prae-cli 0.9.1 → 0.10.0

package/lib/{cli-7yLG89gV.js → cli-DPldZ2ND.js}

@@ -1,438 +1,388 @@
-import { t as evaluate } from "./evaluate-wMPkjcIC.js";
-import { a as renderPacks, c as renderNav, d as FRAMEWORKS, f as cite, i as renderOverview, l as renderShell, n as renderApprovals, o as CONTROLS, r as renderCompliance, s as esc, t as navFor, u as VERDICT_LABEL$1 } from "./views-CIg2ZNG0.js";
-import { _ as seal, f as verifySignature, h as chain, n as readEntries, p as GENESIS, r as verifyEntries, s as fingerprint, t as Ledger } from "./src-D7g4lvaY.js";
-import { existsSync, readFileSync, readdirSync, statSync, watch } from "node:fs";
+import { a as withinAny, r as hostOf, t as evaluate } from "./evaluate-DhoGQw0Z.js";
+import { n as cite, t as FRAMEWORKS } from "./frameworks-BgZHGKiH.js";
+import { t as parsePack } from "./pack-h5n43S0F.js";
+import { a as verifyEntries, b as seal, g as GENESIS, h as verifySignature, l as verifyBytes, n as Ledger, r as readEntries, t as verifyGrowing, u as fingerprint, v as chain } from "./src-Cy-Acrgj.js";
+import { a as renderPacks, c as renderNav, i as renderOverview, l as renderShell, n as renderApprovals, o as CONTROLS, r as renderCompliance, s as esc, t as navFor, u as VERDICT_LABEL$1 } from "./views-CUcixte0.js";
+import { createRequire } from "node:module";
+import { closeSync, existsSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, statSync, watch, writeFileSync } from "node:fs";
 import { mkdir, readFile, writeFile } from "node:fs/promises";
-import { dirname, extname, join, normalize, resolve, sep } from "node:path";
+import { basename, dirname, extname, join, normalize, resolve, sep } from "node:path";
+import { createHash } from "node:crypto";
 import { homedir } from "node:os";
+import { parse } from "yaml";
 import { composePatchFile, preflightOps, revisionOf, takeSnapshot } from "dsh-overlay-check";
 import { createServer } from "node:http";
 
-//#region ../kernel/src/pack.ts
-function isObject(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-var Check = class {
-	errors = [];
-	fail(path, message) {
-		this.errors.push({
-			path,
-			message
-		});
-	}
-	/** Reject any key the shape does not define. */
-	keys(path, value, allowed) {
-		for (const key of Object.keys(value)) if (!allowed.includes(key)) this.fail(`${path}.${key}`, `unknown field \`${key}\`; expected one of ${allowed.map((k) => `\`${k}\``).join(", ")}`);
-	}
-	text(path, value) {
-		if (typeof value !== "string" || value.trim() === "") {
-			this.fail(path, "expected a non-empty string");
-			return;
-		}
-		return value;
-	}
-	/** A field that accepts one name or a list of them. */
-	names(path, value) {
-		if (typeof value === "string") return value;
-		if (Array.isArray(value)) {
-			const out = [];
-			value.forEach((entry, index) => {
-				const one = this.text(`${path}[${index}]`, entry);
-				if (one !== void 0) out.push(one);
-			});
-			return out;
-		}
-		this.fail(path, "expected a string or an array of strings");
-	}
-	globs(path, value) {
-		if (!Array.isArray(value)) {
-			this.fail(path, "expected an array of path globs");
-			return;
-		}
-		const out = [];
-		value.forEach((entry, index) => {
-			const one = this.text(`${path}[${index}]`, entry);
-			if (one !== void 0) out.push(one);
-		});
-		return out;
-	}
-	number(path, value) {
-		if (typeof value !== "number" || !Number.isFinite(value)) {
-			this.fail(path, "expected a finite number");
-			return;
-		}
-		return value;
-	}
-};
-function readCommandMatch(check$1, path, value) {
-	if (!isObject(value)) {
-		check$1.fail(path, "expected an object");
-		return;
-	}
-	check$1.keys(path, value, [
-		"name",
-		"token",
-		"anyToken",
-		"pipedTo",
-		"pipeline"
-	]);
-	if (value.name === void 0 && value.token === void 0 && value.anyToken === void 0 && value.pipedTo === void 0 && value.pipeline === void 0) check$1.fail(path, "expected `name`, `token`, `anyToken`, `pipedTo` or `pipeline`; a command matcher with none matches nothing");
-	const out = {};
-	if (value.token !== void 0) {
-		const tokens = check$1.names(`${path}.token`, value.token);
-		if (tokens !== void 0) out.token = tokens;
-	}
-	if (value.name !== void 0) {
-		const names = check$1.names(`${path}.name`, value.name);
-		if (names !== void 0) out.name = names;
-	}
-	if (value.anyToken !== void 0) {
-		const tokens = check$1.names(`${path}.anyToken`, value.anyToken);
-		if (tokens !== void 0) out.anyToken = tokens;
-	}
-	if (value.pipedTo !== void 0) {
-		const pipes = check$1.names(`${path}.pipedTo`, value.pipedTo);
-		if (pipes !== void 0) out.pipedTo = pipes;
-	}
-	if (value.pipeline !== void 0) {
-		const shapes = check$1.names(`${path}.pipeline`, value.pipeline);
-		if (shapes !== void 0) out.pipeline = shapes;
-	}
-	return out;
-}
-function readPathMatch(check$1, path, value) {
-	if (!isObject(value)) {
-		check$1.fail(path, "expected an object");
-		return;
-	}
-	check$1.keys(path, value, [
-		"arg",
-		"outside",
-		"inside"
-	]);
-	if (value.outside === void 0 && value.inside === void 0) check$1.fail(path, "expected `inside` or `outside`; a path matcher with neither matches nothing");
-	const out = {};
-	if (value.arg !== void 0) {
-		const arg = check$1.text(`${path}.arg`, value.arg);
-		if (arg !== void 0) out.arg = arg;
-	}
-	if (value.outside !== void 0) {
-		const globs = check$1.globs(`${path}.outside`, value.outside);
-		if (globs !== void 0) out.outside = globs;
-	}
-	if (value.inside !== void 0) {
-		const globs = check$1.globs(`${path}.inside`, value.inside);
-		if (globs !== void 0) out.inside = globs;
-	}
-	return out;
-}
-function readHostMatch(check$1, path, value) {
-	if (!isObject(value)) {
-		check$1.fail(path, "expected an object");
-		return;
-	}
-	check$1.keys(path, value, [
-		"arg",
-		"in",
-		"notIn"
-	]);
-	if (value.in === void 0 && value.notIn === void 0) check$1.fail(path, "expected `in` or `notIn`; a host matcher with neither matches nothing");
-	const out = {};
-	if (value.arg !== void 0) {
-		const arg = check$1.text(`${path}.arg`, value.arg);
-		if (arg !== void 0) out.arg = arg;
-	}
-	if (value.in !== void 0) {
-		const list = check$1.globs(`${path}.in`, value.in);
-		if (list !== void 0) out.in = list;
+//#region ../dsh/src/chain.ts
+const STAGES = [
+	{
+		id: "untrusted-input",
+		step: 1,
+		name: "UNTRUSTED INPUT",
+		severity: "INFO",
+		definition: "The agent took in content from outside the trust boundary: a read of a path the classifier treats as customer-supplied, or a tool result screening found carrying instructions.",
+		rule: "fs:read of a path under the untrusted globs (default **/tickets/**), or a row whose screening outcome is steer or hold.",
+		owasp: ["ASI01"],
+		atlas: ["AML.T0051.001"],
+		alignment: "Where an indirect prompt injection (ATLAS AML.T0051.001) can enter; the read alone does not show that one did. Unless a screening row says so, nothing here detected an injection."
+	},
+	{
+		id: "credential-access",
+		step: 2,
+		name: "CREDENTIAL ACCESS",
+		severity: "HIGH",
+		definition: "The agent tried to reach a credential: a file that is one by its path, or content the inspector found holding one.",
+		rule: "The deciding or a matched rule has a secrets matcher, or the row carries content findings, or the target is under the credential globs (/etc/shadow, **/.ssh/**, **/*.pem, **/.env, …).",
+		owasp: ["ASI03"],
+		atlas: [
+			"AML.TA0013",
+			"AML.T0055",
+			"AML.T0098"
+		],
+		alignment: "ATLAS tactic Credential Access, with Unsecured Credentials (a credential in a file) and AI Agent Tool Credential Harvesting (an agent tool used to collect one)."
+	},
+	{
+		id: "exfiltration",
+		step: 3,
+		name: "EXFILTRATION ATTEMPT",
+		severity: "CRITICAL",
+		definition: "The agent tried to send a request to a destination outside the egress list: through the fetch tool, or a network client in the shell.",
+		rule: "A matched rule has a host matcher on a net:fetch call, or a command matcher naming a network client on a proc:spawn call, and the request is not stage 4.",
+		owasp: ["ASI02"],
+		atlas: ["AML.TA0010", "AML.T0086"],
+		alignment: "ATLAS Exfiltration via AI Agent Tool Invocation. The row shows an outbound request to an unapproved host was attempted; it does not show what data the request carried."
+	},
+	{
+		id: "token-abuse",
+		step: 4,
+		name: "TOKEN ABUSE",
+		severity: "CRITICAL",
+		definition: "A stage-3 request whose destination path is a token-issuance endpoint: an attempt to obtain or register a credential outside the trust boundary.",
+		rule: "Stage 3, and the URL path has a segment token, oauth, oauth2 or sts.",
+		owasp: ["ASI03"],
+		atlas: ["AML.TA0013", "AML.TA0010"],
+		alignment: "PRAE-specific: no ATLAS technique is this one-to-one. It is classified from the request; it is enforced by whichever egress rule refused it."
+	},
+	{
+		id: "runaway",
+		step: 5,
+		name: "RUNAWAY BEHAVIOUR",
+		severity: "HIGH",
+		definition: "The agent kept calling past a budget the pack sets for the session.",
+		rule: "The deciding or a matched rule has a count matcher.",
+		owasp: ["ASI08"],
+		atlas: ["AML.T0034.002"],
+		alignment: "ATLAS Agentic Resource Consumption. OWASP ASI08 (Cascading Failures) is the nearest Agentic entry, not an equivalent."
 	}
-	if (value.notIn !== void 0) {
-		const list = check$1.globs(`${path}.notIn`, value.notIn);
-		if (list !== void 0) out.notIn = list;
+];
+/** Paths whose content the classifier treats as from outside the boundary. */
+const UNTRUSTED_GLOBS = ["**/tickets/**", "./tickets/**"];
+/** Paths that are credentials by location, whatever they contain. */
+const CREDENTIAL_GLOBS = [
+	"/etc/shadow",
+	"/etc/gshadow",
+	"/etc/sudoers",
+	"**/.ssh/**",
+	"**/.aws/**",
+	"**/.gnupg/**",
+	"**/*.pem",
+	"**/*.key",
+	"**/.env",
+	"**/.env.*",
+	"**/credentials/**",
+	"**/.netrc"
+];
+const NETWORK_CLIENTS = new Set([
+	"curl",
+	"wget",
+	"nc",
+	"ncat",
+	"netcat",
+	"ssh",
+	"scp",
+	"sftp",
+	"ftp",
+	"telnet",
+	"openssl"
+]);
+const TOKEN_SEGMENT = new Set([
+	"token",
+	"oauth",
+	"oauth2",
+	"sts"
+]);
+function rulesOf(row$1, pack) {
+	if (pack === void 0) return [];
+	const ids = [row$1.rule, ...(row$1.trace ?? []).map((t) => t.rule)].filter((id) => id !== void 0);
+	return [...new Set(ids)].map((id) => pack.rules.find((r) => r.id === id)).filter((r) => r !== void 0);
+}
+function pathOf(url) {
+	try {
+		return new URL(url).pathname.toLowerCase().split("/").filter(Boolean);
+	} catch {
+		return [];
 	}
-	return out;
 }
-function readArgMatch(check$1, path, value) {
-	if (!isObject(value)) {
-		check$1.fail(path, "expected an object");
-		return;
+const stage = (id) => STAGES.find((s) => s.id === id);
+/**
+* The stage of one row, or undefined when the row is not an attack-chain
+* step. Reads only the sealed row and the pack; the same inputs give the
+* same answer every time. Checked in order: budget, credential, egress,
+* untrusted input. The first that holds decides.
+*/
+function classify(row$1, pack) {
+	if (row$1.tool.startsWith("prae:")) return void 0;
+	const rules = rulesOf(row$1, pack);
+	const target = row$1.subject ?? "";
+	const budget = rules.find((r) => r.when.count !== void 0);
+	if (budget !== void 0) return {
+		stage: stage("runaway"),
+		basis: `${budget.id} is a session budget (count above ${budget.when.count?.above})`
+	};
+	const secrets = rules.find((r) => r.when.secrets !== void 0);
+	if (secrets !== void 0 || (row$1.secrets?.length ?? 0) > 0) return {
+		stage: stage("credential-access"),
+		basis: secrets !== void 0 ? `${secrets.id} inspects content for credentials, and matched` : `content inspection found ${row$1.secrets?.length} credential finding(s)`
+	};
+	if (target !== "" && (row$1.capability === "fs:read" || row$1.capability === "fs:write" || row$1.capability === "proc:spawn") && withinAny(target, CREDENTIAL_GLOBS)) return {
+		stage: stage("credential-access"),
+		basis: `the target ${target} is a credential by its path`
+	};
+	const host = rules.find((r) => r.when.host !== void 0);
+	const shell = row$1.capability === "proc:spawn" && row$1.command !== void 0 && NETWORK_CLIENTS.has(row$1.command.program) ? rules.find((r) => r.when.command !== void 0) : void 0;
+	const egress = row$1.capability === "net:fetch" ? host : shell;
+	if (egress !== void 0) {
+		const token = row$1.capability === "net:fetch" ? pathOf(target).find((s) => TOKEN_SEGMENT.has(s)) : void 0;
+		const where = row$1.capability === "net:fetch" ? `the destination ${hostOf(target) ?? target} is outside the egress list` : `the shell ran the network client ${row$1.command?.program}`;
+		return token !== void 0 ? {
+			stage: stage("token-abuse"),
+			basis: `${where} (${egress.id}), and the path names a token endpoint (/${token})`
+		} : {
+			stage: stage("exfiltration"),
+			basis: `${where} (${egress.id})`
+		};
 	}
-	check$1.keys(path, value, [
-		"name",
-		"above",
-		"below",
-		"equals",
-		"oneOf",
-		"present"
-	]);
-	const name = check$1.text(`${path}.name`, value.name);
-	if (name === void 0) return void 0;
-	const out = { name };
-	if (value.above !== void 0) {
-		const n = check$1.number(`${path}.above`, value.above);
-		if (n !== void 0) out.above = n;
-	}
-	if (value.below !== void 0) {
-		const n = check$1.number(`${path}.below`, value.below);
-		if (n !== void 0) out.below = n;
-	}
-	if (value.equals !== void 0) out.equals = value.equals;
-	if (value.oneOf !== void 0) if (!Array.isArray(value.oneOf)) check$1.fail(`${path}.oneOf`, "expected an array");
-	else out.oneOf = value.oneOf;
-	if (value.present !== void 0) if (typeof value.present !== "boolean") check$1.fail(`${path}.present`, "expected a boolean");
-	else out.present = value.present;
-	return out;
+	if (row$1.screening !== void 0 && (row$1.screening.outcome === "steer" || row$1.screening.outcome === "hold")) return {
+		stage: stage("untrusted-input"),
+		basis: `screening found instructions in the content (${row$1.screening.outcome})`
+	};
+	if (row$1.capability === "fs:read" && target !== "" && withinAny(target, UNTRUSTED_GLOBS)) return {
+		stage: stage("untrusted-input"),
+		basis: `${target} is customer-supplied content`
+	};
 }
-function readSecretsMatch(check$1, path, value) {
-	if (!isObject(value)) {
-		check$1.fail(path, "expected an object");
-		return;
-	}
-	check$1.keys(path, value, [
-		"types",
-		"minConfidence",
-		"atLeast"
-	]);
-	const out = {};
-	if (value.types !== void 0) {
-		const types = check$1.globs(`${path}.types`, value.types);
-		if (types !== void 0) out.types = types;
-	}
-	if (value.minConfidence !== void 0) {
-		const n = check$1.number(`${path}.minConfidence`, value.minConfidence);
-		if (n !== void 0) if (n < 0 || n > 1) check$1.fail(`${path}.minConfidence`, "expected a number between 0 and 1");
-		else out.minConfidence = n;
-	}
-	if (value.atLeast !== void 0) {
-		const n = check$1.number(`${path}.atLeast`, value.atLeast);
-		if (n !== void 0) if (!Number.isInteger(n) || n < 1) check$1.fail(`${path}.atLeast`, "expected an integer of at least 1");
-		else out.atLeast = n;
-	}
-	return out;
+const EXECUTION_LABEL = {
+	"blocked-before-execution": "BLOCKED BEFORE EXECUTION",
+	"held-before-execution": "HELD BEFORE EXECUTION",
+	"executed-output-withheld": "EXECUTED · DETECTED AFTER EXECUTION",
+	"executed-shadow": "EXECUTED · SHADOW (WOULD HAVE BEEN REFUSED)",
+	executed: "EXECUTED",
+	permitted: "PERMITTED"
+};
+/**
+* Whether the call ran, from the row alone. A refusal before execution and
+* a result withheld after it are different claims, and the row says which:
+* `phase: output` is the second.
+*/
+function executionOf(row$1) {
+	if (row$1.tool.startsWith("prae:")) return void 0;
+	const refused = row$1.verdict === "deny" || row$1.verdict === "correct";
+	if (row$1.shadow === true && (refused || row$1.verdict === "ask")) return "executed-shadow";
+	if (row$1.phase === "output") return refused ? "executed-output-withheld" : "executed";
+	if (refused) return "blocked-before-execution";
+	if (row$1.verdict === "ask") return "held-before-execution";
+	return row$1.executed === true ? "executed" : "permitted";
 }
-function readMatch(check$1, path, value) {
-	if (!isObject(value)) {
-		check$1.fail(path, "expected an object");
-		return {};
-	}
-	check$1.keys(path, value, [
-		"tool",
-		"capability",
-		"plugin",
-		"agent",
-		"command",
-		"path",
-		"host",
-		"arg",
-		"count",
-		"secrets"
-	]);
-	const out = {};
-	for (const key of [
-		"tool",
-		"capability",
-		"plugin",
-		"agent"
-	]) if (value[key] !== void 0) {
-		const names = check$1.names(`${path}.${key}`, value[key]);
-		if (names !== void 0) out[key] = names;
-	}
-	if (value.command !== void 0) {
-		const match = readCommandMatch(check$1, `${path}.command`, value.command);
-		if (match !== void 0) out.command = match;
-	}
-	if (value.path !== void 0) {
-		const match = readPathMatch(check$1, `${path}.path`, value.path);
-		if (match !== void 0) out.path = match;
-	}
-	if (value.host !== void 0) {
-		const match = readHostMatch(check$1, `${path}.host`, value.host);
-		if (match !== void 0) out.host = match;
-	}
-	if (value.arg !== void 0) if (!Array.isArray(value.arg)) check$1.fail(`${path}.arg`, "expected an array of argument matchers");
-	else {
-		const list = [];
-		value.arg.forEach((entry, index) => {
-			const one = readArgMatch(check$1, `${path}.arg[${index}]`, entry);
-			if (one !== void 0) list.push(one);
+/**
+* The Attack Chain Integrity Matrix: every classified row, in ledger order,
+* from attempted action to the seal that proves it. The Guardian comes from
+* the catalogue the caller passes; the rest is the row's own.
+*/
+function integrityMatrix(entries, pack, guardianOf = () => void 0) {
+	const out = [];
+	for (const row$1 of entries) {
+		const c = classify(row$1, pack);
+		const execution = executionOf(row$1);
+		if (c === void 0 || execution === void 0) continue;
+		const rule = row$1.rule ?? row$1.trace?.[0]?.rule;
+		const mismatch = entries.find((e) => e.rule === "skill.capability_mismatch" && e.about === row$1.seq)?.seq;
+		out.push({
+			seq: row$1.seq,
+			at: row$1.at,
+			action: row$1.tool,
+			...row$1.subject === void 0 ? {} : { target: row$1.subject },
+			...row$1.capability === void 0 ? {} : { capability: row$1.capability },
+			...guardianOf(rule) === void 0 ? {} : { guardian: guardianOf(rule) },
+			...rule === void 0 ? {} : {
+				rule,
+				ruleRole: row$1.rule === void 0 ? "recorded" : "decided"
+			},
+			decision: row$1.verdict.toUpperCase(),
+			...row$1.reason === void 0 ? {} : { reason: row$1.reason },
+			execution: EXECUTION_LABEL[execution],
+			stage: `${c.stage.step}/5 ${c.stage.name}`,
+			basis: c.basis,
+			...mismatch === void 0 ? {} : { mismatch },
+			hash: row$1.hash,
+			prev: row$1.prev,
+			signed: row$1.sig !== void 0
 		});
-		out.arg = list;
-	}
-	if (value.count !== void 0) if (!isObject(value.count)) check$1.fail(`${path}.count`, "expected an object");
-	else {
-		check$1.keys(`${path}.count`, value.count, ["above"]);
-		const above = check$1.number(`${path}.count.above`, value.count.above);
-		if (above !== void 0) out.count = { above };
-	}
-	if (value.secrets !== void 0) {
-		const match = readSecretsMatch(check$1, `${path}.secrets`, value.secrets);
-		if (match !== void 0) out.secrets = match;
 	}
 	return out;
 }
-function readEffect(check$1, path, value) {
-	if (!isObject(value)) {
-		check$1.fail(path, "expected an object");
-		return;
+
+//#endregion
+//#region ../dsh/src/packset.ts
+const PACK_FILE = /\.prae\.(json|ya?ml)$/;
+/** Read one pack file: its parsed pack, or why it cannot be one. */
+function readPackFile(file, policyKey, origin = "workspace") {
+	let bytes;
+	try {
+		bytes = readFileSync(file);
+	} catch (e) {
+		return {
+			file,
+			reason: `unreadable: ${e instanceof Error ? e.message : String(e)}`
+		};
 	}
-	const kind = value.kind;
-	if (kind !== "deny" && kind !== "ask" && kind !== "correct" && kind !== "warn") {
-		check$1.fail(`${path}.kind`, "expected `deny`, `ask`, `correct`, or `warn`");
-		return;
+	const sha256 = createHash("sha256").update(bytes).digest("hex");
+	if (policyKey !== void 0) {
+		let signature = "";
+		try {
+			signature = readFileSync(`${file}.sig`, "utf8");
+		} catch {}
+		if (signature === "") return {
+			file,
+			reason: `unsigned: no ${file.split("/").at(-1)}.sig beside it, and a policy key is pinned`
+		};
+		if (!verifyBytes(bytes, signature, policyKey)) return {
+			file,
+			reason: `not signed by the policy key ${fingerprint(policyKey)} (edited after signing, or signed by another key)`
+		};
 	}
-	check$1.keys(path, value, kind === "correct" ? [
-		"kind",
-		"set",
-		"because"
-	] : ["kind", "because"]);
-	const because = check$1.text(`${path}.because`, value.because);
-	if (because === void 0) return void 0;
-	if (kind === "correct") {
-		if (!isObject(value.set) || Object.keys(value.set).length === 0) {
-			check$1.fail(`${path}.set`, "expected a non-empty object of arguments to set");
-			return;
-		}
+	let json = bytes.toString("utf8");
+	if (/\.ya?ml$/.test(file)) try {
+		json = JSON.stringify(parse(json));
+	} catch (e) {
 		return {
-			kind,
-			set: value.set,
-			because
+			file,
+			reason: `invalid YAML: ${e instanceof Error ? e.message : String(e)}`
 		};
 	}
-	return {
-		kind,
-		because
+	const parsed$1 = parsePack(json);
+	if (!parsed$1.ok) return {
+		file,
+		reason: parsed$1.errors.map((e) => `${e.path || "<root>"}: ${e.message}`).join("; ")
 	};
-}
-function readRule(check$1, path, value) {
-	if (!isObject(value)) {
-		check$1.fail(path, "expected an object");
-		return;
-	}
-	check$1.keys(path, value, [
-		"id",
-		"title",
-		"when",
-		"effect",
-		"frameworks"
-	]);
-	const id = check$1.text(`${path}.id`, value.id);
-	const effect = readEffect(check$1, `${path}.effect`, value.effect);
-	if (value.when === void 0) check$1.fail(`${path}.when`, "expected an object");
-	const when = readMatch(check$1, `${path}.when`, value.when ?? {});
-	if (id === void 0 || effect === void 0) return void 0;
-	const rule = {
-		id,
-		when,
-		effect
+	return {
+		file,
+		pack: parsed$1.pack,
+		origin,
+		sha256,
+		...policyKey === void 0 ? {} : { signedBy: fingerprint(policyKey) }
 	};
-	if (value.title !== void 0) {
-		const title = check$1.text(`${path}.title`, value.title);
-		if (title !== void 0) rule.title = title;
-	}
-	if (value.frameworks !== void 0) {
-		const frameworks = readFrameworks(check$1, `${path}.frameworks`, value.frameworks);
-		if (frameworks !== void 0) rule.frameworks = frameworks;
-	}
-	return rule;
 }
-/**
-* A citation names a framework edition and controls the registry knows. A
-* typo here would be a rule that claims a mapping no view can render, so it
-* is a pack error rather than an ignored key — the same line the rest of the
-* parser takes.
-*/
-function readFrameworks(check$1, path, value) {
-	if (!isObject(value)) {
-		check$1.fail(path, "expected an object keyed by framework id");
-		return;
+/** Load, validate and merge every pack in a directory. Never throws. */
+function loadPackDir(dir, policyKey, accept, builtin) {
+	const packs = [];
+	const rejected = [];
+	const ids = /* @__PURE__ */ new Map();
+	let baselineFrom;
+	let names = [];
+	try {
+		names = readdirSync(resolve(dir)).filter((n) => PACK_FILE.test(n)).sort();
+	} catch (e) {
+		rejected.push({
+			file: dir,
+			reason: `no such directory: ${e instanceof Error ? e.message : String(e)}`
+		});
 	}
-	const out = {};
-	for (const [framework, controls] of Object.entries(value)) {
-		const known = FRAMEWORKS[framework];
-		if (known === void 0) {
-			check$1.fail(`${path}.${framework}`, `unknown framework; expected one of ${Object.keys(FRAMEWORKS).map((k) => `\`${k}\``).join(", ")}`);
+	const candidates = [...builtin === void 0 ? [] : [builtin], ...names.map((name) => readPackFile(join(resolve(dir), name), policyKey))];
+	for (const read of candidates) {
+		const file = read.file;
+		const name = file.split("/").at(-1) ?? file;
+		if (!("pack" in read)) {
+			rejected.push(read);
 			continue;
 		}
-		if (!Array.isArray(controls) || !controls.every((c) => typeof c === "string")) {
-			check$1.fail(`${path}.${framework}`, "expected an array of control ids");
+		const refused = accept?.(read);
+		if (refused !== void 0) {
+			rejected.push({
+				file,
+				reason: refused
+			});
 			continue;
 		}
-		const ids = controls;
-		for (const control of ids) if (known.controls[control] === void 0) check$1.fail(`${path}.${framework}`, `unknown control \`${control}\` in ${known.name}`);
-		if (ids.length > 0) out[framework] = [...new Set(ids)];
-	}
-	return out;
-}
-/** Parse and validate a pack. Never throws; every problem lands in `errors`. */
-function parsePack(source) {
-	let raw;
-	try {
-		raw = JSON.parse(source);
-	} catch (error) {
-		return {
-			ok: false,
-			errors: [{
-				path: "",
-				message: `invalid JSON: ${error instanceof Error ? error.message : String(error)}`
+		const foreign = read.origin === "workspace" ? read.pack.rules.find((r) => !r.id.startsWith("ORG-")) : void 0;
+		if (foreign !== void 0) {
+			rejected.push({
+				file,
+				reason: `rule id ${foreign.id} must start with ORG-; workspace rules are the organisation's own, and other ids belong to built-in packs`
+			});
+			continue;
+		}
+		const clash = read.pack.rules.find((r) => ids.has(r.id));
+		if (clash !== void 0) {
+			rejected.push({
+				file,
+				reason: `rule id ${clash.id} is already defined by ${ids.get(clash.id)}; rule ids must be unique across the workspace`
+			});
+			continue;
+		}
+		if (read.pack.baseline !== void 0 && baselineFrom !== void 0) {
+			rejected.push({
+				file,
+				reason: `declares a baseline, and ${baselineFrom} already does; only one pack in a workspace may, so a grant is never widened`
+			});
+			continue;
+		}
+		if (read.pack.baseline !== void 0) baselineFrom = name;
+		for (const r of read.pack.rules) ids.set(r.id, name);
+		packs.push(read);
+	}
+	return merge(packs, rejected);
+}
+/** The packs as one policy, each rule remembering where it came from. */
+function merge(packs, rejected) {
+	const origins = /* @__PURE__ */ new Map();
+	for (const p of packs) for (const r of p.pack.rules) origins.set(r.id, {
+		name: p.pack.pack,
+		version: p.pack.version,
+		sha256: p.sha256,
+		origin: p.origin
+	});
+	if (packs.length === 0) return {
+		packs,
+		rejected,
+		origins,
+		effective: {
+			prae: "0.1",
+			pack: "no-valid-pack",
+			version: "0",
+			rules: [{
+				id: "PRAE-NO-PACK",
+				when: {},
+				effect: {
+					kind: "deny",
+					because: `no valid policy pack is loaded, so nothing runs (${rejected.length === 0 ? "no policy pack found" : rejected.map((r) => `${r.file.split("/").at(-1)}: ${r.reason}`).join(" · ")})`
+				}
 			}]
-		};
-	}
-	const check$1 = new Check();
-	if (!isObject(raw)) return {
-		ok: false,
-		errors: [{
-			path: "",
-			message: "expected an object"
-		}]
-	};
-	check$1.keys("", raw, [
-		"prae",
-		"pack",
-		"version",
-		"baseline",
-		"rules"
-	]);
-	if (raw.prae !== "0.1") check$1.fail(".prae", "expected `\"0.1\"`; this is the only pack version this build reads");
-	const name = check$1.text(".pack", raw.pack);
-	const version = check$1.text(".version", raw.version);
-	let baseline;
-	if (raw.baseline !== void 0) if (!isObject(raw.baseline)) check$1.fail(".baseline", "expected an object");
-	else {
-		check$1.keys(".baseline", raw.baseline, ["capabilities"]);
-		const caps = check$1.globs(".baseline.capabilities", raw.baseline.capabilities);
-		if (caps !== void 0) baseline = { capabilities: caps };
-	}
-	const rules = [];
-	if (!Array.isArray(raw.rules)) check$1.fail(".rules", "expected an array");
-	else {
-		const seen = /* @__PURE__ */ new Set();
-		raw.rules.forEach((entry, index) => {
-			const rule = readRule(check$1, `rules[${index}]`, entry);
-			if (rule === void 0) return;
-			if (seen.has(rule.id)) {
-				check$1.fail(`rules[${index}].id`, `duplicate rule id \`${rule.id}\``);
-				return;
-			}
-			seen.add(rule.id);
-			rules.push(rule);
-		});
-	}
-	if (check$1.errors.length > 0) return {
-		ok: false,
-		errors: check$1.errors
-	};
-	if (name === void 0 || version === void 0) return {
-		ok: false,
-		errors: check$1.errors
+		}
 	};
+	const baseline = packs.find((p) => p.pack.baseline !== void 0)?.pack.baseline;
+	const only = packs.length === 1 ? packs[0] : void 0;
+	const expires = packs.map((p) => p.pack.expires_at).filter((e) => e !== void 0).sort((a, b) => Date.parse(a) - Date.parse(b))[0];
 	return {
-		ok: true,
-		pack: {
+		packs,
+		rejected,
+		origins,
+		effective: {
 			prae: "0.1",
-			pack: name,
-			version,
+			pack: only?.pack.pack ?? packs.map((p) => p.pack.pack).join("+"),
+			version: only?.pack.version ?? createHash("sha256").update(packs.map((p) => p.sha256).join("")).digest("hex").slice(0, 12),
 			...baseline === void 0 ? {} : { baseline },
-			rules
+			...expires === void 0 ? {} : { expires_at: expires },
+			rules: packs.flatMap((p) => p.pack.rules)
 		}
 	};
 }
@@ -457,7 +407,7 @@ function row(entry, pack) {
         <div class="call">${esc(call)}</div>
         <div class="actor">${esc(actor)}</div>
         <div class="clause">${esc(entry.rule ?? "—")}${cited}</div>
-        <div class="verdict v-${esc(entry.verdict)}">${esc(VERDICT_LABEL$1[entry.verdict] ?? entry.verdict)}</div>
+        <div class="verdict v-${esc(entry.verdict)}">${esc(VERDICT_LABEL$1[entry.verdict] ?? entry.verdict)}${entry.shadow === true ? " · SHADOW" : ""}</div>
         <div class="seal">${esc(seal(entry))}</div>
       </div>`;
 }
@@ -465,12 +415,14 @@ function renderLedgerView(entries, verification, options) {
 	const counts = {};
 	const packs = /* @__PURE__ */ new Set();
 	const sessions = /* @__PURE__ */ new Set();
+	let shadowed = 0;
 	for (const entry of entries) {
-		counts[entry.verdict] = (counts[entry.verdict] ?? 0) + 1;
+		if (entry.shadow === true) shadowed += 1;
+		else counts[entry.verdict] = (counts[entry.verdict] ?? 0) + 1;
 		packs.add(`${entry.pack.name} ${entry.pack.version}`);
 		if (entry.session !== void 0) sessions.add(entry.session);
 	}
-	const held = entries.filter((e) => e.verdict === "ask");
+	const held = entries.filter((e) => e.verdict === "ask" && e.shadow !== true);
 	const pack = [...packs][0] ?? "—";
 	const now = Date.parse(options.generatedAt);
 	const chainOk = verification.ok;
@@ -480,6 +432,7 @@ function renderLedgerView(entries, verification, options) {
         <div class="meta">${esc([
 		`${sessions.size || 1} session${sessions.size === 1 ? "" : "s"}`,
 		`${entries.length.toLocaleString("en-US")} decisions`,
+		...shadowed === 0 ? [] : [`${shadowed} in shadow mode (recorded, not enforced)`],
 		options.retention === void 0 ? "retention local" : `retention ${options.retention}`
 	].join(" · "))}</div>
       </div>
@@ -763,6 +716,7 @@ function praeRow(options) {
 	if (options.ledger !== void 0) lines.push(`        ledger: ${JSON.stringify(options.ledger)}`);
 	if (options.approver !== void 0) lines.push(`        approver: ${JSON.stringify(options.approver)}`);
 	if (options.mode !== void 0) lines.push(`        mode: ${options.mode}`);
+	if (options.packDir !== void 0) lines.push(`        packDir: ${JSON.stringify(options.packDir)}`);
 	if (options.packFile !== void 0) lines.push(`        packFile: ${JSON.stringify(options.packFile)}`);
 	else lines.push("        pack: |", indent(options.pack ?? "", 10));
 	return lines.join("\n");
@@ -814,16 +768,60 @@ function jsonOrNull(path) {
 		return null;
 	}
 }
-function readLedger(path) {
-	if (!existsSync(path)) return [];
-	const out = [];
-	for (const line of readFileSync(path, "utf8").split("\n")) {
+const parsed = /* @__PURE__ */ new Map();
+function parseLines(text, into) {
+	for (const line of text.split("\n")) {
 		if (line.trim() === "") continue;
 		try {
-			out.push(JSON.parse(line));
+			into.push(JSON.parse(line));
 		} catch {}
 	}
-	return out;
+}
+/**
+* The ledger's rows. A ledger is append-only, so the parse is kept and only
+* the bytes appended since are read: a long demo grows it to tens of
+* thousands of rows, and every endpoint the console polls reads it — parsed
+* whole each time, that kept the server too busy to answer anyone. A file
+* that shrank or was replaced is read again from the start. A half-written
+* last line is left unread until its newline arrives.
+*/
+function readLedger(path) {
+	if (!existsSync(path)) {
+		parsed.delete(path);
+		return [];
+	}
+	const stat$1 = statSync(path);
+	let entry = parsed.get(path);
+	if (entry === void 0 || entry.ino !== stat$1.ino || stat$1.size < entry.size) {
+		entry = {
+			ino: stat$1.ino,
+			size: 0,
+			mtimeMs: 0,
+			offset: 0,
+			rows: []
+		};
+		parsed.set(path, entry);
+	}
+	if (stat$1.size !== entry.size || stat$1.mtimeMs !== entry.mtimeMs) {
+		const length = stat$1.size - entry.offset;
+		if (length > 0) {
+			const buf = Buffer.alloc(length);
+			const fd = openSync(path, "r");
+			try {
+				readSync(fd, buf, 0, length, entry.offset);
+			} finally {
+				closeSync(fd);
+			}
+			const end = buf.lastIndexOf(10);
+			if (end >= 0) {
+				parseLines(buf.subarray(0, end).toString("utf8"), entry.rows);
+				entry.offset += end + 1;
+			}
+		}
+		entry.size = stat$1.size;
+		entry.mtimeMs = stat$1.mtimeMs;
+	}
+	return entry.rows.slice();
 }
 /** The defaults the demo writes; a caller with other names overrides them. */
 const DEFAULT_FILES = {
@@ -832,6 +830,7 @@ const DEFAULT_FILES = {
 	report: "security-report.json",
 	guardians: "guardians.json",
 	pack: "papaya.prae.json",
+	packs: ".prae/packs",
 	publicKey: "prae-signing.pub.pem",
 	redteam: "../redteam/results"
 };
@@ -841,7 +840,8 @@ function readRecord(dir, files) {
 		discovery: jsonOrNull(resolve(dir, files.discovery)),
 		report: jsonOrNull(resolve(dir, files.report)),
 		guardians: jsonOrNull(resolve(dir, files.guardians)),
-		pack: jsonOrNull(resolve(dir, files.pack))
+		pack: jsonOrNull(resolve(dir, files.pack)),
+		crownJewel: jsonOrNull(resolve(dir, "crown-jewel.json"))
 	};
 }
 /** The red-team campaign and its runs, as the runner wrote them; empty when none. */
@@ -849,12 +849,362 @@ function readRedteam(dir, files) {
 	const root = resolve(dir, files.redteam);
 	if (!existsSync(root)) return {
 		campaign: null,
-		runs: []
+		runs: [],
+		steering: [],
+		history: []
 	};
 	const runs = readdirSync(root).filter((n) => n.endsWith(".json")).sort().filter((n) => n !== "campaign.json").map((n) => jsonOrNull(resolve(root, n))).filter((r) => r !== null);
+	const steeringDir = resolve(root, "steering");
+	const steering = existsSync(steeringDir) ? readdirSync(steeringDir).filter((n) => n.endsWith(".json")).sort().map((n) => jsonOrNull(resolve(steeringDir, n))).filter((r) => r !== null && typeof r === "object" && "objective" in r) : [];
+	const historyDir = resolve(steeringDir, "history");
+	const history = existsSync(historyDir) ? readdirSync(historyDir).filter((n) => n.endsWith(".json")).sort().reverse().map((n) => jsonOrNull(resolve(historyDir, n))).filter((r) => r !== null) : [];
 	return {
 		campaign: jsonOrNull(resolve(root, "campaign.json")),
-		runs
+		runs,
+		steering,
+		history
+	};
+}
+
+//#endregion
+//#region ../controls/src/scope.ts
+const ROW_LIMIT = 50;
+/** A framework's edition, read from its versioned id (`…-2026`). */
+const versionOf = (id) => /(\d{4})$/.exec(id)?.[1];
+/** Where a built-in control belongs, and its code within it. */
+function placeOf(control) {
+	const found = Object.entries(FRAMEWORKS).find(([, f]) => control.id.startsWith(`${f.short} · `));
+	if (found !== void 0) return {
+		framework: {
+			id: found[0],
+			name: found[1].name
+		},
+		id: control.id.slice(found[1].short.length + 3)
+	};
+	return {
+		framework: control.standard ?? {
+			id: "obligations",
+			name: "Obligations"
+		},
+		id: control.code ?? control.id.split(" · ")[1] ?? control.id
+	};
+}
+/** A control defined as data: evidence is the rows under its mapped rules. */
+function fromData(def) {
+	const types = new Set(def.evidence_types ?? [
+		"allow",
+		"deny",
+		"ask"
+	]);
+	const trace = (data) => {
+		const ids = new Set(def.prae_controls);
+		return {
+			rules: [...def.prae_controls],
+			rows: data.entries.filter((e) => e.rule !== void 0 && ids.has(e.rule) && types.has(e.verdict))
+		};
+	};
+	return {
+		id: def.id,
+		...def.name === void 0 ? {} : { name: def.name },
+		asks: def.asks,
+		trace,
+		evidence: (data) => {
+			const inPack = new Set((data.pack?.rules ?? []).map((r) => r.id));
+			const present = def.prae_controls.filter((id) => inPack.has(id));
+			const rows = trace(data).rows.length;
+			if (rows > 0) return {
+				state: "covered",
+				note: `${def.prae_controls.length} PRAE control${def.prae_controls.length === 1 ? "" : "s"} mapped (${def.prae_controls.join(", ")}) · ${rows} sealed decision${rows === 1 ? "" : "s"} under them in scope.`
+			};
+			if (present.length > 0) return {
+				state: "partial",
+				note: `${present.length} mapped PRAE control${present.length === 1 ? " is" : "s are"} in the pack (${present.join(", ")}); none has decided a call in scope, so the mapping is declared, not exercised.`
+			};
+			return {
+				state: "absent",
+				note: def.prae_controls.length === 0 ? "No PRAE control is mapped to it." : `The mapped PRAE controls (${def.prae_controls.join(", ")}) are not in this pack.`
+			};
+		}
+	};
+}
+/** The built-in catalog, plus a record's own frameworks when it has any. */
+function catalogOf(file) {
+	const frameworks = /* @__PURE__ */ new Map();
+	const controls = /* @__PURE__ */ new Map();
+	const add = (framework, id, control) => {
+		const key = `${framework.id}:${id}`;
+		if (controls.has(key)) return;
+		controls.set(key, control);
+		let f = frameworks.get(framework.id);
+		if (f === void 0) {
+			f = {
+				...framework,
+				controls: []
+			};
+			frameworks.set(framework.id, f);
+		}
+		f.controls.push({
+			key,
+			id,
+			...control.name === void 0 ? {} : { name: control.name },
+			asks: control.asks
+		});
+	};
+	for (const control of CONTROLS) {
+		const place = placeOf(control);
+		const version = versionOf(place.framework.id);
+		add({
+			id: place.framework.id,
+			name: place.framework.name,
+			...version === void 0 ? {} : { version }
+		}, place.id, control);
+	}
+	for (const f of file?.frameworks ?? []) for (const c of f.controls) add({
+		id: f.id,
+		name: f.name,
+		...f.version === void 0 ? {} : { version: f.version },
+		...f.description === void 0 ? {} : { description: f.description },
+		custom: true
+	}, c.id, fromData(c));
+	return {
+		frameworks: [...frameworks.values()],
+		controls
+	};
+}
+/** A catalog file, checked: what is wrong with it, or the file. */
+function parseCatalog(raw) {
+	const text = (v) => typeof v === "string" && v.trim() !== "";
+	if (typeof raw !== "object" || raw === null) return "not an object";
+	const frameworks = raw.frameworks;
+	if (!Array.isArray(frameworks)) return "frameworks: expected an array";
+	for (const [i, f] of frameworks.entries()) {
+		if (!text(f?.id) || !/^[a-z0-9][a-z0-9-]*$/.test(f.id)) return `frameworks[${i}].id: lowercase letters, digits and dashes`;
+		if (!text(f.name)) return `frameworks[${i}].name: required`;
+		if (!Array.isArray(f.controls)) return `frameworks[${i}].controls: expected an array`;
+		for (const [j, c] of f.controls.entries()) {
+			const at = `frameworks[${i}].controls[${j}]`;
+			if (!text(c?.id)) return `${at}.id: required`;
+			if (!text(c.asks)) return `${at}.asks: required`;
+			if (!Array.isArray(c.prae_controls) || !c.prae_controls.every((r) => text(r))) return `${at}.prae_controls: expected an array of PRAE rule ids`;
+			if (c.evidence_types !== void 0 && (!Array.isArray(c.evidence_types) || !c.evidence_types.every((t) => [
+				"allow",
+				"deny",
+				"ask"
+			].includes(t)))) return `${at}.evidence_types: allow, deny or ask`;
+		}
+	}
+	return raw;
+}
+/** Everything built in, every agent and session, the whole record. */
+function defaultScope(catalog) {
+	const builtIn = catalog.frameworks.filter((f) => f.custom !== true);
+	return {
+		frameworks: builtIn.map((f) => f.id),
+		controls: builtIn.flatMap((f) => f.controls.map((c) => c.key)),
+		agents: "all",
+		sessions: "all",
+		period: { kind: "all" }
+	};
+}
+/** A scope as saved or sent, checked: what is wrong with it, or the scope. */
+function parseScope(raw) {
+	if (typeof raw !== "object" || raw === null) return "not an object";
+	const r = raw;
+	const strings = (v) => Array.isArray(v) && v.every((s) => typeof s === "string" && s.length <= 200);
+	if (!strings(r.frameworks)) return "frameworks: expected an array of ids";
+	if (!strings(r.controls)) return "controls: expected an array of keys";
+	for (const d of ["agents", "sessions"]) if (r[d] !== "all" && !strings(r[d])) return `${d}: "all" or an array`;
+	const p = r.period;
+	const period = p?.kind === "all" ? { kind: "all" } : p?.kind === "days" && typeof p.days === "number" && Number.isInteger(p.days) && p.days > 0 && p.days <= 3650 ? {
+		kind: "days",
+		days: p.days
+	} : p?.kind === "custom" && typeof p.from === "string" && typeof p.to === "string" && !Number.isNaN(Date.parse(p.from)) && !Number.isNaN(Date.parse(p.to)) && Date.parse(p.from) <= Date.parse(p.to) ? {
+		kind: "custom",
+		from: p.from,
+		to: p.to
+	} : "period: all, the last N days, or a custom from–to range";
+	if (typeof period === "string") return period;
+	return {
+		frameworks: r.frameworks,
+		controls: r.controls,
+		agents: r.agents,
+		sessions: r.sessions,
+		period
+	};
+}
+/** Whether a row falls in the scope's period. */
+function inPeriod(at, period, now) {
+	const t = Date.parse(at);
+	if (period.kind === "all") return true;
+	if (Number.isNaN(t)) return false;
+	if (period.kind === "days") return t >= now - period.days * 864e5;
+	return t >= Date.parse(period.from) && t < Date.parse(period.to) + 864e5;
+}
+/**
+* Assess the scoped controls against the record. The rows are narrowed to
+* the scope's agents, sessions and period before any control reads them;
+* the chain's verification stays the whole record's, since integrity is a
+* property of the chain, not of a slice of it.
+*/
+function assess(data, scope, catalog, options) {
+	const now = options.now ?? Date.now();
+	const agentOf$1 = (e) => e.agent ?? options.agent;
+	const admitted = data.entries.filter((e) => (scope.agents === "all" || scope.agents.includes(agentOf$1(e))) && (scope.sessions === "all" || e.session !== void 0 && scope.sessions.includes(e.session)) && inPeriod(e.at, scope.period, now));
+	const scoped = {
+		...data,
+		entries: admitted
+	};
+	const frameworksOn = new Set(scope.frameworks);
+	const controlsOn = new Set(scope.controls);
+	const row$1 = (e) => ({
+		seq: e.seq,
+		at: e.at,
+		tool: e.tool,
+		...e.subject === void 0 ? {} : { subject: e.subject },
+		verdict: e.verdict,
+		...e.rule === void 0 ? {} : { rule: e.rule },
+		...e.session === void 0 ? {} : { session: e.session },
+		agent: agentOf$1(e),
+		hash: e.hash
+	});
+	const frameworks = catalog.frameworks.map((f) => {
+		const selected = frameworksOn.has(f.id);
+		const controls = f.controls.map((c) => {
+			const control = catalog.controls.get(c.key);
+			if (!(selected && controlsOn.has(c.key)) || control === void 0) return {
+				...c,
+				inScope: false,
+				state: "not-in-scope",
+				note: "Not in the selected scope, so not assessed.",
+				rules: [],
+				evidence: {
+					count: 0,
+					rows: []
+				}
+			};
+			const found = control.evidence(scoped);
+			const trace = control.trace?.(scoped) ?? {
+				rules: [],
+				rows: []
+			};
+			return {
+				...c,
+				inScope: true,
+				state: found.state,
+				note: found.note,
+				rules: trace.rules,
+				evidence: {
+					count: trace.rows.length,
+					rows: trace.rows.slice(-ROW_LIMIT).reverse().map(row$1)
+				}
+			};
+		});
+		const on$1 = controls.filter((c) => c.inScope);
+		const count = (s) => on$1.filter((c) => c.state === s).length;
+		const { controls: _,...meta } = f;
+		return {
+			...meta,
+			selected,
+			total: controls.length,
+			inScope: on$1.length,
+			covered: count("covered"),
+			partial: count("partial"),
+			absent: count("absent"),
+			controls
+		};
+	});
+	const on = frameworks.flatMap((f) => f.controls.filter((c) => c.inScope));
+	const sessions = /* @__PURE__ */ new Map();
+	for (const e of data.entries) {
+		if (e.session === void 0) continue;
+		const s = sessions.get(e.session);
+		if (s === void 0) sessions.set(e.session, {
+			rows: 1,
+			first: e.at,
+			last: e.at
+		});
+		else {
+			s.rows += 1;
+			s.last = e.at;
+		}
+	}
+	return {
+		scope,
+		frameworks,
+		totals: {
+			frameworks: frameworks.filter((f) => f.inScope > 0).length,
+			controls: on.length,
+			withEvidence: on.filter((c) => c.state !== "absent").length,
+			covered: on.filter((c) => c.state === "covered").length,
+			partial: on.filter((c) => c.state === "partial").length,
+			absent: on.filter((c) => c.state === "absent").length
+		},
+		dimensions: {
+			agents: [...new Set([options.agent, ...data.entries.map(agentOf$1)])],
+			sessions: [...sessions.entries()].map(([id, s]) => ({
+				id,
+				...s
+			})),
+			environment: options.environment
+		},
+		rows: {
+			admitted: admitted.length,
+			total: data.entries.length
+		}
+	};
+}
+
+//#endregion
+//#region src/compliance.ts
+const SCOPE_FILE = ".prae-compliance/scope.json";
+const CATALOG_FILE = "compliance-catalog.json";
+/** The record's catalog: built in, plus its own file when it parses. */
+function catalogFor(dir) {
+	const path = resolve(dir, CATALOG_FILE);
+	if (!existsSync(path)) return { catalog: catalogOf() };
+	let raw;
+	try {
+		raw = JSON.parse(readFileSync(path, "utf8"));
+	} catch {
+		return {
+			catalog: catalogOf(),
+			catalogError: `${CATALOG_FILE}: not JSON`
+		};
+	}
+	const file = parseCatalog(raw);
+	return typeof file === "string" ? {
+		catalog: catalogOf(),
+		catalogError: `${CATALOG_FILE}: ${file}`
+	} : { catalog: catalogOf(file) };
+}
+/** The saved scope, or everything built in when none is saved yet. */
+function scopeFor(dir, catalog) {
+	const path = resolve(dir, SCOPE_FILE);
+	if (!existsSync(path)) return defaultScope(catalog);
+	try {
+		const scope = parseScope(JSON.parse(readFileSync(path, "utf8")));
+		return typeof scope === "string" ? defaultScope(catalog) : scope;
+	} catch {
+		return defaultScope(catalog);
+	}
+}
+/** The agent the record's discovery names, for rows that name none. */
+function agentOf(dir) {
+	try {
+		const discovery = JSON.parse(readFileSync(resolve(dir, "discovery.json"), "utf8"));
+		if (typeof discovery.agent?.name === "string") return discovery.agent.name;
+	} catch {}
+	return "this agent";
+}
+function assessCompliance(record, data) {
+	const { catalog, catalogError } = catalogFor(record.dir);
+	return {
+		...assess(data, scopeFor(record.dir, catalog), catalog, {
+			agent: agentOf(record.dir),
+			environment: basename(resolve(record.dir))
+		}),
+		saved: existsSync(resolve(record.dir, SCOPE_FILE)),
+		...catalogError === void 0 ? {} : { catalogError }
 	};
 }
 
@@ -913,6 +1263,23 @@ function verifyRecord(record, tamper, repair = false) {
 		repaired: false,
 		signatures: null
 	};
+	if (tamper === void 0) {
+		const keyPath$1 = resolve(dir, files.publicKey);
+		const publicKey = existsSync(keyPath$1) ? readFileSync(keyPath$1, "utf8") : void 0;
+		const v = verifyGrowing(path, publicKey);
+		return {
+			ok: v.ok,
+			entries: v.entries,
+			problems: [...v.problems],
+			tampered: null,
+			repaired: false,
+			signatures: v.signatures === null || publicKey === void 0 ? null : {
+				checked: v.signatures.checked,
+				failed: [...v.signatures.failed],
+				fingerprint: fingerprint(publicKey)
+			}
+		};
+	}
 	let text = readFileSync(path, "utf8");
 	let tampered = null;
 	if (tamper !== void 0) {
@@ -972,6 +1339,45 @@ function verifyRecord(record, tamper, repair = false) {
 		signatures
 	};
 }
+/** The record's built-in pack and workspace packs, as the gate loads them. */
+function packSetOf(record) {
+	const { dir, files } = record;
+	const packsDir = resolve(dir, files.packs);
+	const builtinPath = resolve(dir, files.pack);
+	return {
+		packsDir,
+		set: loadPackDir(packsDir, void 0, void 0, existsSync(builtinPath) ? readPackFile(builtinPath, void 0, "builtin") : void 0)
+	};
+}
+/**
+* The packs in force for a record (PRA-127): the built-in pack and the
+* workspace's own, read by the gate's loader — each with its origin, version,
+* sha256 and rules — and every workspace pack the loader rejects, with why.
+*/
+function packsOf(record) {
+	const { packsDir, set } = packSetOf(record);
+	return {
+		packs: set.packs.map((p) => ({
+			file: p.file.split("/").at(-1),
+			name: p.pack.pack,
+			version: p.pack.version,
+			...p.pack.description === void 0 ? {} : { description: p.pack.description },
+			...p.pack.owner === void 0 ? {} : { owner: p.pack.owner },
+			sha256: p.sha256,
+			origin: p.origin,
+			rules: p.pack.rules.map((r) => ({
+				id: r.id,
+				...r.title === void 0 ? {} : { title: r.title },
+				kind: r.effect.kind,
+				because: r.effect.because
+			}))
+		})),
+		rejected: set.rejected.filter((r) => r.file !== packsDir).map((r) => ({
+			file: r.file.split("/").at(-1),
+			reason: r.reason
+		}))
+	};
+}
 /**
 * Evidence toward each control, from the pack and the ledger as they are
 * now — the rows the controls package defines, so the console, the exporter and
@@ -981,40 +1387,56 @@ function verifyRecord(record, tamper, repair = false) {
 function complianceOf(record) {
 	const { dir, files } = record;
 	const ledgerPath = resolve(dir, files.ledger);
-	const text = existsSync(ledgerPath) ? readFileSync(ledgerPath, "utf8") : "";
-	let entries = [];
-	try {
-		entries = readEntries(text);
-	} catch {
-		entries = [];
-	}
-	const packPath = resolve(dir, files.pack);
-	let pack;
-	if (existsSync(packPath)) {
-		const parsed = parsePack(readFileSync(packPath, "utf8"));
-		if (parsed.ok) pack = parsed.pack;
-	}
+	const entries = readLedger(ledgerPath);
+	const grown = existsSync(ledgerPath) ? verifyGrowing(ledgerPath) : void 0;
+	const verification = grown === void 0 ? verifyEntries("") : {
+		ok: grown.ok,
+		entries: grown.entries,
+		problems: grown.problems
+	};
+	const { set } = packSetOf(record);
+	const pack = set.packs.length > 0 ? set.effective : void 0;
 	const data = {
 		...pack === void 0 ? {} : { pack },
 		entries,
-		verification: verifyEntries(text),
+		verification,
 		generatedAt: (/* @__PURE__ */ new Date()).toISOString()
 	};
-	return { controls: CONTROLS.map((control) => {
-		const found = Object.entries(FRAMEWORKS).find(([, f]) => control.id.startsWith(`${f.short} · `));
-		const code = found === void 0 ? void 0 : control.id.split(" · ")[1];
-		const named = found === void 0 || code === void 0 ? void 0 : found[1].controls[code];
-		const standard = control.standard;
-		const name = named?.name ?? control.name;
-		return {
-			id: code ?? (standard === void 0 ? control.id : control.id.split(" · ")[1] ?? control.id),
-			...name === void 0 ? {} : { name },
-			asks: control.asks,
-			framework: found?.[0] ?? standard?.id ?? "obligation",
-			...found === void 0 ? standard === void 0 ? {} : { frameworkName: standard.name } : { frameworkName: found[1].name },
-			...control.evidence(data)
-		};
-	}) };
+	return {
+		assessment: assessCompliance(record, data),
+		controls: CONTROLS.map((control) => {
+			const found = Object.entries(FRAMEWORKS).find(([, f]) => control.id.startsWith(`${f.short} · `));
+			const code = found === void 0 ? void 0 : control.id.split(" · ")[1];
+			const named = found === void 0 || code === void 0 ? void 0 : found[1].controls[code];
+			const standard = control.standard;
+			const name = named?.name ?? control.name;
+			return {
+				id: code ?? (standard === void 0 ? control.id : control.id.split(" · ")[1] ?? control.id),
+				...name === void 0 ? {} : { name },
+				asks: control.asks,
+				framework: found?.[0] ?? standard?.id ?? "obligation",
+				...found === void 0 ? standard === void 0 ? {} : { frameworkName: standard.name } : { frameworkName: found[1].name },
+				...control.evidence(data)
+			};
+		})
+	};
+}
+/**
+* The API's version is prae-cli's: every `/api/*` response names it in
+* `X-PRAE-API-Version`, so a client can tell which contract answered. The
+* contract follows the package's semver — a breaking change to a route bumps
+* the major — and a route on its way out carries `Deprecation` and `Sunset`
+* (RFC 9745 / RFC 8594) for at least one minor release before it goes.
+*/
+/**
+* The most rows `/api/record` sends: the newest ones. The console keeps the
+* same window (apps/console/src/data/hooks.ts); `trimmed` counts the rest.
+*/
+const RECORD_WINDOW = 25e3;
+const API_VERSION = createRequire(import.meta.url)("../package.json").version;
+/** Name the contract on an API response; call before the status is written. */
+function apiVersion(res) {
+	res.setHeader("x-prae-api-version", API_VERSION);
 }
 /**
 * The record over HTTP, for the Command Center (apps/console): the same
@@ -1029,6 +1451,7 @@ function complianceOf(record) {
 function handleApi(req, res, record) {
 	const route = (req.url ?? "").split("?")[0] ?? "";
 	if (!route.startsWith("/api/")) return false;
+	apiVersion(res);
 	const json = (body, status = 200) => {
 		res.statusCode = status;
 		res.setHeader("content-type", "application/json; charset=utf-8");
@@ -1043,19 +1466,56 @@ function handleApi(req, res, record) {
 			connection: "keep-alive"
 		});
 		res.write(": connected\n\n");
-		let sent = readRecord(dir, files).ledger.length;
+		const ledgerPath = resolve(dir, files.ledger);
+		const size = () => existsSync(ledgerPath) ? statSync(ledgerPath).size : 0;
+		let offset = (() => {
+			if (!existsSync(ledgerPath)) return 0;
+			return readFileSync(ledgerPath).lastIndexOf(10) + 1;
+		})();
 		const push = () => {
-			const rows = readRecord(dir, files).ledger;
-			if (rows.length < sent) sent = 0;
-			const fresh = rows.slice(sent);
-			sent = rows.length;
+			const end = size();
+			if (end < offset) {
+				offset = 0;
+				res.write("event: reset\ndata: {}\n\n");
+			}
+			const fresh = [];
+			if (end > offset) {
+				const bytes = Buffer.alloc(end - offset);
+				const fd = openSync(ledgerPath, "r");
+				try {
+					readSync(fd, bytes, 0, bytes.length, offset);
+				} finally {
+					closeSync(fd);
+				}
+				let at = 0;
+				for (;;) {
+					const nl = bytes.indexOf(10, at);
+					if (nl === -1) break;
+					const l = bytes.subarray(at, nl).toString("utf8");
+					if (l.trim() !== "") try {
+						fresh.push(JSON.parse(l));
+					} catch {
+						break;
+					}
+					at = nl + 1;
+				}
+				offset += at;
+			}
 			if (fresh.length > 0) res.write(`data: ${JSON.stringify(fresh)}\n\n`);
 			else res.write(": keepalive\n\n");
 		};
-		const watcher = existsSync(dir) ? watch(dir, { persistent: false }, () => push()) : void 0;
+		let soon;
+		const schedule = () => {
+			soon ??= setTimeout(() => {
+				soon = void 0;
+				push();
+			}, 250);
+		};
+		const watcher = existsSync(dir) ? watch(dir, { persistent: false }, schedule) : void 0;
 		const keep = setInterval(push, 2e3);
 		res.on("close", () => {
 			clearInterval(keep);
+			if (soon !== void 0) clearTimeout(soon);
 			watcher?.close();
 		});
 		return true;
@@ -1071,15 +1531,40 @@ function handleApi(req, res, record) {
 		json(complianceOf(record));
 		return true;
 	}
+	if (route === "/api/packs") {
+		json(packsOf(record));
+		return true;
+	}
 	if (route === "/api/redteam") {
 		json(readRedteam(dir, files));
 		return true;
 	}
+	if (route === "/api/status") {
+		json({
+			dir,
+			files: Object.fromEntries(Object.entries(files).map(([name, file]) => {
+				const path = resolve(dir, file);
+				if (!existsSync(path)) return [name, null];
+				const stat$1 = statSync(path);
+				return [name, {
+					size: stat$1.size,
+					mtime: stat$1.mtimeMs
+				}];
+			}))
+		});
+		return true;
+	}
 	const snapshot = readRecord(dir, files);
 	switch (route) {
-		case "/api/record":
-			json(snapshot);
+		case "/api/record": {
+			const over = snapshot.ledger.length - RECORD_WINDOW;
+			json(over > 0 ? {
+				...snapshot,
+				ledger: snapshot.ledger.slice(over),
+				trimmed: over
+			} : snapshot);
 			break;
+		}
 		case "/api/ledger":
 			json(snapshot.ledger);
 			break;
@@ -1095,20 +1580,6 @@ function handleApi(req, res, record) {
 		case "/api/pack":
 			json(snapshot.pack);
 			break;
-		case "/api/status":
-			json({
-				dir,
-				files: Object.fromEntries(Object.entries(files).map(([name, file]) => {
-					const path = resolve(dir, file);
-					if (!existsSync(path)) return [name, null];
-					const stat$1 = statSync(path);
-					return [name, {
-						size: stat$1.size,
-						mtime: stat$1.mtimeMs
-					}];
-				}))
-			});
-			break;
 		default: json({ error: "not found" }, 404);
 	}
 	return true;
@@ -1125,6 +1596,7 @@ function serveConsole(root, port, record) {
 			res.end();
 			return;
 		}
+		if ((req.url ?? "").startsWith("/api/")) apiVersion(res);
 		if (record !== void 0 && handleApi(req, res, record)) return;
 		const target = safePath(root, req.url ?? "/");
 		if (target === void 0) {
@@ -1169,6 +1641,12 @@ const USAGE = `⌜▪⌟ prae — operator policy for agent harnesses
   prae check <pack.json>
       Validate a policy pack and summarise what it enforces.
 
+  prae check <dir> [--policy-key <policy.pub.pem>]
+      Validate a workspace's packs (e.g. .prae/packs) exactly as the gate
+      loads them: every *.prae.json / .yaml in name order, each rejection
+      with its reason, and, with --policy-key, each .sig checked. Exits
+      non-zero if any pack would be rejected.
+
   prae explain <pack.json> <tool> [key=value ...]
       Judge one call against the pack and print the trace. Nothing is executed.
 
@@ -1195,6 +1673,14 @@ const USAGE = `⌜▪⌟ prae — operator policy for agent harnesses
       --checkpoint, also check that nothing before that checkpoint's head
       has been removed or rewritten since it was taken.
 
+  prae chain <ledger.jsonl> --pack <pack.json> [--guardians <guardians.json>]
+              [--key <public.pem>] [--json]
+      The Attack Chain Integrity Matrix: each attack-chain row from the
+      attempted action to its seal — capability, Guardian, rule, decision,
+      whether it ran, the stage and why, the hash and the signature. The
+      stage is classified from the sealed row and the pack, never typed in.
+      Exits non-zero if the chain or (with --key) any signature fails.
+
   prae checkpoint <ledger.jsonl> [--key <private.pem>] [--out <file>]
       Record the ledger's length and head, signed, to keep somewhere the
       ledger's machine cannot write. A chain proves no row inside the file
@@ -1252,13 +1738,31 @@ const USAGE = `⌜▪⌟ prae — operator policy for agent harnesses
       Read the instruction files at <dir> and propose the rules they imply.
       Proposals only: an existing pack is never modified.
 
-  prae init [--pack <file>] [--profile <dir>] [--ledger <file>]
+  prae init [--pack <file> | --pack-dir <dir>] [--profile <dir>] [--ledger <file>]
                 (no --pack mounts the built-in baseline of 8 high-risk rules)
                   [--approver <name>] [--link] [--shadow] [--apply]
       Compose the overlay row that mounts PRAE with a pack. Prints the
       diff; writes only with --apply. --link points the profile at the
       pack file instead of copying it in, so edits hot-reload; --shadow
       mounts in shadow mode: every verdict sealed, every call let through.
+      --pack-dir adds the workspace's own packs (e.g. .prae/packs) beside
+      that pack, loaded and watched as a set; a set that would not load is
+      not mounted (see \`prae check <dir>\`).
+
+  prae init claude-code (--settings <file> | --scope user|project)
+                [--shadow | --enforce] [--pack <file>] [--ledger <file>]
+                [--dir <dir>] [--apply] [--remove]
+      Register PRAE as a Claude Code PreToolUse hook: every tool call,
+      built-in or MCP, judged by the pack and sealed in a signed ledger
+      (default ~/.prae/claude-code/). Shadow (the default) records and
+      never blocks; --enforce returns deny/ask to Claude Code. Prints the
+      settings diff; writes only with --apply. --remove takes out PRAE's
+      own entry and nothing else. See docs/pilot-claude-code.md.
+
+  prae hook claude-code [--shadow | --enforce] --pack <file> --ledger <file>
+                [--key <private.pem>] [--settings <file>]
+      The command that settings entry runs: reads one PreToolUse payload on
+      stdin and answers through the hook's output contract.
 `;
 function fail(message) {
 	console.error(`prae: ${message}`);
@@ -1279,7 +1783,25 @@ async function loadPack(path) {
 	}
 	return result.pack;
 }
-async function check(path) {
+async function checkDir(dir, keyPath) {
+	let key;
+	if (keyPath !== void 0) try {
+		key = await readFile(keyPath, "utf8");
+	} catch {
+		return fail(`cannot read ${keyPath}`);
+	}
+	const set = loadPackDir(dir, key);
+	for (const p of set.packs) {
+		console.log(`ok        ${p.file.split("/").at(-1)} · ${p.pack.pack} ${p.pack.version} · ${p.pack.rules.length} rules · sha256 ${p.sha256.slice(0, 12)}${p.signedBy === void 0 ? "" : ` · signed ${p.signedBy}`}`);
+		for (const rule of p.pack.rules) console.log(`            ${rule.id.padEnd(14)} ${(rule.effect.kind === "ask" ? "HOLD" : rule.effect.kind.toUpperCase()).padEnd(8)} ${rule.title ?? rule.effect.because}`);
+	}
+	for (const r of set.rejected) console.error(`REJECTED  ${r.file.split("/").at(-1)}\n            ${r.reason}`);
+	if (set.packs.length === 0) console.error("\nNo valid pack: the gate would refuse every call until one loads.");
+	if (set.rejected.length > 0) process.exit(1);
+	console.log(`\n${set.packs.length} pack${set.packs.length === 1 ? "" : "s"} valid · in force as ${set.effective.pack} ${set.effective.version}`);
+}
+async function check(path, argv = []) {
+	if (existsSync(path) && statSync(path).isDirectory()) return checkDir(path, flag(argv, "policy-key"));
 	const pack = await loadPack(path);
 	console.log(`${pack.pack} ${pack.version} — valid`);
 	const baseline = pack.baseline?.capabilities;
@@ -1300,7 +1822,7 @@ async function check(path) {
 * from the findings, so there is nothing here to be careful about printing.
 */
 async function scanFile(path, packPath, json) {
-	const { scan } = await import("./src-CwBEFhww.js");
+	const { scan } = await import("./src-DMoYsdfo.js");
 	let content;
 	try {
 		content = await readFile(path, "utf8");
@@ -1340,13 +1862,13 @@ async function scanFile(path, packPath, json) {
 * not come up inspecting nothing.
 */
 async function mcp(root, packPath, ledgerPath) {
-	const { serveMcp } = await import("./mcp-doNYU-1C.js");
+	const { serveMcp } = await import("./mcp-D521EoP6.js");
 	const { resolve: resolve$1 } = await import("node:path");
 	const bundled = [join(import.meta.dirname, "secret-catcher.prae.json"), join(import.meta.dirname, "..", "..", "..", "examples", "secret-catcher.prae.json")].find((candidate) => existsSync(candidate));
 	const chosen = packPath ?? bundled;
 	if (chosen === void 0) return fail("mcp needs --pack <file>; no bundled secret-catcher found");
 	const pack = await loadPack(chosen);
-	const { Ledger: Ledger$1 } = await import("./src-d82lSKVQ.js");
+	const { Ledger: Ledger$1 } = await import("./src-wG36kT6K.js");
 	const ledger = ledgerPath === void 0 ? void 0 : Ledger$1.open(ledgerPath);
 	console.error(`prae mcp: serving ${resolve$1(root)} under ${pack.pack} ${pack.version}` + (ledgerPath === void 0 ? " (no ledger)" : ` · ledger ${ledgerPath}`));
 	await serveMcp({
@@ -1398,7 +1920,7 @@ async function explain(path, tool, pairs) {
 * a key that arrived beside it is checked against nothing.
 */
 async function keygen(dir) {
-	const { generateKeypair, fingerprint: fingerprint$1 } = await import("./src-d82lSKVQ.js");
+	const { generateKeypair, fingerprint: fingerprint$1 } = await import("./src-wG36kT6K.js");
 	const { writeFileSync: writeFileSync$1 } = await import("node:fs");
 	const keys = generateKeypair();
 	const priv = join(dir, "prae-signing.pem");
@@ -1421,7 +1943,7 @@ async function keygen(dir) {
 async function keygenSealed(role, dir) {
 	if (role !== "operator" && role !== "policy" && role !== "ledger") fail("--role is operator, policy or ledger");
 	const stem = role === "ledger" ? "prae-signing" : role;
-	const { sealedKeypair, fingerprint: fingerprint$1 } = await import("./src-d82lSKVQ.js");
+	const { sealedKeypair, fingerprint: fingerprint$1 } = await import("./src-wG36kT6K.js");
 	const { writeFileSync: writeFileSync$1 } = await import("node:fs");
 	const keys = sealedKeypair(process.env.PRAE_KEY_PASSPHRASE ?? await askHidden("passphrase: "));
 	const pub = join(dir, `${stem}.pub.pem`);
@@ -1434,11 +1956,11 @@ async function keygenSealed(role, dir) {
 }
 /** A detached signature over a pack's bytes (PRA-107). */
 async function signPack(packPath, keyPath) {
-	const { signBytes, unsealPrivateKey, fingerprint: fingerprint$1 } = await import("./src-d82lSKVQ.js");
-	const { createPublicKey } = await import("node:crypto");
+	const { signBytes, unsealPrivateKey, fingerprint: fingerprint$1 } = await import("./src-wG36kT6K.js");
+	const { createPublicKey: createPublicKey$1 } = await import("node:crypto");
 	const bytes = readFileSync(packPath);
-	const parsed = parsePack(bytes.toString("utf8"));
-	if (!parsed.ok) fail(`${packPath} does not parse; nothing signed`);
+	const parsed$1 = parsePack(bytes.toString("utf8"));
+	if (!parsed$1.ok) fail(`${packPath} does not parse; nothing signed`);
 	const passphrase = process.env.PRAE_KEY_PASSPHRASE ?? await askHidden("passphrase: ");
 	let key;
 	try {
@@ -1447,11 +1969,11 @@ async function signPack(packPath, keyPath) {
 		fail("wrong passphrase, or not a sealed key");
 	}
 	await writeFile(`${packPath}.sig`, `${signBytes(bytes, key)}\n`);
-	const pub = createPublicKey(key).export({
+	const pub = createPublicKey$1(key).export({
 		type: "spki",
 		format: "pem"
 	});
-	console.log(`signed      ${packPath}.sig  (${parsed.pack.pack} ${parsed.pack.version})`);
+	console.log(`signed      ${packPath}.sig  (${parsed$1.pack.pack} ${parsed$1.pack.version})`);
 	console.log(`policy key  ${fingerprint$1(pub.toString())}`);
 }
 /** Read a line from the terminal without echoing it. */
@@ -1479,11 +2001,11 @@ function askHidden(prompt) {
 	});
 }
 async function receipt(path, seq, keyPath, out) {
-	const { Ledger: Ledger$1, makeReceipt, fingerprint: fingerprint$1 } = await import("./src-d82lSKVQ.js");
+	const { Ledger: Ledger$1, makeReceipt, fingerprint: fingerprint$1 } = await import("./src-wG36kT6K.js");
 	const { readFileSync: readFileSync$1 } = await import("node:fs");
-	const { createPublicKey } = await import("node:crypto");
+	const { createPublicKey: createPublicKey$1 } = await import("node:crypto");
 	const privateKey = readFileSync$1(keyPath, "utf8");
-	const publicKey = createPublicKey(privateKey).export({
+	const publicKey = createPublicKey$1(privateKey).export({
 		type: "spki",
 		format: "pem"
 	}).toString();
@@ -1509,14 +2031,14 @@ async function receipt(path, seq, keyPath, out) {
 * file and sets the exit code, so scripts can branch on it.
 */
 async function verifyReceiptCmd(path) {
-	const { checkReceipt } = await import("./receipt-check-CD-W1wXs.js");
-	let parsed;
+	const { checkReceipt } = await import("./receipt-check-CUuEjGHL.js");
+	let parsed$1;
 	try {
-		parsed = JSON.parse(await readFile(path, "utf8"));
+		parsed$1 = JSON.parse(await readFile(path, "utf8"));
 	} catch {
 		return fail(`cannot read a receipt from ${path}`);
 	}
-	const result = checkReceipt(parsed);
+	const result = checkReceipt(parsed$1);
 	for (const line of result.lines) if (result.ok) console.log(line);
 	else console.error(line);
 	if (!result.ok) process.exit(1);
@@ -1534,14 +2056,14 @@ async function test(suitePath, packOverride, asJson) {
 	} catch {
 		return fail(`cannot read ${suitePath}`);
 	}
-	let parsed;
+	let parsed$1;
 	try {
-		parsed = JSON.parse(raw);
+		parsed$1 = JSON.parse(raw);
 	} catch (error) {
 		return fail(`${suitePath} is not valid JSON: ${error instanceof Error ? error.message : error}`);
 	}
-	const { parseSuite, renderSuite, runSuite } = await import("./test-run-XNIRHKOu.js");
-	const suite = parseSuite(parsed);
+	const { parseSuite, renderSuite, runSuite } = await import("./test-run-C8dHjIE2.js");
+	const suite = parseSuite(parsed$1);
 	if (!suite.ok) {
 		console.error(`prae: ${suitePath} is not a valid test suite`);
 		for (const message of suite.errors) console.error(`  ${message}`);
@@ -1551,7 +2073,7 @@ async function test(suitePath, packOverride, asJson) {
 	if (chosen === void 0) return fail("test needs a pack: set `pack` in the suite or pass --pack");
 	const pack = await loadPack(chosen);
 	const { capabilityForTool } = await import("capmark");
-	const { scan } = await import("./src-CwBEFhww.js");
+	const { scan } = await import("./src-DMoYsdfo.js");
 	const inspect = pack.rules.some((rule) => rule.when.secrets !== void 0) ? (path) => {
 		try {
 			return scan(readFileSync(path, "utf8"));
@@ -1567,7 +2089,7 @@ async function test(suitePath, packOverride, asJson) {
 	else for (const line of renderSuite(result)) console.log(line);
 	if (!result.ok) process.exit(1);
 }
-async function verify(path, keyPath, checkpointPath) {
+async function verify$1(path, keyPath, checkpointPath) {
 	let ledger;
 	try {
 		ledger = Ledger.open(path);
@@ -1580,14 +2102,14 @@ async function verify(path, keyPath, checkpointPath) {
 		const last = entries.at(-1);
 		console.log(`${result.entries} entries · chain intact${last === void 0 ? "" : ` · seal ${seal(last)}`}`);
 		if (checkpointPath !== void 0) {
-			const { checkCheckpoint } = await import("./checkpoint-BWSuhZ5h.js");
+			const { checkCheckpoint } = await import("./checkpoint-BqJ8xwky.js");
 			const publicKey = keyPath === void 0 ? void 0 : readFileSync(keyPath, "utf8");
 			const verdict = checkCheckpoint(entries, JSON.parse(readFileSync(checkpointPath, "utf8")), publicKey);
 			for (const line of verdict.lines) (verdict.ok ? console.log : console.error)(`checkpoint: ${line}`);
 			if (!verdict.ok) process.exitCode = 1;
 		}
 		if (keyPath !== void 0) {
-			const { verifySignature: verifySignature$1, fingerprint: fingerprint$1 } = await import("./src-d82lSKVQ.js");
+			const { verifySignature: verifySignature$1, fingerprint: fingerprint$1 } = await import("./src-wG36kT6K.js");
 			const { readFileSync: readFileSync$1 } = await import("node:fs");
 			const publicKey = readFileSync$1(keyPath, "utf8");
 			let signed = 0;
@@ -1665,7 +2187,7 @@ async function report(path, out, packPath) {
 * that step is a proposal a human approves, and it starts from this list.
 */
 async function instructions(from, asJson) {
-	const { ingest } = await import("./src-d4c_n6wd.js");
+	const { ingest } = await import("./src-CDYyZyeU.js");
 	const result = ingest(from);
 	if (asJson) {
 		console.log(JSON.stringify(result, null, 2));
@@ -1701,7 +2223,7 @@ async function instructions(from, asJson) {
 * on purpose rather than something that happened to their policy.
 */
 async function propose(from, options) {
-	const [{ ingest }, { extract }] = await Promise.all([import("./src-d4c_n6wd.js"), import("./src-CBGZVvt7.js")]);
+	const [{ ingest }, { extract }] = await Promise.all([import("./src-CDYyZyeU.js"), import("./src-BlmsTGdY.js")]);
 	const read = ingest(from);
 	if (read.files.length === 0) {
 		console.log(`No instruction files found at or above ${from}.`);
@@ -1761,9 +2283,9 @@ async function consoleOut(path, argv) {
 	const instructionsDir = flag(argv, "instructions");
 	if (instructionsDir !== void 0) {
 		const [{ ingest }, { extract }, { renderInstructions }] = await Promise.all([
-			import("./src-d4c_n6wd.js"),
-			import("./src-CBGZVvt7.js"),
-			import("./instructions-Bg5puOen.js")
+			import("./src-CDYyZyeU.js"),
+			import("./src-BlmsTGdY.js"),
+			import("./instructions-DihPiiC2.js")
 		]);
 		const read = ingest(instructionsDir);
 		instructionsView = renderInstructions(data, read, extract(read.statements));
@@ -1804,9 +2326,12 @@ async function consoleOut(path, argv) {
 	console.log(`record at ${url}api/record · events at ${url}api/events`);
 	console.log("loopback only, read-only. ctrl-c to stop.");
 }
+/** The bundled baseline: beside the built code, or in examples/ in source. */
+function bundledBaseline() {
+	return [join(import.meta.dirname, "prae-baseline.prae.json"), join(import.meta.dirname, "..", "..", "..", "examples", "prae-baseline.prae.json")].find((candidate) => existsSync(candidate));
+}
 async function init(argv) {
-	const bundledBaseline = [join(import.meta.dirname, "prae-baseline.prae.json"), join(import.meta.dirname, "..", "..", "..", "examples", "prae-baseline.prae.json")].find((candidate) => existsSync(candidate));
-	const packPath = flag(argv, "pack") ?? bundledBaseline;
+	const packPath = flag(argv, "pack") ?? bundledBaseline();
 	if (packPath === void 0) fail("init needs --pack <file>; no bundled baseline found");
 	if (flag(argv, "pack") === void 0) {
 		console.log("No --pack given; mounting the built-in baseline (8 rules).");
@@ -1814,14 +2339,29 @@ async function init(argv) {
 	}
 	const pack = await loadPack(packPath);
 	const source = await readFile(packPath, "utf8");
+	const link = argv.includes("--link");
+	const builtin = link ? { packFile: resolve(packPath) } : { pack: source };
+	const builtinLine = `${pack.pack} ${pack.version} · ${pack.rules.length} rules${link ? ` · linked, edits hot-reload (${resolve(packPath)})` : ""}`;
+	const packDirFlag = flag(argv, "pack-dir");
+	if (packDirFlag === void 0) return writeRow(argv, builtin, builtinLine);
+	const packDir = resolve(packDirFlag);
+	const set = loadPackDir(packDir, void 0, void 0, readPackFile(packPath, void 0, "builtin"));
+	for (const r of set.rejected) console.error(`REJECTED  ${r.file.split("/").at(-1)}: ${r.reason}`);
+	if (set.rejected.length > 0) fail(`not mounting ${packDir}: fix the packs above (prae check ${packDir})`);
+	const custom = set.packs.filter((p) => p.origin === "workspace");
+	return writeRow(argv, {
+		...builtin,
+		packDir
+	}, `${builtinLine}\n            + ${custom.map((p) => `${p.pack.pack} ${p.pack.version}`).join(", ")} · workspace, watched (${packDir})`);
+}
+async function writeRow(argv, source, packLine) {
 	const profileDir = flag(argv, "profile");
 	const profile = profileDir === void 0 ? defaultProfile() : profileAt(profileDir);
 	const ledger = flag(argv, "ledger");
 	const approver = flag(argv, "approver");
-	const link = argv.includes("--link");
 	const shadow = argv.includes("--shadow");
 	const row$1 = praeRow({
-		...link ? { packFile: resolve(packPath) } : { pack: source },
+		...source,
 		...shadow ? { mode: "shadow" } : {},
 		...ledger === void 0 ? {} : { ledger },
 		...approver === void 0 ? {} : { approver }
@@ -1834,7 +2374,7 @@ async function init(argv) {
 	}
 	console.log(`profile     ${profile.dir}`);
 	console.log(`overlay     ${plan.patchPath}`);
-	console.log(`pack        ${pack.pack} ${pack.version} · ${pack.rules.length} rules${link ? ` · linked, edits hot-reload (${resolve(packPath)})` : ""}`);
+	console.log(`pack        ${packLine}`);
 	if (shadow) console.log("mode        shadow · every verdict sealed, every call proceeds");
 	if (ledger !== void 0) console.log(`ledger      ${ledger}`);
 	if (plan.findings.length > 0) {
@@ -1861,8 +2401,55 @@ async function init(argv) {
 		return fail(error instanceof Error ? error.message : String(error));
 	}
 }
+/** `prae chain`: the Attack Chain Integrity Matrix, from the record alone (PRA-128). */
+async function chainMatrix(path, argv) {
+	const packPath = flag(argv, "pack");
+	if (packPath === void 0) fail("chain needs --pack <pack.json>");
+	const pack = await loadPack(packPath);
+	let ledger;
+	try {
+		ledger = Ledger.open(path);
+	} catch (error) {
+		return fail(error instanceof Error ? error.message : String(error));
+	}
+	const entries = ledger.read();
+	const chainOk = ledger.verify().ok;
+	const guardiansPath = flag(argv, "guardians");
+	const catalogue = guardiansPath === void 0 ? [] : JSON.parse(readFileSync(guardiansPath, "utf8")).guardians;
+	const guardianOf = (rule) => rule === void 0 ? void 0 : catalogue.find((g) => g.rules.includes(rule) || (g.armed ?? []).includes(rule))?.name;
+	const keyPath = flag(argv, "key");
+	const { verifySignature: verifySignature$1 } = await import("./src-wG36kT6K.js");
+	const publicKey = keyPath === void 0 ? void 0 : readFileSync(keyPath, "utf8");
+	const matrix = integrityMatrix(entries, pack, guardianOf).map((m) => {
+		const entry = entries.find((e) => e.seq === m.seq);
+		return {
+			...m,
+			verified: publicKey === void 0 || entry?.sig === void 0 ? void 0 : verifySignature$1(entry, entry.sig, publicKey)
+		};
+	});
+	const sigFailed = matrix.some((m) => m.verified === false);
+	if (argv.includes("--json")) console.log(JSON.stringify({
+		chain: chainOk,
+		rows: matrix
+	}, null, 2));
+	else {
+		for (const m of matrix) {
+			console.log(`#${m.seq}  ${m.stage}`);
+			console.log(`      attempted   ${m.action}${m.target ? ` ${m.target}` : ""}`);
+			console.log(`      capability  ${m.capability ?? "—"}`);
+			console.log(`      guardian    ${m.guardian ?? "—"}`);
+			console.log(`      rule        ${m.rule === void 0 ? "— (no rule matched)" : m.ruleRole === "recorded" ? `${m.rule} (matched and recorded; did not decide)` : m.rule}`);
+			console.log(`      decision    ${m.decision} · ${m.execution}`);
+			console.log(`      basis       ${m.basis}`);
+			if (m.mismatch !== void 0) console.log(`      mismatch    row #${m.mismatch} (sealed link)`);
+			console.log(`      evidence    hash ${m.hash.slice(0, 16)} · prev ${m.prev.slice(0, 16)} · ${m.verified === void 0 ? m.signed ? "signed" : "unsigned" : m.verified ? "signature verifies" : "SIGNATURE FAILS"}`);
+		}
+		console.log(`\n${matrix.length} attack-chain rows · chain ${chainOk ? "intact" : "BROKEN"}${publicKey === void 0 ? "" : sigFailed ? " · signatures FAIL" : " · signatures verify"}`);
+	}
+	if (!chainOk || sigFailed) process.exitCode = 1;
+}
 async function checkpoint(path, keyPath, out) {
-	const { makeCheckpoint } = await import("./checkpoint-BWSuhZ5h.js");
+	const { makeCheckpoint } = await import("./checkpoint-BqJ8xwky.js");
 	let ledger;
 	try {
 		ledger = Ledger.open(path);
@@ -1883,9 +2470,9 @@ async function checkpoint(path, keyPath, out) {
 	}
 }
 async function exportLedger(path, options) {
-	const { toOcsf, ndjson, sendToHec } = await import("./ocsf-DhVGbBUw.js");
-	const { createRequire } = await import("node:module");
-	const { version } = createRequire(import.meta.url)("../package.json");
+	const { toOcsf, ndjson, sendToHec } = await import("./ocsf-DF9cMiQJ.js");
+	const { createRequire: createRequire$1 } = await import("node:module");
+	const { version } = createRequire$1(import.meta.url)("../package.json");
 	let ledger;
 	try {
 		ledger = Ledger.open(path);
@@ -1920,8 +2507,8 @@ async function main(argv) {
 	switch (command) {
 		case "check": {
 			const path = rest[0];
-			if (path === void 0) fail("check needs a pack file");
-			return check(path);
+			if (path === void 0) fail("check needs a pack file or directory");
+			return check(path, rest);
 		}
 		case "explain": {
 			const [path, tool, ...pairs] = rest;
@@ -1964,7 +2551,12 @@ async function main(argv) {
 		case "verify": {
 			const path = rest[0];
 			if (path === void 0) fail("verify needs a ledger file");
-			return verify(path, flag(rest, "key"), flag(rest, "checkpoint"));
+			return verify$1(path, flag(rest, "key"), flag(rest, "checkpoint"));
+		}
+		case "chain": {
+			const path = rest[0];
+			if (path === void 0) fail("chain needs a ledger file");
+			return chainMatrix(path, rest);
 		}
 		case "checkpoint": {
 			const path = rest[0];
@@ -2007,7 +2599,26 @@ async function main(argv) {
 				...flag(rest, "out") === void 0 ? {} : { out: flag(rest, "out") }
 			});
 		}
-		case "init": return init(rest);
+		case "init":
+			if (rest[0] === "claude-code") {
+				const { initClaudeCode, stableNode } = await import("./init-DRd-IRR6.js");
+				try {
+					return initClaudeCode(rest.slice(1), {
+						cwd: process.cwd(),
+						node: stableNode(process.execPath, process.env.PATH),
+						bin: resolve(process.argv[1] ?? ""),
+						baseline: bundledBaseline()
+					});
+				} catch (error) {
+					return fail(error instanceof Error ? error.message : String(error));
+				}
+			}
+			return init(rest);
+		case "hook": {
+			if (rest[0] !== "claude-code") fail("hook takes claude-code");
+			const { runHook } = await import("./hook-Gll2spTP.js");
+			return runHook(rest.slice(1));
+		}
 		case "--help":
 		case "-h":
 		case void 0: