@majikah/majik-key 0.2.9 → 0.2.11

package/README.md

@@ -893,7 +893,7 @@ Secure messaging platform using Majik Keys
 
 [Read more about Majik Message here](https://majikah.solutions/products/majik-message)
 
-[![Majik Message Thumbnail](https://github.com/user-attachments/assets/d433c6b8-1841-4fa1-a6da-b348029d1dbe)](https://message.majikah.solutions)
+[![Majik Message Thumbnail](https://github.com/user-attachments/assets/6355cbd3-63e4-4a95-a370-64ba27cbb4a7)](https://message.majikah.solutions)
 
 > Click the image to try Majik Message live.
 

package/dist/core/types.d.ts

@@ -21,6 +21,12 @@ export interface MajikKeyJSON {
     encryptedMlDsaSecretKey?: string;
     mnemonicLanguage?: MnemonicLanguage;
 }
+export interface MajikKeyDangerousJSON extends MajikKeyJSON {
+    privateKeyBase64: string;
+    mlKemSecretKeyBase64: string;
+    edSecretKeyBase64: string;
+    mlDsaSecretKeyBase64: string;
+}
 export interface MajikKeyMetadata {
     id: string;
     fingerprint: string;

package/dist/majik-key.d.ts

@@ -21,9 +21,9 @@
  *   point, so ML-KEM keys can be deterministically re-derived and stored.
  *   No partial migration — either fully upgraded or not upgraded yet.
  */
-import { MajikContact } from "@majikah/majik-contact";
+import { MajikContact, MajikContactMeta } from "@majikah/majik-contact";
 import { KDF_VERSION } from "./core/crypto/constants";
-import type { MajikKeyJSON, MajikKeyMetadata, MnemonicJSON } from "./core/types";
+import type { MajikKeyDangerousJSON, MajikKeyJSON, MajikKeyMetadata, MnemonicJSON } from "./core/types";
 import { MajikMessageIdentity } from "./core/database/system/identity";
 import { MajikUser } from "@thezelijah/majik-user";
 import { MnemonicLanguage } from "./core/crypto/wordlist";
@@ -142,6 +142,20 @@ export declare class MajikKey {
     get hasSigningKeys(): boolean;
     static create(mnemonic: string, passphrase: string, label?: string, mnemonicLanguage?: MnemonicLanguage): Promise<MajikKey>;
     static fromJSON(json: MajikKeyJSON | string): MajikKey;
+    /**
+     * Export a fully unlocked MajikKey with all raw private keys.
+     * ⚠️ DANGEROUS — output contains unencrypted private key material.
+     * Only use for server-side secrets injection.
+     * Never log, store in a database, or transmit over the network.
+     */
+    toDangerousJSON(): MajikKeyDangerousJSON;
+    /**
+     * Reconstruct a fully unlocked MajikKey from a dangerous JSON export.
+     * ⚠️ DANGEROUS — input contains unencrypted private key material.
+     * Intended for server-side use only (e.g. TSA signing key loaded from Cloudflare Secrets).
+     * No KDF is involved — reconstruction is instant.
+     */
+    static fromDangerousJSON(json: MajikKeyDangerousJSON | string): MajikKey;
     toMnemonicJSON(mnemonic: string, passphrase?: string): MnemonicJSON;
     static fromMnemonicJSON(mnemonicJson: MnemonicJSON | string, passphrase: string, label?: string): Promise<MajikKey>;
     updateLabel(newLabel: string): this;
@@ -165,7 +179,11 @@ export declare class MajikKey {
     toString(pretty?: boolean): string;
     static generateMnemonic(strength?: 128 | 256, language?: MnemonicLanguage): Promise<string>;
     static validateMnemonic(mnemonic: string): boolean;
-    toContact(): MajikContact;
+    /**
+     * Converts the MajikKey to a MajikContact.
+     * You can pass a custom metadata type if needed, e.g., toContact<MyMeta>()
+     */
+    toContact<TMeta extends MajikContactMeta = MajikContactMeta>(initialMeta?: Partial<TMeta>): MajikContact<TMeta>;
     toKeyIdentity(): MajikKeyIdentity;
     toSerializedIdentity(): SerializedIdentity;
     toMajikMessageIdentity(user: MajikUser, options?: {

package/dist/majik-key.js

@@ -198,7 +198,7 @@ export class MajikKey {
                 encryptedMlDsaSecretKeyBase64: arrayBufferToBase64(identity.encryptedMlDsaSecretKey),
                 edSecretKey: identity.edSecretKey,
                 mlDsaSecretKey: identity.mlDsaSecretKey,
-                mnemonicLanguage: mnemonicLanguage
+                mnemonicLanguage: mnemonicLanguage,
             });
         }
         catch (err) {
@@ -271,6 +271,81 @@ export class MajikKey {
             throw new MajikKeyError("Failed to parse MajikKey from JSON", err);
         }
     }
+    /**
+     * Export a fully unlocked MajikKey with all raw private keys.
+     * ⚠️ DANGEROUS — output contains unencrypted private key material.
+     * Only use for server-side secrets injection.
+     * Never log, store in a database, or transmit over the network.
+     */
+    toDangerousJSON() {
+        if (this.isLocked)
+            throw new MajikKeyError("MajikKey must be unlocked to export dangerous JSON.");
+        if (!this._edSecretKey ||
+            !this._mlDsaSecretKey ||
+            !this._mlKemSecretKey ||
+            !this._privateKeyBase64)
+            throw new MajikKeyError("MajikKey is missing secret keys — re-import via importFromMnemonicBackup() first.");
+        return {
+            ...this.toJSON(),
+            privateKeyBase64: this._privateKeyBase64,
+            mlKemSecretKeyBase64: arrayToBase64(this._mlKemSecretKey),
+            edSecretKeyBase64: arrayToBase64(this._edSecretKey),
+            mlDsaSecretKeyBase64: arrayToBase64(this._mlDsaSecretKey),
+        };
+    }
+    /**
+     * Reconstruct a fully unlocked MajikKey from a dangerous JSON export.
+     * ⚠️ DANGEROUS — input contains unencrypted private key material.
+     * Intended for server-side use only (e.g. TSA signing key loaded from Cloudflare Secrets).
+     * No KDF is involved — reconstruction is instant.
+     */
+    static fromDangerousJSON(json) {
+        try {
+            const parsed = typeof json === "string" ? JSON.parse(json) : json;
+            if (!parsed.id ||
+                !parsed.fingerprint ||
+                !parsed.publicKey ||
+                !parsed.privateKeyBase64 ||
+                !parsed.edPublicKey ||
+                !parsed.edSecretKeyBase64 ||
+                !parsed.mlDsaPublicKey ||
+                !parsed.mlDsaSecretKeyBase64 ||
+                !parsed.mlKemPublicKey ||
+                !parsed.mlKemSecretKeyBase64)
+                throw new MajikKeyError("Invalid MajikKeyDangerousJSON — missing required fields");
+            const privateKeyBytes = base64ToUint8Array(parsed.privateKeyBase64);
+            const edPublicKey = base64ToUint8Array(parsed.edPublicKey);
+            const edSecretKey = base64ToUint8Array(parsed.edSecretKeyBase64);
+            const mlDsaPublicKey = base64ToUint8Array(parsed.mlDsaPublicKey);
+            const mlDsaSecretKey = base64ToUint8Array(parsed.mlDsaSecretKeyBase64);
+            const mlKemPublicKey = base64ToUint8Array(parsed.mlKemPublicKey);
+            const mlKemSecretKey = base64ToUint8Array(parsed.mlKemSecretKeyBase64);
+            return new MajikKey({
+                id: parsed.id,
+                fingerprint: parsed.fingerprint,
+                publicKey: { raw: base64ToUint8Array(parsed.publicKey) },
+                publicKeyBase64: parsed.publicKey,
+                privateKey: { raw: privateKeyBytes },
+                privateKeyBase64: parsed.privateKeyBase64,
+                encryptedPrivateKey: new ArrayBuffer(0),
+                encryptedPrivateKeyBase64: parsed.encryptedPrivateKey,
+                salt: parsed.salt,
+                backup: parsed.backup,
+                kdfVersion: parsed?.kdfVersion || KDF_VERSION.ARGON2ID,
+                mlKemPublicKey,
+                mlKemSecretKey,
+                edPublicKey,
+                edSecretKey,
+                mlDsaPublicKey,
+                mlDsaSecretKey,
+            });
+        }
+        catch (err) {
+            if (err instanceof MajikKeyError)
+                throw err;
+            throw new MajikKeyError("Failed to reconstruct MajikKey from dangerous JSON", err);
+        }
+    }
     // ── MnemonicJSON ─────────────────────────────────────────────────────────────
     toMnemonicJSON(mnemonic, passphrase) {
         if (this.isLocked)
@@ -512,13 +587,22 @@ export class MajikKey {
             return false;
         }
     }
-    toContact() {
+    /**
+     * Converts the MajikKey to a MajikContact.
+     * You can pass a custom metadata type if needed, e.g., toContact<MyMeta>()
+     */
+    toContact(initialMeta) {
         const mlKeyBase64 = arrayToBase64(this.mlKemPublicKey);
+        // We construct the base metadata and merge with any provided initialMeta
+        const meta = {
+            label: this._label,
+            ...initialMeta,
+        };
         return new MajikContact({
             id: this._id,
             publicKey: this._publicKey,
             fingerprint: this._fingerprint,
-            meta: { label: this._label },
+            meta: meta,
             mlKey: mlKeyBase64,
             edPublicKeyBase64: this._edPublicKey
                 ? arrayToBase64(this._edPublicKey)

package/package.json

@@ -2,7 +2,7 @@
   "name": "@majikah/majik-key",
   "type": "module",
   "description": "A post-quantum ready seed phrase account library for the Majikah ecosystem. Manages deterministic X25519 and ML-KEM-768 identities with Argon2id protection and seamless legacy account migration.",
-  "version": "0.2.9",
+  "version": "0.2.11",
   "license": "Apache-2.0",
   "author": "Zelijah",
   "main": "./dist/index.js",
@@ -50,7 +50,7 @@
     "test:watch": "vitest"
   },
   "dependencies": {
-    "@majikah/majik-contact": "^0.0.4",
+    "@majikah/majik-contact": "^0.0.6",
     "@noble/hashes": "^2.2.0",
     "@noble/post-quantum": "^0.6.1",
     "@scure/bip39": "^2.2.0",