@majikah/majik-signature 0.2.0 → 0.2.2

package/dist/core/embed/handlers/mp4.js

@@ -42,58 +42,58 @@ export class Mp4Handler {
     async embed(bytes, signatureJson) {
         const clean = await this.strip(bytes);
         const majkBox = this._buildBox(MP4_BOX_TYPE, textEncode(signatureJson));
-        const boxes = this._parseBoxes(clean, 0, clean.length);
+        const { boxes, trailing: topTrailing } = this._parseBoxes(clean, 0, clean.length);
         const moovIdx = boxes.findIndex((b) => b.type === "moov");
         if (moovIdx < 0) {
-            // No moov box — use trailer fallback
             const { appendTrailer } = await import("../utils");
             return appendTrailer(clean, signatureJson);
         }
         const moovBox = boxes[moovIdx];
-        const moovChildren = this._parseBoxes(moovBox.data, 0, moovBox.data.length);
+        const { boxes: moovChildren, trailing: moovTrailing } = this._parseBoxes(moovBox.data, 0, moovBox.data.length);
         const udtaIdx = moovChildren.findIndex((b) => b.type === "udta");
-        let newUdta;
+        const { boxes: existingUdtaChildren, trailing: udtaTrailing } = udtaIdx >= 0
+            ? this._parseBoxes(moovChildren[udtaIdx].data, 0, moovChildren[udtaIdx].data.length)
+            : { boxes: [], trailing: new Uint8Array(0) };
+        const newUdta = this._buildBox("udta", concatBytes(...existingUdtaChildren.map((b) => b.raw), majkBox, // ← box-aligned, right after real children
+        udtaTrailing));
+        const newMoovChildren = [];
         if (udtaIdx >= 0) {
-            const udtaBox = moovChildren[udtaIdx];
-            // Append majk to udta
-            const newUdtaData = concatBytes(udtaBox.data, majkBox);
-            newUdta = this._buildBox("udta", newUdtaData);
+            // Retain the exact original index of the udta box to avoid byte shifting
+            for (let i = 0; i < moovChildren.length; i++) {
+                newMoovChildren.push(i === udtaIdx ? newUdta : moovChildren[i].raw);
+            }
         }
         else {
-            newUdta = this._buildBox("udta", majkBox);
-        }
-        // Rebuild moov
-        const newMoovChildren = [];
-        for (let i = 0; i < moovChildren.length; i++) {
-            if (i === udtaIdx)
-                continue; // skip old udta (we'll add new one)
-            newMoovChildren.push(moovChildren[i].raw);
+            // If it didn't exist previously, it's safe to append it to the end
+            for (let i = 0; i < moovChildren.length; i++) {
+                newMoovChildren.push(moovChildren[i].raw);
+            }
+            newMoovChildren.push(newUdta);
         }
-        newMoovChildren.push(newUdta);
-        const newMoov = this._buildBox("moov", concatBytes(...newMoovChildren));
-        // Rebuild file
+        const newMoov = this._buildBox("moov", concatBytes(...newMoovChildren, moovTrailing));
         const parts = [];
         for (let i = 0; i < boxes.length; i++) {
-            if (i === moovIdx)
-                parts.push(newMoov);
-            else
-                parts.push(boxes[i].raw);
+            parts.push(i === moovIdx ? newMoov : boxes[i].raw);
         }
-        return concatBytes(...parts);
+        return concatBytes(...parts, topTrailing);
     }
     async extract(bytes) {
         if (!this.canHandle(bytes))
             return null;
         try {
-            const boxes = this._parseBoxes(bytes, 0, bytes.length);
+            const { boxes } = this._parseBoxes(bytes, 0, bytes.length);
             const moov = boxes.find((b) => b.type === "moov");
-            if (!moov)
-                return null;
-            const moovChildren = this._parseBoxes(moov.data, 0, moov.data.length);
+            // Fallback: If no moov box exists, check for a Tier-2 trailer
+            if (!moov) {
+                const { extractTrailer } = await import("../utils");
+                const trailer = extractTrailer(bytes);
+                return trailer ? trailer.signatureJson : null;
+            }
+            const { boxes: moovChildren } = this._parseBoxes(moov.data, 0, moov.data.length);
             const udta = moovChildren.find((b) => b.type === "udta");
             if (!udta)
                 return null;
-            const udtaChildren = this._parseBoxes(udta.data, 0, udta.data.length);
+            const { boxes: udtaChildren } = this._parseBoxes(udta.data, 0, udta.data.length);
             const majk = udtaChildren.find((b) => b.type === MP4_BOX_TYPE);
             if (!majk)
                 return null;
@@ -107,32 +107,36 @@ export class Mp4Handler {
         if (!this.canHandle(bytes))
             return bytes;
         try {
-            const boxes = this._parseBoxes(bytes, 0, bytes.length);
+            const { boxes, trailing: topTrailing } = this._parseBoxes(bytes, 0, bytes.length);
             const moovIdx = boxes.findIndex((b) => b.type === "moov");
-            if (moovIdx < 0)
-                return bytes;
+            // Fallback: If no moov box exists, strip the Tier-2 trailer if present
+            if (moovIdx < 0) {
+                const { extractTrailer } = await import("../utils");
+                const trailer = extractTrailer(bytes);
+                return trailer ? trailer.original : bytes;
+            }
             const moovBox = boxes[moovIdx];
-            const moovChildren = this._parseBoxes(moovBox.data, 0, moovBox.data.length);
+            const { boxes: moovChildren, trailing: moovTrailing } = this._parseBoxes(moovBox.data, 0, moovBox.data.length);
             const udtaIdx = moovChildren.findIndex((b) => b.type === "udta");
             if (udtaIdx < 0)
                 return bytes;
             const udtaBox = moovChildren[udtaIdx];
-            const udtaChildren = this._parseBoxes(udtaBox.data, 0, udtaBox.data.length);
+            const { boxes: udtaChildren, trailing: udtaTrailing } = this._parseBoxes(udtaBox.data, 0, udtaBox.data.length);
             const filteredUdta = udtaChildren.filter((b) => b.type !== MP4_BOX_TYPE);
             let newMoovChildren;
-            if (filteredUdta.length === 0) {
-                // Remove udta entirely
+            // Only remove the udta box entirely if it is completely barren of data and trailing bytes
+            if (filteredUdta.length === 0 && udtaTrailing.length === 0) {
                 newMoovChildren = moovChildren
                     .filter((_, i) => i !== udtaIdx)
                     .map((b) => b.raw);
             }
             else {
-                const newUdta = this._buildBox("udta", concatBytes(...filteredUdta.map((b) => b.raw)));
+                const newUdta = this._buildBox("udta", concatBytes(...filteredUdta.map((b) => b.raw), udtaTrailing));
                 newMoovChildren = moovChildren.map((b, i) => i === udtaIdx ? newUdta : b.raw);
             }
-            const newMoov = this._buildBox("moov", concatBytes(...newMoovChildren));
+            const newMoov = this._buildBox("moov", concatBytes(...newMoovChildren, moovTrailing));
             const parts = boxes.map((b, i) => (i === moovIdx ? newMoov : b.raw));
-            return concatBytes(...parts);
+            return concatBytes(...parts, topTrailing);
         }
         catch {
             return bytes;
@@ -146,14 +150,11 @@ export class Mp4Handler {
             let size = readUint32BE(bytes, offset);
             const type = textDecode(bytes.slice(offset + 4, offset + 8));
             if (size === 1) {
-                // 64-bit extended size (large box)
-                // Read as two 32-bit values
                 const hi = readUint32BE(bytes, offset + 8);
                 const lo = readUint32BE(bytes, offset + 12);
                 size = hi * 0x100000000 + lo;
             }
             else if (size === 0) {
-                // Box extends to end of file
                 size = end - offset;
             }
             if (size < 8 || offset + size > end)
@@ -164,7 +165,10 @@ export class Mp4Handler {
             boxes.push({ type, data, raw });
             offset += size;
         }
-        return boxes;
+        // Anything left over (padding, malformed box, unparseable trailing bytes)
+        // — preserve it verbatim instead of silently dropping it.
+        const trailing = bytes.slice(offset, end);
+        return { boxes, trailing };
     }
     _buildBox(type, data) {
         const size = 8 + data.length;

package/dist/core/embed/majik-embed.d.ts

@@ -20,7 +20,7 @@
  * single-sig files — all code here always operates on MultiSigEnvelope.
  */
 import type { MajikKey } from "@majikah/majik-key";
-import type { EmbedOptions, EmbedResult, EnvelopeInfo, ExpectedSigner, ExtractOptions, ExtractResult, MajikSignatureJSON, MajikSignerPublicKeys, SealInfo, SealVerificationResult, SignatoriesFilter, SignatoriesResult, SignOptions, VerificationResult } from "../../core/types";
+import type { EmbedOptions, EmbedResult, EnvelopeInfo, ExpectedSigner, ExtractOptions, ExtractResult, MajikSignatureEnvelope, MajikSignatureJSON, MajikSignerPublicKeys, SealInfo, SealVerificationResult, SignatoriesFilter, SignatoriesResult, SignOptions, VerificationResult } from "../../core/types";
 import { FormatHandlerRegistry } from "./registry";
 import { MajikChainAnchor } from "../../anchor/types";
 export interface MajikSignatureAdapter {
@@ -63,6 +63,24 @@ export declare class MajikSignatureEmbed {
         expectedSigners?: ExpectedSigner[];
     }, debug?: boolean): Promise<EmbedResult & {
         signature: T;
+        envelope: MajikSignatureEnvelope;
+    }>;
+    /**
+     * Sign a file and return the envelope detached.
+     * Extracts any existing envelope (or uses a provided one), validates constraints,
+     * signs the stripped bytes, and returns the updated MultiSigEnvelope.
+     * Does NOT embed the envelope back into the file.
+     */
+    static signDetached(file: Blob, key: MajikKey, MajikSig: MajikSignatureStaticAdapter, options?: EmbedOptions & {
+        contentType?: string;
+        timestamp?: string;
+        expectedSigners?: ExpectedSigner[];
+        existingEnvelope?: MajikSignatureEnvelope;
+    }, debug?: boolean): Promise<{
+        blob: Blob;
+        envelope: MajikSignatureEnvelope;
+        handler: string;
+        mimeType: string;
     }>;
     /**
      * Extract the MultiSigEnvelope from a file.
@@ -81,6 +99,17 @@ export declare class MajikSignatureEmbed {
     static verifyWithKey(file: Blob, key: MajikKey, MajikSig: MajikSignatureStaticAdapter, options?: ExtractOptions & {
         expectedSignerId?: string;
     }, debug?: boolean): Promise<VerificationResult[]>;
+    /**
+     * Verify a file against a provided, detached MultiSigEnvelope.
+     * Skips extraction but still strips the file in case it contains an embedded envelope,
+     * ensuring verification runs against the clean original bytes.
+     */
+    static verifyDetached(file: Blob, envelope: MajikSignatureEnvelope, publicKeys: MajikSignerPublicKeys, MajikSig: MajikSignatureStaticAdapter, options?: ExtractOptions & {
+        expectedSignerId?: string;
+    }, debug?: boolean): Promise<VerificationResult[]>;
+    static verifyDetachedWithKey(file: Blob, envelope: MajikSignatureEnvelope, key: MajikKey, MajikSig: MajikSignatureStaticAdapter, options?: ExtractOptions & {
+        expectedSignerId?: string;
+    }, debug?: boolean): Promise<VerificationResult[]>;
     /**
      * Seal a multi-sig envelope, preventing any further signatures.
      *

package/dist/core/embed/majik-embed.js

@@ -166,7 +166,91 @@ export class MajikSignatureEmbed {
         // ── Step 8: Embed ──────────────────────────────────────────────────────
         const resultBytes = await handler.embed(originalBytes, JSON.stringify(nextEnvelope));
         const blob = bytesToBlob(resultBytes, mimeType);
-        return { blob, handler: handler.name, mimeType, signature: signature };
+        return {
+            blob,
+            handler: handler.name,
+            mimeType,
+            signature: signature,
+            envelope: nextEnvelope,
+        };
+    }
+    // ── signDetached ───────────────────────────────────────────────────────────
+    /**
+     * Sign a file and return the envelope detached.
+     * Extracts any existing envelope (or uses a provided one), validates constraints,
+     * signs the stripped bytes, and returns the updated MultiSigEnvelope.
+     * Does NOT embed the envelope back into the file.
+     */
+    static async signDetached(file, key, MajikSig, options, debug = false) {
+        const bytes = await blobToBytes(file);
+        const mimeType = options?.mimeType ?? detectMimeType(bytes, file.type);
+        const handler = options?.forceFallback
+            ? new FallbackHandler()
+            : DEFAULT_REGISTRY.resolve(bytes, mimeType);
+        // ── Step 1: Resolve the working envelope ───────────────────────────────
+        let envelope;
+        if (options?.existingEnvelope) {
+            envelope = options.existingEnvelope;
+        }
+        else {
+            const existingRaw = await handler.extract(bytes);
+            envelope = existingRaw
+                ? parseEnvelope(existingRaw)
+                : { version: 1, signatures: [] };
+        }
+        // ── Step 2: Reject sealed envelopes ────────────────────────────────────
+        if (envelope.sealHash) {
+            throw new MajikSignatureError("Cannot sign a sealed envelope. The issuer has locked this file against further signatures.");
+        }
+        // ── Step 3: Allowlist enforcement ──────────────────────────────────────────
+        const isIssuer = envelope.allowlistSignerId === key.fingerprint;
+        if (!isIssuer) {
+            const allowlistCheck = checkAllowlist(envelope, key);
+            if (!allowlistCheck.permitted) {
+                throw new MajikSignatureAllowlistError(`Signer "${key.fingerprint}" is not permitted to sign this file. ` +
+                    `The file has a signing allowlist established by "${envelope.allowlistSignerId}".`, key.fingerprint);
+            }
+        }
+        // ── Step 4: Get clean original bytes ───────────────────────────────────
+        const originalBytes = await handler.strip(bytes);
+        if (debug) {
+            const recomputedHash = bytesToBase64(hashContent(originalBytes));
+            console.log("signDetached — original bytes hash:", recomputedHash);
+        }
+        // ── Step 5: Compute allowlistHash if establishing or re-signing ─────────
+        const isFirstSigner = envelope.signatures.length === 0;
+        const establishingAllowlist = isFirstSigner &&
+            options?.expectedSigners &&
+            options.expectedSigners.length > 0;
+        const isIssuerResigning = !isFirstSigner &&
+            !!envelope.allowlist &&
+            envelope.allowlist.length > 0 &&
+            envelope.allowlistSignerId === key.fingerprint;
+        const allowlistHashValue = establishingAllowlist
+            ? hashAllowlist(options.expectedSigners)
+            : isIssuerResigning
+                ? hashAllowlist(envelope.allowlist)
+                : undefined;
+        // ── Step 6: Sign ───────────────────────────────────────────────────────
+        const signature = await MajikSig.sign(originalBytes, key, {
+            contentType: options?.contentType,
+            timestamp: options?.timestamp,
+            ...(allowlistHashValue !== undefined
+                ? { allowlistHash: allowlistHashValue }
+                : {}),
+        });
+        // ── Step 7: Build updated envelope ────────────────────────────────────
+        let nextEnvelope = upsertSignature(envelope, signature.toJSON());
+        if (establishingAllowlist) {
+            nextEnvelope = {
+                ...nextEnvelope,
+                allowlist: options.expectedSigners,
+                allowlistSignerId: key.fingerprint,
+            };
+        }
+        // ── Step 8: Return DETACHED (No Embedding) ────────────────────────────
+        const blob = bytesToBlob(originalBytes, mimeType);
+        return { blob, handler: handler.name, mimeType, envelope: nextEnvelope };
     }
     // ── extract ────────────────────────────────────────────────────────────────
     /**
@@ -273,6 +357,73 @@ export class MajikSignatureEmbed {
         const publicKeys = MajikSig.publicKeysFromMajikKey(key);
         return MajikSignatureEmbed.verify(file, publicKeys, MajikSig, options, debug);
     }
+    // ── verifyDetached ─────────────────────────────────────────────────────────
+    /**
+     * Verify a file against a provided, detached MultiSigEnvelope.
+     * Skips extraction but still strips the file in case it contains an embedded envelope,
+     * ensuring verification runs against the clean original bytes.
+     */
+    static async verifyDetached(file, envelope, publicKeys, MajikSig, options, debug = false) {
+        const bytes = await blobToBytes(file);
+        const mimeType = options?.mimeType ?? detectMimeType(bytes, file.type);
+        const handler = DEFAULT_REGISTRY.resolve(bytes, mimeType);
+        // Strip the file to ensure we verify against clean bytes
+        const originalBytes = await handler.strip(bytes);
+        if (debug) {
+            const recomputedHash = bytesToBase64(hashContent(originalBytes));
+            console.log("verifyDetached — original bytes hash:", recomputedHash);
+        }
+        // ── Allowlist integrity check ──────────────────────────────────────────
+        if (envelope.allowlist && envelope.allowlistSignerId) {
+            const recomputedAllowlistHash = hashAllowlist(envelope.allowlist);
+            const establisherSig = envelope.signatures.find((s) => s.signerId === envelope.allowlistSignerId);
+            if (!establisherSig) {
+                return [
+                    {
+                        valid: false,
+                        reason: `Allowlist establisher "${envelope.allowlistSignerId}" has no signature in this envelope`,
+                        timestamp: new Date().toISOString(),
+                    },
+                ];
+            }
+            if (establisherSig.allowlistHash !== recomputedAllowlistHash) {
+                return [
+                    {
+                        valid: false,
+                        reason: "Allowlist integrity check failed — allowlist may have been tampered with",
+                        timestamp: new Date().toISOString(),
+                    },
+                ];
+            }
+        }
+        // ── Filter by expectedSignerId if provided ─────────────────────────────
+        const sigsToVerify = options?.expectedSignerId
+            ? envelope.signatures.filter((s) => s.signerId === options.expectedSignerId)
+            : envelope.signatures;
+        if (sigsToVerify.length === 0) {
+            return [
+                {
+                    valid: false,
+                    reason: options?.expectedSignerId
+                        ? `No signature found for signerId "${options.expectedSignerId}"`
+                        : "Envelope contains no signatures",
+                    timestamp: new Date().toISOString(),
+                },
+            ];
+        }
+        // ── Verify each signature ──────────────────────────────────────────────
+        const results = [];
+        for (const sig of sigsToVerify) {
+            const result = MajikSig.verify(originalBytes, sig, publicKeys);
+            results.push({ ...result, handler: handler.name });
+        }
+        return results;
+    }
+    // ── verifyDetachedWithKey ──────────────────────────────────────────────────
+    static async verifyDetachedWithKey(file, envelope, key, MajikSig, options, debug = false) {
+        const publicKeys = MajikSig.publicKeysFromMajikKey(key);
+        return MajikSignatureEmbed.verifyDetached(file, envelope, publicKeys, MajikSig, options, debug);
+    }
     // ── seal ───────────────────────────────────────────────────────────────────
     /**
      * Seal a multi-sig envelope, preventing any further signatures.

package/dist/core/types.d.ts

@@ -5,6 +5,7 @@
 import { MajikChainAnchor } from "../anchor/types";
 import type { ContentType } from "./constants";
 export type { ContentType };
+export type MajikSignatureEnvelope = MultiSigEnvelope;
 /**
  * The serializable per-signer signature envelope.
  * Everything a verifier needs — no private keys required.

package/dist/majik-signature.d.ts

@@ -4,7 +4,8 @@
  *
  */
 import type { MajikKey } from "@majikah/majik-key";
-import type { EnvelopeInfo, ExpectedSigner, MajikSignatureJSON, MajikSignerPublicKeys, MajikTimestamp, MajikTSARequest, SealInfo, SealVerificationResult, SignatoriesFilter, SignatoriesResult, SignatoryInfo, SignOptions, VerificationResult } from "./core/types";
+import type { EnvelopeInfo, ExpectedSigner, MajikSignatureEnvelope, MajikSignatureJSON, MajikSignerPublicKeys, MajikTimestamp, MajikTSARequest, SealInfo, SealVerificationResult, SignatoriesFilter, SignatoriesResult, SignatoryInfo, SignOptions, VerificationResult } from "./core/types";
+import { MajikSignatureEmbed } from "./core/embed/majik-embed";
 import type { ImageVerificationResult, ImageSignOptions, ImageSignatureStub } from "./core/stamp";
 import { MajikChainAnchor, MajikChainAnchorMemo } from "./anchor/types";
 /**
@@ -130,12 +131,26 @@ export declare class MajikSignature {
         timestamp?: string;
         mimeType?: string;
         expectedSigners?: ExpectedSigner[];
-    }): Promise<{
-        blob: Blob;
-        signature: MajikSignature;
-        handler: string;
-        mimeType: string;
-    }>;
+    }): ReturnType<typeof MajikSignatureEmbed.signAndEmbed<MajikSignature>>;
+    /**
+     * Sign a file and return the signature envelope detached.
+     *
+     * Strips the file of any embedded envelopes, incorporates your new signature
+     * into the multi-sig structure, but does NOT embed it back.
+     * Useful for external verification workflows where payloads and envelopes travel out-of-band.
+     *
+     * @example
+     *   const { blob, signature } = await MajikSignature.signFileDetached(file, aliceKey, {
+     *     existingEnvelope: outOfBandEnvelope // Optionally pass state from an external source
+     *   });
+     */
+    static signFileDetached(file: Blob, key: MajikKey, options?: {
+        contentType?: string;
+        timestamp?: string;
+        mimeType?: string;
+        expectedSigners?: ExpectedSigner[];
+        existingEnvelope?: MajikSignatureEnvelope;
+    }): ReturnType<typeof MajikSignatureEmbed.signDetached>;
     /**
      * Verify a file's embedded signatures.
      * Returns one VerificationResult per signer. Old single-sig files return a single-item array.
@@ -145,6 +160,16 @@ export declare class MajikSignature {
         expectedSignerId?: string;
         mimeType?: string;
     }, debug?: boolean): Promise<VerificationResult[]>;
+    /**
+     * Verify a file against a detached signature envelope.
+     * Skips extraction and verifies the stripped file bytes directly against the provided envelope.
+     * Returns one VerificationResult per signer.
+     * Pass options.expectedSignerId to verify only a specific signer.
+     */
+    static verifyFileDetached(file: Blob, envelope: MajikSignatureEnvelope, keyOrPublicKeys: MajikKey | MajikSignerPublicKeys, options?: {
+        expectedSignerId?: string;
+        mimeType?: string;
+    }, debug?: boolean): Promise<VerificationResult[]>;
     /**
      * Embed this MajikSignature instance into a file.
      * The signature must cover the original file bytes BEFORE embedding.

package/dist/majik-signature.js

@@ -402,7 +402,22 @@ export class MajikSignature {
      *   });
      */
     static async signFile(file, key, options) {
-        return MajikSignatureEmbed.signAndEmbed(file, key, MajikSignature, options);
+        return await MajikSignatureEmbed.signAndEmbed(file, key, MajikSignature, options);
+    }
+    /**
+     * Sign a file and return the signature envelope detached.
+     *
+     * Strips the file of any embedded envelopes, incorporates your new signature
+     * into the multi-sig structure, but does NOT embed it back.
+     * Useful for external verification workflows where payloads and envelopes travel out-of-band.
+     *
+     * @example
+     *   const { blob, signature } = await MajikSignature.signFileDetached(file, aliceKey, {
+     *     existingEnvelope: outOfBandEnvelope // Optionally pass state from an external source
+     *   });
+     */
+    static async signFileDetached(file, key, options) {
+        return MajikSignatureEmbed.signDetached(file, key, MajikSignature, options);
     }
     /**
      * Verify a file's embedded signatures.
@@ -415,6 +430,18 @@ export class MajikSignature {
         }
         return MajikSignatureEmbed.verify(file, keyOrPublicKeys, MajikSignature, options, debug);
     }
+    /**
+     * Verify a file against a detached signature envelope.
+     * Skips extraction and verifies the stripped file bytes directly against the provided envelope.
+     * Returns one VerificationResult per signer.
+     * Pass options.expectedSignerId to verify only a specific signer.
+     */
+    static async verifyFileDetached(file, envelope, keyOrPublicKeys, options, debug = false) {
+        if (MajikSignature._isMajikKey(keyOrPublicKeys)) {
+            return MajikSignatureEmbed.verifyDetachedWithKey(file, envelope, keyOrPublicKeys, MajikSignature, options, debug);
+        }
+        return MajikSignatureEmbed.verifyDetached(file, envelope, keyOrPublicKeys, MajikSignature, options, debug);
+    }
     /**
      * Embed this MajikSignature instance into a file.
      * The signature must cover the original file bytes BEFORE embedding.

package/package.json

@@ -2,7 +2,7 @@
   "name": "@majikah/majik-signature",
   "type": "module",
   "description": "Majik Signature is a hybrid post-quantum content signing and verification library for the Majikah ecosystem. Built on top of Majik Key, it provides tamper-proof, forgery-resistant digital signatures for any content format — using a dual-algorithm architecture that combines classical Ed25519 with post-quantum ML-DSA-87 (FIPS-204).",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "license": "Apache-2.0",
   "author": "Zelijah",
   "main": "./dist/index.js",
@@ -51,7 +51,7 @@
     "test:watch": "vitest"
   },
   "dependencies": {
-    "@majikah/majik-key": "^0.3.2",
+    "@majikah/majik-key": "^0.3.3",
     "@noble/post-quantum": "^0.6.1",
     "@stablelib/ed25519": "^2.1.0",
     "@stablelib/sha256": "^2.0.1",