@wishknish/knishio-client-ts 1.0.0 → 1.1.0

package/dist/index.iife.js

@@ -20109,6 +20109,14 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
             }
           );
         }
+        /**
+         * Validation error for storage options or parameters
+         */
+        static validationError(message) {
+          return new _SecretStorageException(message, {
+            code: "VALIDATION_ERROR"
+          });
+        }
       };
     }
   });
@@ -52072,10 +52080,121 @@ ${operationTypes.join("\n")}
     return result === 0;
   }
 
+  // src/storage/secretEnvelope.ts
+  init_SecretStorageException();
+  var ENVELOPE_ALGORITHM = "AES-GCM";
+  var DEFAULT_ITERATIONS = 1e5;
+  var SECRET_KEY_PREFIX = "knishio:secret:";
+  var RECOVERY_KEY_PREFIX = "knishio:recovery:";
+  var GCM_IV_LENGTH = 12;
+  var SALT_LENGTH = 16;
+  var textEncoder2 = new TextEncoder();
+  function uint8ArrayToBase642(bytes) {
+    let binary = "";
+    const len = bytes.byteLength;
+    for (let i4 = 0; i4 < len; i4++) {
+      const byte = bytes[i4];
+      if (byte !== void 0) {
+        binary += String.fromCharCode(byte);
+      }
+    }
+    return btoa(binary);
+  }
+  function base64ToUint8Array2(base643) {
+    const binary = atob(base643);
+    const len = binary.length;
+    const bytes = new Uint8Array(len);
+    for (let i4 = 0; i4 < len; i4++) {
+      bytes[i4] = binary.charCodeAt(i4);
+    }
+    return bytes;
+  }
+  async function deriveEnvelopeKey(passphrase, salt, iterations = DEFAULT_ITERATIONS) {
+    if (typeof globalThis.crypto === "undefined" || typeof globalThis.crypto.subtle === "undefined") {
+      throw new exports.SecretStorageException("WebCrypto API is not available");
+    }
+    const passphraseBytes = textEncoder2.encode(passphrase);
+    try {
+      const baseKey = await globalThis.crypto.subtle.importKey(
+        "raw",
+        passphraseBytes,
+        "PBKDF2",
+        false,
+        ["deriveKey"]
+      );
+      return await globalThis.crypto.subtle.deriveKey(
+        {
+          name: "PBKDF2",
+          salt,
+          iterations,
+          hash: "SHA-256"
+        },
+        baseKey,
+        { name: "AES-GCM", length: 256 },
+        false,
+        ["encrypt", "decrypt"]
+      );
+    } finally {
+      zeroizeBytes(passphraseBytes);
+    }
+  }
+  async function sealEnvelope(secret, passphrase, metadata) {
+    if (typeof globalThis.crypto === "undefined" || typeof globalThis.crypto.subtle === "undefined") {
+      throw new exports.SecretStorageException("WebCrypto API is not available");
+    }
+    const salt = new Uint8Array(SALT_LENGTH);
+    const iv = new Uint8Array(GCM_IV_LENGTH);
+    globalThis.crypto.getRandomValues(salt);
+    globalThis.crypto.getRandomValues(iv);
+    const key = await deriveEnvelopeKey(passphrase, salt, DEFAULT_ITERATIONS);
+    const secretBytes = textEncoder2.encode(secret);
+    try {
+      const encryptedBuffer = await globalThis.crypto.subtle.encrypt(
+        {
+          name: ENVELOPE_ALGORITHM,
+          iv
+        },
+        key,
+        secretBytes
+      );
+      const ciphertext = uint8ArrayToBase642(new Uint8Array(encryptedBuffer));
+      return {
+        version: 1,
+        ciphertext,
+        iv: uint8ArrayToBase642(iv),
+        salt: uint8ArrayToBase642(salt),
+        algorithm: ENVELOPE_ALGORITHM,
+        iterations: DEFAULT_ITERATIONS,
+        metadata
+      };
+    } finally {
+      zeroizeBytes(secretBytes);
+    }
+  }
+  async function openEnvelope(payload, passphrase) {
+    if (typeof globalThis.crypto === "undefined" || typeof globalThis.crypto.subtle === "undefined") {
+      throw new exports.SecretStorageException("WebCrypto API is not available");
+    }
+    const salt = base64ToUint8Array2(payload.salt);
+    const iv = base64ToUint8Array2(payload.iv);
+    const ciphertext = base64ToUint8Array2(payload.ciphertext);
+    const key = await deriveEnvelopeKey(passphrase, salt, payload.iterations ?? DEFAULT_ITERATIONS);
+    const decryptedBuffer = await globalThis.crypto.subtle.decrypt(
+      {
+        name: ENVELOPE_ALGORITHM,
+        iv
+      },
+      key,
+      ciphertext
+    );
+    return new Uint8Array(decryptedBuffer);
+  }
+
   // src/storage/MemorySecretStorageProvider.ts
   var MemorySecretStorageProvider = class {
     providerType = "memory";
     secrets = /* @__PURE__ */ new Map();
+    recoverySecrets = /* @__PURE__ */ new Map();
     /**
      * Memory storage is not hardware backed
      */
@@ -52106,6 +52225,17 @@ ${operationTypes.join("\n")}
         providerType: this.providerType
       };
       this.secrets.set(bundleHash, { secret, metadata });
+      if (options?.recoveryPassphrase) {
+        const recoveryMetadata = {
+          bundleHash,
+          label: options?.label,
+          createdAt: Date.now(),
+          hardwareBacked: false,
+          providerType: "webcrypto-aes-gcm"
+        };
+        const recoveryPayload = await sealEnvelope(secret, options.recoveryPassphrase, recoveryMetadata);
+        this.recoverySecrets.set(bundleHash, JSON.stringify(recoveryPayload));
+      }
     }
     /**
      * Retrieve a secret from memory
@@ -52118,6 +52248,7 @@ ${operationTypes.join("\n")}
      * Delete a stored secret
      */
     async deleteSecret(bundleHash) {
+      this.recoverySecrets.delete(bundleHash);
       return this.secrets.delete(bundleHash);
     }
     /**
@@ -52147,6 +52278,48 @@ ${operationTypes.join("\n")}
      */
     clear() {
       this.secrets.clear();
+      this.recoverySecrets.clear();
+    }
+    /**
+     * Recover a secret using its recovery envelope and restore it
+     */
+    async recoverSecret(bundleHash, recoveryPassphrase, options) {
+      if (!bundleHash) {
+        throw new exports.SecretStorageException("Bundle hash cannot be empty");
+      }
+      if (!recoveryPassphrase) {
+        throw new exports.SecretStorageException("Recovery passphrase cannot be empty");
+      }
+      const raw = this.recoverySecrets.get(bundleHash);
+      if (!raw) {
+        throw exports.SecretStorageException.notFound(bundleHash);
+      }
+      let payload;
+      try {
+        payload = JSON.parse(raw);
+      } catch {
+        throw exports.SecretStorageException.decryptionFailed("Corrupted recovery payload format");
+      }
+      let decryptedBytes;
+      try {
+        decryptedBytes = await openEnvelope(payload, recoveryPassphrase);
+      } catch (err) {
+        if (err instanceof exports.SecretStorageException) {
+          throw err;
+        }
+        const msg = err instanceof Error ? err.message : String(err);
+        throw exports.SecretStorageException.decryptionFailed(msg);
+      }
+      let secretStr;
+      try {
+        secretStr = new TextDecoder().decode(decryptedBytes);
+      } finally {
+        zeroizeBytes(decryptedBytes);
+      }
+      await this.storeSecret(bundleHash, secretStr, {
+        ...options,
+        recoveryPassphrase
+      });
     }
   };
 
@@ -53968,45 +54141,25 @@ ${operationTypes.join("\n")}
       return Array.from(this.store.keys());
     }
   };
-  function uint8ArrayToBase642(bytes) {
-    let binary = "";
-    const len = bytes.byteLength;
-    for (let i4 = 0; i4 < len; i4++) {
-      const byte = bytes[i4];
-      if (byte !== void 0) {
-        binary += String.fromCharCode(byte);
-      }
-    }
-    return btoa(binary);
-  }
-  function base64ToUint8Array2(base643) {
-    const binary = atob(base643);
-    const len = binary.length;
-    const bytes = new Uint8Array(len);
-    for (let i4 = 0; i4 < len; i4++) {
-      bytes[i4] = binary.charCodeAt(i4);
-    }
-    return bytes;
-  }
-  var textEncoder2 = new TextEncoder();
   var textDecoder = new TextDecoder();
-  var KEY_PREFIX = "knishio:secret:";
-  var DEFAULT_ITERATIONS = 1e5;
+  var KEY_PREFIX = SECRET_KEY_PREFIX;
   var WebCryptoSecretStorageProvider = class {
     providerType = "webcrypto-aes-gcm";
     backend;
     defaultPassphrase;
-    hardwareBacked;
     constructor(options = {}) {
       this.backend = options.backend ?? new MemoryStorageBackend();
       this.defaultPassphrase = options.defaultPassphrase;
-      this.hardwareBacked = options.hardwareBacked ?? false;
     }
     /**
-     * Whether this provider is backed by hardware (e.g. WebAuthn PRF wrapping)
+     * True only when this provider holds a non-exportable key inside platform-secure
+     * hardware (Android TEE/StrongBox, Secure Enclave, TPM) and learned that from the
+     * platform itself — never from a caller argument. Software envelope providers
+     * return false. The value is persisted as `metadata.hardwareBacked` in every
+     * envelope this provider writes.
      */
     isHardwareBacked() {
-      return this.hardwareBacked;
+      return false;
     }
     /**
      * Check if WebCrypto subtle API is available
@@ -54014,38 +54167,6 @@ ${operationTypes.join("\n")}
     async isAvailable() {
       return typeof globalThis.crypto !== "undefined" && typeof globalThis.crypto.subtle !== "undefined";
     }
-    /**
-     * Derive an AES-GCM CryptoKey from a passphrase and salt using PBKDF2
-     */
-    async deriveKey(passphrase, salt, iterations = DEFAULT_ITERATIONS) {
-      if (!await this.isAvailable()) {
-        throw exports.SecretStorageException.unavailable(this.providerType, "WebCrypto API is not available");
-      }
-      const passphraseBytes = textEncoder2.encode(passphrase);
-      try {
-        const baseKey = await globalThis.crypto.subtle.importKey(
-          "raw",
-          passphraseBytes,
-          "PBKDF2",
-          false,
-          ["deriveKey"]
-        );
-        return await globalThis.crypto.subtle.deriveKey(
-          {
-            name: "PBKDF2",
-            salt,
-            iterations,
-            hash: "SHA-256"
-          },
-          baseKey,
-          { name: "AES-GCM", length: 256 },
-          false,
-          ["encrypt", "decrypt"]
-        );
-      } finally {
-        zeroizeBytes(passphraseBytes);
-      }
-    }
     /**
      * Store and encrypt a master secret
      */
@@ -54060,44 +54181,36 @@ ${operationTypes.join("\n")}
       if (!passphrase) {
         throw new exports.SecretStorageException("Passphrase required for envelope encryption");
       }
-      const salt = new Uint8Array(16);
-      const iv = new Uint8Array(12);
-      globalThis.crypto.getRandomValues(salt);
-      globalThis.crypto.getRandomValues(iv);
-      const key = await this.deriveKey(passphrase, salt, DEFAULT_ITERATIONS);
-      const secretBytes = textEncoder2.encode(secret);
+      if (!await this.isAvailable()) {
+        throw exports.SecretStorageException.unavailable(this.providerType, "WebCrypto API is not available");
+      }
       try {
-        const encryptedBuffer = await globalThis.crypto.subtle.encrypt(
-          {
-            name: "AES-GCM",
-            iv
-          },
-          key,
-          secretBytes
-        );
-        const ciphertext = uint8ArrayToBase642(new Uint8Array(encryptedBuffer));
         const metadata = {
           bundleHash,
           label: options?.label,
           createdAt: Date.now(),
-          hardwareBacked: this.hardwareBacked,
+          hardwareBacked: false,
           providerType: this.providerType
         };
-        const payload = {
-          version: 1,
-          ciphertext,
-          iv: uint8ArrayToBase642(iv),
-          salt: uint8ArrayToBase642(salt),
-          algorithm: "AES-GCM",
-          iterations: DEFAULT_ITERATIONS,
-          metadata
-        };
+        const payload = await sealEnvelope(secret, passphrase, metadata);
         await this.backend.setItem(`${KEY_PREFIX}${bundleHash}`, JSON.stringify(payload));
+        if (options?.recoveryPassphrase) {
+          const recoveryMetadata = {
+            bundleHash,
+            label: options?.label,
+            createdAt: Date.now(),
+            hardwareBacked: false,
+            providerType: "webcrypto-aes-gcm"
+          };
+          const recoveryPayload = await sealEnvelope(secret, options.recoveryPassphrase, recoveryMetadata);
+          await this.backend.setItem(`${RECOVERY_KEY_PREFIX}${bundleHash}`, JSON.stringify(recoveryPayload));
+        }
       } catch (err) {
+        if (err instanceof exports.SecretStorageException) {
+          throw err;
+        }
         const msg = err instanceof Error ? err.message : String(err);
         throw new exports.SecretStorageException(`Encryption failed: ${msg}`);
-      } finally {
-        zeroizeBytes(secretBytes);
       }
     }
     /**
@@ -54118,26 +54231,20 @@ ${operationTypes.join("\n")}
       if (!passphrase) {
         throw new exports.SecretStorageException("Passphrase required for secret decryption");
       }
-      const salt = base64ToUint8Array2(payload.salt);
-      const iv = base64ToUint8Array2(payload.iv);
-      const ciphertext = base64ToUint8Array2(payload.ciphertext);
+      if (!await this.isAvailable()) {
+        throw exports.SecretStorageException.unavailable(this.providerType, "WebCrypto API is not available");
+      }
       try {
-        const key = await this.deriveKey(passphrase, salt, payload.iterations ?? DEFAULT_ITERATIONS);
-        const decryptedBuffer = await globalThis.crypto.subtle.decrypt(
-          {
-            name: "AES-GCM",
-            iv
-          },
-          key,
-          ciphertext
-        );
-        const decryptedBytes = new Uint8Array(decryptedBuffer);
+        const decryptedBytes = await openEnvelope(payload, passphrase);
         try {
           return textDecoder.decode(decryptedBytes);
         } finally {
           zeroizeBytes(decryptedBytes);
         }
       } catch (err) {
+        if (err instanceof exports.SecretStorageException) {
+          throw err;
+        }
         const msg = err instanceof Error ? err.message : String(err);
         throw exports.SecretStorageException.decryptionFailed(msg);
       }
@@ -54147,7 +54254,9 @@ ${operationTypes.join("\n")}
      */
     async deleteSecret(bundleHash) {
       const key = `${KEY_PREFIX}${bundleHash}`;
+      const recoveryKey = `${RECOVERY_KEY_PREFIX}${bundleHash}`;
       const result = await this.backend.removeItem(key);
+      await this.backend.removeItem(recoveryKey);
       return result !== false;
     }
     /**
@@ -54162,7 +54271,7 @@ ${operationTypes.join("\n")}
      */
     async listSecrets() {
       const keys = await this.backend.keys();
-      const matchingKeys = keys.filter((k2) => k2.startsWith(KEY_PREFIX));
+      const matchingKeys = keys.filter((k2) => k2.startsWith(KEY_PREFIX) && !k2.startsWith(RECOVERY_KEY_PREFIX));
       const results = [];
       for (const key of matchingKeys) {
         const raw = await this.backend.getItem(key);
@@ -54196,22 +54305,633 @@ ${operationTypes.join("\n")}
       if (!passphrase) {
         throw new exports.SecretStorageException("Passphrase required for secret decryption");
       }
-      const salt = base64ToUint8Array2(payload.salt);
-      const iv = base64ToUint8Array2(payload.iv);
-      const ciphertext = base64ToUint8Array2(payload.ciphertext);
+      if (!await this.isAvailable()) {
+        throw exports.SecretStorageException.unavailable(this.providerType, "WebCrypto API is not available");
+      }
+      try {
+        const decryptedBytes = await openEnvelope(payload, passphrase);
+        return await withSecureBytes(decryptedBytes, async (bytes) => {
+          const secretString = textDecoder.decode(bytes);
+          return await fn(secretString);
+        });
+      } catch (err) {
+        if (err instanceof exports.SecretStorageException) {
+          throw err;
+        }
+        const msg = err instanceof Error ? err.message : String(err);
+        throw exports.SecretStorageException.decryptionFailed(msg);
+      }
+    }
+    /**
+     * Recover a secret using its recovery envelope and re-enroll it
+     */
+    async recoverSecret(bundleHash, recoveryPassphrase, options) {
+      if (!bundleHash) {
+        throw new exports.SecretStorageException("Bundle hash cannot be empty");
+      }
+      if (!recoveryPassphrase) {
+        throw new exports.SecretStorageException("Recovery passphrase cannot be empty");
+      }
+      const raw = await this.backend.getItem(`${RECOVERY_KEY_PREFIX}${bundleHash}`);
+      if (!raw) {
+        throw exports.SecretStorageException.notFound(bundleHash);
+      }
+      let payload;
+      try {
+        payload = JSON.parse(raw);
+      } catch {
+        throw exports.SecretStorageException.decryptionFailed("Corrupted recovery payload format");
+      }
+      let decryptedBytes;
+      try {
+        decryptedBytes = await openEnvelope(payload, recoveryPassphrase);
+      } catch (err) {
+        if (err instanceof exports.SecretStorageException) {
+          throw err;
+        }
+        const msg = err instanceof Error ? err.message : String(err);
+        throw exports.SecretStorageException.decryptionFailed(msg);
+      }
+      let secretStr;
+      try {
+        secretStr = textDecoder.decode(decryptedBytes);
+      } finally {
+        zeroizeBytes(decryptedBytes);
+      }
+      const storePassphrase = options?.passphrase ?? this.defaultPassphrase ?? recoveryPassphrase;
+      await this.storeSecret(bundleHash, secretStr, {
+        ...options,
+        passphrase: storePassphrase,
+        recoveryPassphrase
+      });
+    }
+  };
+
+  // src/storage/FileStorageBackend.ts
+  init_SecretStorageException();
+  var FileStorageBackend = class {
+    filePath;
+    store = /* @__PURE__ */ new Map();
+    loaded = false;
+    constructor(filePath) {
+      if (!filePath) {
+        throw new exports.SecretStorageException("Storage file path cannot be empty");
+      }
+      this.filePath = filePath;
+    }
+    async getFs() {
+      try {
+        const fs = await import('fs/promises');
+        const path = await import('path');
+        return { fs, path };
+      } catch {
+        throw exports.SecretStorageException.unavailable(
+          "file-storage",
+          "FileStorageBackend is only supported in Node.js environments with node:fs access"
+        );
+      }
+    }
+    async ensureLoaded() {
+      if (this.loaded) {
+        return this.store;
+      }
+      const { fs } = await this.getFs();
+      try {
+        const content = await fs.readFile(this.filePath, "utf8");
+        let parsed;
+        try {
+          parsed = JSON.parse(content);
+        } catch {
+          throw exports.SecretStorageException.decryptionFailed("Corrupted storage file format");
+        }
+        if (parsed && typeof parsed === "object") {
+          this.store = new Map(Object.entries(parsed).map(([k2, v3]) => [k2, String(v3)]));
+        }
+      } catch (err) {
+        if (err instanceof exports.SecretStorageException) {
+          throw err;
+        }
+        const nodeErr = err;
+        if (nodeErr?.code !== "ENOENT") {
+          const msg = err instanceof Error ? err.message : String(err);
+          throw new exports.SecretStorageException(`Failed to read storage file: ${msg}`);
+        }
+        this.store = /* @__PURE__ */ new Map();
+      }
+      this.loaded = true;
+      return this.store;
+    }
+    async persist() {
+      const { fs, path } = await this.getFs();
+      const dir = path.dirname(this.filePath);
+      if (dir && dir !== ".") {
+        await fs.mkdir(dir, { recursive: true });
+      }
+      const tmpPath = `${this.filePath}.tmp.${Date.now()}_${Math.random().toString(36).slice(2)}`;
+      const data = JSON.stringify(Object.fromEntries(this.store), null, 2);
+      try {
+        await fs.writeFile(tmpPath, data, { mode: 384, encoding: "utf8" });
+        if (typeof process !== "undefined" && process.platform !== "win32") {
+          try {
+            await fs.chmod(tmpPath, 384);
+          } catch {
+          }
+        }
+        await fs.rename(tmpPath, this.filePath);
+      } catch (err) {
+        try {
+          await fs.unlink(tmpPath);
+        } catch {
+        }
+        const msg = err instanceof Error ? err.message : String(err);
+        throw new exports.SecretStorageException(`Failed to persist storage file: ${msg}`);
+      }
+    }
+    async getItem(key) {
+      await this.ensureLoaded();
+      return this.store.get(key) ?? null;
+    }
+    async setItem(key, value2) {
+      await this.ensureLoaded();
+      this.store.set(key, value2);
+      await this.persist();
+    }
+    async removeItem(key) {
+      await this.ensureLoaded();
+      const existed = this.store.delete(key);
+      if (existed) {
+        await this.persist();
+      }
+      return existed;
+    }
+    async keys() {
+      await this.ensureLoaded();
+      return Array.from(this.store.keys());
+    }
+  };
+
+  // src/storage/WebStorageBackend.ts
+  init_SecretStorageException();
+  var WebStorageBackend = class {
+    storage;
+    prefix;
+    constructor(storage, prefix = "knishio:") {
+      if (storage) {
+        this.storage = storage;
+      } else if (typeof globalThis !== "undefined" && globalThis.localStorage) {
+        this.storage = globalThis.localStorage;
+      } else {
+        throw exports.SecretStorageException.unavailable(
+          "web-storage",
+          "WebStorageBackend requires a Storage object or global localStorage"
+        );
+      }
+      this.prefix = prefix;
+    }
+    getItem(key) {
+      return this.storage.getItem(key);
+    }
+    setItem(key, value2) {
+      this.storage.setItem(key, value2);
+    }
+    removeItem(key) {
+      const existed = this.storage.getItem(key) !== null;
+      this.storage.removeItem(key);
+      return existed;
+    }
+    keys() {
+      const result = [];
+      const len = this.storage.length;
+      for (let i4 = 0; i4 < len; i4++) {
+        const k2 = this.storage.key(i4);
+        if (k2 !== null) {
+          if (!this.prefix || k2.startsWith(this.prefix)) {
+            result.push(k2);
+          }
+        }
+      }
+      return result;
+    }
+  };
+
+  // src/storage/WebAuthnPrfSecretStorageProvider.ts
+  init_SecretStorageException();
+  var PRF_SALT_LABEL = "knishio:secret-storage:webauthn-prf:v1";
+  var KEK_INFO = "knishio:secret-storage:kek:v1";
+  var KEY_PREFIX2 = SECRET_KEY_PREFIX;
+  var GCM_IV_LENGTH2 = 12;
+  var textEncoder3 = new TextEncoder();
+  var textDecoder2 = new TextDecoder();
+  function base64UrlEncode(bytes) {
+    return uint8ArrayToBase642(bytes).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+  }
+  function base64UrlDecode(str) {
+    let base643 = str.replace(/-/g, "+").replace(/_/g, "/");
+    while (base643.length % 4 !== 0) {
+      base643 += "=";
+    }
+    return base64ToUint8Array2(base643);
+  }
+  function toUint8Array(buf) {
+    if (buf instanceof Uint8Array) {
+      return buf;
+    }
+    if (ArrayBuffer.isView(buf)) {
+      return new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength);
+    }
+    return new Uint8Array(buf);
+  }
+  async function computePrfSalt() {
+    const hash2 = await globalThis.crypto.subtle.digest("SHA-256", textEncoder3.encode(PRF_SALT_LABEL));
+    return new Uint8Array(hash2);
+  }
+  async function deriveKekFromPrf(prfOutput, prfSalt) {
+    const hkdfKey = await globalThis.crypto.subtle.importKey(
+      "raw",
+      prfOutput,
+      "HKDF",
+      false,
+      ["deriveKey"]
+    );
+    return await globalThis.crypto.subtle.deriveKey(
+      {
+        name: "HKDF",
+        hash: "SHA-256",
+        salt: prfSalt,
+        info: textEncoder3.encode(KEK_INFO)
+      },
+      hkdfKey,
+      { name: "AES-GCM", length: 256 },
+      false,
+      ["encrypt", "decrypt"]
+    );
+  }
+  var WebAuthnPrfSecretStorageProvider = class {
+    providerType = "webauthn-prf";
+    backend;
+    rp;
+    user;
+    credentialsContainer;
+    alias;
+    cachedPassphrase;
+    constructor(options) {
+      this.backend = options.backend;
+      this.rp = options.rp;
+      this.user = options.user;
+      this.credentialsContainer = options.credentials;
+      this.alias = options.alias ?? "default";
+    }
+    get credentials() {
+      if (this.credentialsContainer) {
+        return this.credentialsContainer;
+      }
+      if (typeof globalThis.navigator !== "undefined" && globalThis.navigator.credentials) {
+        return globalThis.navigator.credentials;
+      }
+      throw exports.SecretStorageException.unavailable(
+        this.providerType,
+        "WebAuthn credentials container is not available"
+      );
+    }
+    get recordKey() {
+      return `knishio:webauthn-prf:${this.alias}`;
+    }
+    isHardwareBacked() {
+      return false;
+    }
+    async isAvailable() {
+      const hasWebCrypto = typeof globalThis.crypto !== "undefined" && typeof globalThis.crypto.subtle !== "undefined";
+      const hasCredentials = Boolean(
+        this.credentialsContainer || typeof globalThis.navigator !== "undefined" && globalThis.navigator.credentials && typeof globalThis.PublicKeyCredential !== "undefined"
+      );
+      return hasWebCrypto && hasCredentials;
+    }
+    /**
+     * Enroll a new passkey credential with PRF support and wrap a random device passphrase
+     */
+    async enroll() {
+      const existing = await this.backend.getItem(this.recordKey);
+      if (existing) {
+        return;
+      }
+      if (!await this.isAvailable()) {
+        throw exports.SecretStorageException.unavailable(this.providerType, "WebAuthn PRF is not available");
+      }
+      const challenge = new Uint8Array(32);
+      globalThis.crypto.getRandomValues(challenge);
+      const credential = await this.credentials.create({
+        publicKey: {
+          rp: this.rp,
+          user: {
+            id: this.user.id,
+            name: this.user.name,
+            displayName: this.user.displayName
+          },
+          challenge,
+          pubKeyCredParams: [
+            { type: "public-key", alg: -7 },
+            { type: "public-key", alg: -257 }
+          ],
+          authenticatorSelection: {
+            residentKey: "required",
+            userVerification: "required"
+          },
+          extensions: {
+            prf: {}
+          }
+        }
+      });
+      if (!credential) {
+        throw exports.SecretStorageException.unavailable(this.providerType, "Authenticator creation returned null");
+      }
+      const extResults = credential.getClientExtensionResults?.();
+      if (extResults?.prf?.enabled !== true) {
+        throw exports.SecretStorageException.unavailable(
+          this.providerType,
+          "authenticator does not support the PRF extension"
+        );
+      }
+      const credentialIdBytes = new Uint8Array(credential.rawId);
+      const prfSalt = await computePrfSalt();
+      const getChallenge = new Uint8Array(32);
+      globalThis.crypto.getRandomValues(getChallenge);
+      let assertion;
+      try {
+        assertion = await this.credentials.get({
+          publicKey: {
+            challenge: getChallenge,
+            rpId: this.rp.id,
+            allowCredentials: [
+              {
+                type: "public-key",
+                id: credentialIdBytes
+              }
+            ],
+            userVerification: "required",
+            extensions: {
+              prf: {
+                eval: {
+                  first: prfSalt
+                }
+              }
+            }
+          }
+        });
+      } catch (err) {
+        const isNotAllowed = err instanceof Error && err.name === "NotAllowedError" || err?.name === "NotAllowedError";
+        if (isNotAllowed) {
+          throw exports.SecretStorageException.unavailable(
+            this.providerType,
+            "authenticator refused or credential missing"
+          );
+        }
+        throw err;
+      }
+      if (!assertion) {
+        throw exports.SecretStorageException.unavailable(
+          this.providerType,
+          "authenticator refused or credential missing"
+        );
+      }
+      const getExtResults = assertion?.getClientExtensionResults?.();
+      const firstOutput = getExtResults?.prf?.results?.first;
+      if (!firstOutput) {
+        throw exports.SecretStorageException.unavailable(
+          this.providerType,
+          "authenticator returned no PRF result"
+        );
+      }
+      const prfBytes = toUint8Array(firstOutput);
+      const kek = await deriveKekFromPrf(prfBytes, prfSalt);
+      const devicePassphraseBytes = new Uint8Array(32);
+      globalThis.crypto.getRandomValues(devicePassphraseBytes);
+      const devicePassphrase = uint8ArrayToBase642(devicePassphraseBytes);
+      const iv = new Uint8Array(GCM_IV_LENGTH2);
+      globalThis.crypto.getRandomValues(iv);
+      const passphraseBytes = textEncoder3.encode(devicePassphrase);
+      try {
+        const encryptedBuffer = await globalThis.crypto.subtle.encrypt(
+          {
+            name: "AES-GCM",
+            iv
+          },
+          kek,
+          passphraseBytes
+        );
+        const record2 = {
+          version: 1,
+          credentialId: base64UrlEncode(credentialIdBytes),
+          iv: uint8ArrayToBase642(iv),
+          ciphertext: uint8ArrayToBase642(new Uint8Array(encryptedBuffer))
+        };
+        await this.backend.setItem(this.recordKey, JSON.stringify(record2));
+        this.cachedPassphrase = devicePassphrase;
+      } finally {
+        zeroizeBytes(passphraseBytes);
+        zeroizeBytes(devicePassphraseBytes);
+      }
+    }
+    /**
+     * Unlock the device passphrase using the enrolled WebAuthn PRF credential
+     */
+    async unlock() {
+      if (this.cachedPassphrase) {
+        return this.cachedPassphrase;
+      }
+      const rawRecord = await this.backend.getItem(this.recordKey);
+      if (!rawRecord) {
+        throw exports.SecretStorageException.unavailable(
+          this.providerType,
+          "no enrolled credential; call enroll() first"
+        );
+      }
+      let record2;
+      try {
+        record2 = JSON.parse(rawRecord);
+      } catch {
+        throw exports.SecretStorageException.decryptionFailed("Corrupted PRF record format");
+      }
+      const credentialIdBytes = base64UrlDecode(record2.credentialId);
+      const prfSalt = await computePrfSalt();
+      const challenge = new Uint8Array(32);
+      globalThis.crypto.getRandomValues(challenge);
+      let assertion;
+      try {
+        assertion = await this.credentials.get({
+          publicKey: {
+            challenge,
+            rpId: this.rp.id,
+            allowCredentials: [
+              {
+                type: "public-key",
+                id: credentialIdBytes
+              }
+            ],
+            userVerification: "required",
+            extensions: {
+              prf: {
+                eval: {
+                  first: prfSalt
+                }
+              }
+            }
+          }
+        });
+      } catch (err) {
+        const isNotAllowed = err instanceof Error && err.name === "NotAllowedError" || err?.name === "NotAllowedError";
+        if (isNotAllowed) {
+          throw exports.SecretStorageException.unavailable(
+            this.providerType,
+            "authenticator refused or credential missing"
+          );
+        }
+        throw err;
+      }
+      if (!assertion) {
+        throw exports.SecretStorageException.unavailable(
+          this.providerType,
+          "authenticator refused or credential missing"
+        );
+      }
+      const extResults = assertion?.getClientExtensionResults?.();
+      const firstOutput = extResults?.prf?.results?.first;
+      if (!firstOutput) {
+        throw exports.SecretStorageException.unavailable(
+          this.providerType,
+          "authenticator returned no PRF result"
+        );
+      }
+      const prfBytes = toUint8Array(firstOutput);
+      const kek = await deriveKekFromPrf(prfBytes, prfSalt);
+      const iv = base64ToUint8Array2(record2.iv);
+      const ciphertext = base64ToUint8Array2(record2.ciphertext);
       try {
-        const key = await this.deriveKey(passphrase, salt, payload.iterations ?? DEFAULT_ITERATIONS);
         const decryptedBuffer = await globalThis.crypto.subtle.decrypt(
           {
             name: "AES-GCM",
             iv
           },
-          key,
+          kek,
           ciphertext
         );
         const decryptedBytes = new Uint8Array(decryptedBuffer);
+        try {
+          this.cachedPassphrase = textDecoder2.decode(decryptedBytes);
+          return this.cachedPassphrase;
+        } finally {
+          zeroizeBytes(decryptedBytes);
+        }
+      } catch {
+        throw exports.SecretStorageException.decryptionFailed(
+          "wrapped device passphrase failed authentication under the enrolled credential"
+        );
+      }
+    }
+    /**
+     * Lock the provider by clearing cached passphrase material
+     */
+    lock() {
+      this.cachedPassphrase = void 0;
+    }
+    /**
+     * Unenroll the current credential, removing the stored PRF record and clearing cached passphrase
+     */
+    async unenroll() {
+      this.lock();
+      await this.backend.removeItem(this.recordKey);
+    }
+    async storeSecret(bundleHash, secret, options) {
+      if (!bundleHash) {
+        throw new exports.SecretStorageException("Bundle hash cannot be empty");
+      }
+      if (!secret) {
+        throw new exports.SecretStorageException("Secret cannot be empty");
+      }
+      if (options?.passphrase) {
+        throw new exports.SecretStorageException(
+          "WebAuthnPrfSecretStorageProvider derives its passphrase from the authenticator; options.passphrase is not accepted"
+        );
+      }
+      if (!options?.recoveryPassphrase && !options?.allowUnrecoverable) {
+        throw exports.SecretStorageException.validationError(
+          "Recovery passphrase required for non-exportable hardware key unless allowUnrecoverable is true"
+        );
+      }
+      const passphrase = await this.unlock();
+      const metadata = {
+        bundleHash,
+        label: options?.label,
+        createdAt: Date.now(),
+        hardwareBacked: false,
+        providerType: this.providerType
+      };
+      const payload = await sealEnvelope(secret, passphrase, metadata);
+      await this.backend.setItem(`${KEY_PREFIX2}${bundleHash}`, JSON.stringify(payload));
+      if (options?.recoveryPassphrase) {
+        const recoveryMetadata = {
+          bundleHash,
+          label: options?.label,
+          createdAt: Date.now(),
+          hardwareBacked: false,
+          providerType: "webcrypto-aes-gcm"
+        };
+        const recoveryPayload = await sealEnvelope(secret, options.recoveryPassphrase, recoveryMetadata);
+        await this.backend.setItem(`${RECOVERY_KEY_PREFIX}${bundleHash}`, JSON.stringify(recoveryPayload));
+      }
+    }
+    async retrieveSecret(bundleHash, options) {
+      if (options?.passphrase) {
+        throw new exports.SecretStorageException(
+          "WebAuthnPrfSecretStorageProvider derives its passphrase from the authenticator; options.passphrase is not accepted"
+        );
+      }
+      const raw = await this.backend.getItem(`${KEY_PREFIX2}${bundleHash}`);
+      if (!raw) {
+        return null;
+      }
+      let payload;
+      try {
+        payload = JSON.parse(raw);
+      } catch {
+        throw exports.SecretStorageException.decryptionFailed("Corrupted payload format");
+      }
+      const passphrase = await this.unlock();
+      try {
+        const decryptedBytes = await openEnvelope(payload, passphrase);
+        try {
+          return textDecoder2.decode(decryptedBytes);
+        } finally {
+          zeroizeBytes(decryptedBytes);
+        }
+      } catch (err) {
+        if (err instanceof exports.SecretStorageException) {
+          throw err;
+        }
+        const msg = err instanceof Error ? err.message : String(err);
+        throw exports.SecretStorageException.decryptionFailed(msg);
+      }
+    }
+    async withSecret(bundleHash, fn, options) {
+      if (options?.passphrase) {
+        throw new exports.SecretStorageException(
+          "WebAuthnPrfSecretStorageProvider derives its passphrase from the authenticator; options.passphrase is not accepted"
+        );
+      }
+      const raw = await this.backend.getItem(`${KEY_PREFIX2}${bundleHash}`);
+      if (!raw) {
+        throw exports.SecretStorageException.notFound(bundleHash);
+      }
+      let payload;
+      try {
+        payload = JSON.parse(raw);
+      } catch {
+        throw exports.SecretStorageException.decryptionFailed("Corrupted payload format");
+      }
+      const passphrase = await this.unlock();
+      try {
+        const decryptedBytes = await openEnvelope(payload, passphrase);
         return await withSecureBytes(decryptedBytes, async (bytes) => {
-          const secretString = textDecoder.decode(bytes);
+          const secretString = textDecoder2.decode(bytes);
           return await fn(secretString);
         });
       } catch (err) {
@@ -54222,6 +54942,451 @@ ${operationTypes.join("\n")}
         throw exports.SecretStorageException.decryptionFailed(msg);
       }
     }
+    async deleteSecret(bundleHash) {
+      const key = `${KEY_PREFIX2}${bundleHash}`;
+      const recoveryKey = `${RECOVERY_KEY_PREFIX}${bundleHash}`;
+      const result = await this.backend.removeItem(key);
+      await this.backend.removeItem(recoveryKey);
+      return result !== false;
+    }
+    async hasSecret(bundleHash) {
+      const raw = await this.backend.getItem(`${KEY_PREFIX2}${bundleHash}`);
+      return raw !== null;
+    }
+    async listSecrets() {
+      const keys = await this.backend.keys();
+      const matchingKeys = keys.filter((k2) => k2.startsWith(KEY_PREFIX2) && !k2.startsWith(RECOVERY_KEY_PREFIX));
+      const results = [];
+      for (const key of matchingKeys) {
+        const raw = await this.backend.getItem(key);
+        if (raw) {
+          try {
+            const payload = JSON.parse(raw);
+            if (payload.metadata) {
+              results.push(payload.metadata);
+            }
+          } catch {
+          }
+        }
+      }
+      return results;
+    }
+    /**
+     * Recover a secret using its recovery envelope and re-enroll it under a fresh WebAuthn PRF credential
+     */
+    async recoverSecret(bundleHash, recoveryPassphrase, options) {
+      if (!bundleHash) {
+        throw new exports.SecretStorageException("Bundle hash cannot be empty");
+      }
+      if (!recoveryPassphrase) {
+        throw new exports.SecretStorageException("Recovery passphrase cannot be empty");
+      }
+      const raw = await this.backend.getItem(`${RECOVERY_KEY_PREFIX}${bundleHash}`);
+      if (!raw) {
+        throw exports.SecretStorageException.notFound(bundleHash);
+      }
+      let payload;
+      try {
+        payload = JSON.parse(raw);
+      } catch {
+        throw exports.SecretStorageException.decryptionFailed("Corrupted recovery payload format");
+      }
+      let decryptedBytes;
+      try {
+        decryptedBytes = await openEnvelope(payload, recoveryPassphrase);
+      } catch (err) {
+        if (err instanceof exports.SecretStorageException) {
+          throw err;
+        }
+        const msg = err instanceof Error ? err.message : String(err);
+        throw exports.SecretStorageException.decryptionFailed(msg);
+      }
+      let secretStr;
+      try {
+        secretStr = textDecoder2.decode(decryptedBytes);
+      } finally {
+        zeroizeBytes(decryptedBytes);
+      }
+      await this.storeSecret(bundleHash, secretStr, {
+        ...options,
+        recoveryPassphrase
+      });
+    }
+  };
+
+  // src/storage/NonExtractableKeySecretStorageProvider.ts
+  init_SecretStorageException();
+  var KEY_PREFIX3 = SECRET_KEY_PREFIX;
+  var GCM_IV_LENGTH3 = 12;
+  var textEncoder4 = new TextEncoder();
+  var textDecoder3 = new TextDecoder();
+  var MemoryKeyStore = class {
+    keys = /* @__PURE__ */ new Map();
+    async get(name2) {
+      return this.keys.get(name2);
+    }
+    async put(name2, key) {
+      this.keys.set(name2, key);
+    }
+    async delete(name2) {
+      return this.keys.delete(name2);
+    }
+  };
+  var IndexedDbKeyStore = class {
+    dbName;
+    storeName = "keys";
+    constructor(dbName = "knishio-secret-storage") {
+      this.dbName = dbName;
+    }
+    // Executor form intentionally retained for browser runtime compatibility with ES2022 / browsers without Promise.withResolvers polyfill
+    async getDb() {
+      if (typeof globalThis.indexedDB === "undefined") {
+        throw exports.SecretStorageException.unavailable(
+          "webcrypto-nonextractable",
+          "IndexedDB is not available"
+        );
+      }
+      return new Promise((resolve, reject) => {
+        const request = globalThis.indexedDB.open(this.dbName, 1);
+        request.onupgradeneeded = () => {
+          const db = request.result;
+          if (!db.objectStoreNames.contains(this.storeName)) {
+            db.createObjectStore(this.storeName);
+          }
+        };
+        request.onsuccess = () => resolve(request.result);
+        request.onerror = () => reject(request.error);
+      });
+    }
+    async get(name2) {
+      const db = await this.getDb();
+      return new Promise((resolve, reject) => {
+        const tx = db.transaction(this.storeName, "readonly");
+        const store = tx.objectStore(this.storeName);
+        const request = store.get(name2);
+        request.onsuccess = () => resolve(request.result);
+        request.onerror = () => reject(request.error);
+      });
+    }
+    async put(name2, key) {
+      const db = await this.getDb();
+      return new Promise((resolve, reject) => {
+        const tx = db.transaction(this.storeName, "readwrite");
+        const store = tx.objectStore(this.storeName);
+        const request = store.put(key, name2);
+        request.onsuccess = () => resolve();
+        request.onerror = () => reject(request.error);
+      });
+    }
+    async delete(name2) {
+      const db = await this.getDb();
+      return new Promise((resolve, reject) => {
+        const tx = db.transaction(this.storeName, "readwrite");
+        const store = tx.objectStore(this.storeName);
+        const request = store.delete(name2);
+        request.onsuccess = () => resolve(true);
+        request.onerror = () => reject(request.error);
+      });
+    }
+  };
+  var NonExtractableKeySecretStorageProvider = class {
+    providerType = "webcrypto-nonextractable";
+    backend;
+    keyStore;
+    alias;
+    cachedPassphrase;
+    constructor(options) {
+      this.backend = options.backend;
+      this.keyStore = options.keyStore ?? new IndexedDbKeyStore();
+      this.alias = options.alias ?? "default";
+    }
+    get recordKey() {
+      return `knishio:kek:webcrypto-nonextractable:${this.alias}`;
+    }
+    get kekStoreKey() {
+      return `knishio:kek:${this.alias}`;
+    }
+    isHardwareBacked() {
+      return false;
+    }
+    async isAvailable() {
+      return typeof globalThis.crypto !== "undefined" && typeof globalThis.crypto.subtle !== "undefined";
+    }
+    /**
+     * Unlock or initialize the device passphrase using the non-extractable KEK
+     */
+    async unlock() {
+      if (this.cachedPassphrase) {
+        return this.cachedPassphrase;
+      }
+      if (!await this.isAvailable()) {
+        throw exports.SecretStorageException.unavailable(
+          this.providerType,
+          "WebCrypto API is not available"
+        );
+      }
+      const rawRecord = await this.backend.getItem(this.recordKey);
+      if (!rawRecord) {
+        let kek2 = await this.keyStore.get(this.kekStoreKey);
+        if (!kek2) {
+          kek2 = await globalThis.crypto.subtle.generateKey(
+            { name: "AES-GCM", length: 256 },
+            false,
+            ["encrypt", "decrypt"]
+          );
+          await this.keyStore.put(this.kekStoreKey, kek2);
+        }
+        const devicePassphraseBytes = new Uint8Array(32);
+        globalThis.crypto.getRandomValues(devicePassphraseBytes);
+        const devicePassphrase = uint8ArrayToBase642(devicePassphraseBytes);
+        const iv2 = new Uint8Array(GCM_IV_LENGTH3);
+        globalThis.crypto.getRandomValues(iv2);
+        const passphraseBytes = textEncoder4.encode(devicePassphrase);
+        try {
+          const encryptedBuffer = await globalThis.crypto.subtle.encrypt(
+            {
+              name: "AES-GCM",
+              iv: iv2
+            },
+            kek2,
+            passphraseBytes
+          );
+          const record3 = {
+            version: 1,
+            iv: uint8ArrayToBase642(iv2),
+            ciphertext: uint8ArrayToBase642(new Uint8Array(encryptedBuffer))
+          };
+          await this.backend.setItem(this.recordKey, JSON.stringify(record3));
+          this.cachedPassphrase = devicePassphrase;
+          return devicePassphrase;
+        } finally {
+          zeroizeBytes(passphraseBytes);
+          zeroizeBytes(devicePassphraseBytes);
+        }
+      }
+      let record2;
+      try {
+        record2 = JSON.parse(rawRecord);
+      } catch {
+        throw exports.SecretStorageException.decryptionFailed("Corrupted key record format");
+      }
+      const kek = await this.keyStore.get(this.kekStoreKey);
+      if (!kek) {
+        throw exports.SecretStorageException.unavailable(
+          this.providerType,
+          `no non-extractable key found for alias '${this.alias}'`
+        );
+      }
+      const iv = base64ToUint8Array2(record2.iv);
+      const ciphertext = base64ToUint8Array2(record2.ciphertext);
+      try {
+        const decryptedBuffer = await globalThis.crypto.subtle.decrypt(
+          {
+            name: "AES-GCM",
+            iv
+          },
+          kek,
+          ciphertext
+        );
+        const decryptedBytes = new Uint8Array(decryptedBuffer);
+        try {
+          this.cachedPassphrase = textDecoder3.decode(decryptedBytes);
+          return this.cachedPassphrase;
+        } finally {
+          zeroizeBytes(decryptedBytes);
+        }
+      } catch {
+        throw exports.SecretStorageException.decryptionFailed(
+          "wrapped device passphrase failed authentication under non-extractable key"
+        );
+      }
+    }
+    /**
+     * Lock the provider by clearing cached passphrase material
+     */
+    lock() {
+      this.cachedPassphrase = void 0;
+    }
+    /**
+     * Unenroll the non-extractable key, removing the stored wrapped record and KEK
+     */
+    async unenroll() {
+      this.lock();
+      await this.backend.removeItem(this.recordKey);
+      await this.keyStore.delete(this.kekStoreKey);
+    }
+    async storeSecret(bundleHash, secret, options) {
+      if (!bundleHash) {
+        throw new exports.SecretStorageException("Bundle hash cannot be empty");
+      }
+      if (!secret) {
+        throw new exports.SecretStorageException("Secret cannot be empty");
+      }
+      if (options?.passphrase) {
+        throw new exports.SecretStorageException(
+          "NonExtractableKeySecretStorageProvider derives its passphrase from the non-extractable device key; options.passphrase is not accepted"
+        );
+      }
+      if (!options?.recoveryPassphrase && !options?.allowUnrecoverable) {
+        throw exports.SecretStorageException.validationError(
+          "Recovery passphrase required for non-exportable hardware key unless allowUnrecoverable is true"
+        );
+      }
+      const passphrase = await this.unlock();
+      const metadata = {
+        bundleHash,
+        label: options?.label,
+        createdAt: Date.now(),
+        hardwareBacked: false,
+        providerType: this.providerType
+      };
+      const payload = await sealEnvelope(secret, passphrase, metadata);
+      await this.backend.setItem(`${KEY_PREFIX3}${bundleHash}`, JSON.stringify(payload));
+      if (options?.recoveryPassphrase) {
+        const recoveryMetadata = {
+          bundleHash,
+          label: options?.label,
+          createdAt: Date.now(),
+          hardwareBacked: false,
+          providerType: "webcrypto-aes-gcm"
+        };
+        const recoveryPayload = await sealEnvelope(secret, options.recoveryPassphrase, recoveryMetadata);
+        await this.backend.setItem(`${RECOVERY_KEY_PREFIX}${bundleHash}`, JSON.stringify(recoveryPayload));
+      }
+    }
+    async retrieveSecret(bundleHash, options) {
+      if (options?.passphrase) {
+        throw new exports.SecretStorageException(
+          "NonExtractableKeySecretStorageProvider derives its passphrase from the non-extractable device key; options.passphrase is not accepted"
+        );
+      }
+      const raw = await this.backend.getItem(`${KEY_PREFIX3}${bundleHash}`);
+      if (!raw) {
+        return null;
+      }
+      let payload;
+      try {
+        payload = JSON.parse(raw);
+      } catch {
+        throw exports.SecretStorageException.decryptionFailed("Corrupted payload format");
+      }
+      const passphrase = await this.unlock();
+      try {
+        const decryptedBytes = await openEnvelope(payload, passphrase);
+        try {
+          return textDecoder3.decode(decryptedBytes);
+        } finally {
+          zeroizeBytes(decryptedBytes);
+        }
+      } catch (err) {
+        if (err instanceof exports.SecretStorageException) {
+          throw err;
+        }
+        const msg = err instanceof Error ? err.message : String(err);
+        throw exports.SecretStorageException.decryptionFailed(msg);
+      }
+    }
+    async withSecret(bundleHash, fn, options) {
+      if (options?.passphrase) {
+        throw new exports.SecretStorageException(
+          "NonExtractableKeySecretStorageProvider derives its passphrase from the non-extractable device key; options.passphrase is not accepted"
+        );
+      }
+      const raw = await this.backend.getItem(`${KEY_PREFIX3}${bundleHash}`);
+      if (!raw) {
+        throw exports.SecretStorageException.notFound(bundleHash);
+      }
+      let payload;
+      try {
+        payload = JSON.parse(raw);
+      } catch {
+        throw exports.SecretStorageException.decryptionFailed("Corrupted payload format");
+      }
+      const passphrase = await this.unlock();
+      try {
+        const decryptedBytes = await openEnvelope(payload, passphrase);
+        return await withSecureBytes(decryptedBytes, async (bytes) => {
+          const secretString = textDecoder3.decode(bytes);
+          return await fn(secretString);
+        });
+      } catch (err) {
+        if (err instanceof exports.SecretStorageException) {
+          throw err;
+        }
+        const msg = err instanceof Error ? err.message : String(err);
+        throw exports.SecretStorageException.decryptionFailed(msg);
+      }
+    }
+    async deleteSecret(bundleHash) {
+      const key = `${KEY_PREFIX3}${bundleHash}`;
+      const recoveryKey = `${RECOVERY_KEY_PREFIX}${bundleHash}`;
+      const result = await this.backend.removeItem(key);
+      await this.backend.removeItem(recoveryKey);
+      return result !== false;
+    }
+    async hasSecret(bundleHash) {
+      const raw = await this.backend.getItem(`${KEY_PREFIX3}${bundleHash}`);
+      return raw !== null;
+    }
+    async listSecrets() {
+      const keys = await this.backend.keys();
+      const matchingKeys = keys.filter((k2) => k2.startsWith(KEY_PREFIX3) && !k2.startsWith(RECOVERY_KEY_PREFIX));
+      const results = [];
+      for (const key of matchingKeys) {
+        const raw = await this.backend.getItem(key);
+        if (raw) {
+          try {
+            const payload = JSON.parse(raw);
+            if (payload.metadata) {
+              results.push(payload.metadata);
+            }
+          } catch {
+          }
+        }
+      }
+      return results;
+    }
+    /**
+     * Recover a secret using its recovery envelope and re-enroll it under a fresh non-extractable KEK
+     */
+    async recoverSecret(bundleHash, recoveryPassphrase, options) {
+      if (!bundleHash) {
+        throw new exports.SecretStorageException("Bundle hash cannot be empty");
+      }
+      if (!recoveryPassphrase) {
+        throw new exports.SecretStorageException("Recovery passphrase cannot be empty");
+      }
+      const raw = await this.backend.getItem(`${RECOVERY_KEY_PREFIX}${bundleHash}`);
+      if (!raw) {
+        throw exports.SecretStorageException.notFound(bundleHash);
+      }
+      let payload;
+      try {
+        payload = JSON.parse(raw);
+      } catch {
+        throw exports.SecretStorageException.decryptionFailed("Corrupted recovery payload format");
+      }
+      let decryptedBytes;
+      try {
+        decryptedBytes = await openEnvelope(payload, recoveryPassphrase);
+      } catch (err) {
+        if (err instanceof exports.SecretStorageException) {
+          throw err;
+        }
+        const msg = err instanceof Error ? err.message : String(err);
+        throw exports.SecretStorageException.decryptionFailed(msg);
+      }
+      let secretStr;
+      try {
+        secretStr = textDecoder3.decode(decryptedBytes);
+      } finally {
+        zeroizeBytes(decryptedBytes);
+      }
+      await this.storeSecret(bundleHash, secretStr, {
+        ...options,
+        recoveryPassphrase
+      });
+    }
   };
 
   // src/storage/index.ts
@@ -54232,15 +55397,14 @@ ${operationTypes.join("\n")}
     if (typeof globalThis.crypto !== "undefined" && typeof globalThis.crypto.subtle !== "undefined") {
       return new WebCryptoSecretStorageProvider({
         backend: options.backend,
-        defaultPassphrase: options.defaultPassphrase,
-        hardwareBacked: options.hardwareBacked
+        defaultPassphrase: options.defaultPassphrase
       });
     }
     return new MemorySecretStorageProvider();
   }
 
   // src/index.ts
-  var SDK_VERSION = "1.0.0";
+  var SDK_VERSION = "1.1.0";
   var SDK_NAME = "KnishIO-Client-TS";
   var COMPATIBLE_SERVER_VERSIONS = [4, 5];
   var SDK_INFO = {
@@ -54348,9 +55512,12 @@ ${operationTypes.join("\n")}
   exports.CheckMolecule = CheckMolecule;
   exports.DevUtils = DevUtils;
   exports.EXTENDED_COMPATIBILITY_TEST_VECTORS = EXTENDED_COMPATIBILITY_TEST_VECTORS;
+  exports.FileStorageBackend = FileStorageBackend;
   exports.GraphQLClient = GraphQLClient;
+  exports.IndexedDbKeyStore = IndexedDbKeyStore;
   exports.KnishIO = KnishIO;
   exports.KnishIOClient = KnishIOClient;
+  exports.MemoryKeyStore = MemoryKeyStore;
   exports.MemorySecretStorageProvider = MemorySecretStorageProvider;
   exports.MemoryStorageBackend = MemoryStorageBackend;
   exports.Meta = Meta;
@@ -54365,6 +55532,7 @@ ${operationTypes.join("\n")}
   exports.MutationRequestAuthorization = MutationRequestAuthorization;
   exports.MutationRequestTokens = MutationRequestTokens;
   exports.MutationTransferTokens = MutationTransferTokens;
+  exports.NonExtractableKeySecretStorageProvider = NonExtractableKeySecretStorageProvider;
   exports.PolicyMeta = PolicyMeta;
   exports.Query = Query;
   exports.QueryAtom = QueryAtom;
@@ -54376,6 +55544,7 @@ ${operationTypes.join("\n")}
   exports.QueryMetaTypeViaAtom = QueryMetaTypeViaAtom;
   exports.QueryWalletBundle = QueryWalletBundle;
   exports.QueryWalletList = QueryWalletList;
+  exports.RECOVERY_KEY_PREFIX = RECOVERY_KEY_PREFIX;
   exports.ResponseAppendRequest = ResponseAppendRequest;
   exports.ResponseAtom = ResponseAtom;
   exports.ResponseBalance = ResponseBalance;
@@ -54396,9 +55565,12 @@ ${operationTypes.join("\n")}
   exports.SDK_INFO = SDK_INFO;
   exports.SDK_NAME = SDK_NAME;
   exports.SDK_VERSION = SDK_VERSION;
+  exports.SECRET_KEY_PREFIX = SECRET_KEY_PREFIX;
   exports.TokenUnit = TokenUnit;
   exports.Wallet = Wallet;
+  exports.WebAuthnPrfSecretStorageProvider = WebAuthnPrfSecretStorageProvider;
   exports.WebCryptoSecretStorageProvider = WebCryptoSecretStorageProvider;
+  exports.WebStorageBackend = WebStorageBackend;
   exports.base64ToHex = base64ToHex;
   exports.bufferToHexString = bufferToHexString;
   exports.capitalize = capitalize;
@@ -54437,9 +55609,11 @@ ${operationTypes.join("\n")}
   exports.isPosition = isPosition2;
   exports.isWalletAddress = isWalletAddress2;
   exports.normalizeMolecularHash = normalizeMolecularHash;
+  exports.openEnvelope = openEnvelope;
   exports.randomString = randomString;
   exports.runCompatibilityTests = runCompatibilityTests;
   exports.runExtendedCompatibilityTests = runExtendedCompatibilityTests;
+  exports.sealEnvelope = sealEnvelope;
   exports.shake256 = shake256;
   exports.toCamelCase = toCamelCase;
   exports.toSnakeCase = toSnakeCase;