@majikah/majik-signature 0.0.13 → 0.0.15

package/dist/core/embed/majik-embed.js

@@ -112,11 +112,15 @@ export class MajikSignatureEmbed {
         if (envelope.sealHash) {
             throw new MajikSignatureError("Cannot sign a sealed envelope. The issuer has locked this file against further signatures.");
         }
-        // ── Step 3: Allowlist enforcement ──────────────────────────────────────
-        const allowlistCheck = checkAllowlist(envelope, key);
-        if (!allowlistCheck.permitted) {
-            throw new MajikSignatureAllowlistError(`Signer "${key.fingerprint}" is not permitted to sign this file. ` +
-                `The file has a signing allowlist established by "${envelope.allowlistSignerId}".`, key.fingerprint);
+        // ── Step 3: Allowlist enforcement ──────────────────────────────────────────
+        // Issuer always bypasses the allowlist — they established it and control sealing
+        const isIssuer = envelope.allowlistSignerId === key.fingerprint;
+        if (!isIssuer) {
+            const allowlistCheck = checkAllowlist(envelope, key);
+            if (!allowlistCheck.permitted) {
+                throw new MajikSignatureAllowlistError(`Signer "${key.fingerprint}" is not permitted to sign this file. ` +
+                    `The file has a signing allowlist established by "${envelope.allowlistSignerId}".`, key.fingerprint);
+            }
         }
         // ── Step 4: Get clean original bytes ───────────────────────────────────
         const originalBytes = await handler.strip(bytes);
@@ -289,10 +293,13 @@ export class MajikSignatureEmbed {
         //     "Cannot seal an open-signing file. Sealing is only available for files with an allowlist.",
         //   );
         // }
-        // Only the issuer may seal
-        if (key.fingerprint !== envelope.allowlistSignerId) {
-            throw new MajikSignatureKeyError(`Only the issuer ("${envelope.allowlistSignerId}") may seal this file. ` +
-                `Provided key fingerprint: "${key.fingerprint}".`);
+        // Must be a restricted multi-sig file (has an allowlist)
+        if (!!envelope.allowlist && !!envelope.allowlistSignerId?.trim()) {
+            // Only the issuer may seal
+            if (key.fingerprint !== envelope.allowlistSignerId) {
+                throw new MajikSignatureKeyError(`Only the issuer ("${envelope.allowlistSignerId}") may seal this file. ` +
+                    `Provided key fingerprint: "${key.fingerprint}".`);
+            }
         }
         // Already sealed
         if (envelope.sealHash) {
@@ -428,6 +435,10 @@ export class MajikSignatureEmbed {
         if (!envelope.allowlist || envelope.allowlist.length === 0) {
             return { permitted: true };
         }
+        // Issuer bypass — always permitted regardless of allowlist membership
+        if (envelope.allowlistSignerId === key.fingerprint) {
+            return { permitted: true };
+        }
         // Allowlist present — check all three fields
         const check = checkAllowlist(envelope, key);
         if (!check.permitted) {

package/package.json

@@ -2,7 +2,7 @@
   "name": "@majikah/majik-signature",
   "type": "module",
   "description": "Majik Signature is a hybrid post-quantum content signing and verification library for the Majikah ecosystem. Built on top of Majik Key, it provides tamper-proof, forgery-resistant digital signatures for any content format — using a dual-algorithm architecture that combines classical Ed25519 with post-quantum ML-DSA-87 (FIPS-204).",
-  "version": "0.0.13",
+  "version": "0.0.15",
   "license": "Apache-2.0",
   "author": "Zelijah",
   "main": "./dist/index.js",