@h-ai/crypto 0.1.0-alpha.16 → 0.1.0-alpha.19

package/dist/index.js

@@ -33,7 +33,21 @@ var en_US_default = {
   crypto_passwordHashEmpty: "Password and hash cannot be empty",
   crypto_passwordHashFailed: "Password hashing failed",
   crypto_hashFormatInvalid: "Invalid hash format",
-  crypto_passwordVerifyFailed: "Password verification failed"
+  crypto_passwordVerifyFailed: "Password verification failed",
+  crypto_transportClientKeyGenerateFailed: "Failed to generate transport client key pair",
+  crypto_transportServerKeyGenerateFailed: "Failed to generate transport server key pair",
+  crypto_transportKeyExchangeRequestFailed: "Transport key exchange request failed",
+  crypto_transportKeyExchangeHttpFailed: "Transport key exchange returned HTTP {status}",
+  crypto_transportKeyExchangeInvalidJson: "Transport key exchange response is not valid JSON",
+  crypto_transportKeyExchangeMissingFields: "Transport key exchange response is missing required fields",
+  crypto_transportClientNotInitialized: "Transport client has not completed key exchange",
+  crypto_transportClientNotRegistered: "Transport client is not registered or has expired",
+  crypto_transportRequestEncryptFailed: "Failed to encrypt transport request body",
+  crypto_transportRequestDecryptFailed: "Failed to decrypt transport request body",
+  crypto_transportResponseEncryptFailed: "Failed to encrypt transport response body",
+  crypto_transportResponseDecryptFailed: "Failed to decrypt transport response body",
+  crypto_transportSessionKeyEncryptFailed: "Failed to encrypt transport session key",
+  crypto_transportSessionKeyDecryptFailed: "Failed to decrypt transport session key"
 };
 
 // messages/zh-CN.json
@@ -66,7 +80,21 @@ var zh_CN_default = {
   crypto_passwordHashEmpty: "\u5BC6\u7801\u548C\u54C8\u5E0C\u503C\u4E0D\u80FD\u4E3A\u7A7A",
   crypto_passwordHashFailed: "\u5BC6\u7801\u54C8\u5E0C\u5931\u8D25",
   crypto_hashFormatInvalid: "\u65E0\u6548\u7684\u54C8\u5E0C\u683C\u5F0F",
-  crypto_passwordVerifyFailed: "\u5BC6\u7801\u9A8C\u8BC1\u5931\u8D25"
+  crypto_passwordVerifyFailed: "\u5BC6\u7801\u9A8C\u8BC1\u5931\u8D25",
+  crypto_transportClientKeyGenerateFailed: "\u4F20\u8F93\u52A0\u5BC6\u5BA2\u6237\u7AEF\u5BC6\u94A5\u751F\u6210\u5931\u8D25",
+  crypto_transportServerKeyGenerateFailed: "\u4F20\u8F93\u52A0\u5BC6\u670D\u52A1\u7AEF\u5BC6\u94A5\u751F\u6210\u5931\u8D25",
+  crypto_transportKeyExchangeRequestFailed: "\u4F20\u8F93\u52A0\u5BC6\u5BC6\u94A5\u534F\u5546\u8BF7\u6C42\u5931\u8D25",
+  crypto_transportKeyExchangeHttpFailed: "\u4F20\u8F93\u52A0\u5BC6\u5BC6\u94A5\u534F\u5546\u8FD4\u56DE HTTP {status}",
+  crypto_transportKeyExchangeInvalidJson: "\u4F20\u8F93\u52A0\u5BC6\u5BC6\u94A5\u534F\u5546\u54CD\u5E94\u4E0D\u662F\u6709\u6548 JSON",
+  crypto_transportKeyExchangeMissingFields: "\u4F20\u8F93\u52A0\u5BC6\u5BC6\u94A5\u534F\u5546\u54CD\u5E94\u7F3A\u5C11\u5FC5\u8981\u5B57\u6BB5",
+  crypto_transportClientNotInitialized: "\u4F20\u8F93\u52A0\u5BC6\u5BA2\u6237\u7AEF\u5C1A\u672A\u5B8C\u6210\u5BC6\u94A5\u534F\u5546",
+  crypto_transportClientNotRegistered: "\u4F20\u8F93\u52A0\u5BC6\u5BA2\u6237\u7AEF\u672A\u6CE8\u518C\u6216\u5DF2\u8FC7\u671F",
+  crypto_transportRequestEncryptFailed: "\u4F20\u8F93\u52A0\u5BC6\u8BF7\u6C42\u4F53\u52A0\u5BC6\u5931\u8D25",
+  crypto_transportRequestDecryptFailed: "\u4F20\u8F93\u52A0\u5BC6\u8BF7\u6C42\u4F53\u89E3\u5BC6\u5931\u8D25",
+  crypto_transportResponseEncryptFailed: "\u4F20\u8F93\u52A0\u5BC6\u54CD\u5E94\u4F53\u52A0\u5BC6\u5931\u8D25",
+  crypto_transportResponseDecryptFailed: "\u4F20\u8F93\u52A0\u5BC6\u54CD\u5E94\u4F53\u89E3\u5BC6\u5931\u8D25",
+  crypto_transportSessionKeyEncryptFailed: "\u4F20\u8F93\u52A0\u5BC6\u4F1A\u8BDD\u5BC6\u94A5\u52A0\u5BC6\u5931\u8D25",
+  crypto_transportSessionKeyDecryptFailed: "\u4F20\u8F93\u52A0\u5BC6\u4F1A\u8BDD\u5BC6\u94A5\u89E3\u5BC6\u5931\u8D25"
 };
 
 // src/crypto-i18n.ts
@@ -560,49 +588,44 @@ function createSM4() {
     /**
      * SM4 对称加密
      *
-     * 支持 ECB（默认）和 CBC 两种模式，使用 PKCS#7 填充。
-     * CBC 模式需提供合法 IV。
+     * 默认使用 CBC 并自动生成随机 IV，返回结构化字段。
      *
-     * ⚠️ 安全警告：**ECB 默认模式不安全**—相同明文块产生相同密文块，泄漏结构信息。
-     * 生产场景请优先使用 `encryptWithIV()`（自动随机 IV 的 CBC）或显式传入
-     * `{ mode: 'cbc', iv }`。ECB 模式仅保留兼容性，未来版本可能移除默认值。
+     * ⚠️ 安全警告：ECB 模式会让相同明文块产生相同密文块，泄漏结构信息。
+     * 生产场景请使用默认 CBC，或显式传入 `{ mode: 'cbc', iv }`。
      *
      * @param data - 待加密明文
      * @param key - 密钥（32 字符十六进制）
      * @param options - 加密模式/IV/输出格式
-     * @returns 成功时返回密文；失败时返回 INVALID_KEY/INVALID_IV/ENCRYPTION_FAILED
+     * @returns 成功时返回结构化密文；失败时返回 INVALID_KEY/INVALID_IV/ENCRYPTION_FAILED
      */
     encrypt(data, key, options = {}) {
       const {
-        mode = "ecb",
+        mode = "cbc",
         iv,
         outputFormat = "hex"
       } = options;
+      const actualIv = mode === "cbc" ? iv ?? this.generateIV() : void 0;
       if (!this.isValidKey(key)) {
         return err(
           HaiCryptoError.INVALID_KEY,
           cryptoM("crypto_sm4KeyInvalid")
         );
       }
-      if (mode === "cbc" && !iv) {
-        return err(
-          HaiCryptoError.INVALID_IV,
-          cryptoM("crypto_sm4CbcNeedIv")
-        );
-      }
-      if (mode === "cbc" && iv && !this.isValidIV(iv)) {
-        return err(
-          HaiCryptoError.INVALID_IV,
-          cryptoM("crypto_sm4IvInvalid")
-        );
+      if (mode === "cbc") {
+        if (!actualIv || !this.isValidIV(actualIv)) {
+          return err(
+            HaiCryptoError.INVALID_IV,
+            cryptoM("crypto_sm4IvInvalid")
+          );
+        }
       }
       try {
         const sm4Options = {
           mode,
           padding: "pkcs#7"
         };
-        if (mode === "cbc" && iv) {
-          sm4Options.iv = iv;
+        if (mode === "cbc" && actualIv) {
+          sm4Options.iv = actualIv;
         }
         const encrypted = sm4.encrypt(data, key, sm4Options);
         if (!encrypted) {
@@ -611,10 +634,12 @@ function createSM4() {
             cryptoM("crypto_sm4EncryptEmpty")
           );
         }
-        if (outputFormat === "base64") {
-          return ok(hexToBase64(encrypted));
-        }
-        return ok(encrypted);
+        return ok({
+          mode,
+          ciphertext: encodeCiphertext(encrypted, outputFormat),
+          ...actualIv ? { iv: actualIv } : {},
+          encoding: outputFormat
+        });
       } catch (error) {
         return err(
           HaiCryptoError.ENCRYPTION_FAILED,
@@ -626,33 +651,28 @@ function createSM4() {
     /**
      * SM4 对称解密
      *
-     * 自动检测 base64 格式输入并转换为 hex。
-     * 解密模式和 IV 需与加密时一致。
+     * 使用结构化字段解密；解密模式、IV 与密文编码均来自 payload。
      *
-     * @param ciphertext - 密文（hex 或 base64）
+     * @param payload - 结构化密文
      * @param key - 密钥（32 字符十六进制）
-     * @param options - 解密模式/IV
      * @returns 成功时返回明文；失败时返回 INVALID_KEY/INVALID_IV/DECRYPTION_FAILED
      */
-    decrypt(ciphertext, key, options = {}) {
-      const { mode = "ecb", iv } = options;
+    decrypt(payload, key) {
+      const { mode, iv } = payload;
       if (!this.isValidKey(key)) {
         return err(
           HaiCryptoError.INVALID_KEY,
           cryptoM("crypto_sm4KeyInvalid")
         );
       }
-      if (mode === "cbc" && !iv) {
+      if (mode === "cbc" && (!iv || !this.isValidIV(iv))) {
         return err(
           HaiCryptoError.INVALID_IV,
-          cryptoM("crypto_sm4CbcNeedIv")
+          cryptoM("crypto_sm4IvInvalid")
         );
       }
       try {
-        let input = ciphertext;
-        if (isBase64(ciphertext)) {
-          input = base64ToHex(ciphertext);
-        }
+        const input = decodeCiphertext(payload);
         const sm4Options = {
           mode,
           padding: "pkcs#7"
@@ -689,7 +709,12 @@ function createSM4() {
       if (!result.success) {
         return result;
       }
-      return ok({ ciphertext: result.data, iv });
+      return ok({
+        mode: "cbc",
+        ciphertext: result.data.ciphertext,
+        iv,
+        encoding: result.data.encoding
+      });
     },
     /**
      * 带 IV 解密（CBC 模式）
@@ -700,7 +725,7 @@ function createSM4() {
      * @returns 成功时返回明文；失败时同 decrypt
      */
     decryptWithIV(ciphertext, key, iv) {
-      return this.decrypt(ciphertext, key, { mode: "cbc", iv });
+      return this.decrypt({ mode: "cbc", ciphertext, iv, encoding: "hex" }, key);
     },
     /**
      * 从密码和盐值派生密钥
@@ -737,6 +762,12 @@ function generateRandomHex(byteLength) {
   crypto.getRandomValues(bytes);
   return Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
 }
+function encodeCiphertext(ciphertext, encoding) {
+  return encoding === "base64" ? hexToBase64(ciphertext) : ciphertext;
+}
+function decodeCiphertext(payload) {
+  return payload.encoding === "base64" ? base64ToHex(payload.ciphertext) : payload.ciphertext;
+}
 
 // src/transport/crypto-transport-types.ts
 var TRANSPORT_PROTOCOL = {
@@ -760,7 +791,7 @@ function createTransportClient(options) {
   async function doInit() {
     const kpResult = options.crypto.asymmetric.generateKeyPair();
     if (!kpResult.success)
-      return err(HaiCommonError.INTERNAL_ERROR, "Failed to generate client key pair", kpResult.error);
+      return err(HaiCommonError.INTERNAL_ERROR, cryptoM("crypto_transportClientKeyGenerateFailed"), kpResult.error);
     const localKeyPair = kpResult.data;
     let response;
     try {
@@ -770,18 +801,18 @@ function createTransportClient(options) {
         body: JSON.stringify({ clientPublicKey: localKeyPair.publicKey })
       });
     } catch (cause) {
-      return err(HaiCommonError.INTERNAL_ERROR, "Key exchange request failed", cause);
+      return err(HaiCommonError.INTERNAL_ERROR, cryptoM("crypto_transportKeyExchangeRequestFailed"), cause);
     }
     if (!response.ok)
-      return err(HaiCommonError.INTERNAL_ERROR, `Key exchange returned HTTP ${response.status}`);
+      return err(HaiCommonError.INTERNAL_ERROR, cryptoM("crypto_transportKeyExchangeHttpFailed", { params: { status: response.status } }));
     let body;
     try {
       body = await response.json();
     } catch (cause) {
-      return err(HaiCommonError.INTERNAL_ERROR, "Key exchange response is not valid JSON", cause);
+      return err(HaiCommonError.INTERNAL_ERROR, cryptoM("crypto_transportKeyExchangeInvalidJson"), cause);
     }
     if (!body.serverPublicKey || !body.clientId)
-      return err(HaiCommonError.INTERNAL_ERROR, "Key exchange response missing fields");
+      return err(HaiCommonError.INTERNAL_ERROR, cryptoM("crypto_transportKeyExchangeMissingFields"));
     keyPair = localKeyPair;
     serverPublicKey = body.serverPublicKey;
     clientId = body.clientId;
@@ -801,14 +832,14 @@ function createTransportClient(options) {
   }
   function encryptBody(plaintext) {
     if (!serverPublicKey)
-      return err(HaiCommonError.INTERNAL_ERROR, "Transport client not initialized");
+      return err(HaiCommonError.INTERNAL_ERROR, cryptoM("crypto_transportClientNotInitialized"));
     const symKey = options.crypto.symmetric.generateKey();
     const encResult = options.crypto.symmetric.encryptWithIV(plaintext, symKey);
     if (!encResult.success)
-      return err(HaiCommonError.INTERNAL_ERROR, "Failed to encrypt request body", encResult.error);
+      return err(HaiCommonError.INTERNAL_ERROR, cryptoM("crypto_transportRequestEncryptFailed"), encResult.error);
     const keyEncResult = options.crypto.asymmetric.encrypt(symKey, serverPublicKey);
     if (!keyEncResult.success)
-      return err(HaiCommonError.INTERNAL_ERROR, "Failed to encrypt session key", keyEncResult.error);
+      return err(HaiCommonError.INTERNAL_ERROR, cryptoM("crypto_transportSessionKeyEncryptFailed"), keyEncResult.error);
     return ok({
       encryptedKey: keyEncResult.data,
       ciphertext: encResult.data.ciphertext,
@@ -817,13 +848,13 @@ function createTransportClient(options) {
   }
   function decryptPayload(payload) {
     if (!keyPair)
-      return err(HaiCommonError.INTERNAL_ERROR, "Transport client not initialized");
+      return err(HaiCommonError.INTERNAL_ERROR, cryptoM("crypto_transportClientNotInitialized"));
     const keyDec = options.crypto.asymmetric.decrypt(payload.encryptedKey, keyPair.privateKey);
     if (!keyDec.success)
-      return err(HaiCommonError.INTERNAL_ERROR, "Failed to decrypt session key", keyDec.error);
+      return err(HaiCommonError.INTERNAL_ERROR, cryptoM("crypto_transportSessionKeyDecryptFailed"), keyDec.error);
     const dec = options.crypto.symmetric.decryptWithIV(payload.ciphertext, keyDec.data, payload.iv);
     if (!dec.success)
-      return err(HaiCommonError.INTERNAL_ERROR, "Failed to decrypt response body", dec.error);
+      return err(HaiCommonError.INTERNAL_ERROR, cryptoM("crypto_transportResponseDecryptFailed"), dec.error);
     return ok(dec.data);
   }
   const encryptedFetch = async (input, init) => {
@@ -933,14 +964,27 @@ function isEncryptedPayload(payload) {
   const p = payload;
   return typeof p.encryptedKey === "string" && typeof p.ciphertext === "string" && typeof p.iv === "string";
 }
-function createInMemoryKeyStore(maxClients = 1e4) {
+
+// src/transport/store-provider/crypto-transport-store-memory.ts
+var DEFAULT_MAX_CLIENTS = 1e4;
+function normalizeMaxClients(maxClients) {
+  if (!Number.isFinite(maxClients))
+    return DEFAULT_MAX_CLIENTS;
+  return Math.max(1, Math.floor(maxClients));
+}
+function createClientId(counter) {
+  const entropy = typeof crypto !== "undefined" && typeof crypto.randomUUID === "function" ? crypto.randomUUID().replace(/-/g, "") : Math.random().toString(36).slice(2, 12);
+  return `c_${counter}_${Date.now()}_${entropy}`;
+}
+function createInMemoryKeyStore(maxClients = DEFAULT_MAX_CLIENTS) {
   const clientKeys = /* @__PURE__ */ new Map();
+  const capacity = normalizeMaxClients(maxClients);
   let counter = 0;
   return {
     async register(publicKey) {
       counter++;
-      const clientId = `c_${counter}_${Date.now()}`;
-      if (clientKeys.size >= maxClients) {
+      const clientId = createClientId(counter);
+      if (clientKeys.size >= capacity) {
         const oldest = clientKeys.keys().next().value;
         if (oldest !== void 0)
           clientKeys.delete(oldest);
@@ -959,10 +1003,12 @@ function createInMemoryKeyStore(maxClients = 1e4) {
     }
   };
 }
+
+// src/transport/crypto-transport-server.ts
 function createTransportEncryption(cryptoService, options = {}) {
   const keyPairResult = cryptoService.asymmetric.generateKeyPair();
   if (!keyPairResult.success)
-    return err(HaiCommonError.INTERNAL_ERROR, "Failed to generate transport key pair", keyPairResult.error);
+    return err(HaiCommonError.INTERNAL_ERROR, cryptoM("crypto_transportServerKeyGenerateFailed"), keyPairResult.error);
   const serverKeyPair = keyPairResult.data;
   const keyStore = options.keyStore ?? createInMemoryKeyStore(options.maxClients);
   const manager = {
@@ -978,14 +1024,14 @@ function createTransportEncryption(cryptoService, options = {}) {
     async encryptResponse(clientId, data) {
       const clientPublicKey = await keyStore.get(clientId);
       if (!clientPublicKey)
-        return err(HaiCommonError.NOT_FOUND, `Unknown transport client: ${clientId}`);
+        return err(HaiCommonError.NOT_FOUND, cryptoM("crypto_transportClientNotRegistered"));
       const symmetricKey = cryptoService.symmetric.generateKey();
       const encResult = cryptoService.symmetric.encryptWithIV(data, symmetricKey);
       if (!encResult.success)
-        return err(HaiCommonError.INTERNAL_ERROR, "Failed to encrypt response payload", encResult.error);
+        return err(HaiCommonError.INTERNAL_ERROR, cryptoM("crypto_transportResponseEncryptFailed"), encResult.error);
       const keyEncResult = cryptoService.asymmetric.encrypt(symmetricKey, clientPublicKey);
       if (!keyEncResult.success)
-        return err(HaiCommonError.INTERNAL_ERROR, "Failed to encrypt session key", keyEncResult.error);
+        return err(HaiCommonError.INTERNAL_ERROR, cryptoM("crypto_transportSessionKeyEncryptFailed"), keyEncResult.error);
       const payload = {
         encryptedKey: keyEncResult.data,
         ciphertext: encResult.data.ciphertext,
@@ -996,10 +1042,10 @@ function createTransportEncryption(cryptoService, options = {}) {
     decryptRequest(payload) {
       const keyDecResult = cryptoService.asymmetric.decrypt(payload.encryptedKey, serverKeyPair.privateKey);
       if (!keyDecResult.success)
-        return err(HaiCommonError.INTERNAL_ERROR, "Failed to decrypt session key", keyDecResult.error);
+        return err(HaiCommonError.INTERNAL_ERROR, cryptoM("crypto_transportSessionKeyDecryptFailed"), keyDecResult.error);
       const decResult = cryptoService.symmetric.decryptWithIV(payload.ciphertext, keyDecResult.data, payload.iv);
       if (!decResult.success)
-        return err(HaiCommonError.INTERNAL_ERROR, "Failed to decrypt request payload", decResult.error);
+        return err(HaiCommonError.INTERNAL_ERROR, cryptoM("crypto_transportRequestDecryptFailed"), decResult.error);
       return ok(decResult.data);
     },
     async close() {
@@ -1052,6 +1098,7 @@ var crypto2 = {
     }
     initInProgress = true;
     try {
+      await Promise.resolve();
       if (initialized) {
         logger.warn("Crypto module is already initialized, reinitializing");
         await crypto2.close();
@@ -1129,6 +1176,148 @@ var crypto2 = {
   }
 };
 
-export { HaiCryptoError, TRANSPORT_PROTOCOL, crypto2 as crypto };
+// src/transport/store-provider/crypto-transport-store-redis.ts
+var TRANSPORT_KEY_CACHE_PREFIX = "hai:crypto:transport:client";
+function normalizeTtlSeconds(ttlSeconds) {
+  if (ttlSeconds === void 0 || !Number.isFinite(ttlSeconds) || ttlSeconds <= 0)
+    return void 0;
+  return Math.floor(ttlSeconds);
+}
+function createClientId2() {
+  if (typeof crypto !== "undefined" && typeof crypto.randomUUID === "function")
+    return `c_${crypto.randomUUID()}`;
+  return `c_${Date.now()}_${Math.random().toString(36).slice(2, 12)}`;
+}
+function toOperationError(operation, error) {
+  const wrapped = new Error(`${operation} failed: ${error.message}`, { cause: error });
+  wrapped.code = error.code;
+  return wrapped;
+}
+function unwrapResult(operation, result) {
+  if (result.success)
+    return result.data;
+  throw toOperationError(operation, result.error);
+}
+function createRedisTransportKeyStore(options) {
+  const ttlSeconds = normalizeTtlSeconds(options.ttlSeconds);
+  function buildCacheKey(clientId) {
+    return `${TRANSPORT_KEY_CACHE_PREFIX}:${clientId}`;
+  }
+  return {
+    async register(publicKey) {
+      const clientId = createClientId2();
+      unwrapResult(
+        "cache.kv.set",
+        await options.cache.kv.set(
+          buildCacheKey(clientId),
+          publicKey,
+          ttlSeconds === void 0 ? void 0 : { ex: ttlSeconds }
+        )
+      );
+      return clientId;
+    },
+    async get(clientId) {
+      const publicKey = unwrapResult(
+        "cache.kv.get",
+        await options.cache.kv.get(buildCacheKey(clientId))
+      );
+      return publicKey ?? void 0;
+    },
+    async delete(clientId) {
+      unwrapResult("cache.kv.del", await options.cache.kv.del(buildCacheKey(clientId)));
+    }
+  };
+}
+
+// src/transport/store-provider/crypto-transport-store-reldb.ts
+var TRANSPORT_KEY_TABLE = "hai_crypto_transport_client_keys";
+function normalizeTtlSeconds2(ttlSeconds) {
+  if (ttlSeconds === void 0 || !Number.isFinite(ttlSeconds) || ttlSeconds <= 0)
+    return void 0;
+  return Math.floor(ttlSeconds);
+}
+function createClientId3() {
+  if (typeof crypto !== "undefined" && typeof crypto.randomUUID === "function")
+    return `c_${crypto.randomUUID()}`;
+  return `c_${Date.now()}_${Math.random().toString(36).slice(2, 12)}`;
+}
+function toOperationError2(operation, error) {
+  const wrapped = new Error(`${operation} failed: ${error.message}`, { cause: error });
+  wrapped.code = error.code;
+  return wrapped;
+}
+function unwrapResult2(operation, result) {
+  if (result.success)
+    return result.data;
+  throw toOperationError2(operation, result.error);
+}
+function createReldbTransportKeyStore(options) {
+  const ttlSeconds = normalizeTtlSeconds2(options.ttlSeconds);
+  let ensureTablePromise = null;
+  async function ensureTable() {
+    if (!ensureTablePromise) {
+      ensureTablePromise = (async () => {
+        unwrapResult2(
+          "reldb.ddl.createTable",
+          await options.reldb.ddl.createTable(TRANSPORT_KEY_TABLE, {
+            client_id: { type: "TEXT", primaryKey: true },
+            public_key: { type: "TEXT", notNull: true },
+            created_at: { type: "TIMESTAMP", notNull: true },
+            expires_at: { type: "TIMESTAMP" }
+          }, true)
+        );
+      })();
+    }
+    return ensureTablePromise;
+  }
+  async function deleteClientKey(clientId) {
+    unwrapResult2(
+      "reldb.sql.execute",
+      await options.reldb.sql.execute(
+        `DELETE FROM ${TRANSPORT_KEY_TABLE} WHERE client_id = ?`,
+        [clientId]
+      )
+    );
+  }
+  return {
+    async register(publicKey) {
+      await ensureTable();
+      const clientId = createClientId3();
+      const createdAt = (/* @__PURE__ */ new Date()).toISOString();
+      const expiresAt = ttlSeconds === void 0 ? null : new Date(Date.now() + ttlSeconds * 1e3).toISOString();
+      unwrapResult2(
+        "reldb.sql.execute",
+        await options.reldb.sql.execute(
+          `INSERT INTO ${TRANSPORT_KEY_TABLE} (client_id, public_key, created_at, expires_at) VALUES (?, ?, ?, ?)`,
+          [clientId, publicKey, createdAt, expiresAt]
+        )
+      );
+      return clientId;
+    },
+    async get(clientId) {
+      await ensureTable();
+      const row = unwrapResult2(
+        "reldb.sql.get",
+        await options.reldb.sql.get(
+          `SELECT public_key, expires_at FROM ${TRANSPORT_KEY_TABLE} WHERE client_id = ?`,
+          [clientId]
+        )
+      );
+      if (!row)
+        return void 0;
+      if (row.expires_at && Date.parse(row.expires_at) <= Date.now()) {
+        await deleteClientKey(clientId);
+        return void 0;
+      }
+      return row.public_key;
+    },
+    async delete(clientId) {
+      await ensureTable();
+      await deleteClientKey(clientId);
+    }
+  };
+}
+
+export { HaiCryptoError, TRANSPORT_PROTOCOL, createInMemoryKeyStore, createRedisTransportKeyStore, createReldbTransportKeyStore, crypto2 as crypto };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map