macwarden 0.0.0-stage → 1.0.1

package/schemas/output/registry-entry.schema.json

@@ -0,0 +1,28 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "Credential-free registry entry",
+  "type": "object",
+  "required": ["nodePubkey", "label", "rootKeyId", "permissions", "caveats", "grade", "fingerprint", "outPath", "createdAt", "verified", "status", "revokedAt", "revokeEvidence", "replaces", "replacedBy"],
+  "additionalProperties": false,
+  "properties": {
+    "nodePubkey": {"type": "string", "pattern": "^0[23][0-9a-fA-F]{64}$"},
+    "label": {"type": ["string", "null"], "pattern": "^[A-Za-z][A-Za-z0-9._-]{0,63}$"},
+    "rootKeyId": {"type": "string", "pattern": "^(0|[1-9][0-9]*)$"},
+    "permissions": {"type": "array", "items": {"type": "string"}},
+    "caveats": {"type": "array", "items": {"type": "object"}},
+    "grade": {"enum": ["ADMIN", "SPEND", "OPERATE", "RECEIVE", "READ", "UNASSESSED"]},
+    "fingerprint": {"type": ["string", "null"], "pattern": "^fp:[0-9a-f]{16}$"},
+    "outPath": {"type": ["string", "null"]},
+    "createdAt": {"type": "string"},
+    "verified": {"type": "boolean"},
+    "status": {"enum": ["active", "revoked"]},
+    "revokedAt": {"type": ["string", "null"]},
+    "revokeEvidence": {"enum": ["rejected", "by-id-only", null]},
+    "replaces": {"type": ["string", "null"], "pattern": "^(0|[1-9][0-9]*)$"},
+    "replacedBy": {"type": ["string", "null"], "pattern": "^(0|[1-9][0-9]*)$"}
+  },
+  "allOf": [{
+    "if": {"properties": {"fingerprint": {"type": "null"}}},
+    "then": {"properties": {"verified": {"const": false}, "outPath": {"type": "null"}}}
+  }]
+}

package/schemas/output/respond.schema.json

@@ -0,0 +1,620 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/ZilverZtream/macwarden/blob/main/schemas/output/respond.schema.json",
+  "title": "macwarden respond --json output",
+  "description": "Normative source: SPEC.md, Commands > 10. respond. A batch with failed items still has ok: true; its exit code is the batch code.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema",
+    "command",
+    "ok",
+    "warnings",
+    "result",
+    "error"
+  ],
+  "properties": {
+    "schema": {
+      "const": 1
+    },
+    "command": {
+      "const": "respond"
+    },
+    "ok": {
+      "type": "boolean"
+    },
+    "warnings": {
+      "type": "array",
+      "items": {
+        "$ref": "#/$defs/warning"
+      }
+    },
+    "result": {
+      "oneOf": [
+        {
+          "type": "null"
+        },
+        {
+          "$ref": "#/$defs/result"
+        }
+      ]
+    },
+    "error": {
+      "oneOf": [
+        {
+          "type": "null"
+        },
+        {
+          "$ref": "#/$defs/error"
+        }
+      ]
+    }
+  },
+  "allOf": [
+    {
+      "if": {
+        "properties": {
+          "ok": {
+            "const": true
+          }
+        },
+        "required": [
+          "ok"
+        ]
+      },
+      "then": {
+        "properties": {
+          "result": {
+            "$ref": "#/$defs/result"
+          },
+          "error": {
+            "type": "null"
+          }
+        }
+      },
+      "else": {
+        "properties": {
+          "result": {
+            "type": "null"
+          },
+          "error": {
+            "$ref": "#/$defs/error"
+          }
+        }
+      }
+    }
+  ],
+  "$defs": {
+    "error": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "code",
+        "step",
+        "message"
+      ],
+      "properties": {
+        "code": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 8
+        },
+        "step": {
+          "type": [
+            "string",
+            "null"
+          ],
+          "minLength": 1
+        },
+        "message": {
+          "type": "string",
+          "minLength": 1
+        }
+      }
+    },
+    "warning": {
+      "oneOf": [
+        {
+          "type": "string",
+          "minLength": 1
+        },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "code",
+            "message"
+          ],
+          "properties": {
+            "code": {
+              "type": "string",
+              "minLength": 1
+            },
+            "message": {
+              "type": "string"
+            }
+          }
+        }
+      ]
+    },
+    "rootKeyId": {
+      "type": "string",
+      "pattern": "^(0|[1-9][0-9]{0,19})$",
+      "description": "uint64 as a canonical decimal string (range up to 18446744073709551615 is enforced by the decoder)."
+    },
+    "grade": {
+      "enum": [
+        "ADMIN",
+        "SPEND",
+        "OPERATE",
+        "RECEIVE",
+        "READ",
+        "UNASSESSED"
+      ]
+    },
+    "registryEntry": {
+      "type": "object",
+      "required": [
+        "nodePubkey",
+        "label",
+        "rootKeyId",
+        "permissions",
+        "caveats",
+        "grade",
+        "fingerprint",
+        "outPath",
+        "createdAt",
+        "verified",
+        "status",
+        "revokedAt",
+        "revokeEvidence",
+        "replaces",
+        "replacedBy"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "nodePubkey": {
+          "type": "string",
+          "pattern": "^0[23][0-9a-fA-F]{64}$"
+        },
+        "label": {
+          "type": [
+            "string",
+            "null"
+          ],
+          "pattern": "^[A-Za-z][A-Za-z0-9._-]{0,63}$"
+        },
+        "rootKeyId": {
+          "type": "string",
+          "pattern": "^(0|[1-9][0-9]*)$"
+        },
+        "permissions": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "caveats": {
+          "type": "array",
+          "items": {
+            "type": "object"
+          }
+        },
+        "grade": {
+          "enum": [
+            "ADMIN",
+            "SPEND",
+            "OPERATE",
+            "RECEIVE",
+            "READ",
+            "UNASSESSED"
+          ]
+        },
+        "fingerprint": {
+          "type": [
+            "string",
+            "null"
+          ],
+          "pattern": "^fp:[0-9a-f]{16}$"
+        },
+        "outPath": {
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "createdAt": {
+          "type": "string"
+        },
+        "verified": {
+          "type": "boolean"
+        },
+        "status": {
+          "enum": [
+            "active",
+            "revoked"
+          ]
+        },
+        "revokedAt": {
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "revokeEvidence": {
+          "enum": [
+            "rejected",
+            "by-id-only",
+            null
+          ]
+        },
+        "replaces": {
+          "type": [
+            "string",
+            "null"
+          ],
+          "pattern": "^(0|[1-9][0-9]*)$"
+        },
+        "replacedBy": {
+          "type": [
+            "string",
+            "null"
+          ],
+          "pattern": "^(0|[1-9][0-9]*)$"
+        }
+      },
+      "allOf": [
+        {
+          "if": {
+            "properties": {
+              "fingerprint": {
+                "type": "null"
+              }
+            }
+          },
+          "then": {
+            "properties": {
+              "verified": {
+                "const": false
+              },
+              "outPath": {
+                "type": "null"
+              }
+            }
+          }
+        }
+      ]
+    },
+    "respondItem": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "label",
+        "rootKeyId",
+        "grade",
+        "action",
+        "status",
+        "replacementRootKeyId",
+        "outPath",
+        "note",
+        "error",
+        "proof"
+      ],
+      "properties": {
+        "label": {
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "rootKeyId": {
+          "$ref": "#/$defs/rootKeyId"
+        },
+        "grade": {
+          "$ref": "#/$defs/grade"
+        },
+        "action": {
+          "enum": [
+            "stage",
+            "finish",
+            "repair",
+            "manual"
+          ]
+        },
+        "status": {
+          "enum": [
+            "planned",
+            "staged",
+            "finished",
+            "failed",
+            "staged-earlier",
+            "not-staged",
+            "finished-earlier",
+            "not-run",
+            "manual"
+          ]
+        },
+        "replacementRootKeyId": {
+          "oneOf": [
+            {
+              "type": "null"
+            },
+            {
+              "$ref": "#/$defs/rootKeyId"
+            }
+          ]
+        },
+        "replacementFingerprint": {
+          "type": [
+            "string",
+            "null"
+          ],
+          "pattern": "^fp:[0-9a-f]{16}$"
+        },
+        "outPath": {
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "note": {
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "error": {
+          "oneOf": [
+            {
+              "type": "null"
+            },
+            {
+              "$ref": "#/$defs/error"
+            }
+          ]
+        },
+        "proof": {
+          "oneOf": [
+            {
+              "type": "null"
+            },
+            {
+              "type": "object",
+              "additionalProperties": false,
+              "required": [
+                "evidence"
+              ],
+              "properties": {
+                "evidence": {
+                  "enum": [
+                    "rejected",
+                    "by-id-only"
+                  ]
+                },
+                "oldRootKeyIdAbsent": {
+                  "type": [
+                    "boolean",
+                    "null"
+                  ]
+                },
+                "oldCredential": {
+                  "enum": [
+                    "accepted",
+                    "rejected",
+                    "error",
+                    "not-tested"
+                  ]
+                },
+                "newCredential": {
+                  "enum": [
+                    "accepted",
+                    "rejected",
+                    "error",
+                    "not-tested"
+                  ]
+                },
+                "proven": {
+                  "type": "boolean"
+                },
+                "strength": {
+                  "enum": [
+                    "credential-rejected",
+                    "root-key-id-absent"
+                  ]
+                },
+                "scope": {
+                  "const": "this-credential"
+                }
+              }
+            }
+          ]
+        }
+      }
+    },
+    "result": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "mode",
+        "dryRun",
+        "node",
+        "rootKey0",
+        "own",
+        "unknown",
+        "revokedButPresent",
+        "bakingRisk",
+        "outDir",
+        "items",
+        "unproven"
+      ],
+      "properties": {
+        "mode": {
+          "enum": [
+            "stage",
+            "finish"
+          ]
+        },
+        "dryRun": {
+          "type": "boolean"
+        },
+        "node": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "pubkey",
+            "alias",
+            "network"
+          ],
+          "properties": {
+            "pubkey": {
+              "type": "string",
+              "pattern": "^0[23][0-9a-fA-F]{64}$"
+            },
+            "alias": {
+              "type": "string"
+            },
+            "network": {
+              "type": "string"
+            }
+          }
+        },
+        "rootKey0": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "present",
+            "ownOnRootKey0",
+            "guidance"
+          ],
+          "properties": {
+            "present": {
+              "type": "boolean"
+            },
+            "ownOnRootKey0": {
+              "type": "boolean"
+            },
+            "guidance": {
+              "type": "array",
+              "items": {
+                "type": "string",
+                "minLength": 1
+              }
+            }
+          }
+        },
+        "own": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "rootKeyId"
+          ],
+          "properties": {
+            "rootKeyId": {
+              "$ref": "#/$defs/rootKeyId"
+            }
+          }
+        },
+        "unknown": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "rootKeyIds",
+            "guidance"
+          ],
+          "properties": {
+            "rootKeyIds": {
+              "type": "array",
+              "items": {
+                "$ref": "#/$defs/rootKeyId"
+              }
+            },
+            "guidance": {
+              "type": "string"
+            }
+          }
+        },
+        "revokedButPresent": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "rootKeyIds",
+            "guidance"
+          ],
+          "properties": {
+            "rootKeyIds": {
+              "type": "array",
+              "items": {
+                "$ref": "#/$defs/rootKeyId"
+              }
+            },
+            "guidance": {
+              "type": "string"
+            }
+          }
+        },
+        "bakingRisk": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "rootKeyIds",
+            "guidance"
+          ],
+          "properties": {
+            "rootKeyIds": {
+              "type": "array",
+              "items": {
+                "$ref": "#/$defs/rootKeyId"
+              }
+            },
+            "guidance": {
+              "type": "array",
+              "items": {
+                "type": "string",
+                "minLength": 1
+              }
+            }
+          }
+        },
+        "outDir": {
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "items": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/respondItem"
+          }
+        },
+        "unproven": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+              "label",
+              "rootKeyId",
+              "reason"
+            ],
+            "properties": {
+              "label": {
+                "type": [
+                  "string",
+                  "null"
+                ]
+              },
+              "rootKeyId": {
+                "$ref": "#/$defs/rootKeyId"
+              },
+              "reason": {
+                "type": "string",
+                "minLength": 1
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}