@ternent/core 0.0.1

package/packages/ledger/tsconfig.json

@@ -0,0 +1,12 @@
+{
+  "extends": "../../tsconfig.json",
+  "compilerOptions": {
+    "target": "ES2020",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "lib": ["ES2020", "DOM"],
+    "types": ["node", "vitest/globals"]
+  },
+  "include": ["src/**/*.ts", "test/**/*.ts", "vite.config.ts"],
+  "exclude": ["dist", "node_modules"]
+}

package/packages/ledger/vite.browser.config.ts

@@ -0,0 +1,27 @@
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { defineConfig } from "vite";
+
+const configDir = dirname(fileURLToPath(import.meta.url));
+
+export default defineConfig({
+  build: {
+    outDir: "dist",
+    emptyOutDir: false,
+    sourcemap: true,
+    target: "es2020",
+    minify: false,
+    lib: {
+      entry: resolve(configDir, "src/index.ts"),
+      name: "ternentLedgerBrowser",
+      fileName: () => "browser.js",
+      formats: ["es"],
+    },
+    rollupOptions: {
+      output: {
+        format: "es",
+        inlineDynamicImports: true,
+      },
+    },
+  },
+});

package/packages/ledger/vite.config.ts

@@ -0,0 +1,39 @@
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { defineConfig } from "vite";
+import dts from "vite-plugin-dts";
+import { createPackageExternal, resolvePackageDir } from "../../scripts/vite/package-lib-config";
+
+const configDir = dirname(fileURLToPath(import.meta.url));
+const external = createPackageExternal(resolvePackageDir(import.meta.url));
+
+export default defineConfig({
+  build: {
+    outDir: "dist",
+    sourcemap: true,
+    target: "es2020",
+    minify: false,
+    lib: {
+      entry: resolve(configDir, "src/index.ts"),
+      name: "ternentLedger",
+      fileName: "index",
+      formats: ["es"],
+    },
+    rollupOptions: {
+      external,
+      output: {
+        format: "es",
+        entryFileNames: "index.js",
+      },
+    },
+  },
+  plugins: [
+    dts({
+      tsConfigFilePath: resolve(configDir, "tsconfig.json"),
+    }),
+  ],
+  test: {
+    environment: "node",
+    include: ["test/**/*.test.ts"],
+  },
+});

package/packages/seal/CHANGELOG.md

@@ -0,0 +1,137 @@
+# @ternent/seal-cli
+
+## 0.3.10
+
+### Patch Changes
+
+- [`9d23630e3dd0d0ffb22b62e3bf159dd01d60bbaa`](https://github.com/samternent/home/commit/9d23630e3dd0d0ffb22b62e3bf159dd01d60bbaa) Thanks [@samternent](https://github.com/samternent)! - Fix ternent-api deploy packaging by building the proof-only Seal surface used by PixPax issuer and including the missing runtime package outputs in the image build.
+
+## 0.3.9
+
+### Patch Changes
+
+- Updated dependencies [[`ad1b704fb8ba54b12d6140ffbed0fee66adcb6fd`](https://github.com/samternent/home/commit/ad1b704fb8ba54b12d6140ffbed0fee66adcb6fd)]:
+  - ternent-utils@1.1.3
+
+## 0.3.8
+
+### Patch Changes
+
+- Updated dependencies [[`4932df0ce286521f874ffd670ca022592f7d3462`](https://github.com/samternent/home/commit/4932df0ce286521f874ffd670ca022592f7d3462)]:
+  - ternent-utils@1.1.2
+
+## 0.3.7
+
+### Patch Changes
+
+- [`cb63d9c1dc91e0cd3924bafd5abcde89cc02992f`](https://github.com/samternent/home/commit/cb63d9c1dc91e0cd3924bafd5abcde89cc02992f) Thanks [@samternent](https://github.com/samternent)! - Fix workflows
+
+- Updated dependencies [[`cb63d9c1dc91e0cd3924bafd5abcde89cc02992f`](https://github.com/samternent/home/commit/cb63d9c1dc91e0cd3924bafd5abcde89cc02992f)]:
+  - @ternent/identity@0.3.1
+  - @ternent/armour@0.1.5
+
+## 0.3.6
+
+### Patch Changes
+
+- [`acf974919a1176da235e7ec7468c46df8bc13402`](https://github.com/samternent/home/commit/acf974919a1176da235e7ec7468c46df8bc13402) Thanks [@samternent](https://github.com/samternent)! - Update build configs
+
+- Updated dependencies [[`acf974919a1176da235e7ec7468c46df8bc13402`](https://github.com/samternent/home/commit/acf974919a1176da235e7ec7468c46df8bc13402)]:
+  - @ternent/armour@0.1.4
+
+## 0.3.5
+
+### Patch Changes
+
+- [`3fd51c9f51ccc3d816d044aa8aa161d9683534c3`](https://github.com/samternent/home/commit/3fd51c9f51ccc3d816d044aa8aa161d9683534c3) Thanks [@samternent](https://github.com/samternent)! - alias utils
+
+## 0.3.4
+
+### Patch Changes
+
+- [`109f8c3989b16a161a34b933dcad68390d9219c5`](https://github.com/samternent/home/commit/109f8c3989b16a161a34b933dcad68390d9219c5) Thanks [@samternent](https://github.com/samternent)! - Fix deps
+
+- Updated dependencies [[`109f8c3989b16a161a34b933dcad68390d9219c5`](https://github.com/samternent/home/commit/109f8c3989b16a161a34b933dcad68390d9219c5)]:
+  - @ternent/armour@0.1.3
+
+## 0.3.3
+
+### Patch Changes
+
+- [`91246e9d2645faa6d25b0a05cc507bc0c66ade01`](https://github.com/samternent/home/commit/91246e9d2645faa6d25b0a05cc507bc0c66ade01) Thanks [@samternent](https://github.com/samternent)! - Add armoured seal
+
+## 0.3.2
+
+### Patch Changes
+
+- [`e3b14dab10ce8da5b875826383c71283cbd5b99c`](https://github.com/samternent/home/commit/e3b14dab10ce8da5b875826383c71283cbd5b99c) Thanks [@samternent](https://github.com/samternent)! - Adds create identity to seal-cli
+
+## 0.3.1
+
+### Patch Changes
+
+- [`ee7aa501b6a57f0896e9a3b8c13c3446f8751a5a`](https://github.com/samternent/home/commit/ee7aa501b6a57f0896e9a3b8c13c3446f8751a5a) Thanks [@samternent](https://github.com/samternent)! - Fix the package runtime dependency graph by shipping `@ternent/identity` and `ternent-utils` as production dependencies. This prevents browser consumers that bundle Seal proof helpers from source from failing to resolve `@ternent/identity` during app builds.
+
+## 0.3.0
+
+### Minor Changes
+
+- [`f364cb7d38f18770d32fe4a628b3c8b4bcccc31f`](https://github.com/samternent/home/commit/f364cb7d38f18770d32fe4a628b3c8b4bcccc31f) Thanks [@samternent](https://github.com/samternent)! - Introduce the new `@ternent/identity` package with Ed25519 signing, BIP-39 mnemonic recovery, Noble-backed Curve25519 conversion helpers, and versioned JSON identity exports. Migrate `@ternent/seal-cli` and the Seal web app to the seed-material envelope format, `SEAL_IDENTITY` configuration, and Ed25519 proof artifacts while keeping `ternent-identity` as the documented legacy package for existing Concord and PixPax consumers.
+
+## 0.2.0
+
+### Minor Changes
+
+- [`f364cb7d38f18770d32fe4a628b3c8b4bcccc31f`](https://github.com/samternent/home/commit/f364cb7d38f18770d32fe4a628b3c8b4bcccc31f) Thanks [@samternent](https://github.com/samternent)! - Introduce the new `@ternent/identity` package with Ed25519 signing, X25519 bridge helpers, and versioned JSON identity exports. Migrate `@ternent/seal-cli` and the Seal web app to the new identity format, `SEAL_IDENTITY` configuration, and Ed25519 proof artifacts while keeping `ternent-identity` as the documented legacy package for existing Concord and PixPax consumers.
+
+### Patch Changes
+
+- [`f364cb7d38f18770d32fe4a628b3c8b4bcccc31f`](https://github.com/samternent/home/commit/f364cb7d38f18770d32fe4a628b3c8b4bcccc31f) Thanks [@samternent](https://github.com/samternent)! - Move idenity algo with v2
+
+## 0.1.8
+
+### Patch Changes
+
+- [`e694239710abbe9ab15bd386901f34334f7692e5`](https://github.com/samternent/home/commit/e694239710abbe9ab15bd386901f34334f7692e5) Thanks [@samternent](https://github.com/samternent)! - code deletion and renaming
+
+## 0.1.7
+
+### Patch Changes
+
+- [`ba97b4b9466f7c16a7226609f8047e5367afdd70`](https://github.com/samternent/home/commit/ba97b4b9466f7c16a7226609f8047e5367afdd70) Thanks [@samternent](https://github.com/samternent)! - Update seal publish
+
+## 0.1.6
+
+### Patch Changes
+
+- [`44a52fc20be15459f3771f37a002d5ea40068d10`](https://github.com/samternent/home/commit/44a52fc20be15459f3771f37a002d5ea40068d10) Thanks [@samternent](https://github.com/samternent)! - Bump version with action
+
+## 0.1.5
+
+### Patch Changes
+
+- [`be5ecca6e2c9db462407c4edd6d3f668c5d51060`](https://github.com/samternent/home/commit/be5ecca6e2c9db462407c4edd6d3f668c5d51060) Thanks [@samternent](https://github.com/samternent)! - Publish seal-cli
+
+## 0.1.4
+
+### Patch Changes
+
+- [`0b11c7d885e591fb1c9f373d209abe9d9f9dfb61`](https://github.com/samternent/home/commit/0b11c7d885e591fb1c9f373d209abe9d9f9dfb61) Thanks [@samternent](https://github.com/samternent)! - Seal publsh bump
+
+## 0.1.3
+
+### Patch Changes
+
+- [`d1ffa2ed2d23d6c007ab829c0c4d4fd026ce188b`](https://github.com/samternent/home/commit/d1ffa2ed2d23d6c007ab829c0c4d4fd026ce188b) Thanks [@samternent](https://github.com/samternent)! - Update seal-cli scoping
+
+## 0.1.2
+
+### Patch Changes
+
+- [`fd130eb5815c2ea636f66acb5a81c947c4081d95`](https://github.com/samternent/home/commit/fd130eb5815c2ea636f66acb5a81c947c4081d95) Thanks [@samternent](https://github.com/samternent)! - Adds to publish script
+
+## 0.1.1
+
+### Patch Changes
+
+- [`36dd9bfac417eba61b8e81756cf15a3d3ac7a216`](https://github.com/samternent/home/commit/36dd9bfac417eba61b8e81756cf15a3d3ac7a216) Thanks [@samternent](https://github.com/samternent)! - Adds cli and GHA

package/packages/seal/CLAUDE.md

@@ -0,0 +1,8 @@
+# CLAUDE.md
+
+`@ternent/seal-cli` signs/verifies artifacts and supports recipient-targeted encrypted artifacts.
+
+- Treat manifest/proof/artifact schema stability as critical.
+- Keep cryptographic operations explicit and auditable.
+- Use armour/identity composition; avoid duplicated crypto implementations.
+- Preserve offline verification and deterministic output behavior where expected.

package/packages/seal/README.md

@@ -0,0 +1,258 @@
+# @ternent/seal-cli
+
+Seal signs files and manifests. It verifies artifacts offline. It emits portable proof JSON for legacy flows and recipient-targeted sealed artifacts for encrypted flows.
+
+## Install
+
+```bash
+pnpm add -D @ternent/seal-cli
+```
+
+## Environment
+
+Create a signer identity with Seal:
+
+```bash
+seal identity create --out identity.json
+```
+
+Create a mnemonic-backed identity and save the recovery phrase separately:
+
+```bash
+seal identity create --out identity.json --words 24 --mnemonic-out seal-seed-phrase.txt
+```
+
+`@ternent/seal-cli` reads signer material from a v2 identity JSON payload:
+
+```bash
+export SEAL_IDENTITY="$(cat identity.json)"
+# or
+export SEAL_IDENTITY_FILE="./identity.json"
+```
+
+## Commands
+
+```bash
+seal identity create --out identity.json
+seal identity create --out identity.json --words 24 --mnemonic-out seal-seed-phrase.txt
+seal manifest create --input apps/seal/dist --out apps/seal/dist/dist-manifest.json
+seal sign --input apps/seal/dist/dist-manifest.json --out apps/seal/dist/proof.json
+seal sign --input artifact.tar.gz --recipient age1... --recipient age1... --out artifact.seal.json
+seal verify --proof apps/seal/dist/proof.json --input apps/seal/dist/dist-manifest.json --json
+seal verify --artifact artifact.seal.json --json
+seal public-key --json
+```
+
+When one or more `--recipient` flags are provided, Seal encrypts the input bytes with `@ternent/armour`, then signs the unsigned artifact container. Recipient values are never serialized into the emitted artifact.
+
+## JavaScript API
+
+Create a Seal-compatible identity and persist it as the `SEAL_IDENTITY` payload:
+
+```ts
+import {
+  createSealIdentity,
+  createSealMnemonicIdentity,
+  exportIdentityJson,
+} from "@ternent/seal-cli";
+
+const identity = await createSealIdentity();
+const identityJson = exportIdentityJson(identity);
+
+const { identity: mnemonicIdentity, mnemonic } = await createSealMnemonicIdentity({ words: 24 });
+```
+
+Create and verify recipient-targeted artifacts:
+
+```ts
+import {
+  createSealArtifact,
+  decryptSealArtifactPayload,
+  verifySealArtifact,
+} from "@ternent/seal-cli/artifact";
+
+const artifact = await createSealArtifact({
+  signer: { identity },
+  subjectPath: "artifact.tar.gz",
+  payload: artifactBytes,
+  recipients: ["age1..."],
+});
+
+const verification = await verifySealArtifact(artifact);
+const plaintext = await decryptSealArtifactPayload({
+  artifact,
+  identity,
+});
+```
+
+## GitHub Actions
+
+Use the published GitHub Action:
+
+```yaml
+- name: Generate Seal artifacts
+  uses: samternent/seal-action@v2
+  env:
+    SEAL_IDENTITY: ${{ secrets.SEAL_IDENTITY }}
+  with:
+    assets-directory: dist
+    package-name: @ternent/seal-cli
+    package-version: latest
+```
+
+The action is intentionally narrow. Your workflow still needs to:
+
+- check out the repo
+- set up Node
+- build the static directory you want to sign
+
+Inputs:
+
+- `assets-directory`: built static directory to sign
+- `working-directory`: base directory for path resolution
+- `manifest-name`: manifest output filename
+- `proof-name`: proof output filename
+- `public-key-name`: public key output filename
+- `package-name`: npm package name to execute when `cli-command` is omitted
+- `package-version`: npm version or dist-tag to execute when `cli-command` is omitted
+- `cli-command`: command prefix used to invoke Seal
+
+Outputs:
+
+- `manifest-path`
+- `proof-path`
+- `public-key-path`
+
+The default path is npm-backed: if `cli-command` is empty, the action runs `npm exec --yes --package=<package-name>@<package-version> seal`.
+
+## Schemas
+
+Manifest:
+
+```json
+{
+  "version": "1",
+  "type": "seal-manifest",
+  "root": "dist",
+  "files": {
+    "assets/index.js": "sha256:..."
+  }
+}
+```
+
+Proof:
+
+```json
+{
+  "version": "2",
+  "type": "seal-proof",
+  "algorithm": "Ed25519",
+  "createdAt": "2026-03-13T00:00:00.000Z",
+  "subject": {
+    "kind": "manifest",
+    "path": "dist-manifest.json",
+    "hash": "sha256:..."
+  },
+  "signer": {
+    "publicKey": "BASE64URL-RAW-ED25519-PUBLIC-KEY",
+    "keyId": "..."
+  },
+  "signature": "..."
+}
+```
+
+Encrypted artifact:
+
+```json
+{
+  "version": "1",
+  "type": "seal-artifact",
+  "manifest": {
+    "version": "1",
+    "payloadType": "encrypted",
+    "payloadScheme": "age",
+    "payloadMode": "recipients",
+    "payloadEncoding": "armor",
+    "payloadHash": "sha256:..."
+  },
+  "payload": {
+    "type": "encrypted",
+    "scheme": "age",
+    "mode": "recipients",
+    "encoding": "armor",
+    "data": "-----BEGIN AGE ENCRYPTED FILE-----\n...\n-----END AGE ENCRYPTED FILE-----\n"
+  },
+  "proof": {
+    "version": "2",
+    "type": "seal-proof",
+    "algorithm": "Ed25519",
+    "createdAt": "2026-03-17T00:00:00.000Z",
+    "subject": {
+      "kind": "artifact",
+      "path": "artifact.tar.gz",
+      "hash": "sha256:..."
+    },
+    "signer": {
+      "publicKey": "BASE64URL-RAW-ED25519-PUBLIC-KEY",
+      "keyId": "..."
+    },
+    "signature": "..."
+  }
+}
+```
+
+Public key:
+
+```json
+{
+  "version": "2",
+  "type": "seal-public-key",
+  "algorithm": "Ed25519",
+  "publicKey": "BASE64URL-RAW-ED25519-PUBLIC-KEY",
+  "keyId": "..."
+}
+```
+
+Identity:
+
+```json
+{
+  "format": "ternent-identity",
+  "version": "2",
+  "algorithm": "Ed25519",
+  "createdAt": "2026-03-17T00:00:00.000Z",
+  "publicKey": "BASE64URL-RAW-ED25519-PUBLIC-KEY",
+  "keyId": "...",
+  "material": {
+    "kind": "seed",
+    "seed": "BASE64URL-RAW-32-BYTE-SEED"
+  }
+}
+```
+
+## Frontend Contract
+
+`apps/seal` verifies published artifacts by fetching:
+
+- `/dist-manifest.json`
+- `/proof.json`
+- `/public-key.json` (optional)
+
+Browser verification reuses `@ternent/seal-cli/proof`, `@ternent/seal-cli/crypto`, `@ternent/identity`, and `ternent-utils`.
+
+Validation rules:
+
+- parse `seal-proof`
+- recompute the fetched manifest hash from raw bytes
+- verify the embedded signature
+- verify `signer.keyId`
+- if `/public-key.json` exists, require its `publicKey` and `keyId` to match the proof signer
+
+## Exit Codes
+
+- `0` success
+- `1` general failure
+- `2` subject hash mismatch
+- `3` signature invalid
+- `4` invalid proof
+- `5` key or config error

package/packages/seal/bin/seal

@@ -0,0 +1,6 @@
+#!/usr/bin/env node
+import { runCli } from "../dist/cli.js";
+
+runCli(process.argv.slice(2)).then((exitCode) => {
+  process.exitCode = exitCode;
+});

package/packages/seal/package.json

@@ -0,0 +1,59 @@
+{
+  "name": "@ternent/seal",
+  "version": "0.3.10",
+  "description": "Deterministic artifact signing for Seal",
+  "keywords": [
+    "cli",
+    "integrity",
+    "manifest",
+    "seal",
+    "signature"
+  ],
+  "homepage": "https://github.com/ternent/core/tree/main/packages/seal",
+  "bugs": {
+    "url": "https://github.com/ternent/core/issues"
+  },
+  "license": "ISC",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ternent/core.git",
+    "directory": "packages/seal"
+  },
+  "bin": {
+    "seal": "bin/seal"
+  },
+  "files": [
+    "bin",
+    "dist",
+    "README.md"
+  ],
+  "type": "module",
+  "sideEffects": false,
+  "main": "dist/index.js",
+  "module": "dist/index.js",
+  "exports": {
+    ".": "./dist/index.js",
+    "./proof": "./dist/proof.js",
+    "./artifact": "./dist/artifact.js",
+    "./manifest": "./dist/manifest.js",
+    "./crypto": "./dist/crypto.js",
+    "./errors": "./dist/errors.js"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build:proof": "vite build --mode proof-only",
+    "build": "vite build",
+    "test": "vitest run"
+  },
+  "dependencies": {
+    "@ternent/armour": "workspace:*",
+    "@ternent/identity": "workspace:*",
+    "@ternent/utils": "workspace:*"
+  },
+  "devDependencies": {
+    "vite": "^2.9.18",
+    "vitest": "^1.6.0"
+  }
+}