seal-ts

SEAL (Secure Evidence Attribution Label) v1 for TypeScript/JavaScript — sign and verify.

SEAL is an open standard for binding attribution and authentication to media: a compact DKIM-model record (<seal … />) embedded in the file or shipped as a sidecar, authenticated by a public key published in DNS TXT. The spec is maintained by Hacker Factor — SEAL v1.2.12.

The upstream JavaScript implementation (hackerfactor/SEAL-JS) is validator-only; until now a full signer existed only in C (hackerfactor/SEAL-C). This package adds the missing signer in TypeScript and pairs it with the vendored upstream validator so what we sign is proven to authenticate, byte for byte.

Quick start

import { generateSealKeyPair, sealSign, seal } from '@woss/seal-ts';

// One-time: generate a keypair, publish the SPKI in DNS TXT (see Keys)
const kp = await generateSealKeyPair('ecdsa');

// Sign a manifest (JPEG/PNG embeds natively; anything else is a sidecar record)
const signed = await sealSign(manifestBytes, {
  domain: 'example.com',
  key: kp.key,
  alg: 'ecdsa',
});

// Later, anywhere: verify against DNS-published keys
const results = await seal.validateBuffer(signed.embedded, 'photo.jpg');
console.log(results[0].valid); // true

Where to go next

• Installation
• Signing — embed formats, record structure, algorithms
• Verification — DNS resolution, validation results, quirks
• Keys — generation, persistence, DNS TXT distribution, revocation
• Vendored validator — why the verify side is upstream code