@majikah/majik-signature 0.0.2 → 0.0.4

package/dist/core/embed/majik-embed.d.ts

@@ -63,7 +63,7 @@ export declare class MajikSignatureEmbed {
      */
     static verify(file: Blob, publicKeys: MajikSignerPublicKeys, MajikSig: MajikSignatureStaticAdapter, options?: ExtractOptions & {
         expectedSignerId?: string;
-    }): Promise<EmbedVerifyResult>;
+    }, debug?: boolean): Promise<EmbedVerifyResult>;
     /**
      * Verify using a MajikKey instance instead of raw public keys.
      * Called from MajikSignature.verifyFile() — MajikSig passed to avoid

package/dist/core/embed/majik-embed.js

@@ -28,6 +28,7 @@ import { MkvHandler } from "./handlers/mkv";
 import { OfficeHandler } from "./handlers/office";
 import { TextHandler } from "./handlers/text";
 import { FallbackHandler } from "./fallback";
+import { bytesToBase64, hashContent } from "../hash";
 // ─── Registry ─────────────────────────────────────────────────────────────────
 const DEFAULT_REGISTRY = new FormatHandlerRegistry()
     .register(new PdfHandler())
@@ -105,12 +106,14 @@ export class MajikSignatureEmbed {
      * Requires the MajikSignature static class passed in as `MajikSig` to
      * avoid a circular import. Called from MajikSignature.verifyFile().
      */
-    static async verify(file, publicKeys, MajikSig, options) {
+    static async verify(file, publicKeys, MajikSig, options, debug = false) {
         const bytes = await blobToBytes(file);
         const mimeType = options?.mimeType ?? detectMimeType(bytes, file.type);
         const handler = DEFAULT_REGISTRY.resolve(bytes, mimeType);
         const signatureJson = await handler.extract(bytes);
         if (!signatureJson) {
+            if (debug)
+                console.error("No embedded signature found");
             return {
                 valid: false,
                 reason: "No embedded signature found",
@@ -129,6 +132,12 @@ export class MajikSignatureEmbed {
             };
         }
         const originalBytes = await handler.strip(bytes);
+        if (debug) {
+            const recomputedHash = bytesToBase64(hashContent(originalBytes));
+            console.log("Verify-side hash:", recomputedHash);
+            console.log("Embedded hash:  ", parsedSig.contentHash);
+            console.log("match:", recomputedHash === parsedSig.contentHash);
+        }
         if (options?.expectedSignerId &&
             parsedSig.signerId !== options.expectedSignerId) {
             return {

package/dist/majik-signature.d.ts

@@ -49,7 +49,7 @@ export declare class MajikSignature {
      * @param options   - Optional content type label and timestamp override
      * @returns         - MajikSignature instance (ready to serialize)
      */
-    static sign(content: Uint8Array | string, key: MajikKey, options?: SignOptions): Promise<MajikSignature>;
+    static sign(content: Uint8Array | string, key: MajikKey, options?: SignOptions, debug?: boolean): Promise<MajikSignature>;
     /**
      * Verify a MajikSignature against content and the signer's public keys.
      *

package/dist/majik-signature.js

@@ -86,7 +86,7 @@ export class MajikSignature {
      * @param options   - Optional content type label and timestamp override
      * @returns         - MajikSignature instance (ready to serialize)
      */
-    static async sign(content, key, options) {
+    static async sign(content, key, options, debug = false) {
         try {
             // ── Input validation ──
             MajikSignatureValidator.validateContent(content);
@@ -116,10 +116,21 @@ export class MajikSignature {
                 contentHash,
                 contentType,
             });
+            if (debug) {
+                console.log("Signing Payload:", payload);
+            }
             // ── Sign with Ed25519 ──
             const edSigBytes = ed25519.sign(edSecretKey, payload);
+            if (debug) {
+                console.log("mlDsaSecretKey type:", mlDsaSecretKey?.constructor?.name);
+                console.log("mlDsaSecretKey length:", mlDsaSecretKey?.length);
+                console.log("mlDsaSecretKey byteLength:", mlDsaSecretKey?.byteLength);
+                console.log("mlDsaSecretKey byteOffset:", mlDsaSecretKey?.byteOffset);
+                console.log("mlDsaSecretKey buffer.byteLength:", mlDsaSecretKey?.buffer?.byteLength);
+                console.log("is Uint8Array:", mlDsaSecretKey instanceof Uint8Array);
+            }
             // ── Sign with ML-DSA-87 ──
-            const mlDsaSigBytes = ml_dsa87.sign(mlDsaSecretKey, payload);
+            const mlDsaSigBytes = ml_dsa87.sign(payload, mlDsaSecretKey);
             // ── Assemble envelope ──
             const envelope = {
                 version: MAJIK_SIGNATURE_VERSION,
@@ -135,6 +146,9 @@ export class MajikSignature {
             return new MajikSignature(envelope);
         }
         catch (err) {
+            if (debug) {
+                console.error("Raw Signing Error:", err);
+            }
             if (err instanceof MajikSignatureError)
                 throw err;
             throw new MajikSignatureError("Failed to sign content", err);
@@ -191,7 +205,9 @@ export class MajikSignature {
             // ── Step 4: Verify ML-DSA-87 ──
             let mlDsaOk;
             try {
-                mlDsaOk = ml_dsa87.verify(publicKeys.mlDsaPublicKey, payload, base64ToBytes(env.mlDsaSignature));
+                mlDsaOk = ml_dsa87.verify(base64ToBytes(env.mlDsaSignature), // sig
+                payload, // msg
+                publicKeys.mlDsaPublicKey);
             }
             catch {
                 return invalid();

package/package.json

@@ -2,7 +2,7 @@
   "name": "@majikah/majik-signature",
   "type": "module",
   "description": "Majik Signature is a hybrid post-quantum content signing and verification library for the Majikah ecosystem. Built on top of Majik Key, it provides tamper-proof, forgery-resistant digital signatures for any content format — using a dual-algorithm architecture that combines classical Ed25519 with post-quantum ML-DSA-87 (FIPS-204).",
-  "version": "0.0.2",
+  "version": "0.0.4",
   "license": "Apache-2.0",
   "author": "Zelijah",
   "main": "./dist/index.js",
@@ -48,7 +48,7 @@
     "prepublishOnly": "npm run build"
   },
   "dependencies": {
-    "@majikah/majik-key": "^0.2.0",
+    "@majikah/majik-key": "^0.2.1",
     "@noble/post-quantum": "^0.5.4",
     "@stablelib/ed25519": "^2.0.2",
     "@stablelib/sha256": "^2.0.1",