@majikah/majik-signature 0.8.0 → 0.8.2

package/README.md

@@ -11,44 +11,132 @@ Beyond signing raw bytes, Majik Signature can **embed signatures directly into a
 
 ## Table of Contents
 
-- [Why Majik Signature](#why-majik-signature)
-- [Security Architecture](#security-architecture)
-- [Overview](#overview)
-- [Features](#features)
-- [Installation](#installation)
-- [Quick Start](#quick-start)
-  - [Signing Raw Content](#signing-raw-content)
-  - [File Embedding](#file-embedding)
-  - [Detached Signing](#detached-signing)
-  - [Multi-Signature Files & Allowlists](#multi-signature-files--allowlists)
-  - [Sealing an Envelope](#sealing-an-envelope)
-  - [Trusted Timestamps (TSA)](#trusted-timestamps-tsa)
-  - [Batch Signing a Folder](#batch-signing-a-folder)
-  - [Verifying Signing Order](#verifying-signing-order)
-  - [Chain Anchoring](#chain-anchoring)
-- [API Reference](#api-reference)
-  - [Content Signing](#content-signing-bytesstrings)
-  - [File Embedding](#file-embedding-api)
-  - [Detached Signing & MajikSignatureEnvelope](#detached-signing--majiksignatureenvelope-api)
-  - [Multi-Signature & Allowlist](#multi-signature--allowlist-api)
-  - [Sealing](#sealing-api)
-  - [Trusted Timestamps](#trusted-timestamps-api)
-  - [Batch Signing & MajikSignatureMap](#batch-signing--majiksignaturemap-api)
-  - [Signature Order Verification](#signature-order-verification-api)
-  - [Chain Anchoring API](#chain-anchoring-api)
-  - [Image Stamping (Experimental)](#image-stamping-experimental)
-  - [Serialization](#serialization)
-- [Supported File Formats](#supported-file-formats)
-- [Signature & Envelope Structure](#signature--envelope-structure)
-- [Binary Container Formats (MJKSIG / MJKSMAP)](#binary-container-formats-mjksig--mjksmap)
-- [Error Handling](#error-handling)
-- [Security Considerations](#security-considerations)
-- [The Majikah Ecosystem](#the-majikah-ecosystem)
-- [Related Projects](#related-projects)
-- [Contributing](#contributing)
-- [License](#license)
-- [Author](#author)
-- [Contact](#contact)
+- [Majik Signature](#majik-signature)
+  - [Table of Contents](#table-of-contents)
+  - [Why Majik Signature](#why-majik-signature)
+  - [Security Architecture](#security-architecture)
+    - [1. Hybrid Dual-Algorithm Signing](#1-hybrid-dual-algorithm-signing)
+    - [2. Canonical Payload Binding](#2-canonical-payload-binding)
+    - [3. Content-Agnostic Hashing](#3-content-agnostic-hashing)
+    - [4. File Embedding \& Detachment Integrity](#4-file-embedding--detachment-integrity)
+    - [5. Multi-Party Signing, Allowlists \& Sealing](#5-multi-party-signing-allowlists--sealing)
+    - [6. File Versioning for Visually-Mutating Multi-Sig Workflows](#6-file-versioning-for-visually-mutating-multi-sig-workflows)
+    - [7. Trusted Timestamps (TSA)](#7-trusted-timestamps-tsa)
+    - [8. Chain Anchoring](#8-chain-anchoring)
+  - [Overview](#overview)
+    - [What is a Majik Signature?](#what-is-a-majik-signature)
+    - [Use Cases](#use-cases)
+  - [Features](#features)
+    - [Security \& Post-Quantum Readiness](#security--post-quantum-readiness)
+    - [Multi-Party Signing](#multi-party-signing)
+    - [Detached Signing \& Batch Workflows](#detached-signing--batch-workflows)
+    - [Content Format Support](#content-format-support)
+    - [Developer Experience](#developer-experience)
+    - [Serialization \& Portability](#serialization--portability)
+  - [Installation](#installation)
+  - [Command-Line Interface](#command-line-interface)
+    - [`mjksig` — Sign, Verify, Seal, Inspect](#mjksig--sign-verify-seal-inspect)
+    - [Run with `npx`](#run-with-npx)
+    - [CLI Documentation](#cli-documentation)
+  - [Quick Start](#quick-start)
+    - [Signing Raw Content](#signing-raw-content)
+    - [File Embedding](#file-embedding)
+    - [Detached Signing](#detached-signing)
+    - [Multi-Signature Files \& Allowlists](#multi-signature-files--allowlists)
+    - [Sealing an Envelope](#sealing-an-envelope)
+    - [Trusted Timestamps (TSA)](#trusted-timestamps-tsa)
+    - [Batch Signing a Folder](#batch-signing-a-folder)
+    - [Verifying Signing Order](#verifying-signing-order)
+    - [Chain Anchoring](#chain-anchoring)
+    - [File Versioning \& Multi-Sig Revisions](#file-versioning--multi-sig-revisions)
+  - [API Reference](#api-reference)
+    - [Content Signing (bytes/strings)](#content-signing-bytesstrings)
+      - [`MajikSignature.sign(content, key, options?)`](#majiksignaturesigncontent-key-options)
+      - [`MajikSignature.verify(content, signature, publicKeys)`](#majiksignatureverifycontent-signature-publickeys)
+      - [`MajikSignature.verifyWithKey(content, signature, key)`](#majiksignatureverifywithkeycontent-signature-key)
+      - [`MajikSignature.publicKeysFromMajikKey(key)`](#majiksignaturepublickeysfrommajikkeykey)
+      - [`signature.extractPublicKeys()` *(instance method)*](#signatureextractpublickeys-instance-method)
+      - [`signature.validate()` / `signature.isValid()`](#signaturevalidate--signatureisvalid)
+      - [`MajikSignature.fromJSON(json)` / `MajikSignature.deserialize(base64)`](#majiksignaturefromjsonjson--majiksignaturedeserializebase64)
+    - [File Embedding API](#file-embedding-api)
+      - [`MajikSignature.signFile(file, key, options?)`](#majiksignaturesignfilefile-key-options)
+      - [`MajikSignature.verifyFile(file, keyOrPublicKeys, options?)`](#majiksignatureverifyfilefile-keyorpublickeys-options)
+      - [`signature.embedIn(file, options?)` *(instance method)*](#signatureembedinfile-options-instance-method)
+      - [`MajikSignature.extractFrom(file, options?)`](#majiksignatureextractfromfile-options)
+      - [`MajikSignature.stripFrom(file, options?)`](#majiksignaturestripfromfile-options)
+      - [`MajikSignature.isSigned(file, options?)`](#majiksignatureissignedfile-options)
+    - [Detached Signing \& MajikSignatureEnvelope API](#detached-signing--majiksignatureenvelope-api)
+      - [`MajikSignature.signFileDetached(file, key, options?)`](#majiksignaturesignfiledetachedfile-key-options)
+      - [`MajikSignature.verifyFileDetached(file, envelope, keyOrPublicKeys, options?)`](#majiksignatureverifyfiledetachedfile-envelope-keyorpublickeys-options)
+      - [`MajikSignatureEnvelope`](#majiksignatureenvelope)
+    - [Multi-Signature \& Allowlist API](#multi-signature--allowlist-api)
+      - [`MajikSignature.expectedSignerFromKey(key)`](#majiksignatureexpectedsignerfromkeykey)
+      - [`MajikSignature.getAllowlist(file, options?)`](#majiksignaturegetallowlistfile-options)
+      - [`MajikSignature.canSign(file, key, options?)`](#majiksignaturecansignfile-key-options)
+      - [`MajikSignature.getSignatories(file, options?, filter?)`](#majiksignaturegetsignatoriesfile-options-filter)
+      - [`MajikSignature.getIssuer(file, options?)`](#majiksignaturegetissuerfile-options)
+      - [`MajikSignature.getEnvelopeInfo(file, options?)`](#majiksignaturegetenvelopeinfofile-options)
+      - [`MajikSignature.isMultiSig(file, options?)`](#majiksignatureismultisigfile-options)
+    - [Sealing API](#sealing-api)
+      - [`MajikSignature.seal(file, key, options?)`](#majiksignaturesealfile-key-options)
+      - [`MajikSignature.verifySeal(file, options?)`](#majiksignatureverifysealfile-options)
+      - [`MajikSignature.getSealInfo(file, options?)`](#majiksignaturegetsealinfofile-options)
+      - [`MajikSignature.isSealed(file, options?)`](#majiksignatureissealedfile-options)
+    - [Trusted Timestamps API](#trusted-timestamps-api)
+      - [`signature.buildTSARequestPayload()`](#signaturebuildtsarequestpayload)
+      - [`MajikSignature.signTSA(request, key, tsa, options?)`](#majiksignaturesigntsarequest-key-tsa-options)
+      - [`signature.addTSA(timestamp)`](#signatureaddtsatimestamp)
+      - [`signature.verifyTSA()`](#signatureverifytsa)
+      - [`signature.hasTSA`](#signaturehastsa)
+    - [Batch Signing \& MajikSignatureMap API](#batch-signing--majiksignaturemap-api)
+      - [`MajikSignature.signBatchDetached(files, key, options?)`](#majiksignaturesignbatchdetachedfiles-key-options)
+      - [`MajikSignature.verifyFilesFromMjksMap(map, files, publicKeys, options?)`](#majiksignatureverifyfilesfrommjksmapmap-files-publickeys-options)
+      - [`MajikSignature.verifyFilesFromMjksMapWithKey(map, files, key, options?)`](#majiksignatureverifyfilesfrommjksmapwithkeymap-files-key-options)
+      - [`MajikSignature.summarizeBatchVerification(results)`](#majiksignaturesummarizebatchverificationresults)
+      - [`MajikSignatureMap`](#majiksignaturemap)
+    - [Signature Order Verification API](#signature-order-verification-api)
+      - [`MajikSignature.verifyFileOrder(file, expectedOrder, options?)`](#majiksignatureverifyfileorderfile-expectedorder-options)
+      - [`MajikSignature.verifyFileDetachedOrder(file, envelope, expectedOrder, options?)`](#majiksignatureverifyfiledetachedorderfile-envelope-expectedorder-options)
+      - [`MajikSignature.normalizeExpectedOrder(expectedOrder)`](#majiksignaturenormalizeexpectedorderexpectedorder)
+    - [Chain Anchoring API (Experimental)](#chain-anchoring-api-experimental)
+      - [`MajikSignature.canAnchor(file, options?)`](#majiksignaturecananchorfile-options)
+      - [`MajikSignature.buildChainAnchorMemo(sealHash)`](#majiksignaturebuildchainanchormemosealhash)
+      - [`MajikSignature.registerChainAnchor(file, anchor, options?)`](#majiksignatureregisterchainanchorfile-anchor-options)
+      - [`MajikSignature.getChainAnchors(file, options?)`](#majiksignaturegetchainanchorsfile-options)
+    - [File Versioning API](#file-versioning-api)
+      - [`MajikSignature.signFile(file, key, options?)` — versioning-relevant options](#majiksignaturesignfilefile-key-options--versioning-relevant-options)
+      - [`MajikSignature.verifyFileChain(file, options?)`](#majiksignatureverifyfilechainfile-options)
+      - [`MajikSignature.verifyFileRevisions(finalFile, revisions, options?)`](#majiksignatureverifyfilerevisionsfinalfile-revisions-options)
+      - [`MajikSignature.verifyCommitment(signature, publicKeys, now?)`](#majiksignatureverifycommitmentsignature-publickeys-now)
+    - [Image Stamping (Experimental)](#image-stamping-experimental)
+    - [Serialization](#serialization)
+      - [`signature.toJSON()` / `MajikSignature.fromJSON(json)`](#signaturetojson--majiksignaturefromjsonjson)
+      - [`signature.serialize()` / `MajikSignature.deserialize(base64)`](#signatureserialize--majiksignaturedeserializebase64)
+      - [`envelope.toJSON()` / `MajikSignatureEnvelope.fromJSON(json)`](#envelopetojson--majiksignatureenvelopefromjsonjson)
+      - [`envelope.serialize()` / `MajikSignatureEnvelope.deserialize(base64)`](#envelopeserialize--majiksignatureenvelopedeserializebase64)
+      - [`envelope.toMJKSIG()` / `MajikSignatureEnvelope.fromMJKSIG(input)`](#envelopetomjksig--majiksignatureenvelopefrommjksiginput)
+  - [Supported File Formats](#supported-file-formats)
+  - [Signature \& Envelope Structure](#signature--envelope-structure)
+  - [Binary Container Formats (MJKSIG / MJKSMAP)](#binary-container-formats-mjksig--mjksmap)
+  - [Error Handling](#error-handling)
+  - [Security Considerations](#security-considerations)
+    - [What is Guaranteed](#what-is-guaranteed)
+    - [What is Your Responsibility](#what-is-your-responsibility)
+    - [What NOT to Do](#what-not-to-do)
+    - [What TO Do](#what-to-do)
+  - [The Majikah Ecosystem](#the-majikah-ecosystem)
+    - [Majik Signature — Standalone App](#majik-signature--standalone-app)
+    - [🧾 Majik Buwiz](#-majik-buwiz)
+    - [💬 Majik Message](#-majik-message)
+    - [🪪 Majik Universal ID](#-majik-universal-id)
+  - [Related Projects](#related-projects)
+    - [Majik Key](#majik-key)
+    - [Majik Message](#majik-message)
+  - [Contributing](#contributing)
+  - [License](#license)
+  - [Author](#author)
+  - [Contact](#contact)
+
 
 ---
 
@@ -260,6 +348,66 @@ npm install @majikah/majik-key
 
 No native bindings. Works in Node.js 18+, modern browsers, Deno, Bun, and Tauri.
 
+---
+
+## Command-Line Interface
+
+### `mjksig` — Sign, Verify, Seal, Inspect
+
+Majik Signature includes a full-featured CLI for working with signed files directly from your terminal.
+
+The `mjksig` CLI supports:
+
+* Embedded and detached signing
+* MJKSMAP folder signing and verification
+* Multi-signature allowlists and co-signing
+* Envelope sealing
+* Signing-permission checks
+* Signature inspection
+* Batch workflows
+* Machine-readable `--json` output
+* Interactive and non-interactive signing-key passphrases
+
+### Run with `npx`
+
+No global installation required:
+
+```bash
+npx @majikah/majik-signature --help
+```
+
+Sign a file:
+
+```bash
+npx @majikah/majik-signature sign report.pdf --key alice.json
+```
+
+Verify a file:
+
+```bash
+npx @majikah/majik-signature verify report.pdf
+```
+
+Or install globally and use the `mjksig` command directly:
+
+```bash
+npm install -g @majikah/majik-signature
+```
+
+```bash
+mjksig --help
+```
+
+For automation and CI environments, signing-key passphrases can be supplied through `MAJIK_KEY_PASSPHRASE`.
+
+### CLI Documentation
+
+For the complete command reference, workflow combinations, options, compatibility rules, examples, exit codes, automation guidance, and `npx` usage, see:
+
+
+[![CLIREADME](https://img.shields.io/badge/Read_the_CLI_Documentation_Here-EA7F05?style=for-the-badge&logoColor=ea7f05)](./CLI_README.md)
+
+
 ---
 
 ## Quick Start

package/dist/cli-core/index.d.ts

@@ -1,5 +1,5 @@
-export type * from "./types";
-export * from "./io";
-export * from "./key";
-export * from "./output";
-export * from "./operations";
+export type * from "./types.js";
+export * from "./io.js";
+export * from "./key.js";
+export * from "./output.js";
+export * from "./operations.js";

package/dist/cli-core/index.js

@@ -1,4 +1,4 @@
-export * from "./io";
-export * from "./key";
-export * from "./output";
-export * from "./operations";
+export * from "./io.js";
+export * from "./key.js";
+export * from "./output.js";
+export * from "./operations.js";

package/dist/cli-core/io.d.ts

@@ -3,7 +3,7 @@
  *
  * Node.js filesystem helpers for the Majik Signature CLI.
  */
-import type { FolderFile } from "./types";
+import type { FolderFile } from "./types.js";
 /**
  * Convert a filesystem path into the normalized relative-path convention
  * used by MajikSignatureMap.

package/dist/cli-core/key.js

@@ -9,7 +9,7 @@
 import { createInterface } from "node:readline/promises";
 import { stdin as input, stdout as output } from "node:process";
 import { MajikKey } from "@majikah/majik-key";
-import { readJsonFile, resolveCliPath } from "./io";
+import { readJsonFile, resolveCliPath } from "./io.js";
 /**
  * Read a passphrase without echoing it to the terminal.
  *

package/dist/cli-core/operations.js

@@ -16,9 +16,9 @@
  */
 import { basename, extname, isAbsolute, join, relative, resolve, } from "node:path";
 import { zipSync } from "fflate";
-import { MajikSignature } from "../majik-signature";
-import { MajikSignatureEnvelope } from "../core/envelope";
-import { MajikSignatureMap } from "../core/mjksmap";
+import { MajikSignature } from "../majik-signature.js";
+import { MajikSignatureEnvelope } from "../core/envelope.js";
+import { MajikSignatureMap } from "../core/mjksmap.js";
 import { getPathKind, mimeTypeForPath, outputPathForDetachedFile, outputPathForMap, outputPathForMapBundle, readBlob, readFolderFiles, readJsonFile, resolveCliPath, summarizeFiles, writeBlob, writeBytes, } from "./io.js";
 import { loadMajikKey, loadSigningKey, lockKey } from "./key.js";
 function errorMessage(error) {

package/dist/cli-core/output.d.ts

@@ -3,7 +3,7 @@
  *
  * Human-readable and machine-readable result presentation.
  */
-import type { CliResult } from "./types";
+import type { CliResult } from "./types.js";
 export declare function printResult(result: CliResult): void;
 export declare function printJsonResult(result: CliResult): void;
 export declare function printFailure(error: unknown): void;

package/dist/cli.js

@@ -5,9 +5,9 @@
 import { Command } from "commander";
 import { fileURLToPath } from "node:url";
 import { resolve } from "node:path";
-import { runCanSign, runInspect, runSeal, runSign, runVerify, } from "./cli-core/operations";
-import { printFailure, printJsonResult, printResult } from "./cli-core/output";
-import { getPackageVersion } from "./cli-core/io";
+import { runCanSign, runInspect, runSeal, runSign, runVerify, } from "./cli-core/operations.js";
+import { printFailure, printJsonResult, printResult } from "./cli-core/output.js";
+import { getPackageVersion } from "./cli-core/io.js";
 function parseCsv(value) {
     return value
         .split(",")

package/dist/core/embed/canonical.d.ts

@@ -18,7 +18,7 @@
  *
  * This relies on embed() being deterministic (Office pins mtime + level).
  */
-import type { FormatHandler } from "../types";
+import type { FormatHandler } from "../types.js";
 export type CanonicalResult = {
     ok: true;
     original: Uint8Array;

package/dist/core/embed/canonical.js

@@ -18,7 +18,7 @@
  *
  * This relies on embed() being deterministic (Office pins mtime + level).
  */
-import { bufferEqual } from "./utils";
+import { bufferEqual } from "./utils.js";
 /**
  * Embedded-envelope path. `raw` is what handler.extract(bytes) returned.
  * On success `original` is the exact byte string the signatures cover.

package/dist/core/embed/handlers/flac.d.ts

@@ -9,7 +9,7 @@
  * We embed signatures using an APPLICATION block (type = 2) with 4-byte
  * application ID "MAJK" followed by the signature JSON payload.
  */
-import { FormatHandler } from "../../types";
+import { FormatHandler } from "../../types.js";
 export declare class FlacHandler implements FormatHandler {
     readonly name = "FLAC";
     readonly supportedMimeTypes: readonly ["audio/flac", "audio/x-flac"];

package/dist/core/embed/handlers/flac.js

@@ -9,7 +9,7 @@
  * We embed signatures using an APPLICATION block (type = 2) with 4-byte
  * application ID "MAJK" followed by the signature JSON payload.
  */
-import { concatBytes, textDecode, textEncode } from "../utils";
+import { concatBytes, textDecode, textEncode } from "../utils.js";
 const FLAC_MAGIC = textEncode("fLaC");
 const APPLICATION_ID = textEncode("MAJK"); // 4-byte custom Application ID
 var FlacBlockType;

package/dist/core/embed/handlers/index.d.ts

@@ -1,11 +1,11 @@
-export { PdfHandler } from "./pdf";
-export { PngHandler } from "./png";
-export { JpegHandler } from "./jpeg";
-export { WavHandler } from "./wav";
-export { Mp3Handler } from "./mp3";
-export { Mp4Handler } from "./mp4";
-export { FlacHandler } from "./flac";
-export { MkvHandler } from "./mkv";
-export { OfficeHandler } from "./office";
-export { TextHandler } from "./text";
-export { MsixHandler } from "./msix";
+export { PdfHandler } from "./pdf.js";
+export { PngHandler } from "./png.js";
+export { JpegHandler } from "./jpeg.js";
+export { WavHandler } from "./wav.js";
+export { Mp3Handler } from "./mp3.js";
+export { Mp4Handler } from "./mp4.js";
+export { FlacHandler } from "./flac.js";
+export { MkvHandler } from "./mkv.js";
+export { OfficeHandler } from "./office.js";
+export { TextHandler } from "./text.js";
+export { MsixHandler } from "./msix.js";

package/dist/core/embed/handlers/index.js

@@ -1,11 +1,11 @@
-export { PdfHandler } from "./pdf";
-export { PngHandler } from "./png";
-export { JpegHandler } from "./jpeg";
-export { WavHandler } from "./wav";
-export { Mp3Handler } from "./mp3";
-export { Mp4Handler } from "./mp4";
-export { FlacHandler } from "./flac";
-export { MkvHandler } from "./mkv";
-export { OfficeHandler } from "./office";
-export { TextHandler } from "./text";
-export { MsixHandler } from "./msix";
+export { PdfHandler } from "./pdf.js";
+export { PngHandler } from "./png.js";
+export { JpegHandler } from "./jpeg.js";
+export { WavHandler } from "./wav.js";
+export { Mp3Handler } from "./mp3.js";
+export { Mp4Handler } from "./mp4.js";
+export { FlacHandler } from "./flac.js";
+export { MkvHandler } from "./mkv.js";
+export { OfficeHandler } from "./office.js";
+export { TextHandler } from "./text.js";
+export { MsixHandler } from "./msix.js";

package/dist/core/embed/handlers/jpeg.d.ts

@@ -10,7 +10,7 @@
  *
  * Falls back to Tier-2 trailer if segment injection fails.
  */
-import { FormatHandler } from "../../types";
+import { FormatHandler } from "../../types.js";
 export declare class JpegHandler implements FormatHandler {
     readonly name = "JPEG";
     readonly supportedMimeTypes: readonly ["image/jpeg", "image/jpg"];

package/dist/core/embed/handlers/jpeg.js

@@ -10,7 +10,7 @@
  *
  * Falls back to Tier-2 trailer if segment injection fails.
  */
-import { concatBytes, textDecode, textEncode } from "../utils";
+import { concatBytes, textDecode, textEncode } from "../utils.js";
 const JPEG_SOI = new Uint8Array([0xff, 0xd8]);
 const APP15_MARKER = new Uint8Array([0xff, 0xef]);
 const MAJIK_IDENTIFIER = textEncode("MAJIK\0");

package/dist/core/embed/handlers/mkv.d.ts

@@ -11,7 +11,7 @@
  * If you need native MKV Tags element embedding, this handler can be extended
  * with a full EBML parser. For now, the Tier-2 trailer is the primary store.
  */
-import { FormatHandler } from "../../types";
+import { FormatHandler } from "../../types.js";
 export declare class MkvHandler implements FormatHandler {
     readonly name = "MKV/WebM";
     readonly supportedMimeTypes: readonly ["video/x-matroska", "video/webm", "audio/webm", "audio/x-matroska"];

package/dist/core/embed/handlers/mkv.js

@@ -11,7 +11,7 @@
  * If you need native MKV Tags element embedding, this handler can be extended
  * with a full EBML parser. For now, the Tier-2 trailer is the primary store.
  */
-import { appendTrailer, extractTrailer } from "../utils";
+import { appendTrailer, extractTrailer } from "../utils.js";
 const EBML_MAGIC = new Uint8Array([0x1a, 0x45, 0xdf, 0xa3]);
 export class MkvHandler {
     name = "MKV/WebM";

package/dist/core/embed/handlers/mp3.d.ts

@@ -13,7 +13,7 @@
  * ID3v2 header:
  *   "ID3" [1B major_ver=3][1B revision=0][1B flags=0][4B syncsafe_size]
  */
-import { FormatHandler } from "../../types";
+import { FormatHandler } from "../../types.js";
 export declare class Mp3Handler implements FormatHandler {
     readonly name = "MP3";
     readonly supportedMimeTypes: readonly ["audio/mpeg", "audio/mp3"];

package/dist/core/embed/handlers/mp3.js

@@ -13,8 +13,8 @@
  * ID3v2 header:
  *   "ID3" [1B major_ver=3][1B revision=0][1B flags=0][4B syncsafe_size]
  */
-import { ID3_TXXX_DESCRIPTION } from "../constants";
-import { concatBytes, textDecode, textEncode } from "../utils";
+import { ID3_TXXX_DESCRIPTION } from "../constants.js";
+import { concatBytes, textDecode, textEncode } from "../utils.js";
 export class Mp3Handler {
     name = "MP3";
     supportedMimeTypes = ["audio/mpeg", "audio/mp3"];

package/dist/core/embed/handlers/mp4.d.ts

@@ -14,7 +14,7 @@
  * If udta doesn't exist in moov, we create it.
  * If moov doesn't exist (fragmented MP4), fall through to FallbackHandler.
  */
-import { FormatHandler } from "../../types";
+import { FormatHandler } from "../../types.js";
 export declare class Mp4Handler implements FormatHandler {
     readonly name = "MP4/MOV";
     readonly supportedMimeTypes: readonly ["video/mp4", "video/quicktime", "audio/mp4", "audio/m4a", "video/x-m4v", "video/m4v"];

package/dist/core/embed/handlers/mp4.js

@@ -14,9 +14,8 @@
  * If udta doesn't exist in moov, we create it.
  * If moov doesn't exist (fragmented MP4), fall through to FallbackHandler.
  */
-import { MP4_BOX_TYPE } from "../constants";
-import { concatBytes, readUint32BE, textDecode, textEncode, writeUint32BE, } from "../utils";
-const MAJK_TYPE = textEncode(MP4_BOX_TYPE); // "majk"
+import { MP4_BOX_TYPE } from "../constants.js";
+import { concatBytes, readUint32BE, textDecode, textEncode, writeUint32BE, } from "../utils.js";
 export class Mp4Handler {
     name = "MP4/MOV";
     supportedMimeTypes = [

package/dist/core/embed/handlers/msix.d.ts

@@ -22,7 +22,7 @@
  *
  * No canonical ZIP reconstruction is performed.
  */
-import { FormatHandler } from "../../types";
+import { FormatHandler } from "../../types.js";
 export declare class MsixHandler implements FormatHandler {
     readonly name = "MSIX / AppX";
     readonly supportedMimeTypes: readonly string[];

package/dist/core/embed/handlers/msix.js

@@ -24,11 +24,7 @@
  */
 import { unzipSync } from "fflate";
 const MSIX_MIME_TYPES = ["application/msix", "application/appx"];
-const ZIP_MAGIC = 0x04034b50;
-const MSIX_REQUIRED_ENTRIES = new Set([
-    "AppxManifest.xml",
-    "AppxBlockMap.xml",
-]);
+const MSIX_REQUIRED_ENTRIES = new Set(["AppxManifest.xml", "AppxBlockMap.xml"]);
 export class MsixHandler {
     name = "MSIX / AppX";
     supportedMimeTypes = MSIX_MIME_TYPES;

package/dist/core/embed/handlers/office.d.ts

@@ -12,7 +12,7 @@
  *
  * Uses fflate for pure-JS ZIP manipulation (works in browser + Node).
  */
-import { FormatHandler } from "../../types";
+import { FormatHandler } from "../../types.js";
 export declare const MAX_UNZIPPED_BYTES: number;
 export declare class OfficeHandler implements FormatHandler {
     readonly name = "Office (DOCX/XLSX/PPTX/ODF)";

package/dist/core/embed/handlers/office.js

@@ -13,8 +13,8 @@
  * Uses fflate for pure-JS ZIP manipulation (works in browser + Node).
  */
 import { unzipSync, zipSync, strToU8, strFromU8 } from "fflate";
-import { OFFICE_ZIP_ENTRY } from "../constants";
-import { toZippable } from "../utils";
+import { OFFICE_ZIP_ENTRY } from "../constants.js";
+import { toZippable } from "../utils.js";
 const OFFICE_MIME_TYPES = [
     "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
     "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",

package/dist/core/embed/handlers/pdf.d.ts

@@ -12,7 +12,7 @@
  *   incremental update placed after a "\n%%MajikSig%%\n" comment line was
  *   never hashed on the detached-verification path.
  */
-import { FormatHandler } from "../../types";
+import { FormatHandler } from "../../types.js";
 export declare class PdfHandler implements FormatHandler {
     readonly name = "PDF";
     readonly supportedMimeTypes: readonly ["application/pdf"];

package/dist/core/embed/handlers/pdf.js

@@ -12,7 +12,7 @@
  *   incremental update placed after a "\n%%MajikSig%%\n" comment line was
  *   never hashed on the detached-verification path.
  */
-import { concatBytes, includesBytes, matchesAt } from "../utils";
+import { concatBytes, includesBytes, matchesAt } from "../utils.js";
 const PDF_MAGIC = [0x25, 0x50, 0x44, 0x46]; // %PDF
 const MAGIC = new TextEncoder().encode("\n%%MajikSig%%\n");
 const STRICT_UTF8 = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true });

package/dist/core/embed/handlers/png.d.ts

@@ -8,7 +8,7 @@
  * Chunk layout:
  *   [4B length][4B type "iTXt"][keyword\0][compression_flag][compression_method][lang\0][translated_keyword\0][text][4B CRC]
  */
-import { FormatHandler } from "../../types";
+import { FormatHandler } from "../../types.js";
 export declare class PngHandler implements FormatHandler {
     readonly name = "PNG";
     readonly supportedMimeTypes: readonly ["image/png"];

package/dist/core/embed/handlers/png.js

@@ -8,8 +8,8 @@
  * Chunk layout:
  *   [4B length][4B type "iTXt"][keyword\0][compression_flag][compression_method][lang\0][translated_keyword\0][text][4B CRC]
  */
-import { PNG_KEYWORD } from "../constants";
-import { concatBytes, crc32, readUint32BE, textDecode, textEncode, writeUint32BE, } from "../utils";
+import { PNG_KEYWORD } from "../constants.js";
+import { concatBytes, crc32, readUint32BE, textDecode, textEncode, writeUint32BE, } from "../utils.js";
 const PNG_SIGNATURE = new Uint8Array([
     0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a,
 ]);

package/dist/core/embed/handlers/text.d.ts

@@ -20,7 +20,7 @@
  *
  * extract() and strip() share one parser (split()) so they cannot disagree.
  */
-import { FormatHandler } from "../../types";
+import { FormatHandler } from "../../types.js";
 export declare class TextHandler implements FormatHandler {
     readonly name = "Text/Markup/Source";
     readonly supportedMimeTypes: readonly string[];

package/dist/core/embed/handlers/text.js

@@ -20,7 +20,7 @@
  *
  * extract() and strip() share one parser (split()) so they cannot disagree.
  */
-import { concatBytes, includesBytes, matchesAt, textDecode, textEncode, } from "../utils";
+import { concatBytes, includesBytes, matchesAt, textDecode, textEncode, } from "../utils.js";
 const BEGIN_MARKER = "<!-- MAJIK-SIGNATURE-BEGIN -->";
 const END_MARKER = "<!-- MAJIK-SIGNATURE-END -->";
 const BEGIN_BYTES = textEncode(BEGIN_MARKER);

package/dist/core/embed/handlers/wav.d.ts

@@ -12,7 +12,7 @@
  *     "LIST" [4B size] "INFO"
  *       "ISIG" [4B size] [signature JSON, null-padded to even length]
  */
-import { FormatHandler } from "../../types";
+import { FormatHandler } from "../../types.js";
 export declare class WavHandler implements FormatHandler {
     readonly name = "WAV";
     readonly supportedMimeTypes: readonly ["audio/wav", "audio/wave", "audio/x-wav"];

package/dist/core/embed/handlers/wav.js

@@ -12,7 +12,7 @@
  *     "LIST" [4B size] "INFO"
  *       "ISIG" [4B size] [signature JSON, null-padded to even length]
  */
-import { concatBytes, readUint32LE, textDecode, textEncode, writeUint32LE, } from "../utils";
+import { concatBytes, readUint32LE, textDecode, textEncode, writeUint32LE, } from "../utils.js";
 const RIFF_MAGIC = textEncode("RIFF");
 const WAVE_MAGIC = textEncode("WAVE");
 const LIST_TYPE = textEncode("LIST");

package/dist/core/embed/majik-embed.d.ts

@@ -35,12 +35,12 @@
  * The public `MajikSignature` class exposes the higher-level user-facing API.
  */
 import type { ISODateString, MajikKey } from "@majikah/majik-key";
-import type { BatchFileInput, BatchSignOptions, BatchSignResult, BatchVerifyInput, BatchVerifyOptions, BatchVerifySummary, EmbedOptions, EmbedResult, EnvelopeInfo, EnvelopeInput, ExpectedSigner, ExtractOptions, ExtractResult, FileChainVerification, FileLike, FileVerifyResult, MajikSignatureJSON, MajikSignerPublicKeys, MajikTimestamp, RevisionSetVerification, SealInfo, SealVerificationResult, SignatoriesFilter, SignatoriesResult, SignOptions, VerificationResult } from "../../core/types";
-import { MajikSignatureEnvelope } from "../../core/envelope";
-import { FormatHandlerRegistry } from "./registry";
-import { MajikChainAnchor } from "../../anchor/types";
-import { MajikSignatureMap } from "../mjksmap";
-import { SignatureOrderResult, VerifySignatureOrderOptions } from "../order";
+import type { BatchFileInput, BatchSignOptions, BatchSignResult, BatchVerifyInput, BatchVerifyOptions, BatchVerifySummary, EmbedOptions, EmbedResult, EnvelopeInfo, EnvelopeInput, ExpectedSigner, ExtractOptions, ExtractResult, FileChainVerification, FileLike, FileVerifyResult, MajikSignatureJSON, MajikSignerPublicKeys, MajikTimestamp, RevisionSetVerification, SealInfo, SealVerificationResult, SignatoriesFilter, SignatoriesResult, SignOptions, VerificationResult } from "../../core/types.js";
+import { MajikSignatureEnvelope } from "../../core/envelope.js";
+import { FormatHandlerRegistry } from "./registry.js";
+import { MajikChainAnchor } from "../../anchor/types.js";
+import { MajikSignatureMap } from "../mjksmap.js";
+import { SignatureOrderResult, VerifySignatureOrderOptions } from "../order.js";
 /**
  * Minimal instance-level bridge between `MajikSignatureEmbed` and the concrete
  * `MajikSignature` class.

package/dist/core/embed/majik-embed.js

@@ -34,16 +34,16 @@
  * This module is primarily an implementation-level orchestration surface.
  * The public `MajikSignature` class exposes the higher-level user-facing API.
  */
-import { MajikSignatureEnvelope } from "../../core/envelope";
-import { FormatHandlerRegistry } from "./registry";
-import { bytesToBlob, detectMimeType, normalizeToBlob, normalizeToBytes, } from "./utils";
+import { MajikSignatureEnvelope } from "../../core/envelope.js";
+import { FormatHandlerRegistry } from "./registry.js";
+import { bytesToBlob, detectMimeType, normalizeToBlob, normalizeToBytes, } from "./utils.js";
 import { PdfHandler, PngHandler, FlacHandler, JpegHandler, MkvHandler, Mp3Handler, Mp4Handler, OfficeHandler, TextHandler, WavHandler, MsixHandler, } from "./handlers";
-import { FallbackHandler } from "./fallback";
-import { base64ToBytes, bytesToBase64, hashContent } from "../hash";
-import { MajikSignatureError, MajikSignatureValidationError } from "../errors";
-import { MajikSignatureMap } from "../mjksmap";
-import { verifySignatureOrder, } from "../order";
-import { assertCanonical, noSignatureReason, prepareDetachedBytes, } from "./canonical";
+import { FallbackHandler } from "./fallback.js";
+import { base64ToBytes, bytesToBase64, hashContent } from "../hash.js";
+import { MajikSignatureError, MajikSignatureValidationError } from "../errors.js";
+import { MajikSignatureMap } from "../mjksmap.js";
+import { verifySignatureOrder, } from "../order.js";
+import { assertCanonical, noSignatureReason, prepareDetachedBytes, } from "./canonical.js";
 // ─── Registry ─────────────────────────────────────────────────────────────────
 const DEFAULT_REGISTRY = new FormatHandlerRegistry()
     .register(new PdfHandler())

package/dist/core/embed/registry.d.ts

@@ -5,7 +5,7 @@
  * Handlers are tried in registration order; the first canHandle() match wins.
  * FallbackHandler is always last.
  */
-import { FormatHandler } from "../types";
+import { FormatHandler } from "../types.js";
 export declare class FormatHandlerRegistry {
     private readonly _handlers;
     private readonly _fallback;

package/dist/core/embed/registry.js

@@ -5,7 +5,7 @@
  * Handlers are tried in registration order; the first canHandle() match wins.
  * FallbackHandler is always last.
  */
-import { FallbackHandler } from "./fallback";
+import { FallbackHandler } from "./fallback.js";
 export class FormatHandlerRegistry {
     _handlers = [];
     _fallback = new FallbackHandler();

package/dist/core/embed/utils.d.ts

@@ -1,7 +1,7 @@
 /**
  * utils.ts — Byte manipulation, MIME sniffing, and encoding helpers
  */
-import { FileLike } from "../types";
+import { FileLike } from "../types.js";
 /** Normalize any supported input into raw bytes, defensively copied. */
 export declare function normalizeToBytes(input: FileLike): Promise<Uint8Array>;
 export declare function normalizeToBlob(input: FileLike, mimeType?: string): Blob;

package/dist/core/embed/utils.js

@@ -1,8 +1,8 @@
 /**
  * utils.ts — Byte manipulation, MIME sniffing, and encoding helpers
  */
-import { MajikSignatureValidationError } from "../errors";
-import { CANONICAL_MTIME, TRAILER_MAGIC, TRAILER_SUFFIX_LENGTH, } from "./constants";
+import { MajikSignatureValidationError } from "../errors.js";
+import { CANONICAL_MTIME, TRAILER_MAGIC, TRAILER_SUFFIX_LENGTH, } from "./constants.js";
 /** Normalize any supported input into raw bytes, defensively copied. */
 export async function normalizeToBytes(input) {
     if (input instanceof Uint8Array)

package/dist/core/envelope.d.ts

@@ -18,8 +18,8 @@
  *     counterpart — same relationship as MajikSignatureJSON / MajikSignature.
  */
 import type { MajikKey } from "@majikah/majik-key";
-import type { EnvelopeInfo, EnvelopeInput, ExpectedSigner, FileLike, FileVersion, MajikSignatureEnvelopeJSON, MajikSignatureJSON, SealInfo, SealVerificationResult, SignatoriesFilter, SignatoriesResult, SignatoryInfo } from "./types";
-import type { MajikChainAnchor } from "../anchor/types";
+import type { EnvelopeInfo, EnvelopeInput, ExpectedSigner, FileLike, FileVersion, MajikSignatureEnvelopeJSON, MajikSignatureJSON, SealInfo, SealVerificationResult, SignatoriesFilter, SignatoriesResult, SignatoryInfo } from "./types.js";
+import type { MajikChainAnchor } from "../anchor/types.js";
 /**
  * Result of checking whether a key matches the envelope's signing allowlist.
  *

package/dist/core/envelope.js

@@ -19,10 +19,10 @@
  */
 import { sha3_512 } from "@noble/hashes/sha3.js";
 import { bytesToHex } from "@noble/hashes/utils.js";
-import { MAJIK_ENVELOPE_VERSION, MAJIK_SEAL_DOMAIN, MJKSIG_HEADER_LEN, MJKSIG_MAGIC, MJKSIG_MAGIC_LEN, MJKSIG_MEDIA_TYPE, MJKSIG_SUPPORTED_VERSIONS, MJKSIG_VERSION, } from "./constants";
-import { MajikSignatureAllowlistError, MajikSignatureError, MajikSignatureKeyError, MajikSignatureSerializationError, MajikSignatureValidationError, } from "./errors";
-import { hashContent, bytesToBase64 } from "./hash";
-import { normalizeToBytes } from "./embed/utils";
+import { MAJIK_ENVELOPE_VERSION, MAJIK_SEAL_DOMAIN, MJKSIG_HEADER_LEN, MJKSIG_MAGIC, MJKSIG_MAGIC_LEN, MJKSIG_MEDIA_TYPE, MJKSIG_SUPPORTED_VERSIONS, MJKSIG_VERSION, } from "./constants.js";
+import { MajikSignatureAllowlistError, MajikSignatureError, MajikSignatureKeyError, MajikSignatureSerializationError, MajikSignatureValidationError, } from "./errors.js";
+import { hashContent, bytesToBase64 } from "./hash.js";
+import { normalizeToBytes } from "./embed/utils.js";
 // ─── MajikSignatureEnvelope ────────────────────────────────────────────────────
 /**
  * Immutable, behavior-rich representation of a Majik Signature multi-signer

package/dist/core/mjksmap.d.ts

@@ -12,8 +12,8 @@
  *     batch are legitimate and must not collide. contentHash is retained
  *     per-entry as an integrity check and as a secondary lookup index.
  */
-import { MajikSignatureEnvelope } from "./envelope";
-import type { MjksMapEntry, MjksMapFindResult, MjksMapJSON, MjksMapResolveResult } from "./types";
+import { MajikSignatureEnvelope } from "./envelope.js";
+import type { MjksMapEntry, MjksMapFindResult, MjksMapJSON, MjksMapResolveResult } from "./types.js";
 export declare class MajikSignatureMap {
     #private;
     private readonly _version;

package/dist/core/mjksmap.js

@@ -12,10 +12,10 @@
  *     batch are legitimate and must not collide. contentHash is retained
  *     per-entry as an integrity check and as a secondary lookup index.
  */
-import { MajikSignatureSerializationError, MajikSignatureValidationError, } from "./errors";
-import { hashContent, bytesToBase64 } from "./hash";
-import { MajikSignatureEnvelope } from "./envelope";
-import { MJKSMAP_HEADER_LEN, MJKSMAP_MAGIC, MJKSMAP_MAGIC_LEN, MJKSMAP_MEDIA_TYPE, MJKSMAP_SUPPORTED_VERSIONS, MJKSMAP_VERSION, } from "./constants";
+import { MajikSignatureSerializationError, MajikSignatureValidationError, } from "./errors.js";
+import { hashContent, bytesToBase64 } from "./hash.js";
+import { MajikSignatureEnvelope } from "./envelope.js";
+import { MJKSMAP_HEADER_LEN, MJKSMAP_MAGIC, MJKSMAP_MAGIC_LEN, MJKSMAP_MEDIA_TYPE, MJKSMAP_SUPPORTED_VERSIONS, MJKSMAP_VERSION, } from "./constants.js";
 // ─── Path normalization ────────────────────────────────────────────────────────
 /**
  * Normalize a path for use as a map key: forward slashes, no leading slash,

package/dist/core/order.d.ts

@@ -17,8 +17,8 @@
  *     a caveat when order was decided using a self-reported clock.
  */
 import type { MajikKey } from "@majikah/majik-key";
-import type { MajikSignatureEnvelope } from "./envelope";
-import type { ExpectedSigner, MajikSignatureJSON, MajikSignerPublicKeys, VerificationResult } from "./types";
+import type { MajikSignatureEnvelope } from "./envelope.js";
+import type { ExpectedSigner, MajikSignatureJSON, MajikSignerPublicKeys, VerificationResult } from "./types.js";
 export type TimestampSource = "tsa" | "self-reported";
 export interface SignerOrderStatus {
     signerId: string;

package/dist/core/order.js

@@ -16,8 +16,8 @@
  *   - Every result surfaces `usesUnattestedTimestamp` so callers can show
  *     a caveat when order was decided using a self-reported clock.
  */
-import { MajikSignatureKeyError, MajikSignatureValidationError, } from "./errors";
-import { base64ToBytes, bytesToBase64 } from "./hash";
+import { MajikSignatureKeyError, MajikSignatureValidationError, } from "./errors.js";
+import { base64ToBytes, bytesToBase64 } from "./hash.js";
 // ─── Normalization ─────────────────────────────────────────────────────────
 function isExpectedSignerShape(v) {
     return typeof v.edPublicKey === "string";

package/dist/core/payload.d.ts

@@ -20,7 +20,7 @@
  * attestations cannot be confused with ordinary content signatures.
  */
 import { ISODateString, MajikKeyFingerprint } from "@majikah/majik-key";
-import { MajikTSAPayload } from "./types";
+import { MajikTSAPayload } from "./types.js";
 /**
  * Fields used to construct a canonical Majik Signature signing payload.
  *

package/dist/core/payload.js

@@ -19,7 +19,7 @@
  * The TSA payload uses a separate domain (`MAJIK_TSA_DOMAIN`) so timestamp
  * attestations cannot be confused with ordinary content signatures.
  */
-import { MAJIK_SIGNATURE_DOMAIN, MAJIK_SIGNATURE_VERSION, MAJIK_TSA_DOMAIN, } from "./constants";
+import { MAJIK_SIGNATURE_DOMAIN, MAJIK_SIGNATURE_VERSION, MAJIK_TSA_DOMAIN, } from "./constants.js";
 /**
  * Build the canonical byte payload signed by both Majik Signature algorithms.
  *

package/dist/core/stamp/core/payload.d.ts

@@ -13,7 +13,7 @@
  * The JSON object is sorted by key for determinism. The string is then
  * UTF-8 encoded to produce the final bytes that are signed.
  */
-import type { ImageSigningPayloadFields } from "./types";
+import type { ImageSigningPayloadFields } from "./types.js";
 /**
  * Build the canonical byte payload that Ed25519 signs.
  * Must be deterministic — same inputs always produce same bytes.

package/dist/core/stamp/core/stub.d.ts

@@ -57,7 +57,7 @@
  * At 0.5 bits/block at Q70: needs ~3600 blocks → ~480x480px minimum
  * Our minimum is 640x640 → comfortable (480 bytes capacity, 113% headroom).
  */
-import type { ImageSignatureStub } from "./types";
+import type { ImageSignatureStub } from "./types.js";
 declare const STUB_SIZE = 150;
 /**
  * Serialize an ImageSignatureStub to compact binary (150 bytes).

package/dist/core/stamp/image-signature.d.ts

@@ -74,7 +74,7 @@ export interface MajikSignatureStaticAdapter {
         reason?: string;
     }>>;
 }
-import type { ImageSignatureStub, ImageSignOptions } from "./core/types";
+import type { ImageSignatureStub, ImageSignOptions } from "./core/types.js";
 export type VerificationLayer = "both" | "pixel-row" | "dct-only";
 export interface ImageVerificationResult {
     valid: boolean;

package/dist/core/stamp/image-signature.js

@@ -35,13 +35,13 @@
  *   9. Encode output (PNG default)
  */
 import * as ed25519 from "@stablelib/ed25519";
-import { computePHash, pHashMatches, hammingDistance } from "./core/phash";
-import { dctEmbed, dctExtract, dctCapacity } from "./core/dct-stego";
-import { rsEncode, rsDecode, RS_TOTAL_BYTES } from "./core/reed-solomon";
-import { serializeStub, deserializeStub } from "./core/stub";
-import { buildImageSigningPayload } from "./core/payload";
-import { pixelRowEmbed, pixelRowExtract, pixelRowStrip, } from "./core/pixel-row";
-import { decodeImage, encodeImage, padToMinimum, MIN_DIMENSION, } from "./core/image-utils";
+import { computePHash, pHashMatches, hammingDistance } from "./core/phash.js";
+import { dctEmbed, dctExtract, dctCapacity } from "./core/dct-stego.js";
+import { rsEncode, rsDecode, RS_TOTAL_BYTES } from "./core/reed-solomon.js";
+import { serializeStub, deserializeStub } from "./core/stub.js";
+import { buildImageSigningPayload } from "./core/payload.js";
+import { pixelRowEmbed, pixelRowExtract, pixelRowStrip, } from "./core/pixel-row.js";
+import { decodeImage, encodeImage, padToMinimum, MIN_DIMENSION, } from "./core/image-utils.js";
 // ─── Errors ───────────────────────────────────────────────────────────────────
 export class MajikImageSignatureError extends Error {
     constructor(message, cause) {

package/dist/core/stamp/index.d.ts

@@ -31,13 +31,13 @@
  * const { blob } = await MajikImageSignature.sign(imageBlob, key, MajikSignature);
  * ```
  */
-export { MajikImageSignature, MajikImageSignatureError, MajikImageCapacityError, } from "./image-signature";
-export type { ImageVerificationResult, VerificationLayer, } from "./image-signature";
-export type { ImageSignatureStub, ImageSignOptions } from "./core/types";
-export { computePHash, hammingDistance, pHashMatches } from "./core/phash";
-export { dctEmbed, dctExtract, dctCapacity } from "./core/dct-stego";
-export { rsEncode, rsDecode, RS_DATA_BYTES, RS_ECC_BYTES, RS_TOTAL_BYTES, } from "./core/reed-solomon";
-export { serializeStub, deserializeStub, STUB_SIZE } from "./core/stub";
-export { buildImageSigningPayload } from "./core/payload";
-export { pixelRowEmbed, pixelRowExtract, pixelRowStrip, pixelRowHasSignature, } from "./core/pixel-row";
-export { decodeImage, encodeImage, padToMinimum, MIN_DIMENSION, } from "./core/image-utils";
+export { MajikImageSignature, MajikImageSignatureError, MajikImageCapacityError, } from "./image-signature.js";
+export type { ImageVerificationResult, VerificationLayer, } from "./image-signature.js";
+export type { ImageSignatureStub, ImageSignOptions } from "./core/types.js";
+export { computePHash, hammingDistance, pHashMatches } from "./core/phash.js";
+export { dctEmbed, dctExtract, dctCapacity } from "./core/dct-stego.js";
+export { rsEncode, rsDecode, RS_DATA_BYTES, RS_ECC_BYTES, RS_TOTAL_BYTES, } from "./core/reed-solomon.js";
+export { serializeStub, deserializeStub, STUB_SIZE } from "./core/stub.js";
+export { buildImageSigningPayload } from "./core/payload.js";
+export { pixelRowEmbed, pixelRowExtract, pixelRowStrip, pixelRowHasSignature, } from "./core/pixel-row.js";
+export { decodeImage, encodeImage, padToMinimum, MIN_DIMENSION, } from "./core/image-utils.js";

package/dist/core/stamp/index.js

@@ -32,15 +32,15 @@
  * ```
  */
 // ── Primary class ─────────────────────────────────────────────────────────────
-export { MajikImageSignature, MajikImageSignatureError, MajikImageCapacityError, } from "./image-signature";
+export { MajikImageSignature, MajikImageSignatureError, MajikImageCapacityError, } from "./image-signature.js";
 // ── Advanced / testing primitives ─────────────────────────────────────────────
 //
 // These are intentionally not re-exported from the main majik-signature index.
 // Import from '@majikah/majik-signature/stamp' if you need them directly.
-export { computePHash, hammingDistance, pHashMatches } from "./core/phash";
-export { dctEmbed, dctExtract, dctCapacity } from "./core/dct-stego";
-export { rsEncode, rsDecode, RS_DATA_BYTES, RS_ECC_BYTES, RS_TOTAL_BYTES, } from "./core/reed-solomon";
-export { serializeStub, deserializeStub, STUB_SIZE } from "./core/stub";
-export { buildImageSigningPayload } from "./core/payload";
-export { pixelRowEmbed, pixelRowExtract, pixelRowStrip, pixelRowHasSignature, } from "./core/pixel-row";
-export { decodeImage, encodeImage, padToMinimum, MIN_DIMENSION, } from "./core/image-utils";
+export { computePHash, hammingDistance, pHashMatches } from "./core/phash.js";
+export { dctEmbed, dctExtract, dctCapacity } from "./core/dct-stego.js";
+export { rsEncode, rsDecode, RS_DATA_BYTES, RS_ECC_BYTES, RS_TOTAL_BYTES, } from "./core/reed-solomon.js";
+export { serializeStub, deserializeStub, STUB_SIZE } from "./core/stub.js";
+export { buildImageSigningPayload } from "./core/payload.js";
+export { pixelRowEmbed, pixelRowExtract, pixelRowStrip, pixelRowHasSignature, } from "./core/pixel-row.js";
+export { decodeImage, encodeImage, padToMinimum, MIN_DIMENSION, } from "./core/image-utils.js";

package/dist/core/types.d.ts

@@ -7,9 +7,9 @@
  * inspect the implementation when working with IntelliSense or generated docs.
  */
 import type { ISODateString, MajikKeyFingerprint } from "@majikah/majik-key";
-import type { MajikChainAnchor } from "../anchor/types";
-import type { ContentType } from "./constants";
-import type { MajikSignatureEnvelope } from "./envelope";
+import type { MajikChainAnchor } from "../anchor/types.js";
+import type { ContentType } from "./constants.js";
+import type { MajikSignatureEnvelope } from "./envelope.js";
 /** Standard content-type constants exposed by Majik Signature. */
 export type { ContentType };
 /**

package/dist/core/validator.d.ts

@@ -3,7 +3,7 @@
  * Input validation and assertion helpers for MajikSignature.
  */
 import { ISODateString } from "@majikah/majik-key";
-import type { ExpectedSigner, MajikSignatureJSON, MajikSignerPublicKeys, MajikTimestamp, MajikTSAPayload, MultiSigEnvelope } from "./types";
+import type { ExpectedSigner, MajikSignatureJSON, MajikSignerPublicKeys, MajikTimestamp, MajikTSAPayload, MultiSigEnvelope } from "./types.js";
 export declare class MajikSignatureValidator {
     static assert(condition: unknown, message: string, field?: string): asserts condition;
     static assertDefined<T>(value: T | undefined | null, field: string): asserts value is T;

package/dist/core/validator.js

@@ -2,8 +2,8 @@
  * validator.ts
  * Input validation and assertion helpers for MajikSignature.
  */
-import { MAJIK_SIGNATURE_VERSION, MAJIK_ENVELOPE_VERSION, MIN_ED_PUBLIC_KEY_B64_LEN, MIN_DSA_PUBLIC_KEY_B64_LEN, MIN_SIGNATURE_B64_LEN, CONTENT_HASH_B64_LEN, ALLOWLIST_HASH_B64_LEN, SEAL_HASH_HEX_LEN, } from "./constants";
-import { MajikSignatureValidationError, MajikSignatureKeyError, } from "./errors";
+import { MAJIK_SIGNATURE_VERSION, MAJIK_ENVELOPE_VERSION, MIN_ED_PUBLIC_KEY_B64_LEN, MIN_DSA_PUBLIC_KEY_B64_LEN, MIN_SIGNATURE_B64_LEN, CONTENT_HASH_B64_LEN, ALLOWLIST_HASH_B64_LEN, SEAL_HASH_HEX_LEN, } from "./constants.js";
+import { MajikSignatureValidationError, MajikSignatureKeyError, } from "./errors.js";
 export class MajikSignatureValidator {
     // ── Assertions ──────────────────────────────────────────────────────────────
     static assert(condition, message, field) {

package/dist/index.d.ts

@@ -2,17 +2,17 @@
  * index.ts
  * Public API surface for majik-signature.
  */
-export { MajikSignature } from "./majik-signature";
-export type * from "./core/types";
-export * from "./core/errors";
-export * from "./core/constants";
+export { MajikSignature } from "./majik-signature.js";
+export type * from "./core/types.js";
+export * from "./core/errors.js";
+export * from "./core/constants.js";
 export * from "./core/embed/handlers";
-export * from "./core/embed/majik-embed";
-export * from "./core/envelope";
-export * from "./core/mjksmap";
-export * from "./cli";
+export * from "./core/embed/majik-embed.js";
+export * from "./core/envelope.js";
+export * from "./core/mjksmap.js";
+export * from "./cli.js";
 export * from "./cli-core";
-export type * from "./anchor/types";
-export { buildSigningPayload } from "./core/payload";
-export { hashContent, bytesToBase64, base64ToBytes } from "./core/hash";
-export { MajikSignatureValidator } from "./core/validator";
+export type * from "./anchor/types.js";
+export { buildSigningPayload } from "./core/payload.js";
+export { hashContent, bytesToBase64, base64ToBytes } from "./core/hash.js";
+export { MajikSignatureValidator } from "./core/validator.js";

package/dist/index.js

@@ -3,21 +3,21 @@
  * Public API surface for majik-signature.
  */
 // ── Main class ────────────────────────────────────────────────────────────────
-export { MajikSignature } from "./majik-signature";
+export { MajikSignature } from "./majik-signature.js";
 // ── Errors ────────────────────────────────────────────────────────────────────
-export * from "./core/errors";
+export * from "./core/errors.js";
 // ── Constants ─────────────────────────────────────────────────────────────────
-export * from "./core/constants";
+export * from "./core/constants.js";
 export * from "./core/embed/handlers";
-export * from "./core/embed/majik-embed";
-export * from "./core/envelope";
-export * from "./core/mjksmap";
-export * from "./cli";
+export * from "./core/embed/majik-embed.js";
+export * from "./core/envelope.js";
+export * from "./core/mjksmap.js";
+export * from "./cli.js";
 export * from "./cli-core";
 // ── Low-level utilities (opt-in) ──────────────────────────────────────────────
 // These are exported for consumers who want to build on top of the primitives
 // without going through MajikSignature (e.g. streaming hash pipelines,
 // custom envelope formats). Not needed for normal sign/verify usage.
-export { buildSigningPayload } from "./core/payload";
-export { hashContent, bytesToBase64, base64ToBytes } from "./core/hash";
-export { MajikSignatureValidator } from "./core/validator";
+export { buildSigningPayload } from "./core/payload.js";
+export { hashContent, bytesToBase64, base64ToBytes } from "./core/hash.js";
+export { MajikSignatureValidator } from "./core/validator.js";

package/dist/majik-signature.d.ts

@@ -4,13 +4,13 @@
  *
  */
 import type { ISODateString, MajikKey, MajikKeyFingerprint } from "@majikah/majik-key";
-import type { BatchFileInput, BatchSignOptions, BatchVerifyInput, BatchVerifyOptions, ED25519Signature, EnvelopeInfo, EnvelopeInput, ExpectedSigner, FileChainVerification, FileLike, FileVerifyResult, MajikSignatureCompactJSON, MajikSignatureEnvelopeJSON, MajikSignatureJSON, MajikSignerPublicKeys, MajikTimestamp, MajikTSARequest, MLDSA87Signature, RevisionCommitmentResult, RevisionSetVerification, SealInfo, SealVerificationResult, SignatoriesFilter, SignatoriesResult, SignatoryInfo, SignOptions, VerificationResult } from "./core/types";
-import { MajikSignatureEmbed } from "./core/embed/majik-embed";
-import type { ImageVerificationResult, ImageSignOptions, ImageSignatureStub } from "./core/stamp";
-import { MajikChainAnchor, MajikChainAnchorMemo } from "./anchor/types";
-import { MajikSignatureEnvelope } from "./core/envelope";
-import { MajikSignatureMap } from "./core/mjksmap";
-import { SignatureOrderResult } from "./core/order";
+import type { BatchFileInput, BatchSignOptions, BatchVerifyInput, BatchVerifyOptions, ED25519Signature, EnvelopeInfo, EnvelopeInput, ExpectedSigner, FileChainVerification, FileLike, FileVerifyResult, MajikSignatureCompactJSON, MajikSignatureEnvelopeJSON, MajikSignatureJSON, MajikSignerPublicKeys, MajikTimestamp, MajikTSARequest, MLDSA87Signature, RevisionCommitmentResult, RevisionSetVerification, SealInfo, SealVerificationResult, SignatoriesFilter, SignatoriesResult, SignatoryInfo, SignOptions, VerificationResult } from "./core/types.js";
+import { MajikSignatureEmbed } from "./core/embed/majik-embed.js";
+import type { ImageVerificationResult, ImageSignOptions, ImageSignatureStub } from "./core/stamp/index.js";
+import { MajikChainAnchor, MajikChainAnchorMemo } from "./anchor/types.js";
+import { MajikSignatureEnvelope } from "./core/envelope.js";
+import { MajikSignatureMap } from "./core/mjksmap.js";
+import { SignatureOrderResult } from "./core/order.js";
 /**
  * Majik Signature
  * ---

package/dist/majik-signature.js

@@ -5,15 +5,15 @@
  */
 import * as ed25519 from "@stablelib/ed25519";
 import { ml_dsa87 } from "@noble/post-quantum/ml-dsa.js";
-import { MAJIK_NOTARY_MEMO_DOMAIN, MAJIK_SIGNATURE_VERSION, MAJIK_TIMESTAMP_VERSION, } from "./core/constants";
-import { MajikSignatureError, MajikSignatureKeyError, MajikSignatureVerificationError, MajikSignatureSerializationError, } from "./core/errors";
-import { MajikSignatureValidator } from "./core/validator";
-import { buildSigningPayload, buildTSACanonicalBytes } from "./core/payload";
-import { hashContent, bytesToBase64, base64ToBytes } from "./core/hash";
-import { MajikSignatureEmbed } from "./core/embed/majik-embed";
+import { MAJIK_NOTARY_MEMO_DOMAIN, MAJIK_SIGNATURE_VERSION, MAJIK_TIMESTAMP_VERSION, } from "./core/constants.js";
+import { MajikSignatureError, MajikSignatureKeyError, MajikSignatureVerificationError, MajikSignatureSerializationError, } from "./core/errors.js";
+import { MajikSignatureValidator } from "./core/validator.js";
+import { buildSigningPayload, buildTSACanonicalBytes } from "./core/payload.js";
+import { hashContent, bytesToBase64, base64ToBytes } from "./core/hash.js";
+import { MajikSignatureEmbed } from "./core/embed/majik-embed.js";
 // ── Stamp (image signing) imports ─────────────────────────────────────────────
-import { MajikImageSignature } from "./core/stamp/image-signature";
-import { normalizeExpectedOrder as normalizeExpectedOrderUtil, } from "./core/order";
+import { MajikImageSignature } from "./core/stamp/image-signature.js";
+import { normalizeExpectedOrder as normalizeExpectedOrderUtil, } from "./core/order.js";
 const secureFill = Uint8Array.prototype.fill;
 /**
  * Majik Signature

package/package.json

@@ -2,7 +2,7 @@
   "name": "@majikah/majik-signature",
   "type": "module",
   "description": "Majik Signature is a hybrid post-quantum content signing and verification library for the Majikah ecosystem. Built on top of Majik Key, it provides tamper-proof, forgery-resistant digital signatures for any content format — using a dual-algorithm architecture that combines classical Ed25519 with post-quantum ML-DSA-87 (FIPS-204).",
-  "version": "0.8.0",
+  "version": "0.8.2",
   "license": "Apache-2.0",
   "author": "Zelijah",
   "main": "./dist/index.js",