prae-cli 0.9.1 → 0.10.0

package/lib/pack-h5n43S0F.js

@@ -0,0 +1,448 @@
+import { t as FRAMEWORKS } from "./frameworks-BgZHGKiH.js";
+
+//#region ../kernel/src/pack.ts
+function isObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+var Check = class {
+	errors = [];
+	fail(path, message) {
+		this.errors.push({
+			path,
+			message
+		});
+	}
+	/** Reject any key the shape does not define. */
+	keys(path, value, allowed) {
+		for (const key of Object.keys(value)) if (!allowed.includes(key)) this.fail(`${path}.${key}`, `unknown field \`${key}\`; expected one of ${allowed.map((k) => `\`${k}\``).join(", ")}`);
+	}
+	text(path, value) {
+		if (typeof value !== "string" || value.trim() === "") {
+			this.fail(path, "expected a non-empty string");
+			return;
+		}
+		return value;
+	}
+	/** A field that accepts one name or a list of them. */
+	names(path, value) {
+		if (typeof value === "string") return value;
+		if (Array.isArray(value)) {
+			const out = [];
+			value.forEach((entry, index) => {
+				const one = this.text(`${path}[${index}]`, entry);
+				if (one !== void 0) out.push(one);
+			});
+			return out;
+		}
+		this.fail(path, "expected a string or an array of strings");
+	}
+	globs(path, value) {
+		if (!Array.isArray(value)) {
+			this.fail(path, "expected an array of path globs");
+			return;
+		}
+		const out = [];
+		value.forEach((entry, index) => {
+			const one = this.text(`${path}[${index}]`, entry);
+			if (one !== void 0) out.push(one);
+		});
+		return out;
+	}
+	number(path, value) {
+		if (typeof value !== "number" || !Number.isFinite(value)) {
+			this.fail(path, "expected a finite number");
+			return;
+		}
+		return value;
+	}
+};
+function readCommandMatch(check, path, value) {
+	if (!isObject(value)) {
+		check.fail(path, "expected an object");
+		return;
+	}
+	check.keys(path, value, [
+		"name",
+		"token",
+		"anyToken",
+		"pipedTo",
+		"pipeline"
+	]);
+	if (value.name === void 0 && value.token === void 0 && value.anyToken === void 0 && value.pipedTo === void 0 && value.pipeline === void 0) check.fail(path, "expected `name`, `token`, `anyToken`, `pipedTo` or `pipeline`; a command matcher with none matches nothing");
+	const out = {};
+	if (value.token !== void 0) {
+		const tokens = check.names(`${path}.token`, value.token);
+		if (tokens !== void 0) out.token = tokens;
+	}
+	if (value.name !== void 0) {
+		const names = check.names(`${path}.name`, value.name);
+		if (names !== void 0) out.name = names;
+	}
+	if (value.anyToken !== void 0) {
+		const tokens = check.names(`${path}.anyToken`, value.anyToken);
+		if (tokens !== void 0) out.anyToken = tokens;
+	}
+	if (value.pipedTo !== void 0) {
+		const pipes = check.names(`${path}.pipedTo`, value.pipedTo);
+		if (pipes !== void 0) out.pipedTo = pipes;
+	}
+	if (value.pipeline !== void 0) {
+		const shapes = check.names(`${path}.pipeline`, value.pipeline);
+		if (shapes !== void 0) out.pipeline = shapes;
+	}
+	return out;
+}
+function readPathMatch(check, path, value) {
+	if (!isObject(value)) {
+		check.fail(path, "expected an object");
+		return;
+	}
+	check.keys(path, value, [
+		"arg",
+		"outside",
+		"inside"
+	]);
+	if (value.outside === void 0 && value.inside === void 0) check.fail(path, "expected `inside` or `outside`; a path matcher with neither matches nothing");
+	const out = {};
+	if (value.arg !== void 0) {
+		const arg = check.text(`${path}.arg`, value.arg);
+		if (arg !== void 0) out.arg = arg;
+	}
+	if (value.outside !== void 0) {
+		const globs = check.globs(`${path}.outside`, value.outside);
+		if (globs !== void 0) out.outside = globs;
+	}
+	if (value.inside !== void 0) {
+		const globs = check.globs(`${path}.inside`, value.inside);
+		if (globs !== void 0) out.inside = globs;
+	}
+	return out;
+}
+function readHostMatch(check, path, value) {
+	if (!isObject(value)) {
+		check.fail(path, "expected an object");
+		return;
+	}
+	check.keys(path, value, [
+		"arg",
+		"in",
+		"notIn"
+	]);
+	if (value.in === void 0 && value.notIn === void 0) check.fail(path, "expected `in` or `notIn`; a host matcher with neither matches nothing");
+	const out = {};
+	if (value.arg !== void 0) {
+		const arg = check.text(`${path}.arg`, value.arg);
+		if (arg !== void 0) out.arg = arg;
+	}
+	if (value.in !== void 0) {
+		const list = check.globs(`${path}.in`, value.in);
+		if (list !== void 0) out.in = list;
+	}
+	if (value.notIn !== void 0) {
+		const list = check.globs(`${path}.notIn`, value.notIn);
+		if (list !== void 0) out.notIn = list;
+	}
+	return out;
+}
+function readArgMatch(check, path, value) {
+	if (!isObject(value)) {
+		check.fail(path, "expected an object");
+		return;
+	}
+	check.keys(path, value, [
+		"name",
+		"above",
+		"below",
+		"equals",
+		"oneOf",
+		"present"
+	]);
+	const name = check.text(`${path}.name`, value.name);
+	if (name === void 0) return void 0;
+	const out = { name };
+	if (value.above !== void 0) {
+		const n = check.number(`${path}.above`, value.above);
+		if (n !== void 0) out.above = n;
+	}
+	if (value.below !== void 0) {
+		const n = check.number(`${path}.below`, value.below);
+		if (n !== void 0) out.below = n;
+	}
+	if (value.equals !== void 0) out.equals = value.equals;
+	if (value.oneOf !== void 0) if (!Array.isArray(value.oneOf)) check.fail(`${path}.oneOf`, "expected an array");
+	else out.oneOf = value.oneOf;
+	if (value.present !== void 0) if (typeof value.present !== "boolean") check.fail(`${path}.present`, "expected a boolean");
+	else out.present = value.present;
+	return out;
+}
+function readSecretsMatch(check, path, value) {
+	if (!isObject(value)) {
+		check.fail(path, "expected an object");
+		return;
+	}
+	check.keys(path, value, [
+		"types",
+		"minConfidence",
+		"atLeast"
+	]);
+	const out = {};
+	if (value.types !== void 0) {
+		const types = check.globs(`${path}.types`, value.types);
+		if (types !== void 0) out.types = types;
+	}
+	if (value.minConfidence !== void 0) {
+		const n = check.number(`${path}.minConfidence`, value.minConfidence);
+		if (n !== void 0) if (n < 0 || n > 1) check.fail(`${path}.minConfidence`, "expected a number between 0 and 1");
+		else out.minConfidence = n;
+	}
+	if (value.atLeast !== void 0) {
+		const n = check.number(`${path}.atLeast`, value.atLeast);
+		if (n !== void 0) if (!Number.isInteger(n) || n < 1) check.fail(`${path}.atLeast`, "expected an integer of at least 1");
+		else out.atLeast = n;
+	}
+	return out;
+}
+function readMatch(check, path, value) {
+	if (!isObject(value)) {
+		check.fail(path, "expected an object");
+		return {};
+	}
+	check.keys(path, value, [
+		"tool",
+		"capability",
+		"plugin",
+		"agent",
+		"command",
+		"path",
+		"host",
+		"arg",
+		"count",
+		"secrets"
+	]);
+	const out = {};
+	for (const key of [
+		"tool",
+		"capability",
+		"plugin",
+		"agent"
+	]) if (value[key] !== void 0) {
+		const names = check.names(`${path}.${key}`, value[key]);
+		if (names !== void 0) out[key] = names;
+	}
+	if (value.command !== void 0) {
+		const match = readCommandMatch(check, `${path}.command`, value.command);
+		if (match !== void 0) out.command = match;
+	}
+	if (value.path !== void 0) {
+		const match = readPathMatch(check, `${path}.path`, value.path);
+		if (match !== void 0) out.path = match;
+	}
+	if (value.host !== void 0) {
+		const match = readHostMatch(check, `${path}.host`, value.host);
+		if (match !== void 0) out.host = match;
+	}
+	if (value.arg !== void 0) if (!Array.isArray(value.arg)) check.fail(`${path}.arg`, "expected an array of argument matchers");
+	else {
+		const list = [];
+		value.arg.forEach((entry, index) => {
+			const one = readArgMatch(check, `${path}.arg[${index}]`, entry);
+			if (one !== void 0) list.push(one);
+		});
+		out.arg = list;
+	}
+	if (value.count !== void 0) if (!isObject(value.count)) check.fail(`${path}.count`, "expected an object");
+	else {
+		check.keys(`${path}.count`, value.count, ["above"]);
+		const above = check.number(`${path}.count.above`, value.count.above);
+		if (above !== void 0) out.count = { above };
+	}
+	if (value.secrets !== void 0) {
+		const match = readSecretsMatch(check, `${path}.secrets`, value.secrets);
+		if (match !== void 0) out.secrets = match;
+	}
+	return out;
+}
+function readEffect(check, path, value) {
+	if (!isObject(value)) {
+		check.fail(path, "expected an object");
+		return;
+	}
+	const kind = value.kind === "hold" ? "ask" : value.kind;
+	if (kind !== "deny" && kind !== "ask" && kind !== "correct" && kind !== "warn" && kind !== "allow") {
+		check.fail(`${path}.kind`, "expected `allow`, `deny`, `hold` (or `ask`), `correct`, or `warn`");
+		return;
+	}
+	check.keys(path, value, kind === "correct" ? [
+		"kind",
+		"set",
+		"because"
+	] : ["kind", "because"]);
+	const because = check.text(`${path}.because`, value.because);
+	if (because === void 0) return void 0;
+	if (kind === "correct") {
+		if (!isObject(value.set) || Object.keys(value.set).length === 0) {
+			check.fail(`${path}.set`, "expected a non-empty object of arguments to set");
+			return;
+		}
+		return {
+			kind,
+			set: value.set,
+			because
+		};
+	}
+	return {
+		kind,
+		because
+	};
+}
+function readRule(check, path, value) {
+	if (!isObject(value)) {
+		check.fail(path, "expected an object");
+		return;
+	}
+	check.keys(path, value, [
+		"id",
+		"title",
+		"description",
+		"when",
+		"effect",
+		"frameworks"
+	]);
+	const id = check.text(`${path}.id`, value.id);
+	const effect = readEffect(check, `${path}.effect`, value.effect);
+	if (value.when === void 0) check.fail(`${path}.when`, "expected an object");
+	const when = readMatch(check, `${path}.when`, value.when ?? {});
+	if (id === void 0 || effect === void 0) return void 0;
+	const rule = {
+		id,
+		when,
+		effect
+	};
+	if (value.title !== void 0) {
+		const title = check.text(`${path}.title`, value.title);
+		if (title !== void 0) rule.title = title;
+	}
+	if (value.description !== void 0) {
+		const description = check.text(`${path}.description`, value.description);
+		if (description !== void 0) rule.description = description;
+	}
+	if (value.frameworks !== void 0) {
+		const frameworks = readFrameworks(check, `${path}.frameworks`, value.frameworks);
+		if (frameworks !== void 0) rule.frameworks = frameworks;
+	}
+	return rule;
+}
+/**
+* A citation names a framework edition and controls the registry knows. A
+* typo here would be a rule that claims a mapping no view can render, so it
+* is a pack error rather than an ignored key — the same line the rest of the
+* parser takes.
+*/
+function readFrameworks(check, path, value) {
+	if (!isObject(value)) {
+		check.fail(path, "expected an object keyed by framework id");
+		return;
+	}
+	const out = {};
+	for (const [framework, controls] of Object.entries(value)) {
+		const known = FRAMEWORKS[framework];
+		if (known === void 0) {
+			check.fail(`${path}.${framework}`, `unknown framework; expected one of ${Object.keys(FRAMEWORKS).map((k) => `\`${k}\``).join(", ")}`);
+			continue;
+		}
+		if (!Array.isArray(controls) || !controls.every((c) => typeof c === "string")) {
+			check.fail(`${path}.${framework}`, "expected an array of control ids");
+			continue;
+		}
+		const ids = controls;
+		for (const control of ids) if (known.controls[control] === void 0) check.fail(`${path}.${framework}`, `unknown control \`${control}\` in ${known.name}`);
+		if (ids.length > 0) out[framework] = [...new Set(ids)];
+	}
+	return out;
+}
+/** Parse and validate a pack. Never throws; every problem lands in `errors`. */
+function parsePack(source) {
+	let raw;
+	try {
+		raw = JSON.parse(source);
+	} catch (error) {
+		return {
+			ok: false,
+			errors: [{
+				path: "",
+				message: `invalid JSON: ${error instanceof Error ? error.message : String(error)}`
+			}]
+		};
+	}
+	const check = new Check();
+	if (!isObject(raw)) return {
+		ok: false,
+		errors: [{
+			path: "",
+			message: "expected an object"
+		}]
+	};
+	check.keys("", raw, [
+		"prae",
+		"pack",
+		"version",
+		"description",
+		"owner",
+		"expires_at",
+		"baseline",
+		"rules"
+	]);
+	if (raw.prae !== "0.1") check.fail(".prae", "expected `\"0.1\"`; this is the only pack version this build reads");
+	const name = check.text(".pack", raw.pack);
+	const version = check.text(".version", raw.version);
+	const description = raw.description === void 0 ? void 0 : check.text(".description", raw.description);
+	const owner = raw.owner === void 0 ? void 0 : check.text(".owner", raw.owner);
+	const expires = raw.expires_at === void 0 ? void 0 : check.text(".expires_at", raw.expires_at);
+	if (expires !== void 0 && (!/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(:\d{2}(\.\d+)?)?(Z|[+-]\d{2}:\d{2})$/.test(expires) || !Number.isFinite(Date.parse(expires)))) check.fail(".expires_at", "expected an ISO 8601 time with a zone, e.g. 2026-10-05T12:00:00Z");
+	let baseline;
+	if (raw.baseline !== void 0) if (!isObject(raw.baseline)) check.fail(".baseline", "expected an object");
+	else {
+		check.keys(".baseline", raw.baseline, ["capabilities"]);
+		const caps = check.globs(".baseline.capabilities", raw.baseline.capabilities);
+		if (caps !== void 0) baseline = { capabilities: caps };
+	}
+	const rules = [];
+	if (!Array.isArray(raw.rules)) check.fail(".rules", "expected an array");
+	else {
+		const seen = /* @__PURE__ */ new Set();
+		raw.rules.forEach((entry, index) => {
+			const rule = readRule(check, `rules[${index}]`, entry);
+			if (rule === void 0) return;
+			if (seen.has(rule.id)) {
+				check.fail(`rules[${index}].id`, `duplicate rule id \`${rule.id}\``);
+				return;
+			}
+			seen.add(rule.id);
+			rules.push(rule);
+		});
+	}
+	if (check.errors.length > 0) return {
+		ok: false,
+		errors: check.errors
+	};
+	if (name === void 0 || version === void 0) return {
+		ok: false,
+		errors: check.errors
+	};
+	return {
+		ok: true,
+		pack: {
+			prae: "0.1",
+			pack: name,
+			version,
+			...description === void 0 ? {} : { description },
+			...owner === void 0 ? {} : { owner },
+			...expires === void 0 ? {} : { expires_at: expires },
+			...baseline === void 0 ? {} : { baseline },
+			rules
+		}
+	};
+}
+
+//#endregion
+export { parsePack as t };

package/lib/playground.js

@@ -351,6 +351,7 @@
 	* appending to a pack can never accidentally widen what an agent may do.
 	*/
 	const STRENGTH = {
+		allow: 0,
 		warn: 1,
 		correct: 2,
 		ask: 3,
@@ -482,6 +483,14 @@
 				evaluated
 			};
 		}
+		const allowed = hits.find((hit) => hit.effect.kind === "allow");
+		if (allowed !== void 0) return {
+			kind: "allow",
+			rule: allowed.rule.id,
+			reason: allowed.effect.because,
+			trace,
+			evaluated
+		};
 		return {
 			kind: "allow",
 			trace,
@@ -854,9 +863,9 @@
 			check.fail(path, "expected an object");
 			return;
 		}
-		const kind = value.kind;
-		if (kind !== "deny" && kind !== "ask" && kind !== "correct" && kind !== "warn") {
-			check.fail(`${path}.kind`, "expected `deny`, `ask`, `correct`, or `warn`");
+		const kind = value.kind === "hold" ? "ask" : value.kind;
+		if (kind !== "deny" && kind !== "ask" && kind !== "correct" && kind !== "warn" && kind !== "allow") {
+			check.fail(`${path}.kind`, "expected `allow`, `deny`, `hold` (or `ask`), `correct`, or `warn`");
 			return;
 		}
 		check.keys(path, value, kind === "correct" ? [
@@ -890,6 +899,7 @@
 		check.keys(path, value, [
 			"id",
 			"title",
+			"description",
 			"when",
 			"effect",
 			"frameworks"
@@ -908,6 +918,10 @@
 			const title = check.text(`${path}.title`, value.title);
 			if (title !== void 0) rule.title = title;
 		}
+		if (value.description !== void 0) {
+			const description = check.text(`${path}.description`, value.description);
+			if (description !== void 0) rule.description = description;
+		}
 		if (value.frameworks !== void 0) {
 			const frameworks = readFrameworks(check, `${path}.frameworks`, value.frameworks);
 			if (frameworks !== void 0) rule.frameworks = frameworks;
@@ -968,12 +982,19 @@
 			"prae",
 			"pack",
 			"version",
+			"description",
+			"owner",
+			"expires_at",
 			"baseline",
 			"rules"
 		]);
 		if (raw.prae !== "0.1") check.fail(".prae", "expected `\"0.1\"`; this is the only pack version this build reads");
 		const name = check.text(".pack", raw.pack);
 		const version = check.text(".version", raw.version);
+		const description = raw.description === void 0 ? void 0 : check.text(".description", raw.description);
+		const owner = raw.owner === void 0 ? void 0 : check.text(".owner", raw.owner);
+		const expires = raw.expires_at === void 0 ? void 0 : check.text(".expires_at", raw.expires_at);
+		if (expires !== void 0 && (!/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(:\d{2}(\.\d+)?)?(Z|[+-]\d{2}:\d{2})$/.test(expires) || !Number.isFinite(Date.parse(expires)))) check.fail(".expires_at", "expected an ISO 8601 time with a zone, e.g. 2026-10-05T12:00:00Z");
 		let baseline;
 		if (raw.baseline !== void 0) if (!isObject(raw.baseline)) check.fail(".baseline", "expected an object");
 		else {
@@ -1010,6 +1031,9 @@
 				prae: "0.1",
 				pack: name,
 				version,
+				...description === void 0 ? {} : { description },
+				...owner === void 0 ? {} : { owner },
+				...expires === void 0 ? {} : { expires_at: expires },
 				...baseline === void 0 ? {} : { baseline },
 				rules
 			}

package/lib/{receipt-check-CD-W1wXs.js → receipt-check-CUuEjGHL.js}

@@ -1,4 +1,4 @@
-import { d as verifyReceipt, s as fingerprint } from "./src-D7g4lvaY.js";
+import { m as verifyReceipt, u as fingerprint } from "./src-Cy-Acrgj.js";
 
 //#region src/receipt-check.ts
 /** Shape we require before we will call it a receipt at all. */