@lanonasis/oauth-client 1.2.1 → 1.2.3

package/dist/browser.cjs

@@ -0,0 +1,793 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/browser.ts
+var browser_exports = {};
+__export(browser_exports, {
+  ApiKeyStorageWeb: () => ApiKeyStorageWeb,
+  BaseOAuthFlow: () => BaseOAuthFlow,
+  DesktopOAuthFlow: () => DesktopOAuthFlow,
+  MCPClient: () => MCPClient,
+  TokenStorageWeb: () => TokenStorageWeb
+});
+module.exports = __toCommonJS(browser_exports);
+
+// src/flows/base-flow.ts
+var import_cross_fetch = __toESM(require("cross-fetch"), 1);
+var BaseOAuthFlow = class {
+  constructor(config) {
+    this.clientId = config.clientId;
+    this.authBaseUrl = config.authBaseUrl || "https://auth.lanonasis.com";
+    this.scope = config.scope || "memories:read memories:write memories:delete profile";
+  }
+  async makeTokenRequest(body) {
+    const response = await (0, import_cross_fetch.default)(`${this.authBaseUrl}/oauth/token`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body)
+    });
+    const data = await response.json();
+    if (!response.ok) {
+      throw new Error(data.error_description || "Token request failed");
+    }
+    return data;
+  }
+  generateState() {
+    const array = new Uint8Array(32);
+    if (typeof crypto !== "undefined" && crypto.getRandomValues) {
+      crypto.getRandomValues(array);
+    } else {
+      throw new Error("Secure random generation is not available");
+    }
+    return this.base64URLEncode(array);
+  }
+  base64URLEncode(buffer) {
+    const bytes = buffer instanceof ArrayBuffer ? new Uint8Array(buffer) : buffer;
+    let binary = "";
+    bytes.forEach((byte) => {
+      binary += String.fromCharCode(byte);
+    });
+    const base64 = typeof btoa !== "undefined" ? btoa(binary) : Buffer.from(bytes).toString("base64");
+    return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+  }
+  async refreshToken(refreshToken) {
+    return this.makeTokenRequest({
+      grant_type: "refresh_token",
+      refresh_token: refreshToken,
+      client_id: this.clientId
+    });
+  }
+  async revokeToken(token, tokenType = "access_token") {
+    const response = await (0, import_cross_fetch.default)(`${this.authBaseUrl}/oauth/revoke`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        token,
+        token_type_hint: tokenType,
+        client_id: this.clientId
+      })
+    });
+    if (!response.ok) {
+      throw new Error("Failed to revoke token");
+    }
+  }
+};
+
+// src/flows/desktop-flow.ts
+var DesktopOAuthFlow = class extends BaseOAuthFlow {
+  constructor(config) {
+    super({
+      ...config,
+      clientId: config.clientId || "lanonasis-mcp-desktop"
+    });
+    this.authWindow = null;
+    this.redirectUri = config.redirectUri || "lanonasis://oauth/callback";
+  }
+  async authenticate() {
+    const pkce = await this.generatePKCEChallenge();
+    const state = this.generateState();
+    const authUrl = this.buildAuthorizationUrl(pkce.codeChallenge, state);
+    const authCode = await this.openAuthWindow(authUrl, state);
+    return await this.exchangeCodeForToken(authCode, pkce.codeVerifier);
+  }
+  async generatePKCEChallenge() {
+    const codeVerifier = this.generateCodeVerifier();
+    const codeChallenge = await this.generateCodeChallenge(codeVerifier);
+    return { codeVerifier, codeChallenge };
+  }
+  generateCodeVerifier() {
+    const array = new Uint8Array(32);
+    if (typeof crypto !== "undefined" && crypto.getRandomValues) {
+      crypto.getRandomValues(array);
+    } else {
+      throw new Error("Secure random generation is not available in this environment");
+    }
+    return this.base64URLEncode(array);
+  }
+  async generateCodeChallenge(verifier) {
+    const subtle = typeof crypto !== "undefined" ? crypto.subtle : void 0;
+    if (!subtle) {
+      throw new Error("Web Crypto is required to generate PKCE code challenge");
+    }
+    const encoder = new TextEncoder();
+    const data = encoder.encode(verifier);
+    const hash = await subtle.digest("SHA-256", data);
+    return this.base64URLEncode(hash);
+  }
+  buildAuthorizationUrl(codeChallenge, state) {
+    const params = new URLSearchParams({
+      client_id: this.clientId,
+      response_type: "code",
+      redirect_uri: this.redirectUri,
+      scope: this.scope,
+      code_challenge: codeChallenge,
+      code_challenge_method: "S256",
+      state
+    });
+    return `${this.authBaseUrl}/oauth/authorize?${params}`;
+  }
+  async openAuthWindow(authUrl, expectedState) {
+    return new Promise((resolve, reject) => {
+      if (typeof window !== "undefined") {
+        this.openBrowserWindow(authUrl, expectedState, resolve, reject);
+      } else {
+        this.openElectronWindow(authUrl, expectedState, resolve, reject);
+      }
+    });
+  }
+  openBrowserWindow(authUrl, expectedState, resolve, reject) {
+    const width = 500;
+    const height = 700;
+    const left = (window.screen.width - width) / 2;
+    const top = (window.screen.height - height) / 2;
+    this.authWindow = window.open(
+      authUrl,
+      "Lan Onasis Login",
+      `width=${width},height=${height},left=${left},top=${top},toolbar=no,menubar=no`
+    );
+    if (!this.authWindow) {
+      reject(new Error("Failed to open authentication window"));
+      return;
+    }
+    const checkInterval = setInterval(() => {
+      try {
+        if (!this.authWindow || this.authWindow.closed) {
+          clearInterval(checkInterval);
+          reject(new Error("Authentication window was closed"));
+          return;
+        }
+        const currentUrl = this.authWindow.location.href;
+        if (currentUrl.startsWith(this.redirectUri)) {
+          clearInterval(checkInterval);
+          this.authWindow.close();
+          const url = new URL(currentUrl);
+          const code = url.searchParams.get("code");
+          const state = url.searchParams.get("state");
+          const error = url.searchParams.get("error");
+          if (error) {
+            reject(new Error(url.searchParams.get("error_description") || error));
+          } else if (state !== expectedState) {
+            reject(new Error("State mismatch - possible CSRF attack"));
+          } else if (code) {
+            resolve(code);
+          } else {
+            reject(new Error("No authorization code received"));
+          }
+        }
+      } catch (e) {
+      }
+    }, 500);
+  }
+  openElectronWindow(authUrl, expectedState, resolve, reject) {
+    const { BrowserWindow } = require("electron");
+    const authWindow = new BrowserWindow({
+      width: 500,
+      height: 700,
+      webPreferences: {
+        nodeIntegration: false,
+        contextIsolation: true
+      }
+    });
+    authWindow.loadURL(authUrl);
+    authWindow.webContents.on("will-redirect", (event, url) => {
+      if (url.startsWith(this.redirectUri)) {
+        event.preventDefault();
+        authWindow.close();
+        const callbackUrl = new URL(url);
+        const code = callbackUrl.searchParams.get("code");
+        const state = callbackUrl.searchParams.get("state");
+        const error = callbackUrl.searchParams.get("error");
+        if (error) {
+          reject(new Error(callbackUrl.searchParams.get("error_description") || error));
+        } else if (state !== expectedState) {
+          reject(new Error("State mismatch"));
+        } else if (code) {
+          resolve(code);
+        }
+      }
+    });
+    authWindow.on("closed", () => {
+      reject(new Error("Authentication window was closed"));
+    });
+  }
+  async exchangeCodeForToken(code, codeVerifier) {
+    return this.makeTokenRequest({
+      grant_type: "authorization_code",
+      code,
+      client_id: this.clientId,
+      redirect_uri: this.redirectUri,
+      code_verifier: codeVerifier
+    });
+  }
+};
+
+// src/client/mcp-client-browser.ts
+var import_cross_fetch3 = __toESM(require("cross-fetch"), 1);
+
+// src/storage/token-storage-web.ts
+var TokenStorageWeb = class {
+  constructor() {
+    this.storageKey = "lanonasis_mcp_tokens";
+    this.webEncryptionKeyStorage = "lanonasis_web_token_enc_key";
+  }
+  async store(tokens) {
+    const tokensWithTimestamp = {
+      ...tokens,
+      issued_at: Date.now()
+    };
+    const tokenString = JSON.stringify(tokensWithTimestamp);
+    const encrypted = await this.encrypt(tokenString);
+    localStorage.setItem(this.storageKey, encrypted);
+  }
+  async retrieve() {
+    const encrypted = localStorage.getItem(this.storageKey);
+    if (!encrypted) return null;
+    try {
+      const tokenString = await this.decrypt(encrypted);
+      return JSON.parse(tokenString);
+    } catch {
+      return null;
+    }
+  }
+  async clear() {
+    localStorage.removeItem(this.storageKey);
+  }
+  isTokenExpired(tokens) {
+    if (tokens.token_type === "api-key" || tokens.expires_in === 0) return false;
+    if (!tokens.expires_in) return false;
+    if (!tokens.issued_at) return true;
+    const expiresAt = tokens.issued_at + tokens.expires_in * 1e3;
+    return expiresAt - Date.now() < 3e5;
+  }
+  async encrypt(text) {
+    if (typeof window === "undefined" || !window.crypto?.subtle) {
+      const encoder2 = new TextEncoder();
+      return this.base64Encode(encoder2.encode(text));
+    }
+    const encoder = new TextEncoder();
+    const data = encoder.encode(text);
+    const passphrase = await this.getWebEncryptionKey();
+    const keyMaterial = await window.crypto.subtle.importKey(
+      "raw",
+      encoder.encode(passphrase),
+      "PBKDF2",
+      false,
+      ["deriveBits", "deriveKey"]
+    );
+    const key = await window.crypto.subtle.deriveKey(
+      {
+        name: "PBKDF2",
+        salt: encoder.encode("lanonasis-token-salt"),
+        iterations: 1e5,
+        hash: "SHA-256"
+      },
+      keyMaterial,
+      { name: "AES-GCM", length: 256 },
+      true,
+      ["encrypt", "decrypt"]
+    );
+    const iv = window.crypto.getRandomValues(new Uint8Array(12));
+    const encrypted = await window.crypto.subtle.encrypt(
+      { name: "AES-GCM", iv },
+      key,
+      data
+    );
+    const combined = new Uint8Array(iv.length + encrypted.byteLength);
+    combined.set(iv, 0);
+    combined.set(new Uint8Array(encrypted), iv.length);
+    return this.base64Encode(combined);
+  }
+  async decrypt(encrypted) {
+    if (typeof window === "undefined" || !window.crypto?.subtle) {
+      const decoder2 = new TextDecoder();
+      return decoder2.decode(this.base64Decode(encrypted));
+    }
+    const bytes = this.base64Decode(encrypted);
+    const iv = bytes.slice(0, 12);
+    const data = bytes.slice(12);
+    const encoder = new TextEncoder();
+    const decoder = new TextDecoder();
+    const passphrase = await this.getWebEncryptionKey();
+    const keyMaterial = await window.crypto.subtle.importKey(
+      "raw",
+      encoder.encode(passphrase),
+      "PBKDF2",
+      false,
+      ["deriveBits", "deriveKey"]
+    );
+    const key = await window.crypto.subtle.deriveKey(
+      {
+        name: "PBKDF2",
+        salt: encoder.encode("lanonasis-token-salt"),
+        iterations: 1e5,
+        hash: "SHA-256"
+      },
+      keyMaterial,
+      { name: "AES-GCM", length: 256 },
+      true,
+      ["encrypt", "decrypt"]
+    );
+    const decrypted = await window.crypto.subtle.decrypt(
+      { name: "AES-GCM", iv },
+      key,
+      data
+    );
+    return decoder.decode(decrypted);
+  }
+  async getWebEncryptionKey() {
+    const existing = localStorage.getItem(this.webEncryptionKeyStorage);
+    if (existing) return existing;
+    const buf = new Uint8Array(32);
+    if (typeof window !== "undefined" && window.crypto?.getRandomValues) {
+      window.crypto.getRandomValues(buf);
+    }
+    const raw = Array.from(buf).map((b) => b.toString(16).padStart(2, "0")).join("");
+    localStorage.setItem(this.webEncryptionKeyStorage, raw);
+    return raw;
+  }
+  base64Encode(bytes) {
+    let binary = "";
+    bytes.forEach((b) => {
+      binary += String.fromCharCode(b);
+    });
+    return btoa(binary);
+  }
+  base64Decode(value) {
+    const binary = atob(value);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) {
+      bytes[i] = binary.charCodeAt(i);
+    }
+    return bytes;
+  }
+};
+
+// src/flows/apikey-flow.ts
+var import_cross_fetch2 = __toESM(require("cross-fetch"), 1);
+var APIKeyFlow = class extends BaseOAuthFlow {
+  constructor(apiKey, authBaseUrl = "https://mcp.lanonasis.com") {
+    super({
+      clientId: "api-key-client",
+      authBaseUrl
+    });
+    this.apiKey = apiKey;
+  }
+  /**
+   * "Authenticate" by returning the API key as a virtual token
+   * The API key will be used directly in request headers
+   */
+  async authenticate() {
+    if (!this.apiKey || !this.apiKey.startsWith("lano_") && !this.apiKey.startsWith("vx_")) {
+      throw new Error(
+        'Invalid API key format. Must start with "lano_" or "vx_". Please regenerate your API key from the dashboard.'
+      );
+    }
+    if (this.apiKey.startsWith("vx_")) {
+      console.warn(
+        '\u26A0\uFE0F  DEPRECATION WARNING: API keys with "vx_" prefix are deprecated and will stop working soon. Please regenerate your API key from the dashboard to get a "lano_" prefixed key. Support for "vx_" keys will be removed in a future version.'
+      );
+    }
+    return {
+      access_token: this.apiKey,
+      token_type: "api-key",
+      expires_in: 0,
+      // API keys don't expire
+      issued_at: Date.now()
+    };
+  }
+  /**
+   * API keys don't need refresh
+   */
+  async refreshToken(refreshToken) {
+    throw new Error("API keys do not support token refresh");
+  }
+  /**
+   * Optional: Validate API key by making a test request
+   */
+  async validateAPIKey() {
+    try {
+      const response = await (0, import_cross_fetch2.default)(`${this.config.authBaseUrl}/api/v1/health`, {
+        headers: {
+          "x-api-key": this.apiKey
+        }
+      });
+      return response.ok;
+    } catch (error) {
+      console.error("API key validation failed:", error);
+      return false;
+    }
+  }
+};
+
+// src/client/mcp-client-browser.ts
+var MCPClient = class {
+  constructor(config = {}) {
+    this.ws = null;
+    this.eventSource = null;
+    this.accessToken = null;
+    this.refreshTimer = null;
+    this.config = {
+      mcpEndpoint: "wss://mcp.lanonasis.com",
+      autoRefresh: true,
+      ...config
+    };
+    this.tokenStorage = config.tokenStorage || new TokenStorageWeb();
+    this.authMode = config.apiKey ? "apikey" : "oauth";
+    if (this.authMode === "apikey") {
+      this.authFlow = new APIKeyFlow(
+        config.apiKey,
+        config.authBaseUrl || "https://mcp.lanonasis.com"
+      );
+    } else {
+      this.authFlow = new DesktopOAuthFlow(config);
+    }
+  }
+  async connect() {
+    try {
+      let tokens = await this.tokenStorage.retrieve();
+      if (this.authMode === "apikey") {
+        if (!tokens) {
+          tokens = await this.authenticate();
+        }
+        this.accessToken = tokens.access_token;
+      } else {
+        if (!tokens || this.tokenStorage.isTokenExpired(tokens)) {
+          if (tokens?.refresh_token) {
+            try {
+              tokens = await this.authFlow.refreshToken(tokens.refresh_token);
+              await this.tokenStorage.store(tokens);
+            } catch (error) {
+              tokens = await this.authenticate();
+            }
+          } else {
+            tokens = await this.authenticate();
+          }
+        }
+        this.accessToken = tokens.access_token;
+        if (this.config.autoRefresh && tokens.expires_in) {
+          this.scheduleTokenRefresh(tokens.expires_in);
+        }
+      }
+      await this.establishConnection();
+    } catch (error) {
+      console.error("MCP connection failed:", error);
+      throw error;
+    }
+  }
+  async authenticate() {
+    const tokens = await this.authFlow.authenticate();
+    await this.tokenStorage.store(tokens);
+    return tokens;
+  }
+  async ensureAccessToken() {
+    if (!this.accessToken) {
+      await this.connect();
+    }
+    return this.accessToken;
+  }
+  scheduleTokenRefresh(expiresIn) {
+    const refreshTime = (expiresIn - 300) * 1e3;
+    if (this.refreshTimer) {
+      clearTimeout(this.refreshTimer);
+    }
+    this.refreshTimer = setTimeout(async () => {
+      try {
+        const tokens = await this.tokenStorage.retrieve();
+        if (tokens?.refresh_token) {
+          const newTokens = await this.authFlow.refreshToken(tokens.refresh_token);
+          await this.tokenStorage.store(newTokens);
+          this.accessToken = newTokens.access_token;
+          if (newTokens.expires_in) {
+            this.scheduleTokenRefresh(newTokens.expires_in);
+          }
+        }
+      } catch (error) {
+        console.error("Token refresh failed:", error);
+        await this.connect();
+      }
+    }, refreshTime);
+  }
+  async establishConnection() {
+    const endpoint = this.config.mcpEndpoint;
+    if (endpoint.startsWith("ws://") || endpoint.startsWith("wss://")) {
+      await this.connectWebSocket(endpoint);
+    } else {
+      await this.connectSSE(endpoint);
+    }
+  }
+  async connectWebSocket(endpoint) {
+    if (typeof WebSocket !== "undefined") {
+      this.ws = new WebSocket(endpoint);
+      this.ws.onopen = () => {
+        console.log("MCP WebSocket connected");
+        this.ws?.send(JSON.stringify({
+          type: "auth",
+          token: this.accessToken
+        }));
+      };
+      this.ws.onmessage = (event) => {
+        this.handleMessage(JSON.parse(event.data));
+      };
+      this.ws.onerror = (error) => {
+        console.error("MCP WebSocket error:", error);
+      };
+      this.ws.onclose = () => {
+        console.log("MCP WebSocket disconnected");
+        setTimeout(() => this.reconnect(), 5e3);
+      };
+    } else {
+      throw new Error("WebSocket is not available in this environment");
+    }
+  }
+  async connectSSE(endpoint) {
+    const sseUrl = new URL(endpoint);
+    if (typeof EventSource !== "undefined") {
+      if (this.authMode === "apikey") {
+        sseUrl.searchParams.set("api_key", this.accessToken);
+      } else {
+        sseUrl.searchParams.set("token", this.accessToken);
+      }
+      this.eventSource = new EventSource(sseUrl.toString());
+      this.eventSource.onopen = () => {
+        console.log("MCP SSE connected");
+      };
+      this.eventSource.onmessage = (event) => {
+        this.handleMessage(JSON.parse(event.data));
+      };
+      this.eventSource.onerror = () => {
+        console.error("MCP SSE error");
+        this.eventSource?.close();
+        setTimeout(() => this.reconnect(), 5e3);
+      };
+    } else {
+      throw new Error("EventSource is not available in this environment");
+    }
+  }
+  handleMessage(message) {
+    console.log("MCP message:", message);
+  }
+  async reconnect() {
+    try {
+      await this.connect();
+    } catch (error) {
+      console.error("Reconnection failed:", error);
+      setTimeout(() => this.reconnect(), 1e4);
+    }
+  }
+  async request(method, params) {
+    await this.ensureAccessToken();
+    const endpoint = this.config.mcpEndpoint.replace(/^ws/, "http");
+    const response = await (0, import_cross_fetch3.default)(`${endpoint}/rpc`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "Authorization": `Bearer ${this.accessToken}`
+      },
+      body: JSON.stringify({
+        jsonrpc: "2.0",
+        id: this.generateId(),
+        method,
+        params
+      })
+    });
+    const data = await response.json();
+    if (data.error) {
+      throw new Error(data.error.message || "MCP request failed");
+    }
+    return data.result;
+  }
+  disconnect() {
+    if (this.ws) {
+      this.ws.close();
+      this.ws = null;
+    }
+    if (this.eventSource) {
+      this.eventSource.close();
+      this.eventSource = null;
+    }
+    if (this.refreshTimer) {
+      clearTimeout(this.refreshTimer);
+      this.refreshTimer = null;
+    }
+    this.accessToken = null;
+  }
+  async logout() {
+    this.disconnect();
+    await this.tokenStorage.clear();
+  }
+  generateId() {
+    return Math.random().toString(36).substring(2, 15);
+  }
+  // Convenience methods for memory operations
+  async createMemory(title, content, options) {
+    return this.request("memories.create", { title, content, ...options || {} });
+  }
+  async searchMemories(query, options) {
+    return this.request("memories.search", { query, ...options || {} });
+  }
+  async getMemory(id) {
+    return this.request("memories.get", { id });
+  }
+  async updateMemory(id, updates) {
+    return this.request("memories.update", { id, updates });
+  }
+  async deleteMemory(id) {
+    return this.request("memories.delete", { id });
+  }
+};
+
+// src/storage/api-key-storage-web.ts
+var ApiKeyStorageWeb = class {
+  constructor() {
+    this.storageKey = "lanonasis_api_key";
+    this.webEncryptionKeyStorage = "lanonasis_web_enc_key";
+  }
+  async store(data) {
+    const payload = JSON.stringify({
+      ...data,
+      createdAt: data.createdAt || (/* @__PURE__ */ new Date()).toISOString()
+    });
+    const encrypted = await this.encrypt(payload);
+    localStorage.setItem(this.storageKey, encrypted);
+  }
+  async retrieve() {
+    const encrypted = localStorage.getItem(this.storageKey);
+    if (!encrypted) return null;
+    try {
+      const decrypted = await this.decrypt(encrypted);
+      return JSON.parse(decrypted);
+    } catch {
+      return null;
+    }
+  }
+  async clear() {
+    localStorage.removeItem(this.storageKey);
+  }
+  async encrypt(text) {
+    if (typeof window === "undefined" || !window.crypto?.subtle) {
+      const encoder2 = new TextEncoder();
+      return this.base64Encode(encoder2.encode(text));
+    }
+    const encoder = new TextEncoder();
+    const data = encoder.encode(text);
+    const passphrase = await this.getWebEncryptionKey();
+    const keyMaterial = await window.crypto.subtle.importKey(
+      "raw",
+      encoder.encode(passphrase),
+      "PBKDF2",
+      false,
+      ["deriveBits", "deriveKey"]
+    );
+    const key = await window.crypto.subtle.deriveKey(
+      {
+        name: "PBKDF2",
+        salt: encoder.encode("lanonasis-api-key-salt"),
+        iterations: 1e5,
+        hash: "SHA-256"
+      },
+      keyMaterial,
+      { name: "AES-GCM", length: 256 },
+      true,
+      ["encrypt", "decrypt"]
+    );
+    const iv = window.crypto.getRandomValues(new Uint8Array(12));
+    const encrypted = await window.crypto.subtle.encrypt(
+      { name: "AES-GCM", iv },
+      key,
+      data
+    );
+    const combined = new Uint8Array(iv.length + encrypted.byteLength);
+    combined.set(iv, 0);
+    combined.set(new Uint8Array(encrypted), iv.length);
+    return this.base64Encode(combined);
+  }
+  async decrypt(encrypted) {
+    if (typeof window === "undefined" || !window.crypto?.subtle) {
+      const decoder2 = new TextDecoder();
+      return decoder2.decode(this.base64Decode(encrypted));
+    }
+    const bytes = this.base64Decode(encrypted);
+    const iv = bytes.slice(0, 12);
+    const data = bytes.slice(12);
+    const encoder = new TextEncoder();
+    const decoder = new TextDecoder();
+    const passphrase = await this.getWebEncryptionKey();
+    const keyMaterial = await window.crypto.subtle.importKey(
+      "raw",
+      encoder.encode(passphrase),
+      "PBKDF2",
+      false,
+      ["deriveBits", "deriveKey"]
+    );
+    const key = await window.crypto.subtle.deriveKey(
+      {
+        name: "PBKDF2",
+        salt: encoder.encode("lanonasis-api-key-salt"),
+        iterations: 1e5,
+        hash: "SHA-256"
+      },
+      keyMaterial,
+      { name: "AES-GCM", length: 256 },
+      true,
+      ["encrypt", "decrypt"]
+    );
+    const decrypted = await window.crypto.subtle.decrypt(
+      { name: "AES-GCM", iv },
+      key,
+      data
+    );
+    return decoder.decode(decrypted);
+  }
+  async getWebEncryptionKey() {
+    const existing = localStorage.getItem(this.webEncryptionKeyStorage);
+    if (existing) return existing;
+    const buf = new Uint8Array(32);
+    if (typeof window !== "undefined" && window.crypto?.getRandomValues) {
+      window.crypto.getRandomValues(buf);
+    }
+    const raw = Array.from(buf).map((b) => b.toString(16).padStart(2, "0")).join("");
+    localStorage.setItem(this.webEncryptionKeyStorage, raw);
+    return raw;
+  }
+  base64Encode(bytes) {
+    let binary = "";
+    bytes.forEach((b) => {
+      binary += String.fromCharCode(b);
+    });
+    return btoa(binary);
+  }
+  base64Decode(value) {
+    const binary = atob(value);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) {
+      bytes[i] = binary.charCodeAt(i);
+    }
+    return bytes;
+  }
+};