macwarden 1.0.1 → 1.1.0

package/dist/scan/agent-configs.js

@@ -1 +1 @@
-export {api37_agentConfigCandidates as agentConfigCandidates, api37_discoverAgentConfigs as discoverAgentConfigs, api37_defaultAgentConfigEnvironment as defaultAgentConfigEnvironment} from "../runtime.js";
+export {api40_agentConfigCandidates as agentConfigCandidates, api40_discoverAgentConfigs as discoverAgentConfigs, api40_defaultAgentConfigEnvironment as defaultAgentConfigEnvironment} from "../runtime.js";

package/dist/scan/git-history.js

@@ -1 +1 @@
-export {api38_nonLocalPath as nonLocalPath, api38_locateRepository as locateRepository, api38_gitEnvironment as gitEnvironment, api38_assertWorkTree as assertWorkTree, api38_isShallowRepository as isShallowRepository, api38_historyEntries as historyEntries, api38_blobSizes as blobSizes, api38_readBlobs as readBlobs, api38_GitHistoryError as GitHistoryError, api38_MODE_REGULAR as MODE_REGULAR, api38_MODE_SYMLINK as MODE_SYMLINK, api38_MODE_OTHER as MODE_OTHER, api38_GIT_IDLE_TIMEOUT_MS as GIT_IDLE_TIMEOUT_MS, api38_MAX_HISTORY_ENTRIES as MAX_HISTORY_ENTRIES, api38_PINNED_CONFIG as PINNED_CONFIG} from "../runtime.js";
+export {api41_nonLocalPath as nonLocalPath, api41_locateRepository as locateRepository, api41_gitEnvironment as gitEnvironment, api41_assertWorkTree as assertWorkTree, api41_isShallowRepository as isShallowRepository, api41_historyEntries as historyEntries, api41_blobSizes as blobSizes, api41_readBlobs as readBlobs, api41_GitHistoryError as GitHistoryError, api41_MODE_REGULAR as MODE_REGULAR, api41_MODE_SYMLINK as MODE_SYMLINK, api41_MODE_OTHER as MODE_OTHER, api41_GIT_IDLE_TIMEOUT_MS as GIT_IDLE_TIMEOUT_MS, api41_MAX_HISTORY_ENTRIES as MAX_HISTORY_ENTRIES, api41_PINNED_CONFIG as PINNED_CONFIG, api41_PREFLIGHT_LIMITS as PREFLIGHT_LIMITS} from "../runtime.js";

package/dist/scan/ignore.js

@@ -1 +1 @@
-export {api39_parseIgnoreFile as parseIgnoreFile, api39_IgnoreFileError as IgnoreFileError} from "../runtime.js";
+export {api42_parseIgnoreFile as parseIgnoreFile, api42_IgnoreFileError as IgnoreFileError} from "../runtime.js";

package/dist/scan/index.js

@@ -1 +1 @@
-export {api40_readBounded as readBounded, api40_scan as scan, api40_IgnoreFileError as IgnoreFileError, api40_GitHistoryError as GitHistoryError, api40_FINDINGS_LIMIT as FINDINGS_LIMIT, api40_ALSO_AT_EXAMPLES as ALSO_AT_EXAMPLES, api40_HISTORY_DEDUP_WORK_LIMIT as HISTORY_DEDUP_WORK_LIMIT, api40_FindingsLimitError as FindingsLimitError, api40_SCAN_CONCURRENCY as SCAN_CONCURRENCY} from "../runtime.js";
+export {api43_scan as scan, api43_IgnoreFileError as IgnoreFileError, api43_GitHistoryError as GitHistoryError, api43_FINDINGS_LIMIT as FINDINGS_LIMIT, api43_ALSO_AT_EXAMPLES as ALSO_AT_EXAMPLES, api43_HISTORY_DEDUP_WORK_LIMIT as HISTORY_DEDUP_WORK_LIMIT, api43_FindingsLimitError as FindingsLimitError, api43_SCAN_CONCURRENCY as SCAN_CONCURRENCY, api43_readBounded as readBounded} from "../runtime.js";

package/dist/scan/mcp-context.js

@@ -1 +1 @@
-export {api41_mcpServerStringSpans as mcpServerStringSpans, api41_withinSpans as withinSpans} from "../runtime.js";
+export {api44_mcpServerStringSpans as mcpServerStringSpans, api44_withinSpans as withinSpans, api44_MAX_DEPTH as MAX_DEPTH} from "../runtime.js";

package/dist/scan/nwc-match.js

@@ -1 +1 @@
-export {api42_nwcMatches as nwcMatches} from "../runtime.js";
+export {api45_nwcMatches as nwcMatches, api45_replaceNwc as replaceNwc, api45_nwcUnescaped as nwcUnescaped} from "../runtime.js";

package/dist/scan/patterns.js

@@ -1 +1 @@
-export {api43_macaroonHex as macaroonHex, api43_macaroonBase64 as macaroonBase64, api43_lndconnect as lndconnect, api43_nwc as nwc} from "../runtime.js";
+export {api46_macaroonHex as macaroonHex, api46_macaroonBase64 as macaroonBase64, api46_lndconnect as lndconnect, api46_nwc as nwc} from "../runtime.js";

package/dist/scan/redact.js

@@ -1 +1 @@
-export {api44_redactDecoded as redactDecoded, api44_redactPath as redactPath, api44_collectNwcSecrets as collectNwcSecrets, api44_knownSecretRedactor as knownSecretRedactor, api44_redactKnownSecrets as redactKnownSecrets} from "../runtime.js";
+export {api47_redactDecoded as redactDecoded, api47_redactPath as redactPath, api47_collectNwcSecrets as collectNwcSecrets, api47_knownSecretRedactor as knownSecretRedactor, api47_redactKnownSecrets as redactKnownSecrets} from "../runtime.js";

package/dist/secret.js

@@ -1 +1 @@
-export {api45_Secret as Secret} from "./runtime.js";
+export {api48_Secret as Secret} from "./runtime.js";

package/dist/version.js

@@ -1 +1 @@
-export {api46_macwardenVersion as macwardenVersion} from "./runtime.js";
+export {api49_macwardenVersion as macwardenVersion} from "./runtime.js";

package/dist/watch/alert-throttle.js

@@ -1 +1 @@
-export {api47_createAlertThrottle as createAlertThrottle, api47_createAlertRunner as createAlertRunner, api47_ALERT_WINDOW_MS as ALERT_WINDOW_MS, api47_MAX_TRACKED_CANARIES as MAX_TRACKED_CANARIES} from "../runtime.js";
+export {api50_createAlertThrottle as createAlertThrottle, api50_createAlertRunner as createAlertRunner, api50_ALERT_WINDOW_MS as ALERT_WINDOW_MS, api50_MAX_TRACKED_CANARIES as MAX_TRACKED_CANARIES} from "../runtime.js";

package/dist/watch/alert.js

@@ -1 +1 @@
-export {api48_reapAlertGroups as reapAlertGroups, api48_runAlertCommand as runAlertCommand, api48_ALERT_TIMEOUT_MS as ALERT_TIMEOUT_MS, api48_ALERT_KILL_MS as ALERT_KILL_MS, api48_ALERT_GRACE_MS as ALERT_GRACE_MS} from "../runtime.js";
+export {api51_reapAlertGroups as reapAlertGroups, api51_alertCleanupDone as alertCleanupDone, api51_runAlertCommand as runAlertCommand, api51_ALERT_TIMEOUT_MS as ALERT_TIMEOUT_MS, api51_ALERT_KILL_MS as ALERT_KILL_MS, api51_ALERT_GRACE_MS as ALERT_GRACE_MS, api51_ALERT_CLEANUP_MS as ALERT_CLEANUP_MS} from "../runtime.js";

package/dist/watch/canary.js

@@ -1 +1 @@
-export {api49_canaryConfigPath as canaryConfigPath, api49_newCaveatName as newCaveatName, api49_newCondition as newCondition, api49_canaryCondition as canaryCondition, api49_readCanaryConfig as readCanaryConfig, api49_ensureCanaryConfig as ensureCanaryConfig, api49_canaryEntries as canaryEntries, api49_isCanary as isCanary} from "../runtime.js";
+export {api52_canaryConfigPath as canaryConfigPath, api52_newCaveatName as newCaveatName, api52_newCondition as newCondition, api52_canaryCondition as canaryCondition, api52_readCanaryConfig as readCanaryConfig, api52_ensureCanaryConfig as ensureCanaryConfig, api52_canaryEntries as canaryEntries, api52_isCanary as isCanary, api52_CANARY_FILE_LIMIT as CANARY_FILE_LIMIT} from "../runtime.js";

package/dist/watch/output-queue.js

@@ -1 +1 @@
-export {api50_retryable as retryable, api50_fdWriter as fdWriter, api50_createOutputQueue as createOutputQueue, api50_OUTPUT_LIMIT_BYTES as OUTPUT_LIMIT_BYTES} from "../runtime.js";
+export {api53_retryable as retryable, api53_fdWriter as fdWriter, api53_createOutputQueue as createOutputQueue, api53_OUTPUT_LIMIT_BYTES as OUTPUT_LIMIT_BYTES} from "../runtime.js";

package/dist/watch/usage.js

@@ -1 +1 @@
-export {api51_usagePath as usagePath, api51_readUsage as readUsage, api51_writeUsage as writeUsage, api51_USAGE_LIMIT as USAGE_LIMIT, api51_CANARY_LIMIT as CANARY_LIMIT, api51_COVERAGE_LIMIT as COVERAGE_LIMIT, api51_UsageFileError as UsageFileError, api51_UsageStore as UsageStore} from "../runtime.js";
+export {api54_usagePath as usagePath, api54_readUsage as readUsage, api54_writeUsage as writeUsage, api54_USAGE_LIMIT as USAGE_LIMIT, api54_CANARY_LIMIT as CANARY_LIMIT, api54_COVERAGE_LIMIT as COVERAGE_LIMIT, api54_SPAN_LIMIT as SPAN_LIMIT, api54_USAGE_FILE_LIMIT as USAGE_FILE_LIMIT, api54_UsageFileError as UsageFileError, api54_UsageStore as UsageStore} from "../runtime.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "macwarden",
-  "version": "1.0.1",
+  "version": "1.1.0",
   "description": "Lightning credential hygiene for LND: inspect, scan (incl. git history), inventory, bake, revoke, rotate and attenuate macaroons",
   "keywords": [
     "lightning",
@@ -38,7 +38,7 @@
     "provenance": true
   },
   "engines": {
-    "node": ">=22.12.0"
+    "node": "^22.23.2 || ^24.18.1 || >=26.5.1"
   },
   "license": "MIT",
   "scripts": {

package/schemas/output/attenuate.schema.json

@@ -332,6 +332,8 @@
         "root-key-0",
         "trailing-bytes",
         "bad-time-before",
+        "identifier-exceeds-bounds",
+        "caveats-exceed-bounds",
         "unassessed-uri",
         "unassessed-permission",
         "no-permissions",

package/schemas/output/inspect.schema.json

@@ -98,6 +98,8 @@
         "root-key-0",
         "trailing-bytes",
         "bad-time-before",
+        "identifier-exceeds-bounds",
+        "caveats-exceed-bounds",
         "unassessed-uri",
         "unassessed-permission",
         "no-permissions",

package/schemas/output/inventory.schema.json

@@ -555,7 +555,8 @@
                 "credentials",
                 "totals",
                 "controls",
-                "signOff"
+                "signOff",
+                "limitations"
               ],
               "properties": {
                 "schema": {
@@ -616,6 +617,7 @@
                       "replacedBy",
                       "lastUsed",
                       "calls",
+                      "canary",
                       "flags"
                     ],
                     "properties": {
@@ -709,6 +711,34 @@
                         ],
                         "minimum": 0
                       },
+                      "canary": {
+                        "oneOf": [
+                          {
+                            "type": "null"
+                          },
+                          {
+                            "type": "object",
+                            "additionalProperties": false,
+                            "required": [
+                              "uses",
+                              "firstUse",
+                              "lastUse"
+                            ],
+                            "properties": {
+                              "uses": {
+                                "type": "integer",
+                                "minimum": 1
+                              },
+                              "firstUse": {
+                                "type": "string"
+                              },
+                              "lastUse": {
+                                "type": "string"
+                              }
+                            }
+                          }
+                        ]
+                      },
                       "flags": {
                         "type": "array",
                         "uniqueItems": true,
@@ -866,6 +896,10 @@
                       "type": "null"
                     }
                   }
+                },
+                "limitations": {
+                  "type": "string",
+                  "minLength": 1
                 }
               }
             }

package/schemas/output/recommend.schema.json

@@ -0,0 +1,471 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/ZilverZtream/macwarden/blob/main/schemas/output/recommend.schema.json",
+  "title": "macwarden recommend --json output",
+  "description": "Normative source: SPEC.md, Commands > 9. recommend. A recommendation only; commands is empty whenever the evidence does not support narrowing.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema",
+    "command",
+    "ok",
+    "warnings",
+    "result",
+    "error"
+  ],
+  "properties": {
+    "schema": {
+      "const": 1
+    },
+    "command": {
+      "const": "recommend"
+    },
+    "ok": {
+      "type": "boolean"
+    },
+    "warnings": {
+      "type": "array",
+      "items": {
+        "$ref": "#/$defs/warning"
+      }
+    },
+    "result": {
+      "oneOf": [
+        {
+          "type": "null"
+        },
+        {
+          "$ref": "#/$defs/result"
+        }
+      ]
+    },
+    "error": {
+      "oneOf": [
+        {
+          "type": "null"
+        },
+        {
+          "$ref": "#/$defs/error"
+        }
+      ]
+    }
+  },
+  "allOf": [
+    {
+      "if": {
+        "properties": {
+          "ok": {
+            "const": true
+          }
+        },
+        "required": [
+          "ok"
+        ]
+      },
+      "then": {
+        "properties": {
+          "result": {
+            "$ref": "#/$defs/result"
+          },
+          "error": {
+            "type": "null"
+          }
+        }
+      },
+      "else": {
+        "properties": {
+          "result": {
+            "type": "null"
+          },
+          "error": {
+            "$ref": "#/$defs/error"
+          }
+        }
+      }
+    }
+  ],
+  "$defs": {
+    "error": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "code",
+        "step",
+        "message"
+      ],
+      "properties": {
+        "code": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 8
+        },
+        "step": {
+          "type": [
+            "string",
+            "null"
+          ],
+          "minLength": 1
+        },
+        "message": {
+          "type": "string",
+          "minLength": 1
+        }
+      }
+    },
+    "warning": {
+      "oneOf": [
+        {
+          "type": "string",
+          "minLength": 1
+        },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "code",
+            "message"
+          ],
+          "properties": {
+            "code": {
+              "type": "string",
+              "minLength": 1
+            },
+            "message": {
+              "type": "string"
+            }
+          }
+        }
+      ]
+    },
+    "rootKeyId": {
+      "type": "string",
+      "pattern": "^(0|[1-9][0-9]{0,19})$",
+      "description": "uint64 as a canonical decimal string (range up to 18446744073709551615 is enforced by the decoder)."
+    },
+    "grade": {
+      "enum": [
+        "ADMIN",
+        "SPEND",
+        "OPERATE",
+        "RECEIVE",
+        "READ",
+        "UNASSESSED"
+      ]
+    },
+    "registryEntry": {
+      "type": "object",
+      "required": [
+        "nodePubkey",
+        "label",
+        "rootKeyId",
+        "permissions",
+        "caveats",
+        "grade",
+        "fingerprint",
+        "outPath",
+        "createdAt",
+        "verified",
+        "status",
+        "revokedAt",
+        "revokeEvidence",
+        "replaces",
+        "replacedBy"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "nodePubkey": {
+          "type": "string",
+          "pattern": "^0[23][0-9a-fA-F]{64}$"
+        },
+        "label": {
+          "type": [
+            "string",
+            "null"
+          ],
+          "pattern": "^[A-Za-z][A-Za-z0-9._-]{0,63}$"
+        },
+        "rootKeyId": {
+          "type": "string",
+          "pattern": "^(0|[1-9][0-9]*)$"
+        },
+        "permissions": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "caveats": {
+          "type": "array",
+          "items": {
+            "type": "object"
+          }
+        },
+        "grade": {
+          "enum": [
+            "ADMIN",
+            "SPEND",
+            "OPERATE",
+            "RECEIVE",
+            "READ",
+            "UNASSESSED"
+          ]
+        },
+        "fingerprint": {
+          "type": [
+            "string",
+            "null"
+          ],
+          "pattern": "^fp:[0-9a-f]{16}$"
+        },
+        "outPath": {
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "createdAt": {
+          "type": "string"
+        },
+        "verified": {
+          "type": "boolean"
+        },
+        "status": {
+          "enum": [
+            "active",
+            "revoked"
+          ]
+        },
+        "revokedAt": {
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "revokeEvidence": {
+          "enum": [
+            "rejected",
+            "by-id-only",
+            null
+          ]
+        },
+        "replaces": {
+          "type": [
+            "string",
+            "null"
+          ],
+          "pattern": "^(0|[1-9][0-9]*)$"
+        },
+        "replacedBy": {
+          "type": [
+            "string",
+            "null"
+          ],
+          "pattern": "^(0|[1-9][0-9]*)$"
+        }
+      },
+      "allOf": [
+        {
+          "if": {
+            "properties": {
+              "fingerprint": {
+                "type": "null"
+              }
+            }
+          },
+          "then": {
+            "properties": {
+              "verified": {
+                "const": false
+              },
+              "outPath": {
+                "type": "null"
+              }
+            }
+          }
+        }
+      ]
+    },
+    "result": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "node",
+        "selector",
+        "label",
+        "rootKeyId",
+        "credentials",
+        "observed",
+        "unmapped",
+        "recommended",
+        "recommendedUris",
+        "current",
+        "unneeded",
+        "observation",
+        "commands"
+      ],
+      "properties": {
+        "node": {
+          "type": "string",
+          "pattern": "^0[23][0-9a-fA-F]{64}$"
+        },
+        "selector": {
+          "type": "string",
+          "minLength": 1
+        },
+        "label": {
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "rootKeyId": {
+          "oneOf": [
+            {
+              "type": "null"
+            },
+            {
+              "$ref": "#/$defs/rootKeyId"
+            }
+          ]
+        },
+        "credentials": {
+          "type": "array",
+          "uniqueItems": true,
+          "items": {
+            "type": "string",
+            "pattern": "^id:[0-9a-f]{16}$"
+          }
+        },
+        "observed": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+              "method",
+              "calls",
+              "lastUsed",
+              "permissions"
+            ],
+            "properties": {
+              "method": {
+                "type": "string"
+              },
+              "calls": {
+                "type": "integer",
+                "minimum": 0
+              },
+              "lastUsed": {
+                "type": "string"
+              },
+              "permissions": {
+                "type": "array",
+                "uniqueItems": true,
+                "items": {
+                  "type": "string"
+                }
+              }
+            }
+          }
+        },
+        "unmapped": {
+          "type": "array",
+          "uniqueItems": true,
+          "items": {
+            "type": "string"
+          }
+        },
+        "recommended": {
+          "type": "array",
+          "uniqueItems": true,
+          "items": {
+            "type": "string"
+          }
+        },
+        "recommendedUris": {
+          "type": "array",
+          "uniqueItems": true,
+          "items": {
+            "type": "string",
+            "pattern": "^uri:"
+          }
+        },
+        "current": {
+          "oneOf": [
+            {
+              "type": "null"
+            },
+            {
+              "type": "array",
+              "uniqueItems": true,
+              "items": {
+                "type": "string"
+              }
+            }
+          ]
+        },
+        "unneeded": {
+          "type": "array",
+          "uniqueItems": true,
+          "items": {
+            "type": "string"
+          }
+        },
+        "observation": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "seconds",
+            "since",
+            "until",
+            "sessions",
+            "short",
+            "accepted"
+          ],
+          "properties": {
+            "seconds": {
+              "oneOf": [
+                {
+                  "type": "null"
+                },
+                {
+                  "type": "integer",
+                  "minimum": 0
+                }
+              ]
+            },
+            "since": {
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "until": {
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "sessions": {
+              "type": "integer",
+              "minimum": 0
+            },
+            "short": {
+              "type": "boolean"
+            },
+            "accepted": {
+              "type": "boolean"
+            }
+          }
+        },
+        "commands": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "minLength": 1
+          }
+        }
+      }
+    }
+  }
+}

package/schemas/output/scan.schema.json

@@ -80,6 +80,8 @@
         "root-key-0",
         "trailing-bytes",
         "bad-time-before",
+        "identifier-exceeds-bounds",
+        "caveats-exceed-bounds",
         "unassessed-uri",
         "unassessed-permission",
         "no-permissions",