@attest-it/core 0.7.0 → 0.9.0

package/dist/core-beta.d.ts

@@ -62,6 +62,8 @@ export declare interface AttestItSettings {
     publicKeyPath: string;
     /** Path to the attestations file */
     attestationsPath: string;
+    /** Path to the seals file */
+    sealsPath: string;
     /** Default command to execute for attestation (can be overridden per suite) */
     defaultCommand?: string;
     /** Key provider configuration for signing attestations */
@@ -226,6 +228,7 @@ declare const configSchema: z.ZodObject<{
         }>>;
         maxAgeDays: z.ZodDefault<z.ZodNumber>;
         publicKeyPath: z.ZodDefault<z.ZodString>;
+        sealsPath: z.ZodDefault<z.ZodString>;
     }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
         attestationsPath: z.ZodDefault<z.ZodString>;
         defaultCommand: z.ZodOptional<z.ZodString>;
@@ -266,6 +269,7 @@ declare const configSchema: z.ZodObject<{
         }>>;
         maxAgeDays: z.ZodDefault<z.ZodNumber>;
         publicKeyPath: z.ZodDefault<z.ZodString>;
+        sealsPath: z.ZodDefault<z.ZodString>;
     }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
         attestationsPath: z.ZodDefault<z.ZodString>;
         defaultCommand: z.ZodOptional<z.ZodString>;
@@ -306,6 +310,7 @@ declare const configSchema: z.ZodObject<{
         }>>;
         maxAgeDays: z.ZodDefault<z.ZodNumber>;
         publicKeyPath: z.ZodDefault<z.ZodString>;
+        sealsPath: z.ZodDefault<z.ZodString>;
     }, z.ZodTypeAny, "passthrough">>>;
     suites: z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodEffects<z.ZodObject<{
         command: z.ZodOptional<z.ZodString>;
@@ -390,16 +395,19 @@ declare const configSchema: z.ZodObject<{
         github: z.ZodOptional<z.ZodString>;
         name: z.ZodString;
         publicKey: z.ZodString;
+        publicKeyAlgorithm: z.ZodOptional<z.ZodEnum<["ed25519"]>>;
     }, "strict", z.ZodTypeAny, {
         email?: string | undefined;
         github?: string | undefined;
         name: string;
         publicKey: string;
+        publicKeyAlgorithm?: "ed25519" | undefined;
     }, {
         email?: string | undefined;
         github?: string | undefined;
         name: string;
         publicKey: string;
+        publicKeyAlgorithm?: "ed25519" | undefined;
     }>>>;
     version: z.ZodLiteral<1>;
 }, "strict", z.ZodTypeAny, {
@@ -428,6 +436,7 @@ declare const configSchema: z.ZodObject<{
         } | undefined;
         maxAgeDays: number;
         publicKeyPath: string;
+        sealsPath: string;
     } & { [k: string]: unknown };
     suites: Record<string, {
         command?: string | undefined;
@@ -446,6 +455,7 @@ declare const configSchema: z.ZodObject<{
         github?: string | undefined;
         name: string;
         publicKey: string;
+        publicKeyAlgorithm?: "ed25519" | undefined;
     }> | undefined;
     version: 1;
 }, {
@@ -500,6 +510,7 @@ declare const configSchema: z.ZodObject<{
         }>>;
         maxAgeDays: z.ZodDefault<z.ZodNumber>;
         publicKeyPath: z.ZodDefault<z.ZodString>;
+        sealsPath: z.ZodDefault<z.ZodString>;
     }, z.ZodTypeAny, "passthrough">;
     suites: Record<string, {
         command?: string | undefined;
@@ -518,6 +529,7 @@ declare const configSchema: z.ZodObject<{
         github?: string | undefined;
         name: string;
         publicKey: string;
+        publicKeyAlgorithm?: "ed25519" | undefined;
     }> | undefined;
     version: 1;
 }>;
@@ -878,9 +890,8 @@ export declare function getPreferencesPath(): string;
 /**
  * Get the project public keys directory.
  *
- * This returns .attest-it/public-keys relative to the given project root.
- * The project public keys directory is used for CI/GitHub Actions to
- * verify attestation seals.
+ * @deprecated Public keys are now stored inline in the team section of config.yaml.
+ * This function is kept for backward compatibility but should not be used in new code.
  *
  * @param projectRoot - The project root directory (defaults to cwd)
  * @returns Path to the project public keys directory
@@ -901,6 +912,9 @@ export declare function getPublicKeyFromPrivate(privateKeyPem: string): string;
 /**
  * Check if a project has attest-it configuration.
  *
+ * @deprecated This function is kept for backward compatibility but is no longer used
+ * by the core library. Public keys are now stored inline in config.yaml.
+ *
  * @param projectRoot - The project root directory (defaults to cwd)
  * @returns True if the project has .attest-it/config.yaml or similar
  * @public
@@ -946,6 +960,8 @@ export declare interface KeyGenerationResult {
     publicKeyPath: string;
     /** Human-readable storage location description */
     storageDescription: string;
+    /** Whether the private key is encrypted with a passphrase */
+    encrypted?: boolean;
 }
 
 /**
@@ -959,6 +975,8 @@ export declare interface KeygenOptions {
     publicPath?: string;
     /** Overwrite existing keys (default: false) */
     force?: boolean;
+    /** Passphrase to encrypt the private key with AES-256 (optional) */
+    passphrase?: string;
 }
 
 /**
@@ -970,6 +988,8 @@ export declare interface KeygenProviderOptions {
     publicKeyPath: string;
     /** Overwrite existing keys */
     force?: boolean;
+    /** Passphrase to encrypt the private key (filesystem provider only) */
+    passphrase?: string;
 }
 
 /**
@@ -1271,7 +1291,7 @@ export declare function listPackageFiles(packages: string[], ignore?: string[],
            * The merge strategy prioritizes security-critical fields from the policy
            * configuration while combining operational fields from both sources:
            *
-           * - **Policy settings** (maxAgeDays, publicKeyPath, attestationsPath) are used as-is
+           * - **Policy settings** (maxAgeDays, publicKeyPath, attestationsPath, sealsPath) are used as-is
            * - **Operational settings** (defaultCommand, keyProvider) are added from operational config
            * - **Team and gates** come exclusively from policy config
            * - **Suites and groups** come exclusively from operational config
@@ -1708,30 +1728,36 @@ export declare function listPackageFiles(packages: string[], ignore?: string[],
                     attestationsPath: z.ZodDefault<z.ZodString>;
                     maxAgeDays: z.ZodDefault<z.ZodNumber>;
                     publicKeyPath: z.ZodDefault<z.ZodString>;
+                    sealsPath: z.ZodDefault<z.ZodString>;
                 }, "strict", z.ZodTypeAny, {
                     attestationsPath: string;
                     maxAgeDays: number;
                     publicKeyPath: string;
+                    sealsPath: string;
                 }, {
                     attestationsPath?: string | undefined;
                     maxAgeDays?: number | undefined;
                     publicKeyPath?: string | undefined;
+                    sealsPath?: string | undefined;
                 }>>;
                 team: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
                     email: z.ZodOptional<z.ZodString>;
                     github: z.ZodOptional<z.ZodString>;
                     name: z.ZodString;
                     publicKey: z.ZodString;
+                    publicKeyAlgorithm: z.ZodOptional<z.ZodLiteral<"ed25519">>;
                 }, "strict", z.ZodTypeAny, {
                     email?: string | undefined;
                     github?: string | undefined;
                     name: string;
                     publicKey: string;
+                    publicKeyAlgorithm?: "ed25519" | undefined;
                 }, {
                     email?: string | undefined;
                     github?: string | undefined;
                     name: string;
                     publicKey: string;
+                    publicKeyAlgorithm?: "ed25519" | undefined;
                 }>>>;
                 version: z.ZodLiteral<1>;
             }, "strict", z.ZodTypeAny, {
@@ -1749,12 +1775,14 @@ export declare function listPackageFiles(packages: string[], ignore?: string[],
                     attestationsPath: string;
                     maxAgeDays: number;
                     publicKeyPath: string;
+                    sealsPath: string;
                 };
                 team?: Record<string, {
                     email?: string | undefined;
                     github?: string | undefined;
                     name: string;
                     publicKey: string;
+                    publicKeyAlgorithm?: "ed25519" | undefined;
                 }> | undefined;
                 version: 1;
             }, {
@@ -1772,12 +1800,14 @@ export declare function listPackageFiles(packages: string[], ignore?: string[],
                     attestationsPath?: string | undefined;
                     maxAgeDays?: number | undefined;
                     publicKeyPath?: string | undefined;
+                    sealsPath?: string | undefined;
                 } | undefined;
                 team?: Record<string, {
                     email?: string | undefined;
                     github?: string | undefined;
                     name: string;
                     publicKey: string;
+                    publicKeyAlgorithm?: "ed25519" | undefined;
                 }> | undefined;
                 version: 1;
             }>;
@@ -1855,21 +1885,23 @@ export declare function listPackageFiles(packages: string[], ignore?: string[],
              * Read seals from the seals.json file (async).
              *
              * @param dir - Directory containing .attest-it/seals.json
+             * @param sealsPathOverride - Optional explicit path to seals file (from config.settings.sealsPath)
              * @returns The seals file contents, or an empty seals file if the file doesn't exist
              * @throws Error if file exists but cannot be read or parsed
              * @public
              */
-            export declare function readSeals(dir: string): Promise<SealsFile>;
+            export declare function readSeals(dir: string, sealsPathOverride?: string): Promise<SealsFile>;
 
             /**
              * Read seals from the seals.json file (sync).
              *
              * @param dir - Directory containing .attest-it/seals.json
+             * @param sealsPathOverride - Optional explicit path to seals file (from config.settings.sealsPath)
              * @returns The seals file contents, or an empty seals file if the file doesn't exist
              * @throws Error if file exists but cannot be read or parsed
              * @public
              */
-            export declare function readSealsSync(dir: string): SealsFile;
+            export declare function readSealsSync(dir: string, sealsPathOverride?: string): SealsFile;
 
             /**
              * Options for reading and verifying signed attestations.
@@ -1936,16 +1968,17 @@ export declare function listPackageFiles(packages: string[], ignore?: string[],
             export declare function savePreferences(preferences: UserPreferences): Promise<void>;
 
             /**
-             * Save a public key to the user's home directory and optionally to the project directory.
+             * Save a public key to the user's home directory.
              *
              * This saves the public key as a base64-encoded string (matching the format in config.yaml)
-             * to:
-             * 1. ~/.attest-it/public-keys/<slug>.pem (always)
-             * 2. ./.attest-it/public-keys/<slug>.pem (if project has attest-it config)
+             * to ~/.attest-it/public-keys/<slug>.pem for backup purposes.
+             *
+             * Public keys are now stored inline in the team section of config.yaml and no longer
+             * written to the project directory.
              *
              * @param slug - The identity slug (used for the filename)
              * @param publicKey - The base64-encoded public key
-             * @param projectRoot - The project root directory (defaults to cwd)
+             * @param projectRoot - The project root directory (deprecated, kept for backward compatibility)
              * @returns Paths where the key was saved
              * @public
              */
@@ -1963,16 +1996,17 @@ export declare function listPackageFiles(packages: string[], ignore?: string[],
             }
 
             /**
-             * Save a public key to the user's home directory and optionally to the project directory (sync).
+             * Save a public key to the user's home directory (sync).
              *
              * This saves the public key as a base64-encoded string (matching the format in config.yaml)
-             * to:
-             * 1. ~/.attest-it/public-keys/<slug>.pem (always)
-             * 2. ./.attest-it/public-keys/<slug>.pem (if project has attest-it config)
+             * to ~/.attest-it/public-keys/<slug>.pem for backup purposes.
+             *
+             * Public keys are now stored inline in the team section of config.yaml and no longer
+             * written to the project directory.
              *
              * @param slug - The identity slug (used for the filename)
              * @param publicKey - The base64-encoded public key
-             * @param projectRoot - The project root directory (defaults to cwd)
+             * @param projectRoot - The project root directory (deprecated, kept for backward compatibility)
              * @returns Paths where the key was saved
              * @public
              */
@@ -2107,6 +2141,8 @@ export declare function listPackageFiles(packages: string[], ignore?: string[],
                 keyRef?: string;
                 /** Data to sign (string or Buffer) */
                 data: Buffer | string;
+                /** Passphrase for encrypted private keys (optional) */
+                passphrase?: string;
             }
 
             /**
@@ -2171,6 +2207,8 @@ export declare function listPackageFiles(packages: string[], ignore?: string[],
                 github?: string | undefined;
                 /** Base64-encoded Ed25519 public key */
                 publicKey: string;
+                /** Public key algorithm (optional, for future-proofing format changes) */
+                publicKeyAlgorithm?: 'ed25519' | undefined;
             }
 
             /**
@@ -2419,20 +2457,22 @@ export declare function listPackageFiles(packages: string[], ignore?: string[],
              *
              * @param dir - Directory containing .attest-it/seals.json
              * @param sealsFile - The seals file to write
+             * @param sealsPathOverride - Optional explicit path to seals file (from config.settings.sealsPath)
              * @throws Error if file cannot be written
              * @public
              */
-            export declare function writeSeals(dir: string, sealsFile: SealsFile): Promise<void>;
+            export declare function writeSeals(dir: string, sealsFile: SealsFile, sealsPathOverride?: string): Promise<void>;
 
             /**
              * Write seals to the seals.json file (sync).
              *
              * @param dir - Directory containing .attest-it/seals.json
              * @param sealsFile - The seals file to write
+             * @param sealsPathOverride - Optional explicit path to seals file (from config.settings.sealsPath)
              * @throws Error if file cannot be written
              * @public
              */
-            export declare function writeSealsSync(dir: string, sealsFile: SealsFile): void;
+            export declare function writeSealsSync(dir: string, sealsFile: SealsFile, sealsPathOverride?: string): void;
 
             /**
              * Write attestations with a cryptographic signature.

package/dist/core-public.d.ts

@@ -62,6 +62,8 @@ export declare interface AttestItSettings {
     publicKeyPath: string;
     /** Path to the attestations file */
     attestationsPath: string;
+    /** Path to the seals file */
+    sealsPath: string;
     /** Default command to execute for attestation (can be overridden per suite) */
     defaultCommand?: string;
     /** Key provider configuration for signing attestations */
@@ -226,6 +228,7 @@ declare const configSchema: z.ZodObject<{
         }>>;
         maxAgeDays: z.ZodDefault<z.ZodNumber>;
         publicKeyPath: z.ZodDefault<z.ZodString>;
+        sealsPath: z.ZodDefault<z.ZodString>;
     }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
         attestationsPath: z.ZodDefault<z.ZodString>;
         defaultCommand: z.ZodOptional<z.ZodString>;
@@ -266,6 +269,7 @@ declare const configSchema: z.ZodObject<{
         }>>;
         maxAgeDays: z.ZodDefault<z.ZodNumber>;
         publicKeyPath: z.ZodDefault<z.ZodString>;
+        sealsPath: z.ZodDefault<z.ZodString>;
     }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
         attestationsPath: z.ZodDefault<z.ZodString>;
         defaultCommand: z.ZodOptional<z.ZodString>;
@@ -306,6 +310,7 @@ declare const configSchema: z.ZodObject<{
         }>>;
         maxAgeDays: z.ZodDefault<z.ZodNumber>;
         publicKeyPath: z.ZodDefault<z.ZodString>;
+        sealsPath: z.ZodDefault<z.ZodString>;
     }, z.ZodTypeAny, "passthrough">>>;
     suites: z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodEffects<z.ZodObject<{
         command: z.ZodOptional<z.ZodString>;
@@ -390,16 +395,19 @@ declare const configSchema: z.ZodObject<{
         github: z.ZodOptional<z.ZodString>;
         name: z.ZodString;
         publicKey: z.ZodString;
+        publicKeyAlgorithm: z.ZodOptional<z.ZodEnum<["ed25519"]>>;
     }, "strict", z.ZodTypeAny, {
         email?: string | undefined;
         github?: string | undefined;
         name: string;
         publicKey: string;
+        publicKeyAlgorithm?: "ed25519" | undefined;
     }, {
         email?: string | undefined;
         github?: string | undefined;
         name: string;
         publicKey: string;
+        publicKeyAlgorithm?: "ed25519" | undefined;
     }>>>;
     version: z.ZodLiteral<1>;
 }, "strict", z.ZodTypeAny, {
@@ -428,6 +436,7 @@ declare const configSchema: z.ZodObject<{
         } | undefined;
         maxAgeDays: number;
         publicKeyPath: string;
+        sealsPath: string;
     } & { [k: string]: unknown };
     suites: Record<string, {
         command?: string | undefined;
@@ -446,6 +455,7 @@ declare const configSchema: z.ZodObject<{
         github?: string | undefined;
         name: string;
         publicKey: string;
+        publicKeyAlgorithm?: "ed25519" | undefined;
     }> | undefined;
     version: 1;
 }, {
@@ -500,6 +510,7 @@ declare const configSchema: z.ZodObject<{
         }>>;
         maxAgeDays: z.ZodDefault<z.ZodNumber>;
         publicKeyPath: z.ZodDefault<z.ZodString>;
+        sealsPath: z.ZodDefault<z.ZodString>;
     }, z.ZodTypeAny, "passthrough">;
     suites: Record<string, {
         command?: string | undefined;
@@ -518,6 +529,7 @@ declare const configSchema: z.ZodObject<{
         github?: string | undefined;
         name: string;
         publicKey: string;
+        publicKeyAlgorithm?: "ed25519" | undefined;
     }> | undefined;
     version: 1;
 }>;
@@ -878,9 +890,8 @@ export declare function getPreferencesPath(): string;
 /**
  * Get the project public keys directory.
  *
- * This returns .attest-it/public-keys relative to the given project root.
- * The project public keys directory is used for CI/GitHub Actions to
- * verify attestation seals.
+ * @deprecated Public keys are now stored inline in the team section of config.yaml.
+ * This function is kept for backward compatibility but should not be used in new code.
  *
  * @param projectRoot - The project root directory (defaults to cwd)
  * @returns Path to the project public keys directory
@@ -901,6 +912,9 @@ export declare function getPublicKeyFromPrivate(privateKeyPem: string): string;
 /**
  * Check if a project has attest-it configuration.
  *
+ * @deprecated This function is kept for backward compatibility but is no longer used
+ * by the core library. Public keys are now stored inline in config.yaml.
+ *
  * @param projectRoot - The project root directory (defaults to cwd)
  * @returns True if the project has .attest-it/config.yaml or similar
  * @public
@@ -946,6 +960,8 @@ export declare interface KeyGenerationResult {
     publicKeyPath: string;
     /** Human-readable storage location description */
     storageDescription: string;
+    /** Whether the private key is encrypted with a passphrase */
+    encrypted?: boolean;
 }
 
 /**
@@ -959,6 +975,8 @@ export declare interface KeygenOptions {
     publicPath?: string;
     /** Overwrite existing keys (default: false) */
     force?: boolean;
+    /** Passphrase to encrypt the private key with AES-256 (optional) */
+    passphrase?: string;
 }
 
 /**
@@ -970,6 +988,8 @@ export declare interface KeygenProviderOptions {
     publicKeyPath: string;
     /** Overwrite existing keys */
     force?: boolean;
+    /** Passphrase to encrypt the private key (filesystem provider only) */
+    passphrase?: string;
 }
 
 /**
@@ -1271,7 +1291,7 @@ export declare function listPackageFiles(packages: string[], ignore?: string[],
            * The merge strategy prioritizes security-critical fields from the policy
            * configuration while combining operational fields from both sources:
            *
-           * - **Policy settings** (maxAgeDays, publicKeyPath, attestationsPath) are used as-is
+           * - **Policy settings** (maxAgeDays, publicKeyPath, attestationsPath, sealsPath) are used as-is
            * - **Operational settings** (defaultCommand, keyProvider) are added from operational config
            * - **Team and gates** come exclusively from policy config
            * - **Suites and groups** come exclusively from operational config
@@ -1708,30 +1728,36 @@ export declare function listPackageFiles(packages: string[], ignore?: string[],
                     attestationsPath: z.ZodDefault<z.ZodString>;
                     maxAgeDays: z.ZodDefault<z.ZodNumber>;
                     publicKeyPath: z.ZodDefault<z.ZodString>;
+                    sealsPath: z.ZodDefault<z.ZodString>;
                 }, "strict", z.ZodTypeAny, {
                     attestationsPath: string;
                     maxAgeDays: number;
                     publicKeyPath: string;
+                    sealsPath: string;
                 }, {
                     attestationsPath?: string | undefined;
                     maxAgeDays?: number | undefined;
                     publicKeyPath?: string | undefined;
+                    sealsPath?: string | undefined;
                 }>>;
                 team: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
                     email: z.ZodOptional<z.ZodString>;
                     github: z.ZodOptional<z.ZodString>;
                     name: z.ZodString;
                     publicKey: z.ZodString;
+                    publicKeyAlgorithm: z.ZodOptional<z.ZodLiteral<"ed25519">>;
                 }, "strict", z.ZodTypeAny, {
                     email?: string | undefined;
                     github?: string | undefined;
                     name: string;
                     publicKey: string;
+                    publicKeyAlgorithm?: "ed25519" | undefined;
                 }, {
                     email?: string | undefined;
                     github?: string | undefined;
                     name: string;
                     publicKey: string;
+                    publicKeyAlgorithm?: "ed25519" | undefined;
                 }>>>;
                 version: z.ZodLiteral<1>;
             }, "strict", z.ZodTypeAny, {
@@ -1749,12 +1775,14 @@ export declare function listPackageFiles(packages: string[], ignore?: string[],
                     attestationsPath: string;
                     maxAgeDays: number;
                     publicKeyPath: string;
+                    sealsPath: string;
                 };
                 team?: Record<string, {
                     email?: string | undefined;
                     github?: string | undefined;
                     name: string;
                     publicKey: string;
+                    publicKeyAlgorithm?: "ed25519" | undefined;
                 }> | undefined;
                 version: 1;
             }, {
@@ -1772,12 +1800,14 @@ export declare function listPackageFiles(packages: string[], ignore?: string[],
                     attestationsPath?: string | undefined;
                     maxAgeDays?: number | undefined;
                     publicKeyPath?: string | undefined;
+                    sealsPath?: string | undefined;
                 } | undefined;
                 team?: Record<string, {
                     email?: string | undefined;
                     github?: string | undefined;
                     name: string;
                     publicKey: string;
+                    publicKeyAlgorithm?: "ed25519" | undefined;
                 }> | undefined;
                 version: 1;
             }>;
@@ -1855,21 +1885,23 @@ export declare function listPackageFiles(packages: string[], ignore?: string[],
              * Read seals from the seals.json file (async).
              *
              * @param dir - Directory containing .attest-it/seals.json
+             * @param sealsPathOverride - Optional explicit path to seals file (from config.settings.sealsPath)
              * @returns The seals file contents, or an empty seals file if the file doesn't exist
              * @throws Error if file exists but cannot be read or parsed
              * @public
              */
-            export declare function readSeals(dir: string): Promise<SealsFile>;
+            export declare function readSeals(dir: string, sealsPathOverride?: string): Promise<SealsFile>;
 
             /**
              * Read seals from the seals.json file (sync).
              *
              * @param dir - Directory containing .attest-it/seals.json
+             * @param sealsPathOverride - Optional explicit path to seals file (from config.settings.sealsPath)
              * @returns The seals file contents, or an empty seals file if the file doesn't exist
              * @throws Error if file exists but cannot be read or parsed
              * @public
              */
-            export declare function readSealsSync(dir: string): SealsFile;
+            export declare function readSealsSync(dir: string, sealsPathOverride?: string): SealsFile;
 
             /**
              * Options for reading and verifying signed attestations.
@@ -1936,16 +1968,17 @@ export declare function listPackageFiles(packages: string[], ignore?: string[],
             export declare function savePreferences(preferences: UserPreferences): Promise<void>;
 
             /**
-             * Save a public key to the user's home directory and optionally to the project directory.
+             * Save a public key to the user's home directory.
              *
              * This saves the public key as a base64-encoded string (matching the format in config.yaml)
-             * to:
-             * 1. ~/.attest-it/public-keys/<slug>.pem (always)
-             * 2. ./.attest-it/public-keys/<slug>.pem (if project has attest-it config)
+             * to ~/.attest-it/public-keys/<slug>.pem for backup purposes.
+             *
+             * Public keys are now stored inline in the team section of config.yaml and no longer
+             * written to the project directory.
              *
              * @param slug - The identity slug (used for the filename)
              * @param publicKey - The base64-encoded public key
-             * @param projectRoot - The project root directory (defaults to cwd)
+             * @param projectRoot - The project root directory (deprecated, kept for backward compatibility)
              * @returns Paths where the key was saved
              * @public
              */
@@ -1963,16 +1996,17 @@ export declare function listPackageFiles(packages: string[], ignore?: string[],
             }
 
             /**
-             * Save a public key to the user's home directory and optionally to the project directory (sync).
+             * Save a public key to the user's home directory (sync).
              *
              * This saves the public key as a base64-encoded string (matching the format in config.yaml)
-             * to:
-             * 1. ~/.attest-it/public-keys/<slug>.pem (always)
-             * 2. ./.attest-it/public-keys/<slug>.pem (if project has attest-it config)
+             * to ~/.attest-it/public-keys/<slug>.pem for backup purposes.
+             *
+             * Public keys are now stored inline in the team section of config.yaml and no longer
+             * written to the project directory.
              *
              * @param slug - The identity slug (used for the filename)
              * @param publicKey - The base64-encoded public key
-             * @param projectRoot - The project root directory (defaults to cwd)
+             * @param projectRoot - The project root directory (deprecated, kept for backward compatibility)
              * @returns Paths where the key was saved
              * @public
              */
@@ -2107,6 +2141,8 @@ export declare function listPackageFiles(packages: string[], ignore?: string[],
                 keyRef?: string;
                 /** Data to sign (string or Buffer) */
                 data: Buffer | string;
+                /** Passphrase for encrypted private keys (optional) */
+                passphrase?: string;
             }
 
             /**
@@ -2171,6 +2207,8 @@ export declare function listPackageFiles(packages: string[], ignore?: string[],
                 github?: string | undefined;
                 /** Base64-encoded Ed25519 public key */
                 publicKey: string;
+                /** Public key algorithm (optional, for future-proofing format changes) */
+                publicKeyAlgorithm?: 'ed25519' | undefined;
             }
 
             /**
@@ -2419,20 +2457,22 @@ export declare function listPackageFiles(packages: string[], ignore?: string[],
              *
              * @param dir - Directory containing .attest-it/seals.json
              * @param sealsFile - The seals file to write
+             * @param sealsPathOverride - Optional explicit path to seals file (from config.settings.sealsPath)
              * @throws Error if file cannot be written
              * @public
              */
-            export declare function writeSeals(dir: string, sealsFile: SealsFile): Promise<void>;
+            export declare function writeSeals(dir: string, sealsFile: SealsFile, sealsPathOverride?: string): Promise<void>;
 
             /**
              * Write seals to the seals.json file (sync).
              *
              * @param dir - Directory containing .attest-it/seals.json
              * @param sealsFile - The seals file to write
+             * @param sealsPathOverride - Optional explicit path to seals file (from config.settings.sealsPath)
              * @throws Error if file cannot be written
              * @public
              */
-            export declare function writeSealsSync(dir: string, sealsFile: SealsFile): void;
+            export declare function writeSealsSync(dir: string, sealsFile: SealsFile, sealsPathOverride?: string): void;
 
             /**
              * Write attestations with a cryptographic signature.