@wishknish/knishio-client-js 0.9.4 → 1.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +13 -0
- package/dist/client.cjs.js +38 -40
- package/dist/client.cjs.js.map +1 -1
- package/dist/client.es.mjs +6660 -9256
- package/dist/client.es.mjs.map +1 -1
- package/dist/client.iife.js +38 -40
- package/dist/client.iife.js.map +1 -1
- package/package.json +10 -11
- package/src/AuthToken.js +25 -3
- package/src/KnishIOClient.js +54 -15
- package/src/Molecule.js +15 -7
- package/src/Wallet.js +137 -30
- package/src/exception/SecretStorageException.js +10 -0
- package/src/index.js +11 -1
- package/src/libraries/urql/UrqlClientWrapper.js +7 -2
- package/src/storage/FileStorageBackend.js +199 -0
- package/src/storage/MemorySecretStorageProvider.js +69 -1
- package/src/storage/NonExtractableKeySecretStorageProvider.js +514 -0
- package/src/storage/WebAuthnPrfSecretStorageProvider.js +646 -0
- package/src/storage/WebCryptoSecretStorageProvider.js +107 -129
- package/src/storage/WebStorageBackend.js +117 -0
- package/src/storage/index.js +25 -3
- package/src/storage/secretEnvelope.js +208 -0
package/README.md
CHANGED
|
@@ -507,6 +507,19 @@ const client = new KnishIOClient({
|
|
|
507
507
|
Precedence: a query's own context (e.g. ContinuID's `network-only`, which always
|
|
508
508
|
wins) > per-call `requestPolicy` > client `defaultRequestPolicy` > urql default.
|
|
509
509
|
|
|
510
|
+
## Secret storage
|
|
511
|
+
|
|
512
|
+
Master secrets are stored at rest in the cross-SDK AES-256-GCM envelope (PBKDF2-HMAC-SHA256 ×100000, camelCase metadata; frozen in `sdks/shared-test-results/cross-platform-test-vectors.json`). Every SDK decrypts every other SDK's envelope.
|
|
513
|
+
|
|
514
|
+
| Provider | `providerType` | Custody (`hardwareBacked`) | Where the key lives | Recovery passphrase |
|
|
515
|
+
|---|---|---|---|---|
|
|
516
|
+
| `MemorySecretStorageProvider` | `memory` | Software (`false`) | Process memory | Optional |
|
|
517
|
+
| `WebCryptoSecretStorageProvider` | `webcrypto-aes-gcm` | Software (`false`) | Any `IStorageBackend` (`MemoryStorageBackend`, `FileStorageBackend` [0o600 Node-only], `WebStorageBackend`) | Optional |
|
|
518
|
+
| `NonExtractableKeySecretStorageProvider` | `webcrypto-nonextractable` | Software (`false`) | Non-extractable `CryptoKey` in IndexedDB (not hardware) | Required unless `allowUnrecoverable` |
|
|
519
|
+
| `WebAuthnPrfSecretStorageProvider` | `webauthn-prf` | Software (`false`) — PRF secret is authenticator-bound but custody is unattested | Platform authenticator via WebAuthn PRF extension | Required unless `allowUnrecoverable` |
|
|
520
|
+
|
|
521
|
+
`hardwareBacked` is derived by the provider from the platform, never accepted from the caller; software providers always report `false`. A hardware provider refuses to store without a recovery passphrase unless `allowUnrecoverable` is set — the recovery envelope (`knishio:recovery:<bundleHash>`, `providerType: "webcrypto-aes-gcm"`) is *software* custody whose strength is bounded by that passphrase: enforce passphrase entropy or keep it on a second device.
|
|
522
|
+
|
|
510
523
|
## Getting Help
|
|
511
524
|
|
|
512
525
|
Knish.IO is under active development, and our team is ready to assist with integration questions. The best way to seek help is to stop by our [Telegram Support Channel](https://t.me/wishknish). You can also [send us a contact request](https://knish.io/contact) via our website.
|