@majikah/majik-signature-client 1.0.0 → 1.0.2

package/dist/majik-signature-client.d.ts

@@ -207,6 +207,7 @@ export declare class MajikSignatureClient extends MajikKeyClient<MajikContact, M
     private _history;
     /** User activity log manager used for non-blocking activity records. */
     private _activity;
+    private _signingSessionDepth;
     /**
      * Creates a Majik Signature client with the supplied managers and storage adapters.
      *
@@ -967,6 +968,7 @@ export declare class MajikSignatureClient extends MajikKeyClient<MajikContact, M
         priorSignedFile?: Blob;
         /** Optional note attached to this specific revision. */
         message?: string;
+        saveHistory?: boolean;
     }, source?: HistorySource): Promise<Awaited<ReturnType<typeof MajikSignature.signFile>>>;
     /**
      * Sign a file with a detached signature envelope.
@@ -1006,8 +1008,15 @@ export declare class MajikSignatureClient extends MajikKeyClient<MajikContact, M
         timestamp?: string;
         mimeType?: string;
         validUntil?: string;
+        /** Pre-stamp original, when the current file's embedded envelope was
+         *  destroyed by a wholesale re-encode (PDF flatten, image re-render,
+         *  audio re-mux). Lets the prior signature chain be recovered. */
+        priorSignedFile?: Blob;
     }>, options?: {
         accountId?: string;
+        expectedSigners?: ExpectedSigner[];
+        /** Optional note attached to this specific revision. */
+        message?: string;
     }, source?: HistorySource): Promise<Array<{
         blob: Blob | null;
         signature: MajikSignature | null;
@@ -1377,6 +1386,7 @@ export declare class MajikSignatureClient extends MajikKeyClient<MajikContact, M
         mimeType?: string;
         timestamp?: string;
         accountId?: string;
+        saveHistory?: boolean;
     }, source?: HistorySource): Promise<Awaited<ReturnType<typeof MajikSignature.seal>>>;
     /**
      * Verify the seal hash against the current signatories and seal timestamp.
@@ -1695,6 +1705,13 @@ export declare class MajikSignatureClient extends MajikKeyClient<MajikContact, M
      * @throws {Error} When validation fails, required local data is unavailable, or the underlying operation cannot be completed.
      */
     private _withSigningKey;
+    /**
+     * Unlock once, run `fn` (which may call signFile/seal/etc. any number of
+     * times), then re-lock once at the end if one-time unlock is disabled.
+     */
+    withSigningSession<T>(accountId: string | undefined, fn: () => Promise<T>): Promise<T>;
+    get isSigningSessionActive(): boolean;
+    forceEndSigningSession(): void;
     /**
      * Computes a SHA-256 digest and encodes it as base64.
      * @param bytes - Value used by the _sha256 base64 operation.

package/dist/majik-signature-client.js

@@ -70,6 +70,7 @@ export class MajikSignatureClient extends MajikKeyClient {
     _history;
     /** User activity log manager used for non-blocking activity records. */
     _activity;
+    _signingSessionDepth = 0;
     /**
      * Creates a Majik Signature client with the supplied managers and storage adapters.
      *
@@ -1439,6 +1440,7 @@ export class MajikSignatureClient extends MajikKeyClient {
                 message: options?.message,
             });
             const signedBytes = new Uint8Array(await signedResponse.blob.arrayBuffer());
+            const recordHistory = options?.saveHistory ?? true;
             this._recordHistory(key.fingerprint, {
                 reference_id: signedResponse.signature.contentHash,
                 historyType: HistoryTypes.SIGN,
@@ -1450,8 +1452,8 @@ export class MajikSignatureClient extends MajikKeyClient {
                     sealed: false,
                     tsa: false,
                 },
-                signerCount: 1,
-                data: signedBytes,
+                signerCount: signedResponse.envelope.signatures.length,
+                data: recordHistory ? signedBytes : undefined,
                 identity: this._identityFromKey(key),
             }).catch((err) => console.warn(err));
             return signedResponse;
@@ -1510,13 +1512,16 @@ export class MajikSignatureClient extends MajikKeyClient {
      * @returns The result of the batch sign files operation (`Promise< Array<{ blob: Blob | null; signature: MajikSignature | null; serialized: string | null; handler: string | null; mimeType: string | null; error: Error | null; }> >`).
      */
     async batchSignFiles(files, options, source = HistorySources.SYSTEM) {
-        return this._withSigningKey(options?.accountId, "batchSignFiles", (key) => Promise.all(files.map(async ({ file, contentType, timestamp, mimeType, validUntil }) => {
+        return this._withSigningKey(options?.accountId, "batchSignFiles", (key) => Promise.all(files.map(async ({ file, contentType, timestamp, mimeType, validUntil, priorSignedFile, }) => {
             try {
                 const result = await MajikSignature.signFile(file, key, {
                     contentType,
                     timestamp,
                     mimeType,
                     validUntil,
+                    priorSignedFile,
+                    expectedSigners: options?.expectedSigners,
+                    message: options?.message,
                 });
                 this._recordHistory(key.fingerprint, {
                     reference_id: result.signature.contentHash,
@@ -2317,6 +2322,7 @@ export class MajikSignatureClient extends MajikKeyClient {
                 timestamp: options?.timestamp,
             });
             const sealedBytes = new Uint8Array(await sealResult.blob.arrayBuffer());
+            const recordHistory = options?.saveHistory ?? true;
             this._recordHistory(key.fingerprint, {
                 reference_id: sealResult.sealInfo.sealHash,
                 historyType: HistoryTypes.SEAL,
@@ -2328,7 +2334,7 @@ export class MajikSignatureClient extends MajikKeyClient {
                     sealed: true,
                     tsa: false,
                 },
-                data: sealedBytes,
+                data: recordHistory ? sealedBytes : undefined,
                 identity: this._identityFromKey(key),
             }).catch((err) => console.warn(err));
             return sealResult;
@@ -3065,7 +3071,9 @@ export class MajikSignatureClient extends MajikKeyClient {
                 throw new Error(`Account "${id}" has no signing keys. ` +
                     `Re-import via importAccountFromMnemonicBackup() to enable signing.`);
             }
-            shouldRelock = !(await this.isOnetimeUnlockEnabled());
+            shouldRelock =
+                this._signingSessionDepth === 0 &&
+                    !(await this.isOnetimeUnlockEnabled());
             return await fn(key);
         }
         catch (err) {
@@ -3077,6 +3085,42 @@ export class MajikSignatureClient extends MajikKeyClient {
                 key?.lock();
         }
     }
+    /**
+     * Unlock once, run `fn` (which may call signFile/seal/etc. any number of
+     * times), then re-lock once at the end if one-time unlock is disabled.
+     */
+    async withSigningSession(accountId, fn) {
+        const id = accountId ?? this.getActiveAccount()?.id;
+        if (!id)
+            throw new Error("No active account — call setActiveAccount() first");
+        await this._keys.ensureUnlocked(id);
+        this._signingSessionDepth++;
+        try {
+            return await fn();
+        }
+        finally {
+            this._signingSessionDepth = Math.max(0, this._signingSessionDepth - 1);
+            if (this._signingSessionDepth === 0) {
+                try {
+                    if (!(await this.isOnetimeUnlockEnabled())) {
+                        this._keys.get(id)?.lock();
+                    }
+                }
+                catch (err) {
+                    // Fail closed: if we can't read the preference, lock anyway.
+                    this._keys.get(id)?.lock();
+                    console.warn("withSigningSession: relock check failed", err);
+                }
+            }
+        }
+    }
+    get isSigningSessionActive() {
+        return this._signingSessionDepth > 0;
+    }
+    forceEndSigningSession() {
+        this._signingSessionDepth = 0;
+        return;
+    }
     /**
      * Computes a SHA-256 digest and encodes it as base64.
      * @param bytes - Value used by the _sha256 base64 operation.

package/package.json

@@ -2,7 +2,7 @@
   "name": "@majikah/majik-signature-client",
   "type": "module",
   "description": "Majik Signature Client is a hybrid post-quantum content signing and verification library for the Majikah ecosystem. Built on top of Majik Key Client, it provides tamper-proof, forgery-resistant digital signatures for any content format — using a dual-algorithm architecture that combines classical Ed25519 with post-quantum ML-DSA-87 (FIPS-204).",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "license": "Apache-2.0",
   "author": "Zelijah",
   "main": "./dist/index.js",