@majikah/majik-key 0.1.9 → 0.2.0

package/dist/core/crypto/constants.d.ts

@@ -4,6 +4,7 @@ export declare const KEY_ALGO: {
 };
 export declare const MAJIK_SALT = "MajikMessageSalt";
 export declare const MAJIK_MNEMONIC_SALT = "MajikMessageMnemonicSalt";
+export declare const MAJIK_SIGNATURE_SEED = "MajikSignatureSeedDSA";
 /**
  * KDF version identifiers.
  * Stored alongside every encrypted private key blob so the correct
@@ -18,26 +19,10 @@ export type KDF_VERSION = (typeof KDF_VERSION)[keyof typeof KDF_VERSION];
  * Argon2id parameters.
  *
  * PASSPHRASE (protecting the private key at rest):
- *   m=131072 (128 MB) — double OWASP "high security" tier (64 MB)
+ *   m=131072 (64 MB) — double OWASP "high security" tier (64 MB)
  *   t=4               — 4 passes
  *   p=4               — 4 parallel lanes
  *
- * Benchmark targets (approximate):
- *   Modern laptop (2020+):          ~600–900ms  ✓
- *   Mid-range desktop (2018):       ~800–1200ms ✓
- *   Low-end / older machine:        ~1500–2500ms — acceptable for a one-time unlock
- *   RTX 4090 brute-force attack:    ~1–3 guesses/sec vs ~400,000/sec for PBKDF2
- *   Improvement over current PBKDF2: ~100,000–400,000×
- *
- * MNEMONIC BACKUP (protecting exported backup files):
- *   m=65536 (64 MB) — lower because the mnemonic itself is 128-bit entropy;
- *                     the KDF is a domain separator, not a weak-password defense.
- *   t=3
- *   p=2
- *
- * If benchmarks on your lowest-spec target device exceed 3s for the passphrase
- * parameters, reduce m to 65536 (64 MB) and t to 3. That is still ~50,000×
- * harder than the current PBKDF2 setup.
  */
 export declare const ARGON2_PARAMS: {
     readonly PASSPHRASE: {

package/dist/core/crypto/constants.js

@@ -1,6 +1,7 @@
 export const KEY_ALGO = { name: "ECDH", namedCurve: "X25519" };
 export const MAJIK_SALT = "MajikMessageSalt";
 export const MAJIK_MNEMONIC_SALT = "MajikMessageMnemonicSalt";
+export const MAJIK_SIGNATURE_SEED = "MajikSignatureSeedDSA";
 /**
  * KDF version identifiers.
  * Stored alongside every encrypted private key blob so the correct
@@ -14,30 +15,14 @@ export const KDF_VERSION = {
  * Argon2id parameters.
  *
  * PASSPHRASE (protecting the private key at rest):
- *   m=131072 (128 MB) — double OWASP "high security" tier (64 MB)
+ *   m=131072 (64 MB) — double OWASP "high security" tier (64 MB)
  *   t=4               — 4 passes
  *   p=4               — 4 parallel lanes
  *
- * Benchmark targets (approximate):
- *   Modern laptop (2020+):          ~600–900ms  ✓
- *   Mid-range desktop (2018):       ~800–1200ms ✓
- *   Low-end / older machine:        ~1500–2500ms — acceptable for a one-time unlock
- *   RTX 4090 brute-force attack:    ~1–3 guesses/sec vs ~400,000/sec for PBKDF2
- *   Improvement over current PBKDF2: ~100,000–400,000×
- *
- * MNEMONIC BACKUP (protecting exported backup files):
- *   m=65536 (64 MB) — lower because the mnemonic itself is 128-bit entropy;
- *                     the KDF is a domain separator, not a weak-password defense.
- *   t=3
- *   p=2
- *
- * If benchmarks on your lowest-spec target device exceed 3s for the passphrase
- * parameters, reduce m to 65536 (64 MB) and t to 3. That is still ~50,000×
- * harder than the current PBKDF2 setup.
  */
 export const ARGON2_PARAMS = {
     PASSPHRASE: {
-        m: 65536, // memory in KB (128 MB)
+        m: 65536, // memory in KB (64 MB)
         t: 3, // time cost (passes)
         p: 4, // parallelism (lanes)
         dkLen: 32, // output length in bytes (256-bit AES key)

package/dist/core/crypto/crypto-provider.js

@@ -10,6 +10,7 @@ import { arrayToBase64 } from "../utils";
 import { argon2id as nobleArgon2id } from "@noble/hashes/argon2.js";
 import { ARGON2_PARAMS } from "./constants";
 import { ml_kem768 } from "@noble/post-quantum/ml-kem.js";
+import { argon2id as hashWasmArgon2id } from "hash-wasm";
 export const IV_LENGTH = 12;
 export function generateRandomBytes(len) {
     const b = new Uint8Array(len);
@@ -60,10 +61,12 @@ export function aesGcmDecrypt(keyBytes, iv, ciphertext) {
  */
 let _wasmAvailable = null;
 async function _probeWasm() {
+    // Never run WASM probe on server — KDF only runs client-side
+    if (typeof window === "undefined")
+        return false;
     try {
-        const { argon2id } = await import("hash-wasm");
         // Cheap smoke-test: tiny params, just proves the WASM module loads & runs
-        await argon2id({
+        await hashWasmArgon2id({
             password: new Uint8Array(4),
             salt: new Uint8Array(8),
             memorySize: 8,
@@ -79,14 +82,13 @@ async function _probeWasm() {
     }
 }
 async function _argon2idWasm(input, salt, params) {
-    const { argon2id } = await import("hash-wasm");
-    return argon2id({
+    return hashWasmArgon2id({
         password: input,
         salt,
-        memorySize: params.m, // KB — same unit as noble's m ✓
-        iterations: params.t, // hash-wasm calls it iterations, not t
-        parallelism: params.p, // hash-wasm calls it parallelism, not p
-        hashLength: params.dkLen, // hash-wasm calls it hashLength, not dkLen
+        memorySize: params.m,
+        iterations: params.t,
+        parallelism: params.p,
+        hashLength: params.dkLen,
         outputType: "binary",
     });
 }

package/dist/core/crypto/encryption-engine.d.ts

@@ -8,6 +8,10 @@ export interface EncryptionIdentity {
     fingerprint: string;
     mlKemPublicKey: Uint8Array;
     mlKemSecretKey?: Uint8Array;
+    edPublicKey: Uint8Array;
+    edSecretKey: Uint8Array;
+    mlDsaPublicKey: Uint8Array;
+    mlDsaSecretKey: Uint8Array;
 }
 /**
  * EncryptionEngine

package/dist/core/crypto/encryption-engine.js

@@ -2,7 +2,11 @@
 import { mnemonicToSeedSync } from "@scure/bip39";
 import * as ed25519 from "@stablelib/ed25519";
 import ed2curve from "ed2curve";
+import { ml_dsa87 } from "@noble/post-quantum/ml-dsa.js";
 import { deriveMlKemKeypairFromSeed, fingerprintFromPublicRaw, } from "./crypto-provider";
+import { concatUint8Arrays } from "../utils";
+import { hash } from "@stablelib/sha256";
+import { MAJIK_SIGNATURE_SEED } from "./constants";
 /**
  * EncryptionEngine
  * ----------------
@@ -56,12 +60,18 @@ export class EncryptionEngine {
             // seed[0..32] → lattice key matrix expansion (K-PKE keygen)
             // seed[32..64] → implicit rejection parameter z (stored in secretKey)
             const mlKemKeypair = deriveMlKemKeypairFromSeed(seed64);
+            const mlDsaSeed = hash(concatUint8Arrays(seed64, new TextEncoder().encode(MAJIK_SIGNATURE_SEED))); // 32 bytes, deterministic, domain-separated
+            const mlDsaKeypair = ml_dsa87.keygen(mlDsaSeed);
             return {
                 publicKey,
                 privateKey,
                 fingerprint,
                 mlKemPublicKey: mlKemKeypair.publicKey, // 1184 bytes
                 mlKemSecretKey: mlKemKeypair.secretKey, // 2400 bytes
+                edPublicKey: ed.publicKey, // 32 bytes
+                edSecretKey: ed.secretKey, // 64 bytes
+                mlDsaPublicKey: mlDsaKeypair.publicKey, // 2592 bytes
+                mlDsaSecretKey: mlDsaKeypair.secretKey, // 4896 bytes
             };
         }
         catch (err) {

package/dist/core/types.d.ts

@@ -14,6 +14,10 @@ export interface MajikKeyJSON {
     kdfVersion?: number;
     mlKemPublicKey?: string;
     encryptedMlKemSecretKey?: string;
+    edPublicKey?: string;
+    encryptedEdSecretKey?: string;
+    mlDsaPublicKey?: string;
+    encryptedMlDsaSecretKey?: string;
 }
 export interface MajikKeyMetadata {
     id: string;

package/dist/majik-key.d.ts

@@ -40,7 +40,16 @@ export interface MajikKeyIdentity {
     kdfVersion: KDF_VERSION;
     mlKemPublicKey: Uint8Array;
     mlKemSecretKey?: Uint8Array;
+    edPublicKey?: Uint8Array;
+    edSecretKey?: Uint8Array;
+    mlDsaPublicKey?: Uint8Array;
+    mlDsaSecretKey?: Uint8Array;
 }
+export type MajikKeyDerivedIdentity = MajikKeyIdentity & {
+    encryptedMlKemSecretKey: ArrayBuffer;
+    encryptedEdSecretKey: ArrayBuffer;
+    encryptedMlDsaSecretKey: ArrayBuffer;
+};
 export interface SerializedIdentity {
     id: string;
     publicKey: string;
@@ -70,6 +79,12 @@ export interface MajikKeyConstructorOptions {
         raw: Uint8Array;
     };
     privateKeyBase64?: string;
+    edPublicKey?: Uint8Array;
+    encryptedEdSecretKey?: ArrayBuffer;
+    encryptedEdSecretKeyBase64?: string;
+    mlDsaPublicKey?: Uint8Array;
+    encryptedMlDsaSecretKey?: ArrayBuffer;
+    encryptedMlDsaSecretKeyBase64?: string;
 }
 export declare class MajikKey {
     private readonly _id;
@@ -89,6 +104,14 @@ export declare class MajikKey {
     private _encryptedMlKemSecretKeyBase64?;
     private _privateKey?;
     private _privateKeyBase64?;
+    private _edPublicKey?;
+    private _edSecretKey?;
+    private _encryptedEdSecretKey?;
+    private _encryptedEdSecretKeyBase64?;
+    private _mlDsaPublicKey?;
+    private _mlDsaSecretKey?;
+    private _encryptedMlDsaSecretKey?;
+    private _encryptedMlDsaSecretKeyBase64?;
     private constructor();
     get id(): string;
     get fingerprint(): string;
@@ -108,6 +131,9 @@ export declare class MajikKey {
     get hasMlKem(): boolean;
     get isFullyUpgraded(): boolean;
     get metadata(): MajikKeyMetadata;
+    get edPublicKey(): Uint8Array | undefined;
+    get mlDsaPublicKey(): Uint8Array | undefined;
+    get hasSigningKeys(): boolean;
     static create(mnemonic: string, passphrase: string, label?: string): Promise<MajikKey>;
     static fromJSON(json: MajikKeyJSON | string): MajikKey;
     toMnemonicJSON(mnemonic: string, passphrase?: string): MnemonicJSON;
@@ -127,6 +153,8 @@ export declare class MajikKey {
     };
     getPrivateKeyBase64(): string;
     getMlKemSecretKey(): Uint8Array;
+    getEdSecretKey(): Uint8Array;
+    getMlDsaSecretKey(): Uint8Array;
     toJSON(): MajikKeyJSON;
     toString(pretty?: boolean): string;
     static generateMnemonic(strength?: 128 | 256): string;
@@ -160,8 +188,10 @@ export declare class MajikKey {
      * computation → two independently encrypted blobs.
      */
     private static _encryptMlKemSecretKey;
+    private static _encryptSigningKey;
     private static _decryptPrivateKey;
     private static _decryptMlKemSecretKey;
+    private static _decryptSigningKey;
     private static _verifyBackupDecryption;
     private static _exportMnemonicBackup;
     private static _deriveLegacyMnemonicKey;

package/dist/majik-key.js

@@ -51,6 +51,14 @@ export class MajikKey {
     _encryptedMlKemSecretKeyBase64;
     _privateKey;
     _privateKeyBase64;
+    _edPublicKey;
+    _edSecretKey;
+    _encryptedEdSecretKey;
+    _encryptedEdSecretKeyBase64;
+    _mlDsaPublicKey;
+    _mlDsaSecretKey;
+    _encryptedMlDsaSecretKey;
+    _encryptedMlDsaSecretKeyBase64;
     constructor(options) {
         this._id = options.id;
         this._publicKey = options.publicKey;
@@ -69,6 +77,12 @@ export class MajikKey {
         this._encryptedMlKemSecretKeyBase64 = options.encryptedMlKemSecretKeyBase64;
         this._privateKey = options.privateKey;
         this._privateKeyBase64 = options.privateKeyBase64;
+        this._edPublicKey = options.edPublicKey;
+        this._encryptedEdSecretKey = options.encryptedEdSecretKey;
+        this._encryptedEdSecretKeyBase64 = options.encryptedEdSecretKeyBase64;
+        this._mlDsaPublicKey = options.mlDsaPublicKey;
+        this._encryptedMlDsaSecretKey = options.encryptedMlDsaSecretKey;
+        this._encryptedMlDsaSecretKeyBase64 = options.encryptedMlDsaSecretKeyBase64;
     }
     // ── Getters ─────────────────────────────────────────────────────────────────
     get id() {
@@ -127,6 +141,15 @@ export class MajikKey {
             hasMlKem: this.hasMlKem,
         };
     }
+    get edPublicKey() {
+        return this._edPublicKey;
+    }
+    get mlDsaPublicKey() {
+        return this._mlDsaPublicKey;
+    }
+    get hasSigningKeys() {
+        return (this._edPublicKey !== undefined && this._mlDsaPublicKey !== undefined);
+    }
     // ── CREATE ──────────────────────────────────────────────────────────────────
     static async create(mnemonic, passphrase, label) {
         try {
@@ -155,6 +178,12 @@ export class MajikKey {
                 encryptedMlKemSecretKeyBase64: arrayBufferToBase64(identity.encryptedMlKemSecretKey),
                 privateKey: identity.privateKey,
                 privateKeyBase64,
+                edPublicKey: identity.edPublicKey,
+                encryptedEdSecretKey: identity.encryptedEdSecretKey,
+                encryptedEdSecretKeyBase64: arrayBufferToBase64(identity.encryptedEdSecretKey),
+                mlDsaPublicKey: identity.mlDsaPublicKey,
+                encryptedMlDsaSecretKey: identity.encryptedMlDsaSecretKey,
+                encryptedMlDsaSecretKeyBase64: arrayBufferToBase64(identity.encryptedMlDsaSecretKey),
             });
         }
         catch (err) {
@@ -178,6 +207,24 @@ export class MajikKey {
                 encryptedMlKemSecretKeyBase64 = anyParsed.encryptedMlKemSecretKey;
                 encryptedMlKemSecretKey = base64ToArrayBuffer(anyParsed.encryptedMlKemSecretKey);
             }
+            const edPublicKey = anyParsed.edPublicKey
+                ? base64ToUint8Array(anyParsed.edPublicKey)
+                : undefined;
+            let encryptedEdSecretKey;
+            let encryptedEdSecretKeyBase64;
+            if (anyParsed.encryptedEdSecretKey) {
+                encryptedEdSecretKeyBase64 = anyParsed.encryptedEdSecretKey;
+                encryptedEdSecretKey = base64ToArrayBuffer(anyParsed.encryptedEdSecretKey);
+            }
+            const mlDsaPublicKey = anyParsed.mlDsaPublicKey
+                ? base64ToUint8Array(anyParsed.mlDsaPublicKey)
+                : undefined;
+            let encryptedMlDsaSecretKey;
+            let encryptedMlDsaSecretKeyBase64;
+            if (anyParsed.encryptedMlDsaSecretKey) {
+                encryptedMlDsaSecretKeyBase64 = anyParsed.encryptedMlDsaSecretKey;
+                encryptedMlDsaSecretKey = base64ToArrayBuffer(anyParsed.encryptedMlDsaSecretKey);
+            }
             return new MajikKey({
                 id: validated.id,
                 publicKey: { raw: new Uint8Array(publicKeyBuffer) },
@@ -194,6 +241,12 @@ export class MajikKey {
                 mlKemPublicKey,
                 encryptedMlKemSecretKey,
                 encryptedMlKemSecretKeyBase64,
+                edPublicKey,
+                encryptedEdSecretKey,
+                encryptedEdSecretKeyBase64,
+                mlDsaPublicKey,
+                encryptedMlDsaSecretKey,
+                encryptedMlDsaSecretKeyBase64,
             });
         }
         catch (err) {
@@ -260,6 +313,20 @@ export class MajikKey {
                 this._encryptedMlKemSecretKeyBase64 = arrayBufferToBase64(encMlKem);
                 this._mlKemSecretKey = mlKemSecretKeyBytes;
             }
+            if (this._encryptedEdSecretKey) {
+                const edSecretKeyBytes = await MajikKey._decryptSigningKey(this._encryptedEdSecretKey, currentPassphrase, salt);
+                const encEd = await MajikKey._encryptSigningKey(edSecretKeyBytes, newPassphrase, newSalt);
+                this._encryptedEdSecretKey = encEd;
+                this._encryptedEdSecretKeyBase64 = arrayBufferToBase64(encEd);
+                this._edSecretKey = edSecretKeyBytes;
+            }
+            if (this._encryptedMlDsaSecretKey) {
+                const mlDsaSecretKeyBytes = await MajikKey._decryptSigningKey(this._encryptedMlDsaSecretKey, currentPassphrase, salt);
+                const encDsa = await MajikKey._encryptSigningKey(mlDsaSecretKeyBytes, newPassphrase, newSalt);
+                this._encryptedMlDsaSecretKey = encDsa;
+                this._encryptedMlDsaSecretKeyBase64 = arrayBufferToBase64(encDsa);
+                this._mlDsaSecretKey = mlDsaSecretKeyBytes;
+            }
             return this;
         }
         catch (err) {
@@ -294,10 +361,13 @@ export class MajikKey {
         }
     }
     // ── LOCK / UNLOCK ────────────────────────────────────────────────────────────
+    // required
     lock() {
         this._privateKey = undefined;
         this._privateKeyBase64 = undefined;
         this._mlKemSecretKey = undefined;
+        this._edSecretKey = undefined; // ADD
+        this._mlDsaSecretKey = undefined; // ADD
         return this;
     }
     async unlock(passphrase) {
@@ -322,6 +392,12 @@ export class MajikKey {
             if (this._encryptedMlKemSecretKey) {
                 this._mlKemSecretKey = await MajikKey._decryptMlKemSecretKey(this._encryptedMlKemSecretKey, passphrase, salt);
             }
+            if (this._encryptedEdSecretKey) {
+                this._edSecretKey = await MajikKey._decryptSigningKey(this._encryptedEdSecretKey, passphrase, salt);
+            }
+            if (this._encryptedMlDsaSecretKey) {
+                this._mlDsaSecretKey = await MajikKey._decryptSigningKey(this._encryptedMlDsaSecretKey, passphrase, salt);
+            }
             return this;
         }
         catch (err) {
@@ -357,6 +433,20 @@ export class MajikKey {
             throw new MajikKeyError("No ML-KEM secret key — re-import via importFromMnemonicBackup() for full migration.");
         return this._mlKemSecretKey;
     }
+    getEdSecretKey() {
+        if (this.isLocked)
+            throw new MajikKeyError("MajikKey is locked. Call unlock() first.");
+        if (!this._edSecretKey)
+            throw new MajikKeyError("No Ed25519 secret key — re-import via importFromMnemonicBackup() for full migration.");
+        return this._edSecretKey;
+    }
+    getMlDsaSecretKey() {
+        if (this.isLocked)
+            throw new MajikKeyError("MajikKey is locked. Call unlock() first.");
+        if (!this._mlDsaSecretKey)
+            throw new MajikKeyError("No ML-DSA secret key — re-import via importFromMnemonicBackup() for full migration.");
+        return this._mlDsaSecretKey;
+    }
     // ── SERIALIZATION ────────────────────────────────────────────────────────────
     toJSON() {
         return {
@@ -373,6 +463,14 @@ export class MajikKey {
                 ? arrayToBase64(this._mlKemPublicKey)
                 : undefined,
             encryptedMlKemSecretKey: this._encryptedMlKemSecretKeyBase64,
+            edPublicKey: this._edPublicKey
+                ? arrayToBase64(this._edPublicKey)
+                : undefined,
+            encryptedEdSecretKey: this._encryptedEdSecretKeyBase64,
+            mlDsaPublicKey: this._mlDsaPublicKey
+                ? arrayToBase64(this._mlDsaPublicKey)
+                : undefined,
+            encryptedMlDsaSecretKey: this._encryptedMlDsaSecretKeyBase64,
         };
     }
     toString(pretty = false) {
@@ -498,6 +596,12 @@ export class MajikKey {
                 encryptedMlKemSecretKeyBase64: arrayBufferToBase64(identity.encryptedMlKemSecretKey),
                 privateKey: identity.privateKey,
                 privateKeyBase64,
+                edPublicKey: identity.edPublicKey,
+                encryptedEdSecretKey: identity.encryptedEdSecretKey,
+                encryptedEdSecretKeyBase64: arrayBufferToBase64(identity.encryptedEdSecretKey),
+                mlDsaPublicKey: identity.mlDsaPublicKey,
+                encryptedMlDsaSecretKey: identity.encryptedMlDsaSecretKey,
+                encryptedMlDsaSecretKeyBase64: arrayBufferToBase64(identity.encryptedMlDsaSecretKey),
             });
         }
         catch (err) {
@@ -527,6 +631,11 @@ export class MajikKey {
         const { blob: encryptedPrivateKey } = await MajikKey._encryptPrivateKey(exportedXPrivate, passphrase, salt);
         const mlKemSecretKey = encIdentity.mlKemSecretKey;
         const encryptedMlKemSecretKey = await MajikKey._encryptMlKemSecretKey(mlKemSecretKey, passphrase, salt);
+        // after the existing ML-KEM encryption block:
+        const edSecretKey = encIdentity.edSecretKey;
+        const encryptedEdSecretKey = await MajikKey._encryptSigningKey(edSecretKey, passphrase, salt);
+        const mlDsaSecretKey = encIdentity.mlDsaSecretKey;
+        const encryptedMlDsaSecretKey = await MajikKey._encryptSigningKey(mlDsaSecretKey, passphrase, salt);
         return {
             id: encIdentity.fingerprint,
             publicKey: encIdentity.publicKey,
@@ -538,6 +647,12 @@ export class MajikKey {
             mlKemPublicKey: encIdentity.mlKemPublicKey,
             mlKemSecretKey,
             encryptedMlKemSecretKey,
+            edPublicKey: encIdentity.edPublicKey,
+            edSecretKey,
+            encryptedEdSecretKey,
+            mlDsaPublicKey: encIdentity.mlDsaPublicKey,
+            mlDsaSecretKey,
+            encryptedMlDsaSecretKey,
         };
     }
     // ── PRIVATE: Encryption/Decryption ───────────────────────────────────────────
@@ -561,6 +676,12 @@ export class MajikKey {
         const ciphertext = aesGcmEncrypt(keyBytes, iv, mlKemSecretKey);
         return concatUint8Arrays(iv, ciphertext).buffer;
     }
+    static async _encryptSigningKey(keyBytes_, passphrase, salt) {
+        const aesKey = await deriveKeyFromPassphraseArgon2(passphrase, salt);
+        const iv = generateRandomBytes(IV_LENGTH);
+        const ciphertext = aesGcmEncrypt(aesKey, iv, keyBytes_);
+        return concatUint8Arrays(iv, ciphertext).buffer;
+    }
     static async _decryptPrivateKey(buffer, passphrase, salt, kdfVersion = KDF_VERSION.PBKDF2) {
         const keyBytes = kdfVersion === KDF_VERSION.ARGON2ID
             ? await deriveKeyFromPassphraseArgon2(passphrase, salt)
@@ -584,6 +705,16 @@ export class MajikKey {
             throw new MajikKeyError("Failed to decrypt ML-KEM secret key");
         return plain;
     }
+    static async _decryptSigningKey(buffer, passphrase, salt) {
+        const keyBytes = await deriveKeyFromPassphraseArgon2(passphrase, salt);
+        const full = new Uint8Array(buffer);
+        const iv = full.slice(0, IV_LENGTH);
+        const ciphertext = full.slice(IV_LENGTH);
+        const plain = aesGcmDecrypt(keyBytes, iv, ciphertext);
+        if (!plain)
+            throw new MajikKeyError("Failed to decrypt signing key");
+        return plain;
+    }
     // ── PRIVATE: Backup ──────────────────────────────────────────────────────────
     static async _verifyBackupDecryption(ivBase64, ciphertextBase64, mnemonic, backupKdfVersion) {
         const iv = new Uint8Array(base64ToArrayBuffer(ivBase64));

package/package.json

@@ -2,7 +2,7 @@
   "name": "@majikah/majik-key",
   "type": "module",
   "description": "A post-quantum ready seed phrase account library for the Majikah ecosystem. Manages deterministic X25519 and ML-KEM-768 identities with Argon2id protection and seamless legacy account migration.",
-  "version": "0.1.9",
+  "version": "0.2.0",
   "license": "Apache-2.0",
   "author": "Zelijah",
   "main": "./dist/index.js",