@attest-it/core 0.8.0 → 0.9.0

package/dist/index.d.cts

@@ -54,6 +54,8 @@ interface TeamMember {
     github?: string | undefined;
     /** Base64-encoded Ed25519 public key */
     publicKey: string;
+    /** Public key algorithm (optional, for future-proofing format changes) */
+    publicKeyAlgorithm?: 'ed25519' | undefined;
 }
 /**
  * Fingerprint configuration for gates.
@@ -316,16 +318,19 @@ declare const configSchema: z.ZodObject<{
         email: z.ZodOptional<z.ZodString>;
         github: z.ZodOptional<z.ZodString>;
         publicKey: z.ZodString;
+        publicKeyAlgorithm: z.ZodOptional<z.ZodEnum<["ed25519"]>>;
     }, "strict", z.ZodTypeAny, {
         name: string;
         publicKey: string;
         email?: string | undefined;
         github?: string | undefined;
+        publicKeyAlgorithm?: "ed25519" | undefined;
     }, {
         name: string;
         publicKey: string;
         email?: string | undefined;
         github?: string | undefined;
+        publicKeyAlgorithm?: "ed25519" | undefined;
     }>>>;
     gates: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
         name: z.ZodString;
@@ -477,6 +482,7 @@ declare const configSchema: z.ZodObject<{
         publicKey: string;
         email?: string | undefined;
         github?: string | undefined;
+        publicKeyAlgorithm?: "ed25519" | undefined;
     }> | undefined;
     gates?: Record<string, {
         name: string;
@@ -550,6 +556,7 @@ declare const configSchema: z.ZodObject<{
         publicKey: string;
         email?: string | undefined;
         github?: string | undefined;
+        publicKeyAlgorithm?: "ed25519" | undefined;
     }> | undefined;
     gates?: Record<string, {
         name: string;
@@ -697,16 +704,19 @@ declare const policySchema: z.ZodObject<{
         email: z.ZodOptional<z.ZodString>;
         github: z.ZodOptional<z.ZodString>;
         publicKey: z.ZodString;
+        publicKeyAlgorithm: z.ZodOptional<z.ZodLiteral<"ed25519">>;
     }, "strict", z.ZodTypeAny, {
         name: string;
         publicKey: string;
         email?: string | undefined;
         github?: string | undefined;
+        publicKeyAlgorithm?: "ed25519" | undefined;
     }, {
         name: string;
         publicKey: string;
         email?: string | undefined;
         github?: string | undefined;
+        publicKeyAlgorithm?: "ed25519" | undefined;
     }>>>;
     gates: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
         name: z.ZodString;
@@ -755,6 +765,7 @@ declare const policySchema: z.ZodObject<{
         publicKey: string;
         email?: string | undefined;
         github?: string | undefined;
+        publicKeyAlgorithm?: "ed25519" | undefined;
     }> | undefined;
     gates?: Record<string, {
         name: string;
@@ -779,6 +790,7 @@ declare const policySchema: z.ZodObject<{
         publicKey: string;
         email?: string | undefined;
         github?: string | undefined;
+        publicKeyAlgorithm?: "ed25519" | undefined;
     }> | undefined;
     gates?: Record<string, {
         name: string;
@@ -2436,9 +2448,8 @@ declare function getHomePublicKeysDir(): string;
 /**
  * Get the project public keys directory.
  *
- * This returns .attest-it/public-keys relative to the given project root.
- * The project public keys directory is used for CI/GitHub Actions to
- * verify attestation seals.
+ * @deprecated Public keys are now stored inline in the team section of config.yaml.
+ * This function is kept for backward compatibility but should not be used in new code.
  *
  * @param projectRoot - The project root directory (defaults to cwd)
  * @returns Path to the project public keys directory
@@ -2448,6 +2459,9 @@ declare function getProjectPublicKeysDir(projectRoot?: string): string;
 /**
  * Check if a project has attest-it configuration.
  *
+ * @deprecated This function is kept for backward compatibility but is no longer used
+ * by the core library. Public keys are now stored inline in config.yaml.
+ *
  * @param projectRoot - The project root directory (defaults to cwd)
  * @returns True if the project has .attest-it/config.yaml or similar
  * @public
@@ -2464,31 +2478,33 @@ interface SavePublicKeyResult {
     projectPath?: string;
 }
 /**
- * Save a public key to the user's home directory and optionally to the project directory.
+ * Save a public key to the user's home directory.
  *
  * This saves the public key as a base64-encoded string (matching the format in config.yaml)
- * to:
- * 1. ~/.attest-it/public-keys/<slug>.pem (always)
- * 2. ./.attest-it/public-keys/<slug>.pem (if project has attest-it config)
+ * to ~/.attest-it/public-keys/<slug>.pem for backup purposes.
+ *
+ * Public keys are now stored inline in the team section of config.yaml and no longer
+ * written to the project directory.
  *
  * @param slug - The identity slug (used for the filename)
  * @param publicKey - The base64-encoded public key
- * @param projectRoot - The project root directory (defaults to cwd)
+ * @param projectRoot - The project root directory (deprecated, kept for backward compatibility)
  * @returns Paths where the key was saved
  * @public
  */
 declare function savePublicKey(slug: string, publicKey: string, projectRoot?: string): Promise<SavePublicKeyResult>;
 /**
- * Save a public key to the user's home directory and optionally to the project directory (sync).
+ * Save a public key to the user's home directory (sync).
  *
  * This saves the public key as a base64-encoded string (matching the format in config.yaml)
- * to:
- * 1. ~/.attest-it/public-keys/<slug>.pem (always)
- * 2. ./.attest-it/public-keys/<slug>.pem (if project has attest-it config)
+ * to ~/.attest-it/public-keys/<slug>.pem for backup purposes.
+ *
+ * Public keys are now stored inline in the team section of config.yaml and no longer
+ * written to the project directory.
  *
  * @param slug - The identity slug (used for the filename)
  * @param publicKey - The base64-encoded public key
- * @param projectRoot - The project root directory (defaults to cwd)
+ * @param projectRoot - The project root directory (deprecated, kept for backward compatibility)
  * @returns Paths where the key was saved
  * @public
  */

package/dist/index.d.ts

@@ -50,6 +50,8 @@ interface TeamMember {
     github?: string | undefined;
     /** Base64-encoded Ed25519 public key */
     publicKey: string;
+    /** Public key algorithm (optional, for future-proofing format changes) */
+    publicKeyAlgorithm?: 'ed25519' | undefined;
 }
 /**
  * Fingerprint configuration for gates.
@@ -424,16 +426,19 @@ declare const configSchema: z.ZodObject<{
         github: z.ZodOptional<z.ZodString>;
         name: z.ZodString;
         publicKey: z.ZodString;
+        publicKeyAlgorithm: z.ZodOptional<z.ZodEnum<["ed25519"]>>;
     }, "strict", z.ZodTypeAny, {
         email?: string | undefined;
         github?: string | undefined;
         name: string;
         publicKey: string;
+        publicKeyAlgorithm?: "ed25519" | undefined;
     }, {
         email?: string | undefined;
         github?: string | undefined;
         name: string;
         publicKey: string;
+        publicKeyAlgorithm?: "ed25519" | undefined;
     }>>>;
     version: z.ZodLiteral<1>;
 }, "strict", z.ZodTypeAny, {
@@ -481,6 +486,7 @@ declare const configSchema: z.ZodObject<{
         github?: string | undefined;
         name: string;
         publicKey: string;
+        publicKeyAlgorithm?: "ed25519" | undefined;
     }> | undefined;
     version: 1;
 }, {
@@ -554,6 +560,7 @@ declare const configSchema: z.ZodObject<{
         github?: string | undefined;
         name: string;
         publicKey: string;
+        publicKeyAlgorithm?: "ed25519" | undefined;
     }> | undefined;
     version: 1;
 }>;
@@ -724,16 +731,19 @@ declare const policySchema: z.ZodObject<{
         github: z.ZodOptional<z.ZodString>;
         name: z.ZodString;
         publicKey: z.ZodString;
+        publicKeyAlgorithm: z.ZodOptional<z.ZodLiteral<"ed25519">>;
     }, "strict", z.ZodTypeAny, {
         email?: string | undefined;
         github?: string | undefined;
         name: string;
         publicKey: string;
+        publicKeyAlgorithm?: "ed25519" | undefined;
     }, {
         email?: string | undefined;
         github?: string | undefined;
         name: string;
         publicKey: string;
+        publicKeyAlgorithm?: "ed25519" | undefined;
     }>>>;
     version: z.ZodLiteral<1>;
 }, "strict", z.ZodTypeAny, {
@@ -758,6 +768,7 @@ declare const policySchema: z.ZodObject<{
         github?: string | undefined;
         name: string;
         publicKey: string;
+        publicKeyAlgorithm?: "ed25519" | undefined;
     }> | undefined;
     version: 1;
 }, {
@@ -782,6 +793,7 @@ declare const policySchema: z.ZodObject<{
         github?: string | undefined;
         name: string;
         publicKey: string;
+        publicKeyAlgorithm?: "ed25519" | undefined;
     }> | undefined;
     version: 1;
 }>;
@@ -2426,9 +2438,8 @@ declare function getHomePublicKeysDir(): string;
 /**
  * Get the project public keys directory.
  *
- * This returns .attest-it/public-keys relative to the given project root.
- * The project public keys directory is used for CI/GitHub Actions to
- * verify attestation seals.
+ * @deprecated Public keys are now stored inline in the team section of config.yaml.
+ * This function is kept for backward compatibility but should not be used in new code.
  *
  * @param projectRoot - The project root directory (defaults to cwd)
  * @returns Path to the project public keys directory
@@ -2438,6 +2449,9 @@ declare function getProjectPublicKeysDir(projectRoot?: string): string;
 /**
  * Check if a project has attest-it configuration.
  *
+ * @deprecated This function is kept for backward compatibility but is no longer used
+ * by the core library. Public keys are now stored inline in config.yaml.
+ *
  * @param projectRoot - The project root directory (defaults to cwd)
  * @returns True if the project has .attest-it/config.yaml or similar
  * @public
@@ -2454,31 +2468,33 @@ interface SavePublicKeyResult {
     projectPath?: string;
 }
 /**
- * Save a public key to the user's home directory and optionally to the project directory.
+ * Save a public key to the user's home directory.
  *
  * This saves the public key as a base64-encoded string (matching the format in config.yaml)
- * to:
- * 1. ~/.attest-it/public-keys/<slug>.pem (always)
- * 2. ./.attest-it/public-keys/<slug>.pem (if project has attest-it config)
+ * to ~/.attest-it/public-keys/<slug>.pem for backup purposes.
+ *
+ * Public keys are now stored inline in the team section of config.yaml and no longer
+ * written to the project directory.
  *
  * @param slug - The identity slug (used for the filename)
  * @param publicKey - The base64-encoded public key
- * @param projectRoot - The project root directory (defaults to cwd)
+ * @param projectRoot - The project root directory (deprecated, kept for backward compatibility)
  * @returns Paths where the key was saved
  * @public
  */
 declare function savePublicKey(slug: string, publicKey: string, projectRoot?: string): Promise<SavePublicKeyResult>;
 /**
- * Save a public key to the user's home directory and optionally to the project directory (sync).
+ * Save a public key to the user's home directory (sync).
  *
  * This saves the public key as a base64-encoded string (matching the format in config.yaml)
- * to:
- * 1. ~/.attest-it/public-keys/<slug>.pem (always)
- * 2. ./.attest-it/public-keys/<slug>.pem (if project has attest-it config)
+ * to ~/.attest-it/public-keys/<slug>.pem for backup purposes.
+ *
+ * Public keys are now stored inline in the team section of config.yaml and no longer
+ * written to the project directory.
  *
  * @param slug - The identity slug (used for the filename)
  * @param publicKey - The base64-encoded public key
- * @param projectRoot - The project root directory (defaults to cwd)
+ * @param projectRoot - The project root directory (deprecated, kept for backward compatibility)
  * @returns Paths where the key was saved
  * @public
  */

package/dist/index.js

@@ -30,7 +30,8 @@ var teamMemberSchema = z.object({
   name: z.string().min(1, "Team member name cannot be empty"),
   email: z.string().email().optional(),
   github: z.string().min(1).optional(),
-  publicKey: z.string().min(1, "Public key is required")
+  publicKey: z.string().min(1, "Public key is required"),
+  publicKeyAlgorithm: z.enum(["ed25519"]).optional()
 }).strict();
 var fingerprintConfigSchema = z.object({
   paths: z.array(z.string().min(1, "Path cannot be empty")).min(1, "At least one path is required"),
@@ -261,7 +262,8 @@ var teamMemberSchema2 = z.object({
   name: z.string().min(1, "Team member name cannot be empty"),
   email: z.string().email().optional(),
   github: z.string().min(1).optional(),
-  publicKey: z.string().min(1, "Public key is required")
+  publicKey: z.string().min(1, "Public key is required"),
+  publicKeyAlgorithm: z.literal("ed25519").optional()
 }).strict();
 var fingerprintConfigSchema2 = z.object({
   paths: z.array(z.string().min(1, "Path cannot be empty")).min(1, "At least one path is required"),
@@ -1826,16 +1828,19 @@ function loadLocalConfigSync(configPath) {
     throw error;
   }
 }
+var IDENTITY_SCHEMA_HEADER = "# yaml-language-server: $schema=https://raw.githubusercontent.com/mike-north/attest-it/main/schemas/v1/identity.schema.json\n";
 async function saveLocalConfig(config, configPath) {
   const resolvedPath = configPath ?? getLocalConfigPath();
-  const content = stringify(config);
+  const yamlContent = stringify(config);
+  const content = IDENTITY_SCHEMA_HEADER + yamlContent;
   const dir = dirname(resolvedPath);
   await mkdir(dir, { recursive: true });
   await writeFile(resolvedPath, content, "utf8");
 }
 function saveLocalConfigSync(config, configPath) {
   const resolvedPath = configPath ?? getLocalConfigPath();
-  const content = stringify(config);
+  const yamlContent = stringify(config);
+  const content = IDENTITY_SCHEMA_HEADER + yamlContent;
   const dir = dirname(resolvedPath);
   mkdirSync(dir, { recursive: true });
   writeFileSync(resolvedPath, content, "utf8");
@@ -1866,13 +1871,6 @@ async function savePublicKey(slug, publicKey, projectRoot = process.cwd()) {
   const homePath = join(homeDir, `${slug}.pem`);
   await writeFile(homePath, publicKey, "utf8");
   result.homePath = homePath;
-  if (hasProjectConfig(projectRoot)) {
-    const projectDir = getProjectPublicKeysDir(projectRoot);
-    await mkdir(projectDir, { recursive: true });
-    const projectPath = join(projectDir, `${slug}.pem`);
-    await writeFile(projectPath, publicKey, "utf8");
-    result.projectPath = projectPath;
-  }
   return result;
 }
 function savePublicKeySync(slug, publicKey, projectRoot = process.cwd()) {
@@ -1884,13 +1882,6 @@ function savePublicKeySync(slug, publicKey, projectRoot = process.cwd()) {
   const homePath = join(homeDir, `${slug}.pem`);
   writeFileSync(homePath, publicKey, "utf8");
   result.homePath = homePath;
-  if (hasProjectConfig(projectRoot)) {
-    const projectDir = getProjectPublicKeysDir(projectRoot);
-    mkdirSync(projectDir, { recursive: true });
-    const projectPath = join(projectDir, `${slug}.pem`);
-    writeFileSync(projectPath, publicKey, "utf8");
-    result.projectPath = projectPath;
-  }
   return result;
 }