@wishknish/knishio-client-ts 0.9.5 → 0.9.7

package/dist/index.d.cts

@@ -124,6 +124,42 @@ interface GraphQLClient$1 {
     getUri(): string;
 }
 
+interface SecretStorageMetadata {
+    bundleHash: string;
+    label?: string;
+    createdAt: number;
+    hardwareBacked: boolean;
+    providerType: string;
+}
+interface EncryptedSecretPayload {
+    version: 1;
+    ciphertext: string;
+    iv: string;
+    salt: string;
+    tag?: string;
+    algorithm: 'AES-GCM' | 'AES-CBC';
+    iterations?: number;
+    metadata: SecretStorageMetadata;
+}
+interface ISecretStorageProvider {
+    readonly providerType: string;
+    isHardwareBacked(): boolean;
+    isAvailable(): Promise<boolean>;
+    storeSecret(bundleHash: string, secret: string, options?: {
+        label?: string;
+        passphrase?: string;
+    }): Promise<void>;
+    retrieveSecret(bundleHash: string, options?: {
+        passphrase?: string;
+    }): Promise<string | null>;
+    deleteSecret(bundleHash: string): Promise<boolean>;
+    hasSecret(bundleHash: string): Promise<boolean>;
+    listSecrets(): Promise<SecretStorageMetadata[]>;
+    withSecret<T>(bundleHash: string, fn: (secret: string) => Promise<T> | T, options?: {
+        passphrase?: string;
+    }): Promise<T>;
+}
+
 type WalletAddress = WalletAddressPattern & {
     readonly __brand: 'WalletAddress';
 };
@@ -472,6 +508,27 @@ declare class Atom {
     static groupByIsotope(atoms: Atom[]): Record<AtomIsotope, Atom[]>;
 }
 
+declare class TokenUnit {
+    id: string;
+    name: string;
+    metas: Record<string, any>;
+    constructor(id: string, name: string, metas?: Record<string, any>);
+    static createFromGraphQL(data: {
+        id: string;
+        name: string;
+        metas?: any;
+    }): TokenUnit;
+    static createFromDB(data: [string, string, Record<string, any>?]): TokenUnit;
+    getFragmentZone(): any | null;
+    getFusedTokenUnits(): any | null;
+    toData(): [string, string, Record<string, any>];
+    toGraphQLResponse(): {
+        id: string;
+        name: string;
+        metas: string;
+    };
+}
+
 declare class Wallet {
     token: string;
     balance: string;
@@ -515,7 +572,7 @@ declare class Wallet {
     static generateAddress(key: string): string;
     static generatePosition(saltLength?: number): string;
     static isBundleHash(maybeBundleHash: unknown): maybeBundleHash is string;
-    static getTokenUnits(unitsData: any[]): any[];
+    static getTokenUnits(unitsData: Array<[string, string, Record<string, any>?]>): TokenUnit[];
     createRemainder(secret: string): Wallet;
     initBatchId({ sourceWallet, isRemainder }: {
         sourceWallet: Wallet;
@@ -729,6 +786,10 @@ declare class Molecule {
         amount: number;
         walletBundle?: string | null;
     }): Molecule;
+    replenishToken({ amount, units }: {
+        amount: number;
+        units?: Array<[string, string, Record<string, any>?]>;
+    }): Molecule;
     initAuthorization({ meta }: {
         meta: Record<string, any>;
     }): Molecule;
@@ -1142,6 +1203,7 @@ declare class ResponseRequestAuthorization extends ResponseProposeMolecule {
 declare class KnishIOClient {
     private $__secret;
     private $__bundle;
+    private $__secretStorage;
     private $__cellSlug;
     private $__encrypt;
     private $__uris;
@@ -1168,6 +1230,7 @@ declare class KnishIOClient {
         serverSdkVersion?: number;
         logging?: boolean;
         defaultRequestPolicy?: RequestPolicy | null;
+        secretStorage?: ISecretStorageProvider | null;
     });
     initialize({ uri, cellSlug, socket, client, serverSdkVersion, logging, defaultRequestPolicy }: {
         uri: string | string[];
@@ -1197,6 +1260,11 @@ declare class KnishIOClient {
     getCellSlug(): string | null;
     hasSecret(): boolean;
     getSecret(): string;
+    setSecretStorage(storage: ISecretStorageProvider, bundleHash?: string): void;
+    getSecretStorage(): ISecretStorageProvider | null;
+    retrieveSecret(options?: {
+        passphrase?: string;
+    }): Promise<string | null>;
     hasBundle(): boolean;
     getBundle(): string;
     setRemainderWallet(remainderWallet: Wallet): void;
@@ -1396,10 +1464,10 @@ declare class KnishIOClient {
         units?: string[] | null;
         sourceWallet?: Wallet | null;
     }): Promise<Response>;
-    replenishToken({ token, amount, units, sourceWallet: _sourceWallet }: {
+    replenishToken({ token, amount, units, sourceWallet }: {
         token: TokenSlug | string;
         amount?: number | string | null;
-        units?: string[] | null;
+        units?: Array<[string, string, Record<string, any>?]> | null;
         sourceWallet?: Wallet | null;
     }): Promise<Response>;
     fuseToken({ bundleHash: _bundleHash, tokenSlug, newTokenUnit: _newTokenUnit, fusedTokenUnitIds: _fusedTokenUnitIds, sourceWallet: _sourceWallet }: {
@@ -1795,27 +1863,6 @@ declare class MutationAppendRequest extends MutationProposeMolecule {
     createResponse(json: any): ResponseAppendRequest;
 }
 
-declare class TokenUnit {
-    id: string;
-    name: string;
-    metas: Record<string, any>;
-    constructor(id: string, name: string, metas?: Record<string, any>);
-    static createFromGraphQL(data: {
-        id: string;
-        name: string;
-        metas?: any;
-    }): TokenUnit;
-    static createFromDB(data: [string, string, Record<string, any>?]): TokenUnit;
-    getFragmentZone(): any | null;
-    getFusedTokenUnits(): any | null;
-    toData(): [string, string, Record<string, any>];
-    toGraphQLResponse(): {
-        id: string;
-        name: string;
-        metas: string;
-    };
-}
-
 declare class PolicyMeta {
     policy: Record<string, any>;
     constructor(policy?: Record<string, any>, metaKeys?: string[]);
@@ -1963,6 +2010,13 @@ declare class WalletCredentialException extends BaseException {
     static bundleMismatch(expected: string, actual: string): WalletCredentialException;
 }
 
+declare class SecretStorageException extends BaseException {
+    constructor(message?: string, options?: BaseExceptionOptions);
+    static notFound(bundleHash: string): SecretStorageException;
+    static decryptionFailed(reason?: string): SecretStorageException;
+    static unavailable(provider: string, reason?: string): SecretStorageException;
+}
+
 declare class InvalidResponseException extends BaseException {
     constructor(message?: string, options?: BaseExceptionOptions);
     static malformedJson(error: string): InvalidResponseException;
@@ -2074,12 +2128,83 @@ declare const EXCEPTION_CODES: {
     readonly NETWORK_ERROR: "NETWORK_ERROR";
 };
 
-declare const SDK_VERSION = "0.9.5";
+declare class MemorySecretStorageProvider implements ISecretStorageProvider {
+    readonly providerType = "memory";
+    private secrets;
+    isHardwareBacked(): boolean;
+    isAvailable(): Promise<boolean>;
+    storeSecret(bundleHash: string, secret: string, options?: {
+        label?: string;
+        passphrase?: string;
+    }): Promise<void>;
+    retrieveSecret(bundleHash: string): Promise<string | null>;
+    deleteSecret(bundleHash: string): Promise<boolean>;
+    hasSecret(bundleHash: string): Promise<boolean>;
+    listSecrets(): Promise<SecretStorageMetadata[]>;
+    withSecret<T>(bundleHash: string, fn: (secret: string) => Promise<T> | T): Promise<T>;
+    clear(): void;
+}
+
+interface IStorageBackend {
+    getItem(key: string): Promise<string | null> | string | null;
+    setItem(key: string, value: string): Promise<void> | void;
+    removeItem(key: string): Promise<boolean | void> | boolean | void;
+    keys(): Promise<string[]> | string[];
+}
+declare class MemoryStorageBackend implements IStorageBackend {
+    private store;
+    getItem(key: string): string | null;
+    setItem(key: string, value: string): void;
+    removeItem(key: string): boolean;
+    keys(): string[];
+}
+declare class WebCryptoSecretStorageProvider implements ISecretStorageProvider {
+    readonly providerType = "webcrypto-aes-gcm";
+    private backend;
+    private defaultPassphrase?;
+    private hardwareBacked;
+    constructor(options?: {
+        backend?: IStorageBackend;
+        defaultPassphrase?: string;
+        hardwareBacked?: boolean;
+    });
+    isHardwareBacked(): boolean;
+    isAvailable(): Promise<boolean>;
+    private deriveKey;
+    storeSecret(bundleHash: string, secret: string, options?: {
+        label?: string;
+        passphrase?: string;
+    }): Promise<void>;
+    retrieveSecret(bundleHash: string, options?: {
+        passphrase?: string;
+    }): Promise<string | null>;
+    deleteSecret(bundleHash: string): Promise<boolean>;
+    hasSecret(bundleHash: string): Promise<boolean>;
+    listSecrets(): Promise<SecretStorageMetadata[]>;
+    withSecret<T>(bundleHash: string, fn: (secret: string) => Promise<T> | T, options?: {
+        passphrase?: string;
+    }): Promise<T>;
+}
+
+interface CreateSecretStorageOptions {
+    type?: 'webcrypto' | 'memory';
+    defaultPassphrase?: string;
+    backend?: IStorageBackend;
+    hardwareBacked?: boolean;
+}
+declare function createDefaultSecretStorage(options?: CreateSecretStorageOptions): ISecretStorageProvider;
+
+declare function zeroizeBytes(buffer: Uint8Array | number[]): void;
+declare function withSecureBytes<T>(bytes: Uint8Array, fn: (bytes: Uint8Array) => Promise<T> | T): Promise<T>;
+declare function withSecureString<T>(secret: string, fn: (cleanSecret: string) => Promise<T> | T): Promise<T>;
+declare function constantTimeCompare(a: Uint8Array | string, b: Uint8Array | string): boolean;
+
+declare const SDK_VERSION = "0.9.7";
 declare const SDK_NAME = "KnishIO-Client-TS";
 declare const COMPATIBLE_SERVER_VERSIONS: number[];
 declare const SDK_INFO: {
     readonly name: "KnishIO-Client-TS";
-    readonly version: "0.9.5";
+    readonly version: "0.9.7";
     readonly description: "TypeScript SDK for Knish.IO post-blockchain distributed ledger";
     readonly compatibleServerVersions: number[];
     readonly features: readonly ["Post-quantum cryptography (XMSS, ML-KEM768)", "Cross-platform compatibility", "Type-safe APIs", "DAG-based transaction processing", "GraphQL integration", "Real-time subscriptions", "Cellular architecture support"];
@@ -2107,7 +2232,7 @@ declare const DevUtils: {
         nodeVersion: string;
         environment: string;
         name: "KnishIO-Client-TS";
-        version: "0.9.5";
+        version: "0.9.7";
         description: "TypeScript SDK for Knish.IO post-blockchain distributed ledger";
         compatibleServerVersions: number[];
         features: readonly ["Post-quantum cryptography (XMSS, ML-KEM768)", "Cross-platform compatibility", "Type-safe APIs", "DAG-based transaction processing", "GraphQL integration", "Real-time subscriptions", "Cellular architecture support"];
@@ -2134,7 +2259,7 @@ declare const KnishIO: {
     SDK_VERSION: string;
     SDK_INFO: {
         readonly name: "KnishIO-Client-TS";
-        readonly version: "0.9.5";
+        readonly version: "0.9.7";
         readonly description: "TypeScript SDK for Knish.IO post-blockchain distributed ledger";
         readonly compatibleServerVersions: number[];
         readonly features: readonly ["Post-quantum cryptography (XMSS, ML-KEM768)", "Cross-platform compatibility", "Type-safe APIs", "DAG-based transaction processing", "GraphQL integration", "Real-time subscriptions", "Cellular architecture support"];
@@ -2147,4 +2272,4 @@ declare const KnishIO: {
     };
 };
 
-export { Atom, AtomIndexException, type AtomIsotope, AtomMeta, type AtomParams, AtomsMissingException, type AuthParams, AuthToken, type BalanceQueryParams, type Base17Hash, BaseException, type BaseResponse, type BundleHash, type BundleHashOptions, COMPATIBLE_SERVER_VERSIONS, CRYPTO_CONSTANTS, type CellSlug, CheckMolecule, type CreateTokenParams, DevUtils, Dot, EXCEPTION_CODES, EXCEPTION_TYPES, EXTENDED_COMPATIBILITY_TEST_VECTORS, type EmbeddingStatusItem, ExceptionFactory, GraphQLClient, type GraphQLError, type GraphQLRequest, type GraphQLResponse, type HexString, InvalidResponseException, type KeyGenerationOptions, KnishIO, KnishIOClient, type KnishIOClientConfig, Meta$1 as Meta, type MetaData, type MetaId, type MetaQueryParams, type MetaType, type MolecularHash, MolecularHashMismatchException, Molecule, type MoleculeParams, Mutation, MutationAppendRequest, MutationCreateMeta, MutationCreateToken, MutationCreateWallet, type MutationOperation, MutationPeering, MutationProposeMolecule, MutationRequestAuthorization, MutationRequestTokens, MutationTransferTokens, PolicyMeta, type Position, type PositionGenerationOptions, Query, QueryAtom, QueryBalance, QueryBatch, QueryContinuId, QueryEmbeddingStatus, QueryMetaType, QueryMetaTypeViaAtom, type QueryOperation, QueryWalletBundle, QueryWalletList, type RequestTokensParams, Response, ResponseAppendRequest, ResponseAtom, ResponseBalance, ResponseContinuId, ResponseCreateMeta, ResponseCreateToken, ResponseCreateWallet, ResponseEmbeddingStatus, ResponseMetaType, ResponseMetaTypeViaAtom, ResponsePeering, ResponseProposeMolecule, ResponseRequestAuthorization, ResponseRequestTokens, ResponseTransferTokens, ResponseWalletBundle, ResponseWalletList, type SDKConfig, SDK_INFO, SDK_NAME, SDK_VERSION, type SHAKE256Options, type SecretGenerationOptions, SignatureMismatchException, type SignatureOptions, type TokenSlug, TokenUnit, TransferBalanceException, type TransferParams, type ValidationResult$1 as ValidationResult, type VerificationOptions, Wallet, type WalletAddress, WalletCredentialException, type WalletParams, type WalletQueryParams, base64ToHex, bufferToHexString, capitalize, charsetBaseConvert, chunkArray, chunkSubstr, configureSDK, convertToBase17, createBundleHash, createMolecularHash, createPosition, createTokenSlug, createWalletAddress, deepCloning, diff, enumerateMolecularHash, generateBatchId, generateBundleHash, generateOTSSignature, generatePosition, generateSecret, generateWalletAddress, generateWalletKey, getSDKConfig, hexStringToBuffer, hexToBase64, intersect, isAtomIsotope, isBundleHash, isHex, isHexString, isMolecularHash, isNumeric, isPosition, isWalletAddress, normalizeMolecularHash, randomString, runCompatibilityTests, runExtendedCompatibilityTests, shake256, toCamelCase, toSnakeCase, truncate, validateBundleHash, validateMolecularHashForSignature, validateOTSSignature, validatePosition, validateSecret, validateWalletAddress, verifyOTSSignature };
+export { Atom, AtomIndexException, type AtomIsotope, AtomMeta, type AtomParams, AtomsMissingException, type AuthParams, AuthToken, type BalanceQueryParams, type Base17Hash, BaseException, type BaseResponse, type BundleHash, type BundleHashOptions, COMPATIBLE_SERVER_VERSIONS, CRYPTO_CONSTANTS, type CellSlug, CheckMolecule, type CreateSecretStorageOptions, type CreateTokenParams, DevUtils, Dot, EXCEPTION_CODES, EXCEPTION_TYPES, EXTENDED_COMPATIBILITY_TEST_VECTORS, type EmbeddingStatusItem, type EncryptedSecretPayload, ExceptionFactory, GraphQLClient, type GraphQLError, type GraphQLRequest, type GraphQLResponse, type HexString, type ISecretStorageProvider, type IStorageBackend, InvalidResponseException, type KeyGenerationOptions, KnishIO, KnishIOClient, type KnishIOClientConfig, MemorySecretStorageProvider, MemoryStorageBackend, Meta$1 as Meta, type MetaData, type MetaId, type MetaQueryParams, type MetaType, type MolecularHash, MolecularHashMismatchException, Molecule, type MoleculeParams, Mutation, MutationAppendRequest, MutationCreateMeta, MutationCreateToken, MutationCreateWallet, type MutationOperation, MutationPeering, MutationProposeMolecule, MutationRequestAuthorization, MutationRequestTokens, MutationTransferTokens, PolicyMeta, type Position, type PositionGenerationOptions, Query, QueryAtom, QueryBalance, QueryBatch, QueryContinuId, QueryEmbeddingStatus, QueryMetaType, QueryMetaTypeViaAtom, type QueryOperation, QueryWalletBundle, QueryWalletList, type RequestTokensParams, Response, ResponseAppendRequest, ResponseAtom, ResponseBalance, ResponseContinuId, ResponseCreateMeta, ResponseCreateToken, ResponseCreateWallet, ResponseEmbeddingStatus, ResponseMetaType, ResponseMetaTypeViaAtom, ResponsePeering, ResponseProposeMolecule, ResponseRequestAuthorization, ResponseRequestTokens, ResponseTransferTokens, ResponseWalletBundle, ResponseWalletList, type SDKConfig, SDK_INFO, SDK_NAME, SDK_VERSION, type SHAKE256Options, type SecretGenerationOptions, SecretStorageException, type SecretStorageMetadata, SignatureMismatchException, type SignatureOptions, type TokenSlug, TokenUnit, TransferBalanceException, type TransferParams, type ValidationResult$1 as ValidationResult, type VerificationOptions, Wallet, type WalletAddress, WalletCredentialException, type WalletParams, type WalletQueryParams, WebCryptoSecretStorageProvider, base64ToHex, bufferToHexString, capitalize, charsetBaseConvert, chunkArray, chunkSubstr, configureSDK, constantTimeCompare, convertToBase17, createBundleHash, createDefaultSecretStorage, createMolecularHash, createPosition, createTokenSlug, createWalletAddress, deepCloning, diff, enumerateMolecularHash, generateBatchId, generateBundleHash, generateOTSSignature, generatePosition, generateSecret, generateWalletAddress, generateWalletKey, getSDKConfig, hexStringToBuffer, hexToBase64, intersect, isAtomIsotope, isBundleHash, isHex, isHexString, isMolecularHash, isNumeric, isPosition, isWalletAddress, normalizeMolecularHash, randomString, runCompatibilityTests, runExtendedCompatibilityTests, shake256, toCamelCase, toSnakeCase, truncate, validateBundleHash, validateMolecularHashForSignature, validateOTSSignature, validatePosition, validateSecret, validateWalletAddress, verifyOTSSignature, withSecureBytes, withSecureString, zeroizeBytes };

package/dist/index.d.ts

@@ -124,6 +124,42 @@ interface GraphQLClient$1 {
     getUri(): string;
 }
 
+interface SecretStorageMetadata {
+    bundleHash: string;
+    label?: string;
+    createdAt: number;
+    hardwareBacked: boolean;
+    providerType: string;
+}
+interface EncryptedSecretPayload {
+    version: 1;
+    ciphertext: string;
+    iv: string;
+    salt: string;
+    tag?: string;
+    algorithm: 'AES-GCM' | 'AES-CBC';
+    iterations?: number;
+    metadata: SecretStorageMetadata;
+}
+interface ISecretStorageProvider {
+    readonly providerType: string;
+    isHardwareBacked(): boolean;
+    isAvailable(): Promise<boolean>;
+    storeSecret(bundleHash: string, secret: string, options?: {
+        label?: string;
+        passphrase?: string;
+    }): Promise<void>;
+    retrieveSecret(bundleHash: string, options?: {
+        passphrase?: string;
+    }): Promise<string | null>;
+    deleteSecret(bundleHash: string): Promise<boolean>;
+    hasSecret(bundleHash: string): Promise<boolean>;
+    listSecrets(): Promise<SecretStorageMetadata[]>;
+    withSecret<T>(bundleHash: string, fn: (secret: string) => Promise<T> | T, options?: {
+        passphrase?: string;
+    }): Promise<T>;
+}
+
 type WalletAddress = WalletAddressPattern & {
     readonly __brand: 'WalletAddress';
 };
@@ -472,6 +508,27 @@ declare class Atom {
     static groupByIsotope(atoms: Atom[]): Record<AtomIsotope, Atom[]>;
 }
 
+declare class TokenUnit {
+    id: string;
+    name: string;
+    metas: Record<string, any>;
+    constructor(id: string, name: string, metas?: Record<string, any>);
+    static createFromGraphQL(data: {
+        id: string;
+        name: string;
+        metas?: any;
+    }): TokenUnit;
+    static createFromDB(data: [string, string, Record<string, any>?]): TokenUnit;
+    getFragmentZone(): any | null;
+    getFusedTokenUnits(): any | null;
+    toData(): [string, string, Record<string, any>];
+    toGraphQLResponse(): {
+        id: string;
+        name: string;
+        metas: string;
+    };
+}
+
 declare class Wallet {
     token: string;
     balance: string;
@@ -515,7 +572,7 @@ declare class Wallet {
     static generateAddress(key: string): string;
     static generatePosition(saltLength?: number): string;
     static isBundleHash(maybeBundleHash: unknown): maybeBundleHash is string;
-    static getTokenUnits(unitsData: any[]): any[];
+    static getTokenUnits(unitsData: Array<[string, string, Record<string, any>?]>): TokenUnit[];
     createRemainder(secret: string): Wallet;
     initBatchId({ sourceWallet, isRemainder }: {
         sourceWallet: Wallet;
@@ -729,6 +786,10 @@ declare class Molecule {
         amount: number;
         walletBundle?: string | null;
     }): Molecule;
+    replenishToken({ amount, units }: {
+        amount: number;
+        units?: Array<[string, string, Record<string, any>?]>;
+    }): Molecule;
     initAuthorization({ meta }: {
         meta: Record<string, any>;
     }): Molecule;
@@ -1142,6 +1203,7 @@ declare class ResponseRequestAuthorization extends ResponseProposeMolecule {
 declare class KnishIOClient {
     private $__secret;
     private $__bundle;
+    private $__secretStorage;
     private $__cellSlug;
     private $__encrypt;
     private $__uris;
@@ -1168,6 +1230,7 @@ declare class KnishIOClient {
         serverSdkVersion?: number;
         logging?: boolean;
         defaultRequestPolicy?: RequestPolicy | null;
+        secretStorage?: ISecretStorageProvider | null;
     });
     initialize({ uri, cellSlug, socket, client, serverSdkVersion, logging, defaultRequestPolicy }: {
         uri: string | string[];
@@ -1197,6 +1260,11 @@ declare class KnishIOClient {
     getCellSlug(): string | null;
     hasSecret(): boolean;
     getSecret(): string;
+    setSecretStorage(storage: ISecretStorageProvider, bundleHash?: string): void;
+    getSecretStorage(): ISecretStorageProvider | null;
+    retrieveSecret(options?: {
+        passphrase?: string;
+    }): Promise<string | null>;
     hasBundle(): boolean;
     getBundle(): string;
     setRemainderWallet(remainderWallet: Wallet): void;
@@ -1396,10 +1464,10 @@ declare class KnishIOClient {
         units?: string[] | null;
         sourceWallet?: Wallet | null;
     }): Promise<Response>;
-    replenishToken({ token, amount, units, sourceWallet: _sourceWallet }: {
+    replenishToken({ token, amount, units, sourceWallet }: {
         token: TokenSlug | string;
         amount?: number | string | null;
-        units?: string[] | null;
+        units?: Array<[string, string, Record<string, any>?]> | null;
         sourceWallet?: Wallet | null;
     }): Promise<Response>;
     fuseToken({ bundleHash: _bundleHash, tokenSlug, newTokenUnit: _newTokenUnit, fusedTokenUnitIds: _fusedTokenUnitIds, sourceWallet: _sourceWallet }: {
@@ -1795,27 +1863,6 @@ declare class MutationAppendRequest extends MutationProposeMolecule {
     createResponse(json: any): ResponseAppendRequest;
 }
 
-declare class TokenUnit {
-    id: string;
-    name: string;
-    metas: Record<string, any>;
-    constructor(id: string, name: string, metas?: Record<string, any>);
-    static createFromGraphQL(data: {
-        id: string;
-        name: string;
-        metas?: any;
-    }): TokenUnit;
-    static createFromDB(data: [string, string, Record<string, any>?]): TokenUnit;
-    getFragmentZone(): any | null;
-    getFusedTokenUnits(): any | null;
-    toData(): [string, string, Record<string, any>];
-    toGraphQLResponse(): {
-        id: string;
-        name: string;
-        metas: string;
-    };
-}
-
 declare class PolicyMeta {
     policy: Record<string, any>;
     constructor(policy?: Record<string, any>, metaKeys?: string[]);
@@ -1963,6 +2010,13 @@ declare class WalletCredentialException extends BaseException {
     static bundleMismatch(expected: string, actual: string): WalletCredentialException;
 }
 
+declare class SecretStorageException extends BaseException {
+    constructor(message?: string, options?: BaseExceptionOptions);
+    static notFound(bundleHash: string): SecretStorageException;
+    static decryptionFailed(reason?: string): SecretStorageException;
+    static unavailable(provider: string, reason?: string): SecretStorageException;
+}
+
 declare class InvalidResponseException extends BaseException {
     constructor(message?: string, options?: BaseExceptionOptions);
     static malformedJson(error: string): InvalidResponseException;
@@ -2074,12 +2128,83 @@ declare const EXCEPTION_CODES: {
     readonly NETWORK_ERROR: "NETWORK_ERROR";
 };
 
-declare const SDK_VERSION = "0.9.5";
+declare class MemorySecretStorageProvider implements ISecretStorageProvider {
+    readonly providerType = "memory";
+    private secrets;
+    isHardwareBacked(): boolean;
+    isAvailable(): Promise<boolean>;
+    storeSecret(bundleHash: string, secret: string, options?: {
+        label?: string;
+        passphrase?: string;
+    }): Promise<void>;
+    retrieveSecret(bundleHash: string): Promise<string | null>;
+    deleteSecret(bundleHash: string): Promise<boolean>;
+    hasSecret(bundleHash: string): Promise<boolean>;
+    listSecrets(): Promise<SecretStorageMetadata[]>;
+    withSecret<T>(bundleHash: string, fn: (secret: string) => Promise<T> | T): Promise<T>;
+    clear(): void;
+}
+
+interface IStorageBackend {
+    getItem(key: string): Promise<string | null> | string | null;
+    setItem(key: string, value: string): Promise<void> | void;
+    removeItem(key: string): Promise<boolean | void> | boolean | void;
+    keys(): Promise<string[]> | string[];
+}
+declare class MemoryStorageBackend implements IStorageBackend {
+    private store;
+    getItem(key: string): string | null;
+    setItem(key: string, value: string): void;
+    removeItem(key: string): boolean;
+    keys(): string[];
+}
+declare class WebCryptoSecretStorageProvider implements ISecretStorageProvider {
+    readonly providerType = "webcrypto-aes-gcm";
+    private backend;
+    private defaultPassphrase?;
+    private hardwareBacked;
+    constructor(options?: {
+        backend?: IStorageBackend;
+        defaultPassphrase?: string;
+        hardwareBacked?: boolean;
+    });
+    isHardwareBacked(): boolean;
+    isAvailable(): Promise<boolean>;
+    private deriveKey;
+    storeSecret(bundleHash: string, secret: string, options?: {
+        label?: string;
+        passphrase?: string;
+    }): Promise<void>;
+    retrieveSecret(bundleHash: string, options?: {
+        passphrase?: string;
+    }): Promise<string | null>;
+    deleteSecret(bundleHash: string): Promise<boolean>;
+    hasSecret(bundleHash: string): Promise<boolean>;
+    listSecrets(): Promise<SecretStorageMetadata[]>;
+    withSecret<T>(bundleHash: string, fn: (secret: string) => Promise<T> | T, options?: {
+        passphrase?: string;
+    }): Promise<T>;
+}
+
+interface CreateSecretStorageOptions {
+    type?: 'webcrypto' | 'memory';
+    defaultPassphrase?: string;
+    backend?: IStorageBackend;
+    hardwareBacked?: boolean;
+}
+declare function createDefaultSecretStorage(options?: CreateSecretStorageOptions): ISecretStorageProvider;
+
+declare function zeroizeBytes(buffer: Uint8Array | number[]): void;
+declare function withSecureBytes<T>(bytes: Uint8Array, fn: (bytes: Uint8Array) => Promise<T> | T): Promise<T>;
+declare function withSecureString<T>(secret: string, fn: (cleanSecret: string) => Promise<T> | T): Promise<T>;
+declare function constantTimeCompare(a: Uint8Array | string, b: Uint8Array | string): boolean;
+
+declare const SDK_VERSION = "0.9.7";
 declare const SDK_NAME = "KnishIO-Client-TS";
 declare const COMPATIBLE_SERVER_VERSIONS: number[];
 declare const SDK_INFO: {
     readonly name: "KnishIO-Client-TS";
-    readonly version: "0.9.5";
+    readonly version: "0.9.7";
     readonly description: "TypeScript SDK for Knish.IO post-blockchain distributed ledger";
     readonly compatibleServerVersions: number[];
     readonly features: readonly ["Post-quantum cryptography (XMSS, ML-KEM768)", "Cross-platform compatibility", "Type-safe APIs", "DAG-based transaction processing", "GraphQL integration", "Real-time subscriptions", "Cellular architecture support"];
@@ -2107,7 +2232,7 @@ declare const DevUtils: {
         nodeVersion: string;
         environment: string;
         name: "KnishIO-Client-TS";
-        version: "0.9.5";
+        version: "0.9.7";
         description: "TypeScript SDK for Knish.IO post-blockchain distributed ledger";
         compatibleServerVersions: number[];
         features: readonly ["Post-quantum cryptography (XMSS, ML-KEM768)", "Cross-platform compatibility", "Type-safe APIs", "DAG-based transaction processing", "GraphQL integration", "Real-time subscriptions", "Cellular architecture support"];
@@ -2134,7 +2259,7 @@ declare const KnishIO: {
     SDK_VERSION: string;
     SDK_INFO: {
         readonly name: "KnishIO-Client-TS";
-        readonly version: "0.9.5";
+        readonly version: "0.9.7";
         readonly description: "TypeScript SDK for Knish.IO post-blockchain distributed ledger";
         readonly compatibleServerVersions: number[];
         readonly features: readonly ["Post-quantum cryptography (XMSS, ML-KEM768)", "Cross-platform compatibility", "Type-safe APIs", "DAG-based transaction processing", "GraphQL integration", "Real-time subscriptions", "Cellular architecture support"];
@@ -2147,4 +2272,4 @@ declare const KnishIO: {
     };
 };
 
-export { Atom, AtomIndexException, type AtomIsotope, AtomMeta, type AtomParams, AtomsMissingException, type AuthParams, AuthToken, type BalanceQueryParams, type Base17Hash, BaseException, type BaseResponse, type BundleHash, type BundleHashOptions, COMPATIBLE_SERVER_VERSIONS, CRYPTO_CONSTANTS, type CellSlug, CheckMolecule, type CreateTokenParams, DevUtils, Dot, EXCEPTION_CODES, EXCEPTION_TYPES, EXTENDED_COMPATIBILITY_TEST_VECTORS, type EmbeddingStatusItem, ExceptionFactory, GraphQLClient, type GraphQLError, type GraphQLRequest, type GraphQLResponse, type HexString, InvalidResponseException, type KeyGenerationOptions, KnishIO, KnishIOClient, type KnishIOClientConfig, Meta$1 as Meta, type MetaData, type MetaId, type MetaQueryParams, type MetaType, type MolecularHash, MolecularHashMismatchException, Molecule, type MoleculeParams, Mutation, MutationAppendRequest, MutationCreateMeta, MutationCreateToken, MutationCreateWallet, type MutationOperation, MutationPeering, MutationProposeMolecule, MutationRequestAuthorization, MutationRequestTokens, MutationTransferTokens, PolicyMeta, type Position, type PositionGenerationOptions, Query, QueryAtom, QueryBalance, QueryBatch, QueryContinuId, QueryEmbeddingStatus, QueryMetaType, QueryMetaTypeViaAtom, type QueryOperation, QueryWalletBundle, QueryWalletList, type RequestTokensParams, Response, ResponseAppendRequest, ResponseAtom, ResponseBalance, ResponseContinuId, ResponseCreateMeta, ResponseCreateToken, ResponseCreateWallet, ResponseEmbeddingStatus, ResponseMetaType, ResponseMetaTypeViaAtom, ResponsePeering, ResponseProposeMolecule, ResponseRequestAuthorization, ResponseRequestTokens, ResponseTransferTokens, ResponseWalletBundle, ResponseWalletList, type SDKConfig, SDK_INFO, SDK_NAME, SDK_VERSION, type SHAKE256Options, type SecretGenerationOptions, SignatureMismatchException, type SignatureOptions, type TokenSlug, TokenUnit, TransferBalanceException, type TransferParams, type ValidationResult$1 as ValidationResult, type VerificationOptions, Wallet, type WalletAddress, WalletCredentialException, type WalletParams, type WalletQueryParams, base64ToHex, bufferToHexString, capitalize, charsetBaseConvert, chunkArray, chunkSubstr, configureSDK, convertToBase17, createBundleHash, createMolecularHash, createPosition, createTokenSlug, createWalletAddress, deepCloning, diff, enumerateMolecularHash, generateBatchId, generateBundleHash, generateOTSSignature, generatePosition, generateSecret, generateWalletAddress, generateWalletKey, getSDKConfig, hexStringToBuffer, hexToBase64, intersect, isAtomIsotope, isBundleHash, isHex, isHexString, isMolecularHash, isNumeric, isPosition, isWalletAddress, normalizeMolecularHash, randomString, runCompatibilityTests, runExtendedCompatibilityTests, shake256, toCamelCase, toSnakeCase, truncate, validateBundleHash, validateMolecularHashForSignature, validateOTSSignature, validatePosition, validateSecret, validateWalletAddress, verifyOTSSignature };
+export { Atom, AtomIndexException, type AtomIsotope, AtomMeta, type AtomParams, AtomsMissingException, type AuthParams, AuthToken, type BalanceQueryParams, type Base17Hash, BaseException, type BaseResponse, type BundleHash, type BundleHashOptions, COMPATIBLE_SERVER_VERSIONS, CRYPTO_CONSTANTS, type CellSlug, CheckMolecule, type CreateSecretStorageOptions, type CreateTokenParams, DevUtils, Dot, EXCEPTION_CODES, EXCEPTION_TYPES, EXTENDED_COMPATIBILITY_TEST_VECTORS, type EmbeddingStatusItem, type EncryptedSecretPayload, ExceptionFactory, GraphQLClient, type GraphQLError, type GraphQLRequest, type GraphQLResponse, type HexString, type ISecretStorageProvider, type IStorageBackend, InvalidResponseException, type KeyGenerationOptions, KnishIO, KnishIOClient, type KnishIOClientConfig, MemorySecretStorageProvider, MemoryStorageBackend, Meta$1 as Meta, type MetaData, type MetaId, type MetaQueryParams, type MetaType, type MolecularHash, MolecularHashMismatchException, Molecule, type MoleculeParams, Mutation, MutationAppendRequest, MutationCreateMeta, MutationCreateToken, MutationCreateWallet, type MutationOperation, MutationPeering, MutationProposeMolecule, MutationRequestAuthorization, MutationRequestTokens, MutationTransferTokens, PolicyMeta, type Position, type PositionGenerationOptions, Query, QueryAtom, QueryBalance, QueryBatch, QueryContinuId, QueryEmbeddingStatus, QueryMetaType, QueryMetaTypeViaAtom, type QueryOperation, QueryWalletBundle, QueryWalletList, type RequestTokensParams, Response, ResponseAppendRequest, ResponseAtom, ResponseBalance, ResponseContinuId, ResponseCreateMeta, ResponseCreateToken, ResponseCreateWallet, ResponseEmbeddingStatus, ResponseMetaType, ResponseMetaTypeViaAtom, ResponsePeering, ResponseProposeMolecule, ResponseRequestAuthorization, ResponseRequestTokens, ResponseTransferTokens, ResponseWalletBundle, ResponseWalletList, type SDKConfig, SDK_INFO, SDK_NAME, SDK_VERSION, type SHAKE256Options, type SecretGenerationOptions, SecretStorageException, type SecretStorageMetadata, SignatureMismatchException, type SignatureOptions, type TokenSlug, TokenUnit, TransferBalanceException, type TransferParams, type ValidationResult$1 as ValidationResult, type VerificationOptions, Wallet, type WalletAddress, WalletCredentialException, type WalletParams, type WalletQueryParams, WebCryptoSecretStorageProvider, base64ToHex, bufferToHexString, capitalize, charsetBaseConvert, chunkArray, chunkSubstr, configureSDK, constantTimeCompare, convertToBase17, createBundleHash, createDefaultSecretStorage, createMolecularHash, createPosition, createTokenSlug, createWalletAddress, deepCloning, diff, enumerateMolecularHash, generateBatchId, generateBundleHash, generateOTSSignature, generatePosition, generateSecret, generateWalletAddress, generateWalletKey, getSDKConfig, hexStringToBuffer, hexToBase64, intersect, isAtomIsotope, isBundleHash, isHex, isHexString, isMolecularHash, isNumeric, isPosition, isWalletAddress, normalizeMolecularHash, randomString, runCompatibilityTests, runExtendedCompatibilityTests, shake256, toCamelCase, toSnakeCase, truncate, validateBundleHash, validateMolecularHashForSignature, validateOTSSignature, validatePosition, validateSecret, validateWalletAddress, verifyOTSSignature, withSecureBytes, withSecureString, zeroizeBytes };