@wishknish/knishio-client-ts 1.0.0 → 1.2.0

package/dist/index.d.cts

@@ -141,14 +141,17 @@ interface EncryptedSecretPayload {
     iterations?: number;
     metadata: SecretStorageMetadata;
 }
+interface StorageOptions {
+    label?: string;
+    passphrase?: string;
+    recoveryPassphrase?: string;
+    allowUnrecoverable?: boolean;
+}
 interface ISecretStorageProvider {
     readonly providerType: string;
     isHardwareBacked(): boolean;
     isAvailable(): Promise<boolean>;
-    storeSecret(bundleHash: string, secret: string, options?: {
-        label?: string;
-        passphrase?: string;
-    }): Promise<void>;
+    storeSecret(bundleHash: string, secret: string, options?: StorageOptions): Promise<void>;
     retrieveSecret(bundleHash: string, options?: {
         passphrase?: string;
     }): Promise<string | null>;
@@ -158,6 +161,9 @@ interface ISecretStorageProvider {
     withSecret<T>(bundleHash: string, fn: (secret: string) => Promise<T> | T, options?: {
         passphrase?: string;
     }): Promise<T>;
+    recoverSecret(bundleHash: string, recoveryPassphrase: string, options?: {
+        label?: string;
+    }): Promise<void>;
 }
 
 type WalletAddress = WalletAddressPattern & {
@@ -2021,6 +2027,7 @@ declare class SecretStorageException extends BaseException {
     static notFound(bundleHash: string): SecretStorageException;
     static decryptionFailed(reason?: string): SecretStorageException;
     static unavailable(provider: string, reason?: string): SecretStorageException;
+    static validationError(message: string): SecretStorageException;
 }
 
 declare class InvalidResponseException extends BaseException {
@@ -2137,18 +2144,19 @@ declare const EXCEPTION_CODES: {
 declare class MemorySecretStorageProvider implements ISecretStorageProvider {
     readonly providerType = "memory";
     private secrets;
+    private recoverySecrets;
     isHardwareBacked(): boolean;
     isAvailable(): Promise<boolean>;
-    storeSecret(bundleHash: string, secret: string, options?: {
-        label?: string;
-        passphrase?: string;
-    }): Promise<void>;
+    storeSecret(bundleHash: string, secret: string, options?: StorageOptions): Promise<void>;
     retrieveSecret(bundleHash: string): Promise<string | null>;
     deleteSecret(bundleHash: string): Promise<boolean>;
     hasSecret(bundleHash: string): Promise<boolean>;
     listSecrets(): Promise<SecretStorageMetadata[]>;
     withSecret<T>(bundleHash: string, fn: (secret: string) => Promise<T> | T): Promise<T>;
     clear(): void;
+    recoverSecret(bundleHash: string, recoveryPassphrase: string, options?: {
+        label?: string;
+    }): Promise<void>;
 }
 
 interface IStorageBackend {
@@ -2168,35 +2176,161 @@ declare class WebCryptoSecretStorageProvider implements ISecretStorageProvider {
     readonly providerType = "webcrypto-aes-gcm";
     private backend;
     private defaultPassphrase?;
-    private hardwareBacked;
     constructor(options?: {
         backend?: IStorageBackend;
         defaultPassphrase?: string;
-        hardwareBacked?: boolean;
     });
     isHardwareBacked(): boolean;
     isAvailable(): Promise<boolean>;
-    private deriveKey;
-    storeSecret(bundleHash: string, secret: string, options?: {
+    storeSecret(bundleHash: string, secret: string, options?: StorageOptions): Promise<void>;
+    retrieveSecret(bundleHash: string, options?: {
+        passphrase?: string;
+    }): Promise<string | null>;
+    deleteSecret(bundleHash: string): Promise<boolean>;
+    hasSecret(bundleHash: string): Promise<boolean>;
+    listSecrets(): Promise<SecretStorageMetadata[]>;
+    withSecret<T>(bundleHash: string, fn: (secret: string) => Promise<T> | T, options?: {
+        passphrase?: string;
+    }): Promise<T>;
+    recoverSecret(bundleHash: string, recoveryPassphrase: string, options?: {
         label?: string;
         passphrase?: string;
     }): Promise<void>;
+}
+
+declare class FileStorageBackend implements IStorageBackend {
+    readonly filePath: string;
+    private store;
+    private loaded;
+    constructor(filePath: string);
+    private getFs;
+    private ensureLoaded;
+    private persist;
+    getItem(key: string): Promise<string | null>;
+    setItem(key: string, value: string): Promise<void>;
+    removeItem(key: string): Promise<boolean>;
+    keys(): Promise<string[]>;
+}
+
+declare class WebStorageBackend implements IStorageBackend {
+    private readonly storage;
+    readonly prefix: string;
+    constructor(storage?: Storage, prefix?: string);
+    getItem(key: string): string | null;
+    setItem(key: string, value: string): void;
+    removeItem(key: string): boolean;
+    keys(): string[];
+}
+
+interface WebAuthnPrfSecretStorageOptions {
+    backend: IStorageBackend;
+    rp: {
+        id?: string;
+        name: string;
+    };
+    user: {
+        id: Uint8Array;
+        name: string;
+        displayName: string;
+    };
+    credentials?: Pick<CredentialsContainer, 'create' | 'get'>;
+    alias?: string;
+}
+declare class WebAuthnPrfSecretStorageProvider implements ISecretStorageProvider {
+    readonly providerType = "webauthn-prf";
+    private backend;
+    private rp;
+    private user;
+    private credentialsContainer?;
+    private alias;
+    private cachedPassphrase?;
+    constructor(options: WebAuthnPrfSecretStorageOptions);
+    private get credentials();
+    private get recordKey();
+    isHardwareBacked(): boolean;
+    isAvailable(): Promise<boolean>;
+    enroll(): Promise<void>;
+    private unlock;
+    lock(): void;
+    unenroll(): Promise<void>;
+    storeSecret(bundleHash: string, secret: string, options?: StorageOptions): Promise<void>;
     retrieveSecret(bundleHash: string, options?: {
         passphrase?: string;
     }): Promise<string | null>;
+    withSecret<T>(bundleHash: string, fn: (secret: string) => Promise<T> | T, options?: {
+        passphrase?: string;
+    }): Promise<T>;
     deleteSecret(bundleHash: string): Promise<boolean>;
     hasSecret(bundleHash: string): Promise<boolean>;
     listSecrets(): Promise<SecretStorageMetadata[]>;
+    recoverSecret(bundleHash: string, recoveryPassphrase: string, options?: {
+        label?: string;
+    }): Promise<void>;
+}
+
+interface IKeyStore {
+    get(name: string): Promise<CryptoKey | undefined>;
+    put(name: string, key: CryptoKey): Promise<void>;
+    delete(name: string): Promise<boolean>;
+}
+declare class MemoryKeyStore implements IKeyStore {
+    private keys;
+    get(name: string): Promise<CryptoKey | undefined>;
+    put(name: string, key: CryptoKey): Promise<void>;
+    delete(name: string): Promise<boolean>;
+}
+declare class IndexedDbKeyStore implements IKeyStore {
+    private dbName;
+    private storeName;
+    constructor(dbName?: string);
+    private getDb;
+    get(name: string): Promise<CryptoKey | undefined>;
+    put(name: string, key: CryptoKey): Promise<void>;
+    delete(name: string): Promise<boolean>;
+}
+interface NonExtractableKeyStorageOptions {
+    backend: IStorageBackend;
+    keyStore?: IKeyStore;
+    alias?: string;
+}
+declare class NonExtractableKeySecretStorageProvider implements ISecretStorageProvider {
+    readonly providerType = "webcrypto-nonextractable";
+    private backend;
+    private keyStore;
+    private alias;
+    private cachedPassphrase?;
+    constructor(options: NonExtractableKeyStorageOptions);
+    private get recordKey();
+    private get kekStoreKey();
+    isHardwareBacked(): boolean;
+    isAvailable(): Promise<boolean>;
+    private unlock;
+    lock(): void;
+    unenroll(): Promise<void>;
+    storeSecret(bundleHash: string, secret: string, options?: StorageOptions): Promise<void>;
+    retrieveSecret(bundleHash: string, options?: {
+        passphrase?: string;
+    }): Promise<string | null>;
     withSecret<T>(bundleHash: string, fn: (secret: string) => Promise<T> | T, options?: {
         passphrase?: string;
     }): Promise<T>;
+    deleteSecret(bundleHash: string): Promise<boolean>;
+    hasSecret(bundleHash: string): Promise<boolean>;
+    listSecrets(): Promise<SecretStorageMetadata[]>;
+    recoverSecret(bundleHash: string, recoveryPassphrase: string, options?: {
+        label?: string;
+    }): Promise<void>;
 }
 
+declare const SECRET_KEY_PREFIX = "knishio:secret:";
+declare const RECOVERY_KEY_PREFIX = "knishio:recovery:";
+declare function sealEnvelope(secret: string, passphrase: string, metadata: SecretStorageMetadata): Promise<EncryptedSecretPayload>;
+declare function openEnvelope(payload: EncryptedSecretPayload, passphrase: string): Promise<Uint8Array>;
+
 interface CreateSecretStorageOptions {
     type?: 'webcrypto' | 'memory';
     defaultPassphrase?: string;
     backend?: IStorageBackend;
-    hardwareBacked?: boolean;
 }
 declare function createDefaultSecretStorage(options?: CreateSecretStorageOptions): ISecretStorageProvider;
 
@@ -2205,12 +2339,12 @@ declare function withSecureBytes<T>(bytes: Uint8Array, fn: (bytes: Uint8Array) =
 declare function withSecureString<T>(secret: string, fn: (cleanSecret: string) => Promise<T> | T): Promise<T>;
 declare function constantTimeCompare(a: Uint8Array | string, b: Uint8Array | string): boolean;
 
-declare const SDK_VERSION = "1.0.0";
+declare const SDK_VERSION = "1.2.0";
 declare const SDK_NAME = "KnishIO-Client-TS";
 declare const COMPATIBLE_SERVER_VERSIONS: number[];
 declare const SDK_INFO: {
     readonly name: "KnishIO-Client-TS";
-    readonly version: "1.0.0";
+    readonly version: "1.2.0";
     readonly description: "TypeScript SDK for Knish.IO post-blockchain distributed ledger";
     readonly compatibleServerVersions: number[];
     readonly features: readonly ["Post-quantum cryptography (XMSS, ML-KEM-1024)", "Cross-platform compatibility", "Type-safe APIs", "DAG-based transaction processing", "GraphQL integration", "Real-time subscriptions", "Cellular architecture support"];
@@ -2238,7 +2372,7 @@ declare const DevUtils: {
         nodeVersion: string;
         environment: string;
         name: "KnishIO-Client-TS";
-        version: "1.0.0";
+        version: "1.2.0";
         description: "TypeScript SDK for Knish.IO post-blockchain distributed ledger";
         compatibleServerVersions: number[];
         features: readonly ["Post-quantum cryptography (XMSS, ML-KEM-1024)", "Cross-platform compatibility", "Type-safe APIs", "DAG-based transaction processing", "GraphQL integration", "Real-time subscriptions", "Cellular architecture support"];
@@ -2265,7 +2399,7 @@ declare const KnishIO: {
     SDK_VERSION: string;
     SDK_INFO: {
         readonly name: "KnishIO-Client-TS";
-        readonly version: "1.0.0";
+        readonly version: "1.2.0";
         readonly description: "TypeScript SDK for Knish.IO post-blockchain distributed ledger";
         readonly compatibleServerVersions: number[];
         readonly features: readonly ["Post-quantum cryptography (XMSS, ML-KEM-1024)", "Cross-platform compatibility", "Type-safe APIs", "DAG-based transaction processing", "GraphQL integration", "Real-time subscriptions", "Cellular architecture support"];
@@ -2278,4 +2412,4 @@ declare const KnishIO: {
     };
 };
 
-export { Atom, AtomIndexException, type AtomIsotope, AtomMeta, type AtomParams, AtomsMissingException, type AuthParams, AuthToken, type BalanceQueryParams, type Base17Hash, BaseException, type BaseResponse, type BundleHash, type BundleHashOptions, COMPATIBLE_SERVER_VERSIONS, CRYPTO_CONSTANTS, type CellSlug, CheckMolecule, type CreateSecretStorageOptions, type CreateTokenParams, DevUtils, Dot, EXCEPTION_CODES, EXCEPTION_TYPES, EXTENDED_COMPATIBILITY_TEST_VECTORS, type EmbeddingStatusItem, type EncryptedSecretPayload, ExceptionFactory, GraphQLClient, type GraphQLError, type GraphQLRequest, type GraphQLResponse, type HexString, type ISecretStorageProvider, type IStorageBackend, InvalidResponseException, type KeyGenerationOptions, KnishIO, KnishIOClient, type KnishIOClientConfig, MemorySecretStorageProvider, MemoryStorageBackend, Meta$1 as Meta, type MetaData, type MetaId, type MetaQueryParams, type MetaType, type MolecularHash, MolecularHashMismatchException, Molecule, type MoleculeParams, Mutation, MutationAppendRequest, MutationCreateMeta, MutationCreateToken, MutationCreateWallet, type MutationOperation, MutationPeering, MutationProposeMolecule, MutationRequestAuthorization, MutationRequestTokens, MutationTransferTokens, PolicyMeta, type Position, type PositionGenerationOptions, Query, QueryAtom, QueryBalance, QueryBatch, QueryContinuId, QueryEmbeddingStatus, QueryMetaType, QueryMetaTypeViaAtom, type QueryOperation, QueryWalletBundle, QueryWalletList, type RequestTokensParams, Response, ResponseAppendRequest, ResponseAtom, ResponseBalance, ResponseContinuId, ResponseCreateMeta, ResponseCreateToken, ResponseCreateWallet, ResponseEmbeddingStatus, ResponseMetaType, ResponseMetaTypeViaAtom, ResponsePeering, ResponseProposeMolecule, ResponseRequestAuthorization, ResponseRequestTokens, ResponseTransferTokens, ResponseWalletBundle, ResponseWalletList, type SDKConfig, SDK_INFO, SDK_NAME, SDK_VERSION, type SHAKE256Options, type SecretGenerationOptions, SecretStorageException, type SecretStorageMetadata, SignatureMismatchException, type SignatureOptions, type TokenSlug, TokenUnit, TransferBalanceException, type TransferParams, type ValidationResult$1 as ValidationResult, type VerificationOptions, Wallet, type WalletAddress, WalletCredentialException, type WalletParams, type WalletQueryParams, WebCryptoSecretStorageProvider, base64ToHex, bufferToHexString, capitalize, charsetBaseConvert, chunkArray, chunkSubstr, configureSDK, constantTimeCompare, convertToBase17, createBundleHash, createDefaultSecretStorage, createMolecularHash, createPosition, createTokenSlug, createWalletAddress, deepCloning, diff, enumerateMolecularHash, generateBatchId, generateBundleHash, generateOTSSignature, generatePosition, generateSecret, generateWalletAddress, generateWalletKey, getSDKConfig, hexStringToBuffer, hexToBase64, intersect, isAtomIsotope, isBundleHash, isHex, isHexString, isMolecularHash, isNumeric, isPosition, isWalletAddress, normalizeMolecularHash, randomString, runCompatibilityTests, runExtendedCompatibilityTests, shake256, toCamelCase, toSnakeCase, truncate, validateBundleHash, validateMolecularHashForSignature, validateOTSSignature, validatePosition, validateSecret, validateWalletAddress, verifyOTSSignature, withSecureBytes, withSecureString, zeroizeBytes };
+export { Atom, AtomIndexException, type AtomIsotope, AtomMeta, type AtomParams, AtomsMissingException, type AuthParams, AuthToken, type BalanceQueryParams, type Base17Hash, BaseException, type BaseResponse, type BundleHash, type BundleHashOptions, COMPATIBLE_SERVER_VERSIONS, CRYPTO_CONSTANTS, type CellSlug, CheckMolecule, type CreateSecretStorageOptions, type CreateTokenParams, DevUtils, Dot, EXCEPTION_CODES, EXCEPTION_TYPES, EXTENDED_COMPATIBILITY_TEST_VECTORS, type EmbeddingStatusItem, type EncryptedSecretPayload, ExceptionFactory, FileStorageBackend, GraphQLClient, type GraphQLError, type GraphQLRequest, type GraphQLResponse, type HexString, type IKeyStore, type ISecretStorageProvider, type IStorageBackend, IndexedDbKeyStore, InvalidResponseException, type KeyGenerationOptions, KnishIO, KnishIOClient, type KnishIOClientConfig, MemoryKeyStore, MemorySecretStorageProvider, MemoryStorageBackend, Meta$1 as Meta, type MetaData, type MetaId, type MetaQueryParams, type MetaType, type MolecularHash, MolecularHashMismatchException, Molecule, type MoleculeParams, Mutation, MutationAppendRequest, MutationCreateMeta, MutationCreateToken, MutationCreateWallet, type MutationOperation, MutationPeering, MutationProposeMolecule, MutationRequestAuthorization, MutationRequestTokens, MutationTransferTokens, NonExtractableKeySecretStorageProvider, type NonExtractableKeyStorageOptions, PolicyMeta, type Position, type PositionGenerationOptions, Query, QueryAtom, QueryBalance, QueryBatch, QueryContinuId, QueryEmbeddingStatus, QueryMetaType, QueryMetaTypeViaAtom, type QueryOperation, QueryWalletBundle, QueryWalletList, RECOVERY_KEY_PREFIX, type RequestTokensParams, Response, ResponseAppendRequest, ResponseAtom, ResponseBalance, ResponseContinuId, ResponseCreateMeta, ResponseCreateToken, ResponseCreateWallet, ResponseEmbeddingStatus, ResponseMetaType, ResponseMetaTypeViaAtom, ResponsePeering, ResponseProposeMolecule, ResponseRequestAuthorization, ResponseRequestTokens, ResponseTransferTokens, ResponseWalletBundle, ResponseWalletList, type SDKConfig, SDK_INFO, SDK_NAME, SDK_VERSION, SECRET_KEY_PREFIX, type SHAKE256Options, type SecretGenerationOptions, SecretStorageException, type SecretStorageMetadata, SignatureMismatchException, type SignatureOptions, type StorageOptions, type TokenSlug, TokenUnit, TransferBalanceException, type TransferParams, type ValidationResult$1 as ValidationResult, type VerificationOptions, Wallet, type WalletAddress, WalletCredentialException, type WalletParams, type WalletQueryParams, type WebAuthnPrfSecretStorageOptions, WebAuthnPrfSecretStorageProvider, WebCryptoSecretStorageProvider, WebStorageBackend, base64ToHex, bufferToHexString, capitalize, charsetBaseConvert, chunkArray, chunkSubstr, configureSDK, constantTimeCompare, convertToBase17, createBundleHash, createDefaultSecretStorage, createMolecularHash, createPosition, createTokenSlug, createWalletAddress, deepCloning, diff, enumerateMolecularHash, generateBatchId, generateBundleHash, generateOTSSignature, generatePosition, generateSecret, generateWalletAddress, generateWalletKey, getSDKConfig, hexStringToBuffer, hexToBase64, intersect, isAtomIsotope, isBundleHash, isHex, isHexString, isMolecularHash, isNumeric, isPosition, isWalletAddress, normalizeMolecularHash, openEnvelope, randomString, runCompatibilityTests, runExtendedCompatibilityTests, sealEnvelope, shake256, toCamelCase, toSnakeCase, truncate, validateBundleHash, validateMolecularHashForSignature, validateOTSSignature, validatePosition, validateSecret, validateWalletAddress, verifyOTSSignature, withSecureBytes, withSecureString, zeroizeBytes };

package/dist/index.d.ts

@@ -141,14 +141,17 @@ interface EncryptedSecretPayload {
     iterations?: number;
     metadata: SecretStorageMetadata;
 }
+interface StorageOptions {
+    label?: string;
+    passphrase?: string;
+    recoveryPassphrase?: string;
+    allowUnrecoverable?: boolean;
+}
 interface ISecretStorageProvider {
     readonly providerType: string;
     isHardwareBacked(): boolean;
     isAvailable(): Promise<boolean>;
-    storeSecret(bundleHash: string, secret: string, options?: {
-        label?: string;
-        passphrase?: string;
-    }): Promise<void>;
+    storeSecret(bundleHash: string, secret: string, options?: StorageOptions): Promise<void>;
     retrieveSecret(bundleHash: string, options?: {
         passphrase?: string;
     }): Promise<string | null>;
@@ -158,6 +161,9 @@ interface ISecretStorageProvider {
     withSecret<T>(bundleHash: string, fn: (secret: string) => Promise<T> | T, options?: {
         passphrase?: string;
     }): Promise<T>;
+    recoverSecret(bundleHash: string, recoveryPassphrase: string, options?: {
+        label?: string;
+    }): Promise<void>;
 }
 
 type WalletAddress = WalletAddressPattern & {
@@ -2021,6 +2027,7 @@ declare class SecretStorageException extends BaseException {
     static notFound(bundleHash: string): SecretStorageException;
     static decryptionFailed(reason?: string): SecretStorageException;
     static unavailable(provider: string, reason?: string): SecretStorageException;
+    static validationError(message: string): SecretStorageException;
 }
 
 declare class InvalidResponseException extends BaseException {
@@ -2137,18 +2144,19 @@ declare const EXCEPTION_CODES: {
 declare class MemorySecretStorageProvider implements ISecretStorageProvider {
     readonly providerType = "memory";
     private secrets;
+    private recoverySecrets;
     isHardwareBacked(): boolean;
     isAvailable(): Promise<boolean>;
-    storeSecret(bundleHash: string, secret: string, options?: {
-        label?: string;
-        passphrase?: string;
-    }): Promise<void>;
+    storeSecret(bundleHash: string, secret: string, options?: StorageOptions): Promise<void>;
     retrieveSecret(bundleHash: string): Promise<string | null>;
     deleteSecret(bundleHash: string): Promise<boolean>;
     hasSecret(bundleHash: string): Promise<boolean>;
     listSecrets(): Promise<SecretStorageMetadata[]>;
     withSecret<T>(bundleHash: string, fn: (secret: string) => Promise<T> | T): Promise<T>;
     clear(): void;
+    recoverSecret(bundleHash: string, recoveryPassphrase: string, options?: {
+        label?: string;
+    }): Promise<void>;
 }
 
 interface IStorageBackend {
@@ -2168,35 +2176,161 @@ declare class WebCryptoSecretStorageProvider implements ISecretStorageProvider {
     readonly providerType = "webcrypto-aes-gcm";
     private backend;
     private defaultPassphrase?;
-    private hardwareBacked;
     constructor(options?: {
         backend?: IStorageBackend;
         defaultPassphrase?: string;
-        hardwareBacked?: boolean;
     });
     isHardwareBacked(): boolean;
     isAvailable(): Promise<boolean>;
-    private deriveKey;
-    storeSecret(bundleHash: string, secret: string, options?: {
+    storeSecret(bundleHash: string, secret: string, options?: StorageOptions): Promise<void>;
+    retrieveSecret(bundleHash: string, options?: {
+        passphrase?: string;
+    }): Promise<string | null>;
+    deleteSecret(bundleHash: string): Promise<boolean>;
+    hasSecret(bundleHash: string): Promise<boolean>;
+    listSecrets(): Promise<SecretStorageMetadata[]>;
+    withSecret<T>(bundleHash: string, fn: (secret: string) => Promise<T> | T, options?: {
+        passphrase?: string;
+    }): Promise<T>;
+    recoverSecret(bundleHash: string, recoveryPassphrase: string, options?: {
         label?: string;
         passphrase?: string;
     }): Promise<void>;
+}
+
+declare class FileStorageBackend implements IStorageBackend {
+    readonly filePath: string;
+    private store;
+    private loaded;
+    constructor(filePath: string);
+    private getFs;
+    private ensureLoaded;
+    private persist;
+    getItem(key: string): Promise<string | null>;
+    setItem(key: string, value: string): Promise<void>;
+    removeItem(key: string): Promise<boolean>;
+    keys(): Promise<string[]>;
+}
+
+declare class WebStorageBackend implements IStorageBackend {
+    private readonly storage;
+    readonly prefix: string;
+    constructor(storage?: Storage, prefix?: string);
+    getItem(key: string): string | null;
+    setItem(key: string, value: string): void;
+    removeItem(key: string): boolean;
+    keys(): string[];
+}
+
+interface WebAuthnPrfSecretStorageOptions {
+    backend: IStorageBackend;
+    rp: {
+        id?: string;
+        name: string;
+    };
+    user: {
+        id: Uint8Array;
+        name: string;
+        displayName: string;
+    };
+    credentials?: Pick<CredentialsContainer, 'create' | 'get'>;
+    alias?: string;
+}
+declare class WebAuthnPrfSecretStorageProvider implements ISecretStorageProvider {
+    readonly providerType = "webauthn-prf";
+    private backend;
+    private rp;
+    private user;
+    private credentialsContainer?;
+    private alias;
+    private cachedPassphrase?;
+    constructor(options: WebAuthnPrfSecretStorageOptions);
+    private get credentials();
+    private get recordKey();
+    isHardwareBacked(): boolean;
+    isAvailable(): Promise<boolean>;
+    enroll(): Promise<void>;
+    private unlock;
+    lock(): void;
+    unenroll(): Promise<void>;
+    storeSecret(bundleHash: string, secret: string, options?: StorageOptions): Promise<void>;
     retrieveSecret(bundleHash: string, options?: {
         passphrase?: string;
     }): Promise<string | null>;
+    withSecret<T>(bundleHash: string, fn: (secret: string) => Promise<T> | T, options?: {
+        passphrase?: string;
+    }): Promise<T>;
     deleteSecret(bundleHash: string): Promise<boolean>;
     hasSecret(bundleHash: string): Promise<boolean>;
     listSecrets(): Promise<SecretStorageMetadata[]>;
+    recoverSecret(bundleHash: string, recoveryPassphrase: string, options?: {
+        label?: string;
+    }): Promise<void>;
+}
+
+interface IKeyStore {
+    get(name: string): Promise<CryptoKey | undefined>;
+    put(name: string, key: CryptoKey): Promise<void>;
+    delete(name: string): Promise<boolean>;
+}
+declare class MemoryKeyStore implements IKeyStore {
+    private keys;
+    get(name: string): Promise<CryptoKey | undefined>;
+    put(name: string, key: CryptoKey): Promise<void>;
+    delete(name: string): Promise<boolean>;
+}
+declare class IndexedDbKeyStore implements IKeyStore {
+    private dbName;
+    private storeName;
+    constructor(dbName?: string);
+    private getDb;
+    get(name: string): Promise<CryptoKey | undefined>;
+    put(name: string, key: CryptoKey): Promise<void>;
+    delete(name: string): Promise<boolean>;
+}
+interface NonExtractableKeyStorageOptions {
+    backend: IStorageBackend;
+    keyStore?: IKeyStore;
+    alias?: string;
+}
+declare class NonExtractableKeySecretStorageProvider implements ISecretStorageProvider {
+    readonly providerType = "webcrypto-nonextractable";
+    private backend;
+    private keyStore;
+    private alias;
+    private cachedPassphrase?;
+    constructor(options: NonExtractableKeyStorageOptions);
+    private get recordKey();
+    private get kekStoreKey();
+    isHardwareBacked(): boolean;
+    isAvailable(): Promise<boolean>;
+    private unlock;
+    lock(): void;
+    unenroll(): Promise<void>;
+    storeSecret(bundleHash: string, secret: string, options?: StorageOptions): Promise<void>;
+    retrieveSecret(bundleHash: string, options?: {
+        passphrase?: string;
+    }): Promise<string | null>;
     withSecret<T>(bundleHash: string, fn: (secret: string) => Promise<T> | T, options?: {
         passphrase?: string;
     }): Promise<T>;
+    deleteSecret(bundleHash: string): Promise<boolean>;
+    hasSecret(bundleHash: string): Promise<boolean>;
+    listSecrets(): Promise<SecretStorageMetadata[]>;
+    recoverSecret(bundleHash: string, recoveryPassphrase: string, options?: {
+        label?: string;
+    }): Promise<void>;
 }
 
+declare const SECRET_KEY_PREFIX = "knishio:secret:";
+declare const RECOVERY_KEY_PREFIX = "knishio:recovery:";
+declare function sealEnvelope(secret: string, passphrase: string, metadata: SecretStorageMetadata): Promise<EncryptedSecretPayload>;
+declare function openEnvelope(payload: EncryptedSecretPayload, passphrase: string): Promise<Uint8Array>;
+
 interface CreateSecretStorageOptions {
     type?: 'webcrypto' | 'memory';
     defaultPassphrase?: string;
     backend?: IStorageBackend;
-    hardwareBacked?: boolean;
 }
 declare function createDefaultSecretStorage(options?: CreateSecretStorageOptions): ISecretStorageProvider;
 
@@ -2205,12 +2339,12 @@ declare function withSecureBytes<T>(bytes: Uint8Array, fn: (bytes: Uint8Array) =
 declare function withSecureString<T>(secret: string, fn: (cleanSecret: string) => Promise<T> | T): Promise<T>;
 declare function constantTimeCompare(a: Uint8Array | string, b: Uint8Array | string): boolean;
 
-declare const SDK_VERSION = "1.0.0";
+declare const SDK_VERSION = "1.2.0";
 declare const SDK_NAME = "KnishIO-Client-TS";
 declare const COMPATIBLE_SERVER_VERSIONS: number[];
 declare const SDK_INFO: {
     readonly name: "KnishIO-Client-TS";
-    readonly version: "1.0.0";
+    readonly version: "1.2.0";
     readonly description: "TypeScript SDK for Knish.IO post-blockchain distributed ledger";
     readonly compatibleServerVersions: number[];
     readonly features: readonly ["Post-quantum cryptography (XMSS, ML-KEM-1024)", "Cross-platform compatibility", "Type-safe APIs", "DAG-based transaction processing", "GraphQL integration", "Real-time subscriptions", "Cellular architecture support"];
@@ -2238,7 +2372,7 @@ declare const DevUtils: {
         nodeVersion: string;
         environment: string;
         name: "KnishIO-Client-TS";
-        version: "1.0.0";
+        version: "1.2.0";
         description: "TypeScript SDK for Knish.IO post-blockchain distributed ledger";
         compatibleServerVersions: number[];
         features: readonly ["Post-quantum cryptography (XMSS, ML-KEM-1024)", "Cross-platform compatibility", "Type-safe APIs", "DAG-based transaction processing", "GraphQL integration", "Real-time subscriptions", "Cellular architecture support"];
@@ -2265,7 +2399,7 @@ declare const KnishIO: {
     SDK_VERSION: string;
     SDK_INFO: {
         readonly name: "KnishIO-Client-TS";
-        readonly version: "1.0.0";
+        readonly version: "1.2.0";
         readonly description: "TypeScript SDK for Knish.IO post-blockchain distributed ledger";
         readonly compatibleServerVersions: number[];
         readonly features: readonly ["Post-quantum cryptography (XMSS, ML-KEM-1024)", "Cross-platform compatibility", "Type-safe APIs", "DAG-based transaction processing", "GraphQL integration", "Real-time subscriptions", "Cellular architecture support"];
@@ -2278,4 +2412,4 @@ declare const KnishIO: {
     };
 };
 
-export { Atom, AtomIndexException, type AtomIsotope, AtomMeta, type AtomParams, AtomsMissingException, type AuthParams, AuthToken, type BalanceQueryParams, type Base17Hash, BaseException, type BaseResponse, type BundleHash, type BundleHashOptions, COMPATIBLE_SERVER_VERSIONS, CRYPTO_CONSTANTS, type CellSlug, CheckMolecule, type CreateSecretStorageOptions, type CreateTokenParams, DevUtils, Dot, EXCEPTION_CODES, EXCEPTION_TYPES, EXTENDED_COMPATIBILITY_TEST_VECTORS, type EmbeddingStatusItem, type EncryptedSecretPayload, ExceptionFactory, GraphQLClient, type GraphQLError, type GraphQLRequest, type GraphQLResponse, type HexString, type ISecretStorageProvider, type IStorageBackend, InvalidResponseException, type KeyGenerationOptions, KnishIO, KnishIOClient, type KnishIOClientConfig, MemorySecretStorageProvider, MemoryStorageBackend, Meta$1 as Meta, type MetaData, type MetaId, type MetaQueryParams, type MetaType, type MolecularHash, MolecularHashMismatchException, Molecule, type MoleculeParams, Mutation, MutationAppendRequest, MutationCreateMeta, MutationCreateToken, MutationCreateWallet, type MutationOperation, MutationPeering, MutationProposeMolecule, MutationRequestAuthorization, MutationRequestTokens, MutationTransferTokens, PolicyMeta, type Position, type PositionGenerationOptions, Query, QueryAtom, QueryBalance, QueryBatch, QueryContinuId, QueryEmbeddingStatus, QueryMetaType, QueryMetaTypeViaAtom, type QueryOperation, QueryWalletBundle, QueryWalletList, type RequestTokensParams, Response, ResponseAppendRequest, ResponseAtom, ResponseBalance, ResponseContinuId, ResponseCreateMeta, ResponseCreateToken, ResponseCreateWallet, ResponseEmbeddingStatus, ResponseMetaType, ResponseMetaTypeViaAtom, ResponsePeering, ResponseProposeMolecule, ResponseRequestAuthorization, ResponseRequestTokens, ResponseTransferTokens, ResponseWalletBundle, ResponseWalletList, type SDKConfig, SDK_INFO, SDK_NAME, SDK_VERSION, type SHAKE256Options, type SecretGenerationOptions, SecretStorageException, type SecretStorageMetadata, SignatureMismatchException, type SignatureOptions, type TokenSlug, TokenUnit, TransferBalanceException, type TransferParams, type ValidationResult$1 as ValidationResult, type VerificationOptions, Wallet, type WalletAddress, WalletCredentialException, type WalletParams, type WalletQueryParams, WebCryptoSecretStorageProvider, base64ToHex, bufferToHexString, capitalize, charsetBaseConvert, chunkArray, chunkSubstr, configureSDK, constantTimeCompare, convertToBase17, createBundleHash, createDefaultSecretStorage, createMolecularHash, createPosition, createTokenSlug, createWalletAddress, deepCloning, diff, enumerateMolecularHash, generateBatchId, generateBundleHash, generateOTSSignature, generatePosition, generateSecret, generateWalletAddress, generateWalletKey, getSDKConfig, hexStringToBuffer, hexToBase64, intersect, isAtomIsotope, isBundleHash, isHex, isHexString, isMolecularHash, isNumeric, isPosition, isWalletAddress, normalizeMolecularHash, randomString, runCompatibilityTests, runExtendedCompatibilityTests, shake256, toCamelCase, toSnakeCase, truncate, validateBundleHash, validateMolecularHashForSignature, validateOTSSignature, validatePosition, validateSecret, validateWalletAddress, verifyOTSSignature, withSecureBytes, withSecureString, zeroizeBytes };
+export { Atom, AtomIndexException, type AtomIsotope, AtomMeta, type AtomParams, AtomsMissingException, type AuthParams, AuthToken, type BalanceQueryParams, type Base17Hash, BaseException, type BaseResponse, type BundleHash, type BundleHashOptions, COMPATIBLE_SERVER_VERSIONS, CRYPTO_CONSTANTS, type CellSlug, CheckMolecule, type CreateSecretStorageOptions, type CreateTokenParams, DevUtils, Dot, EXCEPTION_CODES, EXCEPTION_TYPES, EXTENDED_COMPATIBILITY_TEST_VECTORS, type EmbeddingStatusItem, type EncryptedSecretPayload, ExceptionFactory, FileStorageBackend, GraphQLClient, type GraphQLError, type GraphQLRequest, type GraphQLResponse, type HexString, type IKeyStore, type ISecretStorageProvider, type IStorageBackend, IndexedDbKeyStore, InvalidResponseException, type KeyGenerationOptions, KnishIO, KnishIOClient, type KnishIOClientConfig, MemoryKeyStore, MemorySecretStorageProvider, MemoryStorageBackend, Meta$1 as Meta, type MetaData, type MetaId, type MetaQueryParams, type MetaType, type MolecularHash, MolecularHashMismatchException, Molecule, type MoleculeParams, Mutation, MutationAppendRequest, MutationCreateMeta, MutationCreateToken, MutationCreateWallet, type MutationOperation, MutationPeering, MutationProposeMolecule, MutationRequestAuthorization, MutationRequestTokens, MutationTransferTokens, NonExtractableKeySecretStorageProvider, type NonExtractableKeyStorageOptions, PolicyMeta, type Position, type PositionGenerationOptions, Query, QueryAtom, QueryBalance, QueryBatch, QueryContinuId, QueryEmbeddingStatus, QueryMetaType, QueryMetaTypeViaAtom, type QueryOperation, QueryWalletBundle, QueryWalletList, RECOVERY_KEY_PREFIX, type RequestTokensParams, Response, ResponseAppendRequest, ResponseAtom, ResponseBalance, ResponseContinuId, ResponseCreateMeta, ResponseCreateToken, ResponseCreateWallet, ResponseEmbeddingStatus, ResponseMetaType, ResponseMetaTypeViaAtom, ResponsePeering, ResponseProposeMolecule, ResponseRequestAuthorization, ResponseRequestTokens, ResponseTransferTokens, ResponseWalletBundle, ResponseWalletList, type SDKConfig, SDK_INFO, SDK_NAME, SDK_VERSION, SECRET_KEY_PREFIX, type SHAKE256Options, type SecretGenerationOptions, SecretStorageException, type SecretStorageMetadata, SignatureMismatchException, type SignatureOptions, type StorageOptions, type TokenSlug, TokenUnit, TransferBalanceException, type TransferParams, type ValidationResult$1 as ValidationResult, type VerificationOptions, Wallet, type WalletAddress, WalletCredentialException, type WalletParams, type WalletQueryParams, type WebAuthnPrfSecretStorageOptions, WebAuthnPrfSecretStorageProvider, WebCryptoSecretStorageProvider, WebStorageBackend, base64ToHex, bufferToHexString, capitalize, charsetBaseConvert, chunkArray, chunkSubstr, configureSDK, constantTimeCompare, convertToBase17, createBundleHash, createDefaultSecretStorage, createMolecularHash, createPosition, createTokenSlug, createWalletAddress, deepCloning, diff, enumerateMolecularHash, generateBatchId, generateBundleHash, generateOTSSignature, generatePosition, generateSecret, generateWalletAddress, generateWalletKey, getSDKConfig, hexStringToBuffer, hexToBase64, intersect, isAtomIsotope, isBundleHash, isHex, isHexString, isMolecularHash, isNumeric, isPosition, isWalletAddress, normalizeMolecularHash, openEnvelope, randomString, runCompatibilityTests, runExtendedCompatibilityTests, sealEnvelope, shake256, toCamelCase, toSnakeCase, truncate, validateBundleHash, validateMolecularHashForSignature, validateOTSSignature, validatePosition, validateSecret, validateWalletAddress, verifyOTSSignature, withSecureBytes, withSecureString, zeroizeBytes };