macwarden 1.0.1 → 1.1.0

package/dist/runtime.js

@@ -1,6 +1,6 @@
-import * as builtin0 from "node:async_hooks";
-import * as builtin1 from "node:fs";
-import * as builtin2 from "node:fs/promises";
+import * as builtin0 from "node:fs";
+import * as builtin1 from "node:fs/promises";
+import * as builtin2 from "node:async_hooks";
 import * as builtin3 from "node:path";
 import * as builtin4 from "node:stream";
 import * as builtin5 from "node:crypto";
@@ -10,8 +10,106 @@ import * as builtin8 from "node:readline";
 import * as builtin9 from "node:util";
 import * as builtin10 from "node:http2";
 import * as builtin11 from "node:https";
-const builtins = {"node:async_hooks": builtin0,"node:fs": builtin1,"node:fs/promises": builtin2,"node:path": builtin3,"node:stream": builtin4,"node:crypto": builtin5,"node:child_process": builtin6,"node:os": builtin7,"node:readline": builtin8,"node:util": builtin9,"node:http2": builtin10,"node:https": builtin11};
-const factories = {"cancellation.js": (module, exports, require) => {
+const builtins = {"node:fs": builtin0,"node:fs/promises": builtin1,"node:async_hooks": builtin2,"node:path": builtin3,"node:stream": builtin4,"node:crypto": builtin5,"node:child_process": builtin6,"node:os": builtin7,"node:readline": builtin8,"node:util": builtin9,"node:http2": builtin10,"node:https": builtin11};
+const factories = {"bounded-file.js": (module, exports, require) => {
+"use strict";
+exports.__esModule = true;
+exports.LOCK_FILE_LIMIT = exports.DEFAULT_FILE_LIMIT = exports.BoundedFileError = void 0;
+exports.readBounded = readBounded;
+exports.readBoundedFile = readBoundedFile;
+exports.assertPlainFile = assertPlainFile;
+// Bounded regular-file reads for files macwarden reads by path: TLS certificates and the
+// sidecars kept next to the registry. The path and its resolved target are checked against
+// the protected names (SAFE-02) before anything is opened, the opened file must be the
+// regular file that was checked, and at most `limit` bytes are accepted: a larger file fails
+// before its content is parsed, and allocation follows the file's size, never the limit.
+const node_fs_1 = require("node:fs");
+const protected_path_js_1 = require("./protected-path.js");
+/** Why a bounded read was refused before any content was read or accepted. */
+class BoundedFileError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'BoundedFileError';
+    }
+}
+exports.BoundedFileError = BoundedFileError;
+exports.DEFAULT_FILE_LIMIT = 1_048_576;
+/**
+ * Reads at most limit + 1 bytes from an open handle. The buffer starts at the size fstat
+ * reported plus one byte (to notice growth) and doubles only while the file keeps yielding
+ * data, so a small file never costs a limit-sized allocation.
+ */
+async function readBounded(handle, limit, size) {
+    const hinted = typeof size === 'bigint' ? (size > BigInt(limit) ? limit : Number(size)) : Math.min(Math.max(size, 0), limit);
+    let bytes = Buffer.allocUnsafe(hinted + 1);
+    let total = 0;
+    for (;;) {
+        if (total === bytes.length) {
+            if (bytes.length >= limit + 1)
+                break;
+            const grown = Buffer.allocUnsafe(Math.min(limit + 1, bytes.length * 2));
+            bytes.copy(grown, 0, 0, total);
+            bytes = grown;
+        }
+        const { bytesRead } = await handle.read(bytes, total, bytes.length - total, total);
+        if (bytesRead === 0)
+            break;
+        total += bytesRead;
+    }
+    return bytes.subarray(0, total);
+}
+/**
+ * Reads a regular file of at most `limit` bytes. A missing path rejects with the file
+ * system's ENOENT error (so callers can treat an optional file as absent); a protected path
+ * or target, anything but a regular file, a file replaced between check and open, or one
+ * larger than `limit` rejects with BoundedFileError before any content is read.
+ */
+async function readBoundedFile(path, io, limit = exports.DEFAULT_FILE_LIMIT) {
+    if ((0, protected_path_js_1.isProtectedPath)(path))
+        throw new BoundedFileError('protected file');
+    const resolved = await io.realpath(path);
+    if ((0, protected_path_js_1.isProtectedPath)(resolved))
+        throw new BoundedFileError('protected file');
+    const before = await io.stat(resolved);
+    if (!before.isFile())
+        throw new BoundedFileError('not a regular file');
+    if (before.size > limit)
+        throw new BoundedFileError('file too large');
+    const handle = await io.open(resolved, node_fs_1.constants.O_RDONLY | node_fs_1.constants.O_NONBLOCK | (node_fs_1.constants.O_NOFOLLOW ?? 0));
+    try {
+        const opened = await handle.stat();
+        if (!opened.isFile() || opened.dev !== before.dev || opened.ino !== before.ino)
+            throw new BoundedFileError('file changed');
+        if (opened.size > limit)
+            throw new BoundedFileError('file too large');
+        const bytes = await readBounded(handle, limit, opened.size);
+        if (bytes.length > limit)
+            throw new BoundedFileError('file too large');
+        return bytes;
+    }
+    finally {
+        await handle.close();
+    }
+}
+/** Largest lock owner record read: a few fields (pid, host name, start time, process domain). */
+exports.LOCK_FILE_LIMIT = 64 * 1024;
+/**
+ * For files read by whole-file reads that must stay in place (lock owner records, whose
+ * reads are part of the lock protocol): the path itself must be a regular file, not a
+ * symlink, under no protected name, and at most `limit` bytes. Refuses before any open.
+ */
+async function assertPlainFile(path, io, limit) {
+    if ((0, protected_path_js_1.isProtectedPath)(path))
+        throw new BoundedFileError('protected file');
+    const meta = await io.lstat(path);
+    if (!meta.isFile() || meta.isSymbolicLink())
+        throw new BoundedFileError('not a regular file');
+    if (meta.size > limit)
+        throw new BoundedFileError('file too large');
+}
+
+},
+"cancellation.js": (module, exports, require) => {
 "use strict";
 exports.__esModule = true;
 exports.Cancelled = void 0;
@@ -209,6 +307,8 @@ const synopses = {
     recommend: [`recommend (<label> | <root-key-id> | id:<16 hex> | --target-file <file>) [--accept-short-observation] [--registry <path>] [--json]${online}`],
     respond: [`respond --out-dir <directory> [--allow-admin] [--yes] [--registry <path>] [--break-lock] [--dry-run] [--json]${online}`,
         `respond --finish [--yes] [--registry <path>] [--break-lock] [--dry-run] [--json]${online}`],
+    verify: [`verify <file | -> [--registry <path>] [--json]${online}`,
+        `verify <hex | base64 | lndconnect://...> --unsafe-arg [--registry <path>] [--json]${online}`],
 };
 const summaries = [
     ['inspect', 'decode a macaroon or NWC URI offline and grade what it can do'],
@@ -221,6 +321,7 @@ const summaries = [
     ['watch', 'observe which credential makes which call (read-only LND middleware); guard canaries'],
     ['recommend', 'suggest the least permissions a credential needs from observed usage'],
     ['respond', 'after a suspected leak: stage replacements for every credential, then --finish with proof'],
+    ['verify', 'ask LND whether one credential file is still accepted (after a leak)'],
 ];
 const usage = ['Usage: macwarden <command> [options]', '       macwarden <command> --help', '       macwarden --help | --version',
     '', 'Commands:', ...summaries.map(([name, summary]) => `  ${name.padEnd(10)} ${summary}`)].join('\n');
@@ -520,7 +621,7 @@ function byteSort(values) {
     return [...new Set(values)].sort((left, right) => Buffer.compare(Buffer.from(left), Buffer.from(right)));
 }
 function result(parent, child, added, out, dryRun, now) {
-    const assessed = (0, index_js_2.grade)(child.permissions);
+    const assessed = (0, index_js_2.gradeFacts)(child);
     return {
         dryRun,
         out,
@@ -1331,7 +1432,8 @@ const attenuate_js_1 = require("./attenuate.js");
 const watch_js_1 = require("./watch.js");
 const recommend_js_1 = require("./recommend.js");
 const respond_js_1 = require("./respond.js");
-exports.handlers = { inspect: inspect_js_1.inspect, scan: scan_js_1.run, inventory: inventory_js_1.inventory, bake: index_js_1.bake, revoke: revoke_js_1.revoke, rotate: rotate_js_1.rotate, attenuate: attenuate_js_1.attenuate, watch: watch_js_1.watch, recommend: recommend_js_1.recommend, respond: respond_js_1.respond };
+const verify_js_1 = require("./verify.js");
+exports.handlers = { inspect: inspect_js_1.inspect, scan: scan_js_1.run, inventory: inventory_js_1.inventory, bake: index_js_1.bake, revoke: revoke_js_1.revoke, rotate: rotate_js_1.rotate, attenuate: attenuate_js_1.attenuate, watch: watch_js_1.watch, recommend: recommend_js_1.recommend, respond: respond_js_1.respond, verify: verify_js_1.verify };
 
 },
 "commands/inspect.js": (module, exports, require) => {
@@ -1370,6 +1472,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 exports.__esModule = true;
+exports.inspectResult = inspectResult;
 exports.run = run;
 exports.inspect = inspect;
 const fs = __importStar(require("node:fs/promises"));
@@ -1394,6 +1497,22 @@ function datedCaveat(caveat, now) {
     const expired = expiration(caveat.value, now);
     return expired === undefined ? caveat : { ...caveat, expired };
 }
+/** The offline facts inspect reports for one macaroon; verify reports the same. */
+function inspectResult(facts, now) {
+    const assessed = (0, index_js_2.gradeFacts)(facts);
+    return {
+        fingerprint: facts.fingerprint,
+        location: facts.location,
+        rootKeyId: facts.rootKeyId.toString(),
+        permissions: facts.permissions,
+        caveats: facts.caveats.map(caveat => datedCaveat(caveat, now)),
+        grade: assessed.grade,
+        reasons: assessed.reasons,
+        warnings: byteSort([...assessed.warnings, ...(0, index_js_2.describe)(facts)]),
+        unassessed: assessed.unassessed,
+        snapshot: '0.21.4-beta',
+    };
+}
 async function run(args, deps) {
     let unsafeArg = false;
     let endOfFlags = false;
@@ -1435,21 +1554,7 @@ async function run(args, deps) {
             };
             return { command: 'inspect', ok: true, warnings, result, error: null };
         }
-        const facts = (0, index_js_1.decodeMacaroon)(secret);
-        const assessed = (0, index_js_2.grade)(facts.permissions);
-        const now = deps.clock();
-        const result = {
-            fingerprint: facts.fingerprint,
-            location: facts.location,
-            rootKeyId: facts.rootKeyId.toString(),
-            permissions: facts.permissions,
-            caveats: facts.caveats.map(caveat => datedCaveat(caveat, now)),
-            grade: assessed.grade,
-            reasons: assessed.reasons,
-            warnings: byteSort([...assessed.warnings, ...(0, index_js_2.describe)(facts)]),
-            unassessed: assessed.unassessed,
-            snapshot: '0.21.4-beta',
-        };
+        const result = inspectResult((0, index_js_1.decodeMacaroon)(secret), deps.clock());
         return { command: 'inspect', ok: true, warnings, result, error: null };
     }
     catch (error) {
@@ -2030,24 +2135,37 @@ async function runSteps(args, deps) {
         return fail(failure.code, 'R5', failure.message, warnings);
     }
     const ownEntries = registry.entries.filter(entry => entry.nodePubkey.toLowerCase() === pubkey);
+    // The one active registry entry for a non-zero root key ID, or none when there is none or
+    // more than one (the permissions to check against would be ambiguous).
+    const activeFor = (rootKeyId) => {
+        if (rootKeyId === '0')
+            return undefined;
+        const found = ownEntries.filter(item => item.rootKeyId === rootKeyId && item.status === 'active');
+        return found.length === 1 ? found[0] : undefined;
+    };
     let entry;
     let select;
     let label = selector;
+    // Permissions decoded from --target-file: the selected credential's own, so the widening
+    // guard also applies to a credential with no registry entry (a default macaroon).
+    let filePermissions = null;
+    let fileRootKeyId = null;
     if (targetFile !== undefined) {
-        // The credential ID comes from the identifier only; the file's bytes are not kept.
+        // The credential ID and permissions come from the identifier only; the file's bytes are not kept.
         let identity;
         try {
             if ((0, protected_path_js_1.isProtectedPath)(targetFile))
                 return fail(3, 'R6', 'protected target file', warnings);
-            identity = (0, index_js_1.macaroonId)((await (0, online_js_1.readOnlineCredential)(targetFile, { stdin: process.stdin, fs: deps.fs })).secret);
+            const secret = (await (0, online_js_1.readOnlineCredential)(targetFile, { stdin: process.stdin, fs: deps.fs })).secret;
+            identity = (0, index_js_1.macaroonId)(secret);
+            filePermissions = (0, index_js_1.decodeMacaroon)(secret).permissions;
         }
         catch {
             return fail(3, 'R6', 'unreadable or undecodable target file', warnings);
         }
         select = { credential: identity.id };
         label = identity.id;
-        if (identity.rootKeyId !== 0n)
-            entry = ownEntries.find(item => item.rootKeyId === identity.rootKeyId.toString() && item.status === 'active');
+        fileRootKeyId = identity.rootKeyId.toString();
     }
     else if (byCredential) {
         select = { credential: selector };
@@ -2056,7 +2174,7 @@ async function runSteps(args, deps) {
         // Root key 0 is shared by every default macaroon: only a fingerprint can tell them apart.
         if (selector === '0')
             return fail(2, 'R6', 'root key ID 0 is shared by the default macaroons; select one with --target-file or its credential ID (id:…)', warnings);
-        entry = ownEntries.find(item => item.rootKeyId === selector && item.status === 'active');
+        entry = activeFor(selector);
         select = { rootKeyId: selector };
     }
     else {
@@ -2068,6 +2186,19 @@ async function runSteps(args, deps) {
         select = { rootKeyId: entry.rootKeyId };
     }
     const records = usage.forCredential(pubkey, select);
+    // A credential selector resolves to a registry entry through its usage identity: the root
+    // key ID recorded with it (and the file's, for --target-file) must be one non-zero value.
+    // One credential ID under several root key IDs is inconsistent evidence and resolves to none.
+    const identities = new Set(records.map(item => item.rootKeyId));
+    if (fileRootKeyId !== null)
+        identities.add(fileRootKeyId);
+    const identity = identities.size === 1 ? [...identities][0] : null;
+    if (select.credential !== undefined) {
+        if (identity !== null)
+            entry = activeFor(identity);
+        if (identities.size > 1)
+            filePermissions = null;
+    }
     const byMethod = new Map();
     for (const record of records) {
         const current = byMethod.get(record.method);
@@ -2091,18 +2222,35 @@ async function runSteps(args, deps) {
         warnings.push({ code: 'usage-incomplete', message: 'the usage data may be missing calls (records were evicted, or watch '
                 + 'was overloaded and did not attribute some calls), and any credential could be affected; no narrowing command is printed. '
                 + 'For a complete observation, stop watch, move the usage file aside and run watch again' });
-    const beyond = current === null ? [] : methods.filter(method => !unmapped.includes(method)
-        && !current.includes(`uri:${method}`) && !(methodPermissions[method] ?? []).every(permission => current.includes(permission)));
+    // Every permission set the credential is known to hold must already cover each observed
+    // method: the registry entry's and, for --target-file, the file's own.
+    const held = [current, filePermissions].filter((item) => item !== null);
+    const covers = (permissions, method) => permissions.includes(`uri:${method}`)
+        || (methodPermissions[method] ?? []).every(permission => permissions.includes(permission));
+    const beyond = methods.filter(method => !unmapped.includes(method) && held.some(permissions => !covers(permissions, method)));
+    // Without any known permission set, narrowing cannot be told from widening.
+    const unverified = observed.length > 0 && held.length === 0;
+    if (unverified)
+        warnings.push({ code: 'recommendation-unverified', message: 'the observed usage could not be matched to the permissions '
+                + 'of exactly one active registry entry (or of --target-file), so a narrowing command could widen the credential; none is printed' });
     if (beyond.length)
         warnings.push({ code: 'recommendation-broader', message: `observed methods this credential's recorded permissions do not cover: `
                 + `${beyond.join(', ')}; the usage data or the registry may be wrong, so no narrowing command is printed` });
-    // How long watch observed this node, counted from the credential's creation when it is
-    // registered later than watch first ran. Files written before 1.0.1 record no coverage.
+    // How long watch observed this node after the credential was created: a provable lower
+    // bound, never time watch covered before it existed. Its creation is the registry entry's;
+    // without one, the credential existed no later than its first recorded use. Two bounds,
+    // the larger is taken: the recorded spans after creation (from 1.1.0), and the covered
+    // total minus the most that can lie before creation (all time from the first registration
+    // to it). Files written before 1.0.1 record no coverage.
     const coverage = usage.coverageFor(pubkey);
     let seconds = null;
     if (coverage) {
-        const since = Math.max(Date.parse(coverage.firstStart), entry ? Date.parse(entry.createdAt) : 0);
-        seconds = Math.max(0, Math.min(coverage.coveredSeconds, Math.floor((Date.parse(coverage.lastEnd) - since) / 1_000)));
+        const firstUse = records.length ? records.reduce((first, item) => Math.min(first, Date.parse(item.firstSeen)), Infinity) : null;
+        const created = entry ? Date.parse(entry.createdAt) : firstUse;
+        const since = Math.max(Date.parse(coverage.firstStart), created ?? -Infinity);
+        const before = Math.ceil((since - Date.parse(coverage.firstStart)) / 1_000);
+        const lower = Math.max(coverage.coveredSeconds - before, usage.coveredSince(pubkey, since) ?? 0);
+        seconds = Math.max(0, Math.min(lower, Math.floor((Date.parse(coverage.lastEnd) - since) / 1_000)));
     }
     const short = seconds === null || seconds < exports.SHORT_OBSERVATION_SECONDS;
     const observation = { seconds, since: coverage?.firstStart ?? null, until: coverage?.lastEnd ?? null,
@@ -2114,16 +2262,18 @@ async function runSteps(args, deps) {
                 + (acceptShort ? 'The narrowing command is printed because --accept-short-observation was given'
                     : 'Keep watch running longer, or pass --accept-short-observation to print the narrowing command anyway') });
     const commands = [];
-    if (observed.length && !unmapped.length && !incomplete && !beyond.length && (!short || acceptShort)) {
+    if (observed.length && !unmapped.length && !incomplete && !unverified && !beyond.length && (!short || acceptShort)) {
         const label = entry?.label ? narrowLabel(entry.label) : 'narrowed';
         const connection = `--lnd-rest ${quote(host)} --tls-cert ${quote((0, online_js_1.recoveryPath)(certPath))} --macaroon ${quote((0, online_js_1.recoveryPath)(ownPath))}` +
             (registryPath ? ` --registry ${quote((0, online_js_1.recoveryPath)(registryPath))}` : '');
         commands.push(`macwarden bake --label ${label} --uri ${methods.join(',')} --out <file> ${connection}`);
-        if (entry?.label)
+        // Revoking deletes the whole root key ID: only suggested when the selection covered every
+        // credential observed on it (a label or root key ID), never from one credential's usage.
+        if (entry?.label && select.credential === undefined)
             commands.push(`after switching the app to the new file: macwarden revoke ${entry.label} ${connection}`);
     }
     const result = { node: pubkey, selector: label, label: entry?.label ?? null,
-        rootKeyId: entry?.rootKeyId ?? (byId ? selector : null), credentials: sortUnique(records.map(record => record.credential)),
+        rootKeyId: entry?.rootKeyId ?? (byId ? selector : identity), credentials: sortUnique(records.map(record => record.credential)),
         observed, unmapped, recommended, recommendedUris, current, unneeded, observation, commands };
     return { schema: 1, command: 'recommend', ok: true, warnings, result, error: null };
 }
@@ -2376,10 +2526,24 @@ async function runSteps(args, deps) {
     const tampered = (0, index_js_3.replacementLinkProblems)(mine)[0];
     if (tampered)
         return fail(3, 'P5', `registry tampering: root key ID ${tampered.rootKeyId} claims to replace ${tampered.replaces}, but ${tampered.problem}; restore the registry from a trusted copy`, warnings);
+    // Whether a credential is a canary is decided by its file, not by the editable registry caveat list:
+    // a custom caveat the registry does not record would let the batch rotate a canary into an
+    // ordinary credential. Refused before any mutation, like a forged replacement link.
+    for (const entry of originals(mine)) {
+        if ((0, index_js_3.hasCustomCaveat)(entry))
+            continue;
+        const file = await readCredential(entry.outPath, deps);
+        if (file && file.facts.fingerprint === entry.fingerprint && file.facts.caveats.some(caveat => caveat.type === 'lnd-custom'))
+            return fail(3, 'P5', `registry tampering: root key ID ${entry.rootKeyId}: its credential file carries a custom caveat ` +
+                '(a canary, or another lnd-custom caveat) that the registry does not record; restore the registry from a trusted copy', warnings);
+    }
     // Only active entries cover an ID LND holds; a revoked entry for a present ID needs action.
     const active = new Set(mine.filter(entry => entry.status === 'active').map(entry => entry.rootKeyId));
     const revokedIds = new Set(mine.filter(entry => entry.status === 'revoked').map(entry => entry.rootKeyId));
     const canBake = (entry) => entry.grade === 'ADMIN' || entry.permissions.includes('macaroon:generate');
+    // revoke resolves a label among this node's active entries; where that is ambiguous, advice names the ID.
+    const target = (entry) => entry.label !== null
+        && mine.filter(other => other.status === 'active' && other.label === entry.label).length === 1 ? entry.label : entry.rootKeyId;
     const items = [];
     for (const entry of originals(mine).sort((a, b) => byId(a.rootKeyId, b.rootKeyId))) {
         const staged = stagedReplacement(mine, entry);
@@ -2391,12 +2555,28 @@ async function runSteps(args, deps) {
                     ? 'macwarden\'s own credential: bake a new own macaroon, switch MACWARDEN_MACAROON to it, then revoke this ID'
                     : entry.rootKeyId === '0' ? 'root key ID 0: see the root key ID 0 guidance' : 'no label: revoke it by root key ID, then bake a replacement' });
         else if ((0, index_js_3.hasCustomCaveat)(entry))
-            items.push({ ...base, action: 'manual', status: 'manual', note: exports.CUSTOM_CAVEAT_NOTE.replace('<label>', entry.label) });
-        else if (!inLnd.has(entry.rootKeyId))
-            items.push({ ...base, action: 'repair', status: 'manual',
-                note: `absent from LND while the registry says active: run macwarden revoke ${entry.label} to record it` });
+            items.push({ ...base, action: 'manual', status: 'manual', note: exports.CUSTOM_CAVEAT_NOTE.replace('<label>', target(entry)) });
+        // A replacement an earlier stage allocated but never verified or wrote (an uncertain bake, a failed
+        // verification or write, a failed registry update) is unresolved work, not a usable stage. It is
+        // never retried: LND may hold, or still create, its root key ID.
+        else if (staged && (!staged.verified || !staged.outPath || !staged.fingerprint)) {
+            const listed = inLnd.has(staged.rootKeyId);
+            items.push({ ...base, outPath: null, action: 'repair', status: 'failed',
+                note: `replacement root key ID ${staged.rootKeyId} is incomplete: abandon it with macwarden revoke ${staged.rootKeyId}, then rerun macwarden respond --out-dir <directory>`,
+                error: { code: 7, step: 'P5', message: `replacement root key ID ${staged.rootKeyId} for root key ID ${entry.rootKeyId} was allocated ` +
+                        'by an earlier stage that did not complete (no verified replacement file); ' +
+                        (listed ? 'LND lists it' : 'LND does not list it, but may still create it') + '; it is not retried automatically. ' +
+                        `Inspect with ${(0, online_js_1.inventoryRecoveryCommand)(request)}, abandon it with ${(0, online_js_1.recoveryCommand)(request, staged.rootKeyId)}, ` +
+                        'then rerun macwarden respond --out-dir <directory> to stage a new replacement; the old credential is unchanged' } });
+        }
+        // A staged replacement comes first even when the old ID is already absent: an earlier finish
+        // deleted it and was stopped before saving the registry, and rotate F6 repairs exactly that,
+        // after proving the replacement accepted.
         else if (staged)
             items.push({ ...base, action: 'finish', status: 'planned', note: null });
+        else if (!inLnd.has(entry.rootKeyId))
+            items.push({ ...base, action: 'repair', status: 'manual',
+                note: `absent from LND while the registry says active: run macwarden revoke ${target(entry)} to record it` });
         else
             items.push({ ...base, action: 'stage', status: 'planned', note: null });
     }
@@ -2421,13 +2601,18 @@ async function runSteps(args, deps) {
         bakingRisk: { rootKeyIds: baking, guidance: baking.length ? exports.BAKING_RISK_GUIDANCE : [] },
         outDir: request.outDir ? (0, node_path_1.resolve)(request.outDir) : null, items, unproven: [],
     };
+    const incomplete = items.filter(item => item.status === 'failed');
+    for (const item of incomplete)
+        result.unproven.push({ label: item.label, rootKeyId: item.rootKeyId,
+            reason: `replacement root key ID ${item.replacementRootKeyId} incomplete: revoke it by ID, then stage again` });
     const bakingFirst = (item) => baking.includes(item.rootKeyId) ? 0 : 1;
     const selected = items.filter(item => item.action === (request.finish ? 'finish' : 'stage'))
         .sort((a, b) => bakingFirst(a) - bakingFirst(b) || byId(a.rootKeyId, b.rootKeyId));
     for (const item of items) {
         if (!request.finish && item.action === 'finish') {
             item.status = 'staged-earlier';
-            item.note = 'replacement staged earlier: switch the app, then run macwarden respond --finish';
+            item.note = inLnd.has(item.rootKeyId) ? 'replacement staged earlier: switch the app, then run macwarden respond --finish'
+                : `replacement staged earlier; old root key ID ${item.rootKeyId} is already absent from LND (an earlier finish was interrupted): run macwarden respond --finish to prove the replacement and record the revocation`;
         }
         if (request.finish && item.action === 'stage') {
             // A credential that already replaced a now-revoked one (an earlier finish, or a past
@@ -2448,8 +2633,10 @@ async function runSteps(args, deps) {
     }
     const done = (exitCode) => ({ schema: 1, command: 'respond', ok: true, warnings, result,
         error: null, ...(exitCode ? { exitCode } : {}) });
-    if (request.dryRun || !selected.length)
+    if (request.dryRun)
         return done(0);
+    if (!selected.length)
+        return done(incomplete.length ? 7 : 0);
     // P6: the output directory exists and is a directory; created owner-only when missing.
     if (!request.finish) {
         const outDir = (0, node_path_1.resolve)(request.outDir);
@@ -2499,6 +2686,8 @@ async function runSteps(args, deps) {
         }
         const rotated = outcome.result;
         item.status = request.finish ? 'finished' : 'staged';
+        if (rotated.repaired)
+            item.note = `old root key ID ${item.rootKeyId} was already absent from LND: registry repaired, no second deletion sent`;
         item.replacementRootKeyId = rotated.new.rootKeyId;
         item.replacementFingerprint = rotated.new.fingerprint;
         item.outPath = rotated.new.outPath;
@@ -2544,8 +2733,8 @@ async function runSteps(args, deps) {
     // that was not confirmed: exit 7, like any mutation whose outcome is unknown.
     const unprovenFinish = selected.some(item => item.status === 'finished' && item.proof !== null && item.proof.proven === false);
     // An interrupt after any staged or finished credential means LND changed (7); before any, nothing changed (6).
-    const code = interrupted ? (codes.some(value => value === 0 || value === 7) ? 7 : 6)
-        : aggregateExit([...codes, ...(unprovenFinish ? [7] : [])]);
+    const code = interrupted ? (codes.some(value => value === 0 || value === 7) || incomplete.length ? 7 : 6)
+        : aggregateExit([...codes, ...(unprovenFinish || incomplete.length ? [7] : [])]);
     return done(code);
 }
 async function run(args, deps) {
@@ -2963,7 +3152,7 @@ async function runSteps(args, deps, warnings, state) {
                 revokedEntry = { nodePubkey: pubkey, rootKeyId: id.toString(), label: null,
                     permissions: facts ? [...facts.permissions] : [],
                     caveats: facts?.caveats.map(({ type, value }) => ({ type, value })) ?? [],
-                    grade: facts ? (0, index_js_4.grade)(facts.permissions).grade : 'UNASSESSED',
+                    grade: facts ? (0, index_js_4.gradeFacts)(facts).grade : 'UNASSESSED',
                     fingerprint: facts?.fingerprint ?? null, outPath: facts && request.targetFile ? (0, node_path_1.resolve)(request.targetFile) : null,
                     createdAt: revokedAt, verified: facts !== undefined && proof === 'rejected', status: 'revoked', revokedAt,
                     revokeEvidence: proof, replaces: null, replacedBy: null };
@@ -3479,6 +3668,11 @@ async function runSteps(args, deps, state) {
         return fail(3, 'S4', 'old credential file root key ID differs from the registry entry');
     if (oldFacts && oldFacts.fingerprint !== old.fingerprint)
         return fail(3, 'S4', 'old credential fingerprint differs from the registry entry');
+    // The registry's caveat list is editable metadata: the credential itself decides whether it is a
+    // canary. A custom caveat the registry does not record is tampering, refused before any mutation.
+    if (oldFacts?.caveats.some(caveat => caveat.type === 'lnd-custom'))
+        return fail(3, 'S4', 'the credential file carries a custom caveat (a canary, or another lnd-custom caveat) that the ' +
+            'registry entry does not record; a rotation would replace it with an ordinary credential. Restore the registry from a trusted copy');
     if ((0, index_js_3.grade)(old.permissions).grade !== old.grade)
         return fail(3, 'S4', 'registry grade differs from recorded permissions');
     if (oldFacts?.fingerprint === old.fingerprint) {
@@ -3980,6 +4174,329 @@ async function run(args, deps = { fs }) {
     }
 }
 
+},
+"commands/verify.js": (module, exports, require) => {
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+exports.__esModule = true;
+exports.CUSTOM_CAVEAT_REJECTED = exports.REJECTED_INCONCLUSIVE = exports.OWN_ROOT_KEY_ACCEPTED = exports.CAN_BAKE_ROOT_KEY_0 = exports.CAN_BAKE_ACCEPTED = exports.ROOT_KEY_0_ACCEPTED = void 0;
+exports.run = run;
+exports.verify = verify;
+const nodeFs = __importStar(require("node:fs/promises"));
+const cancellation_js_1 = require("../cancellation.js");
+const online_js_1 = require("../online.js");
+const environment_js_1 = require("../environment.js");
+const protected_path_js_1 = require("../protected-path.js");
+const index_js_1 = require("../decode/index.js");
+const index_js_2 = require("../input/index.js");
+const index_js_3 = require("../lnd/index.js");
+const index_js_4 = require("../registry/index.js");
+const inspect_js_1 = require("./inspect.js");
+const valueFlags = ['--registry', '--lnd-rest', '--tls-cert', '--macaroon'];
+// GetInfo (node identity for the registry match), ListPermissions (snapshot drift, as on every
+// online command) and CheckMacaroonPermissions are required; ListMacaroonIDs is optional.
+const required = [
+    ['/lnrpc.Lightning/GetInfo', 'info:read'],
+    ['/lnrpc.Lightning/ListPermissions', 'info:read'],
+    ['/lnrpc.Lightning/CheckMacaroonPermissions', 'macaroon:read'],
+];
+const listIdsMethod = ['/lnrpc.Lightning/ListMacaroonIDs', 'macaroon:read'];
+// Static operator guidance. macwarden never calls changepassword or touches macaroons.db (SAFE-02).
+exports.ROOT_KEY_0_ACCEPTED = [
+    'This credential is on root key ID 0, shared by admin.macaroon, readonly.macaroon, invoice.macaroon and every macaroon baked without --root_key_id. LND refuses to delete root key ID 0, so it cannot be revoked on its own.',
+    'Only regenerating every root key invalidates it: lncli changepassword --new_mac_root_key on the node (it needs the wallet password). macwarden never runs it (SAFE-02).',
+    "That also invalidates every other macaroon on the node at once: every app's credential, macwarden's own and any replacement staged with macwarden respond. So regenerate first, in a maintenance window, then bake a fresh per-app macaroon for each app (macwarden bake) and re-pair it. Run macwarden inventory beforehand to list the apps that will need one; staging replacements before the regeneration would only see them invalidated too.",
+    'Procedure: docs/incident-playbook.md and docs/replacing-default-macaroons.md.',
+];
+exports.CAN_BAKE_ACCEPTED = 'This credential can bake macaroons (macaroon:generate). If it leaked, its holder may have created credentials on other root key IDs, and revoking this one does not remove them. Replace and revoke every registered credential with macwarden respond, list unknown root key IDs with macwarden inventory, and if this credential may have been used, regenerate all root keys (see docs/incident-playbook.md).';
+exports.CAN_BAKE_ROOT_KEY_0 = 'It can also bake macaroons (macaroon:generate): its holder may have created credentials on other root key IDs. The regeneration invalidates those too; afterwards, revoke any root key ID macwarden inventory still shows as unknown that no app of yours uses.';
+exports.OWN_ROOT_KEY_ACCEPTED = "This credential shares the root key ID of the credential macwarden is running with, and macwarden revoke refuses its own root key ID. Revoke it with another own credential, or delete that root key ID with lncli deletemacaroonid after switching macwarden to a new session macaroon.";
+exports.REJECTED_INCONCLUSIVE = 'LND rejected this check, but not because the root key ID is gone, the root key was regenerated or the credential expired. A caveat that depends on the caller (an IP lock, or a custom caveat such as a canary\'s) can make LND accept it from another address or while a middleware runs. Treat it as live until its root key ID is revoked.';
+exports.CUSTOM_CAVEAT_REJECTED = 'It carries a custom caveat (a canary, or another lnd-custom caveat): LND accepts it only while a middleware for that caveat, such as macwarden watch, is registered.';
+function fail(code, step, message, warnings = []) {
+    return { schema: 1, command: 'verify', ok: false, warnings, result: null, error: { code, step, message } };
+}
+function lndFailure(error, step, warnings) {
+    const failure = (0, online_js_1.failureDetails)(error);
+    return fail(failure.code, step, failure.message, warnings);
+}
+// Returns the request, or a message naming the flag and the rule (never the value).
+function parse(args, env) {
+    const supplied = new Map();
+    const inputs = [];
+    let unsafeArg = false;
+    let endOfFlags = false;
+    for (let index = 0; index < args.length; index++) {
+        const arg = args[index];
+        if (endOfFlags) {
+            inputs.push(arg);
+            continue;
+        }
+        if (arg === '--') {
+            endOfFlags = true;
+            continue;
+        }
+        if (arg === '--json')
+            continue;
+        if (arg === '--unsafe-arg') {
+            if (unsafeArg)
+                return (0, online_js_1.flagProblem)(arg, 'repeated');
+            unsafeArg = true;
+            continue;
+        }
+        if (valueFlags.includes(arg)) {
+            const value = args[++index];
+            if (supplied.has(arg))
+                return (0, online_js_1.flagProblem)(arg, 'repeated');
+            if (value === undefined || value.startsWith('--'))
+                return (0, online_js_1.flagProblem)(arg, 'missing');
+            supplied.set(arg, value);
+            continue;
+        }
+        if (arg.startsWith('-') && arg !== '-')
+            return `unknown flag; verify takes: <file | -> --unsafe-arg ${valueFlags.join(' ')} --json`;
+        inputs.push(arg);
+    }
+    if (inputs.length !== 1)
+        return 'expected one input: a credential file, or - for stdin';
+    const host = supplied.get('--lnd-rest') ?? env.MACWARDEN_LND_REST;
+    const cert = supplied.get('--tls-cert') ?? env.MACWARDEN_TLS_CERT;
+    const own = supplied.get('--macaroon') ?? env.MACWARDEN_MACAROON;
+    const connection = (0, online_js_1.connectionProblem)(host, cert, own);
+    if (connection)
+        return connection;
+    return { input: inputs[0], unsafeArg, registry: supplied.get('--registry'),
+        host: (0, online_js_1.endpoint)(host), cert: cert, own: own };
+}
+function holds(held, [method, permission]) {
+    return held.has(permission) || held.has(`uri:${method}`);
+}
+/** The registry entry for this credential on this node: the same bytes first, else the same root key ID. */
+function registryMatch(entries, pubkey, facts) {
+    const local = entries.filter(entry => entry.nodePubkey.toLowerCase() === pubkey);
+    const rootKeyId = facts.rootKeyId.toString();
+    const byFingerprint = local.filter(entry => entry.fingerprint === facts.fingerprint);
+    const sameId = (entry) => entry.rootKeyId === rootKeyId;
+    // An active entry outranks a revoked record of the same root key ID.
+    const pick = (rows) => rows.find(entry => entry.status === 'active') ?? rows[0];
+    const exact = pick(byFingerprint.filter(sameId));
+    if (exact)
+        return { label: exact.label, status: exact.status, match: 'fingerprint' };
+    const related = pick(local.filter(sameId));
+    return related ? { label: related.label, status: related.status, match: 'root-key-id' } : null;
+}
+function guidance(result) {
+    const id = result.rootKeyId;
+    if (result.status === 'accepted') {
+        const lines = ['LND accepts this credential now: whoever holds a copy can use it against this node.'];
+        if (id === '0')
+            return [...lines, ...exports.ROOT_KEY_0_ACCEPTED, ...(result.canBake ? [exports.CAN_BAKE_ROOT_KEY_0] : [])];
+        if (result.ownCredential)
+            lines.push(exports.OWN_ROOT_KEY_ACCEPTED);
+        else {
+            const label = result.registry?.status === 'active' ? result.registry.label : null;
+            // By root key ID: a label is ambiguous while a rotation is staged (two active entries).
+            lines.push(result.registry === null
+                ? `Revoke it: macwarden revoke ${id} --unregistered. It is not in this registry, so first make sure no app you rely on uses root key ID ${id}.`
+                : `Revoke it: macwarden revoke ${id}${label ? ` (registered as ${label}; if an app still needs access, rotate it instead: macwarden rotate ${label} --out <file>, switch the app, then macwarden rotate ${label} --finish)` : ''}.`);
+            lines.push(`Revoking root key ID ${id} also invalidates every other macaroon baked on it.`);
+        }
+        if (result.canBake)
+            lines.push(exports.CAN_BAKE_ACCEPTED);
+        return lines;
+    }
+    if (!result.conclusive) {
+        const lines = [exports.REJECTED_INCONCLUSIVE];
+        if (result.caveats.some(caveat => caveat.type === 'lnd-custom'))
+            lines.push(exports.CUSTOM_CAVEAT_REJECTED);
+        if (id !== '0')
+            lines.push(`To make sure: macwarden revoke ${id}${result.registry === null ? ' --unregistered' : ''}.`);
+        return lines;
+    }
+    const why = result.rejection === 'root-key-missing' ? 'its root key ID no longer exists'
+        : result.rejection === 'signature-mismatch' ? 'its root key was regenerated'
+            : result.rejection === 'expired' ? 'a time-before caveat has passed' : 'its root key ID is no longer listed';
+    const lines = [`LND rejects this credential now: ${why}. It can no longer be used against this node.`];
+    if (result.rejection === 'expired' && result.rootKeyListed !== false && id !== '0')
+        lines.push(`Its root key ID ${id} still exists: other macaroons baked on it, including copies without this expiry, keep working until it is revoked.`);
+    return lines;
+}
+async function runSteps(args, deps, warnings) {
+    // C1 Parse.
+    const request = parse(args, deps.env);
+    if (typeof request === 'string')
+        return fail(2, null, request);
+    // C2 ENV.
+    if ((0, environment_js_1.unsafeNodeDiagnostics)(deps.env))
+        return fail(2, 'C2', 'unsafe Node diagnostic settings');
+    // C3 Read and decode the credential under test, offline, as inspect does.
+    let target;
+    let facts;
+    try {
+        const read = await (0, index_js_2.readCredential)(request.input, { stdin: deps.stdin ?? process.stdin, fs: deps.fs }, { unsafeArg: request.unsafeArg, nwc: true });
+        if (read.literal)
+            warnings.push('unsafe-arg');
+        if ((0, index_js_1.isNwcContainer)(read.secret))
+            return fail(3, 'input-form', 'a Nostr Wallet Connect URI is not an LND credential; revoke NWC connections in the wallet service', warnings);
+        target = read.secret;
+        facts = (0, index_js_1.decodeMacaroon)(target);
+    }
+    catch (error) {
+        if (error instanceof index_js_2.UsageError)
+            return fail(2, null, error.message, warnings);
+        if (error instanceof index_js_2.InputError || error instanceof index_js_1.DecodeError)
+            return fail(3, error.stage, error.message, warnings);
+        throw error;
+    }
+    // An empty permission list is never sent: LND would report any macaroon valid for it.
+    if (facts.permissions.length === 0)
+        return fail(3, 'C3', 'the credential holds no permissions, so LND cannot be asked about it (an empty permission list is never sent)', warnings);
+    const offline = (0, inspect_js_1.inspectResult)(facts, deps.clock());
+    // C4 OWN.
+    let cert;
+    try {
+        if ((0, protected_path_js_1.isProtectedPath)(request.cert) || (0, protected_path_js_1.isProtectedPath)(await deps.fs.realpath(request.cert)))
+            return fail(4, 'C4', 'unreadable TLS certificate', warnings);
+        cert = await (0, online_js_1.readBoundedFile)(request.cert, deps.fs);
+    }
+    catch {
+        return fail(4, 'C4', 'unreadable TLS certificate', warnings);
+    }
+    let own;
+    try {
+        own = (await (0, online_js_1.readOnlineCredential)(request.own, { stdin: deps.stdin ?? process.stdin, fs: deps.fs })).secret;
+    }
+    catch {
+        return fail(4, 'C4', 'unreadable own macaroon', warnings);
+    }
+    let ownFacts;
+    try {
+        ownFacts = (0, index_js_1.decodeMacaroon)(own);
+    }
+    catch {
+        return fail(4, 'C4', 'undecodable own macaroon', warnings);
+    }
+    const held = new Set(ownFacts.permissions);
+    for (const method of required)
+        if (!holds(held, method))
+            return fail(4, 'C4', `own macaroon missing permission: ${method[0]} requires ${method[1]}`, warnings);
+    const canList = holds(held, listIdsMethod);
+    if (ownFacts.rootKeyId === 0n)
+        warnings.push('own-root-key-0');
+    // C5 Registry, read-only (no lock).
+    let entries;
+    try {
+        if (request.registry && (0, protected_path_js_1.isProtectedPath)(request.registry))
+            return fail(3, 'C5', 'protected registry path', warnings);
+        entries = (await (0, index_js_4.openRegistry)(request.registry, { fs: deps.fs, env: deps.env })).entries;
+    }
+    catch {
+        return fail(3, 'C5', 'unreadable or invalid registry', warnings);
+    }
+    // C6 Node identity, snapshot drift, root key IDs.
+    const adapter = deps.lnd ?? deps.createAdapter?.({ restUrl: request.host, tlsCert: cert, macaroon: own });
+    if (!adapter)
+        return fail(8, 'internal', 'unexpected failure', warnings);
+    const lnd = (0, online_js_1.onlineAdapter)(adapter);
+    let info;
+    try {
+        info = (0, online_js_1.nodeInfo)(await lnd.getInfo());
+    }
+    catch (error) {
+        return lndFailure(error, 'C6', warnings);
+    }
+    try {
+        if ((0, online_js_1.drift)(await lnd.listPermissions()))
+            warnings.push('snapshot-drift');
+    }
+    catch (error) {
+        return lndFailure(error, 'C6', warnings);
+    }
+    let rootKeyListed = null;
+    if (canList) {
+        try {
+            rootKeyListed = (await lnd.listMacaroonIds()).includes(facts.rootKeyId);
+        }
+        catch (error) {
+            return lndFailure(error, 'C6', warnings);
+        }
+    }
+    // C7 Ask LND: CheckMacaroonPermissions with the credential's own decoded permissions.
+    let checked;
+    try {
+        checked = await lnd.checkMacaroon(target, facts.permissions);
+    }
+    catch (error) {
+        return lndFailure(error, 'C7', warnings);
+    }
+    const expired = offline.caveats.some(caveat => caveat.type === 'time-before' && caveat.expired === true);
+    const rejection = checked.valid ? null
+        : checked.reason === 'other' && expired ? 'expired' : checked.reason;
+    // A rejection holds everywhere when the root key is gone or regenerated, or the credential
+    // expired; any other rejection may depend on the caller (IP lock, custom caveat).
+    const conclusive = checked.valid || rejection !== 'other' || rootKeyListed === false;
+    const partial = {
+        ...offline,
+        node: { pubkey: info.pubkey, alias: info.alias, network: info.network },
+        status: checked.valid ? 'accepted' : 'rejected',
+        rejection, conclusive, rootKeyListed,
+        ownCredential: facts.rootKeyId === ownFacts.rootKeyId,
+        canBake: offline.grade === 'ADMIN' || facts.permissions.includes('macaroon:generate'),
+        registry: registryMatch(entries, info.pubkey, facts),
+    };
+    const result = { ...partial, guidance: guidance(partial) };
+    // Exit 1 is a finding, as with scan --fail-on: the credential is live, or may be.
+    return { schema: 1, command: 'verify', ok: true, warnings, result, error: null,
+        ...(result.status === 'accepted' || !result.conclusive ? { exitCode: 1 } : {}) };
+}
+async function run(args, deps) {
+    const warnings = [];
+    try {
+        return (0, online_js_1.onlineWarnings)(await runSteps(args, deps, warnings));
+    }
+    catch (error) {
+        // verify changes nothing, so an interrupt is always before any mutation (exit 6).
+        return (0, online_js_1.onlineWarnings)(error instanceof cancellation_js_1.Cancelled ? fail(6, 'cancelled', 'interrupted', warnings)
+            : fail(8, 'internal', 'unexpected failure', warnings));
+    }
+}
+async function verify(args) {
+    return run(args, { createAdapter: index_js_3.createLndAdapter, fs: nodeFs, env: { ...process.env },
+        clock: () => new Date(), stdin: process.stdin });
+}
+
 },
 "commands/watch.js": (module, exports, require) => {
 "use strict";
@@ -4017,7 +4534,8 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 exports.__esModule = true;
-exports.CANARY_RELOAD_MS = void 0;
+exports.MAX_TIMER_MS = exports.CANARY_RELOAD_MS = void 0;
+exports.scheduleDeadline = scheduleDeadline;
 exports.lockOwnerGone = lockOwnerGone;
 exports.acquireLock = acquireLock;
 exports.run = run;
@@ -4036,6 +4554,7 @@ const environment_js_1 = require("../environment.js");
 const index_js_2 = require("../lnd/index.js");
 const online_js_1 = require("../online.js");
 const protected_path_js_1 = require("../protected-path.js");
+const bounded_file_js_1 = require("../bounded-file.js");
 const index_js_3 = require("../registry/index.js");
 const process_domain_js_1 = require("../registry/process-domain.js");
 const index_js_4 = require("../output/index.js");
@@ -4146,6 +4665,30 @@ function parse(args, env) {
     return { host: (0, online_js_1.endpoint)(host), grpcHost: grpc.host, grpcPort: grpc.port, grpcSource, cert, own, registry: get('--registry'),
         name, untilMs, alertCommand, alertsOnly: flags.get('--alerts-only') === true, json: flags.get('--json') === true };
 }
+/** The longest delay setTimeout honours (signed 32-bit milliseconds); longer ones fire after 1 ms. */
+exports.MAX_TIMER_MS = 2 ** 31 - 1;
+/**
+ * Calls onExpire once `ms` have passed on a monotonic clock. `--until` accepts up to 999999
+ * days, far beyond one timer (audit MW102-09: `--until 25d` ended at once), so the wait is
+ * split into chunks of at most MAX_TIMER_MS, each re-measured against the one deadline.
+ */
+function scheduleDeadline(ms, onExpire, now = () => performance.now()) {
+    const deadline = now() + ms;
+    let timer;
+    let cleared = false;
+    const arm = () => {
+        if (cleared)
+            return;
+        const left = deadline - now();
+        if (left <= 0) {
+            onExpire();
+            return;
+        }
+        timer = setTimeout(arm, Math.min(Math.ceil(left), exports.MAX_TIMER_MS));
+    };
+    arm();
+    return { clear: () => { cleared = true; clearTimeout(timer); } };
+}
 function defaultSleep(ms, signal) {
     return new Promise(resolve => {
         const timer = setTimeout(done, ms);
@@ -4266,6 +4809,8 @@ async function acquireLock(path, deps) {
             let owner = {};
             let stale;
             try {
+                // The owner record is read only as a plain file: never through a symlink (SAFE-02).
+                await (0, bounded_file_js_1.assertPlainFile)(path, deps.fs, bounded_file_js_1.LOCK_FILE_LIMIT);
                 stale = await deps.fs.readFile(path, 'utf8');
                 owner = JSON.parse(stale);
             }
@@ -4444,7 +4989,7 @@ async function runSteps(args, deps) {
     signal?.addEventListener('abort', onAbort, { once: true });
     if (signal?.aborted)
         stop.abort();
-    const untilTimer = request.untilMs === null ? undefined : setTimeout(() => stop.abort(), request.untilMs);
+    const untilTimer = request.untilMs === null ? undefined : scheduleDeadline(request.untilMs, () => stop.abort());
     const counters = { calls: 0, errors: 0, alerts: 0, canaryUses: 0, alertFailures: 0, reconnects: 0, credentials: new Set(),
         attributionDropped: 0 };
     const work = [];
@@ -4529,7 +5074,8 @@ async function runSteps(args, deps) {
     // Whoever holds a canary controls how often it is used, so alerting is bounded:
     // one alert per canary per window plus a counted summary, and at most one
     // --alert-command process at a time (src/watch/alert-throttle.ts).
-    const runner = (0, alert_throttle_js_1.createAlertRunner)(event => (deps.alert ?? alert_js_1.runAlertCommand)(request.alertCommand, event), event => {
+    const runner = (0, alert_throttle_js_1.createAlertRunner)((event, cancel) => deps.alert ? deps.alert(request.alertCommand, event, cancel)
+        : (0, alert_js_1.runAlertCommand)(request.alertCommand, event, undefined, undefined, cancel), event => {
         // A failed alert must be visible: the operator relies on it for paging.
         counters.alertFailures += 1;
         if (!warnings.some(item => (typeof item === 'string' ? item : item.code) === 'alert-failed'))
@@ -4788,7 +5334,7 @@ async function runSteps(args, deps) {
     finally {
         clearInterval(flusher);
         clearInterval(reloader);
-        clearTimeout(untilTimer);
+        untilTimer?.clear();
         signal?.removeEventListener('abort', onAbort);
         processCanaries();
         runWork(Number.MAX_SAFE_INTEGER);
@@ -4796,10 +5342,15 @@ async function runSteps(args, deps) {
         usage.endCoverage(pubkey, deps.clock());
         await flush();
         await release();
-        // Each alert command is killed by ALERT_KILL_MS, so this wait is bounded too.
-        await Promise.race([runner.idle(), new Promise(resolve => setTimeout(resolve, alert_js_1.ALERT_KILL_MS + 1_000).unref())]);
+        // One alert deadline for the whole shutdown (audit MW102-05): no alert command starts from
+        // here on and an alert still waiting is discarded (reported as alert-failed); the running
+        // one may finish within ALERT_KILL_MS, then it is cancelled (group or tree killed), and
+        // the process-tree kills get what is left of ALERT_CLEANUP_MS.
+        const alertDeadline = Date.now() + alert_js_1.ALERT_KILL_MS + alert_js_1.ALERT_CLEANUP_MS;
+        await runner.stop(alert_js_1.ALERT_KILL_MS, alert_js_1.ALERT_CLEANUP_MS);
         // Anything an alert command left running is killed now, not left behind (POSIX groups).
         (0, alert_js_1.reapAlertGroups)();
+        await (0, alert_js_1.alertCleanupDone)(Math.max(0, alertDeadline - Date.now()));
         reportDrops();
         // Queued events go out before the summary; a reader that never reads cannot hold us forever.
         // A reader that never reads must not keep this process alive: after the bounded
@@ -4847,7 +5398,7 @@ exports.__esModule = true;
 exports.redactEncodedCredentials = redactEncodedCredentials;
 const grouped_runs_js_1 = require("./grouped-runs.js");
 const recognition_js_1 = require("./decode/recognition.js");
-function normalized(text, compact = true, source) {
+function normalized(text, compact = true, source, decode = true, backslashPairs = true) {
     let value = '';
     const starts = [];
     const ends = [];
@@ -4859,9 +5410,10 @@ function normalized(text, compact = true, source) {
             continue;
         }
         const at = i;
-        const percentByte = text[i] === '%' && /^[0-9a-f]{2}$/i.test(text.slice(i + 1, i + 3));
-        const encodedByte = /^(?:%u([0-9a-f]{4})|&#(?:x([0-9a-f]{1,4})|([0-9]{1,5}));)/i.exec(text.slice(i, i + 12));
-        const escape = text[i] === '\\' ? /^(?:u([0-9a-f]{4})|x([0-9a-f]{2})|([0-7]{1,3})|([\\"/bfnrt]))/i.exec(text.slice(i + 1)) : null;
+        const percentByte = decode && text[i] === '%' && /^[0-9a-f]{2}$/i.test(text.slice(i + 1, i + 3));
+        const encodedByte = !decode ? null : /^(?:%u([0-9a-f]{4})|&#(?:x([0-9a-f]{1,4})|([0-9]{1,5}));)/i.exec(text.slice(i, i + 12));
+        const escape = decode && text[i] === '\\' ? (backslashPairs ? /^(?:u([0-9a-f]{4})|x([0-9a-f]{2})|([0-7]{1,3})|([\\"/bfnrt]))/i
+            : /^(?:u([0-9a-f]{4})|x([0-9a-f]{2})|([0-7]{1,3})|(["/bfnrt]))/i).exec(text.slice(i + 1)) : null;
         let character;
         if (encodedByte && parseInt(encodedByte[1] ?? encodedByte[2] ?? encodedByte[3], encodedByte[3] ? 10 : 16) <= 255) {
             character = String.fromCharCode(parseInt(encodedByte[1] ?? encodedByte[2] ?? encodedByte[3], encodedByte[3] ? 10 : 16));
@@ -4889,6 +5441,9 @@ function normalized(text, compact = true, source) {
     }
     return { value, starts, ends, escaped };
 }
+// A macaroon starts with version 2 and a location (1) or identifier (2) packet kind. LND
+// also accepts the kind as a non-minimal varint (0x81 0x00 ...), so a re-framed copy starts 0281/0282.
+const MACAROON_HEX_STARTS = new Set(['0201', '0202', '0281', '0282']);
 function isHexDigit(character) {
     return character !== undefined && /^[0-9a-f]$/i.test(character);
 }
@@ -4900,39 +5455,8 @@ function regularGroups(run) {
 function isByteSeparator(character) {
     return character !== undefined && character !== '\\' && /^[^0-9A-Za-z]$/u.test(character);
 }
-function spans(text, source) {
-    const { value, starts, ends } = normalized(text, true, source);
-    const found = [];
-    const raw = normalized(text, false, source);
-    // Decode each decimal byte array once, then redact only confirmed macaroon
-    // spans. Ordinary arrays and any surrounding values retain their source text.
-    const decimalArrays = /(?:0x[0-9a-f]{2}(?:[^0-9A-Za-z\\]{1,3}0x[0-9a-f]{2})+|\d{1,3}(?:[^0-9A-Za-z\\]{1,3}\d{1,3})+)/gi;
-    for (let run = decimalArrays.exec(raw.value); run; run = decimalArrays.exec(raw.value)) {
-        const tokens = [...run[0].matchAll(/0x[0-9a-f]{2}|\d+/gi)];
-        const values = tokens.map(token => Number(token[0]));
-        for (let segmentStart = 0; segmentStart < values.length;) {
-            let segmentEnd = segmentStart;
-            while (segmentEnd < values.length && values[segmentEnd] <= 255)
-                segmentEnd++;
-            if (segmentEnd > segmentStart) {
-                const bytes = Buffer.from(values.slice(segmentStart, segmentEnd));
-                const lengthAt = (0, recognition_js_1.macaroonEnds)(bytes);
-                for (let pos = 0; pos < bytes.length; pos++) {
-                    if (bytes[pos] !== 2)
-                        continue;
-                    const length = lengthAt(pos);
-                    if (length === null)
-                        continue;
-                    const begin = run.index + tokens[segmentStart + pos].index;
-                    const last = tokens[segmentStart + pos + length - 1];
-                    const end = run.index + last.index + last[0].length;
-                    found.push([raw.starts[begin], raw.ends[end - 1]]);
-                    pos += length - 1;
-                }
-            }
-            segmentStart = segmentEnd + 1;
-        }
-    }
+// Hex encodings, contiguous or with byte separators, in normalized text.
+function hexSpans(value, starts, ends, found) {
     // A maximal run is decoded once. Repeated 02 prefixes in an ordinary hex
     // string do not cause a decode of every remaining suffix.
     const hexRuns = /(?:0x)?[0-9a-f]{8,}/gi;
@@ -4945,8 +5469,7 @@ function spans(text, source) {
             return (0, recognition_js_1.macaroonEnds)(bytes);
         });
         for (let offset = 0; offset + 8 <= digits.length; offset++) {
-            if (digits.slice(offset, offset + 4).toLowerCase() !== '0201' &&
-                digits.slice(offset, offset + 4).toLowerCase() !== '0202')
+            if (!MACAROON_HEX_STARTS.has(digits.slice(offset, offset + 4).toLowerCase()))
                 continue;
             const length = phases[offset % 2](Math.floor(offset / 2));
             if (length === null)
@@ -4984,8 +5507,7 @@ function spans(text, source) {
         const digits = digitPositions.map(position => value.charAt(position)).join('');
         const phases = [0, 1].map(phase => (0, recognition_js_1.macaroonEnds)(Buffer.from(digits.slice(phase), 'hex')));
         for (let offset = 0; offset + 8 <= digits.length; offset++) {
-            if (digits.slice(offset, offset + 4).toLowerCase() !== '0201' &&
-                digits.slice(offset, offset + 4).toLowerCase() !== '0202')
+            if (!MACAROON_HEX_STARTS.has(digits.slice(offset, offset + 4).toLowerCase()))
                 continue;
             const length = phases[offset % 2](Math.floor(offset / 2));
             if (length === null)
@@ -4996,6 +5518,52 @@ function spans(text, source) {
             offset += length * 2 - 1;
         }
     }
+}
+// A backslash, "%" and "&" start the escapes the decoding layers interpret. An escape-like prefix
+// ("\0201...", "%0201...") must not hide a hex credential by being decoded together with its
+// first digits, so hex is also recognised in the literal text (whitespace compacted only).
+function literalHexSpans(text) {
+    if (!/[\\%&]/.test(text))
+        return [];
+    const { value, starts, ends } = normalized(text, true, undefined, false);
+    const found = [];
+    hexSpans(value, starts, ends, found);
+    return found;
+}
+function spans(text, source, backslashPairs = true) {
+    const { value, starts, ends } = normalized(text, true, source, true, backslashPairs);
+    const found = [];
+    const raw = normalized(text, false, source, true, backslashPairs);
+    // Decode each decimal byte array once, then redact only confirmed macaroon
+    // spans. Ordinary arrays and any surrounding values retain their source text.
+    const decimalArrays = /(?:0x[0-9a-f]{2}(?:[^0-9A-Za-z\\]{1,3}0x[0-9a-f]{2})+|\d{1,3}(?:[^0-9A-Za-z\\]{1,3}\d{1,3})+)/gi;
+    for (let run = decimalArrays.exec(raw.value); run; run = decimalArrays.exec(raw.value)) {
+        const tokens = [...run[0].matchAll(/0x[0-9a-f]{2}|\d+/gi)];
+        const values = tokens.map(token => Number(token[0]));
+        for (let segmentStart = 0; segmentStart < values.length;) {
+            let segmentEnd = segmentStart;
+            while (segmentEnd < values.length && values[segmentEnd] <= 255)
+                segmentEnd++;
+            if (segmentEnd > segmentStart) {
+                const bytes = Buffer.from(values.slice(segmentStart, segmentEnd));
+                const lengthAt = (0, recognition_js_1.macaroonEnds)(bytes);
+                for (let pos = 0; pos < bytes.length; pos++) {
+                    if (bytes[pos] !== 2)
+                        continue;
+                    const length = lengthAt(pos);
+                    if (length === null)
+                        continue;
+                    const begin = run.index + tokens[segmentStart + pos].index;
+                    const last = tokens[segmentStart + pos + length - 1];
+                    const end = run.index + last.index + last[0].length;
+                    found.push([raw.starts[begin], raw.ends[end - 1]]);
+                    pos += length - 1;
+                }
+            }
+            segmentStart = segmentEnd + 1;
+        }
+    }
+    hexSpans(value, starts, ends, found);
     if (raw.value.includes(String.fromCharCode(2))) {
         // Raw latin1 and recovered escaped bytes use the same structured decoder.
         // Preserve offsets through JSON escapes and UTF-16 zero-byte padding.
@@ -5122,7 +5690,12 @@ function spans(text, source) {
     return found.sort((a, b) => a[0] - b[0]);
 }
 function redactEncodedCredentials(text) {
-    const matches = [];
+    const matches = literalHexSpans(text);
+    // A stray backslash before an escaped credential (a backslash, then \x02\x01...) pairs with
+    // the first escape's backslash and hides its byte: text holding two adjacent backslashes is
+    // read once more with every backslash starting an escape on its own.
+    if (text.includes('\\\\'))
+        matches.push(...spans(text, undefined, false));
     let source;
     // A fixed number of escape layers keeps work bounded. Compose source offsets
     // on every pass and inspect each representation before further normalization.
@@ -5154,10 +5727,11 @@ function redactEncodedCredentials(text) {
 "use strict";
 exports.__esModule = true;
 exports.DecodeError = void 0;
+exports.macaroonEosEnd = macaroonEosEnd;
 exports.macaroonPacketRange = macaroonPacketRange;
 exports.macaroonSectionRange = macaroonSectionRange;
 exports.parseTimeBefore = parseTimeBefore;
-exports.canonicalMacaroonLength = canonicalMacaroonLength;
+exports.canonicalMacaroonForm = canonicalMacaroonForm;
 exports.decodeMacaroon = decodeMacaroon;
 exports.macaroonId = macaroonId;
 exports.encodeMacaroon = encodeMacaroon;
@@ -5189,29 +5763,57 @@ function varint(data, start, end, stage) {
         if (i === 9 && byte > 1)
             return fail(stage);
         value |= BigInt(byte & 0x7f) << BigInt(i * 7);
-        if ((byte & 0x80) === 0) {
-            if (stage === 'packet' && i > 0 && byte === 0)
-                return fail(stage);
+        if ((byte & 0x80) === 0)
             return [value, offset + 1];
+    }
+    return fail(stage);
+}
+// go-macaroon v2.0.0 (LND v0.21.4) reads packet kinds and lengths with
+// binary.Uvarint: up to 10 bytes, non-minimal encodings accepted, values above
+// 0x7fffffff refused. Anyone holding a macaroon can re-frame it this way without
+// the root key (the signature covers the identifier and caveat bytes, not the
+// framing), so the decoder accepts exactly what LND accepts.
+const MAX_PACKET_VALUE = 0x7fffffff;
+function packetVarint(data, start) {
+    let value = 0;
+    for (let i = 0; i < 10; i++) {
+        const offset = start + i;
+        if (offset >= data.length)
+            return null;
+        const byte = data[offset];
+        if (i === 9 && byte > 1)
+            return null;
+        const bits = byte & 0x7f;
+        if (bits !== 0) {
+            if (i >= 5)
+                return null;
+            value += bits * 2 ** (7 * i);
+            if (value > MAX_PACKET_VALUE)
+                return null;
         }
+        if ((byte & 0x80) === 0)
+            return [value, offset + 1];
     }
-    return fail(stage);
+    return null;
+}
+/** End offset of an end-of-section marker at `start` (any varint encoding of 0), else null. */
+function macaroonEosEnd(data, start) {
+    const item = packetVarint(data, start);
+    return item !== null && item[0] === 0 ? item[1] : null;
 }
 // Shared structural parser: decoder and bounded recognition use identical
-// packet ordering, canonical lengths, and caveat-location rules.
+// packet ordering, varint, end-of-section and caveat-location rules.
 function macaroonPacketRange(data, start) {
-    const kind = data[start];
-    if (![1, 2, 4, 6].includes(kind))
+    const kindItem = packetVarint(data, start);
+    if (kindItem === null || ![1, 2, 4, 6].includes(kindItem[0]))
         return null;
-    try {
-        const [length, afterLength] = varint(data, start + 1, data.length, 'packet');
-        if (length > BigInt(data.length - afterLength))
-            return null;
-        return { kind, start: afterLength, end: afterLength + Number(length) };
-    }
-    catch {
+    const lengthItem = packetVarint(data, kindItem[1]);
+    if (lengthItem === null)
         return null;
-    }
+    const [length, afterLength] = lengthItem;
+    if (length > data.length - afterLength)
+        return null;
+    return { kind: kindItem[0], start: afterLength, end: afterLength + length };
 }
 function macaroonSectionRange(data, start, header) {
     let pos = start;
@@ -5219,7 +5821,8 @@ function macaroonSectionRange(data, start, header) {
     let location = null;
     let identifier = null;
     let vid = null;
-    while (pos < data.length && data[pos] !== 0) {
+    let end = null;
+    while (pos < data.length && (end = macaroonEosEnd(data, pos)) === null) {
         const item = macaroonPacketRange(data, pos);
         if (!item || item.kind <= lastKind || ![1, 2, 4].includes(item.kind) || header && item.kind === 4)
             return null;
@@ -5232,9 +5835,9 @@ function macaroonSectionRange(data, start, header) {
         lastKind = item.kind;
         pos = item.end;
     }
-    if (pos >= data.length || identifier === null || !header && location && location.end > location.start && vid === null)
+    if (end === null || identifier === null || !header && location && location.end > location.start && vid === null)
         return null;
-    return { location, identifier, vid, end: pos + 1 };
+    return { location, identifier, vid, end };
 }
 function packet(data, start) {
     const item = macaroonPacketRange(data, start);
@@ -5250,6 +5853,54 @@ function section(data, start, header) {
             identifier: data.subarray(item.identifier.start, item.identifier.end),
             vid: item.vid ? data.subarray(item.vid.start, item.vid.end) : null }, item.end];
 }
+// Group nesting LND's protobuf decoder accepts (protowire's DefaultRecursionLimit of 10,000
+// lets a group hold 10,000 nested groups). Deeper nesting is refused there and here.
+const MAX_GROUP_DEPTH = 10_001;
+const MAX_GROUP_FIELD = 0x7fffffffn;
+function skipValue(data, pos, wire) {
+    switch (wire) {
+        case 0: return varint(data, pos, data.length, 'identifier-proto')[1];
+        case 1: return data.length - pos < 8 ? fail('identifier-proto') : pos + 8;
+        case 2: {
+            const [length, afterLength] = varint(data, pos, data.length, 'identifier-proto');
+            if (length > BigInt(data.length - afterLength))
+                return fail('identifier-proto');
+            return afterLength + Number(length);
+        }
+        case 5: return data.length - pos < 4 ? fail('identifier-proto') : pos + 4;
+        default: return fail('identifier-proto');
+    }
+}
+// An unknown group (wire type 3) is skipped as protowire.ConsumeFieldValue skips it: every
+// member is consumed, nested groups must close with their own field number, and members may
+// use field numbers up to 2^31-1. Iterative, with only the open field numbers kept.
+function skipGroup(data, pos, field) {
+    const open = [field];
+    while (open.length > 0) {
+        const [tag, afterTag] = varint(data, pos, data.length, 'identifier-proto');
+        const member = tag >> 3n;
+        const wire = Number(tag & 7n);
+        if (member === 0n || member > MAX_GROUP_FIELD)
+            return fail('identifier-proto');
+        pos = afterTag;
+        if (wire === 3) {
+            if (open.length >= MAX_GROUP_DEPTH)
+                return fail('identifier-proto');
+            open.push(member);
+        }
+        else if (wire === 4) {
+            if (open.pop() !== member)
+                return fail('identifier-proto');
+        }
+        else {
+            pos = skipValue(data, pos, wire);
+        }
+    }
+    return pos;
+}
+// The protobuf wire format as LND's decoder (golang/protobuf v1.5.4 over protobuf-go) reads it:
+// varints up to 10 bytes (non-minimal accepted), field numbers 1 to 2^29-1, wire types 0, 1,
+// 2, 5 and groups (3 ... 4); a lone end-group or wire types 6 and 7 are refused.
 function protobuf(data, visit) {
     let pos = 0;
     while (pos < data.length) {
@@ -5258,55 +5909,40 @@ function protobuf(data, visit) {
         const wire = Number(tag & 7n);
         if (field === 0n || field > MAX_PROTO_FIELD)
             return fail('identifier-proto');
-        pos = afterTag;
         let value = null;
-        switch (wire) {
-            case 0:
-                [, pos] = varint(data, pos, data.length, 'identifier-proto');
-                break;
-            case 1:
-                if (data.length - pos < 8)
-                    return fail('identifier-proto');
-                pos += 8;
-                break;
-            case 2: {
-                const [length, afterLength] = varint(data, pos, data.length, 'identifier-proto');
-                if (length > BigInt(data.length - afterLength))
-                    return fail('identifier-proto');
-                pos = afterLength + Number(length);
-                value = data.subarray(afterLength, pos);
-                break;
-            }
-            case 5:
-                if (data.length - pos < 4)
-                    return fail('identifier-proto');
-                pos += 4;
-                break;
-            default:
+        if (wire === 2) {
+            const [length, afterLength] = varint(data, afterTag, data.length, 'identifier-proto');
+            if (length > BigInt(data.length - afterLength))
                 return fail('identifier-proto');
+            pos = afterLength + Number(length);
+            value = data.subarray(afterLength, pos);
+        }
+        else {
+            pos = wire === 3 ? skipGroup(data, afterTag, field) : skipValue(data, afterTag, wire);
         }
         visit(Number(field), wire, value);
     }
 }
-function protobufString(value) {
+/** A proto3 string field: LND refuses the whole identifier when one is not valid UTF-8. */
+function checkedString(value) {
     try {
-        return utf8.decode(value);
+        utf8.decode(value);
     }
     catch {
-        return fail('identifier-proto');
-    }
-}
-// Limits on what one identifier may expand to. Permissions are entity x action
-// products, so a small identifier could otherwise decode to hundreds of megabytes.
-// LND v0.21.4 has 164 RPC methods (longest URI 49 bytes) across 19 entities whose
-// longest name is 8 bytes, so a real macaroon carries at most about 200 permissions.
-// The entity is repeated in every permission it applies to; capping it at 16 bytes
-// bounds the expansion to about 6 bytes of permission text per identifier byte.
-const IDENTIFIER_LIMITS = {
-    operations: 256, actionsPerOperation: 512, permissions: 1024,
-    entityBytes: 16, actionBytes: 256, permissionBytes: 65_536,
-};
-/** At most this many caveats per macaroon; LND adds a handful. */
+        fail('identifier-proto');
+    }
+}
+// Bounds on what one identifier may expand to. Permissions are entity x action products, so a
+// small identifier could otherwise decode to hundreds of megabytes. LND v0.21.4 has 164 RPC
+// methods (longest URI 49 bytes) across 19 entities whose longest name is 8 bytes, so a real
+// macaroon carries at most about 200 permissions. The entity is repeated in every permission it
+// applies to; leaving out entities over 16 bytes (and actions over 256 bytes) bounds the
+// expansion to about 6 bytes of permission text per identifier byte, and the totals bound it
+// absolutely. Exceeding a bound never refuses the macaroon (LND honours it): what fits is
+// decoded, the rest is left out, and the warning identifier-exceeds-bounds makes the grade fail
+// closed.
+const IDENTIFIER_BOUNDS = { permissions: 1024, permissionBytes: 65_536, entityBytes: 16, actionBytes: 256 };
+/** Caveats kept per macaroon; LND adds a handful. Further caveats are parsed and counted, not kept. */
 const MAX_CAVEATS = 4096;
 function identifier(data) {
     if (data[0] !== 3)
@@ -5315,6 +5951,7 @@ function identifier(data) {
     const permissions = [];
     let operations = 0;
     let permissionBytes = 0;
+    let exceedsBounds = false;
     protobuf(data.subarray(1), (field, wire, value) => {
         if (wire !== 2 || value === null)
             return;
@@ -5322,35 +5959,42 @@ function identifier(data) {
             storageId = value;
         if (field !== 3)
             return;
-        if (++operations > IDENTIFIER_LIMITS.operations)
-            return fail('identifier-limits');
-        let entity = '';
-        const actions = [];
+        // Bakery expands every op's actions in order (an empty entity included) and requires only
+        // that the first op has an action. The entity is a proto3 string: the last one wins.
+        const first = operations++ === 0;
+        let entity = Buffer.alloc(0);
+        let actions = 0;
         protobuf(value, (opField, opWire, opValue) => {
-            if (opWire !== 2 || opValue === null)
+            if (opWire !== 2 || opValue === null || (opField !== 1 && opField !== 2))
                 return;
-            if (opField === 1) {
-                if (opValue.length > IDENTIFIER_LIMITS.entityBytes)
-                    return fail('identifier-limits');
-                entity = protobufString(opValue);
-            }
-            if (opField === 2) {
-                if (opValue.length > IDENTIFIER_LIMITS.actionBytes || actions.length >= IDENTIFIER_LIMITS.actionsPerOperation)
-                    return fail('identifier-limits');
-                actions.push(protobufString(opValue));
-            }
+            checkedString(opValue);
+            if (opField === 1)
+                entity = opValue;
+            else
+                actions++;
         });
-        if (!entity || actions.length === 0)
+        if (first && actions === 0)
             return fail('identifier-proto');
-        // Checked before building any string, so the expansion itself is bounded.
-        if (permissions.length + actions.length > IDENTIFIER_LIMITS.permissions)
-            return fail('identifier-limits');
-        for (const action of actions) {
-            permissionBytes += entity.length + 1 + action.length;
-            if (permissionBytes > IDENTIFIER_LIMITS.permissionBytes)
-                return fail('identifier-limits');
-            permissions.push(`${entity}:${action}`);
+        if (actions === 0 || exceedsBounds)
+            return;
+        if (entity.length > IDENTIFIER_BOUNDS.entityBytes) {
+            exceedsBounds = true;
+            return;
         }
+        const entityText = entity.toString('utf8');
+        protobuf(value, (opField, opWire, action) => {
+            if (opField !== 2 || opWire !== 2 || action === null || exceedsBounds)
+                return;
+            const size = entity.length + 1 + action.length;
+            // Checked before building any string, so the expansion itself is bounded.
+            if (action.length > IDENTIFIER_BOUNDS.actionBytes || permissions.length >= IDENTIFIER_BOUNDS.permissions
+                || permissionBytes + size > IDENTIFIER_BOUNDS.permissionBytes) {
+                exceedsBounds = true;
+                return;
+            }
+            permissionBytes += size;
+            permissions.push(`${entityText}:${action.toString('utf8')}`);
+        });
     });
     if (storageId === null)
         return fail('identifier-root-key-id');
@@ -5364,7 +6008,7 @@ function identifier(data) {
     const rootKeyId = BigInt(decimal);
     if (rootKeyId > MAX_UINT64)
         return fail('identifier-root-key-id');
-    return { rootKeyId, permissions };
+    return { rootKeyId, permissions, exceedsBounds };
 }
 function caveat(sectionValue, warnings) {
     if (sectionValue.vid !== null && sectionValue.vid.length > 0) {
@@ -5381,26 +6025,52 @@ function caveat(sectionValue, warnings) {
     }
     return { type: 'unknown', value: condition };
 }
+/** Days from 1970-01-01 to a proleptic Gregorian date (Howard Hinnant's days_from_civil). */
+function daysFromCivil(year, month, day) {
+    const y = month <= 2 ? year - 1 : year;
+    const era = Math.floor(y / 400);
+    const yearOfEra = y - era * 400;
+    const dayOfYear = Math.floor((153 * (month + (month > 2 ? -3 : 9)) + 2) / 5) + day - 1;
+    return era * 146_097 + yearOfEra * 365 + Math.floor(yearOfEra / 4) - Math.floor(yearOfEra / 100) + dayOfYear - 719_468;
+}
+/**
+ * The instant (Unix nanoseconds) LND enforces for a time-before value. Bakery checks it with Go's
+ * time.Parse(time.RFC3339Nano), whose general parser (the fallback after the strict RFC 3339
+ * path) accepts a one- or two-digit hour, a comma or a period before any number of fraction
+ * digits (nanoseconds kept), and a zone offset of up to 24 hours and 60 minutes.
+ */
 function parseTimeBefore(value) {
-    const match = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:[.,](\d+))?(Z|([+-])(\d{2}):(\d{2}))$/.exec(value);
+    const match = /^(\d{4})-(\d{2})-(\d{2})T(\d{1,2}):(\d{2}):(\d{2})(?:[.,](\d+))?(Z|([+-])(\d{2}):(\d{2}))$/.exec(value);
     if (!match)
         return undefined;
-    const [, yearText, monthText, dayText, hourText, minuteText, secondText, fraction, zone, , offsetHour, offsetMinute] = match;
+    const [, yearText, monthText, dayText, hourText, minuteText, secondText, fraction, zone, sign, offsetHourText, offsetMinuteText] = match;
     const year = Number(yearText), month = Number(monthText), day = Number(dayText);
     const hour = Number(hourText), minute = Number(minuteText), second = Number(secondText);
+    const offsetHour = zone === 'Z' ? 0 : Number(offsetHourText), offsetMinute = zone === 'Z' ? 0 : Number(offsetMinuteText);
     const leapYear = year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0);
     const daysInMonth = [31, leapYear ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
     if (month < 1 || month > 12 || day < 1 || day > daysInMonth[month - 1]
-        || hour > 23 || minute > 59 || second > 59
-        || (zone !== 'Z' && (Number(offsetHour) > 23 || Number(offsetMinute) > 59)))
-        return undefined;
-    // Go's time.Parse(RFC3339Nano) accepts a comma or a period before the fraction.
-    const seconds = Date.parse(value.replace(/[.,]\d+(?=Z|[+-]\d{2}:\d{2}$)/, ''));
-    if (!Number.isFinite(seconds))
+        || hour > 23 || minute > 59 || second > 59 || offsetHour > 24 || offsetMinute > 60)
         return undefined;
-    return BigInt(seconds) * 1000000n + BigInt((fraction ?? '').slice(0, 9).padEnd(9, '0'));
+    const offset = (sign === '-' ? -1 : 1) * (offsetHour * 3600 + offsetMinute * 60);
+    const seconds = daysFromCivil(year, month, day) * 86_400 + hour * 3600 + minute * 60 + second - offset;
+    return BigInt(seconds) * 1000000000n + BigInt((fraction ?? '').slice(0, 9).padEnd(9, '0'));
+}
+function varintSize(value) {
+    let size = 1;
+    while (value >= 128) {
+        value = Math.floor(value / 128);
+        size++;
+    }
+    return size;
+}
+const packetSize = (kind, value) => varintSize(kind) + varintSize(value.length) + value.length;
+/** Size of a section as go-macaroon's MarshalBinary writes it: empty location and verification ID packets are omitted. */
+function canonicalSectionSize(value) {
+    return (value.location?.length ? packetSize(1, value.location) : 0) + packetSize(2, value.identifier)
+        + (value.vid?.length ? packetSize(4, value.vid) : 0) + 1;
 }
-function parsedMacaroon(data) {
+function parsedMacaroon(data, onCaveat) {
     if (data[0] !== 2) {
         if (data.subarray(0, 3).toString('ascii') === '001') {
             throw new errors_js_1.DecodeError('v2-header', 'macaroon v1 format is not supported');
@@ -5408,19 +6078,25 @@ function parsedMacaroon(data) {
         return fail('v2-header');
     }
     const [header, afterHeader] = section(data, 1, true);
+    let canonicalLength = 1 + canonicalSectionSize(header);
     const caveats = [];
+    let omittedCaveats = 0;
     let pos = afterHeader;
     for (;;) {
         if (pos >= data.length)
             return fail('packet');
-        if (data[pos] === 0) {
-            pos++;
+        const eos = macaroonEosEnd(data, pos);
+        if (eos !== null) {
+            pos = eos;
             break;
         }
-        if (caveats.length >= MAX_CAVEATS)
-            return fail('packet');
         const [next, after] = section(data, pos, false);
-        caveats.push(next);
+        if (caveats.length < MAX_CAVEATS)
+            caveats.push(next);
+        else
+            omittedCaveats++;
+        onCaveat?.(next);
+        canonicalLength += canonicalSectionSize(next);
         pos = after;
     }
     if (pos >= data.length)
@@ -5428,15 +6104,32 @@ function parsedMacaroon(data) {
     const [kind, signature, end] = packet(data, pos);
     if (kind !== 6 || signature.length !== 32)
         return fail('packet');
-    return { parsed: { header, caveats, signature }, end };
+    canonicalLength += 1 + packetSize(6, signature);
+    return { parsed: { header, caveats, signature }, end, canonicalLength, omittedCaveats };
 }
-// Generic Secret containers retain malformed data. Only a fully valid offline
-// macaroon receives the canonical public identity ending at its signature.
-function canonicalMacaroonLength(data) {
+/**
+ * The canonical public identity of a fully valid offline macaroon: the bytes go-macaroon's
+ * MarshalBinary writes for it (minimal varints, one-byte end-of-section markers, no empty
+ * location or verification ID packets). Every macaroon LND or macwarden writes is already in
+ * this form: `length` is then the length of that prefix and `reencoded` is null. A re-framed
+ * copy of the same credential (which LND accepts) is re-encoded, so both share one fingerprint.
+ * Trailing bytes are never part of it. Generic Secret containers holding anything else get null
+ * and keep hashing their own bytes.
+ */
+function canonicalMacaroonForm(data) {
     try {
-        const { parsed, end } = parsedMacaroon(data);
+        const { parsed, end, canonicalLength } = parsedMacaroon(data);
         identifier(parsed.header.identifier);
-        return end;
+        if (canonicalLength === end)
+            return { length: end, reencoded: null };
+        // Any non-canonical framing only adds bytes, so equal lengths mean equal bytes.
+        const marshalled = (value) => encodeSection({ identifier: value.identifier,
+            location: value.location?.length ? value.location : null, vid: value.vid?.length ? value.vid : null });
+        const pieces = [Buffer.from([2]), ...marshalled(parsed.header)];
+        parsedMacaroon(data, value => pieces.push(...marshalled(value)));
+        pieces.push(Buffer.from([0]), encodePacket(6, parsed.signature));
+        const reencoded = Buffer.concat(pieces);
+        return { length: reencoded.length, reencoded };
     }
     catch {
         return null;
@@ -5444,14 +6137,21 @@ function canonicalMacaroonLength(data) {
 }
 function decodeMacaroon(mac) {
     const data = (0, secret_capability_js_1.revealSecret)(mac);
-    const { parsed: { header, caveats }, end } = parsedMacaroon(data);
-    const { rootKeyId, permissions } = identifier(header.identifier);
+    const { parsed: { header, caveats }, end, omittedCaveats } = parsedMacaroon(data);
+    const { rootKeyId, permissions, exceedsBounds } = identifier(header.identifier);
     const warnings = [];
+    // Fail closed: what could not be kept is named, and the grade treats it as unassessed.
+    if (exceedsBounds)
+        warnings.push('identifier-exceeds-bounds');
+    if (omittedCaveats > 0)
+        warnings.push('caveats-exceed-bounds');
     const decodedCaveats = caveats.map(value => caveat(value, warnings));
     if (end < data.length)
         warnings.push('trailing-bytes');
-    // One fingerprint definition: the canonical container hashes its own bytes.
-    const canonical = new secret_js_1.Secret(data.subarray(0, end));
+    // One fingerprint definition: the canonical container (go-macaroon's MarshalBinary form,
+    // which is the input up to its signature for every macaroon LND writes) hashes its own bytes.
+    const form = canonicalMacaroonForm(data);
+    const canonical = new secret_js_1.Secret(form?.reencoded ?? data.subarray(0, end));
     const fingerprint = canonical.fingerprint;
     const facts = {
         location: header.location?.toString('utf8') ?? null,
@@ -5715,8 +6415,10 @@ function macaroonEnds(bytes) {
         return valid;
     }
     for (let pos = bytes.length - 1; pos >= 0; pos--) {
-        if (bytes[pos] === 0) {
-            const signature = packet(pos + 1);
+        // Any varint encoding of 0 ends a section, as in go-macaroon.
+        const eos = (0, index_js_1.macaroonEosEnd)(bytes, pos);
+        if (eos !== null) {
+            const signature = packet(eos);
             if (signature?.[0] === 6n && signature[1] === 32n)
                 tails[pos] = signature[3];
             continue;
@@ -5821,6 +6523,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 exports.__esModule = true;
 exports.grade = grade;
+exports.gradeFacts = gradeFacts;
 exports.describe = describe;
 const lnd_permissions_json_1 = __importDefault(require("./lnd-permissions.json"));
 const classes = ['READ', 'RECEIVE', 'OPERATE', 'SPEND', 'ADMIN'];
@@ -5867,12 +6570,19 @@ function classOfUri(permission) {
     }
     return highest;
 }
-function grade(permissions) {
+/**
+ * `incomplete` is true when the decoder could not keep every permission of the identifier
+ * (warning identifier-exceeds-bounds): the permissions left out count as unassessed, so the
+ * grade fails closed to UNASSESSED unless the kept ones already give ADMIN.
+ */
+function grade(permissions, incomplete = false) {
     const assessed = new Map();
     const unassessed = new Set();
     const warnings = new Set();
     const unique = new Set(permissions);
-    if (unique.size === 0)
+    if (incomplete)
+        warnings.add('identifier-exceeds-bounds');
+    else if (unique.size === 0)
         warnings.add('no-permissions');
     for (const permission of unique) {
         const isUri = uriShape.test(permission);
@@ -5890,12 +6600,16 @@ function grade(permissions) {
         if (!highest || classes.indexOf(permissionClass) > classes.indexOf(highest))
             highest = permissionClass;
     }
-    const resultGrade = unassessed.size > 0 && highest !== 'ADMIN'
+    const resultGrade = (unassessed.size > 0 || incomplete) && highest !== 'ADMIN'
         ? 'UNASSESSED' : highest ?? 'UNASSESSED';
     const reasons = resultGrade === 'UNASSESSED' ? [] : byteSort([...assessed].filter(([, permissionClass]) => permissionClass === resultGrade)
         .map(([permission]) => permission));
     return { grade: resultGrade, reasons, warnings: byteSort(warnings), unassessed: byteSort(unassessed) };
 }
+/** The grade of decoded facts, failing closed when the identifier exceeded the decoder's bounds. */
+function gradeFacts(facts) {
+    return grade(facts.permissions, facts.warnings.includes('identifier-exceeds-bounds'));
+}
 function describe(facts) {
     const warnings = new Set(facts.warnings);
     if (facts.rootKeyId === 0n)
@@ -6222,6 +6936,7 @@ exports.openGrpcStream = openGrpcStream;
 // applies here. Framing: 1-byte compression flag (must be 0), 4-byte length, payload.
 const node_http2_1 = require("node:http2");
 const errors_js_1 = require("../errors.js");
+const tls_identity_js_1 = require("./tls-identity.js");
 exports.MAX_GRPC_MESSAGE = 200 * 1024 * 1024;
 /** A message that stops arriving midway (a stuck or hostile peer) ends the call after this. */
 exports.STALL_TIMEOUT_MS = 60_000;
@@ -6312,7 +7027,7 @@ function openGrpcStream(target, onMessage) {
     const servername = /^[0-9.]+$|:/.test(target.host) ? undefined : target.host;
     try {
         session = (0, node_http2_1.connect)(`https://${target.host.includes(':') ? `[${target.host}]` : target.host}:${target.port}`, {
-            ca: target.ca, rejectUnauthorized: true, servername,
+            ca: target.ca, rejectUnauthorized: true, servername, ...(0, tls_identity_js_1.identityCheck)(target.host),
         });
     }
     catch {
@@ -6529,6 +7244,7 @@ const node_https_1 = require("node:https");
 const errors_js_1 = require("../errors.js");
 const secret_js_1 = require("../secret.js");
 const grpc_js_1 = require("./grpc.js");
+const tls_identity_js_1 = require("./tls-identity.js");
 const middleware_proto_js_1 = require("./middleware-proto.js");
 const MAX_RESPONSE = 1_048_576;
 const TIMEOUT_MS = 10_000;
@@ -6616,6 +7332,10 @@ function ids(body) {
 }
 function createLndAdapter(config) {
     const peer = endpoint(config);
+    // WHATWG URL keeps an IPv6 literal in brackets ("[::1]"); the transport and its TLS
+    // identity check need the bare address, or Node treats it as a DNS name and the
+    // certificate's IP SAN never matches. Printed URLs and commands keep the brackets.
+    const transportHost = peer.hostname.replace(/^\[(.*)\]$/, '$1');
     const ca = Buffer.from(config.tlsCert);
     const own = config.macaroon;
     function call(stage, method, path, payload) {
@@ -6646,8 +7366,8 @@ function createLndAdapter(config) {
                 return;
             }
             try {
-                req = (0, node_https_1.request)({ protocol: 'https:', hostname: peer.hostname, port: peer.port || 443,
-                    method, path, ca, rejectUnauthorized: true, agent: false,
+                req = (0, node_https_1.request)({ protocol: 'https:', hostname: transportHost, port: peer.port || 443,
+                    method, path, ca, rejectUnauthorized: true, ...(0, tls_identity_js_1.identityCheck)(transportHost), agent: false,
                     headers: { 'Grpc-Metadata-macaroon': (0, secret_capability_js_1.revealSecret)(own).toString('hex'),
                         ...(body === undefined ? {} : { 'Content-Type': 'application/json' }) } }, response => {
                     const chunks = [];
@@ -7137,6 +7857,47 @@ function encodeFeedback(refMsgId, error = '') {
     return out.subarray(0, position);
 }
 
+},
+"lnd/tls-identity.js": (module, exports, require) => {
+"use strict";
+// Server identity check for an LND endpoint given as an IPv6 literal. Host names and IPv4
+// addresses keep Node's default check (no option is passed). Some supported Node releases
+// (22.x) pass the host through domainToASCII before matching, which turns "::1" into "" and
+// refuses every IPv6 certificate, even one whose IP address SAN matches. This replacement
+// is as strict as Node's own IP rule: only IP address SANs count (never the common name),
+// compared in canonical form, and quoted SAN lists (which need an escaping-aware parser)
+// are refused rather than parsed.
+exports.__esModule = true;
+exports.identityCheck = identityCheck;
+/** Canonical (WHATWG: compressed, lower case) form of an IPv6 address, or null. */
+function canonicalIPv6(address) {
+    const bare = address.replace(/^\[(.*)\]$/, '$1');
+    if (!bare.includes(':') || /[[\]/?#@]/.test(bare))
+        return null;
+    try {
+        return new URL(`https://[${bare}]/`).hostname;
+    }
+    catch {
+        return null;
+    }
+}
+/** TLS options for `host`: a strict IP SAN check for an IPv6 literal, nothing otherwise. */
+function identityCheck(host) {
+    const wanted = canonicalIPv6(host);
+    if (wanted === null)
+        return {};
+    return {
+        checkServerIdentity(_name, cert) {
+            const altnames = cert.subjectaltname ?? '';
+            const names = altnames.includes('"') ? [] : altnames.split(', ');
+            if (names.some(name => name.startsWith('IP Address:') && canonicalIPv6(name.slice(11)) === wanted))
+                return undefined;
+            const reason = `IP: ${host} is not in the cert's list`;
+            return Object.assign(new Error(`Hostname/IP does not match certificate's altnames: ${reason}`), { code: 'ERR_TLS_CERT_ALTNAME_INVALID', reason, host });
+        },
+    };
+}
+
 },
 "online.js": (module, exports, require) => {
 "use strict";
@@ -7144,7 +7905,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 exports.__esModule = true;
-exports.LABEL_RULE = void 0;
+exports.readBoundedFile = exports.LABEL_RULE = void 0;
 exports.endpoint = endpoint;
 exports.credentialText = credentialText;
 exports.connectionProblem = connectionProblem;
@@ -7155,7 +7916,6 @@ exports.drift = drift;
 exports.samePermissions = samePermissions;
 exports.listIds = listIds;
 exports.failureDetails = failureDetails;
-exports.readBoundedFile = readBoundedFile;
 exports.onlineAdapter = onlineAdapter;
 exports.shellQuote = shellQuote;
 exports.recoveryPath = recoveryPath;
@@ -7168,7 +7928,6 @@ const cancellation_js_1 = require("./cancellation.js");
 const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
 const errors_js_1 = require("./errors.js");
-const protected_path_js_1 = require("./protected-path.js");
 const lnd_permissions_json_1 = __importDefault(require("./grade/lnd-permissions.json"));
 function endpoint(host) {
     if (!/:[0-9]{1,5}$/.test(host))
@@ -7231,36 +7990,8 @@ function failureDetails(error) {
     return { code: error.code, message: error.code === 4
             ? 'LND transport, TLS or authentication failure' : 'LND request failed' };
 }
-async function readBoundedFile(path, io) {
-    if ((0, protected_path_js_1.isProtectedPath)(path))
-        throw new Error('protected file');
-    const resolved = await io.realpath(path);
-    if ((0, protected_path_js_1.isProtectedPath)(resolved))
-        throw new Error('protected file');
-    const before = await io.stat(resolved);
-    if (!before.isFile())
-        throw new Error('not a regular file');
-    const handle = await io.open(resolved, node_fs_1.constants.O_RDONLY | node_fs_1.constants.O_NONBLOCK | (node_fs_1.constants.O_NOFOLLOW ?? 0));
-    try {
-        const opened = await handle.stat();
-        if (!opened.isFile() || opened.dev !== before.dev || opened.ino !== before.ino)
-            throw new Error('file changed');
-        const bytes = Buffer.allocUnsafe(1_048_577);
-        let total = 0;
-        while (total < bytes.length) {
-            const { bytesRead } = await handle.read(bytes, total, bytes.length - total, null);
-            if (!bytesRead)
-                break;
-            total += bytesRead;
-        }
-        if (total > 1_048_576)
-            throw new Error('file too large');
-        return bytes.subarray(0, total);
-    }
-    finally {
-        await handle.close();
-    }
-}
+var bounded_file_js_1 = require("./bounded-file.js");
+module.exports = exports = { __proto__: null, ...exports, get readBoundedFile() { return bounded_file_js_1.readBoundedFile; } };
 function onlineAdapter(adapter) {
     return {
         getInfo: () => (0, cancellation_js_1.cancellable)(() => adapter.getInfo()),
@@ -7312,6 +8043,7 @@ function readOnlineCredential(path, io) {
 function onlineWarnings(result) {
     const messages = {
         'acl-best-effort': "the file inherits the folder's permissions",
+        'unsafe-arg': 'literal credentials can appear in shell history and process listings',
         'own-root-key-0': 'own credential uses root key ID 0',
         'snapshot-drift': 'LND permissions differ from the bundled snapshot',
         'canary-requires-watch': 'LND accepts this canary only while macwarden watch runs; a running watch picks it up within 60 seconds (or at its next reconnect), then denies and alerts on every use its permissions allow',
@@ -7345,6 +8077,7 @@ const lndconnect_js_1 = require("../input/lndconnect.js");
 const recognition_js_1 = require("../decode/recognition.js");
 const node_util_1 = require("node:util");
 const patterns_js_1 = require("../scan/patterns.js");
+const nwc_match_js_1 = require("../scan/nwc-match.js");
 const credential_recognition_js_1 = require("../credential-recognition.js");
 const redact_js_1 = require("../scan/redact.js");
 function rotatePlanResult(plan, next, warnings, repaired) {
@@ -7358,10 +8091,7 @@ function revokePlanResult(plan, warnings, alreadyAbsent) {
     result.display = { alreadyAbsent };
     return result;
 }
-const redactors = [patterns_js_1.lndconnect, patterns_js_1.nwc]
-    .map(pattern => ({ regex: new RegExp(pattern.source, `${pattern.flags}g`),
-    isLndconnect: pattern === patterns_js_1.lndconnect,
-    consumesDelimiter: pattern === patterns_js_1.nwc }));
+const lndconnectAll = new RegExp(patterns_js_1.lndconnect.source, `${patterns_js_1.lndconnect.flags}g`);
 function hasCredentialInLndconnect(value) {
     const bytes = (0, lndconnect_js_1.parseLndconnect)(value);
     return bytes !== null && (0, recognition_js_1.macaroonEnds)(bytes)(0) !== null;
@@ -7393,12 +8123,11 @@ function redact(text) {
     return safe;
 }
 function redactUncached(text) {
-    const withUrisRedacted = redactors.reduce((value, { regex, isLndconnect, consumesDelimiter }) => value.replace(regex, match => {
-        if (isLndconnect && !hasCredentialInLndconnect(match))
-            return match;
-        const delimiter = consumesDelimiter && /[^0-9a-f]$/i.test(match) ? match.slice(-1) : '';
-        return `[redacted]${delimiter}`;
-    }), text);
+    lndconnectAll.lastIndex = 0;
+    const withLndconnectRedacted = text.replace(lndconnectAll, match => hasCredentialInLndconnect(match) ? '[redacted]' : match);
+    // NWC URIs through the linear matcher: the published regex backtracks quadratically on
+    // repeated prefixes. The match consumes one delimiter after the secret, which is kept.
+    const withUrisRedacted = (0, nwc_match_js_1.replaceNwc)(withLndconnectRedacted, match => `[redacted]${/[^0-9a-f]$/i.test(match) ? match.slice(-1) : ''}`);
     return (0, credential_recognition_js_1.redactEncodedCredentials)(withUrisRedacted);
 }
 function assertPlain(value, seen = new WeakSet()) {
@@ -7556,6 +8285,23 @@ parent       ${safeText(result.parentFingerprint)}
         result.added.map(caveat => `added        ${safeText(caveat)}
 `).join('') + inspectText(result);
 }
+function verifyText(result) {
+    const why = result.rejection === null ? '' : ` (${safeText(result.rejection)})`;
+    const status = result.status === 'accepted' ? 'ACCEPTED by LND: this credential is live'
+        : result.conclusive ? `rejected by LND${why}`
+            : `REJECTED BY THIS CHECK ONLY${why}: it may still be accepted from another caller`;
+    const registry = result.registry === null ? 'not in this registry'
+        : `${safeText(result.registry.label ?? 'unlabelled')} (${safeText(result.registry.status)}${result.registry.match === 'fingerprint' ? ', same credential' : ', same root key ID, different credential'})`;
+    const lines = [
+        `node         ${safeText(result.node.pubkey)} (${safeText(result.node.alias)}) ${safeText(result.node.network)}`,
+        `status       ${status}`,
+        `root key     ${result.rootKeyListed === null ? 'not checked (own credential cannot call ListMacaroonIDs)'
+            : result.rootKeyListed ? 'listed in LND' : 'not listed in LND'}${result.ownCredential ? "; macwarden's own root key ID" : ''}`,
+        `registry     ${registry}`,
+        ...result.guidance.map(line => `next         ${safeText(line)}`),
+    ];
+    return inspectText(result) + `${lines.join('\n')}\n`;
+}
 function respondText(result) {
     const lines = [`respond ${result.mode}${result.dryRun ? ' (dry run: nothing changed)' : ''}  node ${safeText(result.node.pubkey)} (${safeText(result.node.alias)}) ${safeText(result.node.network)}`];
     if (result.outDir)
@@ -8035,6 +8781,9 @@ function* renderChunks(result, mode) {
             case 'respond':
                 rendered = respondText(result.result);
                 break;
+            case 'verify':
+                rendered = isInspectResult(result.result) ? verifyText(result.result) : genericText(result);
+                break;
             default:
                 rendered = genericText(result);
                 break;
@@ -8351,6 +9100,7 @@ const node_os_1 = require("node:os");
 const node_path_1 = require("node:path");
 const node_crypto_1 = require("node:crypto");
 const protected_path_js_1 = require("../protected-path.js");
+const bounded_file_js_1 = require("../bounded-file.js");
 const maxRootKeyId = 18446744073709551615n;
 const fields = ['nodePubkey', 'label', 'rootKeyId', 'permissions', 'caveats', 'grade',
     'fingerprint', 'outPath', 'createdAt', 'verified', 'status', 'revokedAt',
@@ -8715,6 +9465,8 @@ class Registry {
             }
             let lock;
             try {
+                // The lock is ours to read only as a plain file: never through a symlink (SAFE-02).
+                await (0, bounded_file_js_1.assertPlainFile)(lockPath, this.fs, bounded_file_js_1.LOCK_FILE_LIMIT);
                 const text = await this.fs.readFile(lockPath, 'utf8');
                 lock = JSON.parse(text);
             }
@@ -9072,7 +9824,7 @@ function ownProcessDomain() {
 "report/access-review.js": (module, exports, require) => {
 "use strict";
 exports.__esModule = true;
-exports.REPORT_FORMATS = void 0;
+exports.LIMITATIONS = exports.REPORT_FORMATS = void 0;
 exports.buildAccessReview = buildAccessReview;
 exports.csvField = csvField;
 exports.formatAccessReview = formatAccessReview;
@@ -9082,6 +9834,8 @@ exports.formatAccessReview = formatAccessReview;
 const credential_recognition_js_1 = require("../credential-recognition.js");
 const index_js_1 = require("../decode/index.js");
 exports.REPORT_FORMATS = ['markdown', 'csv', 'json'];
+/** The scope statement every format carries. */
+exports.LIMITATIONS = 'This report is evidence for a reviewer. It does not by itself establish compliance with any framework.';
 const FLAGS = ['default-root-key', 'own-credential', 'unknown', 'missing-in-lnd', 'revoked-but-present',
     'admin-grade', 'no-expiry', 'expired', 'unlabelled', 'canary-triggered'];
 const byId = (left, right) => { const a = BigInt(left), b = BigInt(right); return a < b ? -1 : a > b ? 1 : 0; };
@@ -9131,12 +9885,14 @@ function buildAccessReview(input) {
             flags.push('expired');
         if (entry.label === null)
             flags.push('unlabelled');
-        if (input.canary?.(entry.rootKeyId))
+        const triggered = input.canary?.(entry.rootKeyId) ?? null;
+        if (triggered)
             flags.push('canary-triggered');
         credentials.push({ rootKeyId: entry.rootKeyId, inLnd: present, label: entry.label, status: entry.status,
             grade: entry.grade, permissions: [...entry.permissions].sort(), caveats: entry.caveats.map(caveat => `${caveat.type} ${caveat.value}`),
             expiresAt: at, createdAt: entry.createdAt, revokedAt: entry.revokedAt, revokeEvidence: entry.revokeEvidence,
-            replaces: entry.replaces, replacedBy: entry.replacedBy, ...observed(entry.rootKeyId), flags });
+            replaces: entry.replaces, replacedBy: entry.replacedBy, ...observed(entry.rootKeyId),
+            canary: triggered ? { uses: triggered.uses, firstUse: triggered.firstUse, lastUse: triggered.lastUse } : null, flags });
     }
     for (const id of [...inLnd].filter(id => !seen.has(id)).sort(byId)) {
         const flags = id === '0' ? ['default-root-key'] : id === input.ownRootKeyId ? [] : ['unknown'];
@@ -9144,7 +9900,7 @@ function buildAccessReview(input) {
             flags.push('own-credential');
         credentials.push({ rootKeyId: id, inLnd: true, label: null, status: 'not-in-registry', grade: null, permissions: [],
             caveats: [], expiresAt: null, createdAt: null, revokedAt: null, revokeEvidence: null, replaces: null,
-            replacedBy: null, ...observed(id), flags });
+            replacedBy: null, ...observed(id), canary: null, flags });
     }
     credentials.sort((a, b) => byId(a.rootKeyId, b.rootKeyId));
     const flagged = Object.fromEntries(FLAGS.map(flag => [flag, credentials.filter(item => item.flags.includes(flag)).length]));
@@ -9168,6 +9924,7 @@ function buildAccessReview(input) {
                 observation: 'Expired credentials still active and revoked entries whose root key ID is still in LND should be removed with macwarden revoke.' },
         ],
         signOff: { reviewer: null, date: null, decision: null, notes: null },
+        limitations: exports.LIMITATIONS,
     };
 }
 /** Credential recognition plus removal of control characters; reports are plain text. */
@@ -9188,7 +9945,25 @@ const COLUMNS = [
     ['revoke_evidence', item => item.revokeEvidence ?? ''], ['replaces', item => item.replaces ?? ''], ['replaced_by', item => item.replacedBy ?? ''],
     ['last_used', item => item.lastUsed ?? ''], ['calls', item => item.calls === null ? '' : String(item.calls)],
     ['flags', item => item.flags.join(' ')],
+    ['caveats', item => item.caveats.join('; ')], ['canary_uses', item => item.canary ? String(item.canary.uses) : ''],
+    ['canary_first_use', item => item.canary?.firstUse ?? ''], ['canary_last_use', item => item.canary?.lastUse ?? ''],
+];
+/**
+ * Columns after the credential columns: the controls that name this row, then report-level
+ * fields repeated on every row, so the CSV stays one table with one header row.
+ */
+const REPORT_COLUMNS = [
+    ['controls', (review, item) => naming(review, item).map(control => control.control).join('; ')],
+    ['control_observations', (review, item) => naming(review, item).map(control => `${control.control}: ${control.observation}`).join(' | ')],
+    ['generated_at', review => review.generatedAt], ['macwarden_version', review => review.macwardenVersion],
+    ['node_pubkey', review => review.node.pubkey], ['node_alias', review => review.node.alias],
+    ['node_network', review => review.node.network], ['node_version', review => review.node.version],
+    ['reviewer', () => ''], ['review_date', () => ''], ['review_decision', () => ''], ['review_notes', () => ''],
+    ['limitations', review => review.limitations],
 ];
+function naming(review, item) {
+    return review.controls.filter(control => control.rootKeyIds.includes(item.rootKeyId));
+}
 /** RFC 4180 field; a leading formula character is neutralised so spreadsheets never evaluate it. */
 function csvField(value) {
     const safe = /^[=+\-@\t\r]/.test(value) ? `'${value}` : value;
@@ -9205,8 +9980,9 @@ function formatAccessReview(review, format) {
     if (format === 'json')
         return `${JSON.stringify(safe, null, 2)}\n`;
     if (format === 'csv')
-        return [COLUMNS.map(([name]) => name).join(','),
-            ...safe.credentials.map(item => COLUMNS.map(([, value]) => csvField(value(item))).join(','))].join('\r\n') + '\r\n';
+        return [[...COLUMNS, ...REPORT_COLUMNS].map(([name]) => name).join(','),
+            ...safe.credentials.map(item => [...COLUMNS.map(([, value]) => value(item)), ...REPORT_COLUMNS.map(([, value]) => value(safe, item))]
+                .map(csvField).join(','))].join('\r\n') + '\r\n';
     const node = safe.node;
     const lines = [
         `# Lightning credential access review`, '',
@@ -9214,15 +9990,20 @@ function formatAccessReview(review, format) {
         `- Node: ${markdownCell(node.pubkey)} (${markdownCell(node.alias)}), ${markdownCell(node.network)}, LND ${markdownCell(node.version)}`,
         `- Tool: macwarden ${markdownCell(safe.macwardenVersion)}`,
         `- Root key IDs in LND: ${safe.totals.inLnd}; active registry entries: ${safe.totals.active}; revoked: ${safe.totals.revoked}; unknown: ${safe.totals.unknown}`,
-        '', 'This report is evidence for a reviewer. It does not by itself establish compliance with any framework.', '',
+        `- Flag counts: ${Object.entries(safe.totals.flagged).map(([flag, count]) => `${markdownCell(flag)} ${count}`).join(', ')}`,
+        '', safe.limitations, '',
         '## Credentials', '',
-        '| Root key ID | In LND | Label | Status | Grade | Expires | Created | Revoked | Evidence | Last used | Calls | Flags |',
-        '|---|---|---|---|---|---|---|---|---|---|---|---|',
+        '| Root key ID | In LND | Label | Status | Grade | Expires | Created | Revoked | Evidence | Replaces | Replaced by | Last used | Calls | Canary uses | Flags |',
+        '|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|',
         ...safe.credentials.map(item => `| ${[item.rootKeyId, item.inLnd ? 'yes' : 'no', item.label ?? '', item.status, item.grade ?? '',
-            item.expiresAt ?? '', item.createdAt ?? '', item.revokedAt ?? '', item.revokeEvidence ?? '', item.lastUsed ?? 'not observed',
-            item.calls === null ? '' : String(item.calls), item.flags.join(', ')].map(markdownCell).join(' | ')} |`),
+            item.expiresAt ?? '', item.createdAt ?? '', item.revokedAt ?? '', item.revokeEvidence ?? '', item.replaces ?? '', item.replacedBy ?? '',
+            item.lastUsed ?? 'not observed', item.calls === null ? '' : String(item.calls),
+            item.canary ? `${item.canary.uses} denied (first ${item.canary.firstUse}, last ${item.canary.lastUse})` : '',
+            item.flags.join(', ')].map(markdownCell).join(' | ')} |`),
         '', '## Permissions', '',
         ...safe.credentials.filter(item => item.permissions.length).map(item => `- ${markdownCell(item.rootKeyId)} ${markdownCell(item.label ?? '')}: ${item.permissions.map(markdownCell).join(', ')}`),
+        '', '## Caveats', '',
+        ...safe.credentials.filter(item => item.caveats.length).map(item => `- ${markdownCell(item.rootKeyId)} ${markdownCell(item.label ?? '')}: ${item.caveats.map(markdownCell).join('; ')}`),
         '', '## Control observations', '',
         ...safe.controls.flatMap(control => [`### ${control.control}`, '', control.observation, '',
             control.rootKeyIds.length ? `Root key IDs: ${control.rootKeyIds.map(markdownCell).join(', ')}` : 'Root key IDs: none', '']),
@@ -9343,7 +10124,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 exports.__esModule = true;
-exports.PINNED_CONFIG = exports.MAX_HISTORY_ENTRIES = exports.GIT_IDLE_TIMEOUT_MS = exports.MODE_OTHER = exports.MODE_SYMLINK = exports.MODE_REGULAR = exports.GitHistoryError = void 0;
+exports.PREFLIGHT_LIMITS = exports.PINNED_CONFIG = exports.MAX_HISTORY_ENTRIES = exports.GIT_IDLE_TIMEOUT_MS = exports.MODE_OTHER = exports.MODE_SYMLINK = exports.MODE_REGULAR = exports.GitHistoryError = void 0;
 exports.nonLocalPath = nonLocalPath;
 exports.locateRepository = locateRepository;
 exports.gitEnvironment = gitEnvironment;
@@ -9443,14 +10224,87 @@ async function local(base, value) {
         throw new GitHistoryError(NOT_LOCAL);
     return real ?? path;
 }
-async function small(path) {
-    const stat = await fs.stat(path).catch(() => null);
-    if (!stat?.isFile())
-        return null;
-    if (stat.size > MAX_LOCATION_FILE)
-        throw new GitHistoryError(UNREADABLE);
-    return fs.readFile(path, 'utf8');
+exports.PREFLIGHT_LIMITS = { files: 256, bytes: 1024 * 1024, edges: 4096 };
+/** One preflight: budgets, counters, memoized results and the chain currently being walked. */
+class Preflight {
+    stats;
+    limits;
+    /** Canonical location → its expansion, once validated. Each location is read at most once. */
+    done = new Map();
+    walking = new Set();
+    constructor(limits = {}, stats) {
+        this.limits = { ...exports.PREFLIGHT_LIMITS, ...limits };
+        this.stats = Object.assign(stats ?? {}, { files: 0, bytes: 0, edges: 0, expandedEdges: 0, expandedBytes: 0 });
+    }
+    key(path) { return process.platform === 'win32' ? (0, node_path_1.resolve)(path).toLowerCase() : (0, node_path_1.resolve)(path); }
+    /** Checks cancellation and the cumulative budgets; exceeding one fails like unreadable input. */
+    step() {
+        (0, cancellation_js_1.checkCancellation)();
+        const { stats, limits } = this;
+        if (stats.files > limits.files || stats.bytes > limits.bytes || stats.edges > limits.edges
+            || stats.expandedEdges > limits.edges || stats.expandedBytes > limits.bytes)
+            throw new GitHistoryError(UNREADABLE);
+    }
+    edge() { this.stats.edges++; this.step(); }
+    async small(path) {
+        this.stats.files++;
+        this.step();
+        const stat = await fs.stat(path).catch(() => null);
+        if (!stat?.isFile())
+            return null;
+        if (stat.size > MAX_LOCATION_FILE)
+            throw new GitHistoryError(UNREADABLE);
+        const bytes = await fs.readFile(path);
+        // The file may have grown between stat and read: count and bound what was actually read.
+        if (bytes.length > MAX_LOCATION_FILE)
+            throw new GitHistoryError(UNREADABLE);
+        this.stats.bytes += bytes.length;
+        this.step();
+        return bytes.toString('utf8');
+    }
+    /** Adds a followed edge and the child's expansion to `into`, failing once it exceeds a budget. */
+    follow(into, child) {
+        into.height = Math.max(into.height, 1 + child.height);
+        into.edges += 1 + child.edges;
+        into.bytes += child.bytes;
+        if (into.edges > this.limits.edges || into.bytes > this.limits.bytes)
+            throw new GitHistoryError(UNREADABLE);
+    }
+    /** Adds a root location's expansion to the totals for the whole repository. */
+    root(expansion) {
+        this.stats.expandedEdges += expansion.edges;
+        this.stats.expandedBytes += expansion.bytes;
+        this.step();
+    }
+    /**
+     * Validates `location` at `depth` at most once. A location validated earlier is accepted
+     * when its deepest chain still fits under `max` from this depth; one on the chain being
+     * walked is a cycle, which git would follow until its own depth limit, so it is refused.
+     */
+    async visit(location, depth, max, walk) {
+        const key = this.key(location);
+        const known = this.done.get(key);
+        if (known !== undefined) {
+            if (depth + known.height > max)
+                throw new GitHistoryError(UNREADABLE);
+            return known;
+        }
+        if (this.walking.has(key))
+            throw new GitHistoryError(UNREADABLE);
+        this.walking.add(key);
+        try {
+            const expansion = await walk();
+            if (depth + expansion.height > max)
+                throw new GitHistoryError(UNREADABLE);
+            this.done.set(key, expansion);
+            return expansion;
+        }
+        finally {
+            this.walking.delete(key);
+        }
+    }
 }
+const NOTHING = { height: 0, edges: 0, bytes: 0 };
 /** Unquotes a C-style quoted alternates line as git writes them. */
 function unquoteAlternate(line) {
     if (!line.startsWith('"') || !line.endsWith('"') || line.length < 2)
@@ -9462,18 +10316,25 @@ function unquoteAlternate(line) {
         return named[escape] ?? escape;
     });
 }
-async function checkAlternates(objects, depth) {
-    const text = await small((0, node_path_1.join)(objects, 'info', 'alternates'));
-    if (text === null)
-        return;
-    if (depth >= MAX_ALTERNATE_DEPTH)
-        throw new GitHistoryError(UNREADABLE);
-    for (const raw of text.split(/\r?\n/)) {
-        const line = raw.trim();
-        if (!line || line.startsWith('#'))
-            continue;
-        await checkAlternates(await local(objects, unquoteAlternate(line)), depth + 1);
-    }
+/** Alternates chains of at most MAX_ALTERNATE_DEPTH levels; each objects directory is read once. */
+function checkAlternates(run, objects, depth) {
+    const file = (0, node_path_1.join)(objects, 'info', 'alternates');
+    return run.visit(file, depth, MAX_ALTERNATE_DEPTH, async () => {
+        const text = await run.small(file);
+        if (text === null)
+            return NOTHING;
+        if (depth >= MAX_ALTERNATE_DEPTH)
+            throw new GitHistoryError(UNREADABLE);
+        const own = { height: 0, edges: 0, bytes: Buffer.byteLength(text) };
+        for (const raw of text.split(/\r?\n/)) {
+            const line = raw.trim();
+            if (!line || line.startsWith('#'))
+                continue;
+            run.edge();
+            run.follow(own, await checkAlternates(run, await local(objects, unquoteAlternate(line)), depth + 1));
+        }
+        return own;
+    });
 }
 /** Include paths named by [include] and [includeIf "..."] sections of one config file. */
 function includePaths(text) {
@@ -9502,19 +10363,27 @@ function includePaths(text) {
     }
     return paths;
 }
-async function checkIncludes(file, depth) {
-    const text = await small(file);
-    if (text === null)
-        return;
-    for (const value of includePaths(text)) {
-        if (depth >= MAX_INCLUDE_DEPTH)
-            throw new GitHistoryError(UNREADABLE);
-        const named = value.startsWith('~/') || value.startsWith('~\\') ? (0, node_path_1.join)((0, node_os_1.homedir)(), value.slice(2)) : value;
-        // %(prefix)/ names the git installation, which is not repository input.
-        if (named.startsWith('%(prefix)/'))
-            continue;
-        await checkIncludes(await local((0, node_path_1.dirname)(file), named), depth + 1);
-    }
+/** Include chains of at most MAX_INCLUDE_DEPTH levels; each config file is read once. */
+function checkIncludes(run, file, depth) {
+    return run.visit(file, depth, MAX_INCLUDE_DEPTH, async () => {
+        const text = await run.small(file);
+        if (text === null)
+            return NOTHING;
+        const own = { height: 0, edges: 0, bytes: Buffer.byteLength(text) };
+        for (const value of includePaths(text)) {
+            if (depth >= MAX_INCLUDE_DEPTH)
+                throw new GitHistoryError(UNREADABLE);
+            run.edge();
+            const named = value.startsWith('~/') || value.startsWith('~\\') ? (0, node_path_1.join)((0, node_os_1.homedir)(), value.slice(2)) : value;
+            // %(prefix)/ names the git installation, which is not repository input.
+            if (named.startsWith('%(prefix)/')) {
+                run.follow(own, NOTHING);
+                continue;
+            }
+            run.follow(own, await checkIncludes(run, await local((0, node_path_1.dirname)(file), named), depth + 1));
+        }
+        return own;
+    });
 }
 /** GIT_CEILING_DIRECTORIES as git reads it: discovery never moves up into one of these. */
 function ceilings() {
@@ -9526,7 +10395,8 @@ function ceilings() {
  * Finds the repository containing `directory` the way git discovery would (a .git
  * directory or gitfile in it or a parent) and validates every location git would read.
  */
-async function locateRepository(directory) {
+async function locateRepository(directory, options = {}) {
+    const run = new Preflight(options.limits, options.stats);
     if (nonLocalPath((0, node_path_1.resolve)(directory)))
         throw new GitHistoryError(NOT_LOCAL);
     let current = await fs.realpath(directory).catch(() => { throw new GitHistoryError(NOT_WORK_TREE); });
@@ -9540,7 +10410,7 @@ async function locateRepository(directory) {
         if (stat) {
             let gitDir;
             if (stat.isFile()) {
-                const text = await small(candidate);
+                const text = await run.small(candidate);
                 const target = text === null ? null : /^gitdir:\s*(.+?)\s*$/m.exec(text)?.[1];
                 if (!target)
                     throw new GitHistoryError(NOT_WORK_TREE);
@@ -9551,11 +10421,11 @@ async function locateRepository(directory) {
             const gitStat = await fs.stat(gitDir).catch(() => null);
             if (!gitStat?.isDirectory())
                 throw new GitHistoryError(NOT_WORK_TREE);
-            const common = await small((0, node_path_1.join)(gitDir, 'commondir'));
+            const common = await run.small((0, node_path_1.join)(gitDir, 'commondir'));
             const commonDir = common === null ? gitDir : await local(gitDir, common.trim());
-            await checkAlternates((0, node_path_1.join)(commonDir, 'objects'), 0);
-            await checkIncludes((0, node_path_1.join)(commonDir, 'config'), 0);
-            await checkIncludes((0, node_path_1.join)(gitDir, 'config.worktree'), 0);
+            run.root(await checkAlternates(run, (0, node_path_1.join)(commonDir, 'objects'), 0));
+            run.root(await checkIncludes(run, (0, node_path_1.join)(commonDir, 'config'), 0));
+            run.root(await checkIncludes(run, (0, node_path_1.join)(gitDir, 'config.worktree'), 0));
             return { gitDir, workTree: current };
         }
         const parent = (0, node_path_1.dirname)(current);
@@ -10033,8 +10903,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 exports.__esModule = true;
-exports.SCAN_CONCURRENCY = exports.FindingsLimitError = exports.HISTORY_DEDUP_WORK_LIMIT = exports.ALSO_AT_EXAMPLES = exports.FINDINGS_LIMIT = exports.GitHistoryError = exports.IgnoreFileError = void 0;
-exports.readBounded = readBounded;
+exports.readBounded = exports.SCAN_CONCURRENCY = exports.FindingsLimitError = exports.HISTORY_DEDUP_WORK_LIMIT = exports.ALSO_AT_EXAMPLES = exports.FINDINGS_LIMIT = exports.GitHistoryError = exports.IgnoreFileError = void 0;
 exports.scan = scan;
 const mcp_context_js_1 = require("./mcp-context.js");
 const node_crypto_1 = require("node:crypto");
@@ -10053,6 +10922,8 @@ const nwc_match_js_1 = require("./nwc-match.js");
 const ignore_js_1 = require("./ignore.js");
 const git_history_js_1 = require("./git-history.js");
 const cancellation_js_1 = require("../cancellation.js");
+const bounded_file_js_1 = require("../bounded-file.js");
+module.exports = exports = { __proto__: null, ...exports, get readBounded() { return bounded_file_js_1.readBounded; } };
 var ignore_js_2 = require("./ignore.js");
 module.exports = exports = { __proto__: null, ...exports, get IgnoreFileError() { return ignore_js_2.IgnoreFileError; } };
 var git_history_js_2 = require("./git-history.js");
@@ -10085,7 +10956,8 @@ const detectors = [
 const detectorRegexes = detectors.map(({ kind, pattern }) => ({ kind, regex: new RegExp(pattern.source, `${pattern.flags.replace('g', '')}g`) }));
 // Every detector match contains one of these (case-insensitive superset), so a line
 // without any of them cannot produce a hit and is not split into code points.
-const MAY_MATCH = /lndconnect:\/\/|walletconnect:|0201036c6e6402|AgEDbG5kA/i;
+// "walletconnect%3a" covers percent-encoded NWC URIs, which are matched on a normalised copy.
+const MAY_MATCH = /lndconnect:\/\/|walletconnect:|walletconnect%3a|0201036c6e6402|AgEDbG5kA/i;
 const WINDOW = 65_536;
 const STEP = 32_768;
 function fingerprint(data) {
@@ -10106,7 +10978,7 @@ function withFacts(path, line, column, kind, facts, now, ctx) {
             (0, redact_js_1.collectNwcSecrets)(facts.location, ctx.secrets);
         for (const value of [...facts.permissions, ...facts.caveats.map(caveat => caveat.value)])
             (0, redact_js_1.collectNwcSecrets)(value, ctx.secrets);
-        const assessed = (0, index_js_2.grade)(facts.permissions);
+        const assessed = (0, index_js_2.gradeFacts)(facts);
         shared = {
             fingerprint: facts.fingerprint, grade: assessed.grade,
             rootKeyId: facts.rootKeyId.toString(), permissions: facts.permissions.map(redact_js_1.redactDecoded),
@@ -10154,11 +11026,13 @@ function credentialBytes(hit) {
         return null;
     return (0, lndconnect_js_1.parseLndconnect)(hit.text);
 }
-function collectHits(points) {
+function collectHits(points, only) {
     const hits = new Map();
     for (let offset = 0; offset < points.length; offset += STEP) {
         const window = points.slice(offset, offset + WINDOW).join('');
         for (const { kind, regex } of detectorRegexes) {
+            if (only !== undefined && kind !== only)
+                continue;
             regex.lastIndex = 0;
             let codeUnit = 0;
             let codePoint = 0;
@@ -10205,15 +11079,31 @@ function scanText(path, text, now, ctx) {
         if (!MAY_MATCH.test(lines[i]))
             continue;
         const points = Array.from(lines[i]);
-        for (const hit of collectHits(points)) {
+        const hits = collectHits(points);
+        // NWC URIs in common escaped forms (JSON-escaped slashes, percent-encoding, "+" as a
+        // space) are matched on one normalised copy of the line; a URI the line already matched
+        // at the same column is not reported twice.
+        const unescaped = (0, nwc_match_js_1.nwcUnescaped)(points, lines[i]);
+        if (unescaped) {
+            const seen = new Set(hits.filter(hit => hit.kind === 'nwc').map(hit => hit.start));
+            for (const hit of collectHits(unescaped.points, 'nwc')) {
+                const start = unescaped.origin[hit.start];
+                if (!seen.has(start)) {
+                    seen.add(start);
+                    hits.push({ ...hit, start });
+                }
+            }
+            hits.sort((a, b) => a.start - b.start);
+        }
+        for (const hit of hits) {
             const column = hit.start + 1;
             const line = i + 1;
             if (hit.kind === 'nwc') {
-                const secret = /(?:[?&])secret=([0-9a-f]{64})(?=[^0-9a-f]|$)/i.exec(hit.text);
-                if (secret) {
-                    ctx.secrets.add(secret[1].toLowerCase());
-                    findings.push(nullFinding(path, line, column, 'nwc', fingerprint(Buffer.from(secret[1], 'hex'))));
-                }
+                // The matcher ends every match with secret=<64 hex> and at most one delimiter. Any
+                // match is reported (fail closed): "&amp;secret=" and other separators included.
+                const secret = /secret=([0-9a-f]{64})[^0-9a-f]?$/i.exec(hit.text)[1].toLowerCase();
+                ctx.secrets.add(secret);
+                findings.push(nullFinding(path, line, column, 'nwc', fingerprint(Buffer.from(secret, 'hex'))));
                 continue;
             }
             const bytes = credentialBytes(hit);
@@ -10357,30 +11247,6 @@ function tagMcpContext(path, text, findings) {
             finding.context = 'mcp-config';
     }
 }
-/**
- * Reads at most limit + 1 bytes. The buffer starts at the size fstat reported plus one
- * byte (to notice growth) and doubles only while the file keeps yielding data, so a small
- * file never costs a limit-sized allocation.
- */
-async function readBounded(handle, limit, size) {
-    const hinted = typeof size === 'bigint' ? (size > BigInt(limit) ? limit : Number(size)) : Math.min(Math.max(size, 0), limit);
-    let bytes = Buffer.allocUnsafe(hinted + 1);
-    let total = 0;
-    for (;;) {
-        if (total === bytes.length) {
-            if (bytes.length >= limit + 1)
-                break;
-            const grown = Buffer.allocUnsafe(Math.min(limit + 1, bytes.length * 2));
-            bytes.copy(grown, 0, 0, total);
-            bytes = grown;
-        }
-        const { bytesRead } = await handle.read(bytes, total, bytes.length - total, total);
-        if (bytesRead === 0)
-            break;
-        total += bytesRead;
-    }
-    return bytes.subarray(0, total);
-}
 async function scan(paths, opts = {}) {
     const io = opts.fs ?? fs;
     const now = opts.clock?.() ?? new Date();
@@ -10415,7 +11281,7 @@ async function scan(paths, opts = {}) {
                     !openedPathStat.isFile() || openedPathStat.isSymbolicLink() ||
                     !sameFileIdentity(openedPathStat, openedStat))
                     throw new index_js_3.InputError('input-read', 'cannot read ignore file');
-                const bytes = await readBounded(handle, TEXT_LIMIT, openedStat.size);
+                const bytes = await (0, bounded_file_js_1.readBounded)(handle, TEXT_LIMIT, openedStat.size);
                 if (bytes.length > TEXT_LIMIT)
                     throw new index_js_3.InputError('input-read', 'cannot read ignore file');
                 content = bytes.toString('utf8');
@@ -10466,7 +11332,7 @@ async function scan(paths, opts = {}) {
                 identity = fileIdentity(openedStat, target);
                 if (scannedFiles.has(identity))
                     return { type: 'dup' };
-                bytes = await readBounded(handle, macaroonFile ? MACAROON_LIMIT : TEXT_LIMIT, openedStat.size);
+                bytes = await (0, bounded_file_js_1.readBounded)(handle, macaroonFile ? MACAROON_LIMIT : TEXT_LIMIT, openedStat.size);
             }
             finally {
                 if (handle)
@@ -10980,22 +11846,22 @@ async function scan(paths, opts = {}) {
 // as `context: "mcp-config"`. Positions use the scanner's convention: 1-based lines split
 // on CRLF, LF or CR, and 1-based columns in Unicode code points.
 exports.__esModule = true;
+exports.MAX_DEPTH = void 0;
 exports.mcpServerStringSpans = mcpServerStringSpans;
 exports.withinSpans = withinSpans;
 const CONTAINERS = new Set(['mcpServers', 'mcp_servers', 'context_servers']);
-function insideServer(path, mcpFile) {
-    for (let i = 0; i < path.length - 1; i++) {
-        if (CONTAINERS.has(path[i]))
-            return true;
-        if (path[i] === 'servers' && (mcpFile || (i > 0 && path[i - 1] === 'mcp')))
-            return true;
-    }
-    return false;
+/** Tagging gives up (returns []) beyond this nesting depth; real configuration files stay far below. */
+exports.MAX_DEPTH = 1000;
+const EMPTY_PATH = { inside: false, last: null, lastQualifies: false };
+function append(path, element, mcpFile) {
+    return { inside: path.inside || path.lastQualifies, last: element,
+        lastQualifies: CONTAINERS.has(element) || (element === 'servers' && (mcpFile || path.last === 'mcp')) };
 }
 /**
  * Spans of every string value inside a server entry. Returns [] for text that is not
- * well-formed JSON with optional comments and trailing commas: tagging is best effort
- * and never changes what is detected.
+ * well-formed JSON with optional comments and trailing commas, or that nests deeper than
+ * MAX_DEPTH: tagging is best effort and never changes what is detected. Work is linear in
+ * the text length.
  */
 function mcpServerStringSpans(text, mcpFile) {
     const chars = Array.from(text.startsWith('') ? text.slice(1) : text);
@@ -11017,8 +11883,13 @@ function mcpServerStringSpans(text, mcpFile) {
             column++;
     };
     const stack = [];
-    const keyPath = () => stack.flatMap(frame => frame.kind === 'object'
-        ? (frame.key === null ? [] : [frame.key]) : ['[]']);
+    const pathOf = (frame) => {
+        if (!frame)
+            return EMPTY_PATH;
+        if (frame.kind === 'array')
+            return append(frame.parents, '[]', mcpFile);
+        return frame.key === null ? frame.parents : append(frame.parents, frame.key, mcpFile);
+    };
     const readString = () => {
         const start = { line, column };
         advance();
@@ -11076,14 +11947,12 @@ function mcpServerStringSpans(text, mcpFile) {
                 continue;
             }
             const top = stack.at(-1);
-            if (c === '{') {
-                advance();
-                stack.push({ kind: 'object', key: null, expectKey: true });
-                continue;
-            }
-            if (c === '[') {
+            if (c === '{' || c === '[') {
+                if (stack.length >= exports.MAX_DEPTH)
+                    return [];
+                const parents = pathOf(top);
                 advance();
-                stack.push({ kind: 'array' });
+                stack.push(c === '{' ? { kind: 'object', key: null, expectKey: true, parents } : { kind: 'array', parents });
                 continue;
             }
             if (c === '}' || c === ']') {
@@ -11117,7 +11986,7 @@ function mcpServerStringSpans(text, mcpFile) {
                     top.key = token.value;
                     continue;
                 }
-                if (insideServer(keyPath(), mcpFile))
+                if (pathOf(top).inside)
                     spans.push({ start: token.start, end: token.end });
                 afterValue();
                 continue;
@@ -11138,9 +12007,23 @@ function mcpServerStringSpans(text, mcpFile) {
     return stack.length === 0 ? spans : [];
 }
 const before = (a, b) => a.line < b.line || (a.line === b.line && a.column <= b.column);
-/** True when the position falls within one of the spans (inclusive of the quotes). */
+/**
+ * True when the position falls within one of the spans (inclusive of the quotes). Spans come
+ * in document order and never overlap (string values cannot nest), so a binary search finds
+ * the only candidate: each finding costs O(log spans), not O(spans).
+ */
 function withinSpans(position, spans) {
-    return spans.some(span => before(span.start, position) && before(position, span.end));
+    let low = 0, high = spans.length - 1, candidate = -1;
+    while (low <= high) {
+        const middle = (low + high) >>> 1;
+        if (before(spans[middle].start, position)) {
+            candidate = middle;
+            low = middle + 1;
+        }
+        else
+            high = middle - 1;
+    }
+    return candidate >= 0 && before(position, spans[candidate].end);
 }
 
 },
@@ -11148,6 +12031,8 @@ function withinSpans(position, spans) {
 "use strict";
 exports.__esModule = true;
 exports.nwcMatches = nwcMatches;
+exports.replaceNwc = replaceNwc;
+exports.nwcUnescaped = nwcUnescaped;
 // Linear-time equivalent of the published `nwc` detector regex (src/scan/patterns.ts),
 // used for scanning. The regex's lazy middle `[^\s"'<>]*?` makes a backtracking engine
 // rescan the rest of a segment from every candidate start, which is quadratic when an
@@ -11199,6 +12084,58 @@ function nwcMatches(text) {
     }
     return matches;
 }
+/**
+ * Replaces every match of the published `nwc` regex exactly as `text.replace(/nwc/gi, replacer)`
+ * would, in linear time. Used by output redaction and scan's secret collection.
+ */
+function replaceNwc(text, replacer) {
+    if (!/walletconnect:/i.test(text))
+        return text;
+    let output = '';
+    let cursor = 0;
+    for (const match of nwcMatches(text)) {
+        output += text.slice(cursor, match.index) + replacer(match.text);
+        cursor = match.index + match.text.length;
+    }
+    return cursor === 0 ? text : output + text.slice(cursor);
+}
+const NWC_ESCAPE_HINT = /\\\/|%[0-9a-f]{2}|nostr walletconnect/i;
+/**
+ * One normalised copy of a line, for NWC URIs written in common escaped forms: JSON-escaped
+ * slashes ("\/" becomes "/"), one level of percent-encoding (ASCII bytes only) and a "+"
+ * decoded to a space in the scheme ("nostr walletconnect"). `origin[i]` is the index in the
+ * original code points of normalised code point i. Null when the line has none of these.
+ * (An "&amp;" before secret= needs no unescaping: the matcher accepts it as it is.)
+ */
+function nwcUnescaped(points, line) {
+    if (!/walletconnect/i.test(line) || !NWC_ESCAPE_HINT.test(line))
+        return null;
+    const out = [];
+    const origin = [];
+    for (let i = 0; i < points.length;) {
+        if (points[i] === '\\' && points[i + 1] === '/') {
+            out.push('/');
+            origin.push(i);
+            i += 2;
+            continue;
+        }
+        if (points[i] === '%' && /^[0-7][0-9a-f]$/i.test(`${points[i + 1] ?? ''}${points[i + 2] ?? ''}`)) {
+            out.push(String.fromCharCode(parseInt(points[i + 1] + points[i + 2], 16)));
+            origin.push(i);
+            i += 3;
+            continue;
+        }
+        out.push(points[i]);
+        origin.push(i);
+        i++;
+    }
+    for (let i = 5; i + 13 < out.length; i++) {
+        if (out[i] === ' ' && out.slice(i - 5, i).join('').toLowerCase() === 'nostr'
+            && out.slice(i + 1, i + 14).join('').toLowerCase() === 'walletconnect')
+            out[i] = '+';
+    }
+    return { points: out, origin };
+}
 
 },
 "scan/patterns.js": (module, exports, require) => {
@@ -11222,14 +12159,14 @@ exports.collectNwcSecrets = collectNwcSecrets;
 exports.knownSecretRedactor = knownSecretRedactor;
 exports.redactKnownSecrets = redactKnownSecrets;
 const credential_recognition_js_1 = require("../credential-recognition.js");
+const nwc_match_js_1 = require("./nwc-match.js");
 const patterns_js_1 = require("./patterns.js");
 const lndconnectAll = new RegExp(patterns_js_1.lndconnect.source, `${patterns_js_1.lndconnect.flags}g`);
-const nwcAll = new RegExp(patterns_js_1.nwc.source, `${patterns_js_1.nwc.flags.replace('g', '')}g`);
+// The published nwc regex backtracks quadratically on repeated prefixes; the linear matcher
+// returns exactly its matches (src/scan/nwc-match.ts).
 function redactStructured(text) {
     lndconnectAll.lastIndex = 0;
-    nwcAll.lastIndex = 0;
-    return text.replace(lndconnectAll, '[redacted]')
-        .replace(nwcAll, match => `[redacted]${/[^0-9a-f]$/i.test(match) ? match.slice(-1) : ''}`);
+    return (0, nwc_match_js_1.replaceNwc)(text.replace(lndconnectAll, '[redacted]'), match => `[redacted]${/[^0-9a-f]$/i.test(match) ? match.slice(-1) : ''}`);
 }
 // Same rule as the output renderer: a complete macaroon is at least 36 bytes and every
 // encoding the recognizer reads needs at least one printable ASCII character per byte, so a
@@ -11261,9 +12198,10 @@ function redactPath(text) {
 // those known identities for redaction; ordinary encoded-looking facts remain
 // unchanged.
 function collectNwcSecrets(text, secrets) {
-    nwcAll.lastIndex = 0;
-    for (const match of text.matchAll(nwcAll)) {
-        const parameter = /(?:[?&])secret=([0-9a-f]{64})(?=[^0-9a-f]|$)/i.exec(match[0]);
+    if (!/walletconnect:/i.test(text))
+        return;
+    for (const match of (0, nwc_match_js_1.nwcMatches)(text)) {
+        const parameter = /(?:[?&])secret=([0-9a-f]{64})(?=[^0-9a-f]|$)/i.exec(match.text);
         if (parameter)
             secrets.add(parameter[1].toLowerCase());
     }
@@ -11438,9 +12376,10 @@ class Secret {
     constructor(bytes) {
         const stored = bufferFrom(bytes);
         this.#bytes = stored;
-        const canonicalLength = (0, index_js_1.canonicalMacaroonLength)(stored);
+        // A valid macaroon hashes its canonical form (see canonicalMacaroonForm), anything else its bytes.
+        const canonical = (0, index_js_1.canonicalMacaroonForm)(stored);
         const hash = newHash('sha256');
-        hashUpdate(hash, subarray(stored, 0, canonicalLength ?? stored.length));
+        hashUpdate(hash, canonical?.reencoded ?? subarray(stored, 0, canonical?.length ?? stored.length));
         this.fingerprint = `fp:${hashDigest(hash, 'hex').slice(0, 16)}`;
     }
     toString() {
@@ -11545,23 +12484,50 @@ function createAlertThrottle(options) {
         suppressed: () => suppressedTotal,
     };
 }
-/** Runs alert commands one at a time; while one runs, only the newest event waits. */
+/**
+ * Runs alert commands one at a time; while one runs, only the newest event waits.
+ * Each run gets an AbortSignal: aborting it cancels the command (its process tree is killed).
+ * stop() ends alerting for good (watch shutdown, audit MW102-05): nothing new starts, the
+ * waiting event is discarded, and the running command gets one deadline after which it is
+ * cancelled. Discarded and refused events are reported through onFailure: no command ran.
+ */
 function createAlertRunner(run, onFailure) {
     let running = null;
+    let control = null;
     let pending = null;
     let replaced = 0;
+    let stopped = false;
     const start = (event) => {
-        running = run(event).catch(() => onFailure(event)).finally(() => {
+        const own = new AbortController();
+        control = own;
+        let attempt;
+        try {
+            attempt = run(event, own.signal);
+        }
+        catch (error) {
+            attempt = Promise.reject(error);
+        }
+        running = attempt.catch(() => onFailure(event)).finally(() => {
             running = null;
-            if (pending) {
+            control = null;
+            if (pending && !stopped) {
                 const next = pending;
                 pending = null;
                 start(next);
             }
         });
     };
+    const wait = (promise, ms) => {
+        let timer;
+        return Promise.race([promise.then(() => true), new Promise(resolve => { timer = setTimeout(() => resolve(false), ms); })])
+            .finally(() => clearTimeout(timer));
+    };
     return {
         submit(event) {
+            if (stopped) {
+                onFailure(event);
+                return;
+            }
             if (running) {
                 if (pending)
                     replaced += 1;
@@ -11573,6 +12539,23 @@ function createAlertRunner(run, onFailure) {
         /** Resolves once no alert command is running or waiting. */
         async idle() { while (running)
             await running; },
+        /**
+         * Stops alerting: refuses new events, discards the waiting one, lets the running command
+         * finish for at most graceMs, then cancels it and waits at most settleMs for it to settle.
+         */
+        async stop(graceMs, settleMs) {
+            stopped = true;
+            if (pending) {
+                const dropped = pending;
+                pending = null;
+                onFailure(dropped);
+            }
+            const active = running;
+            if (!active || await wait(active, graceMs))
+                return;
+            control?.abort();
+            await wait(active, settleMs);
+        },
         /** Alert command runs skipped because a newer event replaced a waiting one. */
         replaced: () => replaced,
     };
@@ -11582,8 +12565,9 @@ function createAlertRunner(run, onFailure) {
 "watch/alert.js": (module, exports, require) => {
 "use strict";
 exports.__esModule = true;
-exports.ALERT_GRACE_MS = exports.ALERT_KILL_MS = exports.ALERT_TIMEOUT_MS = void 0;
+exports.ALERT_CLEANUP_MS = exports.ALERT_GRACE_MS = exports.ALERT_KILL_MS = exports.ALERT_TIMEOUT_MS = void 0;
 exports.reapAlertGroups = reapAlertGroups;
+exports.alertCleanupDone = alertCleanupDone;
 exports.runAlertCommand = runAlertCommand;
 // Runs the operator's --alert-command for a canary event: a fixed absolute executable,
 // no shell, no arguments, a minimal environment, the event JSON on stdin and a timeout.
@@ -11602,12 +12586,23 @@ exports.runAlertCommand = runAlertCommand;
 // On Windows there are no process groups: a timed-out command's process tree is killed with
 // System32 taskkill /T /F, but children of a command that has already exited cannot be found
 // by tree and are not killed. Alert commands on Windows must not leave background processes.
+//
+// Shutdown (audit MW102-05): watch stops the alert runner, which cancels a command still
+// running at its deadline through the AbortSignal: the group gets SIGKILL (POSIX) or the tree
+// is killed with taskkill (Windows), and the run settles once that is done. Every taskkill is
+// tracked until it exits (each bounded by TASKKILL_MS): watch waits for them before it returns
+// and the CLI arms its forced-exit deadline only after they finished (alertCleanupDone), since
+// ending this process ends the command itself and orphans the children taskkill must find.
 // spawn is used rather than execFile: execFile does not pass `detached` through, so it
 // cannot create the process group.
 const node_child_process_1 = require("node:child_process");
 exports.ALERT_TIMEOUT_MS = 10_000;
 exports.ALERT_KILL_MS = 12_000;
 exports.ALERT_GRACE_MS = 1_000;
+/** How long watch's shutdown waits for process-tree kills to finish before it returns. */
+exports.ALERT_CLEANUP_MS = 1_000;
+/** A taskkill that has not exited by then is abandoned (and killed). */
+const TASKKILL_MS = 10_000;
 // Process groups of alert commands that may still have members (POSIX).
 const liveGroups = new Set();
 const killGroup = (pid) => {
@@ -11622,18 +12617,51 @@ function reapAlertGroups() {
     for (const pid of [...liveGroups])
         killGroup(pid);
 }
+// Windows process-tree kills (taskkill) that have not finished yet.
+const treeKills = new Set();
 /** Kills a Windows process tree with System32 taskkill: absolute path, no shell, bounded. */
 function killTree(pid, spawn) {
     const root = process.env.SystemRoot;
     if (!root || !/^[A-Za-z]:[\\/]/.test(root))
-        return;
+        return Promise.resolve();
+    let killer;
+    try {
+        killer = spawn(`${root}\\System32\\taskkill.exe`, ['/T', '/F', '/PID', String(pid)], { shell: false, windowsHide: true, stdio: 'ignore' });
+    }
+    catch {
+        return Promise.resolve(); /* best effort */
+    }
+    const done = new Promise(resolve => {
+        const finish = () => { clearTimeout(timer); treeKills.delete(done); resolve(); };
+        const timer = setTimeout(() => { try {
+            killer.kill();
+        }
+        catch { /* gone */ } finish(); }, TASKKILL_MS);
+        timer.unref?.();
+        killer.once('exit', finish);
+        killer.once('error', finish);
+    });
+    treeKills.add(done);
+    return done;
+}
+/** Resolves once every process-tree kill started so far has finished, or after `ms`. */
+async function alertCleanupDone(ms = TASKKILL_MS) {
+    let timer;
+    let expired = false;
+    const deadline = new Promise(resolve => { timer = setTimeout(() => { expired = true; resolve(); }, ms); });
     try {
-        const killer = spawn(`${root}\\System32\\taskkill.exe`, ['/T', '/F', '/PID', String(pid)], { shell: false, windowsHide: true, stdio: 'ignore' });
-        killer.once('error', () => undefined);
+        while (treeKills.size && !expired)
+            await Promise.race([Promise.all([...treeKills]), deadline]);
+    }
+    finally {
+        clearTimeout(timer);
     }
-    catch { /* best effort */ }
 }
-function runAlertCommand(command, event, spawn = node_child_process_1.spawn, platform = process.platform) {
+/**
+ * Runs the alert command once. Aborting `signal` cancels it: the process group (POSIX) or
+ * tree (Windows) is killed at once, and the run settles with an error after that finished.
+ */
+function runAlertCommand(command, event, spawn = node_child_process_1.spawn, platform = process.platform, signal) {
     return new Promise((resolve, reject) => {
         const env = {};
         for (const name of ['PATH', 'Path', 'SystemRoot', 'SYSTEMROOT', 'HOME', 'USERPROFILE', 'TEMP', 'TMP', 'TMPDIR'])
@@ -11643,17 +12671,25 @@ function runAlertCommand(command, event, spawn = node_child_process_1.spawn, pla
         let settled = false;
         // Filled in after spawn; settle may run before (a synchronous spawn failure).
         const timers = {};
+        let cancel = () => settle(new Error('alert command cancelled'));
+        const onAbort = () => cancel();
         const settle = (error) => {
             if (settled)
                 return;
             settled = true;
             clearTimeout(timers.term);
             clearTimeout(timers.kill);
+            signal?.removeEventListener('abort', onAbort);
             if (error)
                 reject(error);
             else
                 resolve();
         };
+        if (signal?.aborted) {
+            settle(new Error('alert command cancelled'));
+            return;
+        }
+        signal?.addEventListener('abort', onAbort, { once: true });
         let child;
         try {
             child = spawn(command, [], { shell: false, windowsHide: true, env, detached: group, stdio: ['pipe', 'ignore', 'ignore'] });
@@ -11673,7 +12709,8 @@ function runAlertCommand(command, event, spawn = node_child_process_1.spawn, pla
             }
             settle(code === 0 ? undefined : new Error('alert command failed'));
         });
-        const signal = (name) => {
+        /** Signals the command's group (POSIX) or kills its tree (Windows); resolves when that is done. */
+        const kill = (name) => {
             // A negative PID addresses the process group created by detached: true.
             try {
                 if (group && child.pid)
@@ -11681,7 +12718,7 @@ function runAlertCommand(command, event, spawn = node_child_process_1.spawn, pla
                 // Windows has no catchable SIGTERM: terminating the command first would orphan its
                 // children before the tree could be found. Kill the whole tree while the command lives.
                 else if (platform === 'win32' && child.pid)
-                    killTree(child.pid, spawn);
+                    return killTree(child.pid, spawn);
                 else
                     child.kill(name);
             }
@@ -11691,9 +12728,12 @@ function runAlertCommand(command, event, spawn = node_child_process_1.spawn, pla
                 }
                 catch { /* already gone */ }
             }
+            return Promise.resolve();
         };
-        timers.term = setTimeout(() => signal('SIGTERM'), exports.ALERT_TIMEOUT_MS);
-        timers.kill = setTimeout(() => { signal('SIGKILL'); settle(new Error('alert command timed out')); }, exports.ALERT_KILL_MS);
+        // Cancelled (watch is stopping): kill now; the run settles once the tree kill is done.
+        cancel = () => { void kill('SIGKILL').then(() => settle(new Error('alert command cancelled'))); };
+        timers.term = setTimeout(() => { void kill('SIGTERM'); }, exports.ALERT_TIMEOUT_MS);
+        timers.kill = setTimeout(() => { void kill('SIGKILL'); settle(new Error('alert command timed out')); }, exports.ALERT_KILL_MS);
         child.stdin?.on('error', () => undefined);
         child.stdin?.end(`${JSON.stringify({ schema: 1, ...event })}\n`);
     });
@@ -11736,6 +12776,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 exports.__esModule = true;
+exports.CANARY_FILE_LIMIT = void 0;
 exports.canaryConfigPath = canaryConfigPath;
 exports.newCaveatName = newCaveatName;
 exports.newCondition = newCondition;
@@ -11751,9 +12792,12 @@ exports.isCanary = isCanary;
 // innocuous because `lncli printmacaroon` shows it; each canary has its own condition.
 const nodeFs = __importStar(require("node:fs/promises"));
 const node_crypto_1 = require("node:crypto");
+const bounded_file_js_1 = require("../bounded-file.js");
 const words = ['tenant', 'scope', 'profile', 'policy', 'region', 'cluster'];
 const namePattern = /^(?:tenant|scope|profile|policy|region|cluster)-[0-9a-f]{8}$/;
 const conditionPattern = /^[0-9a-f]{16}$/;
+/** Largest canary configuration read: the format holds one short name (about 50 bytes). */
+exports.CANARY_FILE_LIMIT = 4096;
 function canaryConfigPath(registryPath) { return `${registryPath}.canary.json`; }
 function newCaveatName(random = node_crypto_1.randomBytes) {
     const bytes = random(5);
@@ -11781,10 +12825,15 @@ function parse(text) {
         throw new Error('invalid canary configuration');
     return { caveatName: record.caveatName };
 }
+/**
+ * Reads the configuration through the bounded regular-file reader: a protected path or
+ * target (SAFE-02), anything but a regular file, or a file over CANARY_FILE_LIMIT is refused
+ * before its content is read. A missing file is null.
+ */
 async function readCanaryConfig(path, fs = nodeFs) {
     let text;
     try {
-        text = await fs.readFile(path, 'utf8');
+        text = (await (0, bounded_file_js_1.readBoundedFile)(path, fs, exports.CANARY_FILE_LIMIT)).toString('utf8');
     }
     catch (error) {
         if (error.code === 'ENOENT')
@@ -12020,7 +13069,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 exports.__esModule = true;
-exports.UsageStore = exports.UsageFileError = exports.COVERAGE_LIMIT = exports.CANARY_LIMIT = exports.USAGE_LIMIT = void 0;
+exports.UsageStore = exports.UsageFileError = exports.USAGE_FILE_LIMIT = exports.SPAN_LIMIT = exports.COVERAGE_LIMIT = exports.CANARY_LIMIT = exports.USAGE_LIMIT = void 0;
 exports.usagePath = usagePath;
 exports.readUsage = readUsage;
 exports.writeUsage = writeUsage;
@@ -12031,6 +13080,7 @@ exports.writeUsage = writeUsage;
 const nodeFs = __importStar(require("node:fs/promises"));
 const node_crypto_1 = require("node:crypto");
 const node_path_1 = require("node:path");
+const bounded_file_js_1 = require("../bounded-file.js");
 // Callers choose how many distinct (credential, method) pairs exist, so the store is
 // bounded. At capacity the least recently seen record is evicted (O(1): the Map keeps
 // records in recency order), and the eviction is remembered so `recommend` can tell
@@ -12041,6 +13091,22 @@ exports.USAGE_LIMIT = 20_000;
 // one registry serves. At capacity the least recently updated record is dropped.
 exports.CANARY_LIMIT = 1_000;
 exports.COVERAGE_LIMIT = 64;
+/**
+ * Per node, the most recent registered spans (start, end), oldest first and disjoint. They
+ * place the covered time on the clock, so recommend can count only the coverage after a
+ * credential was created. At most this many per node: when more, the oldest is dropped,
+ * which only ever undercounts. Written as the top-level `coverageSpans` (from 1.1.0), apart
+ * from `coverage`, whose records 1.0.1 reads with exactly their original keys.
+ */
+exports.SPAN_LIMIT = 256;
+/**
+ * Largest usage file read, derived from the record caps: 1 KiB per usage record (watch
+ * writes at most about 600 bytes: a method name over 256 bytes is recorded as
+ * /unknown/Unknown), 512 bytes per canary use or coverage record (at most about 200), 64 bytes per
+ * coverage span (55 written) and 4 KiB for the counters. A larger file is refused before it is parsed.
+ */
+exports.USAGE_FILE_LIMIT = 4096 + exports.USAGE_LIMIT * 1024 + (exports.CANARY_LIMIT + exports.COVERAGE_LIMIT) * 512
+    + exports.COVERAGE_LIMIT * exports.SPAN_LIMIT * 64;
 class UsageFileError extends Error {
     code = 3;
     constructor(message) { super(message); this.name = 'UsageFileError'; }
@@ -12070,6 +13136,25 @@ function validCoverage(value) {
         && typeof value.lastEnd === 'string' && time.test(value.lastEnd)
         && count(value.coveredSeconds) && count(value.sessions);
 }
+function validSpans(value) {
+    return object(value) && exactKeys(value, ['nodePubkey', 'spans'])
+        && typeof value.nodePubkey === 'string' && NODE.test(value.nodePubkey)
+        && Array.isArray(value.spans) && value.spans.length <= exports.SPAN_LIMIT
+        && value.spans.every(span => Array.isArray(span) && span.length === 2
+            && span.every(at => typeof at === 'string' && time.test(at)) && Date.parse(span[0]) <= Date.parse(span[1]));
+}
+/** The union of spans: overlapping or touching ones merged, so no time is counted twice. */
+function union(spans) {
+    const merged = [];
+    for (const [from, to] of [...spans].sort((a, b) => a[0] - b[0])) {
+        const last = merged.at(-1);
+        if (last && from <= last[1])
+            last[1] = Math.max(last[1], to);
+        else
+            merged.push([from, to]);
+    }
+    return merged;
+}
 function validRecord(value) {
     if (!value || typeof value !== 'object' || Array.isArray(value))
         return false;
@@ -12108,6 +13193,8 @@ class UsageStore {
     coverages = new Map();
     /** Per node: the instant up to which the current registration was already counted. */
     covering = new Map();
+    /** Per node with a coverage record: its registered spans in ms (see SPAN_LIMIT). */
+    spans = new Map();
     constructor(limit = exports.USAGE_LIMIT) {
         this.limit = limit;
     }
@@ -12138,11 +13225,25 @@ class UsageStore {
         const now = at.toISOString();
         const existing = this.coverages.get(nodePubkey);
         this.coverages.delete(nodePubkey);
-        if (!existing && this.coverages.size >= exports.COVERAGE_LIMIT)
-            this.coverages.delete(this.coverages.keys().next().value);
+        if (!existing && this.coverages.size >= exports.COVERAGE_LIMIT) {
+            const oldest = this.coverages.keys().next().value;
+            this.coverages.delete(oldest);
+            this.spans.delete(oldest);
+        }
         this.coverages.set(nodePubkey, existing ? { ...existing, sessions: existing.sessions + 1, lastEnd: now }
             : { nodePubkey, firstStart: now, lastEnd: now, coveredSeconds: 0, sessions: 1 });
         this.covering.set(nodePubkey, at.getTime());
+        // A new span, starting no earlier than the last one ended (a clock stepping back never
+        // makes spans overlap); one starting exactly where the last ended continues it.
+        const spans = existing ? this.spans.get(nodePubkey) ?? [] : [];
+        const last = spans.at(-1);
+        const from = Math.max(at.getTime(), last?.[1] ?? -Infinity);
+        if (!last || from > last[1]) {
+            spans.push([from, from]);
+            if (spans.length > exports.SPAN_LIMIT)
+                spans.shift();
+        }
+        this.spans.set(nodePubkey, spans);
         this.touch();
     }
     /** Counts the time since the last call as covered, while a registration is current. */
@@ -12160,6 +13261,9 @@ class UsageStore {
             record.coveredSeconds += seconds;
             this.covering.set(nodePubkey, from + seconds * 1_000);
         }
+        const span = this.spans.get(nodePubkey)?.at(-1);
+        if (span && until > span[1])
+            span[1] = until;
         record.lastEnd = at.toISOString();
         this.touch();
     }
@@ -12172,6 +13276,21 @@ class UsageStore {
         const record = this.coverages.get(nodePubkey.toLowerCase());
         return record ? { ...record } : null;
     }
+    /**
+     * Whole seconds of recorded spans after the instant `since` (ms): a lower bound of the time
+     * watch was registered with this node since then. Null when no spans were recorded (a file
+     * written before 1.1.0, or rewritten by 1.0.1).
+     */
+    coveredSince(nodePubkey, since) {
+        const node = nodePubkey.toLowerCase();
+        const spans = this.coverages.has(node) ? this.spans.get(node) : undefined;
+        if (!spans?.length)
+            return null;
+        let ms = 0;
+        for (const [from, to] of spans)
+            ms += Math.max(0, to - Math.max(from, since));
+        return Math.floor(ms / 1_000);
+    }
     key(nodePubkey, credential, rootKeyId, method) {
         return `${nodePubkey}\0${credential}\0${rootKeyId}\0${method}`;
     }
@@ -12250,7 +13369,9 @@ class UsageStore {
             lastEviction: this.lastEviction, droppedAttributions: this.droppedAttributions,
             lastAttributionDrop: this.lastAttributionDropMs === null ? this.lastAttributionDrop
                 : new Date(this.lastAttributionDropMs).toISOString(), canaryUses: [...this.canaryUses.values()],
-            coverage: [...this.coverages.values()], entries: [...this.records.values()] })}\n`;
+            coverage: [...this.coverages.values()], coverageSpans: [...this.spans].map(([nodePubkey, spans]) => ({ nodePubkey,
+                spans: spans.map(([from, to]) => [new Date(from).toISOString(), new Date(to).toISOString()]) })),
+            entries: [...this.records.values()] })}\n`;
     }
     static parse(text, limit = exports.USAGE_LIMIT) {
         let data;
@@ -12273,7 +13394,8 @@ class UsageStore {
             || !count(value.droppedAttributions) || !instant(value.lastAttributionDrop)
             || !Array.isArray(value.entries) || !value.entries.every(validRecord)
             || (value.canaryUses !== undefined && (!Array.isArray(value.canaryUses) || !value.canaryUses.every(validCanaryUse)))
-            || (value.coverage !== undefined && (!Array.isArray(value.coverage) || !value.coverage.every(validCoverage))))
+            || (value.coverage !== undefined && (!Array.isArray(value.coverage) || !value.coverage.every(validCoverage)))
+            || (value.coverageSpans !== undefined && (!Array.isArray(value.coverageSpans) || !value.coverageSpans.every(validSpans))))
             throw new UsageFileError('invalid usage file');
         const store = new UsageStore(limit);
         store.dropped = value.dropped;
@@ -12299,6 +13421,14 @@ class UsageStore {
                 store.coverages.delete(store.coverages.keys().next().value);
             store.coverages.set(item.nodePubkey, { ...item });
         }
+        // Spans are kept only for nodes that kept a coverage record, so they share its bound.
+        for (const item of value.coverageSpans ?? []) {
+            if (store.spans.has(item.nodePubkey))
+                throw new UsageFileError('invalid usage file');
+            if (!store.coverages.has(item.nodePubkey))
+                continue;
+            store.spans.set(item.nodePubkey, union(item.spans.map(([from, to]) => [Date.parse(from), Date.parse(to)])));
+        }
         // Oldest first, so the most recently seen records are kept when a file holds more
         // than this store's limit (for example one written before the limit was lowered).
         const ordered = [...value.entries].sort((a, b) => a.lastSeen < b.lastSeen ? -1 : a.lastSeen > b.lastSeen ? 1 : 0);
@@ -12323,14 +13453,21 @@ function sortRecords(records) {
         || order(a.credential, b.credential) || order(a.method, b.method));
 }
 function usagePath(registryPath) { return `${registryPath}.usage.json`; }
+/**
+ * Reads the usage file through the bounded regular-file reader: a path or target with a
+ * protected name (SAFE-02), anything but a regular file, or a file over USAGE_FILE_LIMIT is
+ * refused before its content is read or parsed. A missing file is an empty store.
+ */
 async function readUsage(path, fs = nodeFs) {
     let text;
     try {
-        text = await fs.readFile(path, 'utf8');
+        text = (await (0, bounded_file_js_1.readBoundedFile)(path, fs, exports.USAGE_FILE_LIMIT)).toString('utf8');
     }
     catch (error) {
         if (error.code === 'ENOENT')
             return new UsageStore();
+        if (error instanceof bounded_file_js_1.BoundedFileError && error.message === 'file too large')
+            throw new UsageFileError('usage file too large');
         throw new UsageFileError('cannot read usage file');
     }
     return UsageStore.parse(text);
@@ -12879,229 +14016,259 @@ function load(id) { if (id === 'grade/lnd-permissions.json') return snapshot; if
         const parts = id.split('/'); parts.pop(); for (const part of name.split('/')) {
           if (part === '..') parts.pop(); else if (part !== '.') parts.push(part);
         } return load(parts.join('/')); }); return module.exports; }
-export const api0_withCancellation = load("cancellation.js").withCancellation;
-export const api0_checkCancellation = load("cancellation.js").checkCancellation;
-export const api0_cancellable = load("cancellation.js").cancellable;
-export const api0_cancellationSignal = load("cancellation.js").cancellationSignal;
-export const api0_cleanup = load("cancellation.js").cleanup;
-export const api0_cleanupOutcome = load("cancellation.js").cleanupOutcome;
-export const api0_Cancelled = load("cancellation.js").Cancelled;
-export const api1_canonicalIp = load("caveat-address.js").canonicalIp;
-export const api1_canonicalCidr = load("caveat-address.js").canonicalCidr;
-export const api2_writeChunks = load("cli.js").writeChunks;
-export const api2_main = load("cli.js").main;
-export const api2_completionStatus = load("cli.js").completionStatus;
-export const api2_WATCH_SUMMARY_WRITE_MS = load("cli.js").WATCH_SUMMARY_WRITE_MS;
-export const api4_run = load("commands/attenuate.js").run;
-export const api4_attenuate = load("commands/attenuate.js").attenuate;
-export const api5_allocateRootKeyId = load("commands/bake/allocate.js").allocateRootKeyId;
-export const api6_run = load("commands/bake/index.js").run;
-export const api6_bake = load("commands/bake/index.js").bake;
-export const api7_reserveOut = load("commands/bake/write-out.js").reserveOut;
-export const api8_handlers = load("commands/handlers.js").handlers;
-export const api9_run = load("commands/inspect.js").run;
-export const api9_inspect = load("commands/inspect.js").inspect;
-export const api10_run = load("commands/inventory.js").run;
-export const api10_inventory = load("commands/inventory.js").inventory;
-export const api11_narrowLabel = load("commands/recommend.js").narrowLabel;
-export const api11_run = load("commands/recommend.js").run;
-export const api11_recommend = load("commands/recommend.js").recommend;
-export const api11_SHORT_OBSERVATION_SECONDS = load("commands/recommend.js").SHORT_OBSERVATION_SECONDS;
-export const api12_aggregateExit = load("commands/respond.js").aggregateExit;
-export const api12_run = load("commands/respond.js").run;
-export const api12_respond = load("commands/respond.js").respond;
-export const api12_ROOT_KEY_0_GUIDANCE = load("commands/respond.js").ROOT_KEY_0_GUIDANCE;
-export const api12_OWN_ON_ROOT_KEY_0 = load("commands/respond.js").OWN_ON_ROOT_KEY_0;
-export const api12_REVOKED_BUT_PRESENT_GUIDANCE = load("commands/respond.js").REVOKED_BUT_PRESENT_GUIDANCE;
-export const api12_BAKING_RISK_GUIDANCE = load("commands/respond.js").BAKING_RISK_GUIDANCE;
-export const api12_CUSTOM_CAVEAT_NOTE = load("commands/respond.js").CUSTOM_CAVEAT_NOTE;
-export const api12_UNKNOWN_GUIDANCE = load("commands/respond.js").UNKNOWN_GUIDANCE;
-export const api13_run = load("commands/revoke.js").run;
-export const api13_revoke = load("commands/revoke.js").revoke;
-export const api14_run = load("commands/rotate.js").run;
-export const api14_rotate = load("commands/rotate.js").rotate;
-export const api15_run = load("commands/scan.js").run;
-export const api16_lockOwnerGone = load("commands/watch.js").lockOwnerGone;
-export const api16_acquireLock = load("commands/watch.js").acquireLock;
-export const api16_run = load("commands/watch.js").run;
-export const api16_stdoutEvents = load("commands/watch.js").stdoutEvents;
-export const api16_watch = load("commands/watch.js").watch;
-export const api16_CANARY_RELOAD_MS = load("commands/watch.js").CANARY_RELOAD_MS;
-export const api17_redactEncodedCredentials = load("credential-recognition.js").redactEncodedCredentials;
-export const api18_macaroonPacketRange = load("decode/index.js").macaroonPacketRange;
-export const api18_macaroonSectionRange = load("decode/index.js").macaroonSectionRange;
-export const api18_parseTimeBefore = load("decode/index.js").parseTimeBefore;
-export const api18_canonicalMacaroonLength = load("decode/index.js").canonicalMacaroonLength;
-export const api18_decodeMacaroon = load("decode/index.js").decodeMacaroon;
-export const api18_macaroonId = load("decode/index.js").macaroonId;
-export const api18_encodeMacaroon = load("decode/index.js").encodeMacaroon;
-export const api18_addFirstPartyCaveat = load("decode/index.js").addFirstPartyCaveat;
-export const api18_timeBeforeCondition = load("decode/index.js").timeBeforeCondition;
-export const api18_validMacaroonIdentifier = load("decode/index.js").validMacaroonIdentifier;
-export const api18_isNwcContainer = load("decode/index.js").isNwcContainer;
-export const api18_decodeNwc = load("decode/index.js").decodeNwc;
-export const api18_DecodeError = load("decode/index.js").DecodeError;
-export const api19_macaroonEnds = load("decode/recognition.js").macaroonEnds;
-export const api20_unsafeNodeDiagnostics = load("environment.js").unsafeNodeDiagnostics;
-export const api21_UsageError = load("errors.js").UsageError;
-export const api21_InputError = load("errors.js").InputError;
-export const api21_DecodeError = load("errors.js").DecodeError;
-export const api21_LndError = load("errors.js").LndError;
-export const api21_LndUncertainError = load("errors.js").LndUncertainError;
-export const api22_grade = load("grade/index.js").grade;
-export const api22_describe = load("grade/index.js").describe;
-export const api23_groupedRuns = load("grouped-runs.js").groupedRuns;
-export const api23_groupedBase64 = load("grouped-runs.js").groupedBase64;
-export const api24_readCredential = load("input/index.js").readCredential;
-export const api24_InputError = load("input/index.js").InputError;
-export const api24_UsageError = load("input/index.js").UsageError;
-export const api25_parseLndconnect = load("input/lndconnect.js").parseLndconnect;
-export const api26_openGrpcStream = load("lnd/grpc.js").openGrpcStream;
-export const api26_MAX_GRPC_MESSAGE = load("lnd/grpc.js").MAX_GRPC_MESSAGE;
-export const api26_STALL_TIMEOUT_MS = load("lnd/grpc.js").STALL_TIMEOUT_MS;
-export const api26_MAX_PENDING_WRITE_BYTES = load("lnd/grpc.js").MAX_PENDING_WRITE_BYTES;
-export const api26_WRITE_OVERHEAD_BYTES = load("lnd/grpc.js").WRITE_OVERHEAD_BYTES;
-export const api26_PING_INTERVAL_MS = load("lnd/grpc.js").PING_INTERVAL_MS;
-export const api26_PING_TIMEOUT_MS = load("lnd/grpc.js").PING_TIMEOUT_MS;
-export const api27_createLndAdapter = load("lnd/index.js").createLndAdapter;
-export const api27_registerMiddleware = load("lnd/index.js").registerMiddleware;
-export const api28_decodeMiddlewareRequest = load("lnd/middleware-proto.js").decodeMiddlewareRequest;
-export const api28_encodeRegistration = load("lnd/middleware-proto.js").encodeRegistration;
-export const api28_encodeFeedback = load("lnd/middleware-proto.js").encodeFeedback;
-export const api28_MAX_MACAROON_BYTES = load("lnd/middleware-proto.js").MAX_MACAROON_BYTES;
-export const api28_MAX_METHOD_BYTES = load("lnd/middleware-proto.js").MAX_METHOD_BYTES;
-export const api28_MAX_CONDITION_BYTES = load("lnd/middleware-proto.js").MAX_CONDITION_BYTES;
-export const api28_UNKNOWN_METHOD = load("lnd/middleware-proto.js").UNKNOWN_METHOD;
-export const api29_endpoint = load("online.js").endpoint;
-export const api29_credentialText = load("online.js").credentialText;
-export const api29_connectionProblem = load("online.js").connectionProblem;
-export const api29_flagProblem = load("online.js").flagProblem;
-export const api29_nodeInfo = load("online.js").nodeInfo;
-export const api29_nodePubkey = load("online.js").nodePubkey;
-export const api29_drift = load("online.js").drift;
-export const api29_samePermissions = load("online.js").samePermissions;
-export const api29_listIds = load("online.js").listIds;
-export const api29_failureDetails = load("online.js").failureDetails;
-export const api29_readBoundedFile = load("online.js").readBoundedFile;
-export const api29_onlineAdapter = load("online.js").onlineAdapter;
-export const api29_shellQuote = load("online.js").shellQuote;
-export const api29_recoveryPath = load("online.js").recoveryPath;
-export const api29_recoveryCommand = load("online.js").recoveryCommand;
-export const api29_inventoryRecoveryCommand = load("online.js").inventoryRecoveryCommand;
-export const api29_readOnlineCredential = load("online.js").readOnlineCredential;
-export const api29_onlineWarnings = load("online.js").onlineWarnings;
-export const api29_LABEL_RULE = load("online.js").LABEL_RULE;
-export const api30_rotatePlanResult = load("output/index.js").rotatePlanResult;
-export const api30_revokePlanResult = load("output/index.js").revokePlanResult;
-export const api30_error = load("output/index.js").error;
-export const api30_warning = load("output/index.js").warning;
-export const api30_renderWatchEvent = load("output/index.js").renderWatchEvent;
-export const api30_formatDuration = load("output/index.js").formatDuration;
-export const api30_revokeConfirmation = load("output/index.js").revokeConfirmation;
-export const api30_writeRevokePrompt = load("output/index.js").writeRevokePrompt;
-export const api30_writeRotateFinishPlan = load("output/index.js").writeRotateFinishPlan;
-export const api30_rotateConfirmation = load("output/index.js").rotateConfirmation;
-export const api30_writeRotatePrompt = load("output/index.js").writeRotatePrompt;
-export const api30_render = load("output/index.js").render;
-export const api30_renderChunks = load("output/index.js").renderChunks;
-export const api30_inventoryResult = load("output/index.js").inventoryResult;
-export const api30_writeRotateStagePlan = load("output/index.js").writeRotateStagePlan;
-export const api31_ruleIdFor = load("output/scan-formats.js").ruleIdFor;
-export const api31_findingSeverity = load("output/scan-formats.js").findingSeverity;
-export const api31_locationOf = load("output/scan-formats.js").locationOf;
-export const api31_fileUri = load("output/scan-formats.js").fileUri;
-export const api31_sarifPieces = load("output/scan-formats.js").sarifPieces;
-export const api31_escapeData = load("output/scan-formats.js").escapeData;
-export const api31_escapeProperty = load("output/scan-formats.js").escapeProperty;
-export const api31_githubLines = load("output/scan-formats.js").githubLines;
-export const api31_SARIF_MAX_RESULTS = load("output/scan-formats.js").SARIF_MAX_RESULTS;
-export const api32_withProcessErrorContext = load("process-error-context.js").withProcessErrorContext;
-export const api32_markMutationSent = load("process-error-context.js").markMutationSent;
-export const api32_internalErrorMessage = load("process-error-context.js").internalErrorMessage;
-export const api33_isProtectedPath = load("protected-path.js").isProtectedPath;
-export const api33_resolveUnprotectedPath = load("protected-path.js").resolveUnprotectedPath;
-export const api34_openRegistry = load("registry/index.js").openRegistry;
-export const api34_replacementProblem = load("registry/index.js").replacementProblem;
-export const api34_replacementLinkProblems = load("registry/index.js").replacementLinkProblems;
-export const api34_hasCustomCaveat = load("registry/index.js").hasCustomCaveat;
-export const api34_RegistryInputError = load("registry/index.js").RegistryInputError;
-export const api34_RegistryUsageError = load("registry/index.js").RegistryUsageError;
-export const api34_Registry = load("registry/index.js").Registry;
-export const api35_validDomain = load("registry/process-domain.js").validDomain;
-export const api35_ownProcessDomain = load("registry/process-domain.js").ownProcessDomain;
-export const api36_buildAccessReview = load("report/access-review.js").buildAccessReview;
-export const api36_csvField = load("report/access-review.js").csvField;
-export const api36_formatAccessReview = load("report/access-review.js").formatAccessReview;
-export const api36_REPORT_FORMATS = load("report/access-review.js").REPORT_FORMATS;
-export const api37_agentConfigCandidates = load("scan/agent-configs.js").agentConfigCandidates;
-export const api37_discoverAgentConfigs = load("scan/agent-configs.js").discoverAgentConfigs;
-export const api37_defaultAgentConfigEnvironment = load("scan/agent-configs.js").defaultAgentConfigEnvironment;
-export const api38_nonLocalPath = load("scan/git-history.js").nonLocalPath;
-export const api38_locateRepository = load("scan/git-history.js").locateRepository;
-export const api38_gitEnvironment = load("scan/git-history.js").gitEnvironment;
-export const api38_assertWorkTree = load("scan/git-history.js").assertWorkTree;
-export const api38_isShallowRepository = load("scan/git-history.js").isShallowRepository;
-export const api38_historyEntries = load("scan/git-history.js").historyEntries;
-export const api38_blobSizes = load("scan/git-history.js").blobSizes;
-export const api38_readBlobs = load("scan/git-history.js").readBlobs;
-export const api38_GitHistoryError = load("scan/git-history.js").GitHistoryError;
-export const api38_MODE_REGULAR = load("scan/git-history.js").MODE_REGULAR;
-export const api38_MODE_SYMLINK = load("scan/git-history.js").MODE_SYMLINK;
-export const api38_MODE_OTHER = load("scan/git-history.js").MODE_OTHER;
-export const api38_GIT_IDLE_TIMEOUT_MS = load("scan/git-history.js").GIT_IDLE_TIMEOUT_MS;
-export const api38_MAX_HISTORY_ENTRIES = load("scan/git-history.js").MAX_HISTORY_ENTRIES;
-export const api38_PINNED_CONFIG = load("scan/git-history.js").PINNED_CONFIG;
-export const api39_parseIgnoreFile = load("scan/ignore.js").parseIgnoreFile;
-export const api39_IgnoreFileError = load("scan/ignore.js").IgnoreFileError;
-export const api40_readBounded = load("scan/index.js").readBounded;
-export const api40_scan = load("scan/index.js").scan;
-export const api40_IgnoreFileError = load("scan/index.js").IgnoreFileError;
-export const api40_GitHistoryError = load("scan/index.js").GitHistoryError;
-export const api40_FINDINGS_LIMIT = load("scan/index.js").FINDINGS_LIMIT;
-export const api40_ALSO_AT_EXAMPLES = load("scan/index.js").ALSO_AT_EXAMPLES;
-export const api40_HISTORY_DEDUP_WORK_LIMIT = load("scan/index.js").HISTORY_DEDUP_WORK_LIMIT;
-export const api40_FindingsLimitError = load("scan/index.js").FindingsLimitError;
-export const api40_SCAN_CONCURRENCY = load("scan/index.js").SCAN_CONCURRENCY;
-export const api41_mcpServerStringSpans = load("scan/mcp-context.js").mcpServerStringSpans;
-export const api41_withinSpans = load("scan/mcp-context.js").withinSpans;
-export const api42_nwcMatches = load("scan/nwc-match.js").nwcMatches;
-export const api43_macaroonHex = load("scan/patterns.js").macaroonHex;
-export const api43_macaroonBase64 = load("scan/patterns.js").macaroonBase64;
-export const api43_lndconnect = load("scan/patterns.js").lndconnect;
-export const api43_nwc = load("scan/patterns.js").nwc;
-export const api44_redactDecoded = load("scan/redact.js").redactDecoded;
-export const api44_redactPath = load("scan/redact.js").redactPath;
-export const api44_collectNwcSecrets = load("scan/redact.js").collectNwcSecrets;
-export const api44_knownSecretRedactor = load("scan/redact.js").knownSecretRedactor;
-export const api44_redactKnownSecrets = load("scan/redact.js").redactKnownSecrets;
-export const api45_Secret = load("secret.js").Secret;
-export const api46_macwardenVersion = load("version.js").macwardenVersion;
-export const api47_createAlertThrottle = load("watch/alert-throttle.js").createAlertThrottle;
-export const api47_createAlertRunner = load("watch/alert-throttle.js").createAlertRunner;
-export const api47_ALERT_WINDOW_MS = load("watch/alert-throttle.js").ALERT_WINDOW_MS;
-export const api47_MAX_TRACKED_CANARIES = load("watch/alert-throttle.js").MAX_TRACKED_CANARIES;
-export const api48_reapAlertGroups = load("watch/alert.js").reapAlertGroups;
-export const api48_runAlertCommand = load("watch/alert.js").runAlertCommand;
-export const api48_ALERT_TIMEOUT_MS = load("watch/alert.js").ALERT_TIMEOUT_MS;
-export const api48_ALERT_KILL_MS = load("watch/alert.js").ALERT_KILL_MS;
-export const api48_ALERT_GRACE_MS = load("watch/alert.js").ALERT_GRACE_MS;
-export const api49_canaryConfigPath = load("watch/canary.js").canaryConfigPath;
-export const api49_newCaveatName = load("watch/canary.js").newCaveatName;
-export const api49_newCondition = load("watch/canary.js").newCondition;
-export const api49_canaryCondition = load("watch/canary.js").canaryCondition;
-export const api49_readCanaryConfig = load("watch/canary.js").readCanaryConfig;
-export const api49_ensureCanaryConfig = load("watch/canary.js").ensureCanaryConfig;
-export const api49_canaryEntries = load("watch/canary.js").canaryEntries;
-export const api49_isCanary = load("watch/canary.js").isCanary;
-export const api50_retryable = load("watch/output-queue.js").retryable;
-export const api50_fdWriter = load("watch/output-queue.js").fdWriter;
-export const api50_createOutputQueue = load("watch/output-queue.js").createOutputQueue;
-export const api50_OUTPUT_LIMIT_BYTES = load("watch/output-queue.js").OUTPUT_LIMIT_BYTES;
-export const api51_usagePath = load("watch/usage.js").usagePath;
-export const api51_readUsage = load("watch/usage.js").readUsage;
-export const api51_writeUsage = load("watch/usage.js").writeUsage;
-export const api51_USAGE_LIMIT = load("watch/usage.js").USAGE_LIMIT;
-export const api51_CANARY_LIMIT = load("watch/usage.js").CANARY_LIMIT;
-export const api51_COVERAGE_LIMIT = load("watch/usage.js").COVERAGE_LIMIT;
-export const api51_UsageFileError = load("watch/usage.js").UsageFileError;
-export const api51_UsageStore = load("watch/usage.js").UsageStore;
+export const api0_readBounded = load("bounded-file.js").readBounded;
+export const api0_readBoundedFile = load("bounded-file.js").readBoundedFile;
+export const api0_assertPlainFile = load("bounded-file.js").assertPlainFile;
+export const api0_BoundedFileError = load("bounded-file.js").BoundedFileError;
+export const api0_DEFAULT_FILE_LIMIT = load("bounded-file.js").DEFAULT_FILE_LIMIT;
+export const api0_LOCK_FILE_LIMIT = load("bounded-file.js").LOCK_FILE_LIMIT;
+export const api1_withCancellation = load("cancellation.js").withCancellation;
+export const api1_checkCancellation = load("cancellation.js").checkCancellation;
+export const api1_cancellable = load("cancellation.js").cancellable;
+export const api1_cancellationSignal = load("cancellation.js").cancellationSignal;
+export const api1_cleanup = load("cancellation.js").cleanup;
+export const api1_cleanupOutcome = load("cancellation.js").cleanupOutcome;
+export const api1_Cancelled = load("cancellation.js").Cancelled;
+export const api2_canonicalIp = load("caveat-address.js").canonicalIp;
+export const api2_canonicalCidr = load("caveat-address.js").canonicalCidr;
+export const api3_writeChunks = load("cli.js").writeChunks;
+export const api3_main = load("cli.js").main;
+export const api3_completionStatus = load("cli.js").completionStatus;
+export const api3_WATCH_SUMMARY_WRITE_MS = load("cli.js").WATCH_SUMMARY_WRITE_MS;
+export const api5_run = load("commands/attenuate.js").run;
+export const api5_attenuate = load("commands/attenuate.js").attenuate;
+export const api6_allocateRootKeyId = load("commands/bake/allocate.js").allocateRootKeyId;
+export const api7_run = load("commands/bake/index.js").run;
+export const api7_bake = load("commands/bake/index.js").bake;
+export const api8_reserveOut = load("commands/bake/write-out.js").reserveOut;
+export const api9_handlers = load("commands/handlers.js").handlers;
+export const api10_inspectResult = load("commands/inspect.js").inspectResult;
+export const api10_run = load("commands/inspect.js").run;
+export const api10_inspect = load("commands/inspect.js").inspect;
+export const api11_run = load("commands/inventory.js").run;
+export const api11_inventory = load("commands/inventory.js").inventory;
+export const api12_narrowLabel = load("commands/recommend.js").narrowLabel;
+export const api12_run = load("commands/recommend.js").run;
+export const api12_recommend = load("commands/recommend.js").recommend;
+export const api12_SHORT_OBSERVATION_SECONDS = load("commands/recommend.js").SHORT_OBSERVATION_SECONDS;
+export const api13_aggregateExit = load("commands/respond.js").aggregateExit;
+export const api13_run = load("commands/respond.js").run;
+export const api13_respond = load("commands/respond.js").respond;
+export const api13_ROOT_KEY_0_GUIDANCE = load("commands/respond.js").ROOT_KEY_0_GUIDANCE;
+export const api13_OWN_ON_ROOT_KEY_0 = load("commands/respond.js").OWN_ON_ROOT_KEY_0;
+export const api13_REVOKED_BUT_PRESENT_GUIDANCE = load("commands/respond.js").REVOKED_BUT_PRESENT_GUIDANCE;
+export const api13_BAKING_RISK_GUIDANCE = load("commands/respond.js").BAKING_RISK_GUIDANCE;
+export const api13_CUSTOM_CAVEAT_NOTE = load("commands/respond.js").CUSTOM_CAVEAT_NOTE;
+export const api13_UNKNOWN_GUIDANCE = load("commands/respond.js").UNKNOWN_GUIDANCE;
+export const api14_run = load("commands/revoke.js").run;
+export const api14_revoke = load("commands/revoke.js").revoke;
+export const api15_run = load("commands/rotate.js").run;
+export const api15_rotate = load("commands/rotate.js").rotate;
+export const api16_run = load("commands/scan.js").run;
+export const api17_run = load("commands/verify.js").run;
+export const api17_verify = load("commands/verify.js").verify;
+export const api17_ROOT_KEY_0_ACCEPTED = load("commands/verify.js").ROOT_KEY_0_ACCEPTED;
+export const api17_CAN_BAKE_ACCEPTED = load("commands/verify.js").CAN_BAKE_ACCEPTED;
+export const api17_CAN_BAKE_ROOT_KEY_0 = load("commands/verify.js").CAN_BAKE_ROOT_KEY_0;
+export const api17_OWN_ROOT_KEY_ACCEPTED = load("commands/verify.js").OWN_ROOT_KEY_ACCEPTED;
+export const api17_REJECTED_INCONCLUSIVE = load("commands/verify.js").REJECTED_INCONCLUSIVE;
+export const api17_CUSTOM_CAVEAT_REJECTED = load("commands/verify.js").CUSTOM_CAVEAT_REJECTED;
+export const api18_scheduleDeadline = load("commands/watch.js").scheduleDeadline;
+export const api18_lockOwnerGone = load("commands/watch.js").lockOwnerGone;
+export const api18_acquireLock = load("commands/watch.js").acquireLock;
+export const api18_run = load("commands/watch.js").run;
+export const api18_stdoutEvents = load("commands/watch.js").stdoutEvents;
+export const api18_watch = load("commands/watch.js").watch;
+export const api18_CANARY_RELOAD_MS = load("commands/watch.js").CANARY_RELOAD_MS;
+export const api18_MAX_TIMER_MS = load("commands/watch.js").MAX_TIMER_MS;
+export const api19_redactEncodedCredentials = load("credential-recognition.js").redactEncodedCredentials;
+export const api20_macaroonEosEnd = load("decode/index.js").macaroonEosEnd;
+export const api20_macaroonPacketRange = load("decode/index.js").macaroonPacketRange;
+export const api20_macaroonSectionRange = load("decode/index.js").macaroonSectionRange;
+export const api20_parseTimeBefore = load("decode/index.js").parseTimeBefore;
+export const api20_canonicalMacaroonForm = load("decode/index.js").canonicalMacaroonForm;
+export const api20_decodeMacaroon = load("decode/index.js").decodeMacaroon;
+export const api20_macaroonId = load("decode/index.js").macaroonId;
+export const api20_encodeMacaroon = load("decode/index.js").encodeMacaroon;
+export const api20_addFirstPartyCaveat = load("decode/index.js").addFirstPartyCaveat;
+export const api20_timeBeforeCondition = load("decode/index.js").timeBeforeCondition;
+export const api20_validMacaroonIdentifier = load("decode/index.js").validMacaroonIdentifier;
+export const api20_isNwcContainer = load("decode/index.js").isNwcContainer;
+export const api20_decodeNwc = load("decode/index.js").decodeNwc;
+export const api20_DecodeError = load("decode/index.js").DecodeError;
+export const api21_macaroonEnds = load("decode/recognition.js").macaroonEnds;
+export const api22_unsafeNodeDiagnostics = load("environment.js").unsafeNodeDiagnostics;
+export const api23_UsageError = load("errors.js").UsageError;
+export const api23_InputError = load("errors.js").InputError;
+export const api23_DecodeError = load("errors.js").DecodeError;
+export const api23_LndError = load("errors.js").LndError;
+export const api23_LndUncertainError = load("errors.js").LndUncertainError;
+export const api24_grade = load("grade/index.js").grade;
+export const api24_gradeFacts = load("grade/index.js").gradeFacts;
+export const api24_describe = load("grade/index.js").describe;
+export const api25_groupedRuns = load("grouped-runs.js").groupedRuns;
+export const api25_groupedBase64 = load("grouped-runs.js").groupedBase64;
+export const api26_readCredential = load("input/index.js").readCredential;
+export const api26_InputError = load("input/index.js").InputError;
+export const api26_UsageError = load("input/index.js").UsageError;
+export const api27_parseLndconnect = load("input/lndconnect.js").parseLndconnect;
+export const api28_openGrpcStream = load("lnd/grpc.js").openGrpcStream;
+export const api28_MAX_GRPC_MESSAGE = load("lnd/grpc.js").MAX_GRPC_MESSAGE;
+export const api28_STALL_TIMEOUT_MS = load("lnd/grpc.js").STALL_TIMEOUT_MS;
+export const api28_MAX_PENDING_WRITE_BYTES = load("lnd/grpc.js").MAX_PENDING_WRITE_BYTES;
+export const api28_WRITE_OVERHEAD_BYTES = load("lnd/grpc.js").WRITE_OVERHEAD_BYTES;
+export const api28_PING_INTERVAL_MS = load("lnd/grpc.js").PING_INTERVAL_MS;
+export const api28_PING_TIMEOUT_MS = load("lnd/grpc.js").PING_TIMEOUT_MS;
+export const api29_createLndAdapter = load("lnd/index.js").createLndAdapter;
+export const api29_registerMiddleware = load("lnd/index.js").registerMiddleware;
+export const api30_decodeMiddlewareRequest = load("lnd/middleware-proto.js").decodeMiddlewareRequest;
+export const api30_encodeRegistration = load("lnd/middleware-proto.js").encodeRegistration;
+export const api30_encodeFeedback = load("lnd/middleware-proto.js").encodeFeedback;
+export const api30_MAX_MACAROON_BYTES = load("lnd/middleware-proto.js").MAX_MACAROON_BYTES;
+export const api30_MAX_METHOD_BYTES = load("lnd/middleware-proto.js").MAX_METHOD_BYTES;
+export const api30_MAX_CONDITION_BYTES = load("lnd/middleware-proto.js").MAX_CONDITION_BYTES;
+export const api30_UNKNOWN_METHOD = load("lnd/middleware-proto.js").UNKNOWN_METHOD;
+export const api31_identityCheck = load("lnd/tls-identity.js").identityCheck;
+export const api32_endpoint = load("online.js").endpoint;
+export const api32_credentialText = load("online.js").credentialText;
+export const api32_connectionProblem = load("online.js").connectionProblem;
+export const api32_flagProblem = load("online.js").flagProblem;
+export const api32_nodeInfo = load("online.js").nodeInfo;
+export const api32_nodePubkey = load("online.js").nodePubkey;
+export const api32_drift = load("online.js").drift;
+export const api32_samePermissions = load("online.js").samePermissions;
+export const api32_listIds = load("online.js").listIds;
+export const api32_failureDetails = load("online.js").failureDetails;
+export const api32_onlineAdapter = load("online.js").onlineAdapter;
+export const api32_shellQuote = load("online.js").shellQuote;
+export const api32_recoveryPath = load("online.js").recoveryPath;
+export const api32_recoveryCommand = load("online.js").recoveryCommand;
+export const api32_inventoryRecoveryCommand = load("online.js").inventoryRecoveryCommand;
+export const api32_readOnlineCredential = load("online.js").readOnlineCredential;
+export const api32_onlineWarnings = load("online.js").onlineWarnings;
+export const api32_LABEL_RULE = load("online.js").LABEL_RULE;
+export const api32_readBoundedFile = load("online.js").readBoundedFile;
+export const api33_rotatePlanResult = load("output/index.js").rotatePlanResult;
+export const api33_revokePlanResult = load("output/index.js").revokePlanResult;
+export const api33_error = load("output/index.js").error;
+export const api33_warning = load("output/index.js").warning;
+export const api33_renderWatchEvent = load("output/index.js").renderWatchEvent;
+export const api33_formatDuration = load("output/index.js").formatDuration;
+export const api33_revokeConfirmation = load("output/index.js").revokeConfirmation;
+export const api33_writeRevokePrompt = load("output/index.js").writeRevokePrompt;
+export const api33_writeRotateFinishPlan = load("output/index.js").writeRotateFinishPlan;
+export const api33_rotateConfirmation = load("output/index.js").rotateConfirmation;
+export const api33_writeRotatePrompt = load("output/index.js").writeRotatePrompt;
+export const api33_render = load("output/index.js").render;
+export const api33_renderChunks = load("output/index.js").renderChunks;
+export const api33_inventoryResult = load("output/index.js").inventoryResult;
+export const api33_writeRotateStagePlan = load("output/index.js").writeRotateStagePlan;
+export const api34_ruleIdFor = load("output/scan-formats.js").ruleIdFor;
+export const api34_findingSeverity = load("output/scan-formats.js").findingSeverity;
+export const api34_locationOf = load("output/scan-formats.js").locationOf;
+export const api34_fileUri = load("output/scan-formats.js").fileUri;
+export const api34_sarifPieces = load("output/scan-formats.js").sarifPieces;
+export const api34_escapeData = load("output/scan-formats.js").escapeData;
+export const api34_escapeProperty = load("output/scan-formats.js").escapeProperty;
+export const api34_githubLines = load("output/scan-formats.js").githubLines;
+export const api34_SARIF_MAX_RESULTS = load("output/scan-formats.js").SARIF_MAX_RESULTS;
+export const api35_withProcessErrorContext = load("process-error-context.js").withProcessErrorContext;
+export const api35_markMutationSent = load("process-error-context.js").markMutationSent;
+export const api35_internalErrorMessage = load("process-error-context.js").internalErrorMessage;
+export const api36_isProtectedPath = load("protected-path.js").isProtectedPath;
+export const api36_resolveUnprotectedPath = load("protected-path.js").resolveUnprotectedPath;
+export const api37_openRegistry = load("registry/index.js").openRegistry;
+export const api37_replacementProblem = load("registry/index.js").replacementProblem;
+export const api37_replacementLinkProblems = load("registry/index.js").replacementLinkProblems;
+export const api37_hasCustomCaveat = load("registry/index.js").hasCustomCaveat;
+export const api37_RegistryInputError = load("registry/index.js").RegistryInputError;
+export const api37_RegistryUsageError = load("registry/index.js").RegistryUsageError;
+export const api37_Registry = load("registry/index.js").Registry;
+export const api38_validDomain = load("registry/process-domain.js").validDomain;
+export const api38_ownProcessDomain = load("registry/process-domain.js").ownProcessDomain;
+export const api39_buildAccessReview = load("report/access-review.js").buildAccessReview;
+export const api39_csvField = load("report/access-review.js").csvField;
+export const api39_formatAccessReview = load("report/access-review.js").formatAccessReview;
+export const api39_REPORT_FORMATS = load("report/access-review.js").REPORT_FORMATS;
+export const api39_LIMITATIONS = load("report/access-review.js").LIMITATIONS;
+export const api40_agentConfigCandidates = load("scan/agent-configs.js").agentConfigCandidates;
+export const api40_discoverAgentConfigs = load("scan/agent-configs.js").discoverAgentConfigs;
+export const api40_defaultAgentConfigEnvironment = load("scan/agent-configs.js").defaultAgentConfigEnvironment;
+export const api41_nonLocalPath = load("scan/git-history.js").nonLocalPath;
+export const api41_locateRepository = load("scan/git-history.js").locateRepository;
+export const api41_gitEnvironment = load("scan/git-history.js").gitEnvironment;
+export const api41_assertWorkTree = load("scan/git-history.js").assertWorkTree;
+export const api41_isShallowRepository = load("scan/git-history.js").isShallowRepository;
+export const api41_historyEntries = load("scan/git-history.js").historyEntries;
+export const api41_blobSizes = load("scan/git-history.js").blobSizes;
+export const api41_readBlobs = load("scan/git-history.js").readBlobs;
+export const api41_GitHistoryError = load("scan/git-history.js").GitHistoryError;
+export const api41_MODE_REGULAR = load("scan/git-history.js").MODE_REGULAR;
+export const api41_MODE_SYMLINK = load("scan/git-history.js").MODE_SYMLINK;
+export const api41_MODE_OTHER = load("scan/git-history.js").MODE_OTHER;
+export const api41_GIT_IDLE_TIMEOUT_MS = load("scan/git-history.js").GIT_IDLE_TIMEOUT_MS;
+export const api41_MAX_HISTORY_ENTRIES = load("scan/git-history.js").MAX_HISTORY_ENTRIES;
+export const api41_PINNED_CONFIG = load("scan/git-history.js").PINNED_CONFIG;
+export const api41_PREFLIGHT_LIMITS = load("scan/git-history.js").PREFLIGHT_LIMITS;
+export const api42_parseIgnoreFile = load("scan/ignore.js").parseIgnoreFile;
+export const api42_IgnoreFileError = load("scan/ignore.js").IgnoreFileError;
+export const api43_scan = load("scan/index.js").scan;
+export const api43_IgnoreFileError = load("scan/index.js").IgnoreFileError;
+export const api43_GitHistoryError = load("scan/index.js").GitHistoryError;
+export const api43_FINDINGS_LIMIT = load("scan/index.js").FINDINGS_LIMIT;
+export const api43_ALSO_AT_EXAMPLES = load("scan/index.js").ALSO_AT_EXAMPLES;
+export const api43_HISTORY_DEDUP_WORK_LIMIT = load("scan/index.js").HISTORY_DEDUP_WORK_LIMIT;
+export const api43_FindingsLimitError = load("scan/index.js").FindingsLimitError;
+export const api43_SCAN_CONCURRENCY = load("scan/index.js").SCAN_CONCURRENCY;
+export const api43_readBounded = load("scan/index.js").readBounded;
+export const api44_mcpServerStringSpans = load("scan/mcp-context.js").mcpServerStringSpans;
+export const api44_withinSpans = load("scan/mcp-context.js").withinSpans;
+export const api44_MAX_DEPTH = load("scan/mcp-context.js").MAX_DEPTH;
+export const api45_nwcMatches = load("scan/nwc-match.js").nwcMatches;
+export const api45_replaceNwc = load("scan/nwc-match.js").replaceNwc;
+export const api45_nwcUnescaped = load("scan/nwc-match.js").nwcUnescaped;
+export const api46_macaroonHex = load("scan/patterns.js").macaroonHex;
+export const api46_macaroonBase64 = load("scan/patterns.js").macaroonBase64;
+export const api46_lndconnect = load("scan/patterns.js").lndconnect;
+export const api46_nwc = load("scan/patterns.js").nwc;
+export const api47_redactDecoded = load("scan/redact.js").redactDecoded;
+export const api47_redactPath = load("scan/redact.js").redactPath;
+export const api47_collectNwcSecrets = load("scan/redact.js").collectNwcSecrets;
+export const api47_knownSecretRedactor = load("scan/redact.js").knownSecretRedactor;
+export const api47_redactKnownSecrets = load("scan/redact.js").redactKnownSecrets;
+export const api48_Secret = load("secret.js").Secret;
+export const api49_macwardenVersion = load("version.js").macwardenVersion;
+export const api50_createAlertThrottle = load("watch/alert-throttle.js").createAlertThrottle;
+export const api50_createAlertRunner = load("watch/alert-throttle.js").createAlertRunner;
+export const api50_ALERT_WINDOW_MS = load("watch/alert-throttle.js").ALERT_WINDOW_MS;
+export const api50_MAX_TRACKED_CANARIES = load("watch/alert-throttle.js").MAX_TRACKED_CANARIES;
+export const api51_reapAlertGroups = load("watch/alert.js").reapAlertGroups;
+export const api51_alertCleanupDone = load("watch/alert.js").alertCleanupDone;
+export const api51_runAlertCommand = load("watch/alert.js").runAlertCommand;
+export const api51_ALERT_TIMEOUT_MS = load("watch/alert.js").ALERT_TIMEOUT_MS;
+export const api51_ALERT_KILL_MS = load("watch/alert.js").ALERT_KILL_MS;
+export const api51_ALERT_GRACE_MS = load("watch/alert.js").ALERT_GRACE_MS;
+export const api51_ALERT_CLEANUP_MS = load("watch/alert.js").ALERT_CLEANUP_MS;
+export const api52_canaryConfigPath = load("watch/canary.js").canaryConfigPath;
+export const api52_newCaveatName = load("watch/canary.js").newCaveatName;
+export const api52_newCondition = load("watch/canary.js").newCondition;
+export const api52_canaryCondition = load("watch/canary.js").canaryCondition;
+export const api52_readCanaryConfig = load("watch/canary.js").readCanaryConfig;
+export const api52_ensureCanaryConfig = load("watch/canary.js").ensureCanaryConfig;
+export const api52_canaryEntries = load("watch/canary.js").canaryEntries;
+export const api52_isCanary = load("watch/canary.js").isCanary;
+export const api52_CANARY_FILE_LIMIT = load("watch/canary.js").CANARY_FILE_LIMIT;
+export const api53_retryable = load("watch/output-queue.js").retryable;
+export const api53_fdWriter = load("watch/output-queue.js").fdWriter;
+export const api53_createOutputQueue = load("watch/output-queue.js").createOutputQueue;
+export const api53_OUTPUT_LIMIT_BYTES = load("watch/output-queue.js").OUTPUT_LIMIT_BYTES;
+export const api54_usagePath = load("watch/usage.js").usagePath;
+export const api54_readUsage = load("watch/usage.js").readUsage;
+export const api54_writeUsage = load("watch/usage.js").writeUsage;
+export const api54_USAGE_LIMIT = load("watch/usage.js").USAGE_LIMIT;
+export const api54_CANARY_LIMIT = load("watch/usage.js").CANARY_LIMIT;
+export const api54_COVERAGE_LIMIT = load("watch/usage.js").COVERAGE_LIMIT;
+export const api54_SPAN_LIMIT = load("watch/usage.js").SPAN_LIMIT;
+export const api54_USAGE_FILE_LIMIT = load("watch/usage.js").USAGE_FILE_LIMIT;
+export const api54_UsageFileError = load("watch/usage.js").UsageFileError;
+export const api54_UsageStore = load("watch/usage.js").UsageStore;