prae-cli 0.8.0 → 0.9.2

package/lib/{cli-UAE968If.js → cli-B_B6-bUZ.js}

@@ -1,9 +1,11 @@
-import { t as evaluate } from "./evaluate-wMPkjcIC.js";
-import { a as renderPacks, c as renderNav, d as FRAMEWORKS, f as cite, i as renderOverview, l as renderShell, n as renderApprovals, o as CONTROLS, r as renderCompliance, s as esc, t as navFor, u as VERDICT_LABEL$1 } from "./views-CCwVXpo2.js";
-import { f as chain, i as fingerprint, l as verifySignature, m as seal, n as readEntries, r as verifyEntries, t as Ledger, u as GENESIS } from "./src-Ciggx9ja.js";
-import { existsSync, readFileSync, readdirSync, statSync, watch } from "node:fs";
+import { n as hostOf, r as withinAny, t as evaluate } from "./evaluate-BqLxhYiP.js";
+import { a as renderPacks, c as renderNav, d as FRAMEWORKS, f as cite, i as renderOverview, l as renderShell, n as renderApprovals, o as CONTROLS, r as renderCompliance, s as esc, t as navFor, u as VERDICT_LABEL$1 } from "./views-D4UEfbzt.js";
+import { c as fingerprint, g as chain, m as GENESIS, n as readEntries, p as verifySignature, r as verifyEntries, s as verifyBytes, t as Ledger, v as seal } from "./src-LA7NdLKb.js";
+import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, watch, writeFileSync } from "node:fs";
 import { mkdir, readFile, writeFile } from "node:fs/promises";
-import { dirname, extname, join, normalize, resolve, sep } from "node:path";
+import { basename, dirname, extname, join, normalize, resolve, sep } from "node:path";
+import { createHash } from "node:crypto";
+import { parse } from "yaml";
 import { homedir } from "node:os";
 import { composePatchFile, preflightOps, revisionOf, takeSnapshot } from "dsh-overlay-check";
 import { createServer } from "node:http";
@@ -275,9 +277,9 @@ function readEffect(check$1, path, value) {
 		check$1.fail(path, "expected an object");
 		return;
 	}
-	const kind = value.kind;
-	if (kind !== "deny" && kind !== "ask" && kind !== "correct" && kind !== "warn") {
-		check$1.fail(`${path}.kind`, "expected `deny`, `ask`, `correct`, or `warn`");
+	const kind = value.kind === "hold" ? "ask" : value.kind;
+	if (kind !== "deny" && kind !== "ask" && kind !== "correct" && kind !== "warn" && kind !== "allow") {
+		check$1.fail(`${path}.kind`, "expected `allow`, `deny`, `hold` (or `ask`), `correct`, or `warn`");
 		return;
 	}
 	check$1.keys(path, value, kind === "correct" ? [
@@ -311,6 +313,7 @@ function readRule(check$1, path, value) {
 	check$1.keys(path, value, [
 		"id",
 		"title",
+		"description",
 		"when",
 		"effect",
 		"frameworks"
@@ -329,6 +332,10 @@ function readRule(check$1, path, value) {
 		const title = check$1.text(`${path}.title`, value.title);
 		if (title !== void 0) rule.title = title;
 	}
+	if (value.description !== void 0) {
+		const description = check$1.text(`${path}.description`, value.description);
+		if (description !== void 0) rule.description = description;
+	}
 	if (value.frameworks !== void 0) {
 		const frameworks = readFrameworks(check$1, `${path}.frameworks`, value.frameworks);
 		if (frameworks !== void 0) rule.frameworks = frameworks;
@@ -389,12 +396,16 @@ function parsePack(source) {
 		"prae",
 		"pack",
 		"version",
+		"description",
+		"owner",
 		"baseline",
 		"rules"
 	]);
 	if (raw.prae !== "0.1") check$1.fail(".prae", "expected `\"0.1\"`; this is the only pack version this build reads");
 	const name = check$1.text(".pack", raw.pack);
 	const version = check$1.text(".version", raw.version);
+	const description = raw.description === void 0 ? void 0 : check$1.text(".description", raw.description);
+	const owner = raw.owner === void 0 ? void 0 : check$1.text(".owner", raw.owner);
 	let baseline;
 	if (raw.baseline !== void 0) if (!isObject(raw.baseline)) check$1.fail(".baseline", "expected an object");
 	else {
@@ -431,12 +442,387 @@ function parsePack(source) {
 			prae: "0.1",
 			pack: name,
 			version,
+			...description === void 0 ? {} : { description },
+			...owner === void 0 ? {} : { owner },
 			...baseline === void 0 ? {} : { baseline },
 			rules
 		}
 	};
 }
 
+//#endregion
+//#region ../dsh/src/chain.ts
+const STAGES = [
+	{
+		id: "untrusted-input",
+		step: 1,
+		name: "UNTRUSTED INPUT",
+		severity: "INFO",
+		definition: "The agent took in content from outside the trust boundary: a read of a path the classifier treats as customer-supplied, or a tool result screening found carrying instructions.",
+		rule: "fs:read of a path under the untrusted globs (default **/tickets/**), or a row whose screening outcome is steer or hold.",
+		owasp: ["ASI01"],
+		atlas: ["AML.T0051.001"],
+		alignment: "Where an indirect prompt injection (ATLAS AML.T0051.001) can enter; the read alone does not show that one did. Unless a screening row says so, nothing here detected an injection."
+	},
+	{
+		id: "credential-access",
+		step: 2,
+		name: "CREDENTIAL ACCESS",
+		severity: "HIGH",
+		definition: "The agent tried to reach a credential: a file that is one by its path, or content the inspector found holding one.",
+		rule: "The deciding or a matched rule has a secrets matcher, or the row carries content findings, or the target is under the credential globs (/etc/shadow, **/.ssh/**, **/*.pem, **/.env, …).",
+		owasp: ["ASI03"],
+		atlas: [
+			"AML.TA0013",
+			"AML.T0055",
+			"AML.T0098"
+		],
+		alignment: "ATLAS tactic Credential Access, with Unsecured Credentials (a credential in a file) and AI Agent Tool Credential Harvesting (an agent tool used to collect one)."
+	},
+	{
+		id: "exfiltration",
+		step: 3,
+		name: "EXFILTRATION ATTEMPT",
+		severity: "CRITICAL",
+		definition: "The agent tried to send a request to a destination outside the egress list: through the fetch tool, or a network client in the shell.",
+		rule: "A matched rule has a host matcher on a net:fetch call, or a command matcher naming a network client on a proc:spawn call, and the request is not stage 4.",
+		owasp: ["ASI02"],
+		atlas: ["AML.TA0010", "AML.T0086"],
+		alignment: "ATLAS Exfiltration via AI Agent Tool Invocation. The row shows an outbound request to an unapproved host was attempted; it does not show what data the request carried."
+	},
+	{
+		id: "token-abuse",
+		step: 4,
+		name: "TOKEN ABUSE",
+		severity: "CRITICAL",
+		definition: "A stage-3 request whose destination path is a token-issuance endpoint: an attempt to obtain or register a credential outside the trust boundary.",
+		rule: "Stage 3, and the URL path has a segment token, oauth, oauth2 or sts.",
+		owasp: ["ASI03"],
+		atlas: ["AML.TA0013", "AML.TA0010"],
+		alignment: "PRAE-specific: no ATLAS technique is this one-to-one. It is classified from the request; it is enforced by whichever egress rule refused it."
+	},
+	{
+		id: "runaway",
+		step: 5,
+		name: "RUNAWAY BEHAVIOUR",
+		severity: "HIGH",
+		definition: "The agent kept calling past a budget the pack sets for the session.",
+		rule: "The deciding or a matched rule has a count matcher.",
+		owasp: ["ASI08"],
+		atlas: ["AML.T0034.002"],
+		alignment: "ATLAS Agentic Resource Consumption. OWASP ASI08 (Cascading Failures) is the nearest Agentic entry, not an equivalent."
+	}
+];
+/** Paths whose content the classifier treats as from outside the boundary. */
+const UNTRUSTED_GLOBS = ["**/tickets/**", "./tickets/**"];
+/** Paths that are credentials by location, whatever they contain. */
+const CREDENTIAL_GLOBS = [
+	"/etc/shadow",
+	"/etc/gshadow",
+	"/etc/sudoers",
+	"**/.ssh/**",
+	"**/.aws/**",
+	"**/.gnupg/**",
+	"**/*.pem",
+	"**/*.key",
+	"**/.env",
+	"**/.env.*",
+	"**/credentials/**",
+	"**/.netrc"
+];
+const NETWORK_CLIENTS = new Set([
+	"curl",
+	"wget",
+	"nc",
+	"ncat",
+	"netcat",
+	"ssh",
+	"scp",
+	"sftp",
+	"ftp",
+	"telnet",
+	"openssl"
+]);
+const TOKEN_SEGMENT = new Set([
+	"token",
+	"oauth",
+	"oauth2",
+	"sts"
+]);
+function rulesOf(row$1, pack) {
+	if (pack === void 0) return [];
+	const ids = [row$1.rule, ...(row$1.trace ?? []).map((t) => t.rule)].filter((id) => id !== void 0);
+	return [...new Set(ids)].map((id) => pack.rules.find((r) => r.id === id)).filter((r) => r !== void 0);
+}
+function pathOf(url) {
+	try {
+		return new URL(url).pathname.toLowerCase().split("/").filter(Boolean);
+	} catch {
+		return [];
+	}
+}
+const stage = (id) => STAGES.find((s) => s.id === id);
+/**
+* The stage of one row, or undefined when the row is not an attack-chain
+* step. Reads only the sealed row and the pack; the same inputs give the
+* same answer every time. Checked in order: budget, credential, egress,
+* untrusted input. The first that holds decides.
+*/
+function classify(row$1, pack) {
+	if (row$1.tool.startsWith("prae:")) return void 0;
+	const rules = rulesOf(row$1, pack);
+	const target = row$1.subject ?? "";
+	const budget = rules.find((r) => r.when.count !== void 0);
+	if (budget !== void 0) return {
+		stage: stage("runaway"),
+		basis: `${budget.id} is a session budget (count above ${budget.when.count?.above})`
+	};
+	const secrets = rules.find((r) => r.when.secrets !== void 0);
+	if (secrets !== void 0 || (row$1.secrets?.length ?? 0) > 0) return {
+		stage: stage("credential-access"),
+		basis: secrets !== void 0 ? `${secrets.id} inspects content for credentials, and matched` : `content inspection found ${row$1.secrets?.length} credential finding(s)`
+	};
+	if (target !== "" && (row$1.capability === "fs:read" || row$1.capability === "fs:write" || row$1.capability === "proc:spawn") && withinAny(target, CREDENTIAL_GLOBS)) return {
+		stage: stage("credential-access"),
+		basis: `the target ${target} is a credential by its path`
+	};
+	const host = rules.find((r) => r.when.host !== void 0);
+	const shell = row$1.capability === "proc:spawn" && row$1.command !== void 0 && NETWORK_CLIENTS.has(row$1.command.program) ? rules.find((r) => r.when.command !== void 0) : void 0;
+	const egress = row$1.capability === "net:fetch" ? host : shell;
+	if (egress !== void 0) {
+		const token = row$1.capability === "net:fetch" ? pathOf(target).find((s) => TOKEN_SEGMENT.has(s)) : void 0;
+		const where = row$1.capability === "net:fetch" ? `the destination ${hostOf(target) ?? target} is outside the egress list` : `the shell ran the network client ${row$1.command?.program}`;
+		return token !== void 0 ? {
+			stage: stage("token-abuse"),
+			basis: `${where} (${egress.id}), and the path names a token endpoint (/${token})`
+		} : {
+			stage: stage("exfiltration"),
+			basis: `${where} (${egress.id})`
+		};
+	}
+	if (row$1.screening !== void 0 && (row$1.screening.outcome === "steer" || row$1.screening.outcome === "hold")) return {
+		stage: stage("untrusted-input"),
+		basis: `screening found instructions in the content (${row$1.screening.outcome})`
+	};
+	if (row$1.capability === "fs:read" && target !== "" && withinAny(target, UNTRUSTED_GLOBS)) return {
+		stage: stage("untrusted-input"),
+		basis: `${target} is customer-supplied content`
+	};
+}
+const EXECUTION_LABEL = {
+	"blocked-before-execution": "BLOCKED BEFORE EXECUTION",
+	"held-before-execution": "HELD BEFORE EXECUTION",
+	"executed-output-withheld": "EXECUTED · DETECTED AFTER EXECUTION",
+	"executed-shadow": "EXECUTED · SHADOW (WOULD HAVE BEEN REFUSED)",
+	executed: "EXECUTED",
+	permitted: "PERMITTED"
+};
+/**
+* Whether the call ran, from the row alone. A refusal before execution and
+* a result withheld after it are different claims, and the row says which:
+* `phase: output` is the second.
+*/
+function executionOf(row$1) {
+	if (row$1.tool.startsWith("prae:")) return void 0;
+	const refused = row$1.verdict === "deny" || row$1.verdict === "correct";
+	if (row$1.shadow === true && (refused || row$1.verdict === "ask")) return "executed-shadow";
+	if (row$1.phase === "output") return refused ? "executed-output-withheld" : "executed";
+	if (refused) return "blocked-before-execution";
+	if (row$1.verdict === "ask") return "held-before-execution";
+	return row$1.executed === true ? "executed" : "permitted";
+}
+/**
+* The Attack Chain Integrity Matrix: every classified row, in ledger order,
+* from attempted action to the seal that proves it. The Guardian comes from
+* the catalogue the caller passes; the rest is the row's own.
+*/
+function integrityMatrix(entries, pack, guardianOf = () => void 0) {
+	const out = [];
+	for (const row$1 of entries) {
+		const c = classify(row$1, pack);
+		const execution = executionOf(row$1);
+		if (c === void 0 || execution === void 0) continue;
+		const rule = row$1.rule ?? row$1.trace?.[0]?.rule;
+		const mismatch = entries.find((e) => e.rule === "skill.capability_mismatch" && e.about === row$1.seq)?.seq;
+		out.push({
+			seq: row$1.seq,
+			at: row$1.at,
+			action: row$1.tool,
+			...row$1.subject === void 0 ? {} : { target: row$1.subject },
+			...row$1.capability === void 0 ? {} : { capability: row$1.capability },
+			...guardianOf(rule) === void 0 ? {} : { guardian: guardianOf(rule) },
+			...rule === void 0 ? {} : {
+				rule,
+				ruleRole: row$1.rule === void 0 ? "recorded" : "decided"
+			},
+			decision: row$1.verdict.toUpperCase(),
+			...row$1.reason === void 0 ? {} : { reason: row$1.reason },
+			execution: EXECUTION_LABEL[execution],
+			stage: `${c.stage.step}/5 ${c.stage.name}`,
+			basis: c.basis,
+			...mismatch === void 0 ? {} : { mismatch },
+			hash: row$1.hash,
+			prev: row$1.prev,
+			signed: row$1.sig !== void 0
+		});
+	}
+	return out;
+}
+
+//#endregion
+//#region ../dsh/src/packset.ts
+const PACK_FILE = /\.prae\.(json|ya?ml)$/;
+/** Read one pack file: its parsed pack, or why it cannot be one. */
+function readPackFile(file, policyKey, origin = "workspace") {
+	let bytes;
+	try {
+		bytes = readFileSync(file);
+	} catch (e) {
+		return {
+			file,
+			reason: `unreadable: ${e instanceof Error ? e.message : String(e)}`
+		};
+	}
+	const sha256 = createHash("sha256").update(bytes).digest("hex");
+	if (policyKey !== void 0) {
+		let signature = "";
+		try {
+			signature = readFileSync(`${file}.sig`, "utf8");
+		} catch {}
+		if (signature === "") return {
+			file,
+			reason: `unsigned: no ${file.split("/").at(-1)}.sig beside it, and a policy key is pinned`
+		};
+		if (!verifyBytes(bytes, signature, policyKey)) return {
+			file,
+			reason: `not signed by the policy key ${fingerprint(policyKey)} (edited after signing, or signed by another key)`
+		};
+	}
+	let json = bytes.toString("utf8");
+	if (/\.ya?ml$/.test(file)) try {
+		json = JSON.stringify(parse(json));
+	} catch (e) {
+		return {
+			file,
+			reason: `invalid YAML: ${e instanceof Error ? e.message : String(e)}`
+		};
+	}
+	const parsed = parsePack(json);
+	if (!parsed.ok) return {
+		file,
+		reason: parsed.errors.map((e) => `${e.path || "<root>"}: ${e.message}`).join("; ")
+	};
+	return {
+		file,
+		pack: parsed.pack,
+		origin,
+		sha256,
+		...policyKey === void 0 ? {} : { signedBy: fingerprint(policyKey) }
+	};
+}
+/** Load, validate and merge every pack in a directory. Never throws. */
+function loadPackDir(dir, policyKey, accept, builtin) {
+	const packs = [];
+	const rejected = [];
+	const ids = /* @__PURE__ */ new Map();
+	let baselineFrom;
+	let names = [];
+	try {
+		names = readdirSync(resolve(dir)).filter((n) => PACK_FILE.test(n)).sort();
+	} catch (e) {
+		rejected.push({
+			file: dir,
+			reason: `no such directory: ${e instanceof Error ? e.message : String(e)}`
+		});
+	}
+	const candidates = [...builtin === void 0 ? [] : [builtin], ...names.map((name) => readPackFile(join(resolve(dir), name), policyKey))];
+	for (const read of candidates) {
+		const file = read.file;
+		const name = file.split("/").at(-1) ?? file;
+		if (!("pack" in read)) {
+			rejected.push(read);
+			continue;
+		}
+		const refused = accept?.(read);
+		if (refused !== void 0) {
+			rejected.push({
+				file,
+				reason: refused
+			});
+			continue;
+		}
+		const foreign = read.origin === "workspace" ? read.pack.rules.find((r) => !r.id.startsWith("ORG-")) : void 0;
+		if (foreign !== void 0) {
+			rejected.push({
+				file,
+				reason: `rule id ${foreign.id} must start with ORG-; workspace rules are the organisation's own, and other ids belong to built-in packs`
+			});
+			continue;
+		}
+		const clash = read.pack.rules.find((r) => ids.has(r.id));
+		if (clash !== void 0) {
+			rejected.push({
+				file,
+				reason: `rule id ${clash.id} is already defined by ${ids.get(clash.id)}; rule ids must be unique across the workspace`
+			});
+			continue;
+		}
+		if (read.pack.baseline !== void 0 && baselineFrom !== void 0) {
+			rejected.push({
+				file,
+				reason: `declares a baseline, and ${baselineFrom} already does; only one pack in a workspace may, so a grant is never widened`
+			});
+			continue;
+		}
+		if (read.pack.baseline !== void 0) baselineFrom = name;
+		for (const r of read.pack.rules) ids.set(r.id, name);
+		packs.push(read);
+	}
+	return merge(packs, rejected);
+}
+/** The packs as one policy, each rule remembering where it came from. */
+function merge(packs, rejected) {
+	const origins = /* @__PURE__ */ new Map();
+	for (const p of packs) for (const r of p.pack.rules) origins.set(r.id, {
+		name: p.pack.pack,
+		version: p.pack.version,
+		sha256: p.sha256,
+		origin: p.origin
+	});
+	if (packs.length === 0) return {
+		packs,
+		rejected,
+		origins,
+		effective: {
+			prae: "0.1",
+			pack: "no-valid-pack",
+			version: "0",
+			rules: [{
+				id: "PRAE-NO-PACK",
+				when: {},
+				effect: {
+					kind: "deny",
+					because: `no valid policy pack is loaded, so nothing runs (${rejected.length === 0 ? "no policy pack found" : rejected.map((r) => `${r.file.split("/").at(-1)}: ${r.reason}`).join(" · ")})`
+				}
+			}]
+		}
+	};
+	const baseline = packs.find((p) => p.pack.baseline !== void 0)?.pack.baseline;
+	const only = packs.length === 1 ? packs[0] : void 0;
+	return {
+		packs,
+		rejected,
+		origins,
+		effective: {
+			prae: "0.1",
+			pack: only?.pack.pack ?? packs.map((p) => p.pack.pack).join("+"),
+			version: only?.pack.version ?? createHash("sha256").update(packs.map((p) => p.sha256).join("")).digest("hex").slice(0, 12),
+			...baseline === void 0 ? {} : { baseline },
+			rules: packs.flatMap((p) => p.pack.rules)
+		}
+	};
+}
+
 //#endregion
 //#region src/console/ledger.ts
 function ago(iso, now) {
@@ -763,6 +1149,7 @@ function praeRow(options) {
 	if (options.ledger !== void 0) lines.push(`        ledger: ${JSON.stringify(options.ledger)}`);
 	if (options.approver !== void 0) lines.push(`        approver: ${JSON.stringify(options.approver)}`);
 	if (options.mode !== void 0) lines.push(`        mode: ${options.mode}`);
+	if (options.packDir !== void 0) lines.push(`        packDir: ${JSON.stringify(options.packDir)}`);
 	if (options.packFile !== void 0) lines.push(`        packFile: ${JSON.stringify(options.packFile)}`);
 	else lines.push("        pack: |", indent(options.pack ?? "", 10));
 	return lines.join("\n");
@@ -832,6 +1219,7 @@ const DEFAULT_FILES = {
 	report: "security-report.json",
 	guardians: "guardians.json",
 	pack: "papaya.prae.json",
+	packs: ".prae/packs",
 	publicKey: "prae-signing.pub.pem",
 	redteam: "../redteam/results"
 };
@@ -849,12 +1237,358 @@ function readRedteam(dir, files) {
 	const root = resolve(dir, files.redteam);
 	if (!existsSync(root)) return {
 		campaign: null,
-		runs: []
+		runs: [],
+		steering: []
 	};
 	const runs = readdirSync(root).filter((n) => n.endsWith(".json")).sort().filter((n) => n !== "campaign.json").map((n) => jsonOrNull(resolve(root, n))).filter((r) => r !== null);
+	const steeringDir = resolve(root, "steering");
+	const steering = existsSync(steeringDir) ? readdirSync(steeringDir).filter((n) => n.endsWith(".json")).sort().map((n) => jsonOrNull(resolve(steeringDir, n))).filter((r) => r !== null && typeof r === "object" && "objective" in r) : [];
 	return {
 		campaign: jsonOrNull(resolve(root, "campaign.json")),
-		runs
+		runs,
+		steering
+	};
+}
+
+//#endregion
+//#region ../controls/src/scope.ts
+const ROW_LIMIT = 50;
+/** A framework's edition, read from its versioned id (`…-2026`). */
+const versionOf = (id) => /(\d{4})$/.exec(id)?.[1];
+/** Where a built-in control belongs, and its code within it. */
+function placeOf(control) {
+	const found = Object.entries(FRAMEWORKS).find(([, f]) => control.id.startsWith(`${f.short} · `));
+	if (found !== void 0) return {
+		framework: {
+			id: found[0],
+			name: found[1].name
+		},
+		id: control.id.slice(found[1].short.length + 3)
+	};
+	return {
+		framework: control.standard ?? {
+			id: "obligations",
+			name: "Obligations"
+		},
+		id: control.code ?? control.id.split(" · ")[1] ?? control.id
+	};
+}
+/** A control defined as data: evidence is the rows under its mapped rules. */
+function fromData(def) {
+	const types = new Set(def.evidence_types ?? [
+		"allow",
+		"deny",
+		"ask"
+	]);
+	const trace = (data) => {
+		const ids = new Set(def.prae_controls);
+		return {
+			rules: [...def.prae_controls],
+			rows: data.entries.filter((e) => e.rule !== void 0 && ids.has(e.rule) && types.has(e.verdict))
+		};
+	};
+	return {
+		id: def.id,
+		...def.name === void 0 ? {} : { name: def.name },
+		asks: def.asks,
+		trace,
+		evidence: (data) => {
+			const inPack = new Set((data.pack?.rules ?? []).map((r) => r.id));
+			const present = def.prae_controls.filter((id) => inPack.has(id));
+			const rows = trace(data).rows.length;
+			if (rows > 0) return {
+				state: "covered",
+				note: `${def.prae_controls.length} PRAE control${def.prae_controls.length === 1 ? "" : "s"} mapped (${def.prae_controls.join(", ")}) · ${rows} sealed decision${rows === 1 ? "" : "s"} under them in scope.`
+			};
+			if (present.length > 0) return {
+				state: "partial",
+				note: `${present.length} mapped PRAE control${present.length === 1 ? " is" : "s are"} in the pack (${present.join(", ")}); none has decided a call in scope, so the mapping is declared, not exercised.`
+			};
+			return {
+				state: "absent",
+				note: def.prae_controls.length === 0 ? "No PRAE control is mapped to it." : `The mapped PRAE controls (${def.prae_controls.join(", ")}) are not in this pack.`
+			};
+		}
+	};
+}
+/** The built-in catalog, plus a record's own frameworks when it has any. */
+function catalogOf(file) {
+	const frameworks = /* @__PURE__ */ new Map();
+	const controls = /* @__PURE__ */ new Map();
+	const add = (framework, id, control) => {
+		const key = `${framework.id}:${id}`;
+		if (controls.has(key)) return;
+		controls.set(key, control);
+		let f = frameworks.get(framework.id);
+		if (f === void 0) {
+			f = {
+				...framework,
+				controls: []
+			};
+			frameworks.set(framework.id, f);
+		}
+		f.controls.push({
+			key,
+			id,
+			...control.name === void 0 ? {} : { name: control.name },
+			asks: control.asks
+		});
+	};
+	for (const control of CONTROLS) {
+		const place = placeOf(control);
+		const version = versionOf(place.framework.id);
+		add({
+			id: place.framework.id,
+			name: place.framework.name,
+			...version === void 0 ? {} : { version }
+		}, place.id, control);
+	}
+	for (const f of file?.frameworks ?? []) for (const c of f.controls) add({
+		id: f.id,
+		name: f.name,
+		...f.version === void 0 ? {} : { version: f.version },
+		...f.description === void 0 ? {} : { description: f.description },
+		custom: true
+	}, c.id, fromData(c));
+	return {
+		frameworks: [...frameworks.values()],
+		controls
+	};
+}
+/** A catalog file, checked: what is wrong with it, or the file. */
+function parseCatalog(raw) {
+	const text = (v) => typeof v === "string" && v.trim() !== "";
+	if (typeof raw !== "object" || raw === null) return "not an object";
+	const frameworks = raw.frameworks;
+	if (!Array.isArray(frameworks)) return "frameworks: expected an array";
+	for (const [i, f] of frameworks.entries()) {
+		if (!text(f?.id) || !/^[a-z0-9][a-z0-9-]*$/.test(f.id)) return `frameworks[${i}].id: lowercase letters, digits and dashes`;
+		if (!text(f.name)) return `frameworks[${i}].name: required`;
+		if (!Array.isArray(f.controls)) return `frameworks[${i}].controls: expected an array`;
+		for (const [j, c] of f.controls.entries()) {
+			const at = `frameworks[${i}].controls[${j}]`;
+			if (!text(c?.id)) return `${at}.id: required`;
+			if (!text(c.asks)) return `${at}.asks: required`;
+			if (!Array.isArray(c.prae_controls) || !c.prae_controls.every((r) => text(r))) return `${at}.prae_controls: expected an array of PRAE rule ids`;
+			if (c.evidence_types !== void 0 && (!Array.isArray(c.evidence_types) || !c.evidence_types.every((t) => [
+				"allow",
+				"deny",
+				"ask"
+			].includes(t)))) return `${at}.evidence_types: allow, deny or ask`;
+		}
+	}
+	return raw;
+}
+/** Everything built in, every agent and session, the whole record. */
+function defaultScope(catalog) {
+	const builtIn = catalog.frameworks.filter((f) => f.custom !== true);
+	return {
+		frameworks: builtIn.map((f) => f.id),
+		controls: builtIn.flatMap((f) => f.controls.map((c) => c.key)),
+		agents: "all",
+		sessions: "all",
+		period: { kind: "all" }
+	};
+}
+/** A scope as saved or sent, checked: what is wrong with it, or the scope. */
+function parseScope(raw) {
+	if (typeof raw !== "object" || raw === null) return "not an object";
+	const r = raw;
+	const strings = (v) => Array.isArray(v) && v.every((s) => typeof s === "string" && s.length <= 200);
+	if (!strings(r.frameworks)) return "frameworks: expected an array of ids";
+	if (!strings(r.controls)) return "controls: expected an array of keys";
+	for (const d of ["agents", "sessions"]) if (r[d] !== "all" && !strings(r[d])) return `${d}: "all" or an array`;
+	const p = r.period;
+	const period = p?.kind === "all" ? { kind: "all" } : p?.kind === "days" && typeof p.days === "number" && Number.isInteger(p.days) && p.days > 0 && p.days <= 3650 ? {
+		kind: "days",
+		days: p.days
+	} : p?.kind === "custom" && typeof p.from === "string" && typeof p.to === "string" && !Number.isNaN(Date.parse(p.from)) && !Number.isNaN(Date.parse(p.to)) && Date.parse(p.from) <= Date.parse(p.to) ? {
+		kind: "custom",
+		from: p.from,
+		to: p.to
+	} : "period: all, the last N days, or a custom from–to range";
+	if (typeof period === "string") return period;
+	return {
+		frameworks: r.frameworks,
+		controls: r.controls,
+		agents: r.agents,
+		sessions: r.sessions,
+		period
+	};
+}
+/** Whether a row falls in the scope's period. */
+function inPeriod(at, period, now) {
+	const t = Date.parse(at);
+	if (period.kind === "all") return true;
+	if (Number.isNaN(t)) return false;
+	if (period.kind === "days") return t >= now - period.days * 864e5;
+	return t >= Date.parse(period.from) && t < Date.parse(period.to) + 864e5;
+}
+/**
+* Assess the scoped controls against the record. The rows are narrowed to
+* the scope's agents, sessions and period before any control reads them;
+* the chain's verification stays the whole record's, since integrity is a
+* property of the chain, not of a slice of it.
+*/
+function assess(data, scope, catalog, options) {
+	const now = options.now ?? Date.now();
+	const agentOf$1 = (e) => e.agent ?? options.agent;
+	const admitted = data.entries.filter((e) => (scope.agents === "all" || scope.agents.includes(agentOf$1(e))) && (scope.sessions === "all" || e.session !== void 0 && scope.sessions.includes(e.session)) && inPeriod(e.at, scope.period, now));
+	const scoped = {
+		...data,
+		entries: admitted
+	};
+	const frameworksOn = new Set(scope.frameworks);
+	const controlsOn = new Set(scope.controls);
+	const row$1 = (e) => ({
+		seq: e.seq,
+		at: e.at,
+		tool: e.tool,
+		...e.subject === void 0 ? {} : { subject: e.subject },
+		verdict: e.verdict,
+		...e.rule === void 0 ? {} : { rule: e.rule },
+		...e.session === void 0 ? {} : { session: e.session },
+		agent: agentOf$1(e),
+		hash: e.hash
+	});
+	const frameworks = catalog.frameworks.map((f) => {
+		const selected = frameworksOn.has(f.id);
+		const controls = f.controls.map((c) => {
+			const control = catalog.controls.get(c.key);
+			if (!(selected && controlsOn.has(c.key)) || control === void 0) return {
+				...c,
+				inScope: false,
+				state: "not-in-scope",
+				note: "Not in the selected scope, so not assessed.",
+				rules: [],
+				evidence: {
+					count: 0,
+					rows: []
+				}
+			};
+			const found = control.evidence(scoped);
+			const trace = control.trace?.(scoped) ?? {
+				rules: [],
+				rows: []
+			};
+			return {
+				...c,
+				inScope: true,
+				state: found.state,
+				note: found.note,
+				rules: trace.rules,
+				evidence: {
+					count: trace.rows.length,
+					rows: trace.rows.slice(-ROW_LIMIT).reverse().map(row$1)
+				}
+			};
+		});
+		const on$1 = controls.filter((c) => c.inScope);
+		const count = (s) => on$1.filter((c) => c.state === s).length;
+		const { controls: _,...meta } = f;
+		return {
+			...meta,
+			selected,
+			total: controls.length,
+			inScope: on$1.length,
+			covered: count("covered"),
+			partial: count("partial"),
+			absent: count("absent"),
+			controls
+		};
+	});
+	const on = frameworks.flatMap((f) => f.controls.filter((c) => c.inScope));
+	const sessions = /* @__PURE__ */ new Map();
+	for (const e of data.entries) {
+		if (e.session === void 0) continue;
+		const s = sessions.get(e.session);
+		if (s === void 0) sessions.set(e.session, {
+			rows: 1,
+			first: e.at,
+			last: e.at
+		});
+		else {
+			s.rows += 1;
+			s.last = e.at;
+		}
+	}
+	return {
+		scope,
+		frameworks,
+		totals: {
+			frameworks: frameworks.filter((f) => f.inScope > 0).length,
+			controls: on.length,
+			withEvidence: on.filter((c) => c.state !== "absent").length,
+			covered: on.filter((c) => c.state === "covered").length,
+			partial: on.filter((c) => c.state === "partial").length,
+			absent: on.filter((c) => c.state === "absent").length
+		},
+		dimensions: {
+			agents: [...new Set([options.agent, ...data.entries.map(agentOf$1)])],
+			sessions: [...sessions.entries()].map(([id, s]) => ({
+				id,
+				...s
+			})),
+			environment: options.environment
+		},
+		rows: {
+			admitted: admitted.length,
+			total: data.entries.length
+		}
+	};
+}
+
+//#endregion
+//#region src/compliance.ts
+const SCOPE_FILE = ".prae-compliance/scope.json";
+const CATALOG_FILE = "compliance-catalog.json";
+/** The record's catalog: built in, plus its own file when it parses. */
+function catalogFor(dir) {
+	const path = resolve(dir, CATALOG_FILE);
+	if (!existsSync(path)) return { catalog: catalogOf() };
+	let raw;
+	try {
+		raw = JSON.parse(readFileSync(path, "utf8"));
+	} catch {
+		return {
+			catalog: catalogOf(),
+			catalogError: `${CATALOG_FILE}: not JSON`
+		};
+	}
+	const file = parseCatalog(raw);
+	return typeof file === "string" ? {
+		catalog: catalogOf(),
+		catalogError: `${CATALOG_FILE}: ${file}`
+	} : { catalog: catalogOf(file) };
+}
+/** The saved scope, or everything built in when none is saved yet. */
+function scopeFor(dir, catalog) {
+	const path = resolve(dir, SCOPE_FILE);
+	if (!existsSync(path)) return defaultScope(catalog);
+	try {
+		const scope = parseScope(JSON.parse(readFileSync(path, "utf8")));
+		return typeof scope === "string" ? defaultScope(catalog) : scope;
+	} catch {
+		return defaultScope(catalog);
+	}
+}
+/** The agent the record's discovery names, for rows that name none. */
+function agentOf(dir) {
+	try {
+		const discovery = JSON.parse(readFileSync(resolve(dir, "discovery.json"), "utf8"));
+		if (typeof discovery.agent?.name === "string") return discovery.agent.name;
+	} catch {}
+	return "this agent";
+}
+function assessCompliance(record, data) {
+	const { catalog, catalogError } = catalogFor(record.dir);
+	return {
+		...assess(data, scopeFor(record.dir, catalog), catalog, {
+			agent: agentOf(record.dir),
+			environment: basename(resolve(record.dir))
+		}),
+		saved: existsSync(resolve(record.dir, SCOPE_FILE)),
+		...catalogError === void 0 ? {} : { catalogError }
 	};
 }
 
@@ -972,6 +1706,45 @@ function verifyRecord(record, tamper, repair = false) {
 		signatures
 	};
 }
+/** The record's built-in pack and workspace packs, as the gate loads them. */
+function packSetOf(record) {
+	const { dir, files } = record;
+	const packsDir = resolve(dir, files.packs);
+	const builtinPath = resolve(dir, files.pack);
+	return {
+		packsDir,
+		set: loadPackDir(packsDir, void 0, void 0, existsSync(builtinPath) ? readPackFile(builtinPath, void 0, "builtin") : void 0)
+	};
+}
+/**
+* The packs in force for a record (PRA-127): the built-in pack and the
+* workspace's own, read by the gate's loader — each with its origin, version,
+* sha256 and rules — and every workspace pack the loader rejects, with why.
+*/
+function packsOf(record) {
+	const { packsDir, set } = packSetOf(record);
+	return {
+		packs: set.packs.map((p) => ({
+			file: p.file.split("/").at(-1),
+			name: p.pack.pack,
+			version: p.pack.version,
+			...p.pack.description === void 0 ? {} : { description: p.pack.description },
+			...p.pack.owner === void 0 ? {} : { owner: p.pack.owner },
+			sha256: p.sha256,
+			origin: p.origin,
+			rules: p.pack.rules.map((r) => ({
+				id: r.id,
+				...r.title === void 0 ? {} : { title: r.title },
+				kind: r.effect.kind,
+				because: r.effect.because
+			}))
+		})),
+		rejected: set.rejected.filter((r) => r.file !== packsDir).map((r) => ({
+			file: r.file.split("/").at(-1),
+			reason: r.reason
+		}))
+	};
+}
 /**
 * Evidence toward each control, from the pack and the ledger as they are
 * now — the rows the controls package defines, so the console, the exporter and
@@ -988,31 +1761,32 @@ function complianceOf(record) {
 	} catch {
 		entries = [];
 	}
-	const packPath = resolve(dir, files.pack);
-	let pack;
-	if (existsSync(packPath)) {
-		const parsed = parsePack(readFileSync(packPath, "utf8"));
-		if (parsed.ok) pack = parsed.pack;
-	}
+	const { set } = packSetOf(record);
+	const pack = set.packs.length > 0 ? set.effective : void 0;
 	const data = {
 		...pack === void 0 ? {} : { pack },
 		entries,
 		verification: verifyEntries(text),
 		generatedAt: (/* @__PURE__ */ new Date()).toISOString()
 	};
-	return { controls: CONTROLS.map((control) => {
-		const found = Object.entries(FRAMEWORKS).find(([, f]) => control.id.startsWith(`${f.short} · `));
-		const code = found === void 0 ? void 0 : control.id.split(" · ")[1];
-		const named = found === void 0 || code === void 0 ? void 0 : found[1].controls[code];
-		return {
-			id: code ?? control.id,
-			...named === void 0 ? {} : { name: named.name },
-			asks: control.asks,
-			framework: found === void 0 ? "obligation" : found[0],
-			...found === void 0 ? {} : { frameworkName: found[1].name },
-			...control.evidence(data)
-		};
-	}) };
+	return {
+		assessment: assessCompliance(record, data),
+		controls: CONTROLS.map((control) => {
+			const found = Object.entries(FRAMEWORKS).find(([, f]) => control.id.startsWith(`${f.short} · `));
+			const code = found === void 0 ? void 0 : control.id.split(" · ")[1];
+			const named = found === void 0 || code === void 0 ? void 0 : found[1].controls[code];
+			const standard = control.standard;
+			const name = named?.name ?? control.name;
+			return {
+				id: code ?? (standard === void 0 ? control.id : control.id.split(" · ")[1] ?? control.id),
+				...name === void 0 ? {} : { name },
+				asks: control.asks,
+				framework: found?.[0] ?? standard?.id ?? "obligation",
+				...found === void 0 ? standard === void 0 ? {} : { frameworkName: standard.name } : { frameworkName: found[1].name },
+				...control.evidence(data)
+			};
+		})
+	};
 }
 /**
 * The record over HTTP, for the Command Center (apps/console): the same
@@ -1069,6 +1843,10 @@ function handleApi(req, res, record) {
 		json(complianceOf(record));
 		return true;
 	}
+	if (route === "/api/packs") {
+		json(packsOf(record));
+		return true;
+	}
 	if (route === "/api/redteam") {
 		json(readRedteam(dir, files));
 		return true;
@@ -1167,6 +1945,12 @@ const USAGE = `⌜▪⌟ prae — operator policy for agent harnesses
   prae check <pack.json>
       Validate a policy pack and summarise what it enforces.
 
+  prae check <dir> [--policy-key <policy.pub.pem>]
+      Validate a workspace's packs (e.g. .prae/packs) exactly as the gate
+      loads them: every *.prae.json / .yaml in name order, each rejection
+      with its reason, and, with --policy-key, each .sig checked. Exits
+      non-zero if any pack would be rejected.
+
   prae explain <pack.json> <tool> [key=value ...]
       Judge one call against the pack and print the trace. Nothing is executed.
 
@@ -1193,6 +1977,14 @@ const USAGE = `⌜▪⌟ prae — operator policy for agent harnesses
       --checkpoint, also check that nothing before that checkpoint's head
       has been removed or rewritten since it was taken.
 
+  prae chain <ledger.jsonl> --pack <pack.json> [--guardians <guardians.json>]
+              [--key <public.pem>] [--json]
+      The Attack Chain Integrity Matrix: each attack-chain row from the
+      attempted action to its seal — capability, Guardian, rule, decision,
+      whether it ran, the stage and why, the hash and the signature. The
+      stage is classified from the sealed row and the pack, never typed in.
+      Exits non-zero if the chain or (with --key) any signature fails.
+
   prae checkpoint <ledger.jsonl> [--key <private.pem>] [--out <file>]
       Record the ledger's length and head, signed, to keep somewhere the
       ledger's machine cannot write. A chain proves no row inside the file
@@ -1209,6 +2001,20 @@ const USAGE = `⌜▪⌟ prae — operator policy for agent harnesses
       Generate an Ed25519 keypair for signing ledger rows. Prints the
       fingerprint a counterparty pins.
 
+  prae keygen --role operator|policy|ledger [--out <dir>]
+      A keypair whose private half is sealed under a passphrase (asked for
+      without echo, or PRAE_KEY_PASSPHRASE). The operator key signs answers
+      to held calls; the policy key signs packs. Pin the public half in the
+      gate (operator.publicKey / policyKey); the agent can read the sealed
+      file and still cannot sign. The ledger key is for the signer that
+      holds it on the harness's behalf (signerFd): prae-signing.*.
+
+  prae sign-pack <pack.json> --key <policy.key.sealed.pem>
+      Sign a pack's exact bytes with the sealed policy key (passphrase asked
+      without echo, or PRAE_KEY_PASSPHRASE), writing <pack.json>.sig. A gate
+      with policyKey pinned governs only by a signed pack whose version
+      rises; raise the version before signing.
+
   prae receipt <ledger.jsonl> <seq> --key <private.pem> [--out <file>]
       Export one decision as a self-contained signed receipt.
 
@@ -1236,13 +2042,16 @@ const USAGE = `⌜▪⌟ prae — operator policy for agent harnesses
       Read the instruction files at <dir> and propose the rules they imply.
       Proposals only: an existing pack is never modified.
 
-  prae init [--pack <file>] [--profile <dir>] [--ledger <file>]
+  prae init [--pack <file> | --pack-dir <dir>] [--profile <dir>] [--ledger <file>]
                 (no --pack mounts the built-in baseline of 8 high-risk rules)
                   [--approver <name>] [--link] [--shadow] [--apply]
       Compose the overlay row that mounts PRAE with a pack. Prints the
       diff; writes only with --apply. --link points the profile at the
       pack file instead of copying it in, so edits hot-reload; --shadow
       mounts in shadow mode: every verdict sealed, every call let through.
+      --pack-dir adds the workspace's own packs (e.g. .prae/packs) beside
+      that pack, loaded and watched as a set; a set that would not load is
+      not mounted (see \`prae check <dir>\`).
 `;
 function fail(message) {
 	console.error(`prae: ${message}`);
@@ -1263,7 +2072,25 @@ async function loadPack(path) {
 	}
 	return result.pack;
 }
-async function check(path) {
+async function checkDir(dir, keyPath) {
+	let key;
+	if (keyPath !== void 0) try {
+		key = await readFile(keyPath, "utf8");
+	} catch {
+		return fail(`cannot read ${keyPath}`);
+	}
+	const set = loadPackDir(dir, key);
+	for (const p of set.packs) {
+		console.log(`ok        ${p.file.split("/").at(-1)} · ${p.pack.pack} ${p.pack.version} · ${p.pack.rules.length} rules · sha256 ${p.sha256.slice(0, 12)}${p.signedBy === void 0 ? "" : ` · signed ${p.signedBy}`}`);
+		for (const rule of p.pack.rules) console.log(`            ${rule.id.padEnd(14)} ${(rule.effect.kind === "ask" ? "HOLD" : rule.effect.kind.toUpperCase()).padEnd(8)} ${rule.title ?? rule.effect.because}`);
+	}
+	for (const r of set.rejected) console.error(`REJECTED  ${r.file.split("/").at(-1)}\n            ${r.reason}`);
+	if (set.packs.length === 0) console.error("\nNo valid pack: the gate would refuse every call until one loads.");
+	if (set.rejected.length > 0) process.exit(1);
+	console.log(`\n${set.packs.length} pack${set.packs.length === 1 ? "" : "s"} valid · in force as ${set.effective.pack} ${set.effective.version}`);
+}
+async function check(path, argv = []) {
+	if (existsSync(path) && statSync(path).isDirectory()) return checkDir(path, flag(argv, "policy-key"));
 	const pack = await loadPack(path);
 	console.log(`${pack.pack} ${pack.version} — valid`);
 	const baseline = pack.baseline?.capabilities;
@@ -1324,13 +2151,13 @@ async function scanFile(path, packPath, json) {
 * not come up inspecting nothing.
 */
 async function mcp(root, packPath, ledgerPath) {
-	const { serveMcp } = await import("./mcp-doNYU-1C.js");
+	const { serveMcp } = await import("./mcp-BCXbpqu4.js");
 	const { resolve: resolve$1 } = await import("node:path");
 	const bundled = [join(import.meta.dirname, "secret-catcher.prae.json"), join(import.meta.dirname, "..", "..", "..", "examples", "secret-catcher.prae.json")].find((candidate) => existsSync(candidate));
 	const chosen = packPath ?? bundled;
 	if (chosen === void 0) return fail("mcp needs --pack <file>; no bundled secret-catcher found");
 	const pack = await loadPack(chosen);
-	const { Ledger: Ledger$1 } = await import("./src-C9L6NBvu.js");
+	const { Ledger: Ledger$1 } = await import("./src-7X6dO7gC.js");
 	const ledger = ledgerPath === void 0 ? void 0 : Ledger$1.open(ledgerPath);
 	console.error(`prae mcp: serving ${resolve$1(root)} under ${pack.pack} ${pack.version}` + (ledgerPath === void 0 ? " (no ledger)" : ` · ledger ${ledgerPath}`));
 	await serveMcp({
@@ -1382,7 +2209,7 @@ async function explain(path, tool, pairs) {
 * a key that arrived beside it is checked against nothing.
 */
 async function keygen(dir) {
-	const { generateKeypair, fingerprint: fingerprint$1 } = await import("./src-C9L6NBvu.js");
+	const { generateKeypair, fingerprint: fingerprint$1 } = await import("./src-7X6dO7gC.js");
 	const { writeFileSync: writeFileSync$1 } = await import("node:fs");
 	const keys = generateKeypair();
 	const priv = join(dir, "prae-signing.pem");
@@ -1397,12 +2224,77 @@ async function keygen(dir) {
 	console.log("receipts, through a channel they trust. Point the plugin at the");
 	console.log("private key with `signingKey` to sign every row.");
 }
+/**
+* A sealed keypair for a human authority (PRA-106/107): written as
+* `<role>.pub.pem` and `<role>.key.sealed.pem`. The passphrase is never an
+* argument — arguments land in process listings and shell history.
+*/
+async function keygenSealed(role, dir) {
+	if (role !== "operator" && role !== "policy" && role !== "ledger") fail("--role is operator, policy or ledger");
+	const stem = role === "ledger" ? "prae-signing" : role;
+	const { sealedKeypair, fingerprint: fingerprint$1 } = await import("./src-7X6dO7gC.js");
+	const { writeFileSync: writeFileSync$1 } = await import("node:fs");
+	const keys = sealedKeypair(process.env.PRAE_KEY_PASSPHRASE ?? await askHidden("passphrase: "));
+	const pub = join(dir, `${stem}.pub.pem`);
+	const sealed = join(dir, `${stem}.key.sealed.pem`);
+	writeFileSync$1(sealed, keys.sealedPrivateKey, { mode: 384 });
+	writeFileSync$1(pub, keys.publicKey);
+	console.log(`sealed      ${sealed}  (useless without the passphrase)`);
+	console.log(`public      ${pub}`);
+	console.log(`fingerprint ${fingerprint$1(keys.publicKey)}`);
+}
+/** A detached signature over a pack's bytes (PRA-107). */
+async function signPack(packPath, keyPath) {
+	const { signBytes, unsealPrivateKey, fingerprint: fingerprint$1 } = await import("./src-7X6dO7gC.js");
+	const { createPublicKey: createPublicKey$1 } = await import("node:crypto");
+	const bytes = readFileSync(packPath);
+	const parsed = parsePack(bytes.toString("utf8"));
+	if (!parsed.ok) fail(`${packPath} does not parse; nothing signed`);
+	const passphrase = process.env.PRAE_KEY_PASSPHRASE ?? await askHidden("passphrase: ");
+	let key;
+	try {
+		key = unsealPrivateKey(readFileSync(keyPath, "utf8"), passphrase);
+	} catch {
+		fail("wrong passphrase, or not a sealed key");
+	}
+	await writeFile(`${packPath}.sig`, `${signBytes(bytes, key)}\n`);
+	const pub = createPublicKey$1(key).export({
+		type: "spki",
+		format: "pem"
+	});
+	console.log(`signed      ${packPath}.sig  (${parsed.pack.pack} ${parsed.pack.version})`);
+	console.log(`policy key  ${fingerprint$1(pub.toString())}`);
+}
+/** Read a line from the terminal without echoing it. */
+function askHidden(prompt) {
+	const input = process.stdin;
+	if (!input.isTTY) fail("no terminal to ask on: set PRAE_KEY_PASSPHRASE");
+	process.stdout.write(prompt);
+	input.setRawMode(true);
+	input.resume();
+	input.setEncoding("utf8");
+	return new Promise((done) => {
+		let typed = "";
+		const onData = (ch) => {
+			if (ch === "\r" || ch === "\n") {
+				input.setRawMode(false);
+				input.pause();
+				input.off("data", onData);
+				process.stdout.write("\n");
+				done(typed);
+			} else if (ch === "") process.exit(130);
+			else if (ch === "") typed = typed.slice(0, -1);
+			else typed += ch;
+		};
+		input.on("data", onData);
+	});
+}
 async function receipt(path, seq, keyPath, out) {
-	const { Ledger: Ledger$1, makeReceipt, fingerprint: fingerprint$1 } = await import("./src-C9L6NBvu.js");
+	const { Ledger: Ledger$1, makeReceipt, fingerprint: fingerprint$1 } = await import("./src-7X6dO7gC.js");
 	const { readFileSync: readFileSync$1 } = await import("node:fs");
-	const { createPublicKey } = await import("node:crypto");
+	const { createPublicKey: createPublicKey$1 } = await import("node:crypto");
 	const privateKey = readFileSync$1(keyPath, "utf8");
-	const publicKey = createPublicKey(privateKey).export({
+	const publicKey = createPublicKey$1(privateKey).export({
 		type: "spki",
 		format: "pem"
 	}).toString();
@@ -1428,7 +2320,7 @@ async function receipt(path, seq, keyPath, out) {
 * file and sets the exit code, so scripts can branch on it.
 */
 async function verifyReceiptCmd(path) {
-	const { checkReceipt } = await import("./receipt-check-s3Aryyz-.js");
+	const { checkReceipt } = await import("./receipt-check-DQK_gVPc.js");
 	let parsed;
 	try {
 		parsed = JSON.parse(await readFile(path, "utf8"));
@@ -1459,7 +2351,7 @@ async function test(suitePath, packOverride, asJson) {
 	} catch (error) {
 		return fail(`${suitePath} is not valid JSON: ${error instanceof Error ? error.message : error}`);
 	}
-	const { parseSuite, renderSuite, runSuite } = await import("./test-run-XNIRHKOu.js");
+	const { parseSuite, renderSuite, runSuite } = await import("./test-run-CCDgJ0Dp.js");
 	const suite = parseSuite(parsed);
 	if (!suite.ok) {
 		console.error(`prae: ${suitePath} is not a valid test suite`);
@@ -1486,7 +2378,7 @@ async function test(suitePath, packOverride, asJson) {
 	else for (const line of renderSuite(result)) console.log(line);
 	if (!result.ok) process.exit(1);
 }
-async function verify(path, keyPath, checkpointPath) {
+async function verify$1(path, keyPath, checkpointPath) {
 	let ledger;
 	try {
 		ledger = Ledger.open(path);
@@ -1499,14 +2391,14 @@ async function verify(path, keyPath, checkpointPath) {
 		const last = entries.at(-1);
 		console.log(`${result.entries} entries · chain intact${last === void 0 ? "" : ` · seal ${seal(last)}`}`);
 		if (checkpointPath !== void 0) {
-			const { checkCheckpoint } = await import("./checkpoint-DiznOVpS.js");
+			const { checkCheckpoint } = await import("./checkpoint-C_q_Rpa5.js");
 			const publicKey = keyPath === void 0 ? void 0 : readFileSync(keyPath, "utf8");
 			const verdict = checkCheckpoint(entries, JSON.parse(readFileSync(checkpointPath, "utf8")), publicKey);
 			for (const line of verdict.lines) (verdict.ok ? console.log : console.error)(`checkpoint: ${line}`);
 			if (!verdict.ok) process.exitCode = 1;
 		}
 		if (keyPath !== void 0) {
-			const { verifySignature: verifySignature$1, fingerprint: fingerprint$1 } = await import("./src-C9L6NBvu.js");
+			const { verifySignature: verifySignature$1, fingerprint: fingerprint$1 } = await import("./src-7X6dO7gC.js");
 			const { readFileSync: readFileSync$1 } = await import("node:fs");
 			const publicKey = readFileSync$1(keyPath, "utf8");
 			let signed = 0;
@@ -1682,7 +2574,7 @@ async function consoleOut(path, argv) {
 		const [{ ingest }, { extract }, { renderInstructions }] = await Promise.all([
 			import("./src-d4c_n6wd.js"),
 			import("./src-CBGZVvt7.js"),
-			import("./instructions-DulxSqFd.js")
+			import("./instructions-ya0LVnZy.js")
 		]);
 		const read = ingest(instructionsDir);
 		instructionsView = renderInstructions(data, read, extract(read.statements));
@@ -1733,14 +2625,29 @@ async function init(argv) {
 	}
 	const pack = await loadPack(packPath);
 	const source = await readFile(packPath, "utf8");
+	const link = argv.includes("--link");
+	const builtin = link ? { packFile: resolve(packPath) } : { pack: source };
+	const builtinLine = `${pack.pack} ${pack.version} · ${pack.rules.length} rules${link ? ` · linked, edits hot-reload (${resolve(packPath)})` : ""}`;
+	const packDirFlag = flag(argv, "pack-dir");
+	if (packDirFlag === void 0) return writeRow(argv, builtin, builtinLine);
+	const packDir = resolve(packDirFlag);
+	const set = loadPackDir(packDir, void 0, void 0, readPackFile(packPath, void 0, "builtin"));
+	for (const r of set.rejected) console.error(`REJECTED  ${r.file.split("/").at(-1)}: ${r.reason}`);
+	if (set.rejected.length > 0) fail(`not mounting ${packDir}: fix the packs above (prae check ${packDir})`);
+	const custom = set.packs.filter((p) => p.origin === "workspace");
+	return writeRow(argv, {
+		...builtin,
+		packDir
+	}, `${builtinLine}\n            + ${custom.map((p) => `${p.pack.pack} ${p.pack.version}`).join(", ")} · workspace, watched (${packDir})`);
+}
+async function writeRow(argv, source, packLine) {
 	const profileDir = flag(argv, "profile");
 	const profile = profileDir === void 0 ? defaultProfile() : profileAt(profileDir);
 	const ledger = flag(argv, "ledger");
 	const approver = flag(argv, "approver");
-	const link = argv.includes("--link");
 	const shadow = argv.includes("--shadow");
 	const row$1 = praeRow({
-		...link ? { packFile: resolve(packPath) } : { pack: source },
+		...source,
 		...shadow ? { mode: "shadow" } : {},
 		...ledger === void 0 ? {} : { ledger },
 		...approver === void 0 ? {} : { approver }
@@ -1753,7 +2660,7 @@ async function init(argv) {
 	}
 	console.log(`profile     ${profile.dir}`);
 	console.log(`overlay     ${plan.patchPath}`);
-	console.log(`pack        ${pack.pack} ${pack.version} · ${pack.rules.length} rules${link ? ` · linked, edits hot-reload (${resolve(packPath)})` : ""}`);
+	console.log(`pack        ${packLine}`);
 	if (shadow) console.log("mode        shadow · every verdict sealed, every call proceeds");
 	if (ledger !== void 0) console.log(`ledger      ${ledger}`);
 	if (plan.findings.length > 0) {
@@ -1780,8 +2687,55 @@ async function init(argv) {
 		return fail(error instanceof Error ? error.message : String(error));
 	}
 }
+/** `prae chain`: the Attack Chain Integrity Matrix, from the record alone (PRA-128). */
+async function chainMatrix(path, argv) {
+	const packPath = flag(argv, "pack");
+	if (packPath === void 0) fail("chain needs --pack <pack.json>");
+	const pack = await loadPack(packPath);
+	let ledger;
+	try {
+		ledger = Ledger.open(path);
+	} catch (error) {
+		return fail(error instanceof Error ? error.message : String(error));
+	}
+	const entries = ledger.read();
+	const chainOk = ledger.verify().ok;
+	const guardiansPath = flag(argv, "guardians");
+	const catalogue = guardiansPath === void 0 ? [] : JSON.parse(readFileSync(guardiansPath, "utf8")).guardians;
+	const guardianOf = (rule) => rule === void 0 ? void 0 : catalogue.find((g) => g.rules.includes(rule) || (g.armed ?? []).includes(rule))?.name;
+	const keyPath = flag(argv, "key");
+	const { verifySignature: verifySignature$1 } = await import("./src-7X6dO7gC.js");
+	const publicKey = keyPath === void 0 ? void 0 : readFileSync(keyPath, "utf8");
+	const matrix = integrityMatrix(entries, pack, guardianOf).map((m) => {
+		const entry = entries.find((e) => e.seq === m.seq);
+		return {
+			...m,
+			verified: publicKey === void 0 || entry?.sig === void 0 ? void 0 : verifySignature$1(entry, entry.sig, publicKey)
+		};
+	});
+	const sigFailed = matrix.some((m) => m.verified === false);
+	if (argv.includes("--json")) console.log(JSON.stringify({
+		chain: chainOk,
+		rows: matrix
+	}, null, 2));
+	else {
+		for (const m of matrix) {
+			console.log(`#${m.seq}  ${m.stage}`);
+			console.log(`      attempted   ${m.action}${m.target ? ` ${m.target}` : ""}`);
+			console.log(`      capability  ${m.capability ?? "—"}`);
+			console.log(`      guardian    ${m.guardian ?? "—"}`);
+			console.log(`      rule        ${m.rule === void 0 ? "— (no rule matched)" : m.ruleRole === "recorded" ? `${m.rule} (matched and recorded; did not decide)` : m.rule}`);
+			console.log(`      decision    ${m.decision} · ${m.execution}`);
+			console.log(`      basis       ${m.basis}`);
+			if (m.mismatch !== void 0) console.log(`      mismatch    row #${m.mismatch} (sealed link)`);
+			console.log(`      evidence    hash ${m.hash.slice(0, 16)} · prev ${m.prev.slice(0, 16)} · ${m.verified === void 0 ? m.signed ? "signed" : "unsigned" : m.verified ? "signature verifies" : "SIGNATURE FAILS"}`);
+		}
+		console.log(`\n${matrix.length} attack-chain rows · chain ${chainOk ? "intact" : "BROKEN"}${publicKey === void 0 ? "" : sigFailed ? " · signatures FAIL" : " · signatures verify"}`);
+	}
+	if (!chainOk || sigFailed) process.exitCode = 1;
+}
 async function checkpoint(path, keyPath, out) {
-	const { makeCheckpoint } = await import("./checkpoint-DiznOVpS.js");
+	const { makeCheckpoint } = await import("./checkpoint-C_q_Rpa5.js");
 	let ledger;
 	try {
 		ledger = Ledger.open(path);
@@ -1839,8 +2793,8 @@ async function main(argv) {
 	switch (command) {
 		case "check": {
 			const path = rest[0];
-			if (path === void 0) fail("check needs a pack file");
-			return check(path);
+			if (path === void 0) fail("check needs a pack file or directory");
+			return check(path, rest);
 		}
 		case "explain": {
 			const [path, tool, ...pairs] = rest;
@@ -1857,7 +2811,17 @@ async function main(argv) {
 			if (root === void 0) fail("mcp needs --root <dir>; serving without a boundary is not a gate");
 			return mcp(root, flag(rest, "pack"), flag(rest, "ledger"));
 		}
-		case "keygen": return keygen(flag(rest, "out") ?? ".");
+		case "keygen": {
+			const role = flag(rest, "role");
+			if (role !== void 0) return keygenSealed(role, flag(rest, "out") ?? ".");
+			return keygen(flag(rest, "out") ?? ".");
+		}
+		case "sign-pack": {
+			const [path] = rest;
+			const key = flag(rest, "key");
+			if (path === void 0 || key === void 0) fail("sign-pack needs <pack.json> --key <policy.key.sealed.pem>");
+			return signPack(path, key);
+		}
 		case "receipt": {
 			const [path, seq] = rest;
 			const key = flag(rest, "key");
@@ -1873,7 +2837,12 @@ async function main(argv) {
 		case "verify": {
 			const path = rest[0];
 			if (path === void 0) fail("verify needs a ledger file");
-			return verify(path, flag(rest, "key"), flag(rest, "checkpoint"));
+			return verify$1(path, flag(rest, "key"), flag(rest, "checkpoint"));
+		}
+		case "chain": {
+			const path = rest[0];
+			if (path === void 0) fail("chain needs a ledger file");
+			return chainMatrix(path, rest);
 		}
 		case "checkpoint": {
 			const path = rest[0];