macwarden 1.0.1 → 1.1.0

package/CHANGELOG.md

@@ -1,5 +1,37 @@
 # Changelog
 
+## 1.1.0 (2026-10-08)
+
+Security release. It fixes every finding of the independent audit of 1.0.1 ([report](docs/reviews/2026-10-08-audit-1.0.1.md)) and of a differential fuzzing review of the parsers against LND's own macaroon library, and adds `verify` for operators responding to credential exposure such as the BTCPay Server 2.4.2 incident.
+
+### Added
+
+- New command `verify <file | ->`: asks your node whether one credential file is still accepted, for operators checking macaroon files that may have been copied (for example in the BTCPay Server 2.4.2 incident, where patching did not invalidate stolen files). It decodes the file offline as `inspect` does, calls CheckMacaroonPermissions with its own permissions, and reports `status` (`accepted` or `rejected`), why LND rejected it (`root-key-missing`, `signature-mismatch`, `expired` or `other`), whether its root key ID is still listed, and its registry label. Exit 1 while LND accepts it, and also when a rejection may depend on the caller (an IP lock or a custom caveat such as a canary's); exit 0 once LND conclusively rejects it. Guidance names the next step: `macwarden revoke`, `respond` for a credential that can bake, or, on root key 0, regenerating every root key first and baking fresh per-app macaroons afterwards. A Nostr Wallet Connect URI is refused (exit 3). Output schema `schemas/output/verify.schema.json`.
+- New [incident playbook](docs/incident-playbook.md) for exposed credentials (BTCPay Server < 2.4.2 and similar): what patching fixes and what it does not, checking each old file with `verify`, replacing and revoking with `respond`, `rotate` and `revoke`, root key ID 0, re-pairing apps and checking for unauthorized activity. Linked from the README.
+- Requires Node.js `^22.23.2 || ^24.18.1 || >=26.5.1` (was `>=22.12.0`): the July 2026 Node.js security releases fix HTTP/2 flaws (CVE-2026-56846, CVE-2026-56848) in `node:http2`, which `watch` uses for its gRPC stream to LND. CI tests the new minimum versions.
+
+### Fixed
+
+- `rotate` and `respond` decide whether a credential is a canary from its decoded file, not only from the registry's caveat list. A registry entry whose caveats were cleared while its file still carries an `lnd-custom` caveat is refused as tampering (exit 3 at S4 and P5) before any lock or LND mutation. Before, clearing that metadata let a canary be rotated into an ordinary, accepted credential (MW102-01).
+- `respond --finish` resumes a finish that deleted the old root key ID but stopped before saving the registry: the credential is finished through `rotate`'s F6 repair, which proves the replacement accepted, records the revocation and link, and sends no second deletion. Before, it reported exit 0 with a `repair` item and advised `macwarden revoke <label>`, which exits 2 because the old entry and its replacement share the label. Advice in `respond` now names a credential by its root key ID wherever its label is ambiguous (MW102-02).
+- `respond` no longer reports a replacement that an earlier stage allocated but never completed (`verified: false`, no output file) as `staged-earlier` with advice to switch the app. It is reported as unresolved: item `repair`/`failed` with exit 7 at P5, listed under `unproven`, with whether LND lists the ID and the recovery `macwarden revoke <replacement root key ID>` followed by a fresh stage. The uncertain mutation is never retried (MW102-10).
+- `recommend` applies the `recommendation-broader` widening guard to every selector. Selecting a credential by `id:…` (or `--target-file`) never looked up its registry entry, so usage claiming a method the credential never held (for example SendPaymentV2 on an invoice credential) produced a bake command that widened it. The credential ID is now resolved through its recorded root key ID to the single active registry entry; `--target-file` is also checked against the file's own permissions. When the permissions cannot be established (unregistered, root key 0 by ID, ambiguous), warning `recommendation-unverified` withholds the commands. A credential ID selector no longer suggests revoking the whole root key ID. (MW102-03)
+- `recommend` counts only watch coverage after the credential was created toward the 7-day observation rule. It compared the covered total with the time since creation, so eight days watched before a credential existed plus one second afterwards counted as seven days and printed narrowing and revoke commands. `watch` now records the registered spans per node (`coverageSpans` in the usage file, at most 256 per node; `coverage` is unchanged, so 1.0.1 still reads the file), and `recommend` uses a provable lower bound. A file without spans counts coverage that began before creation only as far as it cannot have lain before it; a credential without a registry entry counts from its first recorded use. (MW102-04)
+- `watch` shutdown keeps its alert budget (MW102-05). An alert waiting behind a running `--alert-command` is discarded at shutdown (reported as `alert-failed`; its event line is still printed) instead of starting after watch was asked to stop; the running command gets one deadline and is then cancelled with its process group or, on Windows, its process tree; and the CLI's forced-exit deadline starts only after Windows tree kills have finished. Before, a second alert could start 12 s into shutdown and outlive watch.
+- `watch --until` honours durations beyond about 24.8 days (MW102-09). Node fires a timer longer than 2^31−1 ms after 1 ms, so `--until 25d` stopped almost at once; the wait now runs in bounded chunks against one monotonic deadline, up to the accepted maximum of 999999d.
+- `scan --git-history` bounds the repository-location check. Each include and alternates file is read once, and the check stops with exit 3 ("git history could not be read") when git would follow more than 4,096 include or alternate entries or parse more than 1 MiB of location files in total, or when more than 256 distinct location files are involved; an interrupt is honoured during the check. Before, eight 100-byte configs each including the next eight times were walked 2.4 million times (MW102-06).
+- The usage and canary files next to the registry are read through the same bounded reader as TLS certificates: a path or symlink target with a protected name (`seed.json`, `tls.key`, ...) is refused before it is opened, anything but a regular file is refused, and a file larger than its format allows (about 20 MiB for usage, 4 KiB for the canary configuration) fails before it is parsed. Registry and watch lock records are read only from plain files, never through a symlink. Before, a symlinked sidecar was followed into a protected file and read whole (MW102-07).
+- Online commands reach a literal IPv6 REST endpoint (`--lnd-rest '[::1]:8080'`). The bracketed host was passed to the TLS connection as a DNS name, so a certificate with the matching IP address SAN failed verification (exit 4). On Node 22, whose own TLS identity check refuses every IPv6 literal, REST and gRPC connections to an IPv6 address use an equally strict check that accepts only a matching IP address SAN. Printed URLs and commands keep the brackets; verification stays on (MW102-08).
+- `inventory --report`: the Markdown and CSV reports carry all the evidence of the JSON review. Markdown adds the rotation links (replaces, replaced by), canary uses (count, first and last use), caveats and flag counts. CSV stays one table with one header row and adds caveats, canary uses, the controls naming each root key ID with their observations, and report-level columns repeated on every row (generated time, macwarden version, node pubkey, alias, network and LND version, empty sign-off fields, the limitation statement). The JSON review adds `canary` per credential and `limitations`. Before, Markdown dropped rotation links and CSV dropped the report identity, controls, sign-off and limitation statement (MW102-11).
+- `watch` and `recommend` have published JSON schemas: `schemas/output/recommend.schema.json`, `watch.schema.json` for watch's final document and `watch-event.schema.json` for the event lines `watch --json` prints before it (call, error, canary and each status event). They are generated with the others, shipped in the package and checked against real outputs, refusals included. Before, the package had no schema for either command (MW102-12).
+- `scan` no longer stalls on a crafted `.json` file. MCP-context tagging rebuilt the whole key path for every string value and compared every finding with every tagged string, so one committed file with deep nesting and many strings (any `.json` file with one candidate finding) held a scan for hours: 19.3 s for 176 KB, about 4 to 5 hours for 5 MB. Tagging is now linear: 75 ms for the 176 KB file, 1.2 s for 5 MB, and it gives up beyond 1,000 levels of nesting. (Parser review 2026-10-08, HIGH-1.)
+- A re-framed macaroon is decoded as LND decodes it. go-macaroon reads packet kinds, lengths and end-of-section markers as any varint encoding (non-minimal `0x83 0x00` for 3, `0x80 0x00` for end-of-section), so anyone holding a macaroon can re-frame it without the root key and LND still honours it. `inspect`, `scan`, `revoke` and `rotate` refused such a copy as undecodable, and `watch` attributed its calls to `id:undecodable` instead of the stolen credential. The fingerprint is now defined over the canonical form (what go-macaroon writes), so a re-framed copy has the fingerprint of the original; every macaroon LND or macwarden writes keeps its fingerprint. Output redaction also recognises a re-framed hex copy. (Parser review 2026-10-08, MEDIUM-1.)
+- Identifier shapes LND authorizes are no longer refused and ignored. An extra op with an empty entity or no actions, an unknown protobuf group, a non-minimal protobuf tag, more than 256 ops, more than 512 actions in one op and more than 4,096 caveats are decoded as LND decodes them (bakery requires actions only on the first op). Before, `inspect` refused such a macaroon, `scan` reported it as undecodable and `watch` could not attribute its calls, although LND granted it full authority. Expansion stays bounded (an entity over 16 bytes or an action over 256 bytes is left out, as is everything past 1,024 permissions or 64 KiB of permission text, and caveats past 4,096); a macaroon past a bound is still decoded, carries the warning `identifier-exceeds-bounds` or `caveats-exceed-bounds`, and its grade fails closed to `UNASSESSED` unless what was kept is already `ADMIN`. The stage `identifier-limits` is no longer produced. (Parser review 2026-10-08, MEDIUM-2.)
+- Output redaction no longer misses a hex macaroon written right after a backslash or a percent sign (for example a Windows path such as `C:\keys\0201…`). Recognition looked only at the text after decoding escapes, so `\020` was read as an octal escape and `%02` as a percent escape, which removed the start of the macaroon. Hex is now also recognised in the literal text. (Parser review 2026-10-08, LOW-1.)
+- Output redaction and scan's NWC secret collection use the linear NWC matcher that scan detection already used. They still ran the published `nwc` regex, which backtracks quadratically when the URI prefix repeats without a secret: 1 MB took 4 to 6 s to collect and 10 to 12 s to render, and `inspect` of a 1 MB macaroon with such a caveat took 9.3 s. Now 31 ms, 1.0 s and 1.3 s, with identical matches. (Parser review 2026-10-08, LOW-2.)
+- `scan` finds NWC connection strings in common escaped forms: HTML or XML with `&amp;` before `secret=` (the detector matched it, then the hit was dropped without being counted), JSON with escaped slashes, percent-encoded (deep links, form fields) and with `+` decoded to a space. Each grants spend authority. Every detector match is now reported, and each line is matched once more after unescaping these forms. (Parser review 2026-10-08, LOW-3.)
+- A `time-before` caveat with a one-digit hour (`2027-10-08T1:00:00Z`), a zone offset hour of 24 (`+24:00`) or an offset minute of 60 is parsed as LND parses it (Go's `time.Parse` falls back to a lenient parser). Before, macwarden reported `bad-time-before` and no expiry, so an expired credential LND refuses was shown with no known expiry, and `revoke`/`rotate` treated it as unusable. (Parser review 2026-10-08, LOW-4.)
+
 ## 1.0.1 (2026-10-08)
 
 Fixes found in the live field check against LND 0.20.0 (Polar, regtest):

package/README.md

@@ -58,16 +58,17 @@ That is hard with LND alone:
 
 ### Respond to an incident
 
+- `verify <file>` asks your node whether one credential file is still accepted, for example each `.macaroon` file that may have been copied. It exits 1 while LND accepts it and 0 once LND rejects it, and says what to do next: revoke its root key ID, or, for `admin.macaroon` and anything else on root key 0, regenerate every root key.
 - `respond --out-dir <dir>` stages a replacement for every registered credential in one confirmed batch. After the apps are switched, `respond --finish` revokes the old root key IDs and reports, for each credential, proof that the old one is rejected and the new one accepted. It explains what to do about root key 0, which LND cannot revoke on its own. Canaries are never rotated into ordinary credentials, IDs the registry calls revoked but LND still holds are flagged, and if a credential that can bake may have leaked it says so plainly: only regenerating all root keys removes what such a credential could have created.
 - `bake --canary` creates a decoy credential. While `watch` runs, every use its permissions allow is denied and raises an alert within the same call. Put it where a thief would look.
-- `inventory --report markdown|csv|json` writes an access-review record (every credential, its owner, permissions, expiry, last use and review flags, with a sign-off section) for SOC 2, ISO 27001 or internal reviews. It is evidence for a reviewer, not a compliance claim.
+- `inventory --report markdown|csv|json` writes an access-review record (every credential, its owner, permissions, caveats, expiry, rotation links, last use, canary uses and review flags, with control observations and a sign-off section; all three formats carry the same evidence, and the CSV is a single table with one header row) for SOC 2, ISO 27001 or internal reviews. It is evidence for a reviewer, not a compliance claim.
 
 ## Quick start
 
-macwarden needs Node.js 22.12 or later.
+macwarden needs Node.js 22.23.2 or later on the 22 line, 24.18.1 or later on the 24 line, or 26.5.1 or later.
 
 ```sh
-npm i -g macwarden@1.0.1
+npm i -g macwarden@1.1.0
 ```
 
 On production hosts, pin the exact version as above rather than installing the latest, and run `npm audit signatures` in a project that depends on macwarden to check the registry signatures of what you installed.
@@ -88,7 +89,7 @@ It exits 1 if it finds a credential at or above the grade you set, 0 if it finds
 - uses: actions/checkout@v5
   with:
     fetch-depth: 0
-- run: npx --yes macwarden@1.0.1 scan . --git-history --fail-on READ --format github
+- run: npx --yes macwarden@1.1.0 scan . --git-history --fail-on READ --format github
 ```
 
 [docs/ci-integration.md](docs/ci-integration.md) has a SARIF workflow for GitHub code scanning, the pre-commit hook and the gitleaks and TruffleHog rule packs.
@@ -115,7 +116,19 @@ macwarden rotate btcpay --finish
 
 Pick an unused root key ID (check `lncli listmacaroonids`), and run `lncli deletemacaroonid 123456789` when the session is over. To move existing apps off `admin.macaroon` and root key 0, follow [Replacing the default macaroons](docs/replacing-default-macaroons.md). It covers the maintenance window, the one step only you can do, and how to confirm nothing is left behind.
 
-`macwarden --help` lists every command; `macwarden <command> --help` shows its options. Every command accepts `--json` and prints one document whose shape is published as a JSON Schema in `schemas/output/`.
+`macwarden --help` lists every command; `macwarden <command> --help` shows its options. Every command accepts `--json` and prints one document whose shape is published as a JSON Schema in `schemas/output/<command>.schema.json`. `watch --json` first prints one event per line while it runs (`schemas/output/watch-event.schema.json`), then that document as its last line.
+
+### After a leak
+
+Patching the hole does not invalidate stolen files: LND keeps accepting a copied macaroon until its root key ID is deleted or every root key is regenerated, and it rewrites `admin.macaroon` from the same root key. Check each file that may have been exposed:
+
+```sh
+macwarden verify /path/to/old/btcpay.macaroon
+# exit 1: LND still accepts it (or may, for another caller). The output prints what to run next.
+# exit 0: LND rejects it now.
+```
+
+[docs/incident-playbook.md](docs/incident-playbook.md) walks through the whole response: what patching fixes, how to replace and revoke credentials with `respond`, `rotate` and `revoke`, what to do about root key 0, re-pairing apps and checking for unauthorized activity.
 
 ## Safety guarantees
 
@@ -133,7 +146,7 @@ These are enforced in code and covered by tests. [SECURITY.md](SECURITY.md) list
 | --- | --- |
 | LND | 0.21.x. Every online command is tested against a pinned LND v0.21.4-beta regtest node. |
 | Platforms | Linux and Windows, tested on every change. macOS should work but is not tested. |
-| Node.js | 22.12 or later. No runtime dependencies. |
+| Node.js | 22.23.2+, 24.18.1+ or 26.5.1+ (the July 2026 security releases, which fix HTTP/2 flaws CVE-2026-56846 and CVE-2026-56848 in the module `watch` uses). No runtime dependencies. |
 | Transport | REST over HTTPS; `watch` uses gRPC. For a Tor-only node, tunnel to localhost over SSH. |
 
 LND only: Core Lightning runes, LNbits keys, Eclair and LDK are not supported. Nostr Wallet Connect strings are decoded and found by `scan`, but NWC connections are revoked in the wallet service.
@@ -162,6 +175,7 @@ Everything macwarden does online can be done by hand with `lncli`. What it adds
 
 ## Documentation
 
+- [Incident playbook: credentials exposed](docs/incident-playbook.md): what to do when macaroon files may have been copied (BTCPay Server < 2.4.2 and similar)
 - [Replacing the default macaroons](docs/replacing-default-macaroons.md): the operator procedure for moving every app onto its own macaroon
 - [CI integration](docs/ci-integration.md): GitHub Actions, SARIF, pre-commit, gitleaks and TruffleHog
 - [Field check](docs/field-check.md): a short, safe procedure to confirm a release against your own node

package/dist/bin.js

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import { main, completionStatus } from './cli.js';
+import { alertCleanupDone } from './watch/alert.js';
 // watch runs unattended (systemd, CI). If its output can no longer be delivered (a pipe
 // that is never read), a write already handed to the operating system cannot be
 // cancelled: on Windows every write to an inherited pipe is synchronous, and a normal exit
@@ -8,8 +9,13 @@ import { main, completionStatus } from './cli.js';
 // on its own before the deadline with its real status; when the deadline fires, the
 // non-zero exit (1 on Windows, SIGKILL on POSIX) reports that output was not delivered.
 // Other commands are not affected: their output is waited for in full.
+// The deadline is armed only after every alert process-tree kill (Windows taskkill) has
+// finished, each bounded: ending this process first would end the alert command itself and
+// orphan the children taskkill has yet to find (audit MW102-05).
 const WATCH_EXIT_GRACE_MS = 3_000;
 const status = await main(process.argv.slice(2));
 process.exitCode = completionStatus(status);
-if (process.argv[2] === 'watch')
+if (process.argv[2] === 'watch') {
+    await alertCleanupDone();
     setTimeout(() => process.kill(process.pid, 'SIGKILL'), WATCH_EXIT_GRACE_MS).unref();
+}

package/dist/bounded-file.js

@@ -0,0 +1 @@
+export {api0_readBounded as readBounded, api0_readBoundedFile as readBoundedFile, api0_assertPlainFile as assertPlainFile, api0_BoundedFileError as BoundedFileError, api0_DEFAULT_FILE_LIMIT as DEFAULT_FILE_LIMIT, api0_LOCK_FILE_LIMIT as LOCK_FILE_LIMIT} from "./runtime.js";

package/dist/cancellation.js

@@ -1 +1 @@
-export {api0_withCancellation as withCancellation, api0_checkCancellation as checkCancellation, api0_cancellable as cancellable, api0_cancellationSignal as cancellationSignal, api0_cleanup as cleanup, api0_cleanupOutcome as cleanupOutcome, api0_Cancelled as Cancelled} from "./runtime.js";
+export {api1_withCancellation as withCancellation, api1_checkCancellation as checkCancellation, api1_cancellable as cancellable, api1_cancellationSignal as cancellationSignal, api1_cleanup as cleanup, api1_cleanupOutcome as cleanupOutcome, api1_Cancelled as Cancelled} from "./runtime.js";

package/dist/caveat-address.js

@@ -1 +1 @@
-export {api1_canonicalIp as canonicalIp, api1_canonicalCidr as canonicalCidr} from "./runtime.js";
+export {api2_canonicalIp as canonicalIp, api2_canonicalCidr as canonicalCidr} from "./runtime.js";

package/dist/cli.js

@@ -1 +1 @@
-export {api2_writeChunks as writeChunks, api2_main as main, api2_completionStatus as completionStatus, api2_WATCH_SUMMARY_WRITE_MS as WATCH_SUMMARY_WRITE_MS} from "./runtime.js";
+export {api3_writeChunks as writeChunks, api3_main as main, api3_completionStatus as completionStatus, api3_WATCH_SUMMARY_WRITE_MS as WATCH_SUMMARY_WRITE_MS} from "./runtime.js";

package/dist/commands/attenuate.js

@@ -1 +1 @@
-export {api4_run as run, api4_attenuate as attenuate} from "../runtime.js";
+export {api5_run as run, api5_attenuate as attenuate} from "../runtime.js";

package/dist/commands/bake/allocate.js

@@ -1 +1 @@
-export {api5_allocateRootKeyId as allocateRootKeyId} from "../../runtime.js";
+export {api6_allocateRootKeyId as allocateRootKeyId} from "../../runtime.js";

package/dist/commands/bake/index.js

@@ -1 +1 @@
-export {api6_run as run, api6_bake as bake} from "../../runtime.js";
+export {api7_run as run, api7_bake as bake} from "../../runtime.js";

package/dist/commands/bake/write-out.js

@@ -1 +1 @@
-export {api7_reserveOut as reserveOut} from "../../runtime.js";
+export {api8_reserveOut as reserveOut} from "../../runtime.js";

package/dist/commands/handlers.js

@@ -1 +1 @@
-export {api8_handlers as handlers} from "../runtime.js";
+export {api9_handlers as handlers} from "../runtime.js";

package/dist/commands/inspect.js

@@ -1 +1 @@
-export {api9_run as run, api9_inspect as inspect} from "../runtime.js";
+export {api10_inspectResult as inspectResult, api10_run as run, api10_inspect as inspect} from "../runtime.js";

package/dist/commands/inventory.js

@@ -1 +1 @@
-export {api10_run as run, api10_inventory as inventory} from "../runtime.js";
+export {api11_run as run, api11_inventory as inventory} from "../runtime.js";

package/dist/commands/recommend.js

@@ -1 +1 @@
-export {api11_narrowLabel as narrowLabel, api11_run as run, api11_recommend as recommend, api11_SHORT_OBSERVATION_SECONDS as SHORT_OBSERVATION_SECONDS} from "../runtime.js";
+export {api12_narrowLabel as narrowLabel, api12_run as run, api12_recommend as recommend, api12_SHORT_OBSERVATION_SECONDS as SHORT_OBSERVATION_SECONDS} from "../runtime.js";

package/dist/commands/respond.js

@@ -1 +1 @@
-export {api12_aggregateExit as aggregateExit, api12_run as run, api12_respond as respond, api12_ROOT_KEY_0_GUIDANCE as ROOT_KEY_0_GUIDANCE, api12_OWN_ON_ROOT_KEY_0 as OWN_ON_ROOT_KEY_0, api12_REVOKED_BUT_PRESENT_GUIDANCE as REVOKED_BUT_PRESENT_GUIDANCE, api12_BAKING_RISK_GUIDANCE as BAKING_RISK_GUIDANCE, api12_CUSTOM_CAVEAT_NOTE as CUSTOM_CAVEAT_NOTE, api12_UNKNOWN_GUIDANCE as UNKNOWN_GUIDANCE} from "../runtime.js";
+export {api13_aggregateExit as aggregateExit, api13_run as run, api13_respond as respond, api13_ROOT_KEY_0_GUIDANCE as ROOT_KEY_0_GUIDANCE, api13_OWN_ON_ROOT_KEY_0 as OWN_ON_ROOT_KEY_0, api13_REVOKED_BUT_PRESENT_GUIDANCE as REVOKED_BUT_PRESENT_GUIDANCE, api13_BAKING_RISK_GUIDANCE as BAKING_RISK_GUIDANCE, api13_CUSTOM_CAVEAT_NOTE as CUSTOM_CAVEAT_NOTE, api13_UNKNOWN_GUIDANCE as UNKNOWN_GUIDANCE} from "../runtime.js";

package/dist/commands/revoke.js

@@ -1 +1 @@
-export {api13_run as run, api13_revoke as revoke} from "../runtime.js";
+export {api14_run as run, api14_revoke as revoke} from "../runtime.js";

package/dist/commands/rotate.js

@@ -1 +1 @@
-export {api14_run as run, api14_rotate as rotate} from "../runtime.js";
+export {api15_run as run, api15_rotate as rotate} from "../runtime.js";

package/dist/commands/scan.js

@@ -1 +1 @@
-export {api15_run as run} from "../runtime.js";
+export {api16_run as run} from "../runtime.js";

package/dist/commands/verify.js

@@ -0,0 +1 @@
+export {api17_run as run, api17_verify as verify, api17_ROOT_KEY_0_ACCEPTED as ROOT_KEY_0_ACCEPTED, api17_CAN_BAKE_ACCEPTED as CAN_BAKE_ACCEPTED, api17_CAN_BAKE_ROOT_KEY_0 as CAN_BAKE_ROOT_KEY_0, api17_OWN_ROOT_KEY_ACCEPTED as OWN_ROOT_KEY_ACCEPTED, api17_REJECTED_INCONCLUSIVE as REJECTED_INCONCLUSIVE, api17_CUSTOM_CAVEAT_REJECTED as CUSTOM_CAVEAT_REJECTED} from "../runtime.js";

package/dist/commands/watch.js

@@ -1 +1 @@
-export {api16_lockOwnerGone as lockOwnerGone, api16_acquireLock as acquireLock, api16_run as run, api16_stdoutEvents as stdoutEvents, api16_watch as watch, api16_CANARY_RELOAD_MS as CANARY_RELOAD_MS} from "../runtime.js";
+export {api18_scheduleDeadline as scheduleDeadline, api18_lockOwnerGone as lockOwnerGone, api18_acquireLock as acquireLock, api18_run as run, api18_stdoutEvents as stdoutEvents, api18_watch as watch, api18_CANARY_RELOAD_MS as CANARY_RELOAD_MS, api18_MAX_TIMER_MS as MAX_TIMER_MS} from "../runtime.js";

package/dist/credential-recognition.js

@@ -1 +1 @@
-export {api17_redactEncodedCredentials as redactEncodedCredentials} from "./runtime.js";
+export {api19_redactEncodedCredentials as redactEncodedCredentials} from "./runtime.js";

package/dist/decode/index.js

@@ -1 +1 @@
-export {api18_macaroonPacketRange as macaroonPacketRange, api18_macaroonSectionRange as macaroonSectionRange, api18_parseTimeBefore as parseTimeBefore, api18_canonicalMacaroonLength as canonicalMacaroonLength, api18_decodeMacaroon as decodeMacaroon, api18_macaroonId as macaroonId, api18_encodeMacaroon as encodeMacaroon, api18_addFirstPartyCaveat as addFirstPartyCaveat, api18_timeBeforeCondition as timeBeforeCondition, api18_validMacaroonIdentifier as validMacaroonIdentifier, api18_isNwcContainer as isNwcContainer, api18_decodeNwc as decodeNwc, api18_DecodeError as DecodeError} from "../runtime.js";
+export {api20_macaroonEosEnd as macaroonEosEnd, api20_macaroonPacketRange as macaroonPacketRange, api20_macaroonSectionRange as macaroonSectionRange, api20_parseTimeBefore as parseTimeBefore, api20_canonicalMacaroonForm as canonicalMacaroonForm, api20_decodeMacaroon as decodeMacaroon, api20_macaroonId as macaroonId, api20_encodeMacaroon as encodeMacaroon, api20_addFirstPartyCaveat as addFirstPartyCaveat, api20_timeBeforeCondition as timeBeforeCondition, api20_validMacaroonIdentifier as validMacaroonIdentifier, api20_isNwcContainer as isNwcContainer, api20_decodeNwc as decodeNwc, api20_DecodeError as DecodeError} from "../runtime.js";

package/dist/decode/recognition.js

@@ -1 +1 @@
-export {api19_macaroonEnds as macaroonEnds} from "../runtime.js";
+export {api21_macaroonEnds as macaroonEnds} from "../runtime.js";

package/dist/environment.js

@@ -1 +1 @@
-export {api20_unsafeNodeDiagnostics as unsafeNodeDiagnostics} from "./runtime.js";
+export {api22_unsafeNodeDiagnostics as unsafeNodeDiagnostics} from "./runtime.js";

package/dist/errors.js

@@ -1 +1 @@
-export {api21_UsageError as UsageError, api21_InputError as InputError, api21_DecodeError as DecodeError, api21_LndError as LndError, api21_LndUncertainError as LndUncertainError} from "./runtime.js";
+export {api23_UsageError as UsageError, api23_InputError as InputError, api23_DecodeError as DecodeError, api23_LndError as LndError, api23_LndUncertainError as LndUncertainError} from "./runtime.js";

package/dist/grade/index.js

@@ -1 +1 @@
-export {api22_grade as grade, api22_describe as describe} from "../runtime.js";
+export {api24_grade as grade, api24_gradeFacts as gradeFacts, api24_describe as describe} from "../runtime.js";

package/dist/grouped-runs.js

@@ -1 +1 @@
-export {api23_groupedRuns as groupedRuns, api23_groupedBase64 as groupedBase64} from "./runtime.js";
+export {api25_groupedRuns as groupedRuns, api25_groupedBase64 as groupedBase64} from "./runtime.js";

package/dist/input/index.js

@@ -1 +1 @@
-export {api24_readCredential as readCredential, api24_InputError as InputError, api24_UsageError as UsageError} from "../runtime.js";
+export {api26_readCredential as readCredential, api26_InputError as InputError, api26_UsageError as UsageError} from "../runtime.js";

package/dist/input/lndconnect.js

@@ -1 +1 @@
-export {api25_parseLndconnect as parseLndconnect} from "../runtime.js";
+export {api27_parseLndconnect as parseLndconnect} from "../runtime.js";

package/dist/lnd/grpc.js

@@ -1 +1 @@
-export {api26_openGrpcStream as openGrpcStream, api26_MAX_GRPC_MESSAGE as MAX_GRPC_MESSAGE, api26_STALL_TIMEOUT_MS as STALL_TIMEOUT_MS, api26_MAX_PENDING_WRITE_BYTES as MAX_PENDING_WRITE_BYTES, api26_WRITE_OVERHEAD_BYTES as WRITE_OVERHEAD_BYTES, api26_PING_INTERVAL_MS as PING_INTERVAL_MS, api26_PING_TIMEOUT_MS as PING_TIMEOUT_MS} from "../runtime.js";
+export {api28_openGrpcStream as openGrpcStream, api28_MAX_GRPC_MESSAGE as MAX_GRPC_MESSAGE, api28_STALL_TIMEOUT_MS as STALL_TIMEOUT_MS, api28_MAX_PENDING_WRITE_BYTES as MAX_PENDING_WRITE_BYTES, api28_WRITE_OVERHEAD_BYTES as WRITE_OVERHEAD_BYTES, api28_PING_INTERVAL_MS as PING_INTERVAL_MS, api28_PING_TIMEOUT_MS as PING_TIMEOUT_MS} from "../runtime.js";

package/dist/lnd/index.js

@@ -1 +1 @@
-export {api27_createLndAdapter as createLndAdapter, api27_registerMiddleware as registerMiddleware} from "../runtime.js";
+export {api29_createLndAdapter as createLndAdapter, api29_registerMiddleware as registerMiddleware} from "../runtime.js";

package/dist/lnd/middleware-proto.js

@@ -1 +1 @@
-export {api28_decodeMiddlewareRequest as decodeMiddlewareRequest, api28_encodeRegistration as encodeRegistration, api28_encodeFeedback as encodeFeedback, api28_MAX_MACAROON_BYTES as MAX_MACAROON_BYTES, api28_MAX_METHOD_BYTES as MAX_METHOD_BYTES, api28_MAX_CONDITION_BYTES as MAX_CONDITION_BYTES, api28_UNKNOWN_METHOD as UNKNOWN_METHOD} from "../runtime.js";
+export {api30_decodeMiddlewareRequest as decodeMiddlewareRequest, api30_encodeRegistration as encodeRegistration, api30_encodeFeedback as encodeFeedback, api30_MAX_MACAROON_BYTES as MAX_MACAROON_BYTES, api30_MAX_METHOD_BYTES as MAX_METHOD_BYTES, api30_MAX_CONDITION_BYTES as MAX_CONDITION_BYTES, api30_UNKNOWN_METHOD as UNKNOWN_METHOD} from "../runtime.js";

package/dist/lnd/tls-identity.js

@@ -0,0 +1 @@
+export {api31_identityCheck as identityCheck} from "../runtime.js";

package/dist/online.js

@@ -1 +1 @@
-export {api29_endpoint as endpoint, api29_credentialText as credentialText, api29_connectionProblem as connectionProblem, api29_flagProblem as flagProblem, api29_nodeInfo as nodeInfo, api29_nodePubkey as nodePubkey, api29_drift as drift, api29_samePermissions as samePermissions, api29_listIds as listIds, api29_failureDetails as failureDetails, api29_readBoundedFile as readBoundedFile, api29_onlineAdapter as onlineAdapter, api29_shellQuote as shellQuote, api29_recoveryPath as recoveryPath, api29_recoveryCommand as recoveryCommand, api29_inventoryRecoveryCommand as inventoryRecoveryCommand, api29_readOnlineCredential as readOnlineCredential, api29_onlineWarnings as onlineWarnings, api29_LABEL_RULE as LABEL_RULE} from "./runtime.js";
+export {api32_endpoint as endpoint, api32_credentialText as credentialText, api32_connectionProblem as connectionProblem, api32_flagProblem as flagProblem, api32_nodeInfo as nodeInfo, api32_nodePubkey as nodePubkey, api32_drift as drift, api32_samePermissions as samePermissions, api32_listIds as listIds, api32_failureDetails as failureDetails, api32_onlineAdapter as onlineAdapter, api32_shellQuote as shellQuote, api32_recoveryPath as recoveryPath, api32_recoveryCommand as recoveryCommand, api32_inventoryRecoveryCommand as inventoryRecoveryCommand, api32_readOnlineCredential as readOnlineCredential, api32_onlineWarnings as onlineWarnings, api32_LABEL_RULE as LABEL_RULE, api32_readBoundedFile as readBoundedFile} from "./runtime.js";

package/dist/output/index.js

@@ -1 +1 @@
-export {api30_rotatePlanResult as rotatePlanResult, api30_revokePlanResult as revokePlanResult, api30_error as error, api30_warning as warning, api30_renderWatchEvent as renderWatchEvent, api30_formatDuration as formatDuration, api30_revokeConfirmation as revokeConfirmation, api30_writeRevokePrompt as writeRevokePrompt, api30_writeRotateFinishPlan as writeRotateFinishPlan, api30_rotateConfirmation as rotateConfirmation, api30_writeRotatePrompt as writeRotatePrompt, api30_render as render, api30_renderChunks as renderChunks, api30_inventoryResult as inventoryResult, api30_writeRotateStagePlan as writeRotateStagePlan} from "../runtime.js";
+export {api33_rotatePlanResult as rotatePlanResult, api33_revokePlanResult as revokePlanResult, api33_error as error, api33_warning as warning, api33_renderWatchEvent as renderWatchEvent, api33_formatDuration as formatDuration, api33_revokeConfirmation as revokeConfirmation, api33_writeRevokePrompt as writeRevokePrompt, api33_writeRotateFinishPlan as writeRotateFinishPlan, api33_rotateConfirmation as rotateConfirmation, api33_writeRotatePrompt as writeRotatePrompt, api33_render as render, api33_renderChunks as renderChunks, api33_inventoryResult as inventoryResult, api33_writeRotateStagePlan as writeRotateStagePlan} from "../runtime.js";

package/dist/output/scan-formats.js

@@ -1 +1 @@
-export {api31_ruleIdFor as ruleIdFor, api31_findingSeverity as findingSeverity, api31_locationOf as locationOf, api31_fileUri as fileUri, api31_sarifPieces as sarifPieces, api31_escapeData as escapeData, api31_escapeProperty as escapeProperty, api31_githubLines as githubLines, api31_SARIF_MAX_RESULTS as SARIF_MAX_RESULTS} from "../runtime.js";
+export {api34_ruleIdFor as ruleIdFor, api34_findingSeverity as findingSeverity, api34_locationOf as locationOf, api34_fileUri as fileUri, api34_sarifPieces as sarifPieces, api34_escapeData as escapeData, api34_escapeProperty as escapeProperty, api34_githubLines as githubLines, api34_SARIF_MAX_RESULTS as SARIF_MAX_RESULTS} from "../runtime.js";

package/dist/process-error-context.js

@@ -1 +1 @@
-export {api32_withProcessErrorContext as withProcessErrorContext, api32_markMutationSent as markMutationSent, api32_internalErrorMessage as internalErrorMessage} from "./runtime.js";
+export {api35_withProcessErrorContext as withProcessErrorContext, api35_markMutationSent as markMutationSent, api35_internalErrorMessage as internalErrorMessage} from "./runtime.js";

package/dist/protected-path.js

@@ -1 +1 @@
-export {api33_isProtectedPath as isProtectedPath, api33_resolveUnprotectedPath as resolveUnprotectedPath} from "./runtime.js";
+export {api36_isProtectedPath as isProtectedPath, api36_resolveUnprotectedPath as resolveUnprotectedPath} from "./runtime.js";

package/dist/registry/index.js

@@ -1 +1 @@
-export {api34_openRegistry as openRegistry, api34_replacementProblem as replacementProblem, api34_replacementLinkProblems as replacementLinkProblems, api34_hasCustomCaveat as hasCustomCaveat, api34_RegistryInputError as RegistryInputError, api34_RegistryUsageError as RegistryUsageError, api34_Registry as Registry} from "../runtime.js";
+export {api37_openRegistry as openRegistry, api37_replacementProblem as replacementProblem, api37_replacementLinkProblems as replacementLinkProblems, api37_hasCustomCaveat as hasCustomCaveat, api37_RegistryInputError as RegistryInputError, api37_RegistryUsageError as RegistryUsageError, api37_Registry as Registry} from "../runtime.js";

package/dist/registry/process-domain.js

@@ -1 +1 @@
-export {api35_validDomain as validDomain, api35_ownProcessDomain as ownProcessDomain} from "../runtime.js";
+export {api38_validDomain as validDomain, api38_ownProcessDomain as ownProcessDomain} from "../runtime.js";

package/dist/report/access-review.js

@@ -1 +1 @@
-export {api36_buildAccessReview as buildAccessReview, api36_csvField as csvField, api36_formatAccessReview as formatAccessReview, api36_REPORT_FORMATS as REPORT_FORMATS} from "../runtime.js";
+export {api39_buildAccessReview as buildAccessReview, api39_csvField as csvField, api39_formatAccessReview as formatAccessReview, api39_REPORT_FORMATS as REPORT_FORMATS, api39_LIMITATIONS as LIMITATIONS} from "../runtime.js";