macwarden 1.0.1 → 1.1.1

package/dist/scan/agent-configs.js

@@ -1 +1 @@
-export {api37_agentConfigCandidates as agentConfigCandidates, api37_discoverAgentConfigs as discoverAgentConfigs, api37_defaultAgentConfigEnvironment as defaultAgentConfigEnvironment} from "../runtime.js";
+export {api43_agentConfigCandidates as agentConfigCandidates, api43_discoverAgentConfigs as discoverAgentConfigs, api43_defaultAgentConfigEnvironment as defaultAgentConfigEnvironment} from "../runtime.js";

package/dist/scan/git-history.js

@@ -1 +1 @@
-export {api38_nonLocalPath as nonLocalPath, api38_locateRepository as locateRepository, api38_gitEnvironment as gitEnvironment, api38_assertWorkTree as assertWorkTree, api38_isShallowRepository as isShallowRepository, api38_historyEntries as historyEntries, api38_blobSizes as blobSizes, api38_readBlobs as readBlobs, api38_GitHistoryError as GitHistoryError, api38_MODE_REGULAR as MODE_REGULAR, api38_MODE_SYMLINK as MODE_SYMLINK, api38_MODE_OTHER as MODE_OTHER, api38_GIT_IDLE_TIMEOUT_MS as GIT_IDLE_TIMEOUT_MS, api38_MAX_HISTORY_ENTRIES as MAX_HISTORY_ENTRIES, api38_PINNED_CONFIG as PINNED_CONFIG} from "../runtime.js";
+export {api44_nonLocalPath as nonLocalPath, api44_locateRepository as locateRepository, api44_gitEnvironment as gitEnvironment, api44_assertWorkTree as assertWorkTree, api44_isShallowRepository as isShallowRepository, api44_historyEntries as historyEntries, api44_blobSizes as blobSizes, api44_readBlobs as readBlobs, api44_GitHistoryError as GitHistoryError, api44_MODE_REGULAR as MODE_REGULAR, api44_MODE_SYMLINK as MODE_SYMLINK, api44_MODE_OTHER as MODE_OTHER, api44_GIT_IDLE_TIMEOUT_MS as GIT_IDLE_TIMEOUT_MS, api44_MAX_HISTORY_ENTRIES as MAX_HISTORY_ENTRIES, api44_PINNED_CONFIG as PINNED_CONFIG, api44_PREFLIGHT_LIMITS as PREFLIGHT_LIMITS} from "../runtime.js";

package/dist/scan/ignore.js

@@ -1 +1 @@
-export {api39_parseIgnoreFile as parseIgnoreFile, api39_IgnoreFileError as IgnoreFileError} from "../runtime.js";
+export {api45_parseIgnoreFile as parseIgnoreFile, api45_IgnoreFileError as IgnoreFileError} from "../runtime.js";

package/dist/scan/index.js

@@ -1 +1 @@
-export {api40_readBounded as readBounded, api40_scan as scan, api40_IgnoreFileError as IgnoreFileError, api40_GitHistoryError as GitHistoryError, api40_FINDINGS_LIMIT as FINDINGS_LIMIT, api40_ALSO_AT_EXAMPLES as ALSO_AT_EXAMPLES, api40_HISTORY_DEDUP_WORK_LIMIT as HISTORY_DEDUP_WORK_LIMIT, api40_FindingsLimitError as FindingsLimitError, api40_SCAN_CONCURRENCY as SCAN_CONCURRENCY} from "../runtime.js";
+export {api46_scan as scan, api46_IgnoreFileError as IgnoreFileError, api46_GitHistoryError as GitHistoryError, api46_CANDIDATE_LIMIT as CANDIDATE_LIMIT, api46_FINDINGS_LIMIT as FINDINGS_LIMIT, api46_ALSO_AT_EXAMPLES as ALSO_AT_EXAMPLES, api46_HISTORY_DEDUP_WORK_LIMIT as HISTORY_DEDUP_WORK_LIMIT, api46_FindingsLimitError as FindingsLimitError, api46_SCAN_CONCURRENCY as SCAN_CONCURRENCY, api46_readBounded as readBounded, api46_SCAN_OPEN_FLAGS as SCAN_OPEN_FLAGS} from "../runtime.js";

package/dist/scan/mcp-context.js

@@ -1 +1 @@
-export {api41_mcpServerStringSpans as mcpServerStringSpans, api41_withinSpans as withinSpans} from "../runtime.js";
+export {api47_mcpServerStringSpans as mcpServerStringSpans, api47_withinSpans as withinSpans, api47_MAX_DEPTH as MAX_DEPTH} from "../runtime.js";

package/dist/scan/nwc-match.js

@@ -1 +1 @@
-export {api42_nwcMatches as nwcMatches} from "../runtime.js";
+export {api48_nwcMatches as nwcMatches, api48_replaceNwc as replaceNwc, api48_nwcUnescaped as nwcUnescaped} from "../runtime.js";

package/dist/scan/patterns.js

@@ -1 +1 @@
-export {api43_macaroonHex as macaroonHex, api43_macaroonBase64 as macaroonBase64, api43_lndconnect as lndconnect, api43_nwc as nwc} from "../runtime.js";
+export {api49_macaroonHex as macaroonHex, api49_macaroonBase64 as macaroonBase64, api49_lndconnect as lndconnect, api49_nwc as nwc} from "../runtime.js";

package/dist/scan/redact.js

@@ -1 +1 @@
-export {api44_redactDecoded as redactDecoded, api44_redactPath as redactPath, api44_collectNwcSecrets as collectNwcSecrets, api44_knownSecretRedactor as knownSecretRedactor, api44_redactKnownSecrets as redactKnownSecrets} from "../runtime.js";
+export {api50_redactDecoded as redactDecoded, api50_redactPath as redactPath, api50_collectNwcSecrets as collectNwcSecrets, api50_knownSecretRedactor as knownSecretRedactor, api50_redactKnownSecrets as redactKnownSecrets} from "../runtime.js";

package/dist/secret.js

@@ -1 +1 @@
-export {api45_Secret as Secret} from "./runtime.js";
+export {api51_Secret as Secret} from "./runtime.js";

package/dist/version.js

@@ -1 +1 @@
-export {api46_macwardenVersion as macwardenVersion} from "./runtime.js";
+export {api52_macwardenVersion as macwardenVersion} from "./runtime.js";

package/dist/watch/alert-throttle.js

@@ -1 +1 @@
-export {api47_createAlertThrottle as createAlertThrottle, api47_createAlertRunner as createAlertRunner, api47_ALERT_WINDOW_MS as ALERT_WINDOW_MS, api47_MAX_TRACKED_CANARIES as MAX_TRACKED_CANARIES} from "../runtime.js";
+export {api53_createAlertThrottle as createAlertThrottle, api53_createAlertRunner as createAlertRunner, api53_ALERT_WINDOW_MS as ALERT_WINDOW_MS, api53_MAX_TRACKED_CANARIES as MAX_TRACKED_CANARIES} from "../runtime.js";

package/dist/watch/alert.js

@@ -1 +1 @@
-export {api48_reapAlertGroups as reapAlertGroups, api48_runAlertCommand as runAlertCommand, api48_ALERT_TIMEOUT_MS as ALERT_TIMEOUT_MS, api48_ALERT_KILL_MS as ALERT_KILL_MS, api48_ALERT_GRACE_MS as ALERT_GRACE_MS} from "../runtime.js";
+export {api54_reapAlertGroups as reapAlertGroups, api54_alertCleanupDone as alertCleanupDone, api54_runAlertCommand as runAlertCommand, api54_ALERT_TIMEOUT_MS as ALERT_TIMEOUT_MS, api54_ALERT_KILL_MS as ALERT_KILL_MS, api54_ALERT_GRACE_MS as ALERT_GRACE_MS, api54_ALERT_CLEANUP_MS as ALERT_CLEANUP_MS} from "../runtime.js";

package/dist/watch/canary.js

@@ -1 +1 @@
-export {api49_canaryConfigPath as canaryConfigPath, api49_newCaveatName as newCaveatName, api49_newCondition as newCondition, api49_canaryCondition as canaryCondition, api49_readCanaryConfig as readCanaryConfig, api49_ensureCanaryConfig as ensureCanaryConfig, api49_canaryEntries as canaryEntries, api49_isCanary as isCanary} from "../runtime.js";
+export {api55_canaryConfigPath as canaryConfigPath, api55_newCaveatName as newCaveatName, api55_newCondition as newCondition, api55_canaryCondition as canaryCondition, api55_readCanaryConfig as readCanaryConfig, api55_ensureCanaryConfig as ensureCanaryConfig, api55_canaryEntries as canaryEntries, api55_isCanary as isCanary, api55_CANARY_FILE_LIMIT as CANARY_FILE_LIMIT} from "../runtime.js";

package/dist/watch/output-queue.js

@@ -1 +1 @@
-export {api50_retryable as retryable, api50_fdWriter as fdWriter, api50_createOutputQueue as createOutputQueue, api50_OUTPUT_LIMIT_BYTES as OUTPUT_LIMIT_BYTES} from "../runtime.js";
+export {api56_retryable as retryable, api56_fdWriter as fdWriter, api56_createOutputQueue as createOutputQueue, api56_OUTPUT_LIMIT_BYTES as OUTPUT_LIMIT_BYTES} from "../runtime.js";

package/dist/watch/usage.js

@@ -1 +1 @@
-export {api51_usagePath as usagePath, api51_readUsage as readUsage, api51_writeUsage as writeUsage, api51_USAGE_LIMIT as USAGE_LIMIT, api51_CANARY_LIMIT as CANARY_LIMIT, api51_COVERAGE_LIMIT as COVERAGE_LIMIT, api51_UsageFileError as UsageFileError, api51_UsageStore as UsageStore} from "../runtime.js";
+export {api57_usagePath as usagePath, api57_readUsage as readUsage, api57_writeUsage as writeUsage, api57_USAGE_LIMIT as USAGE_LIMIT, api57_CANARY_LIMIT as CANARY_LIMIT, api57_COVERAGE_LIMIT as COVERAGE_LIMIT, api57_SPAN_LIMIT as SPAN_LIMIT, api57_USAGE_FILE_LIMIT as USAGE_FILE_LIMIT, api57_UsageFileError as UsageFileError, api57_UsageStore as UsageStore} from "../runtime.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "macwarden",
-  "version": "1.0.1",
+  "version": "1.1.1",
   "description": "Lightning credential hygiene for LND: inspect, scan (incl. git history), inventory, bake, revoke, rotate and attenuate macaroons",
   "keywords": [
     "lightning",
@@ -38,7 +38,7 @@
     "provenance": true
   },
   "engines": {
-    "node": ">=22.12.0"
+    "node": "^22.23.2 || ^24.18.1 || >=26.5.1"
   },
   "license": "MIT",
   "scripts": {

package/schemas/output/attenuate.schema.json

@@ -36,6 +36,9 @@
         },
         {
           "$ref": "#/$defs/result"
+        },
+        {
+          "$ref": "#/$defs/help"
         }
       ]
     },
@@ -65,7 +68,14 @@
       "then": {
         "properties": {
           "result": {
-            "$ref": "#/$defs/result"
+            "oneOf": [
+              {
+                "$ref": "#/$defs/result"
+              },
+              {
+                "$ref": "#/$defs/help"
+              }
+            ]
           },
           "error": {
             "type": "null"
@@ -332,12 +342,31 @@
         "root-key-0",
         "trailing-bytes",
         "bad-time-before",
+        "identifier-exceeds-bounds",
+        "caveats-exceed-bounds",
         "unassessed-uri",
         "unassessed-permission",
         "no-permissions",
         "preimage-exposure"
       ]
     },
+    "help": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "usage"
+      ],
+      "properties": {
+        "usage": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "type": "string",
+            "pattern": "^macwarden attenuate "
+          }
+        }
+      }
+    },
     "result": {
       "type": "object",
       "additionalProperties": false,

package/schemas/output/bake.schema.json

@@ -36,6 +36,9 @@
         },
         {
           "$ref": "#/$defs/result"
+        },
+        {
+          "$ref": "#/$defs/help"
         }
       ]
     },
@@ -65,7 +68,14 @@
       "then": {
         "properties": {
           "result": {
-            "$ref": "#/$defs/result"
+            "oneOf": [
+              {
+                "$ref": "#/$defs/result"
+              },
+              {
+                "$ref": "#/$defs/help"
+              }
+            ]
           },
           "error": {
             "type": "null"
@@ -285,6 +295,23 @@
         }
       ]
     },
+    "help": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "usage"
+      ],
+      "properties": {
+        "usage": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "type": "string",
+            "pattern": "^macwarden bake "
+          }
+        }
+      }
+    },
     "result": {
       "oneOf": [
         {

package/schemas/output/inspect.schema.json

@@ -15,7 +15,7 @@
       "uniqueItems": true
     },
     "result": {
-      "oneOf": [{ "type": "null" }, { "$ref": "#/$defs/result" }, { "$ref": "#/$defs/nwcResult" }]
+      "oneOf": [{ "type": "null" }, { "$ref": "#/$defs/result" }, { "$ref": "#/$defs/nwcResult" }, { "$ref": "#/$defs/help" }]
     },
     "error": {
       "oneOf": [{ "type": "null" }, { "$ref": "#/$defs/error" }]
@@ -26,7 +26,7 @@
       "if": { "properties": { "ok": { "const": true } }, "required": ["ok"] },
       "then": {
         "properties": {
-          "result": { "oneOf": [{ "$ref": "#/$defs/result" }, { "$ref": "#/$defs/nwcResult" }] },
+          "result": { "oneOf": [{ "$ref": "#/$defs/result" }, { "$ref": "#/$defs/nwcResult" }, { "$ref": "#/$defs/help" }] },
           "error": { "type": "null" }
         }
       },
@@ -39,6 +39,11 @@
     }
   ],
   "$defs": {
+    "help": {
+      "description": "macwarden inspect --help --json: the command synopsis lines (SPEC.md, Output > Help).",
+      "type": "object", "additionalProperties": false, "required": ["usage"],
+      "properties": { "usage": { "type": "array", "minItems": 1, "items": { "type": "string", "pattern": "^macwarden inspect " } } }
+    },
     "error": {
       "type": "object",
       "additionalProperties": false,
@@ -98,6 +103,8 @@
         "root-key-0",
         "trailing-bytes",
         "bad-time-before",
+        "identifier-exceeds-bounds",
+        "caveats-exceed-bounds",
         "unassessed-uri",
         "unassessed-permission",
         "no-permissions",

package/schemas/output/inventory.schema.json

@@ -36,6 +36,9 @@
         },
         {
           "$ref": "#/$defs/result"
+        },
+        {
+          "$ref": "#/$defs/help"
         }
       ]
     },
@@ -65,7 +68,14 @@
       "then": {
         "properties": {
           "result": {
-            "$ref": "#/$defs/result"
+            "oneOf": [
+              {
+                "$ref": "#/$defs/result"
+              },
+              {
+                "$ref": "#/$defs/help"
+              }
+            ]
           },
           "error": {
             "type": "null"
@@ -285,6 +295,23 @@
         }
       ]
     },
+    "help": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "usage"
+      ],
+      "properties": {
+        "usage": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "type": "string",
+            "pattern": "^macwarden inventory "
+          }
+        }
+      }
+    },
     "result": {
       "type": "object",
       "additionalProperties": false,
@@ -555,7 +582,8 @@
                 "credentials",
                 "totals",
                 "controls",
-                "signOff"
+                "signOff",
+                "limitations"
               ],
               "properties": {
                 "schema": {
@@ -616,6 +644,7 @@
                       "replacedBy",
                       "lastUsed",
                       "calls",
+                      "canary",
                       "flags"
                     ],
                     "properties": {
@@ -709,6 +738,34 @@
                         ],
                         "minimum": 0
                       },
+                      "canary": {
+                        "oneOf": [
+                          {
+                            "type": "null"
+                          },
+                          {
+                            "type": "object",
+                            "additionalProperties": false,
+                            "required": [
+                              "uses",
+                              "firstUse",
+                              "lastUse"
+                            ],
+                            "properties": {
+                              "uses": {
+                                "type": "integer",
+                                "minimum": 1
+                              },
+                              "firstUse": {
+                                "type": "string"
+                              },
+                              "lastUse": {
+                                "type": "string"
+                              }
+                            }
+                          }
+                        ]
+                      },
                       "flags": {
                         "type": "array",
                         "uniqueItems": true,
@@ -866,6 +923,10 @@
                       "type": "null"
                     }
                   }
+                },
+                "limitations": {
+                  "type": "string",
+                  "minLength": 1
                 }
               }
             }

package/schemas/output/macwarden.schema.json

@@ -0,0 +1,329 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/ZilverZtream/macwarden/blob/main/schemas/output/macwarden.schema.json",
+  "title": "macwarden --json output without a command",
+  "description": "Normative source: SPEC.md, Output > Help and --json. `macwarden --help --json` (ok: true, the general usage lines and every command with its summary), or a usage error before any command is known (ok: false, exit 2, step null).",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema",
+    "command",
+    "ok",
+    "warnings",
+    "result",
+    "error"
+  ],
+  "properties": {
+    "schema": {
+      "const": 1
+    },
+    "command": {
+      "const": null
+    },
+    "ok": {
+      "type": "boolean"
+    },
+    "warnings": {
+      "type": "array",
+      "items": {
+        "$ref": "#/$defs/warning"
+      }
+    },
+    "result": {
+      "oneOf": [
+        {
+          "type": "null"
+        },
+        {
+          "$ref": "#/$defs/result"
+        }
+      ]
+    },
+    "error": {
+      "oneOf": [
+        {
+          "type": "null"
+        },
+        {
+          "$ref": "#/$defs/error"
+        }
+      ]
+    }
+  },
+  "allOf": [
+    {
+      "if": {
+        "properties": {
+          "ok": {
+            "const": true
+          }
+        },
+        "required": [
+          "ok"
+        ]
+      },
+      "then": {
+        "properties": {
+          "result": {
+            "$ref": "#/$defs/result"
+          },
+          "error": {
+            "type": "null"
+          }
+        }
+      },
+      "else": {
+        "properties": {
+          "result": {
+            "type": "null"
+          },
+          "error": {
+            "$ref": "#/$defs/error"
+          }
+        }
+      }
+    }
+  ],
+  "$defs": {
+    "error": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "code",
+        "step",
+        "message"
+      ],
+      "properties": {
+        "code": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 8
+        },
+        "step": {
+          "type": [
+            "string",
+            "null"
+          ],
+          "minLength": 1
+        },
+        "message": {
+          "type": "string",
+          "minLength": 1
+        }
+      }
+    },
+    "warning": {
+      "oneOf": [
+        {
+          "type": "string",
+          "minLength": 1
+        },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "code",
+            "message"
+          ],
+          "properties": {
+            "code": {
+              "type": "string",
+              "minLength": 1
+            },
+            "message": {
+              "type": "string"
+            }
+          }
+        }
+      ]
+    },
+    "rootKeyId": {
+      "type": "string",
+      "pattern": "^(0|[1-9][0-9]{0,19})$",
+      "description": "uint64 as a canonical decimal string (range up to 18446744073709551615 is enforced by the decoder)."
+    },
+    "grade": {
+      "enum": [
+        "ADMIN",
+        "SPEND",
+        "OPERATE",
+        "RECEIVE",
+        "READ",
+        "UNASSESSED"
+      ]
+    },
+    "registryEntry": {
+      "type": "object",
+      "required": [
+        "nodePubkey",
+        "label",
+        "rootKeyId",
+        "permissions",
+        "caveats",
+        "grade",
+        "fingerprint",
+        "outPath",
+        "createdAt",
+        "verified",
+        "status",
+        "revokedAt",
+        "revokeEvidence",
+        "replaces",
+        "replacedBy"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "nodePubkey": {
+          "type": "string",
+          "pattern": "^0[23][0-9a-fA-F]{64}$"
+        },
+        "label": {
+          "type": [
+            "string",
+            "null"
+          ],
+          "pattern": "^[A-Za-z][A-Za-z0-9._-]{0,63}$"
+        },
+        "rootKeyId": {
+          "type": "string",
+          "pattern": "^(0|[1-9][0-9]*)$"
+        },
+        "permissions": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "caveats": {
+          "type": "array",
+          "items": {
+            "type": "object"
+          }
+        },
+        "grade": {
+          "enum": [
+            "ADMIN",
+            "SPEND",
+            "OPERATE",
+            "RECEIVE",
+            "READ",
+            "UNASSESSED"
+          ]
+        },
+        "fingerprint": {
+          "type": [
+            "string",
+            "null"
+          ],
+          "pattern": "^fp:[0-9a-f]{16}$"
+        },
+        "outPath": {
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "createdAt": {
+          "type": "string"
+        },
+        "verified": {
+          "type": "boolean"
+        },
+        "status": {
+          "enum": [
+            "active",
+            "revoked"
+          ]
+        },
+        "revokedAt": {
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "revokeEvidence": {
+          "enum": [
+            "rejected",
+            "by-id-only",
+            null
+          ]
+        },
+        "replaces": {
+          "type": [
+            "string",
+            "null"
+          ],
+          "pattern": "^(0|[1-9][0-9]*)$"
+        },
+        "replacedBy": {
+          "type": [
+            "string",
+            "null"
+          ],
+          "pattern": "^(0|[1-9][0-9]*)$"
+        }
+      },
+      "allOf": [
+        {
+          "if": {
+            "properties": {
+              "fingerprint": {
+                "type": "null"
+              }
+            }
+          },
+          "then": {
+            "properties": {
+              "verified": {
+                "const": false
+              },
+              "outPath": {
+                "type": "null"
+              }
+            }
+          }
+        }
+      ]
+    },
+    "result": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "usage",
+        "commands"
+      ],
+      "properties": {
+        "usage": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "type": "string",
+            "pattern": "^macwarden "
+          }
+        },
+        "commands": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+              "name",
+              "summary"
+            ],
+            "properties": {
+              "name": {
+                "type": "string",
+                "pattern": "^[a-z]+$"
+              },
+              "summary": {
+                "type": "string",
+                "minLength": 1
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}