@ternent/core 0.0.1

package/packages/seal/test/cli.test.ts

@@ -0,0 +1,208 @@
+import { mkdtemp, readFile, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { describe, expect, it } from "vitest";
+import { createIdentity, serializeIdentity } from "@ternent/identity";
+import { recipientFromIdentity } from "@ternent/armour";
+import { runCli } from "../src/cli";
+
+async function createSigningEnv() {
+  const identity = await createIdentity();
+  return {
+    SEAL_IDENTITY: serializeIdentity(identity, false).trim(),
+  };
+}
+
+async function createTempFile(name: string, content: string): Promise<string> {
+  const root = await mkdtemp(join(tmpdir(), "seal-cli-"));
+  const filePath = join(root, name);
+  await writeFile(filePath, content, "utf8");
+  return filePath;
+}
+
+function createWriter() {
+  let stdout = "";
+  let stderr = "";
+  return {
+    writer: {
+      stdout: (value: string) => {
+        stdout += value;
+      },
+      stderr: (value: string) => {
+        stderr += value;
+      },
+    },
+    read: () => ({ stdout, stderr }),
+  };
+}
+
+describe("seal cli", () => {
+  it("verifies a proof successfully", async () => {
+    const env = await createSigningEnv();
+    const subjectPath = await createTempFile("sample.txt", "sample file\n");
+    const proofPath = await createTempFile("proof.json", "");
+    const writer = createWriter();
+
+    const signExit = await runCli(["sign", "--input", subjectPath, "--out", proofPath], {
+      env,
+      writer: writer.writer,
+    });
+    const verifyExit = await runCli(
+      ["verify", "--proof", proofPath, "--input", subjectPath, "--json"],
+      { env, writer: writer.writer },
+    );
+
+    expect(signExit).toBe(0);
+    expect(verifyExit).toBe(0);
+    expect(writer.read().stdout).toContain('"valid": true');
+  });
+
+  it("signs and verifies an encrypted artifact successfully", async () => {
+    const env = await createSigningEnv();
+    const recipient = await createIdentity();
+    const recipientValue = await recipientFromIdentity(recipient);
+    const subjectPath = await createTempFile("sample.txt", "sample file\n");
+    const artifactPath = await createTempFile("artifact.json", "");
+    const writer = createWriter();
+
+    const signExit = await runCli(
+      ["sign", "--input", subjectPath, "--recipient", recipientValue, "--out", artifactPath],
+      { env, writer: writer.writer },
+    );
+    const verifyExit = await runCli(["verify", "--artifact", artifactPath, "--json"], {
+      writer: writer.writer,
+    });
+
+    expect(signExit).toBe(0);
+    expect(verifyExit).toBe(0);
+    expect(await readFile(artifactPath, "utf8")).toContain('"type": "seal-artifact"');
+    expect(writer.read().stdout).toContain('"encrypted": true');
+  });
+
+  it("creates an identity file", async () => {
+    const identityPath = await createTempFile("identity.json", "");
+    const writer = createWriter();
+
+    const exitCode = await runCli(["identity", "create", "--out", identityPath, "--json"], {
+      writer: writer.writer,
+    });
+
+    expect(exitCode).toBe(0);
+    expect(writer.read().stdout).toContain('"format": "ternent-identity"');
+    expect(await readFile(identityPath, "utf8")).toContain('"material"');
+  });
+
+  it("creates a mnemonic-backed identity and writes the seed phrase", async () => {
+    const identityPath = await createTempFile("identity.json", "");
+    const mnemonicPath = await createTempFile("seed.txt", "");
+    const writer = createWriter();
+
+    const exitCode = await runCli(
+      [
+        "identity",
+        "create",
+        "--out",
+        identityPath,
+        "--words",
+        "24",
+        "--mnemonic-out",
+        mnemonicPath,
+        "--json",
+      ],
+      { writer: writer.writer },
+    );
+
+    expect(exitCode).toBe(0);
+    expect(writer.read().stdout).toContain('"mnemonic"');
+    expect(await readFile(identityPath, "utf8")).toContain('"format": "ternent-identity"');
+    expect(await readFile(mnemonicPath, "utf8")).toContain("Seal seed phrase backup");
+  });
+
+  it("returns exit code 2 for a hash mismatch", async () => {
+    const env = await createSigningEnv();
+    const subjectPath = await createTempFile("sample.txt", "sample file\n");
+    const mismatchPath = await createTempFile("different.txt", "different\n");
+    const proofPath = await createTempFile("proof.json", "");
+
+    await runCli(["sign", "--input", subjectPath, "--out", proofPath], { env });
+    const exitCode = await runCli(["verify", "--proof", proofPath, "--input", mismatchPath], {
+      env,
+    });
+
+    expect(exitCode).toBe(2);
+  });
+
+  it("keeps the legacy proof output when no recipients are provided", async () => {
+    const env = await createSigningEnv();
+    const subjectPath = await createTempFile("sample.txt", "sample file\n");
+    const proofPath = await createTempFile("proof.json", "");
+
+    const exitCode = await runCli(["sign", "--input", subjectPath, "--out", proofPath], { env });
+
+    expect(exitCode).toBe(0);
+    expect(await readFile(proofPath, "utf8")).toContain('"type": "seal-proof"');
+  });
+
+  it("returns exit code 3 for an invalid signature", async () => {
+    const env = await createSigningEnv();
+    const otherEnv = await createSigningEnv();
+    const subjectPath = await createTempFile("sample.txt", "sample file\n");
+    const proofPath = await createTempFile("proof.json", "");
+
+    await runCli(["sign", "--input", subjectPath, "--out", proofPath], {
+      env: otherEnv,
+    });
+
+    const rawProof = await readFile(proofPath, "utf8");
+    const parsed = JSON.parse(rawProof) as Record<string, unknown>;
+    parsed.signer = {
+      ...(parsed.signer as Record<string, unknown>),
+      keyId: "bad-key-id",
+    };
+    await writeFile(proofPath, `${JSON.stringify(parsed, null, 2)}\n`, "utf8");
+
+    const exitCode = await runCli(["verify", "--proof", proofPath, "--input", subjectPath], {
+      env,
+    });
+
+    expect(exitCode).toBe(3);
+  });
+
+  it("returns exit code 4 for schema invalid proof", async () => {
+    const env = await createSigningEnv();
+    const subjectPath = await createTempFile("sample.txt", "sample file\n");
+    const proofPath = await createTempFile("proof.json", '{"type":"bad"}');
+
+    const exitCode = await runCli(["verify", "--proof", proofPath, "--input", subjectPath], {
+      env,
+    });
+
+    expect(exitCode).toBe(4);
+  });
+
+  it("returns exit code 5 for key mismatch", async () => {
+    const writer = createWriter();
+
+    const exitCode = await runCli(["public-key"], {
+      env: {},
+      writer: writer.writer,
+    });
+
+    expect(exitCode).toBe(5);
+  });
+
+  it("surfaces invalid recipients without leaking armour errors", async () => {
+    const env = await createSigningEnv();
+    const subjectPath = await createTempFile("sample.txt", "sample file\n");
+    const writer = createWriter();
+
+    const exitCode = await runCli(
+      ["sign", "--input", subjectPath, "--recipient", "bad-recipient"],
+      { env, writer: writer.writer },
+    );
+
+    expect(exitCode).toBe(1);
+    expect(writer.read().stderr).toContain("Recipient must be a valid age recipient string.");
+    expect(writer.read().stderr).not.toContain("ARMOUR_");
+  });
+});

package/packages/seal/test/crypto.test.ts

@@ -0,0 +1,21 @@
+import { describe, expect, it } from "vitest";
+import { parseIdentity } from "@ternent/identity";
+import { createSealIdentity, createSealMnemonicIdentity, exportIdentityJson } from "../src";
+
+describe("seal crypto", () => {
+  it("creates and serializes a seal identity", async () => {
+    const identity = await createSealIdentity("2026-03-17T00:00:00.000Z");
+    const exported = exportIdentityJson(identity);
+
+    expect(identity.format).toBe("ternent-identity");
+    expect(identity.version).toBe("2");
+    expect(parseIdentity(exported)).toEqual(identity);
+  });
+
+  it("creates a mnemonic-backed seal identity", async () => {
+    const created = await createSealMnemonicIdentity({ words: 12 });
+
+    expect(created.mnemonic.split(/\s+/).length).toBe(12);
+    expect(created.identity.format).toBe("ternent-identity");
+  });
+});

package/packages/seal/test/manifest.test.ts

@@ -0,0 +1,32 @@
+import { mkdtemp, mkdir, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { describe, expect, it } from "vitest";
+import { createManifestArtifact } from "../src/commands/manifest";
+
+async function createFixtureTree(): Promise<string> {
+  const root = await mkdtemp(join(tmpdir(), "seal-manifest-"));
+  await mkdir(join(root, "nested"), { recursive: true });
+  await writeFile(join(root, "a.txt"), "alpha\n", "utf8");
+  await writeFile(join(root, ".DS_Store"), "ignore", "utf8");
+  await writeFile(join(root, "nested", "b.txt"), "beta\n", "utf8");
+  return root;
+}
+
+describe("manifest command", () => {
+  it("is deterministic across runs", async () => {
+    const fixtureRoot = await createFixtureTree();
+    const first = await createManifestArtifact(fixtureRoot);
+    const second = await createManifestArtifact(fixtureRoot);
+
+    expect(first.content).toBe(second.content);
+    expect(first.manifest).toEqual(second.manifest);
+  });
+
+  it("excludes .DS_Store and sorts file keys", async () => {
+    const fixtureRoot = await createFixtureTree();
+    const { manifest } = await createManifestArtifact(fixtureRoot);
+
+    expect(Object.keys(manifest.files)).toEqual(["a.txt", "nested/b.txt"]);
+  });
+});

package/packages/seal/test/proof.test.ts

@@ -0,0 +1,60 @@
+import { describe, expect, it } from "vitest";
+import { createIdentity, deriveKeyId } from "@ternent/identity";
+import {
+  createSealHash,
+  createSealProof,
+  createSealPublicKeyArtifact,
+  parseSealProofJson,
+  verifySealProofAgainstBytes,
+  verifySealProofSignature,
+} from "../src/proof";
+
+async function createSigner() {
+  const identity = await createIdentity();
+  return {
+    identity,
+    publicKey: identity.publicKey,
+    keyId: await deriveKeyId(identity.publicKey),
+  };
+}
+
+describe("seal proof", () => {
+  it("signs and verifies a valid proof", async () => {
+    const signer = await createSigner();
+    const bytes = new TextEncoder().encode("seal proof bytes");
+    const proof = await createSealProof({
+      signer: { identity: signer.identity },
+      subject: {
+        kind: "file",
+        path: "sample.txt",
+        hash: await createSealHash(bytes),
+      },
+    });
+
+    const signatureCheck = await verifySealProofSignature(proof);
+    const verification = await verifySealProofAgainstBytes(proof, bytes);
+
+    expect(signatureCheck.ok).toBe(true);
+    expect(verification.valid).toBe(true);
+    expect(verification.keyId).toBe(signer.keyId);
+  });
+
+  it("rejects invalid proof JSON", () => {
+    const parsed = parseSealProofJson("not-json");
+
+    expect(parsed.ok).toBe(false);
+    expect(parsed.errors[0]).toContain("not valid JSON");
+  });
+
+  it("creates a portable public-key artifact", async () => {
+    const signer = await createSigner();
+    const artifact = await createSealPublicKeyArtifact({
+      identity: signer.identity,
+    });
+
+    expect(artifact.publicKey).toBe(signer.publicKey);
+    expect(artifact.keyId).toBe(signer.keyId);
+    expect(artifact.version).toBe("2");
+    expect(artifact.type).toBe("seal-public-key");
+  });
+});

package/packages/seal/tsconfig.json

@@ -0,0 +1,12 @@
+{
+  "extends": "../../tsconfig.json",
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ESNext",
+    "moduleResolution": "Node",
+    "lib": ["ES2022", "DOM"],
+    "types": ["vitest/globals"]
+  },
+  "include": ["src/**/*.ts", "test/**/*.ts", "vite.config.ts"],
+  "exclude": ["dist", "node_modules"]
+}

package/packages/seal/vite.config.ts

@@ -0,0 +1,54 @@
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { defineConfig } from "vite";
+import { createPackageExternal, resolvePackageDir } from "../../scripts/vite/package-lib-config";
+
+const configDir = dirname(fileURLToPath(import.meta.url));
+const external = createPackageExternal(resolvePackageDir(import.meta.url), {
+  includeNodeBuiltins: true,
+});
+
+export default defineConfig(({ mode }) => {
+  const proofOnly = mode === "proof-only";
+
+  return {
+    build: {
+      outDir: "dist",
+      target: "node20",
+      sourcemap: true,
+      minify: false,
+      rollupOptions: {
+        preserveEntrySignatures: "strict",
+        input: proofOnly
+          ? {
+              proof: resolve(configDir, "src/proof.ts"),
+              crypto: resolve(configDir, "src/crypto.ts"),
+            }
+          : {
+              cli: resolve(configDir, "src/cli.ts"),
+              index: resolve(configDir, "src/index.ts"),
+              proof: resolve(configDir, "src/proof.ts"),
+              artifact: resolve(configDir, "src/artifact.ts"),
+              manifest: resolve(configDir, "src/manifest.ts"),
+              crypto: resolve(configDir, "src/crypto.ts"),
+              errors: resolve(configDir, "src/errors.ts"),
+            },
+        external,
+        output: {
+          format: "es",
+          entryFileNames: "[name].js",
+          chunkFileNames: "chunks/[name]-[hash].js",
+        },
+      },
+    },
+    test: {
+      environment: "node",
+      alias: {
+        "@ternent/armour": resolve(configDir, "../armour/src/index.ts"),
+        "@ternent/identity": resolve(configDir, "../identity-v2/src/index.ts"),
+        "@ternent/rage": resolve(configDir, "../rage/src/index.ts"),
+        "ternent-utils": resolve(configDir, "../utils/src/index.ts"),
+      },
+    },
+  };
+});