@h-ai/crypto 1.0.0-beta.21 → 1.0.0-beta.23

package/dist/index.js

@@ -59,6 +59,7 @@ var en_US_default = {
   crypto_transportBodyLimitInvalid: "Transport plaintext limit must be an integer between 1024 and 67108864 bytes",
   crypto_transportBodyTooLarge: "Encrypted transport payload exceeds the configured byte limit",
   crypto_transportTimeInvalid: "Your device and server clocks may be out of sync, or the request has expired. Enable automatic time synchronization or set your device time manually, then refresh to retry. If this continues, ask an administrator to check the server clock.",
+  crypto_transportTimeResponseInvalid: "Transport time validation response is missing a valid server timestamp",
   crypto_transportTimeInvalidWithServerTime: "Your device and server clocks may be out of sync, or the request has expired. Server time is {serverTime}. Enable automatic time synchronization or set your device time manually, then refresh to retry. If this continues, ask an administrator to check the server clock.",
   crypto_transportTimeConfigInvalid: "Invalid transport time settings. Future clock skew must be an integer from 0 to 300 seconds and request lifetime from 1 to 600 seconds.",
   crypto_transportBodyLimitConflict: "Explicit transport limit {limit} bytes is below the enabled module requirement of {required} bytes; adjust the module budget or explicit limit",
@@ -121,6 +122,7 @@ var ja_JP_default = {
   crypto_transportBodyLimitInvalid: "\u901A\u4FE1\u5E73\u6587\u306E\u4E0A\u9650\u306F 1024 \u304B\u3089 67108864 \u30D0\u30A4\u30C8\u306E\u6574\u6570\u3067\u6307\u5B9A\u3057\u3066\u304F\u3060\u3055\u3044",
   crypto_transportBodyTooLarge: "\u6697\u53F7\u5316\u901A\u4FE1\u306E\u30C7\u30FC\u30BF\u304C\u8A2D\u5B9A\u3055\u308C\u305F\u30D0\u30A4\u30C8\u4E0A\u9650\u3092\u8D85\u3048\u3066\u3044\u307E\u3059",
   crypto_transportTimeInvalid: "\u7AEF\u672B\u3068\u30B5\u30FC\u30D0\u30FC\u306E\u6642\u523B\u304C\u540C\u671F\u3057\u3066\u3044\u306A\u3044\u304B\u3001\u8981\u6C42\u306E\u6709\u52B9\u671F\u9650\u304C\u5207\u308C\u3066\u3044\u307E\u3059\u3002\u7AEF\u672B\u306E\u81EA\u52D5\u6642\u523B\u540C\u671F\u3092\u6709\u52B9\u306B\u3059\u308B\u304B\u3001\u624B\u52D5\u3067\u6642\u523B\u3092\u8A2D\u5B9A\u3057\u3066\u304B\u3089\u3001\u30DA\u30FC\u30B8\u3092\u518D\u8AAD\u307F\u8FBC\u307F\u3057\u3066\u304F\u3060\u3055\u3044\u3002\u89E3\u6D88\u3057\u306A\u3044\u5834\u5408\u306F\u7BA1\u7406\u8005\u306B\u30B5\u30FC\u30D0\u30FC\u306E\u6642\u523B\u78BA\u8A8D\u3092\u4F9D\u983C\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
+  crypto_transportTimeResponseInvalid: "\u6697\u53F7\u5316\u901A\u4FE1\u306E\u6642\u523B\u691C\u8A3C\u5FDC\u7B54\u306B\u6709\u52B9\u306A\u30B5\u30FC\u30D0\u30FC\u6642\u523B\u304C\u3042\u308A\u307E\u305B\u3093",
   crypto_transportTimeInvalidWithServerTime: "\u7AEF\u672B\u3068\u30B5\u30FC\u30D0\u30FC\u306E\u6642\u523B\u304C\u540C\u671F\u3057\u3066\u3044\u306A\u3044\u304B\u3001\u8981\u6C42\u306E\u6709\u52B9\u671F\u9650\u304C\u5207\u308C\u3066\u3044\u307E\u3059\u3002\u30B5\u30FC\u30D0\u30FC\u6642\u523B\u306F {serverTime} \u3067\u3059\u3002\u7AEF\u672B\u306E\u81EA\u52D5\u6642\u523B\u540C\u671F\u3092\u6709\u52B9\u306B\u3059\u308B\u304B\u3001\u624B\u52D5\u3067\u6642\u523B\u3092\u8A2D\u5B9A\u3057\u3066\u304B\u3089\u3001\u30DA\u30FC\u30B8\u3092\u518D\u8AAD\u307F\u8FBC\u307F\u3057\u3066\u304F\u3060\u3055\u3044\u3002\u89E3\u6D88\u3057\u306A\u3044\u5834\u5408\u306F\u7BA1\u7406\u8005\u306B\u30B5\u30FC\u30D0\u30FC\u306E\u6642\u523B\u78BA\u8A8D\u3092\u4F9D\u983C\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
   crypto_transportTimeConfigInvalid: "\u30C8\u30E9\u30F3\u30B9\u30DD\u30FC\u30C8\u306E\u6642\u523B\u8A2D\u5B9A\u304C\u7121\u52B9\u3067\u3059\u3002\u672A\u6765\u65B9\u5411\u306E\u6642\u523B\u5DEE\u306F 0\uFF5E300 \u79D2\u3001\u8981\u6C42\u306E\u6709\u52B9\u671F\u9593\u306F 1\uFF5E600 \u79D2\u306E\u6574\u6570\u3067\u6307\u5B9A\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
   crypto_transportBodyLimitConflict: "\u660E\u793A\u3055\u308C\u305F\u8EE2\u9001\u4E0A\u9650 {limit} \u30D0\u30A4\u30C8\u306F\u6709\u52B9\u306A\u30E2\u30B8\u30E5\u30FC\u30EB\u306E\u5FC5\u8981\u91CF {required} \u30D0\u30A4\u30C8\u672A\u6E80\u3067\u3059\u3002\u4E88\u7B97\u307E\u305F\u306F\u4E0A\u9650\u3092\u5909\u66F4\u3057\u3066\u304F\u3060\u3055\u3044",
@@ -183,6 +185,7 @@ var zh_CN_default = {
   crypto_transportBodyLimitInvalid: "\u4F20\u8F93\u660E\u6587\u5BB9\u91CF\u5FC5\u987B\u662F 1024 \u5230 67108864 \u5B57\u8282\u4E4B\u95F4\u7684\u6574\u6570",
   crypto_transportBodyTooLarge: "\u52A0\u5BC6\u4F20\u8F93\u62A5\u6587\u8D85\u8FC7\u914D\u7F6E\u7684\u5B57\u8282\u4E0A\u9650",
   crypto_transportTimeInvalid: "\u8BBE\u5907\u4E0E\u670D\u52A1\u5668\u65F6\u95F4\u53EF\u80FD\u4E0D\u540C\u6B65\uFF0C\u6216\u8BF7\u6C42\u5DF2\u8FC7\u671F\u3002\u8BF7\u5F00\u542F\u8BBE\u5907\u7684\u81EA\u52A8\u6821\u65F6\u6216\u624B\u5DE5\u4FEE\u6539\u65F6\u95F4\uFF0C\u7136\u540E\u5237\u65B0\u91CD\u8BD5\u3002\u82E5\u4ECD\u5931\u8D25\uFF0C\u8BF7\u8054\u7CFB\u7BA1\u7406\u5458\u68C0\u67E5\u670D\u52A1\u5668\u65F6\u95F4\u3002",
+  crypto_transportTimeResponseInvalid: "\u4F20\u8F93\u52A0\u5BC6\u65F6\u95F4\u6821\u9A8C\u54CD\u5E94\u7F3A\u5C11\u6709\u6548\u7684\u670D\u52A1\u5668\u65F6\u95F4",
   crypto_transportTimeInvalidWithServerTime: "\u8BBE\u5907\u4E0E\u670D\u52A1\u5668\u65F6\u95F4\u53EF\u80FD\u4E0D\u540C\u6B65\uFF0C\u6216\u8BF7\u6C42\u5DF2\u8FC7\u671F\u3002\u670D\u52A1\u5668\u65F6\u95F4\u4E3A {serverTime}\u3002\u8BF7\u5F00\u542F\u8BBE\u5907\u7684\u81EA\u52A8\u6821\u65F6\u6216\u624B\u5DE5\u4FEE\u6539\u65F6\u95F4\uFF0C\u7136\u540E\u5237\u65B0\u91CD\u8BD5\u3002\u82E5\u4ECD\u5931\u8D25\uFF0C\u8BF7\u8054\u7CFB\u7BA1\u7406\u5458\u68C0\u67E5\u670D\u52A1\u5668\u65F6\u95F4\u3002",
   crypto_transportTimeConfigInvalid: "\u4F20\u8F93\u65F6\u95F4\u914D\u7F6E\u65E0\u6548\u3002\u5141\u8BB8\u7684\u672A\u6765\u504F\u5DEE\u987B\u4E3A 0 \u81F3 300 \u79D2\u7684\u6574\u6570\uFF0C\u8BF7\u6C42\u6709\u6548\u671F\u987B\u4E3A 1 \u81F3 600 \u79D2\u7684\u6574\u6570\u3002",
   crypto_transportBodyLimitConflict: "\u663E\u5F0F\u4F20\u8F93\u4E0A\u9650 {limit} \u5B57\u8282\u5C0F\u4E8E\u5DF2\u542F\u7528\u6A21\u5757\u6240\u9700\u7684 {required} \u5B57\u8282\uFF1B\u8BF7\u8C03\u6574\u6A21\u5757\u9884\u7B97\u6216\u663E\u5F0F\u4E0A\u9650",
@@ -1058,6 +1061,9 @@ var TRANSPORT_TIME_LIMITS = Object.freeze({
 });
 
 // src/transport/crypto-transport-codec.ts
+function isValidTransportKeyTtlSeconds(value) {
+  return typeof value === "number" && Number.isInteger(value) && value > 0 && value <= 2147483647;
+}
 function authenticatedText(payload) {
   const c = payload.context;
   return JSON.stringify([
@@ -1164,20 +1170,20 @@ function sameTransportContext(a, b) {
 // src/transport/crypto-transport-error.ts
 var TransportTimeError = class extends Error {
   constructor(context, serverTime) {
-    const validTime = typeof serverTime === "number" && Number.isSafeInteger(serverTime) && serverTime >= 0 && serverTime <= 864e13 ? serverTime : void 0;
-    const message = validTime === void 0 ? cryptoM("crypto_transportTimeInvalid") : cryptoM("crypto_transportTimeInvalidWithServerTime", {
+    if (!Number.isSafeInteger(serverTime) || serverTime < 0 || serverTime > 864e13)
+      throw new RangeError(cryptoM("crypto_transportTimeResponseInvalid"));
+    super(cryptoM("crypto_transportTimeInvalidWithServerTime", {
       params: {
-        serverTime: new Date(validTime).toISOString().replace("T", " ").replace(/\.\d{3}Z$/, " UTC")
+        serverTime: new Date(serverTime).toISOString().replace("T", " ").replace(/\.\d{3}Z$/, " UTC")
       }
-    });
-    super(message);
+    }));
     this.context = context;
+    this.serverTime = serverTime;
     this.name = "TransportTimeError";
-    this.serverTime = validTime;
   }
   context;
-  code = HaiCryptoError.TRANSPORT_TIME_INVALID.code;
   serverTime;
+  code = HaiCryptoError.TRANSPORT_TIME_INVALID.code;
 };
 async function createTransportErrorResponse(error, authenticated) {
   const isTimeError = error instanceof TransportTimeError;
@@ -1194,7 +1200,7 @@ async function createTransportErrorResponse(error, authenticated) {
     }
   };
   if (authenticated) {
-    const encryptedError = isTimeError && error.serverTime !== void 0 ? {
+    const encryptedError = isTimeError ? {
       ...publicError,
       message: error.message,
       details: { serverTime: error.serverTime }
@@ -1217,15 +1223,14 @@ async function createTransportErrorResponse(error, authenticated) {
 }
 
 // src/transport/crypto-transport-client.ts
+function isSessionUsable(session) {
+  return Date.now() < session.renewAt && performance.now() < session.monotonicRenewAt;
+}
 function createTransportClient(options) {
   const baseFetch = options.fetch ?? fetch;
   const localLimits = options.maxPlaintextBytes === void 0 ? void 0 : resolveTransportBodyLimits(options.maxPlaintextBytes);
-  let bodyLimits = localLimits ?? resolveTransportBodyLimits();
-  let keyPair = null;
-  let serverPublicKey = null;
-  let serverKeyId = null;
-  let clientId = null;
-  let initPromise = null;
+  let session;
+  let initPromise;
   let generation = 0;
   let handshakeController;
   async function doInit(attemptGeneration) {
@@ -1237,6 +1242,8 @@ function createTransportClient(options) {
       return err(HaiCommonError.INTERNAL_ERROR, cryptoM("crypto_transportClientKeyGenerateFailed"));
     const controller = new AbortController();
     handshakeController = controller;
+    const exchangeStartedAt = Date.now();
+    const monotonicStart = performance.now();
     const timeout = setTimeout(() => controller.abort(new DOMException("Key exchange timed out", "TimeoutError")), 3e4);
     try {
       let response;
@@ -1269,6 +1276,7 @@ function createTransportClient(options) {
       if (!isKeyExchangeResponse(body)) {
         return err(HaiCommonError.INTERNAL_ERROR, cryptoM("crypto_transportKeyExchangeMissingFields"));
       }
+      let bodyLimits;
       try {
         const serverLimits = resolveTransportBodyLimits(body.maxPlaintextBytes);
         bodyLimits = resolveTransportBodyLimits(Math.min(localLimits?.plaintextBytes ?? serverLimits.plaintextBytes, serverLimits.plaintextBytes));
@@ -1277,11 +1285,21 @@ function createTransportClient(options) {
       }
       if (attemptGeneration !== generation || controller.signal.aborted)
         return err(HaiCommonError.INTERNAL_ERROR, cryptoM("crypto_transportClientNotInitialized"));
-      keyPair = localKeyPair;
-      serverPublicKey = body.serverPublicKey;
-      serverKeyId = body.serverKeyId;
-      clientId = body.clientId;
-      return ok(void 0);
+      const ttlMs = body.clientKeyTtlSeconds === void 0 ? Number.POSITIVE_INFINITY : body.clientKeyTtlSeconds * 1e3;
+      const usableMs = ttlMs - Math.min(ttlMs / 10, 3e4);
+      const nextSession = {
+        keyPair: localKeyPair,
+        serverPublicKey: body.serverPublicKey,
+        serverKeyId: body.serverKeyId,
+        clientId: body.clientId,
+        bodyLimits,
+        renewAt: exchangeStartedAt + usableMs,
+        monotonicRenewAt: monotonicStart + usableMs
+      };
+      if (!isSessionUsable(nextSession))
+        return err(HaiCommonError.INTERNAL_ERROR, cryptoM("crypto_transportKeyExchangeRequestFailed"));
+      session = nextSession;
+      return ok(nextSession);
     } finally {
       clearTimeout(timeout);
       if (handshakeController === controller)
@@ -1289,39 +1307,23 @@ function createTransportClient(options) {
     }
   }
   async function ensureReady() {
-    if (clientId && serverPublicKey)
-      return ok(void 0);
+    if (session && isSessionUsable(session))
+      return ok(session);
     if (!initPromise) {
-      const pending = doInit(generation).then((result) => {
-        if (!result.success && initPromise === pending)
-          initPromise = null;
-        return result;
+      session = void 0;
+      const pending = doInit(generation).finally(() => {
+        if (initPromise === pending)
+          initPromise = void 0;
       });
       initPromise = pending;
     }
     return initPromise;
   }
-  function encryptBody(plaintext, context) {
-    if (!serverPublicKey || !serverKeyId || !keyPair)
-      return err(HaiCommonError.INTERNAL_ERROR, cryptoM("crypto_transportClientNotInitialized"));
-    return sealTransportPayload(options.crypto, plaintext, context, "request", 0, serverPublicKey, keyPair.privateKey, bodyLimits);
-  }
-  function decryptPayload(payload) {
-    if (!keyPair || !serverPublicKey)
-      return err(HaiCommonError.INTERNAL_ERROR, cryptoM("crypto_transportClientNotInitialized"));
-    return openTransportPayload(options.crypto, payload, keyPair.privateKey, serverPublicKey, bodyLimits);
-  }
-  const encryptedFetch = async (input, init) => {
-    const requestInput = isRequestLike(input) ? input : void 0;
-    const signal = init?.signal ?? requestInput?.signal ?? void 0;
+  async function waitForSession(signal) {
     signal?.throwIfAborted();
-    const targetUrl = typeof input === "string" ? input : input instanceof URL ? input.toString() : requestInput?.url ?? String(input);
-    if (targetUrl === options.keyExchangeUrl)
-      return baseFetch(input, init);
     let onAbort;
-    let ready;
     try {
-      ready = await (signal ? Promise.race([
+      const ready = await (signal ? Promise.race([
         ensureReady(),
         new Promise((_resolve, reject) => {
           onAbort = () => reject(signal.reason);
@@ -1330,24 +1332,36 @@ function createTransportClient(options) {
             onAbort();
         })
       ]) : ensureReady());
+      if (!ready.success)
+        throw new Error(ready.error.message);
+      return ready.data;
     } finally {
       if (onAbort)
         signal?.removeEventListener("abort", onAbort);
     }
-    if (!ready.success)
-      throw new Error(ready.error.message);
+  }
+  const encryptedFetch = async (input, init) => {
+    const requestInput = isRequestLike(input) ? input : void 0;
+    const signal = init?.signal ?? requestInput?.signal ?? void 0;
+    signal?.throwIfAborted();
+    const targetUrl = typeof input === "string" ? input : input instanceof URL ? input.toString() : requestInput?.url ?? String(input);
+    if (targetUrl === options.keyExchangeUrl)
+      return baseFetch(input, init);
+    const requestGeneration = generation;
+    let requestSession = await waitForSession(signal);
+    if (requestGeneration !== generation)
+      throw new Error(cryptoM("crypto_transportClientNotInitialized"));
+    const method = (init?.method ?? requestInput?.method ?? "GET").toUpperCase();
+    const requestBody = init?.body != null ? new Response(init.body).body : method === "GET" || method === "HEAD" ? null : requestInput?.body ?? null;
+    const plaintext = await readTransportBody(requestBody, { maxBytes: requestSession.bodyLimits.plaintextBytes, signal });
+    if (requestGeneration === generation && (requestSession !== session || !isSessionUsable(requestSession)))
+      requestSession = await waitForSession(signal);
+    signal?.throwIfAborted();
+    if (requestGeneration !== generation || !isSessionUsable(requestSession))
+      throw new Error(cryptoM("crypto_transportClientNotInitialized"));
+    const { bodyLimits, clientId, keyPair, serverKeyId, serverPublicKey } = requestSession;
     const headers = new Headers(init?.headers ?? requestInput?.headers);
     headers.set(TRANSPORT_PROTOCOL.CLIENT_ID_HEADER, clientId);
-    let rawBody = init?.body;
-    if (rawBody == null && requestInput) {
-      const method2 = (init?.method ?? requestInput.method).toUpperCase();
-      if (method2 !== "GET" && method2 !== "HEAD") {
-        const text = await readTransportBody(requestInput.body, { maxBytes: bodyLimits.plaintextBytes, signal });
-        if (text)
-          rawBody = text;
-      }
-    }
-    const method = (init?.method ?? requestInput?.method ?? "GET").toUpperCase();
     const base = new URL(options.keyExchangeUrl, globalThis.location?.href ?? "http://localhost");
     const url = new URL(targetUrl, base);
     const pathHash = hashTransportPath(options.crypto, url.pathname + url.search);
@@ -1362,10 +1376,12 @@ function createTransportClient(options) {
       method,
       pathHash: pathHash.data
     };
-    const plaintext = rawBody == null ? "" : await readTransportBody(new Response(rawBody).body, { maxBytes: bodyLimits.plaintextBytes, signal });
-    const encResult = encryptBody(plaintext, context);
-    if (!encResult.success)
+    const encResult = sealTransportPayload(options.crypto, plaintext, context, "request", 0, serverPublicKey, keyPair.privateKey, bodyLimits);
+    if (!encResult.success) {
+      if (encResult.error.cause instanceof TransportBodyTooLargeError)
+        throw encResult.error.cause;
       throw new Error(encResult.error.message);
+    }
     const serialized = JSON.stringify(encResult.data);
     if (new TextEncoder().encode(serialized).byteLength > bodyLimits.encryptedPayloadBytes)
       throw new TransportBodyTooLargeError(bodyLimits.encryptedPayloadBytes, new TextEncoder().encode(serialized).byteLength, { stage: "encrypted" });
@@ -1432,7 +1448,9 @@ function createTransportClient(options) {
     if (!isValidEncryptedPayload(payload, bodyLimits) || payload.direction !== "response" || payload.status !== response.status || !sameTransportContext(payload.context, context)) {
       throw new Error(cryptoM("crypto_transportResponseDecryptFailed"));
     }
-    const decResult = decryptPayload(payload);
+    if (requestGeneration !== generation)
+      throw new Error(cryptoM("crypto_transportClientNotInitialized"));
+    const decResult = openTransportPayload(options.crypto, payload, keyPair.privateKey, serverPublicKey, bodyLimits);
     if (!decResult.success) {
       if (decResult.error.cause instanceof TransportBodyTooLargeError)
         throw decResult.error.cause;
@@ -1448,7 +1466,9 @@ function createTransportClient(options) {
       }
       if (failure?.success === false && failure.error?.code === HaiCryptoError.TRANSPORT_TIME_INVALID.code) {
         const serverTime = failure.error.details?.serverTime;
-        throw new TransportTimeError(void 0, typeof serverTime === "number" ? serverTime : void 0);
+        if (typeof serverTime !== "number")
+          throw new TypeError(cryptoM("crypto_transportTimeResponseInvalid"));
+        throw new TransportTimeError(void 0, serverTime);
       }
     }
     if (response.status === 500) {
@@ -1474,18 +1494,18 @@ function createTransportClient(options) {
     });
   };
   return {
-    init: ensureReady,
+    async init() {
+      const ready = await ensureReady();
+      return ready.success ? ok(void 0) : ready;
+    },
     encryptedFetch,
-    ready: () => clientId !== null && serverPublicKey !== null,
+    ready: () => session !== void 0 && isSessionUsable(session),
     destroy() {
       generation++;
       handshakeController?.abort();
       handshakeController = void 0;
-      keyPair = null;
-      serverPublicKey = null;
-      serverKeyId = null;
-      clientId = null;
-      initPromise = null;
+      session = void 0;
+      initPromise = void 0;
     }
   };
 }
@@ -1500,7 +1520,7 @@ function isKeyExchangeResponse(body) {
   if (!body || typeof body !== "object")
     return false;
   const fields = body;
-  return typeof fields.serverPublicKey === "string" && fields.serverPublicKey.length > 0 && new TextEncoder().encode(fields.serverPublicKey).byteLength <= TRANSPORT_BODY_LIMITS.publicKeyBytes && typeof fields.clientId === "string" && fields.clientId.length > 0 && typeof fields.serverKeyId === "string" && /^[\w-]{1,64}$/.test(fields.serverKeyId);
+  return typeof fields.serverPublicKey === "string" && fields.serverPublicKey.length > 0 && new TextEncoder().encode(fields.serverPublicKey).byteLength <= TRANSPORT_BODY_LIMITS.publicKeyBytes && typeof fields.clientId === "string" && fields.clientId.length > 0 && typeof fields.serverKeyId === "string" && /^[\w-]{1,64}$/.test(fields.serverKeyId) && typeof fields.maxPlaintextBytes === "number" && (fields.clientKeyTtlSeconds === void 0 || isValidTransportKeyTtlSeconds(fields.clientKeyTtlSeconds));
 }
 function parseTransportServerKeyRing(serialized) {
   try {
@@ -1554,6 +1574,9 @@ function createTransportEncryption(cryptoService, options) {
   }
   if (core.module.requiresSharedState(globalThis.process?.env ?? {}) && options.keyStore.stateScope !== "shared")
     return err(HaiCryptoError.INVALID_INPUT, cryptoM("crypto_transportKeyStoreRequired"));
+  const { clientKeyTtlSeconds } = options.keyStore;
+  if (clientKeyTtlSeconds !== void 0 && !isValidTransportKeyTtlSeconds(clientKeyTtlSeconds))
+    return err(HaiCryptoError.INVALID_INPUT, cryptoM("crypto_transportKeyStoreTtlInvalid"));
   const serverKeys = /* @__PURE__ */ new Map();
   for (const [id, key] of Object.entries(ring.data.keys)) {
     const probe = cryptoService.asymmetric.encrypt("hai-transport-key-check", key.publicKey);
@@ -1569,6 +1592,7 @@ function createTransportEncryption(cryptoService, options) {
   const keyStore = options.keyStore;
   const manager = {
     bodyLimits,
+    clientKeyTtlSeconds,
     getServerKeyId() {
       return activeKeyId;
     },
@@ -1886,13 +1910,6 @@ function createInMemoryKeyStore(maxClients = DEFAULT_MAX_CLIENTS) {
 
 // src/transport/store-provider/crypto-transport-store-redis.ts
 var TRANSPORT_KEY_CACHE_PREFIX = "hai:crypto:transport:client";
-function normalizeTtlSeconds(ttlSeconds) {
-  if (ttlSeconds === void 0)
-    return void 0;
-  if (!Number.isSafeInteger(ttlSeconds) || ttlSeconds <= 0 || ttlSeconds > 2147483647)
-    throw new TypeError(cryptoM("crypto_transportKeyStoreTtlInvalid"));
-  return ttlSeconds;
-}
 function createClientId2() {
   if (typeof crypto !== "undefined" && typeof crypto.randomUUID === "function")
     return `c_${crypto.randomUUID()}`;
@@ -1909,11 +1926,14 @@ function unwrapResult(operation, result) {
   throw toOperationError(operation, result.error);
 }
 function createRedisTransportKeyStore(options) {
-  const ttlSeconds = normalizeTtlSeconds(options.ttlSeconds);
+  const { ttlSeconds } = options;
+  if (ttlSeconds !== void 0 && !isValidTransportKeyTtlSeconds(ttlSeconds))
+    throw new TypeError(cryptoM("crypto_transportKeyStoreTtlInvalid"));
   function buildCacheKey(clientId) {
     return `${TRANSPORT_KEY_CACHE_PREFIX}:${clientId}`;
   }
   return {
+    clientKeyTtlSeconds: ttlSeconds,
     get stateScope() {
       return options.cache.config?.type === "redis" ? "shared" : "local";
     },
@@ -1972,7 +1992,7 @@ function unwrapResult2(operation, result) {
 }
 function createReldbTransportKeyStore(options) {
   const { ttlSeconds } = options;
-  if (ttlSeconds !== void 0 && (!Number.isSafeInteger(ttlSeconds) || ttlSeconds <= 0 || ttlSeconds > 2147483647))
+  if (ttlSeconds !== void 0 && !isValidTransportKeyTtlSeconds(ttlSeconds))
     throw new TypeError(cryptoM("crypto_transportKeyStoreTtlInvalid"));
   const maxClients = options.maxClients ?? 1e4;
   if (!Number.isSafeInteger(maxClients) || maxClients <= 0)
@@ -2072,6 +2092,7 @@ function createReldbTransportKeyStore(options) {
     return withCapacityLock(pruneRows);
   }
   return {
+    clientKeyTtlSeconds: ttlSeconds,
     get stateScope() {
       return options.reldb.config?.type && options.reldb.config.type !== "sqlite" ? "shared" : "local";
     },