macwarden 0.0.0-stage → 1.0.1

package/dist/scan/agent-configs.js

@@ -0,0 +1 @@
+export {api37_agentConfigCandidates as agentConfigCandidates, api37_discoverAgentConfigs as discoverAgentConfigs, api37_defaultAgentConfigEnvironment as defaultAgentConfigEnvironment} from "../runtime.js";

package/dist/scan/git-history.js

@@ -0,0 +1 @@
+export {api38_nonLocalPath as nonLocalPath, api38_locateRepository as locateRepository, api38_gitEnvironment as gitEnvironment, api38_assertWorkTree as assertWorkTree, api38_isShallowRepository as isShallowRepository, api38_historyEntries as historyEntries, api38_blobSizes as blobSizes, api38_readBlobs as readBlobs, api38_GitHistoryError as GitHistoryError, api38_MODE_REGULAR as MODE_REGULAR, api38_MODE_SYMLINK as MODE_SYMLINK, api38_MODE_OTHER as MODE_OTHER, api38_GIT_IDLE_TIMEOUT_MS as GIT_IDLE_TIMEOUT_MS, api38_MAX_HISTORY_ENTRIES as MAX_HISTORY_ENTRIES, api38_PINNED_CONFIG as PINNED_CONFIG} from "../runtime.js";

package/dist/scan/ignore.js

@@ -0,0 +1 @@
+export {api39_parseIgnoreFile as parseIgnoreFile, api39_IgnoreFileError as IgnoreFileError} from "../runtime.js";

package/dist/scan/index.js

@@ -0,0 +1 @@
+export {api40_readBounded as readBounded, api40_scan as scan, api40_IgnoreFileError as IgnoreFileError, api40_GitHistoryError as GitHistoryError, api40_FINDINGS_LIMIT as FINDINGS_LIMIT, api40_ALSO_AT_EXAMPLES as ALSO_AT_EXAMPLES, api40_HISTORY_DEDUP_WORK_LIMIT as HISTORY_DEDUP_WORK_LIMIT, api40_FindingsLimitError as FindingsLimitError, api40_SCAN_CONCURRENCY as SCAN_CONCURRENCY} from "../runtime.js";

package/dist/scan/mcp-context.js

@@ -0,0 +1 @@
+export {api41_mcpServerStringSpans as mcpServerStringSpans, api41_withinSpans as withinSpans} from "../runtime.js";

package/dist/scan/nwc-match.js

@@ -0,0 +1 @@
+export {api42_nwcMatches as nwcMatches} from "../runtime.js";

package/dist/scan/patterns.js

@@ -0,0 +1 @@
+export {api43_macaroonHex as macaroonHex, api43_macaroonBase64 as macaroonBase64, api43_lndconnect as lndconnect, api43_nwc as nwc} from "../runtime.js";

package/dist/scan/redact.js

@@ -0,0 +1 @@
+export {api44_redactDecoded as redactDecoded, api44_redactPath as redactPath, api44_collectNwcSecrets as collectNwcSecrets, api44_knownSecretRedactor as knownSecretRedactor, api44_redactKnownSecrets as redactKnownSecrets} from "../runtime.js";

package/dist/secret-capability.js

@@ -0,0 +1 @@
+export { Secret } from './secret.js';

package/dist/secret.js

@@ -0,0 +1 @@
+export {api45_Secret as Secret} from "./runtime.js";

package/dist/version.js

@@ -0,0 +1 @@
+export {api46_macwardenVersion as macwardenVersion} from "./runtime.js";

package/dist/watch/alert-throttle.js

@@ -0,0 +1 @@
+export {api47_createAlertThrottle as createAlertThrottle, api47_createAlertRunner as createAlertRunner, api47_ALERT_WINDOW_MS as ALERT_WINDOW_MS, api47_MAX_TRACKED_CANARIES as MAX_TRACKED_CANARIES} from "../runtime.js";

package/dist/watch/alert.js

@@ -0,0 +1 @@
+export {api48_reapAlertGroups as reapAlertGroups, api48_runAlertCommand as runAlertCommand, api48_ALERT_TIMEOUT_MS as ALERT_TIMEOUT_MS, api48_ALERT_KILL_MS as ALERT_KILL_MS, api48_ALERT_GRACE_MS as ALERT_GRACE_MS} from "../runtime.js";

package/dist/watch/canary.js

@@ -0,0 +1 @@
+export {api49_canaryConfigPath as canaryConfigPath, api49_newCaveatName as newCaveatName, api49_newCondition as newCondition, api49_canaryCondition as canaryCondition, api49_readCanaryConfig as readCanaryConfig, api49_ensureCanaryConfig as ensureCanaryConfig, api49_canaryEntries as canaryEntries, api49_isCanary as isCanary} from "../runtime.js";

package/dist/watch/output-queue.js

@@ -0,0 +1 @@
+export {api50_retryable as retryable, api50_fdWriter as fdWriter, api50_createOutputQueue as createOutputQueue, api50_OUTPUT_LIMIT_BYTES as OUTPUT_LIMIT_BYTES} from "../runtime.js";

package/dist/watch/usage.js

@@ -0,0 +1 @@
+export {api51_usagePath as usagePath, api51_readUsage as readUsage, api51_writeUsage as writeUsage, api51_USAGE_LIMIT as USAGE_LIMIT, api51_CANARY_LIMIT as CANARY_LIMIT, api51_COVERAGE_LIMIT as COVERAGE_LIMIT, api51_UsageFileError as UsageFileError, api51_UsageStore as UsageStore} from "../runtime.js";

package/package.json

@@ -1,6 +1,71 @@
 {
   "name": "macwarden",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "1.0.1",
+  "description": "Lightning credential hygiene for LND: inspect, scan (incl. git history), inventory, bake, revoke, rotate and attenuate macaroons",
+  "keywords": [
+    "lightning",
+    "lnd",
+    "macaroon",
+    "bitcoin",
+    "secret-scanning",
+    "credentials",
+    "nwc",
+    "security"
+  ],
+  "homepage": "https://github.com/ZilverZtream/macwarden#readme",
+  "bugs": {
+    "url": "https://github.com/ZilverZtream/macwarden/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ZilverZtream/macwarden.git"
+  },
+  "type": "module",
+  "bin": {
+    "macwarden": "dist/bin.js"
+  },
+  "files": [
+    "dist/",
+    "schemas/output/",
+    "rules/gitleaks.toml",
+    "rules/trufflehog.yaml",
+    "README.md",
+    "SECURITY.md",
+    "LICENSE",
+    "CHANGELOG.md"
+  ],
+  "publishConfig": {
+    "provenance": true
+  },
+  "engines": {
+    "node": ">=22.12.0"
+  },
+  "license": "MIT",
+  "scripts": {
+    "pretest": "npm run build",
+    "test": "vitest run --project product",
+    "test:harness": "vitest run --project harness-docs",
+    "test:related": "vitest related --run",
+    "test:full": "node scripts/full-validation.mjs",
+    "lint": "eslint .",
+    "prebuild": "node scripts/build.mjs",
+    "build": "tsc -p tsconfig.json && tsc -p tsconfig.test.json",
+    "postbuild": "node scripts/build.mjs --copy-permissions",
+    "prepack": "npm run build",
+    "test:oracle": "node scripts/later.mjs CP-002 vitest.oracle.config.ts && vitest run --config vitest.oracle.config.ts",
+    "test:gitleaks": "node scripts/later.mjs CP-013 vitest.gitleaks.config.ts && vitest run --config vitest.gitleaks.config.ts",
+    "fixture:up": "node scripts/later.mjs CP-004 test/fixture/fixture.mjs && node test/fixture/fixture.mjs up",
+    "fixture:down": "node scripts/later.mjs CP-004 test/fixture/fixture.mjs && node test/fixture/fixture.mjs down"
+  },
+  "devDependencies": {
+    "typescript": "6.0.3",
+    "vitest": "5.0.3",
+    "vite": "8.3.2",
+    "eslint": "10.11.0",
+    "@eslint/js": "10.0.1",
+    "typescript-eslint": "8.71.0",
+    "@types/node": "22.20.5",
+    "globals": "17.13.0",
+    "ajv": "8.20.0"
+  }
+}

package/rules/gitleaks.toml

@@ -0,0 +1,30 @@
+# Always run gitleaks with --redact. Without --redact, gitleaks prints and stores the matched credential.
+# These rules add to gitleaks' built-in rules ([extend] useDefault = true); a custom config without it
+# replaces them. Keywords are a case-insensitive prefilter checked before each regex.
+
+[extend]
+useDefault = true
+
+[[rules]]
+id = 'macwarden-macaroon-hex'
+description = 'LND macaroon (location lnd) in hex'
+regex = '''(?i)0201036c6e6402[0-9a-f]{40,}'''
+keywords = ['0201036c6e6402']
+
+[[rules]]
+id = 'macwarden-macaroon-base64'
+description = 'LND macaroon (location lnd) in base64 or base64url'
+regex = '''AgEDbG5kA[A-Za-z0-9+/_-]{40,}={0,2}'''
+keywords = ['agedbg5ka']
+
+[[rules]]
+id = 'macwarden-lndconnect'
+description = 'lndconnect URI, which embeds an LND macaroon'
+regex = '''(?i)lndconnect://[^\s"'<>]+'''
+keywords = ['lndconnect://']
+
+[[rules]]
+id = 'macwarden-nwc'
+description = 'Nostr Wallet Connect (NIP-47) URI with a secret'
+regex = '''(?i)(?:nostr\+walletconnect|nostrwalletconnect):(?://)?[0-9a-f]{64}/?\?[^\s"'<>]*?secret=[0-9a-f]{64}(?:[^0-9a-f]|$)'''
+keywords = ['walletconnect']

package/rules/trufflehog.yaml

@@ -0,0 +1,27 @@
+# macwarden detectors as TruffleHog custom detectors.
+# Usage: trufflehog filesystem . --config rules/trufflehog.yaml --no-verification
+#        trufflehog git file://. --config rules/trufflehog.yaml --no-verification
+# The regexes are byte-identical to SPEC.md and rules/gitleaks.toml (a test enforces it).
+# TruffleHog prints matched secrets in its output: store its results only where a
+# leaked Lightning credential may be read, and rotate anything it finds (macwarden rotate).
+detectors:
+  - name: macwarden-macaroon-hex
+    keywords:
+      - '0201036c6e6402'
+    regex:
+      macaroon: '(?i)0201036c6e6402[0-9a-f]{40,}'
+  - name: macwarden-macaroon-base64
+    keywords:
+      - 'AgEDbG5kA'
+    regex:
+      macaroon: 'AgEDbG5kA[A-Za-z0-9+/_-]{40,}={0,2}'
+  - name: macwarden-lndconnect
+    keywords:
+      - 'lndconnect://'
+    regex:
+      uri: '(?i)lndconnect://[^\s"''<>]+'
+  - name: macwarden-nwc
+    keywords:
+      - 'walletconnect'
+    regex:
+      uri: '(?i)(?:nostr\+walletconnect|nostrwalletconnect):(?://)?[0-9a-f]{64}/?\?[^\s"''<>]*?secret=[0-9a-f]{64}(?:[^0-9a-f]|$)'

package/schemas/output/attenuate.schema.json

@@ -0,0 +1,437 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/ZilverZtream/macwarden/blob/main/schemas/output/attenuate.schema.json",
+  "title": "macwarden attenuate --json output",
+  "description": "Normative source: SPEC.md, Commands > 7. attenuate. The facts of the attenuated copy, as inspect reports them, plus the caveats added.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema",
+    "command",
+    "ok",
+    "warnings",
+    "result",
+    "error"
+  ],
+  "properties": {
+    "schema": {
+      "const": 1
+    },
+    "command": {
+      "const": "attenuate"
+    },
+    "ok": {
+      "type": "boolean"
+    },
+    "warnings": {
+      "type": "array",
+      "items": {
+        "$ref": "#/$defs/warning"
+      }
+    },
+    "result": {
+      "oneOf": [
+        {
+          "type": "null"
+        },
+        {
+          "$ref": "#/$defs/result"
+        }
+      ]
+    },
+    "error": {
+      "oneOf": [
+        {
+          "type": "null"
+        },
+        {
+          "$ref": "#/$defs/error"
+        }
+      ]
+    }
+  },
+  "allOf": [
+    {
+      "if": {
+        "properties": {
+          "ok": {
+            "const": true
+          }
+        },
+        "required": [
+          "ok"
+        ]
+      },
+      "then": {
+        "properties": {
+          "result": {
+            "$ref": "#/$defs/result"
+          },
+          "error": {
+            "type": "null"
+          }
+        }
+      },
+      "else": {
+        "properties": {
+          "result": {
+            "type": "null"
+          },
+          "error": {
+            "$ref": "#/$defs/error"
+          }
+        }
+      }
+    }
+  ],
+  "$defs": {
+    "error": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "code",
+        "step",
+        "message"
+      ],
+      "properties": {
+        "code": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 8
+        },
+        "step": {
+          "type": [
+            "string",
+            "null"
+          ],
+          "minLength": 1
+        },
+        "message": {
+          "type": "string",
+          "minLength": 1
+        }
+      }
+    },
+    "warning": {
+      "oneOf": [
+        {
+          "type": "string",
+          "minLength": 1
+        },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "code",
+            "message"
+          ],
+          "properties": {
+            "code": {
+              "type": "string",
+              "minLength": 1
+            },
+            "message": {
+              "type": "string"
+            }
+          }
+        }
+      ]
+    },
+    "rootKeyId": {
+      "type": "string",
+      "pattern": "^(0|[1-9][0-9]{0,19})$",
+      "description": "uint64 as a canonical decimal string (range up to 18446744073709551615 is enforced by the decoder)."
+    },
+    "grade": {
+      "enum": [
+        "ADMIN",
+        "SPEND",
+        "OPERATE",
+        "RECEIVE",
+        "READ",
+        "UNASSESSED"
+      ]
+    },
+    "registryEntry": {
+      "type": "object",
+      "required": [
+        "nodePubkey",
+        "label",
+        "rootKeyId",
+        "permissions",
+        "caveats",
+        "grade",
+        "fingerprint",
+        "outPath",
+        "createdAt",
+        "verified",
+        "status",
+        "revokedAt",
+        "revokeEvidence",
+        "replaces",
+        "replacedBy"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "nodePubkey": {
+          "type": "string",
+          "pattern": "^0[23][0-9a-fA-F]{64}$"
+        },
+        "label": {
+          "type": [
+            "string",
+            "null"
+          ],
+          "pattern": "^[A-Za-z][A-Za-z0-9._-]{0,63}$"
+        },
+        "rootKeyId": {
+          "type": "string",
+          "pattern": "^(0|[1-9][0-9]*)$"
+        },
+        "permissions": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "caveats": {
+          "type": "array",
+          "items": {
+            "type": "object"
+          }
+        },
+        "grade": {
+          "enum": [
+            "ADMIN",
+            "SPEND",
+            "OPERATE",
+            "RECEIVE",
+            "READ",
+            "UNASSESSED"
+          ]
+        },
+        "fingerprint": {
+          "type": [
+            "string",
+            "null"
+          ],
+          "pattern": "^fp:[0-9a-f]{16}$"
+        },
+        "outPath": {
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "createdAt": {
+          "type": "string"
+        },
+        "verified": {
+          "type": "boolean"
+        },
+        "status": {
+          "enum": [
+            "active",
+            "revoked"
+          ]
+        },
+        "revokedAt": {
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "revokeEvidence": {
+          "enum": [
+            "rejected",
+            "by-id-only",
+            null
+          ]
+        },
+        "replaces": {
+          "type": [
+            "string",
+            "null"
+          ],
+          "pattern": "^(0|[1-9][0-9]*)$"
+        },
+        "replacedBy": {
+          "type": [
+            "string",
+            "null"
+          ],
+          "pattern": "^(0|[1-9][0-9]*)$"
+        }
+      },
+      "allOf": [
+        {
+          "if": {
+            "properties": {
+              "fingerprint": {
+                "type": "null"
+              }
+            }
+          },
+          "then": {
+            "properties": {
+              "verified": {
+                "const": false
+              },
+              "outPath": {
+                "type": "null"
+              }
+            }
+          }
+        }
+      ]
+    },
+    "fingerprint": {
+      "type": "string",
+      "pattern": "^fp:[0-9a-f]{16}$"
+    },
+    "caveat": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "type",
+        "value"
+      ],
+      "properties": {
+        "type": {
+          "enum": [
+            "time-before",
+            "ipaddr",
+            "iprange",
+            "lnd-custom",
+            "third-party",
+            "unknown"
+          ]
+        },
+        "value": {
+          "type": "string"
+        },
+        "expired": {
+          "type": "boolean"
+        }
+      },
+      "if": {
+        "properties": {
+          "type": {
+            "const": "time-before"
+          }
+        }
+      },
+      "else": {
+        "properties": {
+          "expired": false
+        }
+      }
+    },
+    "macaroonWarning": {
+      "enum": [
+        "root-key-0",
+        "trailing-bytes",
+        "bad-time-before",
+        "unassessed-uri",
+        "unassessed-permission",
+        "no-permissions",
+        "preimage-exposure"
+      ]
+    },
+    "result": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "fingerprint",
+        "location",
+        "rootKeyId",
+        "permissions",
+        "caveats",
+        "grade",
+        "reasons",
+        "warnings",
+        "unassessed",
+        "snapshot",
+        "dryRun",
+        "out",
+        "parentFingerprint",
+        "added"
+      ],
+      "properties": {
+        "fingerprint": {
+          "$ref": "#/$defs/fingerprint"
+        },
+        "location": {
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "rootKeyId": {
+          "$ref": "#/$defs/rootKeyId"
+        },
+        "permissions": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "caveats": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/caveat"
+          }
+        },
+        "grade": {
+          "$ref": "#/$defs/grade"
+        },
+        "reasons": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "uniqueItems": true
+        },
+        "warnings": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/macaroonWarning"
+          },
+          "uniqueItems": true
+        },
+        "unassessed": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "uniqueItems": true
+        },
+        "snapshot": {
+          "type": "string",
+          "minLength": 1,
+          "description": "LND version the bundled permission snapshot came from, e.g. 0.21.4-beta."
+        },
+        "dryRun": {
+          "type": "boolean"
+        },
+        "out": {
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "parentFingerprint": {
+          "type": "string",
+          "pattern": "^fp:[0-9a-f]{16}$"
+        },
+        "added": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "type": "string"
+          }
+        }
+      }
+    }
+  }
+}