@wishknish/knishio-client-ts 0.9.8 → 1.1.0

package/dist/index.iife.js

@@ -20109,6 +20109,14 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
             }
           );
         }
+        /**
+         * Validation error for storage options or parameters
+         */
+        static validationError(message) {
+          return new _SecretStorageException(message, {
+            code: "VALIDATION_ERROR"
+          });
+        }
       };
     }
   });
@@ -42562,8 +42570,14 @@ ${operationTypes.join("\n")}
     ...params
   });
   var ml_kem768 = /* @__PURE__ */ (() => mk(PARAMS[768]))();
+  var ml_kem1024 = /* @__PURE__ */ (() => mk(PARAMS[1024]))();
 
   // src/core/Wallet.ts
+  var ML_KEM_PARAMS = {
+    1024: { kem: ml_kem1024, pkBytes: 1568, skBytes: 3168, ctBytes: 1568 },
+    768: { kem: ml_kem768, pkBytes: 1184, skBytes: 2400, ctBytes: 1088 }
+  };
+  var DEFAULT_ML_KEM_PARAMETER_SET = 1024;
   var Wallet = class _Wallet {
     token;
     balance;
@@ -42578,6 +42592,7 @@ ${operationTypes.join("\n")}
     tokenUnits;
     tradeRates;
     molecules;
+    mlKemParameterSet;
     // Token metadata (populated from query responses)
     tokenName;
     tokenAmount;
@@ -42591,8 +42606,14 @@ ${operationTypes.join("\n")}
       address = null,
       position = null,
       batchId = null,
-      characters = null
+      characters = null,
+      mlKemParameterSet = DEFAULT_ML_KEM_PARAMETER_SET
     } = {}) {
+      const paramSetNum = Number(mlKemParameterSet);
+      if (!ML_KEM_PARAMS[paramSetNum]) {
+        throw new Error(`KnishIO: unsupported ML-KEM parameter set ${mlKemParameterSet}; expected 1024 or 768.`);
+      }
+      this.mlKemParameterSet = paramSetNum;
       this.token = token;
       this.balance = "0";
       this.molecules = {};
@@ -42628,7 +42649,8 @@ ${operationTypes.join("\n")}
       bundle = null,
       token = "USER",
       batchId = null,
-      characters = null
+      characters = null,
+      mlKemParameterSet = DEFAULT_ML_KEM_PARAMETER_SET
     }) {
       let position = null;
       if (!secret && !bundle) {
@@ -42644,7 +42666,8 @@ ${operationTypes.join("\n")}
         token,
         position,
         batchId,
-        characters
+        characters,
+        mlKemParameterSet
       });
     }
     /**
@@ -42803,20 +42826,80 @@ ${operationTypes.join("\n")}
       return (typeof this.position === "undefined" || this.position === null) && (typeof this.address === "undefined" || this.address === null);
     }
     // =============================================================================
-    // POST-QUANTUM CRYPTOGRAPHY - ML-KEM768 INTEGRATION
+    // POST-QUANTUM CRYPTOGRAPHY - ML-KEM INTEGRATION
     // =============================================================================
     /**
-     * Initializes the ML-KEM key pair (matches JavaScript SDK exactly)
+     * Derive an ML-KEM keypair for an arbitrary parameter set from the wallet's key seed,
+     * without mutating the wallet. The 64-byte `d‖z` seed takes no parameter-set input — only
+     * the final `keygen` call differs — so one KnishIO wallet owns both an ML-KEM-768 and an
+     * ML-KEM-1024 identity and either can be reconstructed on demand.
+     *
+     * Returns `null` when the wallet holds no key — a secret-less wallet, which is what a molecule
+     * deserializer builds for validation context. `generateSecret(null, …)` does NOT throw, so
+     * without this the wallet would derive a plausible-looking identity from a bogus seed and fail
+     * three layers down at AES-GCM instead of at the missing key. The guard lives here rather than
+     * at each call site so a new caller cannot miss it.
+     *
+     * @param parameterSet - 1024 or 768
      */
-    initializeMLKEM() {
+    deriveMlKemKeypair(parameterSet) {
+      const params = ML_KEM_PARAMS[parameterSet];
+      if (!params) {
+        throw new Error(`KnishIO: unsupported ML-KEM parameter set ${parameterSet}; expected 1024 or 768.`);
+      }
+      if (!this.key) {
+        return null;
+      }
       const seedHex = generateSecret(this.key, 128);
       const seed = new Uint8Array(64);
       for (let i4 = 0; i4 < 64; i4++) {
         seed[i4] = parseInt(seedHex.substr(i4 * 2, 2), 16);
       }
-      const { publicKey, secretKey } = ml_kem768.keygen(seed);
-      this.pubkey = this.serializeKey(publicKey);
-      this.privkey = secretKey;
+      const { publicKey, secretKey } = params.kem.keygen(seed);
+      return {
+        pubkey: this.serializeKey(publicKey),
+        privkey: secretKey,
+        params
+      };
+    }
+    /**
+     * ML-KEM parameter set implied by a serialized public key's raw byte length. FIPS 203's key
+     * lengths are disjoint (1568 bytes → ML-KEM-1024, 1184 bytes → ML-KEM-768), so a stored peer
+     * key recovers the parameter set of the session it belongs to without a wire-format change.
+     * Used by AuthToken.restore to resolve a snapshot that predates the field.
+     *
+     * @param pubkey - Base64-serialized ML-KEM public key
+     * @return 1024, 768, or null when the length matches neither
+     */
+    static mlKemParameterSetFromPubkey(pubkey) {
+      if (!pubkey) {
+        return null;
+      }
+      let byteLength;
+      try {
+        byteLength = typeof Buffer !== "undefined" ? Buffer.from(pubkey, "base64").length : atob(pubkey).length;
+      } catch {
+        return null;
+      }
+      if (byteLength === ML_KEM_PARAMS[1024].pkBytes) {
+        return 1024;
+      }
+      if (byteLength === ML_KEM_PARAMS[768].pkBytes) {
+        return 768;
+      }
+      return null;
+    }
+    /**
+     * Initializes the ML-KEM key pair (matches JavaScript SDK exactly). Only ever reached from the
+     * constructor's `secret` branch, so the derivation cannot come back empty here.
+     */
+    initializeMLKEM() {
+      const derived = this.deriveMlKemKeypair(this.mlKemParameterSet);
+      if (!derived) {
+        return;
+      }
+      this.pubkey = derived.pubkey;
+      this.privkey = derived.privkey;
     }
     // =============================================================================
     // HIGH-LEVEL MESSAGE ENCRYPTION (JavaScript SDK Compatibility)
@@ -42825,13 +42908,13 @@ ${operationTypes.join("\n")}
       const messageString = JSON.stringify(message);
       const messageUint8 = new TextEncoder().encode(messageString);
       const deserializedPubkey = this.deserializeKey(recipientPubkey);
-      const ML_KEM_768_PUBLIC_KEY_BYTES = 1184;
-      if (deserializedPubkey.length !== ML_KEM_768_PUBLIC_KEY_BYTES) {
+      const params = ML_KEM_PARAMS[this.mlKemParameterSet];
+      if (deserializedPubkey.length !== params.pkBytes) {
         throw new Error(
-          `KnishIO: cannot ML-KEM-encrypt \u2014 recipient public key is ${deserializedPubkey.length} bytes, expected ${ML_KEM_768_PUBLIC_KEY_BYTES} (ML-KEM-768). The node likely did not advertise an ML-KEM public key (upgrade the validator to a PQ-transport build), or authenticate with { encrypt: false }.`
+          `KnishIO: cannot ML-KEM-encrypt \u2014 recipient public key is ${deserializedPubkey.length} bytes, expected ${params.pkBytes} (ML-KEM-${this.mlKemParameterSet}). The peer is not running ML-KEM-${this.mlKemParameterSet}; upgrade the peer, or step this client back to the other parameter set.`
         );
       }
-      const { cipherText, sharedSecret } = ml_kem768.encapsulate(deserializedPubkey);
+      const { cipherText, sharedSecret } = params.kem.encapsulate(deserializedPubkey);
       const encryptedMessage = await this.encryptWithSharedSecret(messageUint8, sharedSecret);
       return {
         cipherText: this.serializeKey(cipherText),
@@ -42843,15 +42926,37 @@ ${operationTypes.join("\n")}
       return decryptedString === null ? null : JSON.parse(decryptedString);
     }
     /**
-     * ML-KEM768 decapsulate + AES-256-GCM decrypt → the RAW decrypted UTF-8 string (no JSON.parse).
+     * ML-KEM decapsulate + AES-256-GCM decrypt → the RAW decrypted UTF-8 string (no JSON.parse).
      * Shared by {@link decryptMessage} (which JSON.parses the result) and the PQ CipherHash transport
-     * ({@link decryptMyMessageML768}, which needs the raw response JSON text). PQ-transport Phase E.
+     * ({@link decryptMyMessageML}, which needs the raw response JSON text). PQ-transport Phase E.
      */
     async _mlkemDecryptToString(encryptedData) {
       const { cipherText, encryptedMessage } = encryptedData;
+      const configuredParams = ML_KEM_PARAMS[this.mlKemParameterSet];
+      const otherSet = this.mlKemParameterSet === 1024 ? 768 : 1024;
+      const deserializedCipherText = this.deserializeKey(cipherText);
+      let params = configuredParams;
+      let decapsPrivkey = this.privkey;
+      if (deserializedCipherText.length !== configuredParams.ctBytes) {
+        if (deserializedCipherText.length !== ML_KEM_PARAMS[otherSet].ctBytes) {
+          console.error(
+            `Wallet::decryptMessage() - Ciphertext length mismatch: got ${deserializedCipherText.length}, expected ${configuredParams.ctBytes}`
+          );
+          return null;
+        }
+        const derived = this.deriveMlKemKeypair(otherSet);
+        if (!derived) {
+          console.error(
+            `Wallet::decryptMessage() - cannot derive the ML-KEM-${otherSet} identity: wallet has no key`
+          );
+          return null;
+        }
+        params = derived.params;
+        decapsPrivkey = derived.privkey;
+      }
       let sharedSecret;
       try {
-        sharedSecret = ml_kem768.decapsulate(this.deserializeKey(cipherText), this.privkey);
+        sharedSecret = params.kem.decapsulate(deserializedCipherText, decapsPrivkey);
       } catch (e4) {
         console.error("Wallet::decryptMessage() - Decapsulation failed", e4);
         console.info("Wallet::decryptMessage() - my public key", this.pubkey);
@@ -42901,11 +43006,11 @@ ${operationTypes.join("\n")}
       return this.serializeKey(bytes);
     }
     /**
-     * Post-quantum (ML-KEM768) CipherHash request envelope: a stringified single-recipient map
+     * Post-quantum (ML-KEM) CipherHash request envelope: a stringified single-recipient map
      * `{ "<hashShare(recipientPubkey)>": {cipherText, encryptedMessage} }` (object-valued, via
      * {@link encryptMessage}). Matches the Rust validator's CipherHash handler. PQ-transport Phase E.
      */
-    async encryptStringML768(message, recipientPubkey) {
+    async encryptStringML(message, recipientPubkey) {
       const envelope = await this.encryptMessage(message, recipientPubkey);
       return JSON.stringify({ [this.hashShare(recipientPubkey)]: envelope });
     }
@@ -42913,9 +43018,21 @@ ${operationTypes.join("\n")}
      * Decrypt a CipherHash response map addressed to THIS wallet's ML-KEM pubkey
      * (`hashShare(this.pubkey)`) → the RAW decrypted GraphQL response JSON text (NOT JSON.parsed;
      * it replaces the HTTP response body for the normal parser). `null` if no entry / decrypt fails.
+     *
+     * A pre-bump peer addressed its envelope to `hashShare(our_768_pubkey)`, which a wallet
+     * configured at ML-KEM-1024 would never find — so the other identity's share is tried too.
+     * Without this, the permissive length dispatch in {@link _mlkemDecryptToString} is
+     * unreachable on the transport path.
      */
-    async decryptMyMessageML768(map3) {
-      const envelope = map3[this.hashShare(this.pubkey)];
+    async decryptMyMessageML(map3) {
+      let envelope = map3[this.hashShare(this.pubkey)];
+      if (!envelope) {
+        const otherSet = this.mlKemParameterSet === 1024 ? 768 : 1024;
+        const other = this.deriveMlKemKeypair(otherSet);
+        if (other) {
+          envelope = map3[this.hashShare(other.pubkey)];
+        }
+      }
       if (!envelope) {
         return null;
       }
@@ -43072,7 +43189,8 @@ ${operationTypes.join("\n")}
     serverSdkVersion: external_exports.number().int().min(1).optional(),
     logging: external_exports.boolean().optional(),
     defaultRequestPolicy: external_exports.enum(["cache-first", "cache-only", "network-only", "cache-and-network"]).nullable().optional(),
-    secretStorage: external_exports.unknown().optional()
+    secretStorage: external_exports.unknown().optional(),
+    mlKemParameterSet: external_exports.union([external_exports.literal(1024), external_exports.literal(768)]).optional()
   }).strict();
   external_exports.object({
     token: external_exports.string().min(1, "Auth token cannot be empty"),
@@ -44162,6 +44280,7 @@ ${operationTypes.join("\n")}
     continuIdPosition;
     parentHashes;
     local;
+    mlKemParameterSet = 1024;
     /**
      * Create new Molecule instance
      * Matches JavaScript SDK constructor signature
@@ -44173,7 +44292,8 @@ ${operationTypes.join("\n")}
       remainderWallet = null,
       cellSlug = null,
       version: version3 = null,
-      continuIdPosition = null
+      continuIdPosition = null,
+      mlKemParameterSet = null
     } = {}) {
       this.status = null;
       this.molecularHash = null;
@@ -44185,6 +44305,7 @@ ${operationTypes.join("\n")}
       this.continuIdPosition = continuIdPosition;
       this.atoms = [];
       this.parentHashes = [];
+      this.mlKemParameterSet = mlKemParameterSet || sourceWallet?.mlKemParameterSet || 1024;
       const versionRegistry = versions_default;
       if (version3 !== null && Object.prototype.hasOwnProperty.call(versionRegistry, version3)) {
         this.version = String(version3);
@@ -44195,7 +44316,8 @@ ${operationTypes.join("\n")}
           bundle,
           token: sourceWallet.token,
           batchId: sourceWallet.batchId,
-          characters: sourceWallet.characters
+          characters: sourceWallet.characters,
+          mlKemParameterSet: this.mlKemParameterSet
         });
       } else {
         this.remainderWallet = null;
@@ -44256,7 +44378,8 @@ ${operationTypes.join("\n")}
       if (!this.remainderWallet || this.remainderWallet.token !== "USER") {
         this.remainderWallet = Wallet.create({
           secret: this.secret,
-          bundle: this.bundle
+          bundle: this.bundle,
+          mlKemParameterSet: this.mlKemParameterSet
         });
       }
       const continuIdMeta = {};
@@ -44643,7 +44766,8 @@ ${operationTypes.join("\n")}
       }
       const burnWallet = new Wallet({
         bundle: "0000000000000000000000000000000000000000000000000000000000000000",
-        token: this.sourceWallet.token
+        token: this.sourceWallet.token,
+        mlKemParameterSet: this.mlKemParameterSet
       });
       this.addAtom(Atom.create({
         isotope: "V",
@@ -44915,7 +45039,8 @@ ${operationTypes.join("\n")}
               position: data.sourceWallet.position,
               bundle: data.sourceWallet.bundle,
               batchId: data.sourceWallet.batchId,
-              characters: data.sourceWallet.characters
+              characters: data.sourceWallet.characters,
+              mlKemParameterSet: molecule.mlKemParameterSet
             });
             molecule.sourceWallet.balance = String(data.sourceWallet.balance != null ? data.sourceWallet.balance : 0);
             molecule.sourceWallet.address = data.sourceWallet.address;
@@ -44933,7 +45058,8 @@ ${operationTypes.join("\n")}
               position: data.remainderWallet.position,
               bundle: data.remainderWallet.bundle,
               batchId: data.remainderWallet.batchId,
-              characters: data.remainderWallet.characters
+              characters: data.remainderWallet.characters,
+              mlKemParameterSet: molecule.mlKemParameterSet
             });
             molecule.remainderWallet.balance = String(data.remainderWallet.balance != null ? data.remainderWallet.balance : 0);
             molecule.remainderWallet.address = data.remainderWallet.address;
@@ -45031,7 +45157,8 @@ ${operationTypes.join("\n")}
         secret: this.secret,
         bundle: this.bundle,
         token: this.sourceWallet.token,
-        batchId: this.sourceWallet.batchId
+        batchId: this.sourceWallet.batchId,
+        mlKemParameterSet: this.mlKemParameterSet
       });
       if (tradeRates) {
         bufferWallet.tradeRates = tradeRates;
@@ -47728,7 +47855,7 @@ ${operationTypes.join("\n")}
       let encryptedRequest = false;
       let requestInit = init;
       if (wallet && serverPubkey && init && typeof init.body === "string" && this.shouldEncrypt(init.body)) {
-        const hashVar = await wallet.encryptStringML768(init.body, serverPubkey);
+        const hashVar = await wallet.encryptStringML(init.body, serverPubkey);
         requestInit = { ...init, body: JSON.stringify({ query: CIPHER_HASH_QUERY, variables: { Hash: hashVar } }) };
         encryptedRequest = true;
       }
@@ -47748,7 +47875,7 @@ ${operationTypes.join("\n")}
       if (typeof hash2 !== "string") {
         return new Response(text, init2);
       }
-      const decrypted = await wallet.decryptMyMessageML768(JSON.parse(hash2));
+      const decrypted = await wallet.decryptMyMessageML(JSON.parse(hash2));
       return new Response(decrypted != null ? decrypted : text, init2);
     }
     setAuthData({
@@ -47917,6 +48044,22 @@ ${operationTypes.join("\n")}
       authToken.setWallet(wallet);
       return authToken;
     }
+    /**
+     * ML-KEM parameter set a restored session must use, resolved in three tiers:
+     * an explicit snapshot field, then the stored validator key's length, then ML-KEM-768.
+     *
+     * The final tier is deliberately NOT the constructor default. A snapshot with neither an
+     * explicit field nor a recognisable key can only have come from a pre-bump build, and every
+     * pre-bump build was 768-only — defaulting to 1024 would make the restored wallet advertise
+     * a public key the validator never recorded for that token.
+     */
+    static resolveMlKemParameterSet(snapshot) {
+      const explicit = snapshot.wallet?.mlKemParameterSet;
+      if (explicit) {
+        return Number(explicit) === 768 ? 768 : 1024;
+      }
+      return Wallet.mlKemParameterSetFromPubkey(snapshot.pubkey) ?? 768;
+    }
     /**
      * Restore AuthToken from snapshot
      */
@@ -47924,8 +48067,9 @@ ${operationTypes.join("\n")}
       const wallet = new Wallet({
         secret,
         token: "AUTH",
-        position: snapshot.wallet.position,
-        characters: snapshot.wallet.characters
+        position: snapshot.wallet?.position ?? null,
+        characters: snapshot.wallet?.characters ?? null,
+        mlKemParameterSet: _AuthToken.resolveMlKemParameterSet(snapshot)
       });
       return _AuthToken.create({
         token: snapshot.token,
@@ -47993,7 +48137,9 @@ ${operationTypes.join("\n")}
       };
     }
     /**
-     * Create snapshot for persistence
+     * Create snapshot for persistence. The wallet's ML-KEM parameter set is recorded beside its
+     * position and characters so a stepped-back ML-KEM-768 session restores as 768 rather than
+     * silently taking the constructor default.
      */
     toSnapshot() {
       return {
@@ -48004,7 +48150,8 @@ ${operationTypes.join("\n")}
         ...this.$__wallet ? {
           wallet: {
             position: this.$__wallet.position,
-            characters: this.$__wallet.characters
+            characters: this.$__wallet.characters,
+            mlKemParameterSet: this.$__wallet.mlKemParameterSet
           }
         } : {}
       };
@@ -48304,7 +48451,8 @@ ${operationTypes.join("\n")}
     // isn't rejected.
     defaultRequestPolicy: external_exports.enum(["cache-first", "cache-only", "network-only", "cache-and-network"]).nullable().optional(),
     // Pluggable hardware envelope encryption secret storage provider
-    secretStorage: external_exports.unknown().optional()
+    secretStorage: external_exports.unknown().optional(),
+    mlKemParameterSet: external_exports.union([external_exports.literal(1024), external_exports.literal(768)]).optional()
   }).strict();
   var EnvironmentConfigSchema = external_exports.object({
     NODE_ENV: external_exports.enum(["development", "production", "test"]).optional(),
@@ -51932,10 +52080,121 @@ ${operationTypes.join("\n")}
     return result === 0;
   }
 
+  // src/storage/secretEnvelope.ts
+  init_SecretStorageException();
+  var ENVELOPE_ALGORITHM = "AES-GCM";
+  var DEFAULT_ITERATIONS = 1e5;
+  var SECRET_KEY_PREFIX = "knishio:secret:";
+  var RECOVERY_KEY_PREFIX = "knishio:recovery:";
+  var GCM_IV_LENGTH = 12;
+  var SALT_LENGTH = 16;
+  var textEncoder2 = new TextEncoder();
+  function uint8ArrayToBase642(bytes) {
+    let binary = "";
+    const len = bytes.byteLength;
+    for (let i4 = 0; i4 < len; i4++) {
+      const byte = bytes[i4];
+      if (byte !== void 0) {
+        binary += String.fromCharCode(byte);
+      }
+    }
+    return btoa(binary);
+  }
+  function base64ToUint8Array2(base643) {
+    const binary = atob(base643);
+    const len = binary.length;
+    const bytes = new Uint8Array(len);
+    for (let i4 = 0; i4 < len; i4++) {
+      bytes[i4] = binary.charCodeAt(i4);
+    }
+    return bytes;
+  }
+  async function deriveEnvelopeKey(passphrase, salt, iterations = DEFAULT_ITERATIONS) {
+    if (typeof globalThis.crypto === "undefined" || typeof globalThis.crypto.subtle === "undefined") {
+      throw new exports.SecretStorageException("WebCrypto API is not available");
+    }
+    const passphraseBytes = textEncoder2.encode(passphrase);
+    try {
+      const baseKey = await globalThis.crypto.subtle.importKey(
+        "raw",
+        passphraseBytes,
+        "PBKDF2",
+        false,
+        ["deriveKey"]
+      );
+      return await globalThis.crypto.subtle.deriveKey(
+        {
+          name: "PBKDF2",
+          salt,
+          iterations,
+          hash: "SHA-256"
+        },
+        baseKey,
+        { name: "AES-GCM", length: 256 },
+        false,
+        ["encrypt", "decrypt"]
+      );
+    } finally {
+      zeroizeBytes(passphraseBytes);
+    }
+  }
+  async function sealEnvelope(secret, passphrase, metadata) {
+    if (typeof globalThis.crypto === "undefined" || typeof globalThis.crypto.subtle === "undefined") {
+      throw new exports.SecretStorageException("WebCrypto API is not available");
+    }
+    const salt = new Uint8Array(SALT_LENGTH);
+    const iv = new Uint8Array(GCM_IV_LENGTH);
+    globalThis.crypto.getRandomValues(salt);
+    globalThis.crypto.getRandomValues(iv);
+    const key = await deriveEnvelopeKey(passphrase, salt, DEFAULT_ITERATIONS);
+    const secretBytes = textEncoder2.encode(secret);
+    try {
+      const encryptedBuffer = await globalThis.crypto.subtle.encrypt(
+        {
+          name: ENVELOPE_ALGORITHM,
+          iv
+        },
+        key,
+        secretBytes
+      );
+      const ciphertext = uint8ArrayToBase642(new Uint8Array(encryptedBuffer));
+      return {
+        version: 1,
+        ciphertext,
+        iv: uint8ArrayToBase642(iv),
+        salt: uint8ArrayToBase642(salt),
+        algorithm: ENVELOPE_ALGORITHM,
+        iterations: DEFAULT_ITERATIONS,
+        metadata
+      };
+    } finally {
+      zeroizeBytes(secretBytes);
+    }
+  }
+  async function openEnvelope(payload, passphrase) {
+    if (typeof globalThis.crypto === "undefined" || typeof globalThis.crypto.subtle === "undefined") {
+      throw new exports.SecretStorageException("WebCrypto API is not available");
+    }
+    const salt = base64ToUint8Array2(payload.salt);
+    const iv = base64ToUint8Array2(payload.iv);
+    const ciphertext = base64ToUint8Array2(payload.ciphertext);
+    const key = await deriveEnvelopeKey(passphrase, salt, payload.iterations ?? DEFAULT_ITERATIONS);
+    const decryptedBuffer = await globalThis.crypto.subtle.decrypt(
+      {
+        name: ENVELOPE_ALGORITHM,
+        iv
+      },
+      key,
+      ciphertext
+    );
+    return new Uint8Array(decryptedBuffer);
+  }
+
   // src/storage/MemorySecretStorageProvider.ts
   var MemorySecretStorageProvider = class {
     providerType = "memory";
     secrets = /* @__PURE__ */ new Map();
+    recoverySecrets = /* @__PURE__ */ new Map();
     /**
      * Memory storage is not hardware backed
      */
@@ -51966,6 +52225,17 @@ ${operationTypes.join("\n")}
         providerType: this.providerType
       };
       this.secrets.set(bundleHash, { secret, metadata });
+      if (options?.recoveryPassphrase) {
+        const recoveryMetadata = {
+          bundleHash,
+          label: options?.label,
+          createdAt: Date.now(),
+          hardwareBacked: false,
+          providerType: "webcrypto-aes-gcm"
+        };
+        const recoveryPayload = await sealEnvelope(secret, options.recoveryPassphrase, recoveryMetadata);
+        this.recoverySecrets.set(bundleHash, JSON.stringify(recoveryPayload));
+      }
     }
     /**
      * Retrieve a secret from memory
@@ -51978,6 +52248,7 @@ ${operationTypes.join("\n")}
      * Delete a stored secret
      */
     async deleteSecret(bundleHash) {
+      this.recoverySecrets.delete(bundleHash);
       return this.secrets.delete(bundleHash);
     }
     /**
@@ -52007,6 +52278,48 @@ ${operationTypes.join("\n")}
      */
     clear() {
       this.secrets.clear();
+      this.recoverySecrets.clear();
+    }
+    /**
+     * Recover a secret using its recovery envelope and restore it
+     */
+    async recoverSecret(bundleHash, recoveryPassphrase, options) {
+      if (!bundleHash) {
+        throw new exports.SecretStorageException("Bundle hash cannot be empty");
+      }
+      if (!recoveryPassphrase) {
+        throw new exports.SecretStorageException("Recovery passphrase cannot be empty");
+      }
+      const raw = this.recoverySecrets.get(bundleHash);
+      if (!raw) {
+        throw exports.SecretStorageException.notFound(bundleHash);
+      }
+      let payload;
+      try {
+        payload = JSON.parse(raw);
+      } catch {
+        throw exports.SecretStorageException.decryptionFailed("Corrupted recovery payload format");
+      }
+      let decryptedBytes;
+      try {
+        decryptedBytes = await openEnvelope(payload, recoveryPassphrase);
+      } catch (err) {
+        if (err instanceof exports.SecretStorageException) {
+          throw err;
+        }
+        const msg = err instanceof Error ? err.message : String(err);
+        throw exports.SecretStorageException.decryptionFailed(msg);
+      }
+      let secretStr;
+      try {
+        secretStr = new TextDecoder().decode(decryptedBytes);
+      } finally {
+        zeroizeBytes(decryptedBytes);
+      }
+      await this.storeSecret(bundleHash, secretStr, {
+        ...options,
+        recoveryPassphrase
+      });
     }
   };
 
@@ -52028,6 +52341,7 @@ ${operationTypes.join("\n")}
     $__authTokenObjects = {};
     $__authToken = null;
     $__authInProcess = false;
+    $__mlKemParameterSet = 1024;
     $__remainderWallet = null;
     lastMoleculeQuery = null;
     abortControllers = /* @__PURE__ */ new Map();
@@ -52072,7 +52386,8 @@ ${operationTypes.join("\n")}
         client,
         serverSdkVersion,
         logging,
-        defaultRequestPolicy
+        defaultRequestPolicy,
+        mlKemParameterSet: config2.mlKemParameterSet ?? 1024
       });
       if (config2.secretStorage) {
         this.$__secretStorage = config2.secretStorage;
@@ -52088,10 +52403,12 @@ ${operationTypes.join("\n")}
       client = null,
       serverSdkVersion = 3,
       logging = false,
-      defaultRequestPolicy = null
+      defaultRequestPolicy = null,
+      mlKemParameterSet = 1024
     }) {
       this.reset();
       this.$__logging = logging;
+      this.setMlKemParameterSet(mlKemParameterSet);
       this.$__authTokenObjects = {};
       this.setUri(uri);
       if (cellSlug) {
@@ -52112,6 +52429,17 @@ ${operationTypes.join("\n")}
       this.$__serverSdkVersion = serverSdkVersion;
       this.$__defaultRequestPolicy = defaultRequestPolicy;
     }
+    getMlKemParameterSet() {
+      return this.$__mlKemParameterSet || 1024;
+    }
+    setMlKemParameterSet(parameterSet) {
+      const paramNum = Number(parameterSet);
+      if (![1024, 768].includes(paramNum)) {
+        throw new Error(`KnishIO: unsupported ML-KEM parameter set ${parameterSet}; expected 1024 or 768.`);
+      }
+      this.$__mlKemParameterSet = paramNum;
+      return this;
+    }
     /**
      * Get random uri from specified this.$__uris
      */
@@ -52348,7 +52676,8 @@ ${operationTypes.join("\n")}
         bundle,
         token: "USER",
         batchId: sourceWallet.batchId,
-        characters: sourceWallet.characters
+        characters: sourceWallet.characters,
+        mlKemParameterSet: this.getMlKemParameterSet()
       }));
       return new Molecule({
         secret,
@@ -52357,7 +52686,8 @@ ${operationTypes.join("\n")}
         remainderWallet: this.getRemainderWallet(),
         cellSlug: this.getCellSlug(),
         version: this.getServerSdkVersion(),
-        continuIdPosition
+        continuIdPosition,
+        mlKemParameterSet: this.getMlKemParameterSet()
       });
     }
     /**
@@ -52469,7 +52799,8 @@ ${operationTypes.join("\n")}
       }))?.payload();
       if (!sourceWallet) {
         sourceWallet = new Wallet({
-          secret: this.getSecret()
+          secret: this.getSecret(),
+          mlKemParameterSet: this.getMlKemParameterSet()
         });
       } else {
         sourceWallet.key = Wallet.generateKey({
@@ -52512,7 +52843,8 @@ ${operationTypes.join("\n")}
       }
       const recipientWallet = Wallet.create({
         bundle: bundleHash,
-        token
+        token,
+        mlKemParameterSet: this.getMlKemParameterSet()
       });
       if (batchId !== null) {
         recipientWallet.batchId = batchId;
@@ -52579,7 +52911,8 @@ ${operationTypes.join("\n")}
       const recipientWallets = recipients.map((recipient) => {
         const recipientWallet = Wallet.create({
           bundle: recipient.bundleHash,
-          token
+          token,
+          mlKemParameterSet: this.getMlKemParameterSet()
         });
         if (recipient.batchId !== null && recipient.batchId !== void 0) {
           recipientWallet.batchId = recipient.batchId;
@@ -53203,7 +53536,8 @@ ${operationTypes.join("\n")}
         secret: this.getSecret(),
         bundle: this.getBundle(),
         token,
-        batchId
+        batchId,
+        mlKemParameterSet: this.getMlKemParameterSet()
       });
       await mutation.fillMolecule({
         recipientWallet,
@@ -53271,7 +53605,8 @@ ${operationTypes.join("\n")}
       const recipientWallet = new Wallet({
         secret: this.getSecret(),
         bundle: "0000000000000000000000000000000000000000000000000000000000000000",
-        token
+        token,
+        mlKemParameterSet: this.getMlKemParameterSet()
       });
       await mutation.fillMolecule({
         recipientWallet,
@@ -53348,7 +53683,8 @@ ${operationTypes.join("\n")}
       const newWallet = new Wallet({
         secret: this.getSecret(),
         bundle: this.getBundle(),
-        token
+        token,
+        mlKemParameterSet: this.getMlKemParameterSet()
       });
       await mutation.fillMolecule(newWallet);
       const response = await this.executeQuery(mutation);
@@ -53676,7 +54012,8 @@ ${operationTypes.join("\n")}
       this.setSecret(secret);
       const wallet = new Wallet({
         secret,
-        token: "AUTH"
+        token: "AUTH",
+        mlKemParameterSet: this.getMlKemParameterSet()
       });
       const molecule = await this.createMolecule({
         secret,
@@ -53804,45 +54141,25 @@ ${operationTypes.join("\n")}
       return Array.from(this.store.keys());
     }
   };
-  function uint8ArrayToBase642(bytes) {
-    let binary = "";
-    const len = bytes.byteLength;
-    for (let i4 = 0; i4 < len; i4++) {
-      const byte = bytes[i4];
-      if (byte !== void 0) {
-        binary += String.fromCharCode(byte);
-      }
-    }
-    return btoa(binary);
-  }
-  function base64ToUint8Array2(base643) {
-    const binary = atob(base643);
-    const len = binary.length;
-    const bytes = new Uint8Array(len);
-    for (let i4 = 0; i4 < len; i4++) {
-      bytes[i4] = binary.charCodeAt(i4);
-    }
-    return bytes;
-  }
-  var textEncoder2 = new TextEncoder();
   var textDecoder = new TextDecoder();
-  var KEY_PREFIX = "knishio:secret:";
-  var DEFAULT_ITERATIONS = 1e5;
+  var KEY_PREFIX = SECRET_KEY_PREFIX;
   var WebCryptoSecretStorageProvider = class {
     providerType = "webcrypto-aes-gcm";
     backend;
     defaultPassphrase;
-    hardwareBacked;
     constructor(options = {}) {
       this.backend = options.backend ?? new MemoryStorageBackend();
       this.defaultPassphrase = options.defaultPassphrase;
-      this.hardwareBacked = options.hardwareBacked ?? false;
     }
     /**
-     * Whether this provider is backed by hardware (e.g. WebAuthn PRF wrapping)
+     * True only when this provider holds a non-exportable key inside platform-secure
+     * hardware (Android TEE/StrongBox, Secure Enclave, TPM) and learned that from the
+     * platform itself — never from a caller argument. Software envelope providers
+     * return false. The value is persisted as `metadata.hardwareBacked` in every
+     * envelope this provider writes.
      */
     isHardwareBacked() {
-      return this.hardwareBacked;
+      return false;
     }
     /**
      * Check if WebCrypto subtle API is available
@@ -53850,38 +54167,6 @@ ${operationTypes.join("\n")}
     async isAvailable() {
       return typeof globalThis.crypto !== "undefined" && typeof globalThis.crypto.subtle !== "undefined";
     }
-    /**
-     * Derive an AES-GCM CryptoKey from a passphrase and salt using PBKDF2
-     */
-    async deriveKey(passphrase, salt, iterations = DEFAULT_ITERATIONS) {
-      if (!await this.isAvailable()) {
-        throw exports.SecretStorageException.unavailable(this.providerType, "WebCrypto API is not available");
-      }
-      const passphraseBytes = textEncoder2.encode(passphrase);
-      try {
-        const baseKey = await globalThis.crypto.subtle.importKey(
-          "raw",
-          passphraseBytes,
-          "PBKDF2",
-          false,
-          ["deriveKey"]
-        );
-        return await globalThis.crypto.subtle.deriveKey(
-          {
-            name: "PBKDF2",
-            salt,
-            iterations,
-            hash: "SHA-256"
-          },
-          baseKey,
-          { name: "AES-GCM", length: 256 },
-          false,
-          ["encrypt", "decrypt"]
-        );
-      } finally {
-        zeroizeBytes(passphraseBytes);
-      }
-    }
     /**
      * Store and encrypt a master secret
      */
@@ -53896,44 +54181,36 @@ ${operationTypes.join("\n")}
       if (!passphrase) {
         throw new exports.SecretStorageException("Passphrase required for envelope encryption");
       }
-      const salt = new Uint8Array(16);
-      const iv = new Uint8Array(12);
-      globalThis.crypto.getRandomValues(salt);
-      globalThis.crypto.getRandomValues(iv);
-      const key = await this.deriveKey(passphrase, salt, DEFAULT_ITERATIONS);
-      const secretBytes = textEncoder2.encode(secret);
+      if (!await this.isAvailable()) {
+        throw exports.SecretStorageException.unavailable(this.providerType, "WebCrypto API is not available");
+      }
       try {
-        const encryptedBuffer = await globalThis.crypto.subtle.encrypt(
-          {
-            name: "AES-GCM",
-            iv
-          },
-          key,
-          secretBytes
-        );
-        const ciphertext = uint8ArrayToBase642(new Uint8Array(encryptedBuffer));
         const metadata = {
           bundleHash,
           label: options?.label,
           createdAt: Date.now(),
-          hardwareBacked: this.hardwareBacked,
+          hardwareBacked: false,
           providerType: this.providerType
         };
-        const payload = {
-          version: 1,
-          ciphertext,
-          iv: uint8ArrayToBase642(iv),
-          salt: uint8ArrayToBase642(salt),
-          algorithm: "AES-GCM",
-          iterations: DEFAULT_ITERATIONS,
-          metadata
-        };
+        const payload = await sealEnvelope(secret, passphrase, metadata);
         await this.backend.setItem(`${KEY_PREFIX}${bundleHash}`, JSON.stringify(payload));
+        if (options?.recoveryPassphrase) {
+          const recoveryMetadata = {
+            bundleHash,
+            label: options?.label,
+            createdAt: Date.now(),
+            hardwareBacked: false,
+            providerType: "webcrypto-aes-gcm"
+          };
+          const recoveryPayload = await sealEnvelope(secret, options.recoveryPassphrase, recoveryMetadata);
+          await this.backend.setItem(`${RECOVERY_KEY_PREFIX}${bundleHash}`, JSON.stringify(recoveryPayload));
+        }
       } catch (err) {
+        if (err instanceof exports.SecretStorageException) {
+          throw err;
+        }
         const msg = err instanceof Error ? err.message : String(err);
         throw new exports.SecretStorageException(`Encryption failed: ${msg}`);
-      } finally {
-        zeroizeBytes(secretBytes);
       }
     }
     /**
@@ -53954,26 +54231,20 @@ ${operationTypes.join("\n")}
       if (!passphrase) {
         throw new exports.SecretStorageException("Passphrase required for secret decryption");
       }
-      const salt = base64ToUint8Array2(payload.salt);
-      const iv = base64ToUint8Array2(payload.iv);
-      const ciphertext = base64ToUint8Array2(payload.ciphertext);
+      if (!await this.isAvailable()) {
+        throw exports.SecretStorageException.unavailable(this.providerType, "WebCrypto API is not available");
+      }
       try {
-        const key = await this.deriveKey(passphrase, salt, payload.iterations ?? DEFAULT_ITERATIONS);
-        const decryptedBuffer = await globalThis.crypto.subtle.decrypt(
-          {
-            name: "AES-GCM",
-            iv
-          },
-          key,
-          ciphertext
-        );
-        const decryptedBytes = new Uint8Array(decryptedBuffer);
+        const decryptedBytes = await openEnvelope(payload, passphrase);
         try {
           return textDecoder.decode(decryptedBytes);
         } finally {
           zeroizeBytes(decryptedBytes);
         }
       } catch (err) {
+        if (err instanceof exports.SecretStorageException) {
+          throw err;
+        }
         const msg = err instanceof Error ? err.message : String(err);
         throw exports.SecretStorageException.decryptionFailed(msg);
       }
@@ -53983,7 +54254,9 @@ ${operationTypes.join("\n")}
      */
     async deleteSecret(bundleHash) {
       const key = `${KEY_PREFIX}${bundleHash}`;
+      const recoveryKey = `${RECOVERY_KEY_PREFIX}${bundleHash}`;
       const result = await this.backend.removeItem(key);
+      await this.backend.removeItem(recoveryKey);
       return result !== false;
     }
     /**
@@ -53998,7 +54271,7 @@ ${operationTypes.join("\n")}
      */
     async listSecrets() {
       const keys = await this.backend.keys();
-      const matchingKeys = keys.filter((k2) => k2.startsWith(KEY_PREFIX));
+      const matchingKeys = keys.filter((k2) => k2.startsWith(KEY_PREFIX) && !k2.startsWith(RECOVERY_KEY_PREFIX));
       const results = [];
       for (const key of matchingKeys) {
         const raw = await this.backend.getItem(key);
@@ -54032,22 +54305,1008 @@ ${operationTypes.join("\n")}
       if (!passphrase) {
         throw new exports.SecretStorageException("Passphrase required for secret decryption");
       }
-      const salt = base64ToUint8Array2(payload.salt);
-      const iv = base64ToUint8Array2(payload.iv);
-      const ciphertext = base64ToUint8Array2(payload.ciphertext);
+      if (!await this.isAvailable()) {
+        throw exports.SecretStorageException.unavailable(this.providerType, "WebCrypto API is not available");
+      }
+      try {
+        const decryptedBytes = await openEnvelope(payload, passphrase);
+        return await withSecureBytes(decryptedBytes, async (bytes) => {
+          const secretString = textDecoder.decode(bytes);
+          return await fn(secretString);
+        });
+      } catch (err) {
+        if (err instanceof exports.SecretStorageException) {
+          throw err;
+        }
+        const msg = err instanceof Error ? err.message : String(err);
+        throw exports.SecretStorageException.decryptionFailed(msg);
+      }
+    }
+    /**
+     * Recover a secret using its recovery envelope and re-enroll it
+     */
+    async recoverSecret(bundleHash, recoveryPassphrase, options) {
+      if (!bundleHash) {
+        throw new exports.SecretStorageException("Bundle hash cannot be empty");
+      }
+      if (!recoveryPassphrase) {
+        throw new exports.SecretStorageException("Recovery passphrase cannot be empty");
+      }
+      const raw = await this.backend.getItem(`${RECOVERY_KEY_PREFIX}${bundleHash}`);
+      if (!raw) {
+        throw exports.SecretStorageException.notFound(bundleHash);
+      }
+      let payload;
+      try {
+        payload = JSON.parse(raw);
+      } catch {
+        throw exports.SecretStorageException.decryptionFailed("Corrupted recovery payload format");
+      }
+      let decryptedBytes;
+      try {
+        decryptedBytes = await openEnvelope(payload, recoveryPassphrase);
+      } catch (err) {
+        if (err instanceof exports.SecretStorageException) {
+          throw err;
+        }
+        const msg = err instanceof Error ? err.message : String(err);
+        throw exports.SecretStorageException.decryptionFailed(msg);
+      }
+      let secretStr;
+      try {
+        secretStr = textDecoder.decode(decryptedBytes);
+      } finally {
+        zeroizeBytes(decryptedBytes);
+      }
+      const storePassphrase = options?.passphrase ?? this.defaultPassphrase ?? recoveryPassphrase;
+      await this.storeSecret(bundleHash, secretStr, {
+        ...options,
+        passphrase: storePassphrase,
+        recoveryPassphrase
+      });
+    }
+  };
+
+  // src/storage/FileStorageBackend.ts
+  init_SecretStorageException();
+  var FileStorageBackend = class {
+    filePath;
+    store = /* @__PURE__ */ new Map();
+    loaded = false;
+    constructor(filePath) {
+      if (!filePath) {
+        throw new exports.SecretStorageException("Storage file path cannot be empty");
+      }
+      this.filePath = filePath;
+    }
+    async getFs() {
+      try {
+        const fs = await import('fs/promises');
+        const path = await import('path');
+        return { fs, path };
+      } catch {
+        throw exports.SecretStorageException.unavailable(
+          "file-storage",
+          "FileStorageBackend is only supported in Node.js environments with node:fs access"
+        );
+      }
+    }
+    async ensureLoaded() {
+      if (this.loaded) {
+        return this.store;
+      }
+      const { fs } = await this.getFs();
+      try {
+        const content = await fs.readFile(this.filePath, "utf8");
+        let parsed;
+        try {
+          parsed = JSON.parse(content);
+        } catch {
+          throw exports.SecretStorageException.decryptionFailed("Corrupted storage file format");
+        }
+        if (parsed && typeof parsed === "object") {
+          this.store = new Map(Object.entries(parsed).map(([k2, v3]) => [k2, String(v3)]));
+        }
+      } catch (err) {
+        if (err instanceof exports.SecretStorageException) {
+          throw err;
+        }
+        const nodeErr = err;
+        if (nodeErr?.code !== "ENOENT") {
+          const msg = err instanceof Error ? err.message : String(err);
+          throw new exports.SecretStorageException(`Failed to read storage file: ${msg}`);
+        }
+        this.store = /* @__PURE__ */ new Map();
+      }
+      this.loaded = true;
+      return this.store;
+    }
+    async persist() {
+      const { fs, path } = await this.getFs();
+      const dir = path.dirname(this.filePath);
+      if (dir && dir !== ".") {
+        await fs.mkdir(dir, { recursive: true });
+      }
+      const tmpPath = `${this.filePath}.tmp.${Date.now()}_${Math.random().toString(36).slice(2)}`;
+      const data = JSON.stringify(Object.fromEntries(this.store), null, 2);
+      try {
+        await fs.writeFile(tmpPath, data, { mode: 384, encoding: "utf8" });
+        if (typeof process !== "undefined" && process.platform !== "win32") {
+          try {
+            await fs.chmod(tmpPath, 384);
+          } catch {
+          }
+        }
+        await fs.rename(tmpPath, this.filePath);
+      } catch (err) {
+        try {
+          await fs.unlink(tmpPath);
+        } catch {
+        }
+        const msg = err instanceof Error ? err.message : String(err);
+        throw new exports.SecretStorageException(`Failed to persist storage file: ${msg}`);
+      }
+    }
+    async getItem(key) {
+      await this.ensureLoaded();
+      return this.store.get(key) ?? null;
+    }
+    async setItem(key, value2) {
+      await this.ensureLoaded();
+      this.store.set(key, value2);
+      await this.persist();
+    }
+    async removeItem(key) {
+      await this.ensureLoaded();
+      const existed = this.store.delete(key);
+      if (existed) {
+        await this.persist();
+      }
+      return existed;
+    }
+    async keys() {
+      await this.ensureLoaded();
+      return Array.from(this.store.keys());
+    }
+  };
+
+  // src/storage/WebStorageBackend.ts
+  init_SecretStorageException();
+  var WebStorageBackend = class {
+    storage;
+    prefix;
+    constructor(storage, prefix = "knishio:") {
+      if (storage) {
+        this.storage = storage;
+      } else if (typeof globalThis !== "undefined" && globalThis.localStorage) {
+        this.storage = globalThis.localStorage;
+      } else {
+        throw exports.SecretStorageException.unavailable(
+          "web-storage",
+          "WebStorageBackend requires a Storage object or global localStorage"
+        );
+      }
+      this.prefix = prefix;
+    }
+    getItem(key) {
+      return this.storage.getItem(key);
+    }
+    setItem(key, value2) {
+      this.storage.setItem(key, value2);
+    }
+    removeItem(key) {
+      const existed = this.storage.getItem(key) !== null;
+      this.storage.removeItem(key);
+      return existed;
+    }
+    keys() {
+      const result = [];
+      const len = this.storage.length;
+      for (let i4 = 0; i4 < len; i4++) {
+        const k2 = this.storage.key(i4);
+        if (k2 !== null) {
+          if (!this.prefix || k2.startsWith(this.prefix)) {
+            result.push(k2);
+          }
+        }
+      }
+      return result;
+    }
+  };
+
+  // src/storage/WebAuthnPrfSecretStorageProvider.ts
+  init_SecretStorageException();
+  var PRF_SALT_LABEL = "knishio:secret-storage:webauthn-prf:v1";
+  var KEK_INFO = "knishio:secret-storage:kek:v1";
+  var KEY_PREFIX2 = SECRET_KEY_PREFIX;
+  var GCM_IV_LENGTH2 = 12;
+  var textEncoder3 = new TextEncoder();
+  var textDecoder2 = new TextDecoder();
+  function base64UrlEncode(bytes) {
+    return uint8ArrayToBase642(bytes).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+  }
+  function base64UrlDecode(str) {
+    let base643 = str.replace(/-/g, "+").replace(/_/g, "/");
+    while (base643.length % 4 !== 0) {
+      base643 += "=";
+    }
+    return base64ToUint8Array2(base643);
+  }
+  function toUint8Array(buf) {
+    if (buf instanceof Uint8Array) {
+      return buf;
+    }
+    if (ArrayBuffer.isView(buf)) {
+      return new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength);
+    }
+    return new Uint8Array(buf);
+  }
+  async function computePrfSalt() {
+    const hash2 = await globalThis.crypto.subtle.digest("SHA-256", textEncoder3.encode(PRF_SALT_LABEL));
+    return new Uint8Array(hash2);
+  }
+  async function deriveKekFromPrf(prfOutput, prfSalt) {
+    const hkdfKey = await globalThis.crypto.subtle.importKey(
+      "raw",
+      prfOutput,
+      "HKDF",
+      false,
+      ["deriveKey"]
+    );
+    return await globalThis.crypto.subtle.deriveKey(
+      {
+        name: "HKDF",
+        hash: "SHA-256",
+        salt: prfSalt,
+        info: textEncoder3.encode(KEK_INFO)
+      },
+      hkdfKey,
+      { name: "AES-GCM", length: 256 },
+      false,
+      ["encrypt", "decrypt"]
+    );
+  }
+  var WebAuthnPrfSecretStorageProvider = class {
+    providerType = "webauthn-prf";
+    backend;
+    rp;
+    user;
+    credentialsContainer;
+    alias;
+    cachedPassphrase;
+    constructor(options) {
+      this.backend = options.backend;
+      this.rp = options.rp;
+      this.user = options.user;
+      this.credentialsContainer = options.credentials;
+      this.alias = options.alias ?? "default";
+    }
+    get credentials() {
+      if (this.credentialsContainer) {
+        return this.credentialsContainer;
+      }
+      if (typeof globalThis.navigator !== "undefined" && globalThis.navigator.credentials) {
+        return globalThis.navigator.credentials;
+      }
+      throw exports.SecretStorageException.unavailable(
+        this.providerType,
+        "WebAuthn credentials container is not available"
+      );
+    }
+    get recordKey() {
+      return `knishio:webauthn-prf:${this.alias}`;
+    }
+    isHardwareBacked() {
+      return false;
+    }
+    async isAvailable() {
+      const hasWebCrypto = typeof globalThis.crypto !== "undefined" && typeof globalThis.crypto.subtle !== "undefined";
+      const hasCredentials = Boolean(
+        this.credentialsContainer || typeof globalThis.navigator !== "undefined" && globalThis.navigator.credentials && typeof globalThis.PublicKeyCredential !== "undefined"
+      );
+      return hasWebCrypto && hasCredentials;
+    }
+    /**
+     * Enroll a new passkey credential with PRF support and wrap a random device passphrase
+     */
+    async enroll() {
+      const existing = await this.backend.getItem(this.recordKey);
+      if (existing) {
+        return;
+      }
+      if (!await this.isAvailable()) {
+        throw exports.SecretStorageException.unavailable(this.providerType, "WebAuthn PRF is not available");
+      }
+      const challenge = new Uint8Array(32);
+      globalThis.crypto.getRandomValues(challenge);
+      const credential = await this.credentials.create({
+        publicKey: {
+          rp: this.rp,
+          user: {
+            id: this.user.id,
+            name: this.user.name,
+            displayName: this.user.displayName
+          },
+          challenge,
+          pubKeyCredParams: [
+            { type: "public-key", alg: -7 },
+            { type: "public-key", alg: -257 }
+          ],
+          authenticatorSelection: {
+            residentKey: "required",
+            userVerification: "required"
+          },
+          extensions: {
+            prf: {}
+          }
+        }
+      });
+      if (!credential) {
+        throw exports.SecretStorageException.unavailable(this.providerType, "Authenticator creation returned null");
+      }
+      const extResults = credential.getClientExtensionResults?.();
+      if (extResults?.prf?.enabled !== true) {
+        throw exports.SecretStorageException.unavailable(
+          this.providerType,
+          "authenticator does not support the PRF extension"
+        );
+      }
+      const credentialIdBytes = new Uint8Array(credential.rawId);
+      const prfSalt = await computePrfSalt();
+      const getChallenge = new Uint8Array(32);
+      globalThis.crypto.getRandomValues(getChallenge);
+      let assertion;
+      try {
+        assertion = await this.credentials.get({
+          publicKey: {
+            challenge: getChallenge,
+            rpId: this.rp.id,
+            allowCredentials: [
+              {
+                type: "public-key",
+                id: credentialIdBytes
+              }
+            ],
+            userVerification: "required",
+            extensions: {
+              prf: {
+                eval: {
+                  first: prfSalt
+                }
+              }
+            }
+          }
+        });
+      } catch (err) {
+        const isNotAllowed = err instanceof Error && err.name === "NotAllowedError" || err?.name === "NotAllowedError";
+        if (isNotAllowed) {
+          throw exports.SecretStorageException.unavailable(
+            this.providerType,
+            "authenticator refused or credential missing"
+          );
+        }
+        throw err;
+      }
+      if (!assertion) {
+        throw exports.SecretStorageException.unavailable(
+          this.providerType,
+          "authenticator refused or credential missing"
+        );
+      }
+      const getExtResults = assertion?.getClientExtensionResults?.();
+      const firstOutput = getExtResults?.prf?.results?.first;
+      if (!firstOutput) {
+        throw exports.SecretStorageException.unavailable(
+          this.providerType,
+          "authenticator returned no PRF result"
+        );
+      }
+      const prfBytes = toUint8Array(firstOutput);
+      const kek = await deriveKekFromPrf(prfBytes, prfSalt);
+      const devicePassphraseBytes = new Uint8Array(32);
+      globalThis.crypto.getRandomValues(devicePassphraseBytes);
+      const devicePassphrase = uint8ArrayToBase642(devicePassphraseBytes);
+      const iv = new Uint8Array(GCM_IV_LENGTH2);
+      globalThis.crypto.getRandomValues(iv);
+      const passphraseBytes = textEncoder3.encode(devicePassphrase);
+      try {
+        const encryptedBuffer = await globalThis.crypto.subtle.encrypt(
+          {
+            name: "AES-GCM",
+            iv
+          },
+          kek,
+          passphraseBytes
+        );
+        const record2 = {
+          version: 1,
+          credentialId: base64UrlEncode(credentialIdBytes),
+          iv: uint8ArrayToBase642(iv),
+          ciphertext: uint8ArrayToBase642(new Uint8Array(encryptedBuffer))
+        };
+        await this.backend.setItem(this.recordKey, JSON.stringify(record2));
+        this.cachedPassphrase = devicePassphrase;
+      } finally {
+        zeroizeBytes(passphraseBytes);
+        zeroizeBytes(devicePassphraseBytes);
+      }
+    }
+    /**
+     * Unlock the device passphrase using the enrolled WebAuthn PRF credential
+     */
+    async unlock() {
+      if (this.cachedPassphrase) {
+        return this.cachedPassphrase;
+      }
+      const rawRecord = await this.backend.getItem(this.recordKey);
+      if (!rawRecord) {
+        throw exports.SecretStorageException.unavailable(
+          this.providerType,
+          "no enrolled credential; call enroll() first"
+        );
+      }
+      let record2;
+      try {
+        record2 = JSON.parse(rawRecord);
+      } catch {
+        throw exports.SecretStorageException.decryptionFailed("Corrupted PRF record format");
+      }
+      const credentialIdBytes = base64UrlDecode(record2.credentialId);
+      const prfSalt = await computePrfSalt();
+      const challenge = new Uint8Array(32);
+      globalThis.crypto.getRandomValues(challenge);
+      let assertion;
+      try {
+        assertion = await this.credentials.get({
+          publicKey: {
+            challenge,
+            rpId: this.rp.id,
+            allowCredentials: [
+              {
+                type: "public-key",
+                id: credentialIdBytes
+              }
+            ],
+            userVerification: "required",
+            extensions: {
+              prf: {
+                eval: {
+                  first: prfSalt
+                }
+              }
+            }
+          }
+        });
+      } catch (err) {
+        const isNotAllowed = err instanceof Error && err.name === "NotAllowedError" || err?.name === "NotAllowedError";
+        if (isNotAllowed) {
+          throw exports.SecretStorageException.unavailable(
+            this.providerType,
+            "authenticator refused or credential missing"
+          );
+        }
+        throw err;
+      }
+      if (!assertion) {
+        throw exports.SecretStorageException.unavailable(
+          this.providerType,
+          "authenticator refused or credential missing"
+        );
+      }
+      const extResults = assertion?.getClientExtensionResults?.();
+      const firstOutput = extResults?.prf?.results?.first;
+      if (!firstOutput) {
+        throw exports.SecretStorageException.unavailable(
+          this.providerType,
+          "authenticator returned no PRF result"
+        );
+      }
+      const prfBytes = toUint8Array(firstOutput);
+      const kek = await deriveKekFromPrf(prfBytes, prfSalt);
+      const iv = base64ToUint8Array2(record2.iv);
+      const ciphertext = base64ToUint8Array2(record2.ciphertext);
       try {
-        const key = await this.deriveKey(passphrase, salt, payload.iterations ?? DEFAULT_ITERATIONS);
         const decryptedBuffer = await globalThis.crypto.subtle.decrypt(
           {
             name: "AES-GCM",
             iv
           },
-          key,
+          kek,
           ciphertext
         );
         const decryptedBytes = new Uint8Array(decryptedBuffer);
+        try {
+          this.cachedPassphrase = textDecoder2.decode(decryptedBytes);
+          return this.cachedPassphrase;
+        } finally {
+          zeroizeBytes(decryptedBytes);
+        }
+      } catch {
+        throw exports.SecretStorageException.decryptionFailed(
+          "wrapped device passphrase failed authentication under the enrolled credential"
+        );
+      }
+    }
+    /**
+     * Lock the provider by clearing cached passphrase material
+     */
+    lock() {
+      this.cachedPassphrase = void 0;
+    }
+    /**
+     * Unenroll the current credential, removing the stored PRF record and clearing cached passphrase
+     */
+    async unenroll() {
+      this.lock();
+      await this.backend.removeItem(this.recordKey);
+    }
+    async storeSecret(bundleHash, secret, options) {
+      if (!bundleHash) {
+        throw new exports.SecretStorageException("Bundle hash cannot be empty");
+      }
+      if (!secret) {
+        throw new exports.SecretStorageException("Secret cannot be empty");
+      }
+      if (options?.passphrase) {
+        throw new exports.SecretStorageException(
+          "WebAuthnPrfSecretStorageProvider derives its passphrase from the authenticator; options.passphrase is not accepted"
+        );
+      }
+      if (!options?.recoveryPassphrase && !options?.allowUnrecoverable) {
+        throw exports.SecretStorageException.validationError(
+          "Recovery passphrase required for non-exportable hardware key unless allowUnrecoverable is true"
+        );
+      }
+      const passphrase = await this.unlock();
+      const metadata = {
+        bundleHash,
+        label: options?.label,
+        createdAt: Date.now(),
+        hardwareBacked: false,
+        providerType: this.providerType
+      };
+      const payload = await sealEnvelope(secret, passphrase, metadata);
+      await this.backend.setItem(`${KEY_PREFIX2}${bundleHash}`, JSON.stringify(payload));
+      if (options?.recoveryPassphrase) {
+        const recoveryMetadata = {
+          bundleHash,
+          label: options?.label,
+          createdAt: Date.now(),
+          hardwareBacked: false,
+          providerType: "webcrypto-aes-gcm"
+        };
+        const recoveryPayload = await sealEnvelope(secret, options.recoveryPassphrase, recoveryMetadata);
+        await this.backend.setItem(`${RECOVERY_KEY_PREFIX}${bundleHash}`, JSON.stringify(recoveryPayload));
+      }
+    }
+    async retrieveSecret(bundleHash, options) {
+      if (options?.passphrase) {
+        throw new exports.SecretStorageException(
+          "WebAuthnPrfSecretStorageProvider derives its passphrase from the authenticator; options.passphrase is not accepted"
+        );
+      }
+      const raw = await this.backend.getItem(`${KEY_PREFIX2}${bundleHash}`);
+      if (!raw) {
+        return null;
+      }
+      let payload;
+      try {
+        payload = JSON.parse(raw);
+      } catch {
+        throw exports.SecretStorageException.decryptionFailed("Corrupted payload format");
+      }
+      const passphrase = await this.unlock();
+      try {
+        const decryptedBytes = await openEnvelope(payload, passphrase);
+        try {
+          return textDecoder2.decode(decryptedBytes);
+        } finally {
+          zeroizeBytes(decryptedBytes);
+        }
+      } catch (err) {
+        if (err instanceof exports.SecretStorageException) {
+          throw err;
+        }
+        const msg = err instanceof Error ? err.message : String(err);
+        throw exports.SecretStorageException.decryptionFailed(msg);
+      }
+    }
+    async withSecret(bundleHash, fn, options) {
+      if (options?.passphrase) {
+        throw new exports.SecretStorageException(
+          "WebAuthnPrfSecretStorageProvider derives its passphrase from the authenticator; options.passphrase is not accepted"
+        );
+      }
+      const raw = await this.backend.getItem(`${KEY_PREFIX2}${bundleHash}`);
+      if (!raw) {
+        throw exports.SecretStorageException.notFound(bundleHash);
+      }
+      let payload;
+      try {
+        payload = JSON.parse(raw);
+      } catch {
+        throw exports.SecretStorageException.decryptionFailed("Corrupted payload format");
+      }
+      const passphrase = await this.unlock();
+      try {
+        const decryptedBytes = await openEnvelope(payload, passphrase);
         return await withSecureBytes(decryptedBytes, async (bytes) => {
-          const secretString = textDecoder.decode(bytes);
+          const secretString = textDecoder2.decode(bytes);
+          return await fn(secretString);
+        });
+      } catch (err) {
+        if (err instanceof exports.SecretStorageException) {
+          throw err;
+        }
+        const msg = err instanceof Error ? err.message : String(err);
+        throw exports.SecretStorageException.decryptionFailed(msg);
+      }
+    }
+    async deleteSecret(bundleHash) {
+      const key = `${KEY_PREFIX2}${bundleHash}`;
+      const recoveryKey = `${RECOVERY_KEY_PREFIX}${bundleHash}`;
+      const result = await this.backend.removeItem(key);
+      await this.backend.removeItem(recoveryKey);
+      return result !== false;
+    }
+    async hasSecret(bundleHash) {
+      const raw = await this.backend.getItem(`${KEY_PREFIX2}${bundleHash}`);
+      return raw !== null;
+    }
+    async listSecrets() {
+      const keys = await this.backend.keys();
+      const matchingKeys = keys.filter((k2) => k2.startsWith(KEY_PREFIX2) && !k2.startsWith(RECOVERY_KEY_PREFIX));
+      const results = [];
+      for (const key of matchingKeys) {
+        const raw = await this.backend.getItem(key);
+        if (raw) {
+          try {
+            const payload = JSON.parse(raw);
+            if (payload.metadata) {
+              results.push(payload.metadata);
+            }
+          } catch {
+          }
+        }
+      }
+      return results;
+    }
+    /**
+     * Recover a secret using its recovery envelope and re-enroll it under a fresh WebAuthn PRF credential
+     */
+    async recoverSecret(bundleHash, recoveryPassphrase, options) {
+      if (!bundleHash) {
+        throw new exports.SecretStorageException("Bundle hash cannot be empty");
+      }
+      if (!recoveryPassphrase) {
+        throw new exports.SecretStorageException("Recovery passphrase cannot be empty");
+      }
+      const raw = await this.backend.getItem(`${RECOVERY_KEY_PREFIX}${bundleHash}`);
+      if (!raw) {
+        throw exports.SecretStorageException.notFound(bundleHash);
+      }
+      let payload;
+      try {
+        payload = JSON.parse(raw);
+      } catch {
+        throw exports.SecretStorageException.decryptionFailed("Corrupted recovery payload format");
+      }
+      let decryptedBytes;
+      try {
+        decryptedBytes = await openEnvelope(payload, recoveryPassphrase);
+      } catch (err) {
+        if (err instanceof exports.SecretStorageException) {
+          throw err;
+        }
+        const msg = err instanceof Error ? err.message : String(err);
+        throw exports.SecretStorageException.decryptionFailed(msg);
+      }
+      let secretStr;
+      try {
+        secretStr = textDecoder2.decode(decryptedBytes);
+      } finally {
+        zeroizeBytes(decryptedBytes);
+      }
+      await this.storeSecret(bundleHash, secretStr, {
+        ...options,
+        recoveryPassphrase
+      });
+    }
+  };
+
+  // src/storage/NonExtractableKeySecretStorageProvider.ts
+  init_SecretStorageException();
+  var KEY_PREFIX3 = SECRET_KEY_PREFIX;
+  var GCM_IV_LENGTH3 = 12;
+  var textEncoder4 = new TextEncoder();
+  var textDecoder3 = new TextDecoder();
+  var MemoryKeyStore = class {
+    keys = /* @__PURE__ */ new Map();
+    async get(name2) {
+      return this.keys.get(name2);
+    }
+    async put(name2, key) {
+      this.keys.set(name2, key);
+    }
+    async delete(name2) {
+      return this.keys.delete(name2);
+    }
+  };
+  var IndexedDbKeyStore = class {
+    dbName;
+    storeName = "keys";
+    constructor(dbName = "knishio-secret-storage") {
+      this.dbName = dbName;
+    }
+    // Executor form intentionally retained for browser runtime compatibility with ES2022 / browsers without Promise.withResolvers polyfill
+    async getDb() {
+      if (typeof globalThis.indexedDB === "undefined") {
+        throw exports.SecretStorageException.unavailable(
+          "webcrypto-nonextractable",
+          "IndexedDB is not available"
+        );
+      }
+      return new Promise((resolve, reject) => {
+        const request = globalThis.indexedDB.open(this.dbName, 1);
+        request.onupgradeneeded = () => {
+          const db = request.result;
+          if (!db.objectStoreNames.contains(this.storeName)) {
+            db.createObjectStore(this.storeName);
+          }
+        };
+        request.onsuccess = () => resolve(request.result);
+        request.onerror = () => reject(request.error);
+      });
+    }
+    async get(name2) {
+      const db = await this.getDb();
+      return new Promise((resolve, reject) => {
+        const tx = db.transaction(this.storeName, "readonly");
+        const store = tx.objectStore(this.storeName);
+        const request = store.get(name2);
+        request.onsuccess = () => resolve(request.result);
+        request.onerror = () => reject(request.error);
+      });
+    }
+    async put(name2, key) {
+      const db = await this.getDb();
+      return new Promise((resolve, reject) => {
+        const tx = db.transaction(this.storeName, "readwrite");
+        const store = tx.objectStore(this.storeName);
+        const request = store.put(key, name2);
+        request.onsuccess = () => resolve();
+        request.onerror = () => reject(request.error);
+      });
+    }
+    async delete(name2) {
+      const db = await this.getDb();
+      return new Promise((resolve, reject) => {
+        const tx = db.transaction(this.storeName, "readwrite");
+        const store = tx.objectStore(this.storeName);
+        const request = store.delete(name2);
+        request.onsuccess = () => resolve(true);
+        request.onerror = () => reject(request.error);
+      });
+    }
+  };
+  var NonExtractableKeySecretStorageProvider = class {
+    providerType = "webcrypto-nonextractable";
+    backend;
+    keyStore;
+    alias;
+    cachedPassphrase;
+    constructor(options) {
+      this.backend = options.backend;
+      this.keyStore = options.keyStore ?? new IndexedDbKeyStore();
+      this.alias = options.alias ?? "default";
+    }
+    get recordKey() {
+      return `knishio:kek:webcrypto-nonextractable:${this.alias}`;
+    }
+    get kekStoreKey() {
+      return `knishio:kek:${this.alias}`;
+    }
+    isHardwareBacked() {
+      return false;
+    }
+    async isAvailable() {
+      return typeof globalThis.crypto !== "undefined" && typeof globalThis.crypto.subtle !== "undefined";
+    }
+    /**
+     * Unlock or initialize the device passphrase using the non-extractable KEK
+     */
+    async unlock() {
+      if (this.cachedPassphrase) {
+        return this.cachedPassphrase;
+      }
+      if (!await this.isAvailable()) {
+        throw exports.SecretStorageException.unavailable(
+          this.providerType,
+          "WebCrypto API is not available"
+        );
+      }
+      const rawRecord = await this.backend.getItem(this.recordKey);
+      if (!rawRecord) {
+        let kek2 = await this.keyStore.get(this.kekStoreKey);
+        if (!kek2) {
+          kek2 = await globalThis.crypto.subtle.generateKey(
+            { name: "AES-GCM", length: 256 },
+            false,
+            ["encrypt", "decrypt"]
+          );
+          await this.keyStore.put(this.kekStoreKey, kek2);
+        }
+        const devicePassphraseBytes = new Uint8Array(32);
+        globalThis.crypto.getRandomValues(devicePassphraseBytes);
+        const devicePassphrase = uint8ArrayToBase642(devicePassphraseBytes);
+        const iv2 = new Uint8Array(GCM_IV_LENGTH3);
+        globalThis.crypto.getRandomValues(iv2);
+        const passphraseBytes = textEncoder4.encode(devicePassphrase);
+        try {
+          const encryptedBuffer = await globalThis.crypto.subtle.encrypt(
+            {
+              name: "AES-GCM",
+              iv: iv2
+            },
+            kek2,
+            passphraseBytes
+          );
+          const record3 = {
+            version: 1,
+            iv: uint8ArrayToBase642(iv2),
+            ciphertext: uint8ArrayToBase642(new Uint8Array(encryptedBuffer))
+          };
+          await this.backend.setItem(this.recordKey, JSON.stringify(record3));
+          this.cachedPassphrase = devicePassphrase;
+          return devicePassphrase;
+        } finally {
+          zeroizeBytes(passphraseBytes);
+          zeroizeBytes(devicePassphraseBytes);
+        }
+      }
+      let record2;
+      try {
+        record2 = JSON.parse(rawRecord);
+      } catch {
+        throw exports.SecretStorageException.decryptionFailed("Corrupted key record format");
+      }
+      const kek = await this.keyStore.get(this.kekStoreKey);
+      if (!kek) {
+        throw exports.SecretStorageException.unavailable(
+          this.providerType,
+          `no non-extractable key found for alias '${this.alias}'`
+        );
+      }
+      const iv = base64ToUint8Array2(record2.iv);
+      const ciphertext = base64ToUint8Array2(record2.ciphertext);
+      try {
+        const decryptedBuffer = await globalThis.crypto.subtle.decrypt(
+          {
+            name: "AES-GCM",
+            iv
+          },
+          kek,
+          ciphertext
+        );
+        const decryptedBytes = new Uint8Array(decryptedBuffer);
+        try {
+          this.cachedPassphrase = textDecoder3.decode(decryptedBytes);
+          return this.cachedPassphrase;
+        } finally {
+          zeroizeBytes(decryptedBytes);
+        }
+      } catch {
+        throw exports.SecretStorageException.decryptionFailed(
+          "wrapped device passphrase failed authentication under non-extractable key"
+        );
+      }
+    }
+    /**
+     * Lock the provider by clearing cached passphrase material
+     */
+    lock() {
+      this.cachedPassphrase = void 0;
+    }
+    /**
+     * Unenroll the non-extractable key, removing the stored wrapped record and KEK
+     */
+    async unenroll() {
+      this.lock();
+      await this.backend.removeItem(this.recordKey);
+      await this.keyStore.delete(this.kekStoreKey);
+    }
+    async storeSecret(bundleHash, secret, options) {
+      if (!bundleHash) {
+        throw new exports.SecretStorageException("Bundle hash cannot be empty");
+      }
+      if (!secret) {
+        throw new exports.SecretStorageException("Secret cannot be empty");
+      }
+      if (options?.passphrase) {
+        throw new exports.SecretStorageException(
+          "NonExtractableKeySecretStorageProvider derives its passphrase from the non-extractable device key; options.passphrase is not accepted"
+        );
+      }
+      if (!options?.recoveryPassphrase && !options?.allowUnrecoverable) {
+        throw exports.SecretStorageException.validationError(
+          "Recovery passphrase required for non-exportable hardware key unless allowUnrecoverable is true"
+        );
+      }
+      const passphrase = await this.unlock();
+      const metadata = {
+        bundleHash,
+        label: options?.label,
+        createdAt: Date.now(),
+        hardwareBacked: false,
+        providerType: this.providerType
+      };
+      const payload = await sealEnvelope(secret, passphrase, metadata);
+      await this.backend.setItem(`${KEY_PREFIX3}${bundleHash}`, JSON.stringify(payload));
+      if (options?.recoveryPassphrase) {
+        const recoveryMetadata = {
+          bundleHash,
+          label: options?.label,
+          createdAt: Date.now(),
+          hardwareBacked: false,
+          providerType: "webcrypto-aes-gcm"
+        };
+        const recoveryPayload = await sealEnvelope(secret, options.recoveryPassphrase, recoveryMetadata);
+        await this.backend.setItem(`${RECOVERY_KEY_PREFIX}${bundleHash}`, JSON.stringify(recoveryPayload));
+      }
+    }
+    async retrieveSecret(bundleHash, options) {
+      if (options?.passphrase) {
+        throw new exports.SecretStorageException(
+          "NonExtractableKeySecretStorageProvider derives its passphrase from the non-extractable device key; options.passphrase is not accepted"
+        );
+      }
+      const raw = await this.backend.getItem(`${KEY_PREFIX3}${bundleHash}`);
+      if (!raw) {
+        return null;
+      }
+      let payload;
+      try {
+        payload = JSON.parse(raw);
+      } catch {
+        throw exports.SecretStorageException.decryptionFailed("Corrupted payload format");
+      }
+      const passphrase = await this.unlock();
+      try {
+        const decryptedBytes = await openEnvelope(payload, passphrase);
+        try {
+          return textDecoder3.decode(decryptedBytes);
+        } finally {
+          zeroizeBytes(decryptedBytes);
+        }
+      } catch (err) {
+        if (err instanceof exports.SecretStorageException) {
+          throw err;
+        }
+        const msg = err instanceof Error ? err.message : String(err);
+        throw exports.SecretStorageException.decryptionFailed(msg);
+      }
+    }
+    async withSecret(bundleHash, fn, options) {
+      if (options?.passphrase) {
+        throw new exports.SecretStorageException(
+          "NonExtractableKeySecretStorageProvider derives its passphrase from the non-extractable device key; options.passphrase is not accepted"
+        );
+      }
+      const raw = await this.backend.getItem(`${KEY_PREFIX3}${bundleHash}`);
+      if (!raw) {
+        throw exports.SecretStorageException.notFound(bundleHash);
+      }
+      let payload;
+      try {
+        payload = JSON.parse(raw);
+      } catch {
+        throw exports.SecretStorageException.decryptionFailed("Corrupted payload format");
+      }
+      const passphrase = await this.unlock();
+      try {
+        const decryptedBytes = await openEnvelope(payload, passphrase);
+        return await withSecureBytes(decryptedBytes, async (bytes) => {
+          const secretString = textDecoder3.decode(bytes);
           return await fn(secretString);
         });
       } catch (err) {
@@ -54058,6 +55317,76 @@ ${operationTypes.join("\n")}
         throw exports.SecretStorageException.decryptionFailed(msg);
       }
     }
+    async deleteSecret(bundleHash) {
+      const key = `${KEY_PREFIX3}${bundleHash}`;
+      const recoveryKey = `${RECOVERY_KEY_PREFIX}${bundleHash}`;
+      const result = await this.backend.removeItem(key);
+      await this.backend.removeItem(recoveryKey);
+      return result !== false;
+    }
+    async hasSecret(bundleHash) {
+      const raw = await this.backend.getItem(`${KEY_PREFIX3}${bundleHash}`);
+      return raw !== null;
+    }
+    async listSecrets() {
+      const keys = await this.backend.keys();
+      const matchingKeys = keys.filter((k2) => k2.startsWith(KEY_PREFIX3) && !k2.startsWith(RECOVERY_KEY_PREFIX));
+      const results = [];
+      for (const key of matchingKeys) {
+        const raw = await this.backend.getItem(key);
+        if (raw) {
+          try {
+            const payload = JSON.parse(raw);
+            if (payload.metadata) {
+              results.push(payload.metadata);
+            }
+          } catch {
+          }
+        }
+      }
+      return results;
+    }
+    /**
+     * Recover a secret using its recovery envelope and re-enroll it under a fresh non-extractable KEK
+     */
+    async recoverSecret(bundleHash, recoveryPassphrase, options) {
+      if (!bundleHash) {
+        throw new exports.SecretStorageException("Bundle hash cannot be empty");
+      }
+      if (!recoveryPassphrase) {
+        throw new exports.SecretStorageException("Recovery passphrase cannot be empty");
+      }
+      const raw = await this.backend.getItem(`${RECOVERY_KEY_PREFIX}${bundleHash}`);
+      if (!raw) {
+        throw exports.SecretStorageException.notFound(bundleHash);
+      }
+      let payload;
+      try {
+        payload = JSON.parse(raw);
+      } catch {
+        throw exports.SecretStorageException.decryptionFailed("Corrupted recovery payload format");
+      }
+      let decryptedBytes;
+      try {
+        decryptedBytes = await openEnvelope(payload, recoveryPassphrase);
+      } catch (err) {
+        if (err instanceof exports.SecretStorageException) {
+          throw err;
+        }
+        const msg = err instanceof Error ? err.message : String(err);
+        throw exports.SecretStorageException.decryptionFailed(msg);
+      }
+      let secretStr;
+      try {
+        secretStr = textDecoder3.decode(decryptedBytes);
+      } finally {
+        zeroizeBytes(decryptedBytes);
+      }
+      await this.storeSecret(bundleHash, secretStr, {
+        ...options,
+        recoveryPassphrase
+      });
+    }
   };
 
   // src/storage/index.ts
@@ -54068,15 +55397,14 @@ ${operationTypes.join("\n")}
     if (typeof globalThis.crypto !== "undefined" && typeof globalThis.crypto.subtle !== "undefined") {
       return new WebCryptoSecretStorageProvider({
         backend: options.backend,
-        defaultPassphrase: options.defaultPassphrase,
-        hardwareBacked: options.hardwareBacked
+        defaultPassphrase: options.defaultPassphrase
       });
     }
     return new MemorySecretStorageProvider();
   }
 
   // src/index.ts
-  var SDK_VERSION = "0.9.8";
+  var SDK_VERSION = "1.1.0";
   var SDK_NAME = "KnishIO-Client-TS";
   var COMPATIBLE_SERVER_VERSIONS = [4, 5];
   var SDK_INFO = {
@@ -54085,7 +55413,7 @@ ${operationTypes.join("\n")}
     description: "TypeScript SDK for Knish.IO post-blockchain distributed ledger",
     compatibleServerVersions: COMPATIBLE_SERVER_VERSIONS,
     features: [
-      "Post-quantum cryptography (XMSS, ML-KEM768)",
+      "Post-quantum cryptography (XMSS, ML-KEM-1024)",
       "Cross-platform compatibility",
       "Type-safe APIs",
       "DAG-based transaction processing",
@@ -54184,9 +55512,12 @@ ${operationTypes.join("\n")}
   exports.CheckMolecule = CheckMolecule;
   exports.DevUtils = DevUtils;
   exports.EXTENDED_COMPATIBILITY_TEST_VECTORS = EXTENDED_COMPATIBILITY_TEST_VECTORS;
+  exports.FileStorageBackend = FileStorageBackend;
   exports.GraphQLClient = GraphQLClient;
+  exports.IndexedDbKeyStore = IndexedDbKeyStore;
   exports.KnishIO = KnishIO;
   exports.KnishIOClient = KnishIOClient;
+  exports.MemoryKeyStore = MemoryKeyStore;
   exports.MemorySecretStorageProvider = MemorySecretStorageProvider;
   exports.MemoryStorageBackend = MemoryStorageBackend;
   exports.Meta = Meta;
@@ -54201,6 +55532,7 @@ ${operationTypes.join("\n")}
   exports.MutationRequestAuthorization = MutationRequestAuthorization;
   exports.MutationRequestTokens = MutationRequestTokens;
   exports.MutationTransferTokens = MutationTransferTokens;
+  exports.NonExtractableKeySecretStorageProvider = NonExtractableKeySecretStorageProvider;
   exports.PolicyMeta = PolicyMeta;
   exports.Query = Query;
   exports.QueryAtom = QueryAtom;
@@ -54212,6 +55544,7 @@ ${operationTypes.join("\n")}
   exports.QueryMetaTypeViaAtom = QueryMetaTypeViaAtom;
   exports.QueryWalletBundle = QueryWalletBundle;
   exports.QueryWalletList = QueryWalletList;
+  exports.RECOVERY_KEY_PREFIX = RECOVERY_KEY_PREFIX;
   exports.ResponseAppendRequest = ResponseAppendRequest;
   exports.ResponseAtom = ResponseAtom;
   exports.ResponseBalance = ResponseBalance;
@@ -54232,9 +55565,12 @@ ${operationTypes.join("\n")}
   exports.SDK_INFO = SDK_INFO;
   exports.SDK_NAME = SDK_NAME;
   exports.SDK_VERSION = SDK_VERSION;
+  exports.SECRET_KEY_PREFIX = SECRET_KEY_PREFIX;
   exports.TokenUnit = TokenUnit;
   exports.Wallet = Wallet;
+  exports.WebAuthnPrfSecretStorageProvider = WebAuthnPrfSecretStorageProvider;
   exports.WebCryptoSecretStorageProvider = WebCryptoSecretStorageProvider;
+  exports.WebStorageBackend = WebStorageBackend;
   exports.base64ToHex = base64ToHex;
   exports.bufferToHexString = bufferToHexString;
   exports.capitalize = capitalize;
@@ -54273,9 +55609,11 @@ ${operationTypes.join("\n")}
   exports.isPosition = isPosition2;
   exports.isWalletAddress = isWalletAddress2;
   exports.normalizeMolecularHash = normalizeMolecularHash;
+  exports.openEnvelope = openEnvelope;
   exports.randomString = randomString;
   exports.runCompatibilityTests = runCompatibilityTests;
   exports.runExtendedCompatibilityTests = runExtendedCompatibilityTests;
+  exports.sealEnvelope = sealEnvelope;
   exports.shake256 = shake256;
   exports.toCamelCase = toCamelCase;
   exports.toSnakeCase = toSnakeCase;