@majikah/majik-signature-client 0.3.0 → 0.3.2

package/dist/core/client-state-manager.js

@@ -189,7 +189,10 @@ export class ClientStateManager {
             return DEFAULT_USER_APP_PREFERENCES;
         }
         try {
-            return JSON.parse(raw);
+            return {
+                ...DEFAULT_USER_APP_PREFERENCES,
+                ...JSON.parse(raw),
+            };
         }
         catch (e) {
             console.warn("ClientStateManager: Problem retrieving user app preferences: ", e);

package/dist/core/stamp/majik-signature-stamp-manager.d.ts

@@ -1,18 +1,38 @@
-import type { MajikFileIdentity } from "@majikah/majik-file";
+import { type BatchLockResult, type MajikFileIdentity } from "@majikah/majik-file";
 import { MajikSignatureStamp, MajikSignatureStampJSON, StampAssetKind, CreateStampOptions } from "./majik-signature-stamp";
 import { StorageQuery } from "../storage/storage-adapter";
 import { MajikSignatureStampStorageAdapter } from "../storage";
+import { MajikKey } from "@majikah/majik-key";
 export declare class MajikSignatureStampManagerError extends Error {
     cause?: unknown;
     constructor(message: string, cause?: unknown);
 }
 export declare class MajikSignatureStampManager {
     private readonly _cache;
+    private _decryptErrors;
     private _adapter;
     constructor(adapter?: MajikSignatureStampStorageAdapter);
     get adapter(): MajikSignatureStampStorageAdapter;
     setAdapter(adapter: MajikSignatureStampStorageAdapter): void;
     hydrate(): Promise<void>;
+    /**
+     * Hydrate every stamp for `fingerprint`. If `key` is given (must be
+     * unlocked, matching that fingerprint), each stamp is decrypted so its
+     * plaintext is ready for preview. Stamps that fail to decrypt are
+     * silently excluded from the cache — never a hard throw. Reasons are
+     * kept in getDecryptError() for optional diagnostics.
+     *
+     * NOTE: this intentionally does NOT call MajikFile.batchDecrypt() —
+     * that method gates on MajikFile.canDecrypt(), which currently compares
+     * key.fingerprint against a list of public keys and will reject every
+     * file. Once that's fixed upstream, this can call batchDecrypt() directly
+     * instead of looping decryptHydrate() manually.
+     */
+    hydrateForFingerprint(fingerprint: string, key?: MajikKey): Promise<void>;
+    getDecryptError(id: string): string | undefined;
+    /** Wipe decrypted plaintext from every currently cached stamp's MajikFile.
+     *  MajikFile.batchLock() has no canDecrypt-style gate, safe to use as-is. */
+    lockAll(): BatchLockResult;
     toJSON(): Promise<MajikSignatureStampJSON[]>;
     bulkRestoreFromJSON(data: MajikSignatureStampJSON[]): Promise<void>;
     static fromJSON(data: MajikSignatureStampJSON[], adapter?: MajikSignatureStampStorageAdapter): Promise<MajikSignatureStampManager>;

package/dist/core/stamp/majik-signature-stamp-manager.js

@@ -1,3 +1,4 @@
+import { MajikFile, } from "@majikah/majik-file";
 import { MajikSignatureStamp, } from "./majik-signature-stamp";
 import { InMemoryStampstoreAdapter, } from "../storage";
 export class MajikSignatureStampManagerError extends Error {
@@ -10,6 +11,7 @@ export class MajikSignatureStampManagerError extends Error {
 }
 export class MajikSignatureStampManager {
     _cache = new Map();
+    _decryptErrors = new Map();
     _adapter;
     constructor(adapter) {
         this._adapter = adapter ?? new InMemoryStampstoreAdapter();
@@ -34,6 +36,61 @@ export class MajikSignatureStampManager {
             }
         }
     }
+    /**
+     * Hydrate every stamp for `fingerprint`. If `key` is given (must be
+     * unlocked, matching that fingerprint), each stamp is decrypted so its
+     * plaintext is ready for preview. Stamps that fail to decrypt are
+     * silently excluded from the cache — never a hard throw. Reasons are
+     * kept in getDecryptError() for optional diagnostics.
+     *
+     * NOTE: this intentionally does NOT call MajikFile.batchDecrypt() —
+     * that method gates on MajikFile.canDecrypt(), which currently compares
+     * key.fingerprint against a list of public keys and will reject every
+     * file. Once that's fixed upstream, this can call batchDecrypt() directly
+     * instead of looping decryptHydrate() manually.
+     */
+    async hydrateForFingerprint(fingerprint, key) {
+        this._cache.clear();
+        this._decryptErrors.clear();
+        const rows = this._adapter.query
+            ? await this._adapter.query({ where: { fingerprint } })
+            : (await this._adapter.list()).filter((r) => r.fingerprint === fingerprint);
+        const stamps = [];
+        for (const json of rows) {
+            try {
+                stamps.push(MajikSignatureStamp.fromJSON(json));
+            }
+            catch (err) {
+                console.warn(`hydrateForFingerprint: skipping malformed stamp "${json?.id}":`, err);
+            }
+        }
+        if (!key) {
+            for (const s of stamps)
+                this._cache.set(s.id, s);
+            return;
+        }
+        const results = await Promise.allSettled(stamps.map((stamp) => stamp.toMajikFile().decryptHydrate(key)));
+        results.forEach((result, i) => {
+            const stamp = stamps[i];
+            if (result.status === "fulfilled") {
+                this._cache.set(stamp.id, stamp);
+            }
+            else {
+                this._decryptErrors.set(stamp.id, result.reason instanceof Error
+                    ? result.reason.message
+                    : String(result.reason));
+            }
+        });
+    }
+    getDecryptError(id) {
+        return this._decryptErrors.get(id);
+    }
+    /** Wipe decrypted plaintext from every currently cached stamp's MajikFile.
+     *  MajikFile.batchLock() has no canDecrypt-style gate, safe to use as-is. */
+    lockAll() {
+        const files = this.list().map((s) => s.toMajikFile());
+        return MajikFile.batchLock(files);
+    }
     // ── Serialization ─────────────────────────────────────────────────────
     async toJSON() {
         return this._adapter.list();

package/dist/core/stamp/majik-signature-stamp.d.ts

@@ -1,4 +1,5 @@
-import type { MajikFileIdentity } from "@majikah/majik-file";
+import { MajikFile } from "@majikah/majik-file";
+import type { MajikFileDecryptIdentity, MajikFileIdentity, MajikFileJSON } from "@majikah/majik-file";
 export type StampAssetKind = "image" | "audio" | "video" | "text";
 export interface MajikSignatureStampJSON {
     id: string;
@@ -10,6 +11,9 @@ export interface MajikSignatureStampJSON {
     data: string;
     timestamp: string;
     lastUpdate: string;
+    /** Full MajikFile metadata — required to reconstruct a working MajikFile
+     *  instance via MajikFile.fromJSON() for decryptHydrate()/secureLock(). */
+    fileJson: MajikFileJSON;
 }
 export interface CreateStampOptions {
     data: Uint8Array | ArrayBuffer;
@@ -30,6 +34,8 @@ export declare class MajikSignatureStamp {
     private readonly _sizeBytes;
     private readonly _fingerprint;
     private readonly _timestamp;
+    private readonly _fileJson;
+    private _file;
     private _lastUpdate;
     private _encryptedBinary;
     private constructor();
@@ -46,7 +52,13 @@ export declare class MajikSignatureStamp {
     rename(newName: string): void;
     toJSON(): MajikSignatureStampJSON;
     static fromJSON(json: MajikSignatureStampJSON): MajikSignatureStamp;
-    /** Decrypt and return the raw plaintext content bytes (image/audio/video/text). */
-    decryptContent(identity: Pick<MajikFileIdentity, "fingerprint" | "mlKemSecretKey">): Promise<Uint8Array>;
-    toBinaryBytes(): Uint8Array;
+    /** Reconstruct (or return the cached) MajikFile backing this stamp. */
+    toMajikFile(): MajikFile;
+    /** Cached decrypted bytes, if hydrateForFingerprint()/decryptHydrate() has
+     *  already run for this stamp this session. Undefined otherwise, or after
+     *  a lock. */
+    get decryptedBytes(): Uint8Array | undefined;
+    /** Accepts a full MajikKey OR a bare {fingerprint, mlKemSecretKey} —
+     *  matches MajikFile's own MajikFileDecryptIdentity shape. */
+    decryptContent(identity: MajikFileDecryptIdentity): Promise<Uint8Array>;
 }

package/dist/core/stamp/majik-signature-stamp.js

@@ -9,6 +9,8 @@ export class MajikSignatureStamp {
     _sizeBytes;
     _fingerprint;
     _timestamp;
+    _fileJson;
+    _file = null; // reconstructed lazily, cached per instance
     _lastUpdate;
     _encryptedBinary; // the .mjkb bytes — never the plaintext
     constructor(json, binary) {
@@ -21,6 +23,7 @@ export class MajikSignatureStamp {
         this._timestamp = json.timestamp;
         this._lastUpdate = json.lastUpdate;
         this._encryptedBinary = binary;
+        this._fileJson = json.fileJson;
     }
     get id() {
         return this._id;
@@ -77,8 +80,11 @@ export class MajikSignatureStamp {
             data: arrayToBase64(binary),
             timestamp: fileJson.timestamp ?? now,
             lastUpdate: fileJson.last_update ?? now,
+            fileJson,
         };
-        return new MajikSignatureStamp(json, binary);
+        const instance = new MajikSignatureStamp(json, binary);
+        instance._file = file; // reuse — already fully constructed, no need to refetch
+        return instance;
     }
     /** Plaintext-only rename — no re-encryption, no MajikFile involvement. */
     rename(newName) {
@@ -87,7 +93,6 @@ export class MajikSignatureStamp {
         this._name = newName.trim();
         this._lastUpdate = new Date().toISOString();
     }
-    // ── SERIALISATION ───────────────────────────────────────────────────────
     toJSON() {
         return {
             id: this._id,
@@ -99,21 +104,28 @@ export class MajikSignatureStamp {
             data: arrayToBase64(this._encryptedBinary),
             timestamp: this._timestamp,
             lastUpdate: this._lastUpdate,
+            fileJson: this._fileJson,
         };
     }
     static fromJSON(json) {
         return new MajikSignatureStamp(json, base64ToUint8Array(json.data));
     }
-    // ── DECRYPT ─────────────────────────────────────────────────────────────
-    /** Decrypt and return the raw plaintext content bytes (image/audio/video/text). */
-    async decryptContent(identity) {
-        if (this._fingerprint !== identity.fingerprint) {
-            throw new Error(`decryptContent: stamp was encrypted under fingerprint "${this._fingerprint}", ` +
-                `but the provided identity has fingerprint "${identity.fingerprint}"`);
+    /** Reconstruct (or return the cached) MajikFile backing this stamp. */
+    toMajikFile() {
+        if (!this._file) {
+            this._file = MajikFile.fromJSON(this._fileJson, this._encryptedBinary);
         }
-        return MajikFile.decrypt(this._encryptedBinary, identity);
+        return this._file;
+    }
+    /** Cached decrypted bytes, if hydrateForFingerprint()/decryptHydrate() has
+     *  already run for this stamp this session. Undefined otherwise, or after
+     *  a lock. */
+    get decryptedBytes() {
+        return this._file?.hasDecryptedFile ? this._file.decryptedFile : undefined;
     }
-    toBinaryBytes() {
-        return this._encryptedBinary;
+    /** Accepts a full MajikKey OR a bare {fingerprint, mlKemSecretKey} —
+     *  matches MajikFile's own MajikFileDecryptIdentity shape. */
+    async decryptContent(identity) {
+        return MajikFile.decrypt(this._encryptedBinary, identity);
     }
 }

package/dist/index.d.ts

@@ -7,6 +7,7 @@ export * from "./core/crypto/constants";
 export * from "./core/crypto/keystore-manager";
 export * from "./core/storage";
 export * from "./core/stamp/majik-signature-stamp";
+export { DEFAULT_USER_APP_PREFERENCES } from "./core/client-state-manager";
 export * from "./core/utils/utilities";
 export * from "./core/identity";
 export { migrateMajikMessageJSON } from "./core/contacts/majik-contact-migration";

package/dist/index.js

@@ -6,6 +6,7 @@ export * from "./core/crypto/constants";
 export * from "./core/crypto/keystore-manager";
 export * from "./core/storage";
 export * from "./core/stamp/majik-signature-stamp";
+export { DEFAULT_USER_APP_PREFERENCES } from "./core/client-state-manager";
 export * from "./core/utils/utilities";
 export * from "./core/identity";
 export { migrateMajikMessageJSON } from "./core/contacts/majik-contact-migration";

package/dist/majik-signature-client.d.ts

@@ -132,6 +132,8 @@ export declare class MajikSignatureClient {
     resetUserAppPreferences(): Promise<void>;
     isAnalyticsEnabled(): Promise<boolean>;
     isAutoSealEnabled(): Promise<boolean>;
+    isAutoLockOnMinimizeEnabled(): Promise<boolean>;
+    autoLockInterval(): Promise<number | undefined>;
     generateMnemonic(strength?: 128 | 256, language?: MnemonicLanguage): Promise<string>;
     createAccount(mnemonic: string, passphrase: string, label?: string): Promise<{
         id: string;
@@ -836,6 +838,10 @@ export declare class MajikSignatureClient {
         accountId?: string;
     }): Promise<MajikSignatureStamp>;
     listStamps(kind?: StampAssetKind): MajikSignatureStamp[];
+    hydrateStampsForActiveAccount(): Promise<void>;
+    lockStamps(): void;
+    getDecryptedStampBytes(id: string): Uint8Array | undefined;
+    listStampsForActiveAccount(kind?: StampAssetKind): MajikSignatureStamp[];
     getStamp(id: string): Promise<MajikSignatureStamp | null>;
     decryptStampContent(id: string, accountId?: string): Promise<Uint8Array>;
     renameStamp(id: string, newName: string): Promise<MajikSignatureStamp>;

package/dist/majik-signature-client.js

@@ -200,6 +200,14 @@ export class MajikSignatureClient {
         const appPreferences = await this._state.getUserAppPreferences();
         return appPreferences.signing.autoSeal ?? false;
     }
+    async isAutoLockOnMinimizeEnabled() {
+        const appPreferences = await this._state.getUserAppPreferences();
+        return appPreferences.security?.key?.autoLockOnMinimize ?? false;
+    }
+    async autoLockInterval() {
+        const appPreferences = await this._state.getUserAppPreferences();
+        return appPreferences.security?.key?.autoLockInterval;
+    }
     // ==========================================================================
     // ── ACCOUNT MANAGEMENT ────────────────────────────────────────────────────
     // ==========================================================================
@@ -1312,7 +1320,7 @@ export class MajikSignatureClient {
      */
     async stripSignature(file, options) {
         try {
-            return MajikSignature.stripFrom(file, options);
+            return await MajikSignature.stripFrom(file, options);
         }
         catch (err) {
             this._emit("error", err, { context: "stripSignature" });
@@ -1675,6 +1683,31 @@ export class MajikSignatureClient {
     listStamps(kind) {
         return kind ? this._stamps.listByKind(kind) : this._stamps.list();
     }
+    async hydrateStampsForActiveAccount() {
+        const id = this.getActiveAccount()?.id;
+        if (!id)
+            throw new Error("No active account — call setActiveAccount() first");
+        const key = this._keys.get(id);
+        if (!key)
+            throw new Error(`Account not found in keystore: "${id}"`);
+        if (key.isLocked) {
+            throw new Error(`Account "${id}" is locked. Call unlockAccount() before hydrating stamps.`);
+        }
+        await this._stamps.hydrateForFingerprint(key.fingerprint, key); // pass key directly, no identity-builder needed
+    }
+    lockStamps() {
+        this._stamps.lockAll();
+    }
+    getDecryptedStampBytes(id) {
+        return this._stamps.get(id)?.decryptedBytes;
+    }
+    listStampsForActiveAccount(kind) {
+        const key = this.getActiveAccountKey();
+        if (!key)
+            return [];
+        const all = kind ? this._stamps.listByKind(kind) : this._stamps.list();
+        return all.filter((s) => s.fingerprint === key.fingerprint);
+    }
     async getStamp(id) {
         return this._stamps.load(id);
     }

package/package.json

@@ -2,7 +2,7 @@
   "name": "@majikah/majik-signature-client",
   "type": "module",
   "description": "Majik Signature Client is a hybrid post-quantum content signing and verification library for the Majikah ecosystem. Built on top of Majik Key, it provides tamper-proof, forgery-resistant digital signatures for any content format — using a dual-algorithm architecture that combines classical Ed25519 with post-quantum ML-DSA-87 (FIPS-204).",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "license": "Apache-2.0",
   "author": "Zelijah",
   "main": "./dist/index.js",
@@ -43,7 +43,7 @@
     "url": "https://github.com/Majikah/majik-signature-client/issues"
   },
   "scripts": {
-    "update": "npm install @majikah/majik-key@latest @majikah/majik-signature@latest @majikah/majik-contact@latest",
+    "update": "npm install @majikah/majik-key@latest @majikah/majik-signature@latest @majikah/majik-contact@latest @majikah/majik-file@latest",
     "build": "tsc",
     "typecheck": "tsc --noEmit",
     "prepublishOnly": "npm run build",
@@ -54,7 +54,7 @@
   "dependencies": {
     "@majikah/majik-cjson": "^0.0.3",
     "@majikah/majik-contact": "^0.0.6",
-    "@majikah/majik-file": "^0.1.7",
+    "@majikah/majik-file": "^0.1.8",
     "@majikah/majik-key": "^0.2.12",
     "@majikah/majik-signature": "^0.0.30",
     "@stablelib/ed25519": "^2.1.0",