prae-cli 0.9.2 → 0.10.0

package/lib/views-D4UEfbzt.js

@@ -1,1505 +0,0 @@
-//#region ../kernel/src/frameworks.ts
-const FRAMEWORKS = {
-	"owasp-llm-top-10-2026": {
-		name: "OWASP Top 10 for LLM Applications — 2026",
-		short: "OWASP LLM 2026",
-		controls: {
-			LLM01: {
-				name: "Prompt Injection",
-				summary: "Instructions in a prompt or in retrieved content alter what the model does."
-			},
-			LLM02: {
-				name: "Sensitive Information Disclosure",
-				summary: "Credentials, personal data or proprietary content reach the model or its output."
-			},
-			LLM03: {
-				name: "Excessive Agency",
-				summary: "The model can take actions, or holds permissions, beyond what its task needs."
-			},
-			LLM04: {
-				name: "Supply Chain",
-				summary: "A compromised model, dataset, plugin or dependency enters the application."
-			},
-			LLM05: {
-				name: "Data and Model Poisoning",
-				summary: "Training, fine-tuning or embedding data is manipulated to change behaviour."
-			},
-			LLM06: {
-				name: "Unbounded Consumption",
-				summary: "The application permits resource use without a limit, exhausting budget or service."
-			},
-			LLM07: {
-				name: "Misinformation",
-				summary: "The model produces false or misleading content that is acted on as if true."
-			},
-			LLM08: {
-				name: "Hidden Context Exposure",
-				summary: "System prompts, hidden instructions or internal context are revealed."
-			},
-			LLM09: {
-				name: "Vector and Embedding Weaknesses",
-				summary: "Retrieval stores are manipulated or leak across tenants and permissions."
-			},
-			LLM10: {
-				name: "Improper Output Handling",
-				summary: "Model output is passed to downstream systems without validation."
-			}
-		}
-	},
-	"owasp-agentic-top-10-2026": {
-		name: "OWASP Top 10 for Agentic Applications — 2026",
-		short: "OWASP Agentic 2026",
-		controls: {
-			ASI01: {
-				name: "Agent Goal Hijack",
-				summary: "Untrusted input redirects what the agent is trying to do, turning its objectives against its owner."
-			},
-			ASI02: {
-				name: "Tool Misuse and Exploitation",
-				summary: "A legitimate tool the agent already holds is turned to an attacker's ends."
-			},
-			ASI03: {
-				name: "Identity and Privilege Abuse",
-				summary: "The agent's own authority, credentials or delegated access is inherited or escalated."
-			},
-			ASI04: {
-				name: "Agentic Supply Chain",
-				summary: "A poisoned tool, model, plugin, skill or dependency is trusted before the agent runs."
-			},
-			ASI05: {
-				name: "Unexpected Code Execution",
-				summary: "The agent's output reaches something that runs it: a shell, an interpreter, a parser."
-			},
-			ASI06: {
-				name: "Memory and Context Poisoning",
-				summary: "Corrupted memory or retrieved context persists across sessions and steers future reasoning."
-			},
-			ASI07: {
-				name: "Insecure Inter-Agent Communication",
-				summary: "One agent trusts another's messages by default, so a compromised agent can steer its peers."
-			},
-			ASI08: {
-				name: "Cascading Failures",
-				summary: "A single fault propagates across agents, tools and workflows into system-wide impact."
-			},
-			ASI09: {
-				name: "Human-Agent Trust Exploitation",
-				summary: "Persuasive or misleading agent output moves a person to an unsafe action or approval."
-			},
-			ASI10: {
-				name: "Rogue Agents",
-				summary: "A compromised, misaligned or drifting agent keeps operating in unintended ways."
-			}
-		}
-	}
-};
-/**
-* Every framework control a rule cites, resolved to names.
-*
-* A pack that parsed cites only ids the registry knows, so the lookups here
-* cannot miss; the fallbacks exist for a `Rule` built by hand in code.
-*/
-function cite(rule) {
-	const out = [];
-	for (const [framework, controls] of Object.entries(rule.frameworks ?? {})) {
-		const known = FRAMEWORKS[framework];
-		for (const control of controls) out.push({
-			framework,
-			frameworkName: known?.name ?? framework,
-			frameworkShort: known?.short ?? framework,
-			control,
-			controlName: known?.controls[control]?.name ?? control
-		});
-	}
-	return out;
-}
-
-//#endregion
-//#region ../tokens/src/mark.ts
-/**
-* The mark — Guardians — as code.
-*
-* Four corner brackets around a core that none of them touch: the Guardians
-* PRAE assembles around an agent, and the agent, green because what is
-* inside has been verified. The console, the site and the CLI draw it from
-* here, so there is one geometry and no copies to drift. `brand/` holds the
-* same shapes as files, for places that need a file.
-*
-* Grid 32u. Arms 11u long, 5u thick. Core 8u, centred, 5u clear. Radius 0.
-*/
-const MARK = {
-	viewBox: "0 0 32 32",
-	brackets: "M2 2H13V7H7V13H2ZM19 2H30V13H25V7H19ZM2 19H7V25H13V30H2ZM25 19H30V30H19V25H25Z",
-	corners: [
-		{
-			d: "M2 2H13V7H7V13H2Z",
-			dx: -14,
-			dy: -14
-		},
-		{
-			d: "M19 2H30V13H25V7H19Z",
-			dx: 14,
-			dy: -14
-		},
-		{
-			d: "M25 19H30V30H19V25H25Z",
-			dx: 14,
-			dy: 14
-		},
-		{
-			d: "M2 19H7V25H13V30H2Z",
-			dx: -14,
-			dy: 14
-		}
-	],
-	core: {
-		x: 12,
-		y: 12,
-		width: 8,
-		height: 8
-	},
-	colour: {
-		graphite: "#0E1114",
-		ink: "#FFFFFF",
-		signal: "#98ED49",
-		signalOnLight: "#0C6800"
-	}
-};
-/** The inner drawing: brackets and, unless absent, the core. */
-function markShapes({ surface = "graphite", core = "verified", mono = false } = {}) {
-	const ink = surface === "graphite" ? MARK.colour.ink : MARK.colour.graphite;
-	const green = surface === "graphite" ? MARK.colour.signal : MARK.colour.signalOnLight;
-	const coreFill = mono || core === "unverified" ? ink : green;
-	const { x, y, width, height } = MARK.core;
-	const rect = core === "absent" ? "" : `<rect class="prae-core" x="${x}" y="${y}" width="${width}" height="${height}" fill="${coreFill}"/>`;
-	return `${MARK.corners.map((c, i) => `<path class="prae-corner" style="--i:${i};--dx:${c.dx};--dy:${c.dy}" d="${c.d}" fill="${ink}"/>`).join("")}${rect}`;
-}
-/** A complete SVG document of the mark. */
-function markSvg(options = {}) {
-	const size = options.size ?? 32;
-	return `<svg xmlns="http://www.w3.org/2000/svg" viewBox="${MARK.viewBox}" width="${size}" height="${size}">${markShapes(options)}</svg>`;
-}
-/** The mark as a data URI, for an `<img>` that must not fetch anything. */
-function markDataUri(options = {}) {
-	return `data:image/svg+xml;utf8,${encodeURIComponent(markSvg(options))}`;
-}
-
-//#endregion
-//#region ../tokens/src/palette.ts
-/**
-* The two grounds, as declaration blocks.
-*
-* The console renders twice from one design: `prae console --out` inlines its
-* stylesheet into standalone documents, and the web app links a real one. Both
-* need these values, so they are defined here once and the test in this
-* package asserts the stylesheet agrees — the same guard the rest of the
-* tokens already have, for the same reason.
-*
-* Names are unprefixed because these are consumed as a surface's own palette
-* rather than alongside another product's. `tokens.css` carries the prefixed
-* `--prae-*` set for anyone embedding PRAE inside their own page.
-*/
-/** §06 — Surface B, the ledger, on paper. Printable and high-contrast. */
-const PAPER = `  --signal: oklch(0.45 0.16 140);
-  --signal-bright: oklch(0.5 0.16 140);
-  --signal-edge: oklch(0.5 0.13 140);
-  --signal-text: oklch(0.42 0.14 140);
-  --signal-on: oklch(0.985 0.003 100);
-  --hold: oklch(0.55 0.15 55);
-  --veto: oklch(0.52 0.19 25);
-  --veto-text: oklch(0.5 0.19 25);
-  --veto-edge: oklch(0.62 0.17 25);
-
-  --ground: oklch(0.975 0.003 100);
-  --raised: oklch(0.99 0.002 100);
-  --sunk: oklch(0.955 0.004 100);
-  --active: oklch(0.955 0.006 130);
-  --line: oklch(0.88 0.004 100);
-  --line-soft: oklch(0.92 0.004 100);
-  --line-faint: oklch(0.93 0.004 100);
-  --line-card: oklch(0.86 0.005 100);
-  --line-strong: oklch(0.8 0.006 100);
-  --edge: oklch(0.32 0.01 255);
-  --ink: oklch(0.22 0.01 255);
-  --ink-row: oklch(0.24 0.01 255);
-  --secondary: oklch(0.4 0.01 255);
-  --muted: oklch(0.5 0.01 255);
-  --muted-soft: oklch(0.55 0.01 255);
-  --dim: oklch(0.45 0.01 255);
-  --seal: oklch(0.6 0.01 255);
-
-  --mark: none;`;
-/** §02 — the graphite ramp and the neon signal it is drawn for. */
-const FENCE = `  --signal: oklch(0.86 0.21 133);
-  --signal-bright: oklch(0.95 0.15 133);
-  --signal-edge: oklch(0.4 0.06 133);
-  --signal-text: oklch(0.86 0.21 133);
-  --signal-on: oklch(0.155 0.008 255);
-  --hold: oklch(0.83 0.16 78);
-  --veto: oklch(0.66 0.2 25);
-  --veto-text: oklch(0.75 0.16 25);
-  --veto-edge: oklch(0.45 0.12 25);
-
-  --ground: oklch(0.155 0.008 255);
-  --raised: oklch(0.185 0.009 255);
-  --sunk: oklch(0.135 0.008 255);
-  --active: oklch(0.215 0.022 133);
-  --line: oklch(0.28 0.01 255);
-  --line-soft: oklch(0.26 0.01 255);
-  --line-faint: oklch(0.235 0.01 255);
-  --line-card: oklch(0.3 0.01 255);
-  --line-strong: oklch(0.32 0.01 255);
-  --edge: oklch(0.72 0.01 255);
-  --ink: oklch(0.96 0.004 255);
-  --ink-row: oklch(0.9 0.006 255);
-  --secondary: oklch(0.72 0.01 255);
-  --muted: oklch(0.6 0.012 255);
-  /* Lands where paper's does, at AA on its own ground: 0.55 measures 4.03
-     against graphite, and this token labels pending and absent states that
-     still have to be read. */
-  --muted-soft: oklch(0.575 0.012 255);
-  --dim: oklch(0.62 0.012 255);
-  --seal: oklch(0.58 0.012 255);
-
-  /* The mark is a solid black glyph, so it disappears on the graphite ground.
-     Inverting it yields the white it would have been drawn as. */
-  --mark: invert(1);`;
-
-//#endregion
-//#region ../tokens/src/views.ts
-/**
-* The console's view styles, as one definition.
-*
-* Header, stat band, ledger grid, rule and mapping tables, the awaiting-human
-* panel, and the limits block — everything that makes a PRAE view look like a
-* PRAE view rather than a generic table.
-*
-* Both renderers need these. `prae console --out` inlines them into standalone
-* documents; the web app injects them into a global style tag. Exported as a
-* string rather than a stylesheet so there is exactly one copy: a `.css` file
-* plus a mirrored constant would be two, and two copies of a stylesheet drift
-* the same way two copies of a palette do.
-*
-* What is *not* here is layout — the rail, the scroll containment, the routing.
-* The app has a persistent frame and the exporter produces separate documents,
-* and that is the one thing the two are genuinely allowed to disagree about.
-*/
-const VIEWS_CSS = `/* ── header ───────────────────────────────────────────────────────────── */
-.head {
-  display: flex; align-items: flex-end; justify-content: space-between;
-  gap: 24px; padding: 26px 30px 22px; border-bottom: 1px solid var(--line);
-}
-.head h1 { font-size: 30px; font-weight: 700; letter-spacing: -0.03em; margin: 0; }
-.head .meta {
-  font-family: var(--proof); font-size: 11.5px; color: var(--muted); margin-top: 6px;
-}
-.actions { display: flex; align-items: center; gap: 10px; }
-.chain {
-  display: flex; align-items: center; gap: 8px; padding: 7px 12px;
-  border: 1px solid var(--signal-edge); border-radius: 999px;
-  font-family: var(--proof); font-size: 10.5px; letter-spacing: 0.12em;
-  color: var(--signal-text); white-space: nowrap;
-}
-.chain i { width: 6px; height: 6px; background: var(--signal-bright); border-radius: 999px; }
-.chain.broken { border-color: var(--veto-edge); color: var(--veto-text); }
-.chain.broken i { background: var(--veto); }
-.btn {
-  padding: 9px 16px; border: 1px solid var(--line-strong); font-size: 13.5px;
-  border-radius: 2px; background: none; color: inherit; font-family: inherit;
-  white-space: nowrap;
-}
-
-/* ── stat band ────────────────────────────────────────────────────────── */
-.stats { display: grid; grid-template-columns: repeat(4, 1fr); border-bottom: 1px solid var(--line); }
-.stat { padding: 20px 24px; border-right: 1px solid var(--line-soft); }
-.stat:first-child { padding-left: 30px; }
-.stat:last-child { border-right: none; }
-.stat .v {
-  font-size: 28px; font-weight: 700; letter-spacing: -0.03em;
-  font-variant-numeric: tabular-nums;
-}
-.stat .v.veto { color: var(--veto); }
-.stat .v.hold { color: var(--hold); }
-.stat .k {
-  font-family: var(--proof); font-size: 10px; letter-spacing: 0.14em;
-  color: var(--muted); margin-top: 4px;
-}
-
-/* ── ledger table ─────────────────────────────────────────────────────── */
-.grid {
-  display: grid;
-  grid-template-columns: 96px 1fr 150px 130px 104px 120px;
-  gap: 16px;
-}
-.thead {
-  padding: 12px 30px; font-family: var(--proof); font-size: 10px;
-  letter-spacing: 0.14em; color: var(--muted); border-bottom: 1px solid var(--line);
-}
-.row {
-  padding: 14px 30px; font-family: var(--proof); font-size: 12px;
-  border-bottom: 1px solid var(--line-faint); align-items: center;
-}
-.row .seq { color: var(--muted-soft); font-variant-numeric: tabular-nums; }
-.row .call { color: var(--ink-row); overflow-wrap: anywhere; }
-.row .actor, .row .clause { color: var(--dim); }
-.row .seal { color: var(--seal); }
-.row .verdict { letter-spacing: 0.1em; }
-.v-allow { color: var(--signal-text); }
-.v-deny { color: var(--veto-text); }
-.v-ask { color: var(--hold); }
-.v-correct { color: var(--muted); }
-.empty { padding: 30px; font-family: var(--proof); font-size: 12px; color: var(--muted); }
-
-/* ── awaiting-human panel ─────────────────────────────────────────────── */
-.await { padding: 26px 30px 30px; background: var(--sunk); border-top: 1px solid var(--line); }
-.await .k {
-  font-family: var(--proof); font-size: 10px; letter-spacing: 0.16em;
-  color: var(--muted); margin-bottom: 16px;
-}
-.card {
-  display: flex; gap: 24px; align-items: flex-start; background: var(--raised);
-  border: 1px solid var(--line-card); padding: 22px 24px;
-}
-.card h2 { font-size: 20px; font-weight: 600; letter-spacing: -0.02em; margin: 0 0 8px; }
-.card .detail { font-family: var(--proof); font-size: 12px; color: var(--muted); line-height: 1.8; }
-.decide { display: flex; flex-direction: column; gap: 8px; width: 200px; flex: none; }
-.approve {
-  padding: 11px 18px; background: var(--signal); color: var(--signal-on);
-  font-weight: 600; font-size: 13.5px; text-align: center; border-radius: 2px;
-  border: none; font-family: inherit;
-}
-.deny {
-  padding: 11px 18px; border: 1px solid var(--veto-edge); color: var(--veto-text);
-  font-weight: 600; font-size: 13.5px; text-align: center; border-radius: 2px;
-  background: none; font-family: inherit;
-}
-/*
- * A control that cannot act must not look like one that can. These render so
- * the reader knows where the decision lives, and read as inert so they never
- * reach for it — the harness settles approvals, and a button that looks live
- * here would be an invitation to a second audit trail.
- *
- * The fill is dropped rather than faded. Fading a filled button works against
- * paper and fails against graphite, where a dimmed green block still reads as
- * a live primary action; an outline reads the same on either ground.
- */
-.approve[disabled], .deny[disabled] {
-  background: none; border: 1px solid var(--line-strong);
-  color: var(--muted-soft); font-weight: 500; cursor: not-allowed;
-}
-.recorded {
-  font-family: var(--proof); font-size: 10px; color: var(--muted-soft);
-  text-align: center; letter-spacing: 0.08em;
-}
-
-/* ── limits ───────────────────────────────────────────────────────────── */
-.limits { padding: 22px 30px 28px; border-top: 1px solid var(--line); }
-.limits .k {
-  font-family: var(--proof); font-size: 10px; letter-spacing: 0.16em;
-  color: var(--muted); margin-bottom: 10px;
-}
-.limits ul { margin: 0; padding-left: 18px; font-size: 13px; line-height: 1.7; color: var(--secondary); }
-.limits code { font-family: var(--proof); font-size: 12px; }
-
-/* ── rule / mapping tables, shared by the packs and compliance views ──── */
-.rules { display: grid; grid-template-columns: 110px 1fr 96px; gap: 16px; }
-.map { display: grid; grid-template-columns: 210px 1fr 96px; gap: 16px; }
-.sect { padding: 22px 30px 8px; }
-.sect h2 {
-  font-size: 20px; font-weight: 600; letter-spacing: -0.02em; margin: 0 0 4px;
-}
-.sect p {
-  margin: 0 0 4px; font-size: 14px; line-height: 1.6; color: var(--secondary);
-  max-width: 76ch;
-}
-.caps { display: flex; flex-wrap: wrap; gap: 6px; padding: 4px 30px 22px; }
-.cap {
-  font-family: var(--proof); font-size: 12px; padding: 6px 10px;
-  border: 1px solid var(--signal-edge); color: var(--signal-text);
-  border-radius: 2px;
-}
-.cap.off {
-  border-color: var(--line-strong); color: var(--muted-soft);
-  text-decoration: line-through;
-}
-.effect { letter-spacing: 0.1em; font-size: 11px; }
-.e-deny { color: var(--veto-text); }
-.e-ask { color: var(--hold); }
-.e-warn { color: var(--muted); }
-.e-correct { color: var(--signal-text); }
-.covered { color: var(--signal-text); }
-.partial { color: var(--hold); }
-.absent { color: var(--muted-soft); }
-
-button { cursor: pointer; }
-a:focus-visible, button:focus-visible { outline: 2px solid var(--signal); outline-offset: 2px; }
-`;
-
-//#endregion
-//#region ../tokens/src/index.ts
-/** The Google Fonts stylesheet both surfaces link. */
-const FONT_HREF = "https://fonts.googleapis.com/css2?family=Space+Grotesk:wght@400;500;600;700&family=IBM+Plex+Mono:wght@400;500;600&display=swap";
-/**
-* Verdict chip labels. Uppercase, mono, and never rendered without a clause
-* reference within 8px — §04 is explicit that a chip alone is not allowed.
-*/
-const VERDICT_LABEL = {
-	allow: "ALLOWED",
-	ask: "HELD",
-	deny: "DENIED",
-	correct: "CORRECTED"
-};
-
-//#endregion
-//#region src/console/logo.ts
-const LOGO = markDataUri({ size: 26 });
-
-//#endregion
-//#region src/console/shell.ts
-function esc(value) {
-	return String(value).replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
-}
-/** The stylesheet both console views share. Tokens first, then the surface. */
-/** The stylesheet both console views share. Tokens first, then the surface. */
-const SHEET = `
-:root {
-${PAPER}
-  --claim: 'Space Grotesk', ui-sans-serif, system-ui, sans-serif;
-  --proof: 'IBM Plex Mono', ui-monospace, 'SF Mono', Menlo, monospace;
-  --ease: cubic-bezier(0.2, 0, 0, 1);
-  --surface-motion: 180ms;
-}
-
-/* An explicit choice, remembered. */
-:root[data-theme='dark'] {
-${FENCE}
-}
-
-/* No choice made: follow the machine, unless the reader has said light. */
-@media (prefers-color-scheme: dark) {
-  :root:not([data-theme='light']) {
-${FENCE}
-  }
-}
-
-/*
- * The ground moves at the surface budget, and only while it is moving.
- *
- * Arming this permanently would put a 180ms fade on every hover and every
- * verdict that renders, so the class goes on for one toggle and comes off.
- * §01's 0ms rule is about a decision animating in; nothing is deciding here,
- * the page is repainting, and a verdict that snapped while the page behind it
- * faded would read as a glitch.
- */
-html.theming, html.theming * {
-  transition:
-    background-color var(--surface-motion) var(--ease),
-    border-color var(--surface-motion) var(--ease),
-    color var(--surface-motion) var(--ease),
-    fill var(--surface-motion) var(--ease) !important;
-}
-
-* { box-sizing: border-box; }
-
-/*
- * An application, not a document: the shell fills the viewport and only the
- * content column scrolls, so the rail and the header stay where a reader left
- * them. Print undoes all of it further down — the same page still has to
- * flatten into evidence.
- */
-html, body { height: 100%; }
-body {
-  margin: 0;
-  background: var(--ground);
-  color: var(--ink);
-  font-family: var(--claim);
-  -webkit-font-smoothing: antialiased;
-  overflow: hidden;
-}
-
-.wrap { height: 100%; }
-.scroll { height: 100%; }
-
-.console {
-  background: var(--ground);
-  display: grid;
-  grid-template-columns: 232px 1fr;
-  height: 100%;
-  min-height: 0;
-}
-
-/* The one column that moves. */
-.console > main {
-  overflow-y: auto;
-  overflow-x: auto;
-  min-height: 0;
-  scroll-behavior: smooth;
-}
-
-/* ── rail ─────────────────────────────────────────────────────────────── */
-.rail {
-  border-right: 1px solid var(--line); padding: 22px 0;
-  overflow-y: auto; min-height: 0;
-  display: flex; flex-direction: column;
-}
-.rail .compliance { margin-top: auto; }
-
-/*
- * Two positions, named, rather than a switch with a state you have to infer.
- * Hidden until the head script has run: without scripting it would be a
- * control that does nothing.
- */
-.ground { display: none; margin: auto 20px 14px; }
-html.js .ground { display: grid; grid-template-columns: 1fr 1fr; }
-html.js .rail .compliance { margin-top: 0; }
-.ground button {
-  font-family: var(--proof); font-size: 10px; letter-spacing: 0.14em;
-  padding: 6px 0; background: none; color: var(--muted);
-  border: 1px solid var(--line); border-radius: 0;
-  transition: color 120ms var(--ease), border-color 120ms var(--ease);
-}
-.ground button:first-child { border-radius: 2px 0 0 2px; border-right: none; }
-.ground button:last-child { border-radius: 0 2px 2px 0; }
-.ground button:hover { color: var(--secondary); }
-:root:not([data-theme='dark']) .ground [data-ground='paper'],
-:root[data-theme='dark'] .ground [data-ground='fence'] {
-  color: var(--ink); border-color: var(--line-strong); background: var(--active);
-}
-.brand { display: flex; align-items: center; gap: 10px; padding: 0 20px 22px; }
-/* The canvas sizes the mark at 26px; the glyph is square and needs no frame. */
-.mark { width: 26px; height: 26px; display: block; filter: var(--mark); }
-.brand b {
-  font-weight: 700; font-size: 16px; letter-spacing: 0.04em;
-}
-.eyebrow {
-  font-family: var(--proof); font-size: 10px; letter-spacing: 0.16em;
-  color: var(--muted-soft); padding: 0 20px 10px;
-}
-.nav { display: grid; }
-.nav a, .nav span {
-  padding: 10px 20px; font-size: 14.5px; color: var(--secondary);
-  text-decoration: none; display: flex; justify-content: space-between;
-  align-items: center;
-}
-.nav a { transition: background var(--t-state, 120ms) var(--ease, cubic-bezier(.2,0,0,1)),
-                     color var(--t-state, 120ms) var(--ease, cubic-bezier(.2,0,0,1)); }
-.nav a:hover { background: var(--sunk); }
-
-/*
- * The surface transition, spent where the language says to spend it. Verdicts
- * are deliberately excluded: a decision appears, it never animates in.
- */
-main > * { animation: surface 180ms cubic-bezier(0.2, 0, 0, 1) both; }
-@keyframes surface {
-  from { opacity: 0; transform: translateY(4px); }
-  to { opacity: 1; transform: none; }
-}
-main.leaving { opacity: 0; transition: opacity 120ms cubic-bezier(0.2, 0, 0, 1); }
-@media (prefers-reduced-motion: reduce) {
-  main > *, main.leaving { animation: none; transition: none; }
-  .console > main { scroll-behavior: auto; }
-  :root { --surface-motion: 0ms; }
-}
-.nav .pending { color: var(--muted-soft); }
-.nav .badge.soon {
-  font-size: 9px; letter-spacing: 0.14em; color: var(--muted-soft);
-  border: 1px solid var(--line); border-radius: 999px; padding: 1px 6px;
-}
-.nav a.on {
-  font-weight: 600; color: var(--ink);
-  border-left: 2px solid var(--signal-bright);
-  background: var(--active); margin-left: -1px;
-}
-.nav .badge { font-family: var(--proof); font-size: 11px; color: var(--hold); }
-.compliance {
-  margin: 22px 20px 0; padding-top: 18px; border-top: 1px solid var(--line-soft);
-  font-family: var(--proof); font-size: 10.5px; line-height: 1.9; color: var(--muted);
-}
-
-${VIEWS_CSS}
-
-/* Print is a first-class state, not an afterthought. */
-@media print {
-  @page { margin: 12mm; }
-  /* Evidence prints on paper. The fence has no printed form. */
-  :root, :root[data-theme='dark'] {
-${PAPER}
-  }
-  html.theming, html.theming * { transition: none !important; }
-  html, body { height: auto; overflow: visible; }
-  body { padding: 0; background: #fff; }
-  .wrap, .scroll { height: auto; }
-  .console > main { overflow: visible; height: auto; }
-  main > * { animation: none; }
-  .console {
-    border: none; grid-template-columns: 1fr; min-width: 0;
-    height: auto; display: block;
-  }
-  .rail, .actions, .decide, .ground { display: none; }
-  .thead { display: grid; }
-  thead { display: table-header-group; }
-  .row { break-inside: avoid; }
-  /* A chip is colour; a printed page may not be. Keep the word. */
-  .chain { border-color: currentColor !important; }
-  .stats { break-inside: avoid; }
-}
-`;
-/**
-* Resolve the ground before the first paint.
-*
-* This runs in `<head>`, synchronously, on purpose: read the choice after the
-* body has painted and the reader watches the page flash the wrong palette on
-* every navigation. It also marks the document as scripted, which is what
-* reveals the toggle — a control that cannot work should not be offered.
-*/
-const GROUND_SCRIPT = `
-(() => {
-  const root = document.documentElement;
-  root.classList.add('js');
-  let choice = null;
-  try { choice = localStorage.getItem('prae-ground'); } catch (e) {}
-  if (choice !== 'dark' && choice !== 'light') {
-    choice = matchMedia('(prefers-color-scheme: dark)').matches ? 'dark' : 'light';
-  }
-  root.dataset.theme = choice;
-})();
-`;
-/**
-* Client-side navigation, as progressive enhancement.
-*
-* Every view is still a complete document that opens, prints and mails on its
-* own — that requirement has not moved. This only intercepts a click when the
-* page is being served, swaps the main column, and leaves the rail alone, so
-* the frame stays put and the surface transition the language budgets actually
-* has somewhere to happen. With scripting off, the links are ordinary links.
-*/
-const NAV_SCRIPT = `
-(() => {
-  const main = () => document.querySelector('main');
-  const rail = () => document.querySelector('.rail');
-  if (!main() || !window.fetch) return;
-
-  const swap = async (href, push) => {
-    const target = main();
-    target.classList.add('leaving');
-    try {
-      const res = await fetch(href, { headers: { accept: 'text/html' } });
-      if (!res.ok) throw new Error(String(res.status));
-      const doc = new DOMParser().parseFromString(await res.text(), 'text/html');
-      const next = doc.querySelector('main');
-      const nextRail = doc.querySelector('.rail');
-      if (!next) throw new Error('no main');
-
-      // Collect the view's scripts BEFORE moving it: replaceWith detaches the
-      // element from the parsed document, so querying that document afterwards
-      // finds nothing and the view arrives inert. A parser-created script never
-      // executes on insertion either, which is why each is re-created below.
-      const scripts = [...next.querySelectorAll('script')].map((s) => s.textContent);
-      for (const s of next.querySelectorAll('script')) s.remove();
-
-      target.replaceWith(next);
-      // Only the rail's active marker changes; the element itself stays, so
-      // nothing in it flickers or loses scroll position.
-      if (nextRail) rail().innerHTML = nextRail.innerHTML;
-      if (doc.title) document.title = doc.title;
-      if (push) history.pushState({}, '', href);
-      next.scrollTop = 0;
-      wire();
-      for (const code of scripts) {
-        const el = document.createElement('script');
-        el.textContent = code;
-        document.body.appendChild(el);
-      }
-    } catch {
-      // A failed swap falls back to a real navigation rather than stranding
-      // the reader on a half-updated page.
-      location.href = href;
-    }
-  };
-
-  const wire = () => {
-    for (const a of document.querySelectorAll('.nav a[href$=".html"]')) {
-      a.addEventListener('click', (e) => {
-        if (e.metaKey || e.ctrlKey || e.shiftKey || e.button !== 0) return;
-        e.preventDefault();
-        swap(a.getAttribute('href'), true);
-      });
-    }
-  };
-
-  // Delegated, because a client-side swap replaces the rail's markup and a
-  // handler bound to the old buttons would go with it.
-  let settle;
-  document.addEventListener('click', (e) => {
-    const button = e.target.closest('[data-ground]');
-    if (!button) return;
-    const next = button.dataset.ground === 'fence' ? 'dark' : 'light';
-    const root = document.documentElement;
-    if (root.dataset.theme === next) return;
-
-    // Arm the transition, let the current palette paint once, then move. Doing
-    // both in one frame gives the browser no 'from' state and it jumps.
-    root.classList.add('theming');
-    void root.offsetHeight;
-    root.dataset.theme = next;
-    try { localStorage.setItem('prae-ground', next); } catch (err) {}
-    clearTimeout(settle);
-    settle = setTimeout(() => root.classList.remove('theming'), 240);
-  });
-
-  addEventListener('popstate', () => swap(location.pathname, false));
-  wire();
-})();
-`;
-/** Wrap a view in the console shell: rail, then the view's own header and body. */
-function renderShell(page) {
-	return `<!doctype html>
-<html lang="en" data-prae="ledger"><head>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<title>${esc(page.title)}</title>
-<link rel="preconnect" href="https://fonts.googleapis.com">
-<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
-<link href="${FONT_HREF}" rel="stylesheet">
-<script>${GROUND_SCRIPT}<\/script>
-<style>${SHEET}</style>
-</head><body>
-<div class="wrap"><div class="scroll">
-<div class="console">
-  <nav class="rail">
-    <div class="brand"><img class="mark" src="${LOGO}" alt=""><b>PRAE</b></div>
-    <div class="eyebrow">CONTROL PLANE</div>
-    ${page.nav}
-    <div class="ground" role="group" aria-label="Ground">
-      <button type="button" data-ground="paper">PAPER</button>
-      <button type="button" data-ground="fence">FENCE</button>
-    </div>
-    <div class="compliance">EU AI ACT art. 12<br>NIST AI 600-1<br>SOC 2 CC7.2</div>
-  </nav>
-  <main>
-${page.head}
-${page.body}
-  </main>
-</div>
-</div></div>
-<script>${NAV_SCRIPT}<\/script>
-</body></html>
-`;
-}
-function renderNav(items, active) {
-	return `<div class="nav">\n${items.map((item) => {
-		const classes = [item.label === active ? "on" : "", item.pending === true ? "pending" : ""].filter(Boolean).join(" ");
-		const attr = classes === "" ? "" : ` class="${classes}"`;
-		const badge = item.pending === true ? "<span class=\"badge soon\">SOON</span>" : item.badge === void 0 || item.badge === 0 ? "" : `<span class="badge">${item.badge}</span>`;
-		const href = item.pending === true ? "" : ` href="${esc(item.href ?? "#")}"`;
-		const tag = item.pending === true ? "span" : "a";
-		return `    <${tag}${href}${attr}>${esc(item.label)}${badge}</${tag}>`;
-	}).join("\n")}\n    </div>`;
-}
-
-//#endregion
-//#region ../controls/src/index.ts
-const EU_AI_ACT = {
-	id: "eu-ai-act-2024",
-	name: "EU AI Act — Regulation (EU) 2024/1689"
-};
-const NIST_600_1 = {
-	id: "nist-ai-600-1-2024",
-	name: "NIST AI 600-1 (2024) — Generative AI profile"
-};
-const SOC_2 = {
-	id: "soc2-tsc-2017",
-	name: "SOC 2 — Trust Services Criteria (2017)"
-};
-/**
-* What each control asks for, and what this profile actually produces.
-*
-* Framed as evidence toward a control, never as compliance with it. Nothing
-* here certifies anything: an auditor decides whether the evidence satisfies
-* the obligation, and a tool that told them the answer would be selling the
-* one thing it cannot supply.
-*/
-const isEvent = (e) => e.tool.startsWith("prae:") || e.tool === "system-prompt";
-const decisionsOf = (data) => data.entries.filter((e) => !isEvent(e));
-const allRules = (data) => (data.pack?.rules ?? []).map((r) => r.id);
-/** Rows under the given rules. */
-const under = (data, rules) => {
-	const ids = new Set(rules);
-	return {
-		rules,
-		rows: data.entries.filter((e) => e.rule !== void 0 && ids.has(e.rule))
-	};
-};
-/** Refusals and holds, with the rules that produced them. */
-function heldAndRefused(data) {
-	const rows = decisionsOf(data).filter((e) => e.verdict === "deny" || e.verdict === "ask");
-	return {
-		rules: [...new Set(rows.flatMap((e) => e.rule ? [e.rule] : []))],
-		rows
-	};
-}
-const OBLIGATIONS = [
-	{
-		id: "EU AI Act art. 12",
-		code: "Art. 12",
-		name: "Record-keeping",
-		standard: EU_AI_ACT,
-		trace: (data) => ({
-			rules: [],
-			rows: data.entries
-		}),
-		asks: "Automatic recording of events over the lifetime of the system, to a degree that enables tracing.",
-		evidence: (data) => ({
-			state: data.entries.length > 0 ? "covered" : "partial",
-			note: data.entries.length > 0 ? `${data.entries.length} decisions recorded, each with the clause that produced it and a hash linking it to the one before.` : "Recording is configured but nothing has been logged yet."
-		})
-	},
-	{
-		id: "NIST AI 600-1 · GV-1.2",
-		name: "Trustworthy AI in policy",
-		standard: NIST_600_1,
-		trace: (data) => ({
-			rules: allRules(data),
-			rows: []
-		}),
-		asks: "Characteristics of trustworthy AI are integrated into organisational policies.",
-		evidence: (data) => ({
-			state: data.pack === void 0 ? "absent" : "covered",
-			note: data.pack === void 0 ? "No pack supplied to this view." : `${data.pack.rules.length} rules are declared as data and applied to every tool call, rather than living in a runbook.`
-		})
-	},
-	{
-		id: "NIST AI 600-1 · MS-2.6",
-		name: "Regular safety evaluation",
-		standard: NIST_600_1,
-		asks: "AI system is evaluated regularly for safety risks, with results documented.",
-		evidence: () => ({
-			state: "partial",
-			note: "Decisions are documented per call. Periodic evaluation of the policy itself is an operator process this tool does not perform."
-		})
-	},
-	{
-		id: "SOC 2 · CC7.2",
-		name: "Monitoring for anomalies",
-		standard: SOC_2,
-		trace: (data) => heldAndRefused(data),
-		asks: "The entity monitors system components for anomalies indicative of malicious acts.",
-		evidence: (data) => ({
-			state: data.entries.some((e) => e.verdict === "deny") ? "covered" : "partial",
-			note: `Refusals and held calls are recorded with their clause. ${data.entries.some((e) => e.verdict === "deny") ? "This record contains refusals." : "This record contains none yet, so the monitoring is unproven in practice."}`
-		})
-	},
-	{
-		id: "SOC 2 · CC6.1",
-		name: "Logical access restriction",
-		standard: SOC_2,
-		trace: (data) => ({
-			rules: allRules(data),
-			rows: []
-		}),
-		asks: "Logical access to protected information assets is restricted to authorised users.",
-		evidence: () => ({
-			state: "partial",
-			note: "Capabilities are restricted per agent. Authorisation of the human is not: approvals record what was decided, never who decided it."
-		})
-	}
-];
-const OWASP = "owasp-llm-top-10-2026";
-const AGENTIC = "owasp-agentic-top-10-2026";
-/** Rules in the pack that cite one control of one framework. */
-function citing(pack, framework, control) {
-	return (pack?.rules ?? []).filter((rule) => (rule.frameworks?.[framework] ?? []).includes(control));
-}
-/**
-* Why a runtime execution gate is not the control for a risk no rule cites.
-*
-* Said per risk rather than as one generic line, because "out of scope" with
-* no reason reads as an excuse. Each of these is a boundary a reader can
-* check: the risk lives somewhere a tool-call gate does not stand.
-*/
-const NOT_THIS_BOUNDARY = {
-	LLM04: "Where a model or dependency came from is settled before an agent runs; the gate sees the call, not the provenance.",
-	LLM05: "Training and fine-tuning data sit outside the execution boundary this gate stands on.",
-	LLM07: "Whether an answer is true is not a property of a tool call.",
-	LLM08: "The assembled system prompt is sealed into the ledger as evidence of what the model was told; nothing here stops the model repeating it.",
-	LLM09: "Retrieval stores are upstream of the call the gate judges.",
-	LLM10: "What downstream code does with model output is that code's boundary, not this one's.",
-	ASI04: "Where a tool, skill or plugin came from is settled before the agent runs. A rule on the skill tool (integrity, source) is how a pack refuses to trust one at load time; none in this pack does.",
-	ASI06: "Memory and retrieval stores are upstream of the call the gate judges. What the gate can do is seal what the agent was told (PRAE-ASM, PRAE-CTX) so a poisoned context is evidenced, never silent; this record holds no such seal.",
-	ASI07: "A message between agents is not a tool call; when it becomes one, it is judged like any other agent's call. The channel itself is outside this boundary.",
-	ASI09: "Whether a person was misled is not a property of a tool call. An ask verdict puts a human in the path and seals the outcome; nothing here judges the persuasion."
-};
-/**
-* A risk this gate answers by *not* answering it: nothing here detects an
-* injected instruction or a hijacked goal, and saying otherwise would be the
-* claim a red team disproves first. What the gate does is bound what the
-* subverted agent can execute — the cited controls of another risk doing
-* their job. Said in those words, every time.
-*/
-const BOUNDED_BY = {
-	LLM01: {
-		framework: OWASP,
-		control: "LLM03"
-	},
-	ASI01: {
-		framework: AGENTIC,
-		control: "ASI02"
-	}
-};
-function bounded(data, risk, by) {
-	const bounding = citing(data.pack, by.framework, by.control);
-	const what = risk === "ASI01" ? "a hijacked goal" : "injected instructions";
-	const who = risk === "ASI01" ? "a hijacked agent" : "an injected instruction";
-	return {
-		state: "partial",
-		note: bounding.length === 0 ? `Not mitigated: this gate does not detect ${what}, and no ${by.control} control in this pack bounds what ${who} can execute.` : `Not mitigated: this gate does not detect ${what}. Bounded: ${bounding.length} ${by.control} control${bounding.length === 1 ? "" : "s"} (${bounding.map((r) => r.id).join(", ")}) decide what ${who} can execute.`
-	};
-}
-/**
-* Risks whose evidence is in the record rather than in a citing rule.
-*
-* ASI06: a poisoned context cannot be prevented here, but every change to what
-* the agent was told is sealed, so it is evidenced. ASI10: a drifting agent's
-* actions are judged like any other's; what the record shows is whether the
-* gate refused any of them.
-*/
-const FROM_THE_RECORD = {
-	ASI06: (data) => {
-		const seals = data.entries.filter((e) => e.rule === "PRAE-ASM" || e.rule === "PRAE-CTX");
-		return seals.length === 0 ? void 0 : {
-			state: "partial",
-			note: `Evidenced, not prevented: ${seals.length} seal${seals.length === 1 ? "" : "s"} of what the agent was told (PRAE-ASM / PRAE-CTX) in this record; a poisoned context changes the hash and is answerable afterwards.`
-		};
-	},
-	ASI10: (data) => {
-		const refused = data.entries.filter((e) => e.verdict === "deny").length;
-		const armed = [
-			"ASI02",
-			"ASI03",
-			"ASI08"
-		].flatMap((c) => citing(data.pack, AGENTIC, c));
-		if (armed.length === 0) return void 0;
-		return {
-			state: refused > 0 ? "covered" : "partial",
-			note: refused > 0 ? `A drifting agent's actions are judged like any other's: ${armed.length} controls under ASI02/03/08 apply to every call, and ${refused} refusal${refused === 1 ? "" : "s"} in this record show them holding.` : `A drifting agent's actions are judged like any other's: ${armed.length} controls under ASI02/03/08 apply to every call; none has refused one in this record yet. Detecting drift itself is derived from the record, not a rule.`
-		};
-	}
-};
-function frameworkRow(frameworkId, control) {
-	const framework = FRAMEWORKS[frameworkId];
-	const risk = framework?.controls[control];
-	const name = risk?.name ?? control;
-	return {
-		id: `${framework?.short ?? frameworkId} · ${control}`,
-		asks: `${name}. ${risk?.summary ?? ""}`.trim(),
-		trace: (data) => {
-			const by = BOUNDED_BY[control];
-			if (by !== void 0) return under(data, citing(data.pack, by.framework, by.control).map((r) => r.id));
-			const rules = citing(data.pack, frameworkId, control).map((r) => r.id);
-			if (rules.length > 0) return under(data, rules);
-			if (control === "ASI06") return {
-				rules: [],
-				rows: data.entries.filter((e) => e.rule === "PRAE-ASM" || e.rule === "PRAE-CTX")
-			};
-			if (control === "ASI10") return {
-				rules: [
-					"ASI02",
-					"ASI03",
-					"ASI08"
-				].flatMap((c) => citing(data.pack, AGENTIC, c)).map((r) => r.id),
-				rows: decisionsOf(data).filter((e) => e.verdict === "deny")
-			};
-			return {
-				rules: [],
-				rows: []
-			};
-		},
-		evidence: (data) => {
-			if (data.pack === void 0) return {
-				state: "absent",
-				note: "No pack supplied to this view."
-			};
-			const by = BOUNDED_BY[control];
-			if (by !== void 0) return bounded(data, control, by);
-			const rules = citing(data.pack, frameworkId, control);
-			if (rules.length === 0) {
-				const derived = FROM_THE_RECORD[control]?.(data);
-				if (derived !== void 0) return derived;
-				return {
-					state: "absent",
-					note: NOT_THIS_BOUNDARY[control] ?? "No rule in this pack cites this risk."
-				};
-			}
-			const ids = new Set(rules.map((rule) => rule.id));
-			const decisions = data.entries.filter((entry) => entry.rule !== void 0 && ids.has(entry.rule));
-			const listed = rules.map((rule) => rule.id).join(", ");
-			return decisions.length > 0 ? {
-				state: "covered",
-				note: `${rules.length} control${rules.length === 1 ? "" : "s"} mapped (${listed}) · ${decisions.length} sealed decision${decisions.length === 1 ? "" : "s"} under them in this record.`
-			} : {
-				state: "partial",
-				note: `${rules.length} control${rules.length === 1 ? "" : "s"} mapped (${listed}); none has decided a call in this record yet, so the mapping is declared, not exercised.`
-			};
-		}
-	};
-}
-const rowsOf = (frameworkId) => Object.keys(FRAMEWORKS[frameworkId]?.controls ?? {}).map((control) => frameworkRow(frameworkId, control));
-const ISO_42001 = {
-	id: "iso-iec-42001-2023",
-	name: "ISO/IEC 42001:2023 — AI management system, Annex A"
-};
-const ISO_27001 = {
-	id: "iso-iec-27001-2022",
-	name: "ISO/IEC 27001:2022 — Annex A"
-};
-/** Rules in the pack whose `when` names a capability matching `test`. */
-function rulesOn(pack, test) {
-	return (pack?.rules ?? []).filter((rule) => {
-		const cap = rule.when.capability;
-		return (cap === void 0 ? [] : typeof cap === "string" ? [cap] : cap).some(test);
-	});
-}
-/** The record itself: recorded, chained, and how much of it is signed. */
-function recorded(data) {
-	const n = data.entries.length;
-	if (n === 0) return {
-		state: "partial",
-		note: "Recording is configured but nothing has been logged yet."
-	};
-	const signed = data.entries.filter((e) => e.sig !== void 0).length;
-	if (!data.verification.ok) return {
-		state: "partial",
-		note: `${n} rows recorded, but the chain does not verify: the log is present and its integrity is not.`
-	};
-	return {
-		state: "covered",
-		note: `${n} rows recorded, each hash-linked to the one before, chain intact${signed > 0 ? `, ${signed} of ${n} signed` : ", unsigned"} — an edited, removed or reordered row breaks it.`
-	};
-}
-/** Refusals and holds, recorded with their clause. */
-function monitored(data) {
-	const refused = decisionsOf(data).filter((e) => e.verdict === "deny").length;
-	const held = decisionsOf(data).filter((e) => e.verdict === "ask").length;
-	return refused + held > 0 ? {
-		state: "covered",
-		note: `Every call is judged as it happens; this record holds ${refused} refusal${refused === 1 ? "" : "s"} and ${held} hold${held === 1 ? "" : "s"} for a human, each with the clause that produced it.`
-	} : {
-		state: "partial",
-		note: "Every call is judged as it happens, but this record contains no refusal or hold yet, so the monitoring is unproven in practice."
-	};
-}
-const ISO_CONTROLS = [
-	{
-		id: "ISO/IEC 42001 · A.2.2",
-		name: "AI policy",
-		standard: ISO_42001,
-		trace: (data) => ({
-			rules: allRules(data),
-			rows: []
-		}),
-		asks: "The organisation has a documented policy for developing or using AI systems.",
-		evidence: (data) => data.pack === void 0 ? {
-			state: "absent",
-			note: "No pack supplied to this view."
-		} : {
-			state: "partial",
-			note: `The executable part of an AI policy: ${data.pack.rules.length} rules declared as data and applied to every tool call. The policy document and its approval are the organisation's.`
-		}
-	},
-	{
-		id: "ISO/IEC 42001 · A.6.2.6",
-		name: "AI system operation and monitoring",
-		standard: ISO_42001,
-		trace: heldAndRefused,
-		asks: "The AI system is monitored while it operates, and what is found is acted on.",
-		evidence: monitored
-	},
-	{
-		id: "ISO/IEC 42001 · A.6.2.8",
-		name: "Recording of event logs",
-		standard: ISO_42001,
-		trace: (data) => ({
-			rules: [],
-			rows: data.entries
-		}),
-		asks: "Event logs are kept while the AI system is in use.",
-		evidence: recorded
-	},
-	{
-		id: "ISO/IEC 42001 · A.9.4",
-		name: "Intended use of the AI system",
-		standard: ISO_42001,
-		trace: (data) => {
-			const rows = decisionsOf(data).filter((e) => e.verdict === "deny");
-			return {
-				rules: [...new Set(rows.flatMap((e) => e.rule ? [e.rule] : []))],
-				rows
-			};
-		},
-		asks: "The AI system is used only for its intended uses.",
-		evidence: (data) => {
-			if (data.pack === void 0) return {
-				state: "absent",
-				note: "No pack supplied to this view."
-			};
-			const refused = decisionsOf(data).filter((e) => e.verdict === "deny").length;
-			return refused > 0 ? {
-				state: "covered",
-				note: `Intended use is enforced as scope: ${refused} action${refused === 1 ? "" : "s"} outside it refused before execution in this record.`
-			} : {
-				state: "partial",
-				note: "Intended use is enforced as scope by the pack; nothing outside it has been attempted in this record yet."
-			};
-		}
-	},
-	{
-		id: "ISO/IEC 27001 · A.8.3",
-		name: "Information access restriction",
-		standard: ISO_27001,
-		trace: (data) => ({
-			rules: rulesOn(data.pack, (c) => c.startsWith("fs:")).map((r) => r.id),
-			rows: decisionsOf(data).filter((e) => e.verdict === "deny" && e.capability?.startsWith("fs:"))
-		}),
-		asks: "Access to information is restricted according to the access-control policy.",
-		evidence: (data) => {
-			const rules = rulesOn(data.pack, (c) => c.startsWith("fs:"));
-			if (rules.length === 0) return {
-				state: "absent",
-				note: "No rule in this pack restricts file access."
-			};
-			const refused = decisionsOf(data).filter((e) => e.verdict === "deny" && e.capability?.startsWith("fs:")).length;
-			return refused > 0 ? {
-				state: "covered",
-				note: `${rules.length} file-access rules restrict what the agent may read and write; ${refused} access${refused === 1 ? "" : "es"} refused in this record. Restriction is per agent, not per human.`
-			} : {
-				state: "partial",
-				note: `${rules.length} file-access rules restrict what the agent may read and write; none has refused an access in this record yet.`
-			};
-		}
-	},
-	{
-		id: "ISO/IEC 27001 · A.8.12",
-		name: "Data leakage prevention",
-		standard: ISO_27001,
-		trace: (data) => ({
-			rules: [...new Set([...rulesOn(data.pack, (c) => c === "net:fetch").map((r) => r.id), ...(data.pack?.rules ?? []).filter((r) => r.when.secrets !== void 0).map((r) => r.id)])],
-			rows: decisionsOf(data).filter((e) => e.verdict === "deny" && (e.capability === "net:fetch" || e.secrets !== void 0 || e.phase === "output"))
-		}),
-		asks: "Leakage of sensitive information is prevented where it is processed or sent.",
-		evidence: (data) => {
-			const rules = [...rulesOn(data.pack, (c) => c === "net:fetch"), ...(data.pack?.rules ?? []).filter((r) => r.when.secrets !== void 0)];
-			if (rules.length === 0) return {
-				state: "absent",
-				note: "No rule in this pack governs egress or credentials."
-			};
-			const stopped = decisionsOf(data).filter((e) => e.verdict === "deny" && (e.capability === "net:fetch" || e.secrets !== void 0 || e.phase === "output")).length;
-			return stopped > 0 ? {
-				state: "covered",
-				note: `${new Set(rules.map((r) => r.id)).size} egress and credential rules; ${stopped} send${stopped === 1 ? "" : "s"} or credential read${stopped === 1 ? "" : "s"} stopped in this record before the data left.`
-			} : {
-				state: "partial",
-				note: `${new Set(rules.map((r) => r.id)).size} egress and credential rules in force; none has stopped anything in this record yet.`
-			};
-		}
-	},
-	{
-		id: "ISO/IEC 27001 · A.8.15",
-		name: "Logging",
-		standard: ISO_27001,
-		trace: (data) => ({
-			rules: [],
-			rows: data.entries
-		}),
-		asks: "Activities, exceptions and other relevant events are logged, and the logs are protected.",
-		evidence: recorded
-	},
-	{
-		id: "ISO/IEC 27001 · A.8.16",
-		name: "Monitoring activities",
-		standard: ISO_27001,
-		trace: heldAndRefused,
-		asks: "Systems are monitored for anomalous behaviour, and potential incidents are evaluated.",
-		evidence: monitored
-	}
-];
-/**
-* The obligations first, then the risks framework by framework. Two kinds of
-* row in one table on purpose: an auditor reads down one list and finds the
-* audit obligations the ledger evidences and the application risks the pack's
-* rules address, each stated in its framework's own words.
-*/
-const CONTROLS = [
-	...OBLIGATIONS,
-	...rowsOf(OWASP),
-	...rowsOf(AGENTIC),
-	...ISO_CONTROLS
-];
-
-//#endregion
-//#region src/console/views.ts
-/** One rail for every view, so the shape of the product stays consistent. */
-function navFor(data) {
-	return [
-		{
-			label: "Overview",
-			href: "overview.html"
-		},
-		{
-			label: "Policy packs",
-			href: "packs.html"
-		},
-		{
-			label: "Instructions",
-			href: "instructions.html"
-		},
-		{
-			label: "Playground",
-			href: "playground.html"
-		},
-		{
-			label: "Approvals",
-			href: "approvals.html",
-			badge: data.entries.filter((e) => e.verdict === "ask").length
-		},
-		{
-			label: "Audit ledger",
-			href: "ledger.html"
-		},
-		{
-			label: "Fleet",
-			pending: true
-		},
-		{
-			label: "Compliance map",
-			href: "compliance.html"
-		}
-	];
-}
-function chainPill(ok) {
-	return `<div class="chain${ok ? "" : " broken"}"><i></i>${ok ? "CHAIN INTACT" : "CHAIN BROKEN"}</div>`;
-}
-function header(title, meta, ok) {
-	return `    <header class="head">
-      <div><h1>${esc(title)}</h1><div class="meta">${esc(meta)}</div></div>
-      <div class="actions">${chainPill(ok)}
-        <button type="button" class="btn" onclick="window.print()">Export evidence</button>
-      </div>
-    </header>`;
-}
-function renderOverview(data) {
-	const counts = {};
-	for (const entry of data.entries) counts[entry.verdict] = (counts[entry.verdict] ?? 0) + 1;
-	const held = counts.ask ?? 0;
-	const pack = data.pack;
-	const enforcing = pack?.rules.some((r) => r.effect.kind === "deny") ?? false;
-	const body = `${`    <section class="stats">
-      <div class="stat"><div class="v">${data.entries.length}</div><div class="k">DECISIONS</div></div>
-      <div class="stat"><div class="v veto">${counts.deny ?? 0}</div><div class="k">VETOED</div></div>
-      <div class="stat"><div class="v hold">${held}</div><div class="k">AWAITING HUMAN</div></div>
-      <div class="stat"><div class="v">${pack === void 0 ? "—" : esc(pack.rules.length)}</div><div class="k">RULES IN FORCE</div></div>
-    </section>`}
-    <section class="sect">
-      <h2>Posture</h2>
-      <p>${pack === void 0 ? "No pack was supplied to this view, so nothing here describes a policy in force." : enforcing ? `<strong>${esc(pack.pack)} ${esc(pack.version)}</strong> is enforcing: some calls are refused outright.` : `<strong>${esc(pack.pack)} ${esc(pack.version)}</strong> is observing: it records what an enforcing pack would refuse, and denies nothing.`}</p>
-      <p>${data.verification.ok ? "The decision chain verifies: no row has been removed, edited, or reordered since it was written." : "The decision chain does <strong>not</strong> verify. This record is not continuous, and the Audit ledger names where it breaks."}</p>
-    </section>
-    <section class="sect" style="padding-bottom:26px">
-      <h2>What is not covered</h2>
-      <p>This gate decides tool calls. It does not sandbox plugin code — a
-      plugin's <code>apply()</code> runs with full privileges before any tool
-      call exists — and it does not secure the harness itself. Approvals record
-      what was decided, never who decided it.</p>
-    </section>`;
-	return renderShell({
-		title: `Overview — ${pack?.pack ?? "PRAE"}`,
-		nav: renderNav(navFor(data), "Overview"),
-		head: header("Overview", `${data.entries.length} decisions · ${pack === void 0 ? "no pack" : `${pack.pack} ${pack.version}`}`, data.verification.ok),
-		body
-	});
-}
-function matcherOf(rule) {
-	const when = rule.when;
-	const parts = [];
-	const list = (v) => v === void 0 ? void 0 : Array.isArray(v) ? v.join(", ") : String(v);
-	const cap = list(when.capability);
-	if (cap !== void 0) parts.push(`capability ${cap}`);
-	const tool = list(when.tool);
-	if (tool !== void 0) parts.push(`tool ${tool}`);
-	const plugin = list(when.plugin);
-	if (plugin !== void 0) parts.push(`plugin ${plugin}`);
-	if (when.path?.outside !== void 0) parts.push(`path outside ${when.path.outside.join(", ")}`);
-	if (when.path?.inside !== void 0) parts.push(`path inside ${when.path.inside.join(", ")}`);
-	if (when.host?.notIn !== void 0) parts.push(`host not in ${when.host.notIn.join(", ")}`);
-	if (when.host?.in !== void 0) parts.push(`host in ${when.host.in.join(", ")}`);
-	if (when.count !== void 0) parts.push(`more than ${when.count.above}`);
-	for (const arg of when.arg ?? []) {
-		const bits = [
-			arg.above === void 0 ? "" : `above ${arg.above}`,
-			arg.below === void 0 ? "" : `below ${arg.below}`,
-			arg.equals === void 0 ? "" : `= ${String(arg.equals)}`
-		].filter(Boolean);
-		parts.push(`${arg.name} ${bits.join(" ")}`.trim());
-	}
-	return parts.length === 0 ? "every call" : parts.join(" · ");
-}
-function renderPacks(data) {
-	const pack = data.pack;
-	if (pack === void 0) return renderShell({
-		title: "Policy packs",
-		nav: renderNav(navFor(data), "Policy packs"),
-		head: header("Policy packs", "no pack supplied", data.verification.ok),
-		body: "    <div class=\"empty\">Pass --pack to render the policy in force.</div>"
-	});
-	const baseline = pack.baseline?.capabilities;
-	const caps = baseline === void 0 ? `<p style="padding:0 30px 22px;font-size:14px;color:var(--secondary);max-width:76ch">This pack sets no capability ceiling. It governs through its rules alone, and withholds nothing an author declares.</p>` : `<div class="caps">${baseline.map((c) => `<span class="cap">${esc(c)}</span>`).join("")}</div>`;
-	const cited = /* @__PURE__ */ new Map();
-	for (const rule of pack.rules) for (const c of cite(rule)) cited.set(c.framework, c.frameworkName);
-	const frameworks = cited.size === 0 ? "" : `<div class="caps">${[...cited.values()].map((name) => `<span class="cap">${esc(name)}</span>`).join("")}</div>`;
-	const rows = pack.rules.map((rule) => {
-		const tags = cite(rule).map((c) => `<br><span style="color:var(--secondary)">${esc(c.frameworkShort)} · ${esc(c.control)} ${esc(c.controlName)}</span>`).join("");
-		return `      <div class="grid rules row">
-        <div class="seq">${esc(rule.id)}</div>
-        <div class="call">${esc(rule.title ?? rule.effect.because)}<br><span style="color:var(--muted)">${esc(matcherOf(rule))}</span>${tags}</div>
-        <div class="effect e-${esc(rule.effect.kind)}">${esc(rule.effect.kind.toUpperCase())}</div>
-      </div>`;
-	}).join("\n");
-	const body = `    <section class="sect">
-      <h2>${esc(pack.pack)} <span style="font-family:var(--proof);font-size:14px;color:var(--muted)">${esc(pack.version)}</span></h2>
-      <p>The operator baseline is intersected with whatever a plugin's own
-      manifest declares, and the operator can only ever narrow. A pack cannot
-      grant a capability an author never asked for.</p>
-    </section>
-    ${caps}
-    ${frameworks}
-    <div class="grid rules thead">
-      <div>CLAUSE</div><div>RULE</div><div>EFFECT</div>
-    </div>
-${rows}
-    <section class="sect" style="padding-bottom:26px">
-      <h2>Ordering</h2>
-      <p>When several rules match one call the strongest effect wins —
-      deny over ask over correct over warn — and every match stays in the
-      trace. That is what makes a pack safe to extend: appending a rule can
-      raise a decision's strength and never lower it.</p>
-    </section>`;
-	return renderShell({
-		title: `Policy packs — ${pack.pack}`,
-		nav: renderNav(navFor(data), "Policy packs"),
-		head: header("Policy packs", `${pack.pack} ${pack.version} · ${pack.rules.length} rules`, data.verification.ok),
-		body
-	});
-}
-function renderCompliance(data) {
-	const body = `    <section class="sect">
-      <h2>Evidence, not compliance</h2>
-      <p>Each row states what a control asks for and what this profile actually
-      produces. Nothing here certifies anything — whether the evidence satisfies
-      the obligation is an auditor's judgement, and a tool that answered it for
-      them would be selling the one thing it cannot supply.</p>
-    </section>
-    <div class="grid map thead">
-      <div>CONTROL</div><div>ASKS FOR · WHAT THIS PROFILE PRODUCES</div><div>STATE</div>
-    </div>
-${CONTROLS.map((control) => {
-		const found = control.evidence(data);
-		const label = found.state === "covered" ? "EVIDENCE" : found.state === "partial" ? "PARTIAL" : "NONE";
-		return `      <div class="grid map row">
-        <div class="call">${esc(control.id)}</div>
-        <div class="actor">${esc(control.asks)}<br><span style="color:var(--ink-row)">${esc(found.note)}</span></div>
-        <div class="effect ${esc(found.state)}">${label}</div>
-      </div>`;
-	}).join("\n")}
-    <section class="sect" style="padding-bottom:26px">
-      <h2>Reading the states</h2>
-      <p>For the audit obligations, several rows stop at <em>partial</em> for
-      one reason: the harness records what was decided and never who decided
-      it. Attributable approval needs an identity anchor outside this machine,
-      which is a control-plane concern this build does not claim.</p>
-      <p>For the OWASP risks, <em>evidence</em> means rules in this pack cite
-      the risk and have decided calls in this record; <em>partial</em> means
-      they cite it and have not yet, or — for prompt injection — that the gate
-      bounds the risk without claiming to detect it; <em>none</em> means no
-      rule cites it, with the reason a tool-call gate is not where that risk
-      is controlled.</p>
-    </section>`;
-	return renderShell({
-		title: "Compliance map",
-		nav: renderNav(navFor(data), "Compliance map"),
-		head: header("Compliance map", `${CONTROLS.length} controls · evidence from this profile`, data.verification.ok),
-		body
-	});
-}
-/**
-* Every call the policy held, and what became of it.
-*
-* This is a queue you read, not one you act on. The gate returns `ask` into the
-* harness's own approval seam and the harness settles it there; a second set of
-* buttons here would mean two places to approve from and two audit trails to
-* reconcile. So the view shows what is waiting and what was decided, and says
-* plainly where the decision happens.
-*/
-function renderApprovals(data) {
-	const held = data.entries.filter((e) => e.verdict === "ask");
-	const settled = data.entries.filter((e) => e.rule === "approval");
-	const now = Date.parse(data.generatedAt);
-	const waited = (iso) => {
-		const s = Math.max(0, Math.round((now - Date.parse(iso)) / 1e3));
-		if (!Number.isFinite(s)) return "";
-		const h = Math.floor(s / 3600);
-		const m = Math.floor(s % 3600 / 60);
-		return h > 0 ? `${h}h ${m}m` : `${m}m`;
-	};
-	const queue = held.length === 0 ? "    <div class=\"empty\">Nothing is waiting on a human.</div>" : held.map((e) => `    <section class="await" style="border-top:none">
-      <div class="card">
-        <div style="flex:1">
-          <h2>${esc(e.tool)}${e.subject === void 0 ? "" : ` on ${esc(e.subject)}`}</h2>
-          <div class="detail">
-            ${esc(e.rule ?? "held")} · ${esc(e.session ?? "local session")} · waiting ${esc(waited(e.at))}<br>
-            ${esc(e.reason ?? "")}
-          </div>
-        </div>
-        <div class="decide">
-          <button type="button" class="approve" disabled title="The harness settles approvals; a second prompt would mean two audit trails">Approve</button>
-          <button type="button" class="deny" disabled title="The harness settles approvals; a second prompt would mean two audit trails">Deny</button>
-          <div class="recorded">SETTLED IN THE HARNESS</div>
-        </div>
-      </div>
-    </section>`).join("\n");
-	const history = settled.length === 0 ? "" : `    <div class="grid map thead">
-      <div>WHEN</div><div>CALL · WHY</div><div>OUTCOME</div>
-    </div>
-${settled.map((e) => `      <div class="grid map row">
-        <div class="seq">${esc(e.at.replace("T", " ").replace(/\.\d+Z$/, "Z"))}</div>
-        <div class="call">${esc(e.tool)}${e.subject === void 0 ? "" : ` ${esc(e.subject)}`}<br><span style="color:var(--muted)">${esc(e.reason ?? "")}${e.actor === void 0 ? "" : ` · ${esc(e.actor)}`}</span></div>
-        <div class="effect ${e.verdict === "allow" ? "covered" : "absent"}">${e.verdict === "allow" ? "APPROVED" : "REFUSED"}</div>
-      </div>`).join("\n")}`;
-	const body = `    <section class="stats">
-      <div class="stat"><div class="v hold">${held.length}</div><div class="k">AWAITING HUMAN</div></div>
-      <div class="stat"><div class="v">${settled.length}</div><div class="k">SETTLED</div></div>
-      <div class="stat"><div class="v">${settled.filter((e) => e.actor !== void 0).length}</div><div class="k">WITH AN ACTOR</div></div>
-      <div class="stat"><div class="v">${data.entries.length}</div><div class="k">DECISIONS</div></div>
-    </section>
-    <section class="sect">
-      <h2>Waiting</h2>
-      <p>A held call is one a clause would not decide alone. The harness owns
-      the prompt and settles it; this is the queue, not a second place to
-      approve from.</p>
-    </section>
-${queue}
-    <section class="sect">
-      <h2>Settled</h2>
-      <p>Where an entry names an actor, that name is asserted by configuration.
-      The harness records what was decided and never who decided it, so an
-      attributable approval needs an identity anchor this build does not have.</p>
-    </section>
-${history}`;
-	return renderShell({
-		title: "Approvals",
-		nav: renderNav(navFor(data), "Approvals"),
-		head: header("Approvals", `${held.length} waiting · ${settled.length} settled`, data.verification.ok),
-		body
-	});
-}
-
-//#endregion
-export { renderPacks as a, renderNav as c, FRAMEWORKS as d, cite as f, renderOverview as i, renderShell as l, renderApprovals as n, CONTROLS as o, renderCompliance as r, esc as s, navFor as t, VERDICT_LABEL as u };