@majikah/majik-signature-client 0.6.1 → 0.6.2

package/dist/majik-signature-client.d.ts

@@ -218,16 +218,6 @@ export declare class MajikSignatureClient {
     getBlockedContacts(): MajikContact[];
     clearDirectory(): Promise<this>;
     resolveSignerLabel(signerId: string): string;
-    /**
-     * Sign content with the active account.
-     *
-     * The active account must be unlocked and have signing keys.
-     * Use unlockAccount() first if needed.
-     *
-     * @param content     - Raw bytes or UTF-8 string to sign
-     * @param options     - Optional content type and timestamp override
-     * @param accountId   - Override which account signs. Defaults to active account.
-     */
     sign(content: Uint8Array | string, options?: SignOptions, accountId?: string): Promise<SignResult>;
     /**
      * Sign content and immediately serialize to a base64 string.
@@ -451,12 +441,7 @@ export declare class MajikSignatureClient {
         mimeType?: string;
         accountId?: string;
         expectedSigners?: ExpectedSigner[];
-    }): Promise<{
-        blob: Blob;
-        signature: MajikSignature;
-        handler: string;
-        mimeType: string;
-    }>;
+    }): Promise<ReturnType<typeof MajikSignature.signFile>>;
     /**
      * Sign multiple file blobs with the active (or specified) account in one call.
      *
@@ -646,12 +631,7 @@ export declare class MajikSignatureClient {
         timestamp?: string;
         mimeType?: string;
         accountId?: string;
-    }): Promise<{
-        blob: Blob;
-        signature: MajikSignature;
-        handler: string;
-        mimeType: string;
-    }>;
+    }): Promise<ReturnType<typeof MajikSignature.signFile>>;
     /**
      * Extract metadata from a file's embedded signature without verifying it.
      *
@@ -708,10 +688,7 @@ export declare class MajikSignatureClient {
      */
     canSign(file: Blob, key: MajikKey, options?: {
         mimeType?: string;
-    }): Promise<{
-        permitted: boolean;
-        reason?: string;
-    }>;
+    }): Promise<ReturnType<typeof MajikSignature.canSign>>;
     /**
      * Returns true when the file has a restricted multi-sig envelope
      * (allowlist with more than one expected signer).
@@ -803,12 +780,7 @@ export declare class MajikSignatureClient {
         mimeType?: string;
         timestamp?: string;
         accountId?: string;
-    }): Promise<{
-        blob: Blob;
-        sealInfo: SealInfo;
-        handler: string;
-        mimeType: string;
-    }>;
+    }): Promise<ReturnType<typeof MajikSignature.seal>>;
     /**
      * Verify the seal hash against the current signatories and seal timestamp.
      * Returns invalid if the envelope is not sealed.

package/dist/majik-signature-client.js

@@ -631,31 +631,22 @@ export class MajikSignatureClient {
         return `${signerId.slice(0, 16)}…`;
     }
     // ── Signing ───────────────────────────────────────────────────────────────
-    /**
-     * Sign content with the active account.
-     *
-     * The active account must be unlocked and have signing keys.
-     * Use unlockAccount() first if needed.
-     *
-     * @param content     - Raw bytes or UTF-8 string to sign
-     * @param options     - Optional content type and timestamp override
-     * @param accountId   - Override which account signs. Defaults to active account.
-     */
     async sign(content, options, accountId) {
+        const id = accountId ?? this.getActiveAccount()?.id;
+        if (!id)
+            throw new Error("No active account — call setActiveAccount() first");
+        let key;
+        let shouldRelock = false;
         try {
-            const id = accountId ?? this.getActiveAccount()?.id;
-            if (!id)
-                throw new Error("No active account — call setActiveAccount() first");
-            const key = this._keys.get(id);
+            await this._keys.ensureUnlocked(id);
+            key = this._keys.get(id);
             if (!key)
                 throw new Error(`Account not found in keystore: "${id}"`);
-            if (key.isLocked) {
-                throw new Error(`Account "${id}" is locked. Call unlockAccount() before signing.`);
-            }
             if (!key.hasSigningKeys) {
                 throw new Error(`Account "${id}" has no signing keys. ` +
                     `Re-import via importAccountFromMnemonicBackup() to enable signing.`);
             }
+            shouldRelock = !(await this.isOnetimeUnlockEnabled());
             const signature = await MajikSignature.sign(content, key, options);
             const result = {
                 signature,
@@ -671,6 +662,10 @@ export class MajikSignatureClient {
             this._emit("error", err, { context: "sign" });
             throw err;
         }
+        finally {
+            if (shouldRelock)
+                key?.lock();
+        }
     }
     /**
      * Sign content and immediately serialize to a base64 string.
@@ -1017,16 +1012,19 @@ export class MajikSignatureClient {
         const id = options?.accountId ?? this.getActiveAccount()?.id;
         if (!id)
             throw new Error("No active account — call setActiveAccount() first");
+        let key;
+        let shouldRelock = false;
         try {
             await this._keys.ensureUnlocked(id);
-            const key = this._keys.get(id);
+            key = this._keys.get(id);
             if (!key)
                 throw new Error(`Account not found in keystore: "${id}"`);
             if (!key.hasSigningKeys) {
                 throw new Error(`Account "${id}" has no signing keys. ` +
                     `Re-import via importAccountFromMnemonicBackup() to enable signing.`);
             }
-            return MajikSignature.sign(content, key, {
+            shouldRelock = !(await this.isOnetimeUnlockEnabled());
+            return await MajikSignature.sign(content, key, {
                 contentType: options?.contentType,
                 timestamp: options?.timestamp,
             });
@@ -1035,6 +1033,10 @@ export class MajikSignatureClient {
             this._emit("error", err, { context: "signContent" });
             throw err;
         }
+        finally {
+            if (shouldRelock)
+                key?.lock();
+        }
     }
     /**
      * Sign a file and embed the signature directly into it using the active account.
@@ -1054,26 +1056,34 @@ export class MajikSignatureClient {
         const id = options?.accountId ?? this.getActiveAccount()?.id;
         if (!id)
             throw new Error("No active account — call setActiveAccount() first");
+        let key;
+        let shouldRelock = false;
         try {
             await this._keys.ensureUnlocked(id);
-            const key = this._keys.get(id);
+            key = this._keys.get(id);
             if (!key)
                 throw new Error(`Account not found in keystore: "${id}"`);
             if (!key.hasSigningKeys) {
                 throw new Error(`Account "${id}" has no signing keys. ` +
                     `Re-import via importAccountFromMnemonicBackup() to enable signing.`);
             }
-            return MajikSignature.signFile(file, key, {
+            shouldRelock = !(await this.isOnetimeUnlockEnabled());
+            const signedResponse = await MajikSignature.signFile(file, key, {
                 contentType: options?.contentType,
                 timestamp: options?.timestamp,
                 mimeType: options?.mimeType,
                 expectedSigners: options?.expectedSigners,
             });
+            return signedResponse;
         }
         catch (err) {
             this._emit("error", err, { context: "signFile" });
             throw err;
         }
+        finally {
+            if (shouldRelock)
+                key?.lock();
+        }
     }
     /**
      * Sign multiple file blobs with the active (or specified) account in one call.
@@ -1622,11 +1632,19 @@ export class MajikSignatureClient {
         const id = options?.accountId ?? this.getActiveAccount()?.id;
         if (!id)
             throw new Error("No active account — call setActiveAccount() first");
+        let key;
+        let shouldRelock = false;
         try {
-            const key = this._keys.get(id);
+            await this._keys.ensureUnlocked(id);
+            key = this._keys.get(id);
             if (!key)
                 throw new Error(`Account not found in keystore: "${id}"`);
-            return MajikSignature.seal(file, key, {
+            if (!key.hasSigningKeys) {
+                throw new Error(`Account "${id}" has no signing keys. ` +
+                    `Re-import via importAccountFromMnemonicBackup() to enable signing.`);
+            }
+            shouldRelock = !(await this.isOnetimeUnlockEnabled());
+            return await MajikSignature.seal(file, key, {
                 mimeType: options?.mimeType,
                 timestamp: options?.timestamp,
             });
@@ -1635,6 +1653,10 @@ export class MajikSignatureClient {
             this._emit("error", err, { context: "seal" });
             throw err;
         }
+        finally {
+            if (shouldRelock)
+                key?.lock();
+        }
     }
     /**
      * Verify the seal hash against the current signatories and seal timestamp.

package/package.json

@@ -2,7 +2,7 @@
   "name": "@majikah/majik-signature-client",
   "type": "module",
   "description": "Majik Signature Client is a hybrid post-quantum content signing and verification library for the Majikah ecosystem. Built on top of Majik Key, it provides tamper-proof, forgery-resistant digital signatures for any content format — using a dual-algorithm architecture that combines classical Ed25519 with post-quantum ML-DSA-87 (FIPS-204).",
-  "version": "0.6.1",
+  "version": "0.6.2",
   "license": "Apache-2.0",
   "author": "Zelijah",
   "main": "./dist/index.js",