@attest-it/core 0.6.0 → 0.8.0

package/dist/core-unstripped.d.ts

@@ -62,6 +62,8 @@ export declare interface AttestItSettings {
     publicKeyPath: string;
     /** Path to the attestations file */
     attestationsPath: string;
+    /** Path to the seals file */
+    sealsPath: string;
     /** Default command to execute for attestation (can be overridden per suite) */
     defaultCommand?: string;
     /** Key provider configuration for signing attestations */
@@ -226,6 +228,7 @@ declare const configSchema: z.ZodObject<{
         }>>;
         maxAgeDays: z.ZodDefault<z.ZodNumber>;
         publicKeyPath: z.ZodDefault<z.ZodString>;
+        sealsPath: z.ZodDefault<z.ZodString>;
     }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
         attestationsPath: z.ZodDefault<z.ZodString>;
         defaultCommand: z.ZodOptional<z.ZodString>;
@@ -266,6 +269,7 @@ declare const configSchema: z.ZodObject<{
         }>>;
         maxAgeDays: z.ZodDefault<z.ZodNumber>;
         publicKeyPath: z.ZodDefault<z.ZodString>;
+        sealsPath: z.ZodDefault<z.ZodString>;
     }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
         attestationsPath: z.ZodDefault<z.ZodString>;
         defaultCommand: z.ZodOptional<z.ZodString>;
@@ -306,6 +310,7 @@ declare const configSchema: z.ZodObject<{
         }>>;
         maxAgeDays: z.ZodDefault<z.ZodNumber>;
         publicKeyPath: z.ZodDefault<z.ZodString>;
+        sealsPath: z.ZodDefault<z.ZodString>;
     }, z.ZodTypeAny, "passthrough">>>;
     suites: z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodEffects<z.ZodObject<{
         command: z.ZodOptional<z.ZodString>;
@@ -428,6 +433,7 @@ declare const configSchema: z.ZodObject<{
         } | undefined;
         maxAgeDays: number;
         publicKeyPath: string;
+        sealsPath: string;
     } & { [k: string]: unknown };
     suites: Record<string, {
         command?: string | undefined;
@@ -500,6 +506,7 @@ declare const configSchema: z.ZodObject<{
         }>>;
         maxAgeDays: z.ZodDefault<z.ZodNumber>;
         publicKeyPath: z.ZodDefault<z.ZodString>;
+        sealsPath: z.ZodDefault<z.ZodString>;
     }, z.ZodTypeAny, "passthrough">;
     suites: Record<string, {
         command?: string | undefined;
@@ -817,6 +824,14 @@ export declare function getDefaultPrivateKeyPath(): string;
  */
 export declare function getDefaultPublicKeyPath(): string;
 
+/**
+ * Get the default YubiKey encrypted key path based on OS.
+ * - macOS/Linux: ~/.config/attest-it/yubikey-private.enc
+ * - Windows: %APPDATA%\attest-it\yubikey-private.enc
+ * @public
+ */
+export declare function getDefaultYubiKeyEncryptedKeyPath(): string;
+
 /**
  * Get the gate configuration for a given gate ID.
  *
@@ -827,6 +842,18 @@ export declare function getDefaultPublicKeyPath(): string;
  */
 export declare function getGate(config: AttestItConfig, gateId: string): GateConfig | undefined;
 
+/**
+ * Get the user's home public keys directory.
+ *
+ * This returns ~/.attest-it/public-keys, which is different from the
+ * config directory (~/.config/attest-it). The public keys directory
+ * is designed to be easily shareable and discoverable.
+ *
+ * @returns Path to the user's home public keys directory
+ * @public
+ */
+export declare function getHomePublicKeysDir(): string;
+
 /**
  * Get the path to the local config file.
  *
@@ -855,6 +882,19 @@ export declare function getPreference<K extends keyof UserPreferences>(key: K):
  */
 export declare function getPreferencesPath(): string;
 
+/**
+ * Get the project public keys directory.
+ *
+ * This returns .attest-it/public-keys relative to the given project root.
+ * The project public keys directory is used for CI/GitHub Actions to
+ * verify attestation seals.
+ *
+ * @param projectRoot - The project root directory (defaults to cwd)
+ * @returns Path to the project public keys directory
+ * @public
+ */
+export declare function getProjectPublicKeysDir(projectRoot?: string): string;
+
 /**
  * Extract the public key from an Ed25519 private key.
  *
@@ -865,6 +905,15 @@ export declare function getPreferencesPath(): string;
  */
 export declare function getPublicKeyFromPrivate(privateKeyPem: string): string;
 
+/**
+ * Check if a project has attest-it configuration.
+ *
+ * @param projectRoot - The project root directory (defaults to cwd)
+ * @returns True if the project has .attest-it/config.yaml or similar
+ * @public
+ */
+export declare function hasProjectConfig(projectRoot?: string): boolean;
+
 /**
  * A single identity configuration.
  * @public
@@ -904,6 +953,8 @@ export declare interface KeyGenerationResult {
     publicKeyPath: string;
     /** Human-readable storage location description */
     storageDescription: string;
+    /** Whether the private key is encrypted with a passphrase */
+    encrypted?: boolean;
 }
 
 /**
@@ -917,6 +968,8 @@ export declare interface KeygenOptions {
     publicPath?: string;
     /** Overwrite existing keys (default: false) */
     force?: boolean;
+    /** Passphrase to encrypt the private key with AES-256 (optional) */
+    passphrase?: string;
 }
 
 /**
@@ -928,6 +981,8 @@ export declare interface KeygenProviderOptions {
     publicKeyPath: string;
     /** Overwrite existing keys */
     force?: boolean;
+    /** Passphrase to encrypt the private key (filesystem provider only) */
+    passphrase?: string;
 }
 
 /**
@@ -1229,7 +1284,7 @@ export declare function listPackageFiles(packages: string[], ignore?: string[],
            * The merge strategy prioritizes security-critical fields from the policy
            * configuration while combining operational fields from both sources:
            *
-           * - **Policy settings** (maxAgeDays, publicKeyPath, attestationsPath) are used as-is
+           * - **Policy settings** (maxAgeDays, publicKeyPath, attestationsPath, sealsPath) are used as-is
            * - **Operational settings** (defaultCommand, keyProvider) are added from operational config
            * - **Team and gates** come exclusively from policy config
            * - **Suites and groups** come exclusively from operational config
@@ -1262,6 +1317,8 @@ export declare function listPackageFiles(packages: string[], ignore?: string[],
               url: string;
               /** User UUID */
               user_uuid: string;
+              /** Human-readable account name (e.g., "North Family") */
+              name?: string;
           }
 
           /**
@@ -1292,7 +1349,7 @@ export declare function listPackageFiles(packages: string[], ignore?: string[],
               static isInstalled(): Promise<boolean>;
               /**
                * List all 1Password accounts.
-               * @returns Array of account information
+               * @returns Array of account information including human-readable names
                */
               static listAccounts(): Promise<OnePasswordAccount[]>;
               /**
@@ -1664,14 +1721,17 @@ export declare function listPackageFiles(packages: string[], ignore?: string[],
                     attestationsPath: z.ZodDefault<z.ZodString>;
                     maxAgeDays: z.ZodDefault<z.ZodNumber>;
                     publicKeyPath: z.ZodDefault<z.ZodString>;
+                    sealsPath: z.ZodDefault<z.ZodString>;
                 }, "strict", z.ZodTypeAny, {
                     attestationsPath: string;
                     maxAgeDays: number;
                     publicKeyPath: string;
+                    sealsPath: string;
                 }, {
                     attestationsPath?: string | undefined;
                     maxAgeDays?: number | undefined;
                     publicKeyPath?: string | undefined;
+                    sealsPath?: string | undefined;
                 }>>;
                 team: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
                     email: z.ZodOptional<z.ZodString>;
@@ -1705,6 +1765,7 @@ export declare function listPackageFiles(packages: string[], ignore?: string[],
                     attestationsPath: string;
                     maxAgeDays: number;
                     publicKeyPath: string;
+                    sealsPath: string;
                 };
                 team?: Record<string, {
                     email?: string | undefined;
@@ -1728,6 +1789,7 @@ export declare function listPackageFiles(packages: string[], ignore?: string[],
                     attestationsPath?: string | undefined;
                     maxAgeDays?: number | undefined;
                     publicKeyPath?: string | undefined;
+                    sealsPath?: string | undefined;
                 } | undefined;
                 team?: Record<string, {
                     email?: string | undefined;
@@ -1811,21 +1873,23 @@ export declare function listPackageFiles(packages: string[], ignore?: string[],
              * Read seals from the seals.json file (async).
              *
              * @param dir - Directory containing .attest-it/seals.json
+             * @param sealsPathOverride - Optional explicit path to seals file (from config.settings.sealsPath)
              * @returns The seals file contents, or an empty seals file if the file doesn't exist
              * @throws Error if file exists but cannot be read or parsed
              * @public
              */
-            export declare function readSeals(dir: string): Promise<SealsFile>;
+            export declare function readSeals(dir: string, sealsPathOverride?: string): Promise<SealsFile>;
 
             /**
              * Read seals from the seals.json file (sync).
              *
              * @param dir - Directory containing .attest-it/seals.json
+             * @param sealsPathOverride - Optional explicit path to seals file (from config.settings.sealsPath)
              * @returns The seals file contents, or an empty seals file if the file doesn't exist
              * @throws Error if file exists but cannot be read or parsed
              * @public
              */
-            export declare function readSealsSync(dir: string): SealsFile;
+            export declare function readSealsSync(dir: string, sealsPathOverride?: string): SealsFile;
 
             /**
              * Options for reading and verifying signed attestations.
@@ -1891,6 +1955,49 @@ export declare function listPackageFiles(packages: string[], ignore?: string[],
              */
             export declare function savePreferences(preferences: UserPreferences): Promise<void>;
 
+            /**
+             * Save a public key to the user's home directory and optionally to the project directory.
+             *
+             * This saves the public key as a base64-encoded string (matching the format in config.yaml)
+             * to:
+             * 1. ~/.attest-it/public-keys/<slug>.pem (always)
+             * 2. ./.attest-it/public-keys/<slug>.pem (if project has attest-it config)
+             *
+             * @param slug - The identity slug (used for the filename)
+             * @param publicKey - The base64-encoded public key
+             * @param projectRoot - The project root directory (defaults to cwd)
+             * @returns Paths where the key was saved
+             * @public
+             */
+            export declare function savePublicKey(slug: string, publicKey: string, projectRoot?: string): Promise<SavePublicKeyResult>;
+
+            /**
+             * Result from saving public keys.
+             * @public
+             */
+            export declare interface SavePublicKeyResult {
+                /** Path where the key was saved in the user's home directory */
+                homePath: string;
+                /** Path where the key was saved in the project directory, if applicable */
+                projectPath?: string;
+            }
+
+            /**
+             * Save a public key to the user's home directory and optionally to the project directory (sync).
+             *
+             * This saves the public key as a base64-encoded string (matching the format in config.yaml)
+             * to:
+             * 1. ~/.attest-it/public-keys/<slug>.pem (always)
+             * 2. ./.attest-it/public-keys/<slug>.pem (if project has attest-it config)
+             *
+             * @param slug - The identity slug (used for the filename)
+             * @param publicKey - The base64-encoded public key
+             * @param projectRoot - The project root directory (defaults to cwd)
+             * @returns Paths where the key was saved
+             * @public
+             */
+            export declare function savePublicKeySync(slug: string, publicKey: string, projectRoot?: string): SavePublicKeyResult;
+
             /**
              * A seal represents a cryptographic attestation that a gate's fingerprint
              * was signed by an authorized team member.
@@ -2020,6 +2127,8 @@ export declare function listPackageFiles(packages: string[], ignore?: string[],
                 keyRef?: string;
                 /** Data to sign (string or Buffer) */
                 data: Buffer | string;
+                /** Passphrase for encrypted private keys (optional) */
+                passphrase?: string;
             }
 
             /**
@@ -2332,20 +2441,22 @@ export declare function listPackageFiles(packages: string[], ignore?: string[],
              *
              * @param dir - Directory containing .attest-it/seals.json
              * @param sealsFile - The seals file to write
+             * @param sealsPathOverride - Optional explicit path to seals file (from config.settings.sealsPath)
              * @throws Error if file cannot be written
              * @public
              */
-            export declare function writeSeals(dir: string, sealsFile: SealsFile): Promise<void>;
+            export declare function writeSeals(dir: string, sealsFile: SealsFile, sealsPathOverride?: string): Promise<void>;
 
             /**
              * Write seals to the seals.json file (sync).
              *
              * @param dir - Directory containing .attest-it/seals.json
              * @param sealsFile - The seals file to write
+             * @param sealsPathOverride - Optional explicit path to seals file (from config.settings.sealsPath)
              * @throws Error if file cannot be written
              * @public
              */
-            export declare function writeSealsSync(dir: string, sealsFile: SealsFile): void;
+            export declare function writeSealsSync(dir: string, sealsFile: SealsFile, sealsPathOverride?: string): void;
 
             /**
              * Write attestations with a cryptographic signature.

package/dist/crypto-SSL7OBY2.js

@@ -0,0 +1,3 @@
+export { checkOpenSSL, generateKeyPair, getDefaultPrivateKeyPath, getDefaultPublicKeyPath, getDefaultYubiKeyEncryptedKeyPath, setKeyPermissions, sign, verify } from './chunk-FGYLU2HL.js';
+//# sourceMappingURL=crypto-SSL7OBY2.js.map
+//# sourceMappingURL=crypto-SSL7OBY2.js.map

package/dist/{crypto-CE2YISRD.js.map → crypto-SSL7OBY2.js.map}

@@ -1 +1 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"crypto-CE2YISRD.js"}
+{"version":3,"sources":[],"names":[],"mappings":"","file":"crypto-SSL7OBY2.js"}