@attest-it/core 0.7.0 → 0.8.0

package/dist/core-public.d.ts

@@ -62,6 +62,8 @@ export declare interface AttestItSettings {
     publicKeyPath: string;
     /** Path to the attestations file */
     attestationsPath: string;
+    /** Path to the seals file */
+    sealsPath: string;
     /** Default command to execute for attestation (can be overridden per suite) */
     defaultCommand?: string;
     /** Key provider configuration for signing attestations */
@@ -226,6 +228,7 @@ declare const configSchema: z.ZodObject<{
         }>>;
         maxAgeDays: z.ZodDefault<z.ZodNumber>;
         publicKeyPath: z.ZodDefault<z.ZodString>;
+        sealsPath: z.ZodDefault<z.ZodString>;
     }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
         attestationsPath: z.ZodDefault<z.ZodString>;
         defaultCommand: z.ZodOptional<z.ZodString>;
@@ -266,6 +269,7 @@ declare const configSchema: z.ZodObject<{
         }>>;
         maxAgeDays: z.ZodDefault<z.ZodNumber>;
         publicKeyPath: z.ZodDefault<z.ZodString>;
+        sealsPath: z.ZodDefault<z.ZodString>;
     }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
         attestationsPath: z.ZodDefault<z.ZodString>;
         defaultCommand: z.ZodOptional<z.ZodString>;
@@ -306,6 +310,7 @@ declare const configSchema: z.ZodObject<{
         }>>;
         maxAgeDays: z.ZodDefault<z.ZodNumber>;
         publicKeyPath: z.ZodDefault<z.ZodString>;
+        sealsPath: z.ZodDefault<z.ZodString>;
     }, z.ZodTypeAny, "passthrough">>>;
     suites: z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodEffects<z.ZodObject<{
         command: z.ZodOptional<z.ZodString>;
@@ -428,6 +433,7 @@ declare const configSchema: z.ZodObject<{
         } | undefined;
         maxAgeDays: number;
         publicKeyPath: string;
+        sealsPath: string;
     } & { [k: string]: unknown };
     suites: Record<string, {
         command?: string | undefined;
@@ -500,6 +506,7 @@ declare const configSchema: z.ZodObject<{
         }>>;
         maxAgeDays: z.ZodDefault<z.ZodNumber>;
         publicKeyPath: z.ZodDefault<z.ZodString>;
+        sealsPath: z.ZodDefault<z.ZodString>;
     }, z.ZodTypeAny, "passthrough">;
     suites: Record<string, {
         command?: string | undefined;
@@ -946,6 +953,8 @@ export declare interface KeyGenerationResult {
     publicKeyPath: string;
     /** Human-readable storage location description */
     storageDescription: string;
+    /** Whether the private key is encrypted with a passphrase */
+    encrypted?: boolean;
 }
 
 /**
@@ -959,6 +968,8 @@ export declare interface KeygenOptions {
     publicPath?: string;
     /** Overwrite existing keys (default: false) */
     force?: boolean;
+    /** Passphrase to encrypt the private key with AES-256 (optional) */
+    passphrase?: string;
 }
 
 /**
@@ -970,6 +981,8 @@ export declare interface KeygenProviderOptions {
     publicKeyPath: string;
     /** Overwrite existing keys */
     force?: boolean;
+    /** Passphrase to encrypt the private key (filesystem provider only) */
+    passphrase?: string;
 }
 
 /**
@@ -1271,7 +1284,7 @@ export declare function listPackageFiles(packages: string[], ignore?: string[],
            * The merge strategy prioritizes security-critical fields from the policy
            * configuration while combining operational fields from both sources:
            *
-           * - **Policy settings** (maxAgeDays, publicKeyPath, attestationsPath) are used as-is
+           * - **Policy settings** (maxAgeDays, publicKeyPath, attestationsPath, sealsPath) are used as-is
            * - **Operational settings** (defaultCommand, keyProvider) are added from operational config
            * - **Team and gates** come exclusively from policy config
            * - **Suites and groups** come exclusively from operational config
@@ -1708,14 +1721,17 @@ export declare function listPackageFiles(packages: string[], ignore?: string[],
                     attestationsPath: z.ZodDefault<z.ZodString>;
                     maxAgeDays: z.ZodDefault<z.ZodNumber>;
                     publicKeyPath: z.ZodDefault<z.ZodString>;
+                    sealsPath: z.ZodDefault<z.ZodString>;
                 }, "strict", z.ZodTypeAny, {
                     attestationsPath: string;
                     maxAgeDays: number;
                     publicKeyPath: string;
+                    sealsPath: string;
                 }, {
                     attestationsPath?: string | undefined;
                     maxAgeDays?: number | undefined;
                     publicKeyPath?: string | undefined;
+                    sealsPath?: string | undefined;
                 }>>;
                 team: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
                     email: z.ZodOptional<z.ZodString>;
@@ -1749,6 +1765,7 @@ export declare function listPackageFiles(packages: string[], ignore?: string[],
                     attestationsPath: string;
                     maxAgeDays: number;
                     publicKeyPath: string;
+                    sealsPath: string;
                 };
                 team?: Record<string, {
                     email?: string | undefined;
@@ -1772,6 +1789,7 @@ export declare function listPackageFiles(packages: string[], ignore?: string[],
                     attestationsPath?: string | undefined;
                     maxAgeDays?: number | undefined;
                     publicKeyPath?: string | undefined;
+                    sealsPath?: string | undefined;
                 } | undefined;
                 team?: Record<string, {
                     email?: string | undefined;
@@ -1855,21 +1873,23 @@ export declare function listPackageFiles(packages: string[], ignore?: string[],
              * Read seals from the seals.json file (async).
              *
              * @param dir - Directory containing .attest-it/seals.json
+             * @param sealsPathOverride - Optional explicit path to seals file (from config.settings.sealsPath)
              * @returns The seals file contents, or an empty seals file if the file doesn't exist
              * @throws Error if file exists but cannot be read or parsed
              * @public
              */
-            export declare function readSeals(dir: string): Promise<SealsFile>;
+            export declare function readSeals(dir: string, sealsPathOverride?: string): Promise<SealsFile>;
 
             /**
              * Read seals from the seals.json file (sync).
              *
              * @param dir - Directory containing .attest-it/seals.json
+             * @param sealsPathOverride - Optional explicit path to seals file (from config.settings.sealsPath)
              * @returns The seals file contents, or an empty seals file if the file doesn't exist
              * @throws Error if file exists but cannot be read or parsed
              * @public
              */
-            export declare function readSealsSync(dir: string): SealsFile;
+            export declare function readSealsSync(dir: string, sealsPathOverride?: string): SealsFile;
 
             /**
              * Options for reading and verifying signed attestations.
@@ -2107,6 +2127,8 @@ export declare function listPackageFiles(packages: string[], ignore?: string[],
                 keyRef?: string;
                 /** Data to sign (string or Buffer) */
                 data: Buffer | string;
+                /** Passphrase for encrypted private keys (optional) */
+                passphrase?: string;
             }
 
             /**
@@ -2419,20 +2441,22 @@ export declare function listPackageFiles(packages: string[], ignore?: string[],
              *
              * @param dir - Directory containing .attest-it/seals.json
              * @param sealsFile - The seals file to write
+             * @param sealsPathOverride - Optional explicit path to seals file (from config.settings.sealsPath)
              * @throws Error if file cannot be written
              * @public
              */
-            export declare function writeSeals(dir: string, sealsFile: SealsFile): Promise<void>;
+            export declare function writeSeals(dir: string, sealsFile: SealsFile, sealsPathOverride?: string): Promise<void>;
 
             /**
              * Write seals to the seals.json file (sync).
              *
              * @param dir - Directory containing .attest-it/seals.json
              * @param sealsFile - The seals file to write
+             * @param sealsPathOverride - Optional explicit path to seals file (from config.settings.sealsPath)
              * @throws Error if file cannot be written
              * @public
              */
-            export declare function writeSealsSync(dir: string, sealsFile: SealsFile): void;
+            export declare function writeSealsSync(dir: string, sealsFile: SealsFile, sealsPathOverride?: string): void;
 
             /**
              * Write attestations with a cryptographic signature.

package/dist/core-unstripped.d.ts

@@ -62,6 +62,8 @@ export declare interface AttestItSettings {
     publicKeyPath: string;
     /** Path to the attestations file */
     attestationsPath: string;
+    /** Path to the seals file */
+    sealsPath: string;
     /** Default command to execute for attestation (can be overridden per suite) */
     defaultCommand?: string;
     /** Key provider configuration for signing attestations */
@@ -226,6 +228,7 @@ declare const configSchema: z.ZodObject<{
         }>>;
         maxAgeDays: z.ZodDefault<z.ZodNumber>;
         publicKeyPath: z.ZodDefault<z.ZodString>;
+        sealsPath: z.ZodDefault<z.ZodString>;
     }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
         attestationsPath: z.ZodDefault<z.ZodString>;
         defaultCommand: z.ZodOptional<z.ZodString>;
@@ -266,6 +269,7 @@ declare const configSchema: z.ZodObject<{
         }>>;
         maxAgeDays: z.ZodDefault<z.ZodNumber>;
         publicKeyPath: z.ZodDefault<z.ZodString>;
+        sealsPath: z.ZodDefault<z.ZodString>;
     }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
         attestationsPath: z.ZodDefault<z.ZodString>;
         defaultCommand: z.ZodOptional<z.ZodString>;
@@ -306,6 +310,7 @@ declare const configSchema: z.ZodObject<{
         }>>;
         maxAgeDays: z.ZodDefault<z.ZodNumber>;
         publicKeyPath: z.ZodDefault<z.ZodString>;
+        sealsPath: z.ZodDefault<z.ZodString>;
     }, z.ZodTypeAny, "passthrough">>>;
     suites: z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodEffects<z.ZodObject<{
         command: z.ZodOptional<z.ZodString>;
@@ -428,6 +433,7 @@ declare const configSchema: z.ZodObject<{
         } | undefined;
         maxAgeDays: number;
         publicKeyPath: string;
+        sealsPath: string;
     } & { [k: string]: unknown };
     suites: Record<string, {
         command?: string | undefined;
@@ -500,6 +506,7 @@ declare const configSchema: z.ZodObject<{
         }>>;
         maxAgeDays: z.ZodDefault<z.ZodNumber>;
         publicKeyPath: z.ZodDefault<z.ZodString>;
+        sealsPath: z.ZodDefault<z.ZodString>;
     }, z.ZodTypeAny, "passthrough">;
     suites: Record<string, {
         command?: string | undefined;
@@ -946,6 +953,8 @@ export declare interface KeyGenerationResult {
     publicKeyPath: string;
     /** Human-readable storage location description */
     storageDescription: string;
+    /** Whether the private key is encrypted with a passphrase */
+    encrypted?: boolean;
 }
 
 /**
@@ -959,6 +968,8 @@ export declare interface KeygenOptions {
     publicPath?: string;
     /** Overwrite existing keys (default: false) */
     force?: boolean;
+    /** Passphrase to encrypt the private key with AES-256 (optional) */
+    passphrase?: string;
 }
 
 /**
@@ -970,6 +981,8 @@ export declare interface KeygenProviderOptions {
     publicKeyPath: string;
     /** Overwrite existing keys */
     force?: boolean;
+    /** Passphrase to encrypt the private key (filesystem provider only) */
+    passphrase?: string;
 }
 
 /**
@@ -1271,7 +1284,7 @@ export declare function listPackageFiles(packages: string[], ignore?: string[],
            * The merge strategy prioritizes security-critical fields from the policy
            * configuration while combining operational fields from both sources:
            *
-           * - **Policy settings** (maxAgeDays, publicKeyPath, attestationsPath) are used as-is
+           * - **Policy settings** (maxAgeDays, publicKeyPath, attestationsPath, sealsPath) are used as-is
            * - **Operational settings** (defaultCommand, keyProvider) are added from operational config
            * - **Team and gates** come exclusively from policy config
            * - **Suites and groups** come exclusively from operational config
@@ -1708,14 +1721,17 @@ export declare function listPackageFiles(packages: string[], ignore?: string[],
                     attestationsPath: z.ZodDefault<z.ZodString>;
                     maxAgeDays: z.ZodDefault<z.ZodNumber>;
                     publicKeyPath: z.ZodDefault<z.ZodString>;
+                    sealsPath: z.ZodDefault<z.ZodString>;
                 }, "strict", z.ZodTypeAny, {
                     attestationsPath: string;
                     maxAgeDays: number;
                     publicKeyPath: string;
+                    sealsPath: string;
                 }, {
                     attestationsPath?: string | undefined;
                     maxAgeDays?: number | undefined;
                     publicKeyPath?: string | undefined;
+                    sealsPath?: string | undefined;
                 }>>;
                 team: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
                     email: z.ZodOptional<z.ZodString>;
@@ -1749,6 +1765,7 @@ export declare function listPackageFiles(packages: string[], ignore?: string[],
                     attestationsPath: string;
                     maxAgeDays: number;
                     publicKeyPath: string;
+                    sealsPath: string;
                 };
                 team?: Record<string, {
                     email?: string | undefined;
@@ -1772,6 +1789,7 @@ export declare function listPackageFiles(packages: string[], ignore?: string[],
                     attestationsPath?: string | undefined;
                     maxAgeDays?: number | undefined;
                     publicKeyPath?: string | undefined;
+                    sealsPath?: string | undefined;
                 } | undefined;
                 team?: Record<string, {
                     email?: string | undefined;
@@ -1855,21 +1873,23 @@ export declare function listPackageFiles(packages: string[], ignore?: string[],
              * Read seals from the seals.json file (async).
              *
              * @param dir - Directory containing .attest-it/seals.json
+             * @param sealsPathOverride - Optional explicit path to seals file (from config.settings.sealsPath)
              * @returns The seals file contents, or an empty seals file if the file doesn't exist
              * @throws Error if file exists but cannot be read or parsed
              * @public
              */
-            export declare function readSeals(dir: string): Promise<SealsFile>;
+            export declare function readSeals(dir: string, sealsPathOverride?: string): Promise<SealsFile>;
 
             /**
              * Read seals from the seals.json file (sync).
              *
              * @param dir - Directory containing .attest-it/seals.json
+             * @param sealsPathOverride - Optional explicit path to seals file (from config.settings.sealsPath)
              * @returns The seals file contents, or an empty seals file if the file doesn't exist
              * @throws Error if file exists but cannot be read or parsed
              * @public
              */
-            export declare function readSealsSync(dir: string): SealsFile;
+            export declare function readSealsSync(dir: string, sealsPathOverride?: string): SealsFile;
 
             /**
              * Options for reading and verifying signed attestations.
@@ -2107,6 +2127,8 @@ export declare function listPackageFiles(packages: string[], ignore?: string[],
                 keyRef?: string;
                 /** Data to sign (string or Buffer) */
                 data: Buffer | string;
+                /** Passphrase for encrypted private keys (optional) */
+                passphrase?: string;
             }
 
             /**
@@ -2419,20 +2441,22 @@ export declare function listPackageFiles(packages: string[], ignore?: string[],
              *
              * @param dir - Directory containing .attest-it/seals.json
              * @param sealsFile - The seals file to write
+             * @param sealsPathOverride - Optional explicit path to seals file (from config.settings.sealsPath)
              * @throws Error if file cannot be written
              * @public
              */
-            export declare function writeSeals(dir: string, sealsFile: SealsFile): Promise<void>;
+            export declare function writeSeals(dir: string, sealsFile: SealsFile, sealsPathOverride?: string): Promise<void>;
 
             /**
              * Write seals to the seals.json file (sync).
              *
              * @param dir - Directory containing .attest-it/seals.json
              * @param sealsFile - The seals file to write
+             * @param sealsPathOverride - Optional explicit path to seals file (from config.settings.sealsPath)
              * @throws Error if file cannot be written
              * @public
              */
-            export declare function writeSealsSync(dir: string, sealsFile: SealsFile): void;
+            export declare function writeSealsSync(dir: string, sealsFile: SealsFile, sealsPathOverride?: string): void;
 
             /**
              * Write attestations with a cryptographic signature.

package/dist/crypto-SSL7OBY2.js

@@ -0,0 +1,3 @@
+export { checkOpenSSL, generateKeyPair, getDefaultPrivateKeyPath, getDefaultPublicKeyPath, getDefaultYubiKeyEncryptedKeyPath, setKeyPermissions, sign, verify } from './chunk-FGYLU2HL.js';
+//# sourceMappingURL=crypto-SSL7OBY2.js.map
+//# sourceMappingURL=crypto-SSL7OBY2.js.map

package/dist/{crypto-VT6YNHUE.js.map → crypto-SSL7OBY2.js.map}

@@ -1 +1 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"crypto-VT6YNHUE.js"}
+{"version":3,"sources":[],"names":[],"mappings":"","file":"crypto-SSL7OBY2.js"}

package/dist/index.cjs

@@ -63,7 +63,7 @@ __export(crypto_exports, {
   verify: () => verify
 });
 async function runOpenSSL(args, stdin) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     const child = child_process.spawn("openssl", args, {
       stdio: ["pipe", "pipe", "pipe"]
     });
@@ -79,12 +79,15 @@ async function runOpenSSL(args, stdin) {
       reject(new Error(`Failed to spawn OpenSSL: ${err.message}`));
     });
     child.on("close", (code) => {
-      resolve4({
+      resolve5({
         exitCode: code ?? 1,
         stdout: Buffer.concat(stdoutChunks),
         stderr
       });
     });
+    if (stdin) {
+      child.stdin.write(stdin);
+    }
     child.stdin.end();
   });
 }
@@ -157,7 +160,8 @@ async function generateKeyPair(options = {}) {
   const {
     privatePath = getDefaultPrivateKeyPath(),
     publicPath = getDefaultPublicKeyPath(),
-    force = false
+    force = false,
+    passphrase
   } = options;
   const privateExists = await fileExists(privatePath);
   const publicExists = await fileExists(publicPath);
@@ -181,12 +185,25 @@ async function generateKeyPair(options = {}) {
       "-out",
       privatePath
     ];
-    const genResult = await runOpenSSL(genArgs);
+    if (passphrase) {
+      genArgs.push("-aes256", "-pass", "stdin");
+    }
+    const genResult = await runOpenSSL(
+      genArgs,
+      passphrase ? Buffer.from(passphrase + "\n") : void 0
+    );
     if (genResult.exitCode !== 0) {
       throw new Error(`Failed to generate private key: ${genResult.stderr}`);
     }
     await setKeyPermissions(privatePath);
-    const pubResult = await runOpenSSL(["pkey", "-in", privatePath, "-pubout", "-out", publicPath]);
+    const pubArgs = ["pkey", "-in", privatePath, "-pubout", "-out", publicPath];
+    if (passphrase) {
+      pubArgs.push("-passin", "stdin");
+    }
+    const pubResult = await runOpenSSL(
+      pubArgs,
+      passphrase ? Buffer.from(passphrase + "\n") : void 0
+    );
     if (pubResult.exitCode !== 0) {
       throw new Error(`Failed to extract public key: ${pubResult.stderr}`);
     }
@@ -201,7 +218,7 @@ async function generateKeyPair(options = {}) {
 }
 async function sign(options) {
   await ensureOpenSSLAvailable();
-  const { privateKeyPath, keyProvider, keyRef, data } = options;
+  const { privateKeyPath, keyProvider, keyRef, data, passphrase } = options;
   let effectiveKeyPath;
   let cleanup;
   if (keyProvider && keyRef) {
@@ -226,9 +243,22 @@ async function sign(options) {
     const sigFile = path2__namespace.join(tmpDir, "sig.bin");
     try {
       await fs8__namespace.writeFile(dataFile, processBuffer);
-      const signArgs = ["dgst", "-sha256", "-sign", effectiveKeyPath, "-out", sigFile, dataFile];
-      const result = await runOpenSSL(signArgs);
+      const signArgs = ["dgst", "-sha256"];
+      if (passphrase) {
+        signArgs.push("-passin", "stdin");
+      }
+      signArgs.push("-sign", effectiveKeyPath, "-out", sigFile, dataFile);
+      const result = await runOpenSSL(
+        signArgs,
+        passphrase ? Buffer.from(passphrase + "\n") : void 0
+      );
       if (result.exitCode !== 0) {
+        const stderr = result.stderr.toLowerCase();
+        if (stderr.includes("bad decrypt") || stderr.includes("bad password") || stderr.includes("unable to load key") || stderr.includes("wrong password")) {
+          throw new Error(
+            "Failed to decrypt private key. Please check that the passphrase is correct."
+          );
+        }
         throw new Error(`Failed to sign data: ${result.stderr}`);
       }
       const sigBuffer = await fs8__namespace.readFile(sigFile);
@@ -335,6 +365,7 @@ var settingsSchema = zod.z.object({
   maxAgeDays: zod.z.number().int().positive().default(30),
   publicKeyPath: zod.z.string().default(".attest-it/pubkey.pem"),
   attestationsPath: zod.z.string().default(".attest-it/attestations.json"),
+  sealsPath: zod.z.string().default(".attest-it/seals.json"),
   defaultCommand: zod.z.string().optional(),
   keyProvider: keyProviderSchema.optional()
   // Note: algorithm field was removed - RSA is the only supported algorithm
@@ -488,7 +519,8 @@ function toAttestItConfig(config) {
     settings: {
       maxAgeDays: config.settings.maxAgeDays,
       publicKeyPath: config.settings.publicKeyPath,
-      attestationsPath: config.settings.attestationsPath
+      attestationsPath: config.settings.attestationsPath,
+      sealsPath: config.settings.sealsPath
     },
     suites: {}
   };
@@ -575,7 +607,8 @@ var keyProviderSchema2 = zod.z.object({
 var policySettingsSchema = zod.z.object({
   maxAgeDays: zod.z.number().int().positive().default(30),
   publicKeyPath: zod.z.string().default(".attest-it/pubkey.pem"),
-  attestationsPath: zod.z.string().default(".attest-it/attestations.json")
+  attestationsPath: zod.z.string().default(".attest-it/attestations.json"),
+  sealsPath: zod.z.string().default(".attest-it/seals.json")
 }).strict();
 var policySchema = zod.z.object({
   version: zod.z.literal(1),
@@ -752,7 +785,8 @@ function mergeConfigs(policy, operational) {
     // Security settings from policy (these are trust-critical)
     maxAgeDays: policy.settings.maxAgeDays,
     publicKeyPath: policy.settings.publicKeyPath,
-    attestationsPath: policy.settings.attestationsPath
+    attestationsPath: policy.settings.attestationsPath,
+    sealsPath: policy.settings.sealsPath
   };
   if (operational.settings.defaultCommand !== void 0) {
     settings.defaultCommand = operational.settings.defaultCommand;
@@ -847,7 +881,7 @@ function computeFinalFingerprint(fileHashes) {
 }
 async function hashFileAsync(realPath, normalizedPath, stats) {
   if (stats.size > LARGE_FILE_THRESHOLD) {
-    return new Promise((resolve4, reject) => {
+    return new Promise((resolve5, reject) => {
       const hash2 = crypto3__namespace.createHash("sha256");
       hash2.update(normalizedPath);
       hash2.update(":");
@@ -856,7 +890,7 @@ async function hashFileAsync(realPath, normalizedPath, stats) {
         hash2.update(chunk);
       });
       stream.on("end", () => {
-        resolve4(hash2.digest());
+        resolve5(hash2.digest());
       });
       stream.on("error", reject);
     });
@@ -1470,16 +1504,23 @@ var FilesystemKeyProvider = class {
    * @param options - Key generation options
    */
   async generateKeyPair(options) {
-    const { publicKeyPath, force = false } = options;
-    const result = await generateKeyPair({
+    const { publicKeyPath, force = false, passphrase } = options;
+    const cryptoOptions = {
       privatePath: this.privateKeyPath,
       publicPath: publicKeyPath,
       force
-    });
+    };
+    if (passphrase !== void 0) {
+      cryptoOptions.passphrase = passphrase;
+    }
+    const result = await generateKeyPair(cryptoOptions);
+    const encrypted = passphrase !== void 0 && passphrase.length > 0;
+    const encryptionStatus = encrypted ? " (passphrase-encrypted)" : "";
     return {
       privateKeyRef: result.privatePath,
       publicKeyPath: result.publicPath,
-      storageDescription: `Filesystem: ${result.privatePath}`
+      storageDescription: `Filesystem: ${result.privatePath}${encryptionStatus}`,
+      encrypted
     };
   }
   /**
@@ -1718,7 +1759,7 @@ var OnePasswordKeyProvider = class _OnePasswordKeyProvider {
   }
 };
 async function execCommand(command, args) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     const proc = child_process.spawn(command, args, { stdio: ["ignore", "pipe", "pipe"] });
     let stdout = "";
     let stderr = "";
@@ -1730,7 +1771,7 @@ async function execCommand(command, args) {
     });
     proc.on("close", (code) => {
       if (code === 0) {
-        resolve4(stdout.trim());
+        resolve5(stdout.trim());
       } else {
         reject(new Error(`Command failed with exit code ${String(code)}: ${stderr}`));
       }
@@ -1932,7 +1973,7 @@ var MacOSKeychainKeyProvider = class _MacOSKeychainKeyProvider {
   }
 };
 async function execCommand2(command, args) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     const proc = child_process.spawn(command, args, { stdio: ["ignore", "pipe", "pipe"] });
     let stdout = "";
     let stderr = "";
@@ -1944,7 +1985,7 @@ async function execCommand2(command, args) {
     });
     proc.on("close", (code) => {
       if (code === 0) {
-        resolve4(stdout.trim());
+        resolve5(stdout.trim());
       } else {
         reject(new Error(`Command failed with exit code ${String(code)}: ${stderr}`));
       }
@@ -2609,7 +2650,7 @@ var YubiKeyProvider = class _YubiKeyProvider {
   }
 };
 async function execCommand3(command, args) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     const proc = child_process.spawn(command, args, { stdio: ["ignore", "pipe", "pipe"] });
     let stdout = "";
     let stderr = "";
@@ -2621,7 +2662,7 @@ async function execCommand3(command, args) {
     });
     proc.on("close", (code) => {
       if (code === 0) {
-        resolve4(stdout.trim());
+        resolve5(stdout.trim());
       } else {
         reject(new Error(`Command failed with exit code ${String(code)}: ${stderr}`));
       }
@@ -2924,8 +2965,8 @@ ${issues}`);
   }
   return result.data;
 }
-async function readSeals(dir) {
-  const sealsPath = path2__namespace.join(dir, ".attest-it", "seals.json");
+async function readSeals(dir, sealsPathOverride) {
+  const sealsPath = sealsPathOverride ? path2__namespace.resolve(dir, sealsPathOverride) : path2__namespace.join(dir, ".attest-it", "seals.json");
   try {
     const content = await fs__namespace.promises.readFile(sealsPath, "utf8");
     return parseSealsContent(content);
@@ -2941,8 +2982,8 @@ async function readSeals(dir) {
     );
   }
 }
-function readSealsSync(dir) {
-  const sealsPath = path2__namespace.join(dir, ".attest-it", "seals.json");
+function readSealsSync(dir, sealsPathOverride) {
+  const sealsPath = sealsPathOverride ? path2__namespace.resolve(dir, sealsPathOverride) : path2__namespace.join(dir, ".attest-it", "seals.json");
   try {
     const content = fs__namespace.readFileSync(sealsPath, "utf8");
     return parseSealsContent(content);
@@ -2958,11 +2999,11 @@ function readSealsSync(dir) {
     );
   }
 }
-async function writeSeals(dir, sealsFile) {
-  const attestItDir = path2__namespace.join(dir, ".attest-it");
-  const sealsPath = path2__namespace.join(attestItDir, "seals.json");
+async function writeSeals(dir, sealsFile, sealsPathOverride) {
+  const sealsPath = sealsPathOverride ? path2__namespace.resolve(dir, sealsPathOverride) : path2__namespace.join(dir, ".attest-it", "seals.json");
+  const sealsDir = path2__namespace.dirname(sealsPath);
   try {
-    await fs__namespace.promises.mkdir(attestItDir, { recursive: true });
+    await fs__namespace.promises.mkdir(sealsDir, { recursive: true });
     const content = JSON.stringify(sealsFile, null, 2) + "\n";
     await fs__namespace.promises.writeFile(sealsPath, content, "utf8");
   } catch (error) {
@@ -2971,11 +3012,11 @@ async function writeSeals(dir, sealsFile) {
     );
   }
 }
-function writeSealsSync(dir, sealsFile) {
-  const attestItDir = path2__namespace.join(dir, ".attest-it");
-  const sealsPath = path2__namespace.join(attestItDir, "seals.json");
+function writeSealsSync(dir, sealsFile, sealsPathOverride) {
+  const sealsPath = sealsPathOverride ? path2__namespace.resolve(dir, sealsPathOverride) : path2__namespace.join(dir, ".attest-it", "seals.json");
+  const sealsDir = path2__namespace.dirname(sealsPath);
   try {
-    fs__namespace.mkdirSync(attestItDir, { recursive: true });
+    fs__namespace.mkdirSync(sealsDir, { recursive: true });
     const content = JSON.stringify(sealsFile, null, 2) + "\n";
     fs__namespace.writeFileSync(sealsPath, content, "utf8");
   } catch (error) {