@majikah/majik-key 0.2.10 → 0.2.11

package/dist/core/types.d.ts

@@ -21,6 +21,12 @@ export interface MajikKeyJSON {
     encryptedMlDsaSecretKey?: string;
     mnemonicLanguage?: MnemonicLanguage;
 }
+export interface MajikKeyDangerousJSON extends MajikKeyJSON {
+    privateKeyBase64: string;
+    mlKemSecretKeyBase64: string;
+    edSecretKeyBase64: string;
+    mlDsaSecretKeyBase64: string;
+}
 export interface MajikKeyMetadata {
     id: string;
     fingerprint: string;

package/dist/majik-key.d.ts

@@ -23,7 +23,7 @@
  */
 import { MajikContact, MajikContactMeta } from "@majikah/majik-contact";
 import { KDF_VERSION } from "./core/crypto/constants";
-import type { MajikKeyJSON, MajikKeyMetadata, MnemonicJSON } from "./core/types";
+import type { MajikKeyDangerousJSON, MajikKeyJSON, MajikKeyMetadata, MnemonicJSON } from "./core/types";
 import { MajikMessageIdentity } from "./core/database/system/identity";
 import { MajikUser } from "@thezelijah/majik-user";
 import { MnemonicLanguage } from "./core/crypto/wordlist";
@@ -142,6 +142,20 @@ export declare class MajikKey {
     get hasSigningKeys(): boolean;
     static create(mnemonic: string, passphrase: string, label?: string, mnemonicLanguage?: MnemonicLanguage): Promise<MajikKey>;
     static fromJSON(json: MajikKeyJSON | string): MajikKey;
+    /**
+     * Export a fully unlocked MajikKey with all raw private keys.
+     * ⚠️ DANGEROUS — output contains unencrypted private key material.
+     * Only use for server-side secrets injection.
+     * Never log, store in a database, or transmit over the network.
+     */
+    toDangerousJSON(): MajikKeyDangerousJSON;
+    /**
+     * Reconstruct a fully unlocked MajikKey from a dangerous JSON export.
+     * ⚠️ DANGEROUS — input contains unencrypted private key material.
+     * Intended for server-side use only (e.g. TSA signing key loaded from Cloudflare Secrets).
+     * No KDF is involved — reconstruction is instant.
+     */
+    static fromDangerousJSON(json: MajikKeyDangerousJSON | string): MajikKey;
     toMnemonicJSON(mnemonic: string, passphrase?: string): MnemonicJSON;
     static fromMnemonicJSON(mnemonicJson: MnemonicJSON | string, passphrase: string, label?: string): Promise<MajikKey>;
     updateLabel(newLabel: string): this;

package/dist/majik-key.js

@@ -271,6 +271,81 @@ export class MajikKey {
             throw new MajikKeyError("Failed to parse MajikKey from JSON", err);
         }
     }
+    /**
+     * Export a fully unlocked MajikKey with all raw private keys.
+     * ⚠️ DANGEROUS — output contains unencrypted private key material.
+     * Only use for server-side secrets injection.
+     * Never log, store in a database, or transmit over the network.
+     */
+    toDangerousJSON() {
+        if (this.isLocked)
+            throw new MajikKeyError("MajikKey must be unlocked to export dangerous JSON.");
+        if (!this._edSecretKey ||
+            !this._mlDsaSecretKey ||
+            !this._mlKemSecretKey ||
+            !this._privateKeyBase64)
+            throw new MajikKeyError("MajikKey is missing secret keys — re-import via importFromMnemonicBackup() first.");
+        return {
+            ...this.toJSON(),
+            privateKeyBase64: this._privateKeyBase64,
+            mlKemSecretKeyBase64: arrayToBase64(this._mlKemSecretKey),
+            edSecretKeyBase64: arrayToBase64(this._edSecretKey),
+            mlDsaSecretKeyBase64: arrayToBase64(this._mlDsaSecretKey),
+        };
+    }
+    /**
+     * Reconstruct a fully unlocked MajikKey from a dangerous JSON export.
+     * ⚠️ DANGEROUS — input contains unencrypted private key material.
+     * Intended for server-side use only (e.g. TSA signing key loaded from Cloudflare Secrets).
+     * No KDF is involved — reconstruction is instant.
+     */
+    static fromDangerousJSON(json) {
+        try {
+            const parsed = typeof json === "string" ? JSON.parse(json) : json;
+            if (!parsed.id ||
+                !parsed.fingerprint ||
+                !parsed.publicKey ||
+                !parsed.privateKeyBase64 ||
+                !parsed.edPublicKey ||
+                !parsed.edSecretKeyBase64 ||
+                !parsed.mlDsaPublicKey ||
+                !parsed.mlDsaSecretKeyBase64 ||
+                !parsed.mlKemPublicKey ||
+                !parsed.mlKemSecretKeyBase64)
+                throw new MajikKeyError("Invalid MajikKeyDangerousJSON — missing required fields");
+            const privateKeyBytes = base64ToUint8Array(parsed.privateKeyBase64);
+            const edPublicKey = base64ToUint8Array(parsed.edPublicKey);
+            const edSecretKey = base64ToUint8Array(parsed.edSecretKeyBase64);
+            const mlDsaPublicKey = base64ToUint8Array(parsed.mlDsaPublicKey);
+            const mlDsaSecretKey = base64ToUint8Array(parsed.mlDsaSecretKeyBase64);
+            const mlKemPublicKey = base64ToUint8Array(parsed.mlKemPublicKey);
+            const mlKemSecretKey = base64ToUint8Array(parsed.mlKemSecretKeyBase64);
+            return new MajikKey({
+                id: parsed.id,
+                fingerprint: parsed.fingerprint,
+                publicKey: { raw: base64ToUint8Array(parsed.publicKey) },
+                publicKeyBase64: parsed.publicKey,
+                privateKey: { raw: privateKeyBytes },
+                privateKeyBase64: parsed.privateKeyBase64,
+                encryptedPrivateKey: new ArrayBuffer(0),
+                encryptedPrivateKeyBase64: parsed.encryptedPrivateKey,
+                salt: parsed.salt,
+                backup: parsed.backup,
+                kdfVersion: parsed?.kdfVersion || KDF_VERSION.ARGON2ID,
+                mlKemPublicKey,
+                mlKemSecretKey,
+                edPublicKey,
+                edSecretKey,
+                mlDsaPublicKey,
+                mlDsaSecretKey,
+            });
+        }
+        catch (err) {
+            if (err instanceof MajikKeyError)
+                throw err;
+            throw new MajikKeyError("Failed to reconstruct MajikKey from dangerous JSON", err);
+        }
+    }
     // ── MnemonicJSON ─────────────────────────────────────────────────────────────
     toMnemonicJSON(mnemonic, passphrase) {
         if (this.isLocked)

package/package.json

@@ -2,7 +2,7 @@
   "name": "@majikah/majik-key",
   "type": "module",
   "description": "A post-quantum ready seed phrase account library for the Majikah ecosystem. Manages deterministic X25519 and ML-KEM-768 identities with Argon2id protection and seamless legacy account migration.",
-  "version": "0.2.10",
+  "version": "0.2.11",
   "license": "Apache-2.0",
   "author": "Zelijah",
   "main": "./dist/index.js",