macwarden 1.1.0 → 1.1.1

package/CHANGELOG.md

@@ -1,5 +1,55 @@
 # Changelog
 
+## 1.1.1 (2026-10-09)
+
+Security release. It fixes every finding of the independent audit of 1.1.0 ([report](docs/reviews/2026-10-09-audit-1.1.0.md)) and of four further internal reviews (threat model, lifecycle logic, scan robustness, output files and environment): 38 issues, each proven by a test that failed on 1.1.0. The most important: a long or punctuation-terminated `lndconnect://` URI could be missed by `scan`; `verify` could report a live credential as conclusively rejected (clock skew, an altered copy); a FIFO could hang `scan`; a new `--out` file was briefly readable under the folder's inherited Windows permissions.
+
+Behaviour changes to note: Windows `--out` writes need the System32 PowerShell; POSIX `--out` is refused on file systems that cannot keep mode `0600` (for example WSL `/mnt/c`); connection settings must come all from flags or all from the environment.
+
+### Fixed
+
+- `recommend` no longer prints narrowing commands from a usage file whose timestamps are not real instants. The usage reader checked only the shape of each time, so a value such as `2026-99-09T12:00:00Z` was accepted, the observation window became NaN, and the 7-day short-observation guard was skipped. The usage file now requires real UTC instants (valid month, day of that month, hour 0 to 23) and ordered pairs (`firstSeen` ≤ `lastSeen`, `firstUse` ≤ `lastUse`, `firstStart` ≤ `lastEnd`, span start ≤ end); a file that breaks either is refused as `invalid usage file`. Independently, `recommend` treats an observation window it cannot compute as invalid: warning `observation-invalid`, and no narrowing command even with `--accept-short-observation`. Registry `createdAt` and `revokedAt` follow the same instant rule, and `watch` keeps each `last…` time from moving backwards when the clock steps back. A usage file written by an earlier `watch` across a backward clock step may now be refused; move it aside and run `watch` again (MW110-05).
+- The usage file reader accepted root key IDs above the uint64 maximum (any 20-digit value, such as `99999999999999999999`), unlike the registry and the usage writer. One canonical uint64 rule (digits only, no leading zero, at most 18446744073709551615) is now shared by the registry, usage and canary records, the canary recorder and the `recommend`, `revoke` and `watch` root key ID checks; a `recommend` selector above the maximum is refused at R1 (MW110-07).
+- `scan --git-history` no longer opens protected files named by repository locations. A `.git` gitfile, `commondir`, alternates entry or config `include`/`includeIf` path whose supplied path or resolved target has a protected file or directory component (such as an include of `../wallet.db`) now fails with exit 3 "git history would open a protected file" before the file is opened and before git starts; location files are read through one checked descriptor with a bounded read (MW110-03).
+- Lock owner records (`<registry>.lock`, `<registry>.watch.lock`) are read through one descriptor bound to the checked regular file and never more than 64 KiB + 1 bytes, in the first owner read and in stale-lock recovery, quarantine and release. Previously a lock changed after its check was read whole by pathname (MW110-04).
+- Releasing the registry lock no longer removes a lock another process created in its place. The release compared only device and inode, which Linux can hand to the next file as soon as the lock is removed; the owner record now carries a random per-acquisition `token`, and release also requires the same birth time and the exact record this acquisition wrote. Lock records without a token, written by earlier versions, are still read.
+- `verify` reports a rejection as conclusive only on evidence from the node: a missing root key ID, a signature mismatch, or LND's own expiry error naming one of the credential's `time-before` caveats (`caveat "time-before <value>" not satisfied: macaroon has expired`, judged by the node's clock). Before, an unspecific rejection became `expired`, `conclusive: true` and exit 0 whenever the operator machine's clock said a `time-before` caveat had passed, so a skewed clock turned a caller-dependent rejection such as an IP lock into false clearance. Such a rejection now stays `other`, `conclusive: false`, exit 1, with a note that the local expiry reading is no proof (MW110-02).
+- `verify` no longer clears a credential on a signature mismatch while its root key ID is still listed. LND answers `signature mismatch` after a root key regeneration, which keeps every root key ID listed, but equally for any altered copy (a flipped byte, a mangled paste, a decoy) of a credential that is still accepted; before, such a copy was reported `conclusive: true`, "its root key was regenerated", exit 0. The mismatch is now conclusive only once ListMacaroonIDs no longer lists the root key ID; otherwise it is `conclusive: false`, exit 1, with guidance that the original may still work and the revoke command (on root key ID 0: regenerate every root key unless already done). After a regeneration you carried out, old files therefore exit 1 with `signature-mismatch`; the incident playbook says so (RT-01).
+- After a real root key regeneration, `verify` answers conclusively again for the exact credential macwarden recorded: a signature mismatch is conclusive (exit 0, "its root key was regenerated") when the file's fingerprint equals the one the registry recorded for that root key ID on this node, because those bytes are known genuine. Altered and unregistered copies stay inconclusive, and the guidance says how to settle them: compare the fingerprint with one recorded before the incident, such as an `inventory --report` export or a backup (RT-01).
+- `verify`'s `canBake` and `respond`'s `bakingRisk` reflect baking authority, not the `ADMIN` grade: `macaroon:generate` or `uri:/lnrpc.Lightning/BakeMacaroon`, or a credential whose permissions could not be fully assessed (grade `UNASSESSED`, unassessed permissions, or a decode past its bounds), which counts as possibly able to bake. Before, a credential holding only `macaroon:write` was reported as able to bake although LND refuses BakeMacaroon with it. Grades are unchanged (MW110-06).
+- `respond` checks ListPermissions for snapshot drift itself while planning, as every online command does, and warns `snapshot-drift`; its own credential therefore needs `info:read` (or the ListPermissions URI) for it. Before, a dry run, or a run with nothing to rotate, never made the check and reported no drift (MW110-09).
+- `<command> --help --json` prints one JSON document, `{"schema":1,"command":"<name>","ok":true,"warnings":[],"result":{"usage":[…]},"error":null}`, carrying the command's synopsis lines, and every command's output schema accepts it. Before, it printed plain usage text although `--json` promises a single JSON document (MW110-10).
+- `macwarden --help --json` prints one JSON document too (`command: null`, `result.usage` with the general usage lines and `result.commands` with every command and its summary). Before, it was refused as an unknown flag. A new schema, `schemas/output/macwarden.schema.json`, covers it and the usage errors printed before any command is known (MW110-10).
+- The README now states `verify`'s exit codes as SPEC defines them: exit 1 while LND accepts the credential or rejects it inconclusively, exit 0 only for a conclusive rejection. It said exit 0 once LND rejects the file (MW110-11).
+- `verify` no longer suggests `macwarden revoke <id>` for macwarden's own root key ID when a rejection is inconclusive (revoke refuses it). It says to bake a new session credential, switch to it and revoke the old root key ID from there; on root key ID 0 it says that only regenerating every root key invalidates the credential (RL-06).
+- `revoke`, `rotate` and `rotate --finish` (and `respond --finish`) no longer dead-end when the old credential's recorded file path now holds another credential, for example after baking or staging the replacement where the app reads its file. Such a file is not the old credential, so the revocation is proven by root key ID only (ListMacaroonIDs no longer lists it) and the stage asks the informed approval used for a missing file. A file carrying the entry's own fingerprint on another root key ID still exits 3, because only an edited registry entry produces it. Before, every revoke, rotate and finish of the old credential exited 3 (RL-01).
+- `rotate` records a replacement as created no earlier than the credential it replaces (the later of now and the original's `createdAt`). With the clock behind the original's recorded creation time (an NTP step back, a resumed VM), rotate wrote a link that `rotate --finish`, `respond` and `inventory` then rejected as registry tampering (exit 3), and respond refused every credential on the node. A link 1.1.0 already wrote this way is accepted when it has exactly the shape rotate writes (the original's permissions and grade, at most a `time-before` caveat) and is at most 24 hours behind; any other backwards link is still tampering, and the message now names `macwarden revoke <replacement id>` to abandon it (RL-02).
+- A malformed recorded expiry duration (`caveats[].requested`, for example `1y` from a hand edit) is refused when the registry is read (exit 3) and checked again at rotate S5, before any lock or LND call. Before, `rotate` parsed it only after BakeMacaroon and exited 7 at S11, leaving an issued root key and an incomplete replacement that `respond` reported until it was revoked. `requested` is accepted only on a `time-before` caveat, and impossible calendar instants in `createdAt`/`revokedAt` (`2026-02-30`, `24:00:00`) are refused instead of rolled over (RL-03).
+- One registry for several nodes works with every command. `revoke <id> --unregistered` revokes this node's ID even when another node's entry (for example an `--unregistered` tombstone) records the same small ID, so the command `verify` prints runs; without `--unregistered` the refusal now says how to proceed. `rotate` and `respond` resolve a label that is active on several nodes against the connected node (a read-only GetInfo) instead of exiting 2 "label is active on several nodes", which failed that credential in every `respond` batch (RL-04).
+- Every command `inventory` prints in its text status now runs as printed (with the same connection and `--registry` flags). `revoke with:` names the root key ID when the label is ambiguous, for example while a rotation is staged (before, `macwarden revoke <label>` exited 2), and is not printed for root key ID 0 or macwarden's own credential. `rotate with:` includes the required `--out`, defaulting to `<label>-<YYYY-MM-DD>.macaroon` next to the recorded file, adds `--allow-admin` for an ADMIN credential, and is printed only for credentials `rotate` accepts (not canaries, the own credential, staged replacements or originals that already have one). Before, `macwarden rotate <label>` exited 2 for the missing `--out` (RL-05).
+- A credential whose `replaces` names an original that was pruned from the registry can be rotated again. `respond` planned `stage` for it while `rotate` refused it at S3 ("no eligible active entry"), so neither command could ever rotate it. Both now use one definition: only an entry replacing an active entry on the same node is a pending replacement (RL-07).
+- An interrupt (SIGINT, SIGTERM, SIGHUP) while `bake` or `rotate` saves the pending allocation, before anything is sent to LND, no longer exits 6 "nothing changed" with an active pending record left in the registry. The record is removed again before exit 6, and likewise before exit 3 when that save fails after its rename. If the registry still holds it, the exit is 7 and the message names the root key ID and `macwarden revoke <id>`. Before, `respond` then reported a false incomplete replacement that "LND may still create" (exit 7), and the bake label stayed blocked (RL-08).
+- `scan` no longer silently drops a valid credential longer than its detector window. Before, an `lndconnect` URI carrying a long valid macaroon (about 50 KB, below the 64 KiB bound) was cut at 65,536 code points, counted as dropped and passed `--fail-on` with exit 0. Every match of up to 262,144 code points (the hex of a 64 KiB credential, its base64 or an `lndconnect` URI with certificate) is now matched whole wherever it starts, and a longer match cut by a window, including an `lndconnect` or NWC URI, is reported as `undecodable-candidate` and counts for `--fail-on`. Scanning stays linear in the line length (MW110-01).
+- Output redaction recognises a credential's raw bytes rendered as UTF-8, as SAFE-01 promises. Before, only the latin1 rendering was recognised: a caveat embedding the UTF-8 rendering of a binary credential (where ill-formed bytes become U+FFFD) was printed by `inspect --json` unchanged, and a credential whose bytes render as multi-byte characters was missed too. The rendering is recognised by the framing that survives lossy decoding, in linear time (MW110-08).
+- `scan` finds an `lndconnect` URI followed by punctuation (a markdown backtick or link `)`, a sentence-final `.`, YAML flow `,` or `}`, a shell `;`) or carrying the standard base64 alphabet. Before, the URI did not parse, was counted as dropped, and the valid credential inside it was hidden, so `--fail-on` passed with exit 0. A URI that does not parse no longer hides the credential it carries: that is reported on its own, decoded or as a candidate (RR-01).
+- `scan` finds a base64 macaroon or an `lndconnect` URI whose slashes are JSON-escaped as `\/` (PHP `json_encode` and some Java and Go encoders). Before, the match stopped at the first backslash: about half of all credentials, those with a `/` early in their base64, produced no finding at all (RR-03).
+- `scan` finds credentials stored as the base64 of their text, as in Kubernetes Secret `data:` values and Helm values (`kubectl create secret generic --from-literal=LND_MACAROON=<hex>`). Before, the base64 of a hex, base64 or `lndconnect` credential produced no finding. Such text is decoded one level deep, in linear time, and findings are reported at their column in the encoded text (RR-02).
+- `scan` decodes hex written with a separator between every byte (colon hex, `xxd -g1`, spaced bytes) and credentials wrapped narrower than 49 columns (joined with their continuation lines), and reports the prefix of an `xxd` default dump as `undecodable-candidate`. Before, all of these produced no finding (RR-10).
+- `scan` can no longer be hung by a FIFO. Files were opened without `O_NONBLOCK`, so anyone able to write in a scanned directory could swap a FIFO in between the walk's `lstat` and the open, and `open(2)` waited for a writer forever; SIGINT, SIGTERM and SIGHUP did not end it, because cancellation was only checked between files. Scanned files and the ignore file are now opened non-blocking (and no-follow), the descriptor is checked with `fstat` before anything is read, and an interrupt abandons any file system operation still pending, so the scan exits 6 at once (robustness review 2026-10-09, RR-04).
+- `scan` time no longer grows with the cube of directory depth. The walk resolved the full path of every directory and file with realpath, which resolves each component again, so a committed chain of deep directories could stretch a CI scan from seconds to many minutes. Each path argument is now resolved once and resolved paths are carried down the walk; one `lstat` per check keeps the identity guarantees. On Linux 2,000 nested directories now take 1.9 s (25 s before; 0.2 s laid out flat) and 2,000 files at depth 1,000 take 1.9 s (12.7 s before; 0.6 s at the top level) (RR-05).
+- `scan` on Linux and macOS reports a file whose name contains `\` under its real name in every format. Every `\` in a path was turned into `/`, so `back\slash.env` was reported as `back/slash.env`, a file that does not exist, and ignore globs were matched against that wrong name. Only Windows treats `\` as a separator now (robustness review 2026-10-09, RR-07).
+- `scan` on Linux scans directories named `.GIT`, `Node_Modules` or any other case variant of `.git` and `node_modules`. They were skipped as `excluded-dir` on every platform, so credentials in them were never reported, although on a case-sensitive file system they are ordinary directories. Windows and macOS, whose default file systems ignore case, still exclude them; `--git-history` follows the same rule (RR-08).
+- `scan --format github` names the real file in each annotation. The `file` property carried the text-output escape of a control character (`new\x0aline.env`) instead of the path, so GitHub could not attach the annotation to the file. It now carries the path with GitHub's own property escaping only (`%0A`, `%0D`, `%25`, `%3A`, `%2C`) (RR-09).
+- Text output escapes invisible characters in file names and other untrusted strings: every Unicode format character (soft hyphen U+00AD, zero-width space and joiners, word joiner U+2060, the tag characters U+E0000 to U+E007F and the rest of category Cf), the Hangul fillers, U+034F and the variation selectors. They were printed raw, so `admin⁠.macaroon` looked like `admin.macaroon`. Characters beyond U+FFFF are written `\u{N}` (RR-11).
+- `scan --format sarif` gives correct file URIs for paths outside the working directory. A finding under a relative `../` argument got `file:///../sibling%20dir/x.env`, which names `/sibling dir/x.env`, so code scanning pointed at a file that does not exist. Such a path is now resolved to an absolute `file:` URI (UNC paths as `file://server/share/…`, a `\` in a Linux file name encoded as `%5C`), and the run declares `%SRCROOT%` in `originalUriBaseIds` so every relative URI resolves to its file (RR-06).
+- `.macwardenignore` and `--ignore-file` accept a UTF-16 file with a BOM, which is what Windows PowerShell 5.1 writes with `>` and `Out-File`; it failed with exit 3 (`ignore-file`). A glob with a leading `/` (`fp:… /top.env`, as in `.gitignore`) is anchored at the ignore file's directory; it never matched before. Both failed closed (RR-14).
+- `scan` exits 3 (`input-read`, "scan path is not a regular file or directory") when a path argument is a FIFO, device or socket. It was skipped as `not-regular` with exit 0, so `scan pipe.env --fail-on READ` passed a CI gate having scanned nothing, against the rule that an unreadable argument fails. Such entries found inside a walked directory are still `not-regular` skips (RR-12).
+- `scan` reports every hard-link name of a file with a finding. Within one path argument a second name of the same file was dropped by identity deduplication without a finding or a skip, so an operator who removed `a.env` (most editors write a new file) still had the credential in `b.env` and was never told. The finding at the first name now carries `alsoAt` with the other names (count and up to five paths), shown in text, SARIF and GitHub output; an ignore entry hides it only when every name matches (RR-13).
+- Windows `--out` (`bake`, `rotate`, `respond`, `attenuate`, `inventory --report`): the file is created owner-only in the same call that creates it (owner = your SID, a protected DACL with one entry for you, nothing inherited), then its owner and DACL are read back while macwarden holds the exclusive handle, before any byte is written. Before, the file existed under the folder's inherited ACL for about 70 ms until `icacls` ran; an account with inherited change-permissions (WRITE_DAC) could open a handle in that window that the exclusive reopen did not detect, and grant itself read access after the credential was written, while the command reported a restricted ACL. Any other entry, an inherited entry or a different owner now fails the command (exit 3) with nothing written. `acl-best-effort` is given only on a FAT or exFAT volume, which stores no permissions; `icacls` and `whoami` are no longer run (RO-1).
+- Windows `--out` and `respond --out-dir` refuse names that Windows normalises or maps to a device or stream before anything is created (exit 3, "output path refused"): a component ending in a dot or a space, a reserved device name (`CON`, `PRN`, `AUX`, `NUL`, `COM0`–`COM9`, `LPT0`–`LPT9`, `CONIN$`, `CONOUT$`, with or without an extension), `:` (alternate data stream) or another character Windows forbids, and `\\.\` paths. Before, Node wrote the literal name while the ACL was applied to the normalised one: `app.macaroon.` next to an existing `app.macaroon` kept the folder's ACL without a warning (and the sibling's ACL was rewritten), and `notes.txt:app.macaroon` wrote the credential into a hidden stream of an existing file instead of refusing (RO-2).
+- POSIX `--out` verifies the mode: after the exclusive `0600` create, the mode and owner are read back from the open descriptor, one `chmod 0600` is tried, and a file that is still not private is removed and the command fails (exit 3) with nothing written. Before, on file systems that do not store modes (WSL `/mnt/c`, vfat, exFAT, CIFS) the credential was written world-readable while `bake` printed "(0600)". The text output now reads "(0600, verified)" or "(owner-only Windows ACL, verified)" (RO-3).
+- Online commands take the node address, its certificate and their own credential from one source: all from flags, or all from `MACWARDEN_LND_REST`, `MACWARDEN_TLS_CERT` and `MACWARDEN_MACAROON` (`watch` adds `--lnd-grpc`/`MACWARDEN_LND_GRPC`). A flag combined with a set variable for another setting is refused (exit 2, naming the variables, before any request). Before, each setting fell back to its variable on its own, so `--lnd-rest`/`--tls-cert` for node B with a shell-exported `MACWARDEN_MACAROON` for node A presented node A's admin-equivalent credential to node B (RO-4).
+
 ## 1.1.0 (2026-10-08)
 
 Security release. It fixes every finding of the independent audit of 1.0.1 ([report](docs/reviews/2026-10-08-audit-1.0.1.md)) and of a differential fuzzing review of the parsers against LND's own macaroon library, and adds `verify` for operators responding to credential exposure such as the BTCPay Server 2.4.2 incident.

package/README.md

@@ -12,7 +12,7 @@ node 03f2a1c97b5e4d0e8a6b9f31c2d47e5a0b8c6d2e9f1a3b5c7d9e0f2a4b6c8d0e1f (shop-no
 ROOT KEY ID  LABEL      GRADE    AGE  EXPIRES     STATUS
 0            —          —        —    —           default root key: cannot be individually revoked
 4294967341   btcpay     RECEIVE  41d  —           active; accepted; last used 2026-10-08T09:12:44Z (18324 calls)
-4294967342   lnbits     SPEND    12d  2026-10-26  active; accepted; expires in 17d; rotate with: macwarden rotate lnbits
+4294967342   lnbits     SPEND    12d  2026-10-26  active; accepted; expires in 17d; rotate with: macwarden rotate lnbits --out /home/op/lnbits-2026-10-09.macaroon
 4294967355   ci-reader  READ     3d   2026-10-07  active; expired; revoke with: macwarden revoke ci-reader
 9187201950   —          —        —    —           unknown — not in this registry (another tool or operator may own it)
 ```
@@ -58,7 +58,7 @@ That is hard with LND alone:
 
 ### Respond to an incident
 
-- `verify <file>` asks your node whether one credential file is still accepted, for example each `.macaroon` file that may have been copied. It exits 1 while LND accepts it and 0 once LND rejects it, and says what to do next: revoke its root key ID, or, for `admin.macaroon` and anything else on root key 0, regenerate every root key.
+- `verify <file>` asks your node whether one credential file is still accepted, for example each `.macaroon` file that may have been copied. It exits 1 while LND accepts it, and also when LND rejects it for a reason that may not hold for every caller or every copy (an IP lock, a custom caveat, a signature mismatch on a copy that is not the exact credential macwarden recorded, or an expiry only your own clock sees); it exits 0 only when LND rejects it conclusively (its root key ID is gone, or LND itself reports it expired). It says what to do next: revoke its root key ID, or, for `admin.macaroon` and anything else on root key 0, regenerate every root key.
 - `respond --out-dir <dir>` stages a replacement for every registered credential in one confirmed batch. After the apps are switched, `respond --finish` revokes the old root key IDs and reports, for each credential, proof that the old one is rejected and the new one accepted. It explains what to do about root key 0, which LND cannot revoke on its own. Canaries are never rotated into ordinary credentials, IDs the registry calls revoked but LND still holds are flagged, and if a credential that can bake may have leaked it says so plainly: only regenerating all root keys removes what such a credential could have created.
 - `bake --canary` creates a decoy credential. While `watch` runs, every use its permissions allow is denied and raises an alert within the same call. Put it where a thief would look.
 - `inventory --report markdown|csv|json` writes an access-review record (every credential, its owner, permissions, caveats, expiry, rotation links, last use, canary uses and review flags, with control observations and a sign-off section; all three formats carry the same evidence, and the CSV is a single table with one header row) for SOC 2, ISO 27001 or internal reviews. It is evidence for a reviewer, not a compliance claim.
@@ -68,7 +68,7 @@ That is hard with LND alone:
 macwarden needs Node.js 22.23.2 or later on the 22 line, 24.18.1 or later on the 24 line, or 26.5.1 or later.
 
 ```sh
-npm i -g macwarden@1.1.0
+npm i -g macwarden@1.1.1
 ```
 
 On production hosts, pin the exact version as above rather than installing the latest, and run `npm audit signatures` in a project that depends on macwarden to check the registry signatures of what you installed.
@@ -89,7 +89,7 @@ It exits 1 if it finds a credential at or above the grade you set, 0 if it finds
 - uses: actions/checkout@v5
   with:
     fetch-depth: 0
-- run: npx --yes macwarden@1.1.0 scan . --git-history --fail-on READ --format github
+- run: npx --yes macwarden@1.1.1 scan . --git-history --fail-on READ --format github
 ```
 
 [docs/ci-integration.md](docs/ci-integration.md) has a SARIF workflow for GitHub code scanning, the pre-commit hook and the gitleaks and TruffleHog rule packs.
@@ -114,6 +114,8 @@ macwarden rotate btcpay --out ./btcpay-next.macaroon
 macwarden rotate btcpay --finish
 ```
 
+The node address, its certificate and macwarden's own credential come from one place: all from the `MACWARDEN_*` variables, or all from `--lnd-rest`, `--tls-cert` and `--macaroon`. A command that names one of them as a flag while another is set in the environment is refused (exit 2), so a credential exported for one node is never sent to a node you name on the command line. Give all three flags, or unset the variables, to work with another node.
+
 Pick an unused root key ID (check `lncli listmacaroonids`), and run `lncli deletemacaroonid 123456789` when the session is over. To move existing apps off `admin.macaroon` and root key 0, follow [Replacing the default macaroons](docs/replacing-default-macaroons.md). It covers the maintenance window, the one step only you can do, and how to confirm nothing is left behind.
 
 `macwarden --help` lists every command; `macwarden <command> --help` shows its options. Every command accepts `--json` and prints one document whose shape is published as a JSON Schema in `schemas/output/<command>.schema.json`. `watch --json` first prints one event per line while it runs (`schemas/output/watch-event.schema.json`), then that document as its last line.
@@ -134,7 +136,7 @@ macwarden verify /path/to/old/btcpay.macaroon
 
 These are enforced in code and covered by tests. [SECURITY.md](SECURITY.md) lists them as rules SAFE-01 to SAFE-11:
 
-- It never prints, logs or stores credential bytes. The only file that ever holds a credential is one you asked it to write with `--out`, created owner-only and never overwritten.
+- It never prints, logs or stores credential bytes. The only file that ever holds a credential is one you asked it to write with `--out`, never overwritten, and owner-only before its first byte: the mode `0600` or the Windows owner-only ACL is read back and verified, and the command fails without writing when the file system cannot keep it (for example WSL's `/mnt/c`). A Windows FAT or exFAT volume, which stores no permissions, is written with a warning.
 - It never calls `changepassword`, never deletes root key ID 0, and never reads or writes `macaroons.db`, wallet passwords, seeds or TLS keys.
 - A rotation leaves the old credential valid until you confirm the switch. A failure at any step before that changes nothing you depend on.
 - When the outcome of a change is uncertain (a timeout, a dropped connection), it says so, exits 7 and prints the command to reconcile. It never reports "nothing changed" without proof.

package/SECURITY.md

@@ -24,7 +24,7 @@ These IDs are referenced from SPEC.md. Do not renumber.
 | SAFE-03 | Never delete root key ID 0. | `revoke` and `rotate` refuse ID 0 (as an argument or as a `--target-file`'s ID) before any network call; the adapter refuses it again. Unit and integration tests for both layers. |
 | SAFE-04 | Rotation is two invocations: **stage** (bake → verify new) → operator switches the app → **finish** (confirm → revoke old → verify old rejected). A failure anywhere before the revoke leaves the old credential valid. | Failure-injection cases 1–8 in PLAN.md M5 (faulty adapter in unit tests, real faults against the fixture in integration tests) assert with the `lncli` acceptance probe that the old macaroon is still accepted unless the finish's DeleteMacaroonID had completed. |
 | SAFE-05 | Every mutating command (`bake`, `revoke`, `rotate`) supports `--dry-run`; `revoke` and `rotate --finish` require typed confirmation unless `--yes`. Rotation stage relying on permissions unproven by the old credential requires typed informed approval showing the exact grade and permissions before lock, reservation or issue; stage --yes does not authorize this fallback. | Integration tests: `--dry-run` leaves LND's root key IDs, the registry and the `--out` path unchanged; without `--yes`, a declined, wrong or missing (non-TTY) confirmation changes nothing. |
-| SAFE-06 | Registry and all outputs are free of secrets. The registry is `0600` in a `0700` directory; macaroon files are written owner-only. Stale-lock recovery requires same-host dead-owner and pathname identity proof; competing owners are preserved. Failed owned lock/output cleanup is visible and reports exit 7 after possible mutation while retaining any primary error. On Windows `--out` is restricted to the current user with `icacls`; if that fails the command warns that the file inherits the folder's permissions. Bytes are written only through an exclusive (share mode 0) handle opened after the restriction, so no handle opened before it can read them; if another handle exists the command fails without writing. | Leak test covers the registry file. Tests check modes `0600`/`0700` on Linux/macOS; on Windows (CI) the `icacls` call is asserted and its failure produces warning `acl-best-effort`; a real-Windows test opens a handle before the restriction and proves the command fails with no bytes readable through it. |
+| SAFE-06 | Registry and all outputs are free of secrets. The registry is `0600` in a `0700` directory; macaroon files are written owner-only. Stale-lock recovery requires same-host dead-owner and pathname identity proof; competing owners are preserved. Failed owned lock/output cleanup is visible and reports exit 7 after possible mutation while retaining any primary error. Every `--out` file is owner-only before its first byte, and that is verified, never assumed: on POSIX the `0600` mode and owner are read back from the open descriptor (one `chmod` repair, otherwise the file is removed and the command fails); on Windows the file is created with an owner-only, protected DACL in the same call that creates it (no moment under the folder's inherited ACL, so no other account can open any handle to it, including a change-permissions handle), and its owner and DACL are read back while macwarden holds an exclusive (share mode 0) handle; any other entry, inherited entry or owner fails the command without writing. Bytes are written only through that exclusive handle; if another handle exists the command fails without writing. Only a Windows volume that stores no permissions (FAT, exFAT) is written with warning `acl-best-effort`. Output names that Windows normalises or maps to a device or stream are refused before anything is created. | Leak test covers the registry file. Tests check modes `0600`/`0700` on Linux/macOS, and that a file system which keeps other mode bits fails closed with the file removed; on Windows (CI) a real-Windows test shows the first DACL any process can observe on a new file in a folder granting Everyone change-permissions is owner-only and protected, an entry added before the write fails closed, a handle opened before the exclusive open makes the command fail with no bytes readable through it, and normalised, device and stream names are refused with nothing touched. |
 | SAFE-07 | `inspect` and `scan` are offline and read-only. | Tests run them with networking stubbed to throw and on read-only fixture directories; file mtimes and contents are unchanged afterwards. |
 | SAFE-08 | No telemetry; the only network peer is the configured LND node; TLS certificate verification is on by default. | Code review rule: the `lnd` adapter is the only module that opens network connections (it uses `node:https`). Integration test: a wrong TLS cert is rejected. |
 | SAFE-09 | macwarden's own credential should be a dedicated macaroon; the docs must state plainly that the ability to bake is admin-equivalent, so that macaroon must be protected like `admin.macaroon`. | Documented below and in the README; a unit test asserts `inspect` grades any macaroon holding `macaroon:generate` as `ADMIN`; online commands warn `own-root-key-0`. |
@@ -54,7 +54,7 @@ macwarden does not protect against:
 - **Nodes where macwarden's view is incomplete.** With `--no-macaroons` LND checks no macaroons, so macwarden's verification means nothing. With `--mac_root_key` (stateless init) macaroons can be baked offline and never appear in `inventory`. With a remote signer, the signer has its own macaroon store and must be inventoried separately. Other tools and operators can store root keys in the same LND store (Lightning Terminal is reported to; ARCHITECTURE.md assumption 12), which is why `revoke` needs `--unregistered` for IDs it did not issue.
 - **IP-restricted macaroons.** `bake` has no `--ip`: LND is reported to see REST clients as its REST proxy's address (ARCHITECTURE.md assumption 5), so an IP lock either breaks the app or accepts everyone.
 - **Other implementations.** CLN runes, Eclair and LDK are out of scope for v1.
-- **Secrets `scan` does not recognise.** Scanning is pattern-based. Text detectors only match macaroons with location `lnd`; line-wrapped, split, encrypted, archived or oddly encoded credentials can be missed or only flagged as `undecodable-candidate`; UTF-16 without a BOM is treated as binary; files over 5 MiB are skipped; git history is scanned only with `scan --git-history`, and only for history that still exists in the local repository (rewritten history, other clones and objects missing from a partial clone are not covered; a missing object fails the scan). A clean scan is not proof of no leak.
+- **Secrets `scan` does not recognise.** Scanning is pattern-based. Text detectors only match macaroons with location `lnd`; line-wrapped, split, encrypted, archived or oddly encoded credentials can be missed or only flagged as `undecodable-candidate` (for example an `xxd` dump whose prefix is split across two lines, or hex grouped other than by byte; SPEC.md lists the forms scan reads); UTF-16 without a BOM is treated as binary; files over 5 MiB are skipped; git history is scanned only with `scan --git-history`, and only for history that still exists in the local repository (rewritten history, other clones and objects missing from a partial clone are not covered; a missing object fails the scan). A clean scan is not proof of no leak.
 
 Two facts to keep in mind:
 

package/dist/bounded-file.js

@@ -1 +1 @@
-export {api0_readBounded as readBounded, api0_readBoundedFile as readBoundedFile, api0_assertPlainFile as assertPlainFile, api0_BoundedFileError as BoundedFileError, api0_DEFAULT_FILE_LIMIT as DEFAULT_FILE_LIMIT, api0_LOCK_FILE_LIMIT as LOCK_FILE_LIMIT} from "./runtime.js";
+export {api0_readBounded as readBounded, api0_readBoundedFile as readBoundedFile, api0_readPlainFile as readPlainFile, api0_BoundedFileError as BoundedFileError, api0_DEFAULT_FILE_LIMIT as DEFAULT_FILE_LIMIT, api0_LOCK_FILE_LIMIT as LOCK_FILE_LIMIT} from "./runtime.js";

package/dist/commands/bake/out-errors.js

@@ -0,0 +1 @@
+export {api8_reserveFailure as reserveFailure, api8_OutputReserveError as OutputReserveError} from "../../runtime.js";

package/dist/commands/bake/write-out.js

@@ -1 +1 @@
-export {api8_reserveOut as reserveOut} from "../../runtime.js";
+export {api9_reserveOut as reserveOut} from "../../runtime.js";

package/dist/commands/handlers.js

@@ -1 +1 @@
-export {api9_handlers as handlers} from "../runtime.js";
+export {api10_handlers as handlers} from "../runtime.js";

package/dist/commands/inspect.js

@@ -1 +1 @@
-export {api10_inspectResult as inspectResult, api10_run as run, api10_inspect as inspect} from "../runtime.js";
+export {api11_inspectResult as inspectResult, api11_run as run, api11_inspect as inspect} from "../runtime.js";

package/dist/commands/inventory.js

@@ -1 +1 @@
-export {api11_run as run, api11_inventory as inventory} from "../runtime.js";
+export {api12_run as run, api12_inventory as inventory} from "../runtime.js";

package/dist/commands/recommend.js

@@ -1 +1 @@
-export {api12_narrowLabel as narrowLabel, api12_run as run, api12_recommend as recommend, api12_SHORT_OBSERVATION_SECONDS as SHORT_OBSERVATION_SECONDS} from "../runtime.js";
+export {api13_narrowLabel as narrowLabel, api13_run as run, api13_recommend as recommend, api13_SHORT_OBSERVATION_SECONDS as SHORT_OBSERVATION_SECONDS} from "../runtime.js";

package/dist/commands/respond.js

@@ -1 +1 @@
-export {api13_aggregateExit as aggregateExit, api13_run as run, api13_respond as respond, api13_ROOT_KEY_0_GUIDANCE as ROOT_KEY_0_GUIDANCE, api13_OWN_ON_ROOT_KEY_0 as OWN_ON_ROOT_KEY_0, api13_REVOKED_BUT_PRESENT_GUIDANCE as REVOKED_BUT_PRESENT_GUIDANCE, api13_BAKING_RISK_GUIDANCE as BAKING_RISK_GUIDANCE, api13_CUSTOM_CAVEAT_NOTE as CUSTOM_CAVEAT_NOTE, api13_UNKNOWN_GUIDANCE as UNKNOWN_GUIDANCE} from "../runtime.js";
+export {api14_aggregateExit as aggregateExit, api14_run as run, api14_respond as respond, api14_ROOT_KEY_0_GUIDANCE as ROOT_KEY_0_GUIDANCE, api14_OWN_ON_ROOT_KEY_0 as OWN_ON_ROOT_KEY_0, api14_REVOKED_BUT_PRESENT_GUIDANCE as REVOKED_BUT_PRESENT_GUIDANCE, api14_BAKING_RISK_GUIDANCE as BAKING_RISK_GUIDANCE, api14_CUSTOM_CAVEAT_NOTE as CUSTOM_CAVEAT_NOTE, api14_UNKNOWN_GUIDANCE as UNKNOWN_GUIDANCE} from "../runtime.js";

package/dist/commands/revoke.js

@@ -1 +1 @@
-export {api14_run as run, api14_revoke as revoke} from "../runtime.js";
+export {api15_run as run, api15_revoke as revoke} from "../runtime.js";

package/dist/commands/rotate.js

@@ -1 +1 @@
-export {api15_run as run, api15_rotate as rotate} from "../runtime.js";
+export {api16_run as run, api16_rotate as rotate} from "../runtime.js";

package/dist/commands/scan.js

@@ -1 +1 @@
-export {api16_run as run} from "../runtime.js";
+export {api17_run as run} from "../runtime.js";

package/dist/commands/verify.js

@@ -1 +1 @@
-export {api17_run as run, api17_verify as verify, api17_ROOT_KEY_0_ACCEPTED as ROOT_KEY_0_ACCEPTED, api17_CAN_BAKE_ACCEPTED as CAN_BAKE_ACCEPTED, api17_CAN_BAKE_ROOT_KEY_0 as CAN_BAKE_ROOT_KEY_0, api17_OWN_ROOT_KEY_ACCEPTED as OWN_ROOT_KEY_ACCEPTED, api17_REJECTED_INCONCLUSIVE as REJECTED_INCONCLUSIVE, api17_CUSTOM_CAVEAT_REJECTED as CUSTOM_CAVEAT_REJECTED} from "../runtime.js";
+export {api18_run as run, api18_verify as verify, api18_ROOT_KEY_0_ACCEPTED as ROOT_KEY_0_ACCEPTED, api18_CAN_BAKE_ACCEPTED as CAN_BAKE_ACCEPTED, api18_CAN_BAKE_ROOT_KEY_0 as CAN_BAKE_ROOT_KEY_0, api18_OWN_ROOT_KEY_ACCEPTED as OWN_ROOT_KEY_ACCEPTED, api18_REJECTED_INCONCLUSIVE as REJECTED_INCONCLUSIVE, api18_LOCAL_EXPIRY_UNCONFIRMED as LOCAL_EXPIRY_UNCONFIRMED, api18_SIGNATURE_MISMATCH_INCONCLUSIVE as SIGNATURE_MISMATCH_INCONCLUSIVE, api18_SIGNATURE_MISMATCH_HOW_TO_CONCLUDE as SIGNATURE_MISMATCH_HOW_TO_CONCLUDE, api18_SIGNATURE_MISMATCH_ROOT_KEY_0 as SIGNATURE_MISMATCH_ROOT_KEY_0, api18_OWN_ROOT_KEY_INCONCLUSIVE as OWN_ROOT_KEY_INCONCLUSIVE, api18_ROOT_KEY_0_INCONCLUSIVE as ROOT_KEY_0_INCONCLUSIVE, api18_CUSTOM_CAVEAT_REJECTED as CUSTOM_CAVEAT_REJECTED} from "../runtime.js";

package/dist/commands/watch.js

@@ -1 +1 @@
-export {api18_scheduleDeadline as scheduleDeadline, api18_lockOwnerGone as lockOwnerGone, api18_acquireLock as acquireLock, api18_run as run, api18_stdoutEvents as stdoutEvents, api18_watch as watch, api18_CANARY_RELOAD_MS as CANARY_RELOAD_MS, api18_MAX_TIMER_MS as MAX_TIMER_MS} from "../runtime.js";
+export {api19_scheduleDeadline as scheduleDeadline, api19_lockOwnerGone as lockOwnerGone, api19_acquireLock as acquireLock, api19_run as run, api19_stdoutEvents as stdoutEvents, api19_watch as watch, api19_CANARY_RELOAD_MS as CANARY_RELOAD_MS, api19_MAX_TIMER_MS as MAX_TIMER_MS} from "../runtime.js";

package/dist/credential-recognition.js

@@ -1 +1 @@
-export {api19_redactEncodedCredentials as redactEncodedCredentials} from "./runtime.js";
+export {api20_redactEncodedCredentials as redactEncodedCredentials} from "./runtime.js";

package/dist/decode/index.js

@@ -1 +1 @@
-export {api20_macaroonEosEnd as macaroonEosEnd, api20_macaroonPacketRange as macaroonPacketRange, api20_macaroonSectionRange as macaroonSectionRange, api20_parseTimeBefore as parseTimeBefore, api20_canonicalMacaroonForm as canonicalMacaroonForm, api20_decodeMacaroon as decodeMacaroon, api20_macaroonId as macaroonId, api20_encodeMacaroon as encodeMacaroon, api20_addFirstPartyCaveat as addFirstPartyCaveat, api20_timeBeforeCondition as timeBeforeCondition, api20_validMacaroonIdentifier as validMacaroonIdentifier, api20_isNwcContainer as isNwcContainer, api20_decodeNwc as decodeNwc, api20_DecodeError as DecodeError} from "../runtime.js";
+export {api21_macaroonEosEnd as macaroonEosEnd, api21_macaroonPacketRange as macaroonPacketRange, api21_macaroonSectionRange as macaroonSectionRange, api21_parseTimeBefore as parseTimeBefore, api21_canonicalMacaroonForm as canonicalMacaroonForm, api21_decodeMacaroon as decodeMacaroon, api21_macaroonId as macaroonId, api21_encodeMacaroon as encodeMacaroon, api21_addFirstPartyCaveat as addFirstPartyCaveat, api21_timeBeforeCondition as timeBeforeCondition, api21_validMacaroonIdentifier as validMacaroonIdentifier, api21_isNwcContainer as isNwcContainer, api21_decodeNwc as decodeNwc, api21_DecodeError as DecodeError} from "../runtime.js";

package/dist/decode/recognition.js

@@ -1 +1 @@
-export {api21_macaroonEnds as macaroonEnds} from "../runtime.js";
+export {api22_macaroonEnds as macaroonEnds} from "../runtime.js";

package/dist/environment.js

@@ -1 +1 @@
-export {api22_unsafeNodeDiagnostics as unsafeNodeDiagnostics} from "./runtime.js";
+export {api23_unsafeNodeDiagnostics as unsafeNodeDiagnostics} from "./runtime.js";

package/dist/errors.js

@@ -1 +1 @@
-export {api23_UsageError as UsageError, api23_InputError as InputError, api23_DecodeError as DecodeError, api23_LndError as LndError, api23_LndUncertainError as LndUncertainError} from "./runtime.js";
+export {api24_UsageError as UsageError, api24_InputError as InputError, api24_DecodeError as DecodeError, api24_LndError as LndError, api24_LndUncertainError as LndUncertainError} from "./runtime.js";

package/dist/grade/index.js

@@ -1 +1 @@
-export {api24_grade as grade, api24_gradeFacts as gradeFacts, api24_describe as describe} from "../runtime.js";
+export {api25_grade as grade, api25_gradeFacts as gradeFacts, api25_describe as describe, api25_canBake as canBake, api25_BAKE_MACAROON_URI as BAKE_MACAROON_URI} from "../runtime.js";

package/dist/grouped-runs.js

@@ -1 +1 @@
-export {api25_groupedRuns as groupedRuns, api25_groupedBase64 as groupedBase64} from "./runtime.js";
+export {api26_groupedRuns as groupedRuns, api26_groupedBase64 as groupedBase64} from "./runtime.js";

package/dist/input/index.js

@@ -1 +1 @@
-export {api26_readCredential as readCredential, api26_InputError as InputError, api26_UsageError as UsageError} from "../runtime.js";
+export {api27_readCredential as readCredential, api27_InputError as InputError, api27_UsageError as UsageError} from "../runtime.js";

package/dist/input/lndconnect.js

@@ -1 +1 @@
-export {api27_parseLndconnect as parseLndconnect} from "../runtime.js";
+export {api28_parseLndconnect as parseLndconnect} from "../runtime.js";

package/dist/instant.js

@@ -0,0 +1 @@
+export {api29_isInstant as isInstant} from "./runtime.js";

package/dist/lnd/grpc.js

@@ -1 +1 @@
-export {api28_openGrpcStream as openGrpcStream, api28_MAX_GRPC_MESSAGE as MAX_GRPC_MESSAGE, api28_STALL_TIMEOUT_MS as STALL_TIMEOUT_MS, api28_MAX_PENDING_WRITE_BYTES as MAX_PENDING_WRITE_BYTES, api28_WRITE_OVERHEAD_BYTES as WRITE_OVERHEAD_BYTES, api28_PING_INTERVAL_MS as PING_INTERVAL_MS, api28_PING_TIMEOUT_MS as PING_TIMEOUT_MS} from "../runtime.js";
+export {api30_openGrpcStream as openGrpcStream, api30_MAX_GRPC_MESSAGE as MAX_GRPC_MESSAGE, api30_STALL_TIMEOUT_MS as STALL_TIMEOUT_MS, api30_MAX_PENDING_WRITE_BYTES as MAX_PENDING_WRITE_BYTES, api30_WRITE_OVERHEAD_BYTES as WRITE_OVERHEAD_BYTES, api30_PING_INTERVAL_MS as PING_INTERVAL_MS, api30_PING_TIMEOUT_MS as PING_TIMEOUT_MS} from "../runtime.js";

package/dist/lnd/index.js

@@ -1 +1 @@
-export {api29_createLndAdapter as createLndAdapter, api29_registerMiddleware as registerMiddleware} from "../runtime.js";
+export {api31_createLndAdapter as createLndAdapter, api31_registerMiddleware as registerMiddleware} from "../runtime.js";

package/dist/lnd/middleware-proto.js

@@ -1 +1 @@
-export {api30_decodeMiddlewareRequest as decodeMiddlewareRequest, api30_encodeRegistration as encodeRegistration, api30_encodeFeedback as encodeFeedback, api30_MAX_MACAROON_BYTES as MAX_MACAROON_BYTES, api30_MAX_METHOD_BYTES as MAX_METHOD_BYTES, api30_MAX_CONDITION_BYTES as MAX_CONDITION_BYTES, api30_UNKNOWN_METHOD as UNKNOWN_METHOD} from "../runtime.js";
+export {api32_decodeMiddlewareRequest as decodeMiddlewareRequest, api32_encodeRegistration as encodeRegistration, api32_encodeFeedback as encodeFeedback, api32_MAX_MACAROON_BYTES as MAX_MACAROON_BYTES, api32_MAX_METHOD_BYTES as MAX_METHOD_BYTES, api32_MAX_CONDITION_BYTES as MAX_CONDITION_BYTES, api32_UNKNOWN_METHOD as UNKNOWN_METHOD} from "../runtime.js";

package/dist/lnd/tls-identity.js

@@ -1 +1 @@
-export {api31_identityCheck as identityCheck} from "../runtime.js";
+export {api33_identityCheck as identityCheck} from "../runtime.js";

package/dist/online.js

@@ -1 +1 @@
-export {api32_endpoint as endpoint, api32_credentialText as credentialText, api32_connectionProblem as connectionProblem, api32_flagProblem as flagProblem, api32_nodeInfo as nodeInfo, api32_nodePubkey as nodePubkey, api32_drift as drift, api32_samePermissions as samePermissions, api32_listIds as listIds, api32_failureDetails as failureDetails, api32_onlineAdapter as onlineAdapter, api32_shellQuote as shellQuote, api32_recoveryPath as recoveryPath, api32_recoveryCommand as recoveryCommand, api32_inventoryRecoveryCommand as inventoryRecoveryCommand, api32_readOnlineCredential as readOnlineCredential, api32_onlineWarnings as onlineWarnings, api32_LABEL_RULE as LABEL_RULE, api32_readBoundedFile as readBoundedFile} from "./runtime.js";
+export {api34_endpoint as endpoint, api34_credentialText as credentialText, api34_connectionProblem as connectionProblem, api34_connectionSettings as connectionSettings, api34_flagProblem as flagProblem, api34_nodeInfo as nodeInfo, api34_nodePubkey as nodePubkey, api34_drift as drift, api34_samePermissions as samePermissions, api34_listIds as listIds, api34_failureDetails as failureDetails, api34_onlineAdapter as onlineAdapter, api34_shellQuote as shellQuote, api34_recoveryPath as recoveryPath, api34_recoveryCommand as recoveryCommand, api34_inventoryRecoveryCommand as inventoryRecoveryCommand, api34_readOnlineCredential as readOnlineCredential, api34_onlineWarnings as onlineWarnings, api34_LABEL_RULE as LABEL_RULE, api34_readBoundedFile as readBoundedFile} from "./runtime.js";

package/dist/output/index.js

@@ -1 +1 @@
-export {api33_rotatePlanResult as rotatePlanResult, api33_revokePlanResult as revokePlanResult, api33_error as error, api33_warning as warning, api33_renderWatchEvent as renderWatchEvent, api33_formatDuration as formatDuration, api33_revokeConfirmation as revokeConfirmation, api33_writeRevokePrompt as writeRevokePrompt, api33_writeRotateFinishPlan as writeRotateFinishPlan, api33_rotateConfirmation as rotateConfirmation, api33_writeRotatePrompt as writeRotatePrompt, api33_render as render, api33_renderChunks as renderChunks, api33_inventoryResult as inventoryResult, api33_writeRotateStagePlan as writeRotateStagePlan} from "../runtime.js";
+export {api35_rotatePlanResult as rotatePlanResult, api35_revokePlanResult as revokePlanResult, api35_error as error, api35_warning as warning, api35_renderWatchEvent as renderWatchEvent, api35_formatDuration as formatDuration, api35_revokeConfirmation as revokeConfirmation, api35_writeRevokePrompt as writeRevokePrompt, api35_writeRotateFinishPlan as writeRotateFinishPlan, api35_rotateConfirmation as rotateConfirmation, api35_writeRotatePrompt as writeRotatePrompt, api35_render as render, api35_renderChunks as renderChunks, api35_inventoryResult as inventoryResult, api35_writeRotateStagePlan as writeRotateStagePlan} from "../runtime.js";

package/dist/output/scan-formats.js

@@ -1 +1 @@
-export {api34_ruleIdFor as ruleIdFor, api34_findingSeverity as findingSeverity, api34_locationOf as locationOf, api34_fileUri as fileUri, api34_sarifPieces as sarifPieces, api34_escapeData as escapeData, api34_escapeProperty as escapeProperty, api34_githubLines as githubLines, api34_SARIF_MAX_RESULTS as SARIF_MAX_RESULTS} from "../runtime.js";
+export {api36_ruleIdFor as ruleIdFor, api36_findingSeverity as findingSeverity, api36_locationOf as locationOf, api36_fileUri as fileUri, api36_sarifPieces as sarifPieces, api36_escapeData as escapeData, api36_escapeProperty as escapeProperty, api36_githubLines as githubLines, api36_SARIF_MAX_RESULTS as SARIF_MAX_RESULTS} from "../runtime.js";

package/dist/process-error-context.js

@@ -1 +1 @@
-export {api35_withProcessErrorContext as withProcessErrorContext, api35_markMutationSent as markMutationSent, api35_internalErrorMessage as internalErrorMessage} from "./runtime.js";
+export {api37_withProcessErrorContext as withProcessErrorContext, api37_markMutationSent as markMutationSent, api37_internalErrorMessage as internalErrorMessage} from "./runtime.js";

package/dist/protected-path.js

@@ -1 +1 @@
-export {api36_isProtectedPath as isProtectedPath, api36_resolveUnprotectedPath as resolveUnprotectedPath} from "./runtime.js";
+export {api38_isProtectedPath as isProtectedPath, api38_outputNameProblem as outputNameProblem, api38_resolveUnprotectedPath as resolveUnprotectedPath} from "./runtime.js";

package/dist/registry/index.js

@@ -1 +1 @@
-export {api37_openRegistry as openRegistry, api37_replacementProblem as replacementProblem, api37_replacementLinkProblems as replacementLinkProblems, api37_hasCustomCaveat as hasCustomCaveat, api37_RegistryInputError as RegistryInputError, api37_RegistryUsageError as RegistryUsageError, api37_Registry as Registry} from "../runtime.js";
+export {api39_openRegistry as openRegistry, api39_replacementProblem as replacementProblem, api39_replacementLinkProblems as replacementLinkProblems, api39_recordedFileRelation as recordedFileRelation, api39_isStagedReplacement as isStagedReplacement, api39_hasCustomCaveat as hasCustomCaveat, api39_RegistryInputError as RegistryInputError, api39_RegistryUsageError as RegistryUsageError, api39_Registry as Registry} from "../runtime.js";

package/dist/registry/process-domain.js

@@ -1 +1 @@
-export {api38_validDomain as validDomain, api38_ownProcessDomain as ownProcessDomain} from "../runtime.js";
+export {api40_validDomain as validDomain, api40_ownProcessDomain as ownProcessDomain} from "../runtime.js";

package/dist/report/access-review.js

@@ -1 +1 @@
-export {api39_buildAccessReview as buildAccessReview, api39_csvField as csvField, api39_formatAccessReview as formatAccessReview, api39_REPORT_FORMATS as REPORT_FORMATS, api39_LIMITATIONS as LIMITATIONS} from "../runtime.js";
+export {api41_buildAccessReview as buildAccessReview, api41_csvField as csvField, api41_formatAccessReview as formatAccessReview, api41_REPORT_FORMATS as REPORT_FORMATS, api41_LIMITATIONS as LIMITATIONS} from "../runtime.js";

package/dist/root-key-id.js

@@ -0,0 +1 @@
+export {api42_isRootKeyId as isRootKeyId, api42_MAX_ROOT_KEY_ID as MAX_ROOT_KEY_ID} from "./runtime.js";