@attest-it/core 0.7.0 → 0.9.0

package/dist/index.cjs

@@ -63,7 +63,7 @@ __export(crypto_exports, {
   verify: () => verify
 });
 async function runOpenSSL(args, stdin) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     const child = child_process.spawn("openssl", args, {
       stdio: ["pipe", "pipe", "pipe"]
     });
@@ -79,12 +79,15 @@ async function runOpenSSL(args, stdin) {
       reject(new Error(`Failed to spawn OpenSSL: ${err.message}`));
     });
     child.on("close", (code) => {
-      resolve4({
+      resolve5({
         exitCode: code ?? 1,
         stdout: Buffer.concat(stdoutChunks),
         stderr
       });
     });
+    if (stdin) {
+      child.stdin.write(stdin);
+    }
     child.stdin.end();
   });
 }
@@ -157,7 +160,8 @@ async function generateKeyPair(options = {}) {
   const {
     privatePath = getDefaultPrivateKeyPath(),
     publicPath = getDefaultPublicKeyPath(),
-    force = false
+    force = false,
+    passphrase
   } = options;
   const privateExists = await fileExists(privatePath);
   const publicExists = await fileExists(publicPath);
@@ -181,12 +185,25 @@ async function generateKeyPair(options = {}) {
       "-out",
       privatePath
     ];
-    const genResult = await runOpenSSL(genArgs);
+    if (passphrase) {
+      genArgs.push("-aes256", "-pass", "stdin");
+    }
+    const genResult = await runOpenSSL(
+      genArgs,
+      passphrase ? Buffer.from(passphrase + "\n") : void 0
+    );
     if (genResult.exitCode !== 0) {
       throw new Error(`Failed to generate private key: ${genResult.stderr}`);
     }
     await setKeyPermissions(privatePath);
-    const pubResult = await runOpenSSL(["pkey", "-in", privatePath, "-pubout", "-out", publicPath]);
+    const pubArgs = ["pkey", "-in", privatePath, "-pubout", "-out", publicPath];
+    if (passphrase) {
+      pubArgs.push("-passin", "stdin");
+    }
+    const pubResult = await runOpenSSL(
+      pubArgs,
+      passphrase ? Buffer.from(passphrase + "\n") : void 0
+    );
     if (pubResult.exitCode !== 0) {
       throw new Error(`Failed to extract public key: ${pubResult.stderr}`);
     }
@@ -201,7 +218,7 @@ async function generateKeyPair(options = {}) {
 }
 async function sign(options) {
   await ensureOpenSSLAvailable();
-  const { privateKeyPath, keyProvider, keyRef, data } = options;
+  const { privateKeyPath, keyProvider, keyRef, data, passphrase } = options;
   let effectiveKeyPath;
   let cleanup;
   if (keyProvider && keyRef) {
@@ -226,9 +243,22 @@ async function sign(options) {
     const sigFile = path2__namespace.join(tmpDir, "sig.bin");
     try {
       await fs8__namespace.writeFile(dataFile, processBuffer);
-      const signArgs = ["dgst", "-sha256", "-sign", effectiveKeyPath, "-out", sigFile, dataFile];
-      const result = await runOpenSSL(signArgs);
+      const signArgs = ["dgst", "-sha256"];
+      if (passphrase) {
+        signArgs.push("-passin", "stdin");
+      }
+      signArgs.push("-sign", effectiveKeyPath, "-out", sigFile, dataFile);
+      const result = await runOpenSSL(
+        signArgs,
+        passphrase ? Buffer.from(passphrase + "\n") : void 0
+      );
       if (result.exitCode !== 0) {
+        const stderr = result.stderr.toLowerCase();
+        if (stderr.includes("bad decrypt") || stderr.includes("bad password") || stderr.includes("unable to load key") || stderr.includes("wrong password")) {
+          throw new Error(
+            "Failed to decrypt private key. Please check that the passphrase is correct."
+          );
+        }
         throw new Error(`Failed to sign data: ${result.stderr}`);
       }
       const sigBuffer = await fs8__namespace.readFile(sigFile);
@@ -305,7 +335,8 @@ var teamMemberSchema = zod.z.object({
   name: zod.z.string().min(1, "Team member name cannot be empty"),
   email: zod.z.string().email().optional(),
   github: zod.z.string().min(1).optional(),
-  publicKey: zod.z.string().min(1, "Public key is required")
+  publicKey: zod.z.string().min(1, "Public key is required"),
+  publicKeyAlgorithm: zod.z.enum(["ed25519"]).optional()
 }).strict();
 var fingerprintConfigSchema = zod.z.object({
   paths: zod.z.array(zod.z.string().min(1, "Path cannot be empty")).min(1, "At least one path is required"),
@@ -335,6 +366,7 @@ var settingsSchema = zod.z.object({
   maxAgeDays: zod.z.number().int().positive().default(30),
   publicKeyPath: zod.z.string().default(".attest-it/pubkey.pem"),
   attestationsPath: zod.z.string().default(".attest-it/attestations.json"),
+  sealsPath: zod.z.string().default(".attest-it/seals.json"),
   defaultCommand: zod.z.string().optional(),
   keyProvider: keyProviderSchema.optional()
   // Note: algorithm field was removed - RSA is the only supported algorithm
@@ -488,7 +520,8 @@ function toAttestItConfig(config) {
     settings: {
       maxAgeDays: config.settings.maxAgeDays,
       publicKeyPath: config.settings.publicKeyPath,
-      attestationsPath: config.settings.attestationsPath
+      attestationsPath: config.settings.attestationsPath,
+      sealsPath: config.settings.sealsPath
     },
     suites: {}
   };
@@ -534,7 +567,8 @@ var teamMemberSchema2 = zod.z.object({
   name: zod.z.string().min(1, "Team member name cannot be empty"),
   email: zod.z.string().email().optional(),
   github: zod.z.string().min(1).optional(),
-  publicKey: zod.z.string().min(1, "Public key is required")
+  publicKey: zod.z.string().min(1, "Public key is required"),
+  publicKeyAlgorithm: zod.z.literal("ed25519").optional()
 }).strict();
 var fingerprintConfigSchema2 = zod.z.object({
   paths: zod.z.array(zod.z.string().min(1, "Path cannot be empty")).min(1, "At least one path is required"),
@@ -575,7 +609,8 @@ var keyProviderSchema2 = zod.z.object({
 var policySettingsSchema = zod.z.object({
   maxAgeDays: zod.z.number().int().positive().default(30),
   publicKeyPath: zod.z.string().default(".attest-it/pubkey.pem"),
-  attestationsPath: zod.z.string().default(".attest-it/attestations.json")
+  attestationsPath: zod.z.string().default(".attest-it/attestations.json"),
+  sealsPath: zod.z.string().default(".attest-it/seals.json")
 }).strict();
 var policySchema = zod.z.object({
   version: zod.z.literal(1),
@@ -752,7 +787,8 @@ function mergeConfigs(policy, operational) {
     // Security settings from policy (these are trust-critical)
     maxAgeDays: policy.settings.maxAgeDays,
     publicKeyPath: policy.settings.publicKeyPath,
-    attestationsPath: policy.settings.attestationsPath
+    attestationsPath: policy.settings.attestationsPath,
+    sealsPath: policy.settings.sealsPath
   };
   if (operational.settings.defaultCommand !== void 0) {
     settings.defaultCommand = operational.settings.defaultCommand;
@@ -847,7 +883,7 @@ function computeFinalFingerprint(fileHashes) {
 }
 async function hashFileAsync(realPath, normalizedPath, stats) {
   if (stats.size > LARGE_FILE_THRESHOLD) {
-    return new Promise((resolve4, reject) => {
+    return new Promise((resolve5, reject) => {
       const hash2 = crypto3__namespace.createHash("sha256");
       hash2.update(normalizedPath);
       hash2.update(":");
@@ -856,7 +892,7 @@ async function hashFileAsync(realPath, normalizedPath, stats) {
         hash2.update(chunk);
       });
       stream.on("end", () => {
-        resolve4(hash2.digest());
+        resolve5(hash2.digest());
       });
       stream.on("error", reject);
     });
@@ -1470,16 +1506,23 @@ var FilesystemKeyProvider = class {
    * @param options - Key generation options
    */
   async generateKeyPair(options) {
-    const { publicKeyPath, force = false } = options;
-    const result = await generateKeyPair({
+    const { publicKeyPath, force = false, passphrase } = options;
+    const cryptoOptions = {
       privatePath: this.privateKeyPath,
       publicPath: publicKeyPath,
       force
-    });
+    };
+    if (passphrase !== void 0) {
+      cryptoOptions.passphrase = passphrase;
+    }
+    const result = await generateKeyPair(cryptoOptions);
+    const encrypted = passphrase !== void 0 && passphrase.length > 0;
+    const encryptionStatus = encrypted ? " (passphrase-encrypted)" : "";
     return {
       privateKeyRef: result.privatePath,
       publicKeyPath: result.publicPath,
-      storageDescription: `Filesystem: ${result.privatePath}`
+      storageDescription: `Filesystem: ${result.privatePath}${encryptionStatus}`,
+      encrypted
     };
   }
   /**
@@ -1718,7 +1761,7 @@ var OnePasswordKeyProvider = class _OnePasswordKeyProvider {
   }
 };
 async function execCommand(command, args) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     const proc = child_process.spawn(command, args, { stdio: ["ignore", "pipe", "pipe"] });
     let stdout = "";
     let stderr = "";
@@ -1730,7 +1773,7 @@ async function execCommand(command, args) {
     });
     proc.on("close", (code) => {
       if (code === 0) {
-        resolve4(stdout.trim());
+        resolve5(stdout.trim());
       } else {
         reject(new Error(`Command failed with exit code ${String(code)}: ${stderr}`));
       }
@@ -1932,7 +1975,7 @@ var MacOSKeychainKeyProvider = class _MacOSKeychainKeyProvider {
   }
 };
 async function execCommand2(command, args) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     const proc = child_process.spawn(command, args, { stdio: ["ignore", "pipe", "pipe"] });
     let stdout = "";
     let stderr = "";
@@ -1944,7 +1987,7 @@ async function execCommand2(command, args) {
     });
     proc.on("close", (code) => {
       if (code === 0) {
-        resolve4(stdout.trim());
+        resolve5(stdout.trim());
       } else {
         reject(new Error(`Command failed with exit code ${String(code)}: ${stderr}`));
       }
@@ -2105,16 +2148,19 @@ function loadLocalConfigSync(configPath) {
     throw error;
   }
 }
+var IDENTITY_SCHEMA_HEADER = "# yaml-language-server: $schema=https://raw.githubusercontent.com/mike-north/attest-it/main/schemas/v1/identity.schema.json\n";
 async function saveLocalConfig(config, configPath) {
   const resolvedPath = configPath ?? getLocalConfigPath();
-  const content = yaml.stringify(config);
+  const yamlContent = yaml.stringify(config);
+  const content = IDENTITY_SCHEMA_HEADER + yamlContent;
   const dir = path2.dirname(resolvedPath);
   await fs8.mkdir(dir, { recursive: true });
   await fs8.writeFile(resolvedPath, content, "utf8");
 }
 function saveLocalConfigSync(config, configPath) {
   const resolvedPath = configPath ?? getLocalConfigPath();
-  const content = yaml.stringify(config);
+  const yamlContent = yaml.stringify(config);
+  const content = IDENTITY_SCHEMA_HEADER + yamlContent;
   const dir = path2.dirname(resolvedPath);
   fs.mkdirSync(dir, { recursive: true });
   fs.writeFileSync(resolvedPath, content, "utf8");
@@ -2145,13 +2191,6 @@ async function savePublicKey(slug, publicKey, projectRoot = process.cwd()) {
   const homePath = path2.join(homeDir, `${slug}.pem`);
   await fs8.writeFile(homePath, publicKey, "utf8");
   result.homePath = homePath;
-  if (hasProjectConfig(projectRoot)) {
-    const projectDir = getProjectPublicKeysDir(projectRoot);
-    await fs8.mkdir(projectDir, { recursive: true });
-    const projectPath = path2.join(projectDir, `${slug}.pem`);
-    await fs8.writeFile(projectPath, publicKey, "utf8");
-    result.projectPath = projectPath;
-  }
   return result;
 }
 function savePublicKeySync(slug, publicKey, projectRoot = process.cwd()) {
@@ -2163,13 +2202,6 @@ function savePublicKeySync(slug, publicKey, projectRoot = process.cwd()) {
   const homePath = path2.join(homeDir, `${slug}.pem`);
   fs.writeFileSync(homePath, publicKey, "utf8");
   result.homePath = homePath;
-  if (hasProjectConfig(projectRoot)) {
-    const projectDir = getProjectPublicKeysDir(projectRoot);
-    fs.mkdirSync(projectDir, { recursive: true });
-    const projectPath = path2.join(projectDir, `${slug}.pem`);
-    fs.writeFileSync(projectPath, publicKey, "utf8");
-    result.projectPath = projectPath;
-  }
   return result;
 }
 
@@ -2609,7 +2641,7 @@ var YubiKeyProvider = class _YubiKeyProvider {
   }
 };
 async function execCommand3(command, args) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     const proc = child_process.spawn(command, args, { stdio: ["ignore", "pipe", "pipe"] });
     let stdout = "";
     let stderr = "";
@@ -2621,7 +2653,7 @@ async function execCommand3(command, args) {
     });
     proc.on("close", (code) => {
       if (code === 0) {
-        resolve4(stdout.trim());
+        resolve5(stdout.trim());
       } else {
         reject(new Error(`Command failed with exit code ${String(code)}: ${stderr}`));
       }
@@ -2924,8 +2956,8 @@ ${issues}`);
   }
   return result.data;
 }
-async function readSeals(dir) {
-  const sealsPath = path2__namespace.join(dir, ".attest-it", "seals.json");
+async function readSeals(dir, sealsPathOverride) {
+  const sealsPath = sealsPathOverride ? path2__namespace.resolve(dir, sealsPathOverride) : path2__namespace.join(dir, ".attest-it", "seals.json");
   try {
     const content = await fs__namespace.promises.readFile(sealsPath, "utf8");
     return parseSealsContent(content);
@@ -2941,8 +2973,8 @@ async function readSeals(dir) {
     );
   }
 }
-function readSealsSync(dir) {
-  const sealsPath = path2__namespace.join(dir, ".attest-it", "seals.json");
+function readSealsSync(dir, sealsPathOverride) {
+  const sealsPath = sealsPathOverride ? path2__namespace.resolve(dir, sealsPathOverride) : path2__namespace.join(dir, ".attest-it", "seals.json");
   try {
     const content = fs__namespace.readFileSync(sealsPath, "utf8");
     return parseSealsContent(content);
@@ -2958,11 +2990,11 @@ function readSealsSync(dir) {
     );
   }
 }
-async function writeSeals(dir, sealsFile) {
-  const attestItDir = path2__namespace.join(dir, ".attest-it");
-  const sealsPath = path2__namespace.join(attestItDir, "seals.json");
+async function writeSeals(dir, sealsFile, sealsPathOverride) {
+  const sealsPath = sealsPathOverride ? path2__namespace.resolve(dir, sealsPathOverride) : path2__namespace.join(dir, ".attest-it", "seals.json");
+  const sealsDir = path2__namespace.dirname(sealsPath);
   try {
-    await fs__namespace.promises.mkdir(attestItDir, { recursive: true });
+    await fs__namespace.promises.mkdir(sealsDir, { recursive: true });
     const content = JSON.stringify(sealsFile, null, 2) + "\n";
     await fs__namespace.promises.writeFile(sealsPath, content, "utf8");
   } catch (error) {
@@ -2971,11 +3003,11 @@ async function writeSeals(dir, sealsFile) {
     );
   }
 }
-function writeSealsSync(dir, sealsFile) {
-  const attestItDir = path2__namespace.join(dir, ".attest-it");
-  const sealsPath = path2__namespace.join(attestItDir, "seals.json");
+function writeSealsSync(dir, sealsFile, sealsPathOverride) {
+  const sealsPath = sealsPathOverride ? path2__namespace.resolve(dir, sealsPathOverride) : path2__namespace.join(dir, ".attest-it", "seals.json");
+  const sealsDir = path2__namespace.dirname(sealsPath);
   try {
-    fs__namespace.mkdirSync(attestItDir, { recursive: true });
+    fs__namespace.mkdirSync(sealsDir, { recursive: true });
     const content = JSON.stringify(sealsFile, null, 2) + "\n";
     fs__namespace.writeFileSync(sealsPath, content, "utf8");
   } catch (error) {