secure-crypto-top-sdk 0.1.0

package/dist/client.js

@@ -0,0 +1,1436 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/errors/index.ts
+var ErrorMessages, SecureError;
+var init_errors = __esm({
+  "src/errors/index.ts"() {
+    "use strict";
+    ErrorMessages = {
+      [1e3 /* ENCRYPTION_FAILED */]: "\u52A0\u5BC6\u5931\u8D25",
+      [1001 /* DECRYPTION_FAILED */]: "\u89E3\u5BC6\u5931\u8D25",
+      [1002 /* INVALID_AUTH_TAG */]: "\u8BA4\u8BC1\u6807\u7B7E\u65E0\u6548",
+      [1003 /* UNSUPPORTED_CIPHER */]: "\u4E0D\u652F\u6301\u7684\u52A0\u5BC6\u7B97\u6CD5",
+      [1004 /* UNSUPPORTED_DIGEST */]: "\u4E0D\u652F\u6301\u7684\u6458\u8981/\u7B7E\u540D\u7B97\u6CD5",
+      [1005 /* INVALID_KEY_LENGTH */]: "\u5BC6\u94A5\u957F\u5EA6\u65E0\u6548",
+      [1006 /* INVALID_IV_LENGTH */]: "IV \u957F\u5EA6\u65E0\u6548",
+      [1100 /* HMAC_MISMATCH */]: "HMAC \u9A8C\u8BC1\u5931\u8D25",
+      [1101 /* SIGNATURE_MISMATCH */]: "\u7B7E\u540D\u4E0D\u5339\u914D",
+      [1102 /* TIMESTAMP_EXPIRED */]: "\u8BF7\u6C42\u5DF2\u8FC7\u671F",
+      [1103 /* NONCE_REUSED */]: "\u8BF7\u6C42\u5DF2\u88AB\u5904\u7406\uFF0C\u8BF7\u52FF\u91CD\u653E",
+      [1104 /* INVALID_TIMESTAMP */]: "\u65E0\u6548\u7684\u65F6\u95F4\u6233",
+      [1105 /* SIGN_METHOD_NOT_ALLOWED */]: "\u8BE5\u7B7E\u540D\u65B9\u6CD5\u672A\u88AB\u8BE5 app \u5141\u8BB8",
+      [1200 /* APP_NOT_FOUND */]: "\u672A\u627E\u5230\u5BF9\u5E94\u7684 app \u914D\u7F6E",
+      [1201 /* APP_DISABLED */]: "\u8BE5 app \u5DF2\u88AB\u7981\u7528",
+      [1202 /* PROTOCOL_NOT_FOUND */]: "\u672A\u6CE8\u518C\u5BF9\u5E94\u534F\u8BAE",
+      [1203 /* MISSING_APP_KEY */]: "\u7F3A\u5C11 app_key \u53C2\u6570",
+      [1204 /* MISSING_METHOD */]: "\u7F3A\u5C11 method \u53C2\u6570",
+      [1300 /* VALIDATION_ERROR */]: "\u6570\u636E\u6821\u9A8C\u5931\u8D25",
+      [1301 /* INVALID_REQUEST */]: "\u8BF7\u6C42\u683C\u5F0F\u9519\u8BEF",
+      [1302 /* INVALID_PAYLOAD */]: "\u8BF7\u6C42\u8F7D\u8377\u65E0\u6548"
+    };
+    SecureError = class extends Error {
+      constructor(code, details, statusCode) {
+        super(typeof details === "string" ? details : ErrorMessages[code]);
+        this.name = "SecureError";
+        this.code = code;
+        this.statusCode = statusCode || this.getDefaultStatusCode(code);
+        this.details = details;
+        Error.captureStackTrace(this, this.constructor);
+      }
+      getDefaultStatusCode(code) {
+        if (code >= 1e3 && code < 1100) return 400;
+        if (code >= 1100 && code < 1200) return 401;
+        if (code >= 1200 && code < 1300) return 403;
+        if (code >= 1300 && code < 1400) return 400;
+        return 500;
+      }
+      toJSON() {
+        return { success: false, code: this.code, message: this.message, details: this.details };
+      }
+    };
+  }
+});
+
+// src/algorithms/cipher/aes-gcm.ts
+var nodeCrypto, META, aesGcm;
+var init_aes_gcm = __esm({
+  "src/algorithms/cipher/aes-gcm.ts"() {
+    "use strict";
+    nodeCrypto = __toESM(require("crypto"));
+    init_errors();
+    META = {
+      name: "aes-256-gcm",
+      keyLength: 32,
+      ivLength: 12,
+      hasAuthTag: true,
+      blockSize: 16
+    };
+    aesGcm = {
+      name: "aes-256-gcm",
+      meta: META,
+      generateKey() {
+        return nodeCrypto.randomBytes(META.keyLength);
+      },
+      generateIv() {
+        return nodeCrypto.randomBytes(META.ivLength);
+      },
+      encrypt(plain, params = {}) {
+        if (!params.key) {
+          throw new SecureError(1005 /* INVALID_KEY_LENGTH */, "AES-256-GCM \u9700\u8981\u4F20\u5165 32 \u5B57\u8282\u5BF9\u79F0\u5BC6\u94A5");
+        }
+        const key = params.key;
+        if (key.length !== META.keyLength) {
+          throw new SecureError(1005 /* INVALID_KEY_LENGTH */, `AES-256 \u5BC6\u94A5\u9700 ${META.keyLength} \u5B57\u8282`);
+        }
+        const iv = params.rsaPublicKeyPem ? nodeCrypto.randomBytes(META.ivLength) : params.iv ?? this.generateIv();
+        const cipher = nodeCrypto.createCipheriv("aes-256-gcm", key, iv, { authTagLength: 16 });
+        const enc = Buffer.concat([cipher.update(plain), cipher.final()]);
+        return { data: enc, iv, tag: cipher.getAuthTag() };
+      },
+      decrypt(cipherBuf, params) {
+        if (!params.key) throw new SecureError(1005 /* INVALID_KEY_LENGTH */, "AES-256-GCM \u9700\u8981\u5BC6\u94A5");
+        if (!params.tag) throw new SecureError(1002 /* INVALID_AUTH_TAG */, "AES-256-GCM \u9700\u8981 authTag");
+        const decipher = nodeCrypto.createDecipheriv("aes-256-gcm", params.key, params.iv, { authTagLength: 16 });
+        decipher.setAuthTag(params.tag);
+        try {
+          return Buffer.concat([decipher.update(cipherBuf), decipher.final()]);
+        } catch {
+          throw new SecureError(1002 /* INVALID_AUTH_TAG */, "AES-GCM authTag \u6821\u9A8C\u5931\u8D25,\u6570\u636E\u53EF\u80FD\u5DF2\u88AB\u7BE1\u6539");
+        }
+      }
+    };
+  }
+});
+
+// src/algorithms/cipher/aes-cbc.ts
+function pkcs7Pad(data, blockSize) {
+  const pad = blockSize - data.length % blockSize;
+  return Buffer.concat([data, Buffer.alloc(pad, pad)]);
+}
+function pkcs7Unpad(data) {
+  if (data.length === 0) return data;
+  const pad = data[data.length - 1];
+  if (pad < 1 || pad > data.length) {
+    throw new SecureError(1001 /* DECRYPTION_FAILED */, "PKCS#7 padding \u65E0\u6548");
+  }
+  return data.subarray(0, data.length - pad);
+}
+function makeAesCbc(meta, openSslName) {
+  return {
+    name: meta.name,
+    meta,
+    generateKey() {
+      return nodeCrypto2.randomBytes(meta.keyLength);
+    },
+    generateIv() {
+      return nodeCrypto2.randomBytes(meta.ivLength);
+    },
+    encrypt(plain, params = {}) {
+      if (!params.key || params.key.length !== meta.keyLength) {
+        throw new SecureError(1005 /* INVALID_KEY_LENGTH */, `${meta.name} \u5BC6\u94A5\u9700 ${meta.keyLength} \u5B57\u8282`);
+      }
+      const iv = nodeCrypto2.randomBytes(meta.ivLength);
+      const cipher = nodeCrypto2.createCipheriv(openSslName, params.key, iv);
+      cipher.setAutoPadding(false);
+      const padded = pkcs7Pad(plain, meta.blockSize);
+      const enc = Buffer.concat([cipher.update(padded), cipher.final()]);
+      return { data: enc, iv };
+    },
+    decrypt(cipherBuf, params) {
+      if (!params.key || params.key.length !== meta.keyLength) {
+        throw new SecureError(1005 /* INVALID_KEY_LENGTH */, `${meta.name} \u5BC6\u94A5\u9700 ${meta.keyLength} \u5B57\u8282`);
+      }
+      const decipher = nodeCrypto2.createDecipheriv(openSslName, params.key, params.iv);
+      decipher.setAutoPadding(false);
+      const dec = Buffer.concat([decipher.update(cipherBuf), decipher.final()]);
+      return pkcs7Unpad(dec);
+    }
+  };
+}
+var nodeCrypto2, META_256, META_128, aesCbc256, aesCbc128;
+var init_aes_cbc = __esm({
+  "src/algorithms/cipher/aes-cbc.ts"() {
+    "use strict";
+    nodeCrypto2 = __toESM(require("crypto"));
+    init_errors();
+    META_256 = {
+      name: "aes-256-cbc",
+      keyLength: 32,
+      ivLength: 16,
+      hasAuthTag: false,
+      blockSize: 16
+    };
+    META_128 = {
+      name: "aes-128-cbc",
+      keyLength: 16,
+      ivLength: 16,
+      hasAuthTag: false,
+      blockSize: 16
+    };
+    aesCbc256 = makeAesCbc(META_256, "aes-256-cbc");
+    aesCbc128 = makeAesCbc(META_128, "aes-128-cbc");
+  }
+});
+
+// src/algorithms/cipher/sm4-cbc.ts
+function rotl(x, n) {
+  return (x << n | x >>> 32 - n) >>> 0;
+}
+function bytesToU32(b, off) {
+  return (b[off] << 24 | b[off + 1] << 16 | b[off + 2] << 8 | b[off + 3]) >>> 0;
+}
+function u32ToBytes(x, b, off) {
+  b[off] = x >>> 24 & 255;
+  b[off + 1] = x >>> 16 & 255;
+  b[off + 2] = x >>> 8 & 255;
+  b[off + 3] = x & 255;
+}
+function tau(a) {
+  return SBOX[a >>> 24 & 255] << 24 | SBOX[a >>> 16 & 255] << 16 | SBOX[a >>> 8 & 255] << 8 | SBOX[a & 255];
+}
+function L(b) {
+  return b ^ rotl(b, 2) ^ rotl(b, 10) ^ rotl(b, 18) ^ rotl(b, 24);
+}
+function Lp(b) {
+  return b ^ rotl(b, 13) ^ rotl(b, 23);
+}
+function T(x) {
+  return L(tau(x));
+}
+function Tp(x) {
+  return Lp(tau(x));
+}
+function expandKey(key) {
+  const MK = new Array(4);
+  for (let i = 0; i < 4; i++) MK[i] = bytesToU32(key, i * 4);
+  const rk = new Array(32);
+  for (let i = 0; i < 32; i++) {
+    const k1 = MK[i] ^ CK[i];
+    rk[i] = k1 ^ Tp(k1 ^ MK[(i + 1) % 4] ^ MK[(i + 2) % 4] ^ MK[(i + 3) % 4]);
+  }
+  return rk;
+}
+function cryptBlock(input, off, rk) {
+  const X = new Array(36);
+  for (let i = 0; i < 4; i++) X[i] = bytesToU32(input, off + i * 4);
+  for (let i = 0; i < 32; i++) {
+    X[i + 4] = X[i] ^ T(X[i + 1] ^ X[i + 2] ^ X[i + 3] ^ rk[i]);
+  }
+  return [X[35], X[34], X[33], X[32]];
+}
+function pkcs7Pad2(data, blockSize) {
+  const pad = blockSize - data.length % blockSize;
+  return Buffer.concat([data, Buffer.alloc(pad, pad)]);
+}
+function pkcs7Unpad2(data) {
+  if (data.length === 0) return data;
+  const pad = data[data.length - 1];
+  if (pad < 1 || pad > data.length) throw new SecureError(1001 /* DECRYPTION_FAILED */, "PKCS#7 padding \u65E0\u6548");
+  return data.subarray(0, data.length - pad);
+}
+function xorBlock(a, b) {
+  const out = Buffer.alloc(a.length);
+  for (let i = 0; i < a.length; i++) out[i] = a[i] ^ b[i];
+  return out;
+}
+var nodeCrypto3, META2, SBOX, CK, sm4Cbc;
+var init_sm4_cbc = __esm({
+  "src/algorithms/cipher/sm4-cbc.ts"() {
+    "use strict";
+    nodeCrypto3 = __toESM(require("crypto"));
+    init_errors();
+    META2 = {
+      name: "sm4-cbc",
+      keyLength: 16,
+      ivLength: 16,
+      hasAuthTag: false,
+      blockSize: 16
+    };
+    SBOX = [
+      214,
+      144,
+      233,
+      254,
+      204,
+      225,
+      61,
+      183,
+      22,
+      182,
+      20,
+      194,
+      40,
+      251,
+      44,
+      5,
+      43,
+      103,
+      154,
+      118,
+      42,
+      190,
+      4,
+      195,
+      170,
+      68,
+      19,
+      38,
+      73,
+      134,
+      6,
+      153,
+      156,
+      66,
+      80,
+      244,
+      145,
+      239,
+      152,
+      122,
+      51,
+      84,
+      11,
+      67,
+      237,
+      207,
+      172,
+      98,
+      228,
+      179,
+      28,
+      169,
+      201,
+      8,
+      232,
+      149,
+      128,
+      223,
+      148,
+      250,
+      117,
+      143,
+      63,
+      166,
+      71,
+      7,
+      167,
+      252,
+      243,
+      115,
+      23,
+      186,
+      131,
+      89,
+      60,
+      25,
+      230,
+      133,
+      79,
+      168,
+      104,
+      107,
+      129,
+      178,
+      113,
+      100,
+      218,
+      139,
+      248,
+      235,
+      15,
+      75,
+      112,
+      86,
+      157,
+      53,
+      30,
+      36,
+      14,
+      94,
+      99,
+      88,
+      209,
+      162,
+      37,
+      34,
+      124,
+      59,
+      1,
+      33,
+      120,
+      135,
+      212,
+      0,
+      70,
+      87,
+      159,
+      211,
+      39,
+      82,
+      76,
+      54,
+      2,
+      231,
+      160,
+      196,
+      200,
+      158,
+      234,
+      191,
+      138,
+      210,
+      64,
+      199,
+      56,
+      181,
+      163,
+      247,
+      242,
+      206,
+      249,
+      97,
+      21,
+      161,
+      224,
+      174,
+      93,
+      164,
+      155,
+      52,
+      26,
+      85,
+      173,
+      147,
+      50,
+      48,
+      245,
+      140,
+      177,
+      227,
+      29,
+      246,
+      226,
+      46,
+      130,
+      102,
+      202,
+      96,
+      192,
+      41,
+      35,
+      171,
+      13,
+      83,
+      78,
+      111,
+      213,
+      219,
+      55,
+      69,
+      222,
+      253,
+      142,
+      47,
+      3,
+      255,
+      106,
+      114,
+      109,
+      108,
+      91,
+      81,
+      141,
+      27,
+      175,
+      146,
+      187,
+      221,
+      188,
+      127,
+      17,
+      217,
+      92,
+      65,
+      31,
+      16,
+      90,
+      216,
+      10,
+      193,
+      49,
+      136,
+      165,
+      205,
+      123,
+      189,
+      45,
+      116,
+      208,
+      18,
+      184,
+      229,
+      180,
+      176,
+      137,
+      105,
+      151,
+      74,
+      12,
+      150,
+      119,
+      126,
+      101,
+      185,
+      241,
+      9,
+      197,
+      110,
+      198,
+      132,
+      24,
+      240,
+      125,
+      236,
+      58,
+      220,
+      77,
+      32,
+      121,
+      238,
+      95,
+      62,
+      215,
+      203,
+      57,
+      72
+    ];
+    CK = [
+      462357,
+      472066609,
+      943670861,
+      1415275113,
+      1886879365,
+      2358483617,
+      2830087869,
+      3301692121,
+      3773296373,
+      4228057617,
+      404694573,
+      876298825,
+      1347903077,
+      1819507329,
+      2291111581,
+      2762715833,
+      3234320085,
+      3705924337,
+      4177462797,
+      337322537,
+      808926789,
+      1280531041,
+      1752135293,
+      2223739545,
+      2695343797,
+      3166948049,
+      3638552301,
+      4110090761,
+      269950501,
+      741554753,
+      1213159005,
+      1684763257
+    ];
+    sm4Cbc = {
+      name: "sm4-cbc",
+      meta: META2,
+      generateKey() {
+        return nodeCrypto3.randomBytes(META2.keyLength);
+      },
+      generateIv() {
+        return nodeCrypto3.randomBytes(META2.ivLength);
+      },
+      encrypt(plain, params = {}) {
+        if (!params.key || params.key.length !== 16) {
+          throw new SecureError(1005 /* INVALID_KEY_LENGTH */, "SM4 \u5BC6\u94A5\u9700 16 \u5B57\u8282");
+        }
+        const rk = expandKey(params.key);
+        const iv = nodeCrypto3.randomBytes(META2.ivLength);
+        const padded = pkcs7Pad2(plain, META2.blockSize);
+        const out = Buffer.alloc(padded.length);
+        let prev = iv;
+        for (let off = 0; off < padded.length; off += 16) {
+          const block = xorBlock(padded.subarray(off, off + 16), prev);
+          const r = cryptBlock(block, 0, rk);
+          const enc = Buffer.alloc(16);
+          for (let i = 0; i < 4; i++) u32ToBytes(r[i], enc, i * 4);
+          out.set(enc, off);
+          prev = enc;
+        }
+        return { data: out, iv };
+      },
+      decrypt(cipherBuf, params) {
+        if (!params.key || params.key.length !== 16) {
+          throw new SecureError(1005 /* INVALID_KEY_LENGTH */, "SM4 \u5BC6\u94A5\u9700 16 \u5B57\u8282");
+        }
+        if (params.iv.length !== 16) {
+          throw new SecureError(1006 /* INVALID_IV_LENGTH */, "SM4 IV \u9700 16 \u5B57\u8282");
+        }
+        const rk = expandKey(params.key).slice().reverse();
+        const out = Buffer.alloc(cipherBuf.length);
+        let prev = params.iv;
+        for (let off = 0; off < cipherBuf.length; off += 16) {
+          const enc = cipherBuf.subarray(off, off + 16);
+          const r = cryptBlock(enc, 0, rk);
+          const dec = Buffer.alloc(16);
+          for (let i = 0; i < 4; i++) u32ToBytes(r[i], dec, i * 4);
+          const plain = xorBlock(dec, prev);
+          out.set(plain, off);
+          prev = enc;
+        }
+        return pkcs7Unpad2(out);
+      }
+    };
+  }
+});
+
+// src/algorithms/cipher/rsa-oaep-aes-gcm.ts
+var nodeCrypto4, META3, rsaOaepAesGcm;
+var init_rsa_oaep_aes_gcm = __esm({
+  "src/algorithms/cipher/rsa-oaep-aes-gcm.ts"() {
+    "use strict";
+    nodeCrypto4 = __toESM(require("crypto"));
+    init_errors();
+    init_aes_gcm();
+    META3 = {
+      name: "rsa-oaep-aes-256-gcm",
+      keyLength: 32,
+      // 对称密钥长度
+      ivLength: 12,
+      // GCM IV 长度
+      hasAuthTag: true,
+      blockSize: 16
+    };
+    rsaOaepAesGcm = {
+      name: "rsa-oaep-aes-256-gcm",
+      meta: META3,
+      generateKey() {
+        return nodeCrypto4.randomBytes(META3.keyLength);
+      },
+      generateIv() {
+        return nodeCrypto4.randomBytes(META3.ivLength);
+      },
+      encrypt(plain, params = {}) {
+        if (!params.rsaPublicKeyPem) {
+          throw new SecureError(1e3 /* ENCRYPTION_FAILED */, "rsa-oaep-aes-256-gcm \u9700\u8981 rsaPublicKeyPem");
+        }
+        const aesKey = nodeCrypto4.randomBytes(32);
+        const iv = nodeCrypto4.randomBytes(12);
+        const r = aesGcm.encrypt(plain, { key: aesKey, iv });
+        const encryptedKey = nodeCrypto4.publicEncrypt(
+          { key: params.rsaPublicKeyPem, padding: nodeCrypto4.constants.RSA_PKCS1_OAEP_PADDING, oaepHash: "sha256" },
+          aesKey
+        );
+        return { data: r.data, iv: r.iv, tag: r.tag, encryptedKey };
+      },
+      decrypt(cipherBuf, params) {
+        if (!params.rsaPrivateKeyPem) {
+          throw new SecureError(1001 /* DECRYPTION_FAILED */, "rsa-oaep-aes-256-gcm \u9700\u8981 rsaPrivateKeyPem");
+        }
+        if (!params.encryptedKey) {
+          throw new SecureError(1001 /* DECRYPTION_FAILED */, "\u7F3A\u5C11 encryptedKey");
+        }
+        const aesKey = nodeCrypto4.privateDecrypt(
+          { key: params.rsaPrivateKeyPem, padding: nodeCrypto4.constants.RSA_PKCS1_OAEP_PADDING, oaepHash: "sha256" },
+          params.encryptedKey
+        );
+        return aesGcm.decrypt(cipherBuf, { key: aesKey, iv: params.iv, tag: params.tag });
+      }
+    };
+  }
+});
+
+// src/algorithms/cipher/index.ts
+var init_cipher = __esm({
+  "src/algorithms/cipher/index.ts"() {
+    "use strict";
+    init_aes_gcm();
+    init_aes_cbc();
+    init_sm4_cbc();
+    init_rsa_oaep_aes_gcm();
+  }
+});
+
+// src/algorithms/digest/hmac.ts
+function makeHmac(meta, algo) {
+  return {
+    name: meta.name,
+    meta,
+    sign(data, key) {
+      if (!key) throw new SecureError(1005 /* INVALID_KEY_LENGTH */, `${meta.name} \u9700\u8981\u5BC6\u94A5`);
+      const keyBuf = typeof key === "string" ? Buffer.from(key, "utf-8") : key;
+      if (keyBuf.length < meta.minKeyLength) {
+        throw new SecureError(1005 /* INVALID_KEY_LENGTH */, `${meta.name} \u5BC6\u94A5\u81F3\u5C11 ${meta.minKeyLength} \u5B57\u8282`);
+      }
+      const dataBuf = typeof data === "string" ? Buffer.from(data, "utf-8") : data;
+      return nodeCrypto5.createHmac(algo, keyBuf).update(dataBuf).digest("hex");
+    },
+    verify(sig, data, key) {
+      const expected = this.sign(data, key);
+      try {
+        return nodeCrypto5.timingSafeEqual(Buffer.from(sig, "hex"), Buffer.from(expected, "hex"));
+      } catch {
+        return false;
+      }
+    }
+  };
+}
+var nodeCrypto5, META_2562, META_512, hmacSha256, hmacSha512;
+var init_hmac = __esm({
+  "src/algorithms/digest/hmac.ts"() {
+    "use strict";
+    nodeCrypto5 = __toESM(require("crypto"));
+    init_errors();
+    META_2562 = {
+      name: "hmac-sha256",
+      outputLength: 32,
+      keyed: true,
+      minKeyLength: 16
+    };
+    META_512 = {
+      name: "hmac-sha512",
+      outputLength: 64,
+      keyed: true,
+      minKeyLength: 16
+    };
+    hmacSha256 = makeHmac(META_2562, "sha256");
+    hmacSha512 = makeHmac(META_512, "sha512");
+  }
+});
+
+// src/algorithms/digest/hash.ts
+function makeHash(meta, algo) {
+  return {
+    name: meta.name,
+    meta,
+    sign(data) {
+      const dataBuf = typeof data === "string" ? Buffer.from(data, "utf-8") : data;
+      return nodeCrypto6.createHash(algo).update(dataBuf).digest("hex");
+    },
+    // 非密钥散列的"verify"是直接比较
+    verify(sig, data) {
+      try {
+        return this.sign(data) === sig.toLowerCase();
+      } catch {
+        return false;
+      }
+    }
+  };
+}
+var nodeCrypto6, META_MD5, META_SHA256, md5, sha256;
+var init_hash = __esm({
+  "src/algorithms/digest/hash.ts"() {
+    "use strict";
+    nodeCrypto6 = __toESM(require("crypto"));
+    META_MD5 = {
+      name: "md5",
+      outputLength: 16,
+      keyed: false,
+      minKeyLength: 0
+    };
+    META_SHA256 = {
+      name: "sha256",
+      outputLength: 32,
+      keyed: false,
+      minKeyLength: 0
+    };
+    md5 = makeHash(META_MD5, "md5");
+    sha256 = makeHash(META_SHA256, "sha256");
+  }
+});
+
+// src/algorithms/digest/sm3.ts
+function rotl2(x, n) {
+  return (x << n | x >>> 32 - n) >>> 0;
+}
+function P0(x) {
+  return x ^ rotl2(x, 9) ^ rotl2(x, 17);
+}
+function P1(x) {
+  return x ^ rotl2(x, 15) ^ rotl2(x, 23);
+}
+function FF(x, y, z, j) {
+  return j < 16 ? x ^ y ^ z : x & y | x & z | y & z;
+}
+function GG(x, y, z, j) {
+  return j < 16 ? x ^ y ^ z : x & y | (~x & z) >>> 0;
+}
+function Tj(j) {
+  return j < 16 ? 2043430169 : 2055708042;
+}
+function CF(V, B) {
+  const W = new Uint32Array(68);
+  const W1 = new Uint32Array(64);
+  for (let i = 0; i < 16; i++) W[i] = B[i];
+  for (let i = 16; i < 68; i++) {
+    W[i] = P1(W[i - 16] ^ W[i - 9] ^ rotl2(W[i - 3], 15)) ^ rotl2(W[i - 13], 7) ^ W[i - 6];
+  }
+  for (let i = 0; i < 64; i++) W1[i] = W[i] ^ W[i + 4];
+  let A = V[0], Bb = V[1], C = V[2], D = V[3];
+  let E = V[4], F = V[5], G = V[6], H = V[7];
+  for (let j = 0; j < 64; j++) {
+    const SS1 = rotl2(rotl2(A, 12) + E + rotl2(Tj(j), j), 7);
+    const SS2 = SS1 ^ rotl2(A, 12);
+    const TT1 = FF(A, Bb, C, j) + D + SS2 + W1[j] >>> 0;
+    const TT2 = GG(E, F, G, j) + H + SS1 + W[j] >>> 0;
+    D = C;
+    C = rotl2(Bb, 9);
+    Bb = A;
+    A = TT1;
+    H = G;
+    G = rotl2(F, 19);
+    F = E;
+    E = P0(TT2);
+  }
+  return new Uint32Array([
+    V[0] ^ A,
+    V[1] ^ Bb,
+    V[2] ^ C,
+    V[3] ^ D,
+    V[4] ^ E,
+    V[5] ^ F,
+    V[6] ^ G,
+    V[7] ^ H
+  ]);
+}
+function sm3Hash(data) {
+  const bitLen = BigInt(data.length) * 8n;
+  const padLen = (56 - (data.length + 1) % 64 + 64) % 64;
+  const padded = Buffer.alloc(data.length + 1 + padLen + 8);
+  data.copy(padded, 0);
+  padded[data.length] = 128;
+  for (let i = 0; i < 8; i++) {
+    padded[padded.length - 1 - i] = Number(bitLen >> BigInt(i * 8) & 0xffn);
+  }
+  const V = new Uint32Array(IV);
+  for (let off = 0; off < padded.length; off += 64) {
+    const B = new Uint32Array(16);
+    for (let i = 0; i < 16; i++) {
+      B[i] = padded.readUInt32BE(off + i * 4);
+    }
+    const Vn = CF(V, B);
+    for (let i = 0; i < 8; i++) V[i] = Vn[i];
+  }
+  const out = Buffer.alloc(32);
+  for (let i = 0; i < 8; i++) V[i] = V[i] >>> 0, out.writeUInt32BE(V[i], i * 4);
+  return out;
+}
+var META4, IV, sm3;
+var init_sm3 = __esm({
+  "src/algorithms/digest/sm3.ts"() {
+    "use strict";
+    META4 = {
+      name: "sm3",
+      outputLength: 32,
+      keyed: false,
+      minKeyLength: 0
+    };
+    IV = new Uint32Array([
+      1937774191,
+      1226093241,
+      388252375,
+      3666478592,
+      2842636476,
+      372324522,
+      3817729613,
+      2969243214
+    ]);
+    sm3 = {
+      name: "sm3",
+      meta: META4,
+      sign(data) {
+        const buf = typeof data === "string" ? Buffer.from(data, "utf-8") : data;
+        return sm3Hash(buf).toString("hex");
+      },
+      verify(sig, data) {
+        try {
+          return this.sign(data) === sig.toLowerCase();
+        } catch {
+          return false;
+        }
+      }
+    };
+  }
+});
+
+// src/algorithms/digest/index.ts
+var init_digest = __esm({
+  "src/algorithms/digest/index.ts"() {
+    "use strict";
+    init_hmac();
+    init_hash();
+    init_sm3();
+  }
+});
+
+// src/algorithms/registry.ts
+var registry_exports = {};
+__export(registry_exports, {
+  cipherRegistry: () => cipherRegistry,
+  digestRegistry: () => digestRegistry,
+  getCipher: () => getCipher,
+  getDigest: () => getDigest,
+  parseKeyHex: () => parseKeyHex,
+  parseSecret: () => parseSecret
+});
+function getCipher(name) {
+  const c = cipherRegistry.get(name);
+  if (!c) {
+    throw new SecureError(1003 /* UNSUPPORTED_CIPHER */, `Unsupported cipher: ${name}`);
+  }
+  return c;
+}
+function getDigest(name) {
+  const d = digestRegistry.get(name);
+  if (!d) {
+    throw new SecureError(1004 /* UNSUPPORTED_DIGEST */, `Unsupported digest: ${name}`);
+  }
+  return d;
+}
+function parseKeyHex(hex, expectedLength = 32) {
+  if (!hex || hex.length !== expectedLength * 2) {
+    throw new SecureError(
+      1005 /* INVALID_KEY_LENGTH */,
+      `Key hex \u957F\u5EA6\u9700\u4E3A ${expectedLength * 2} \u5B57\u7B26(\u5BF9\u5E94 ${expectedLength} \u5B57\u8282)`
+    );
+  }
+  return Buffer.from(hex, "hex");
+}
+function parseSecret(secret, minLength = 32) {
+  if (!secret || secret.length < minLength) {
+    throw new SecureError(
+      1005 /* INVALID_KEY_LENGTH */,
+      `Secret \u957F\u5EA6\u9700\u81F3\u5C11 ${minLength} \u5B57\u7B26`
+    );
+  }
+  return Buffer.from(secret, "utf-8");
+}
+var cipherRegistry, digestRegistry;
+var init_registry = __esm({
+  "src/algorithms/registry.ts"() {
+    "use strict";
+    init_errors();
+    init_cipher();
+    init_digest();
+    cipherRegistry = /* @__PURE__ */ new Map([
+      ["aes-256-gcm", aesGcm],
+      ["aes-256-cbc", aesCbc256],
+      ["aes-128-cbc", aesCbc128],
+      ["sm4-cbc", sm4Cbc],
+      ["rsa-oaep-aes-256-gcm", rsaOaepAesGcm]
+    ]);
+    digestRegistry = /* @__PURE__ */ new Map([
+      ["hmac-sha256", hmacSha256],
+      ["hmac-sha512", hmacSha512],
+      ["md5", md5],
+      ["sha256", sha256],
+      ["sm3", sm3]
+    ]);
+  }
+});
+
+// src/client/index.ts
+var client_exports = {};
+__export(client_exports, {
+  SecureClient: () => SecureClient
+});
+module.exports = __toCommonJS(client_exports);
+
+// src/client/SecureClient.ts
+init_registry();
+
+// src/protocol/registry.ts
+init_errors();
+
+// src/protocol/custom/strategy.ts
+var nodeCrypto7 = __toESM(require("crypto"));
+init_registry();
+init_errors();
+var PROTOCOL = "custom";
+var customProtocol = {
+  kind: PROTOCOL,
+  async buildRequest(input, ctx) {
+    const cipherName = input.cipher || "aes-256-gcm";
+    const cipher = getCipher(cipherName);
+    const digest = getDigest(input.digest || "hmac-sha256");
+    const payload = JSON.stringify({
+      path: input.path,
+      method: input.method,
+      body: input.body,
+      query: input.query
+    });
+    const r = cipher.encrypt(Buffer.from(payload, "utf-8"), { key: ctx.encryptionKey });
+    const timestamp = Date.now();
+    const nonce = nodeCrypto7.randomUUID();
+    const signData = `${timestamp}.${nonce}.${r.data.toString("base64")}.${r.iv.toString("base64")}.${(r.tag ?? Buffer.alloc(0)).toString("base64")}`;
+    const signature = digest.sign(signData, ctx.hmacSecret);
+    const envelope = {
+      protocol: PROTOCOL,
+      app_key: ctx.appKey,
+      cipher: cipherName,
+      encryptedPayload: r.data.toString("base64"),
+      iv: r.iv.toString("base64"),
+      timestamp,
+      nonce,
+      signature
+    };
+    if (r.tag) envelope.authTag = r.tag.toString("base64");
+    if (r.encryptedKey) envelope.encryptedKey = r.encryptedKey.toString("base64");
+    return envelope;
+  },
+  async parseAndVerify(raw, ctx) {
+    const encryptedPayload = raw.encryptedPayload;
+    const iv = raw.iv;
+    const authTag = raw.authTag;
+    const signature = raw.signature;
+    const timestamp = raw.timestamp;
+    const nonce = raw.nonce;
+    const encryptedKey = raw.encryptedKey;
+    const cipherName = raw.cipher || "aes-256-gcm";
+    if (!encryptedPayload || !iv || !signature || !timestamp || !nonce) {
+      throw new SecureError(1301 /* INVALID_REQUEST */, "Custom \u534F\u8BAE\u5B57\u6BB5\u7F3A\u5931");
+    }
+    validateTimestamp(timestamp, ctx.requestWindowMs);
+    await checkNonce(ctx.nonceStore, nonce, ctx.requestWindowMs);
+    const digest = getDigest("hmac-sha256");
+    const signData = `${timestamp}.${nonce}.${encryptedPayload}.${iv}.${authTag ?? ""}`;
+    if (!digest.verify(signature, signData, ctx.app.appSecret)) {
+      throw new SecureError(1101 /* SIGNATURE_MISMATCH */, "Custom \u534F\u8BAE\u7B7E\u540D\u9A8C\u8BC1\u5931\u8D25");
+    }
+    const cipher = getCipher(cipherName);
+    const plain = cipher.decrypt(Buffer.from(encryptedPayload, "base64"), {
+      key: ctx.encryptionKey,
+      iv: Buffer.from(iv, "base64"),
+      tag: authTag ? Buffer.from(authTag, "base64") : void 0
+    });
+    const json = JSON.parse(plain.toString("utf-8"));
+    return {
+      appKey: ctx.app.appKey,
+      method: json.method,
+      path: json.path,
+      body: json.body,
+      query: json.query,
+      biz: json
+    };
+  },
+  async buildResponse(biz, ctx) {
+    const cipher = getCipher("aes-256-gcm");
+    const digest = getDigest("hmac-sha256");
+    const r = cipher.encrypt(Buffer.from(JSON.stringify(biz), "utf-8"), { key: ctx.encryptionKey });
+    const timestamp = Date.now();
+    const nonce = ctx.nonce || nodeCrypto7.randomUUID();
+    const signData = `${timestamp}.${nonce}.${r.data.toString("base64")}.${r.iv.toString("base64")}.${(r.tag ?? Buffer.alloc(0)).toString("base64")}`;
+    const signature = digest.sign(signData, ctx.app.appSecret);
+    return {
+      protocol: PROTOCOL,
+      encryptedPayload: r.data.toString("base64"),
+      iv: r.iv.toString("base64"),
+      authTag: r.tag?.toString("base64"),
+      signature,
+      timestamp,
+      nonce
+    };
+  }
+};
+function validateTimestamp(ts, windowMs) {
+  const now = Date.now();
+  if (ts > now + 5e3) throw new SecureError(1104 /* INVALID_TIMESTAMP */, "\u65F6\u95F4\u6233\u6765\u81EA\u672A\u6765");
+  if (now - ts > windowMs) throw new SecureError(1102 /* TIMESTAMP_EXPIRED */, "\u8BF7\u6C42\u5DF2\u8FC7\u671F");
+}
+async function checkNonce(store, nonce, windowMs) {
+  if (!store) return;
+  const ttl = Math.ceil(windowMs * 2 / 1e3);
+  const r = await store.set(`nonce:${nonce}`, "1", "EX", ttl, "NX");
+  if (r === null) throw new SecureError(1103 /* NONCE_REUSED */, "nonce \u5DF2\u88AB\u4F7F\u7528");
+}
+
+// src/protocol/top/strategy.ts
+init_registry();
+init_errors();
+
+// src/protocol/top/signer.ts
+var SYSTEM_PARAMS = /* @__PURE__ */ new Set([
+  "protocol",
+  "method",
+  "app_key",
+  "session",
+  "timestamp",
+  "v",
+  "sign_method",
+  "sign",
+  "format",
+  "simplify",
+  "target_app_key",
+  "session_auth_token",
+  "cipher",
+  "digest",
+  "biz_content",
+  // TOP 把整个业务内容 base64 后放在这个字段
+  "encrypted_key"
+  // 混合加密场景
+]);
+function buildSortedParams(input, includeSystem = false) {
+  const filtered = {};
+  for (const [k, v] of Object.entries(input)) {
+    if (v === void 0 || v === null) continue;
+    if (!includeSystem && SYSTEM_PARAMS.has(k)) continue;
+    filtered[k] = v;
+  }
+  const keys = Object.keys(filtered).sort();
+  return keys.map((k) => k + stringifyVal(filtered[k])).join("");
+}
+function stringifyVal(v) {
+  if (v === null || v === void 0) return "";
+  if (typeof v === "object") return JSON.stringify(v);
+  return String(v);
+}
+function signTop(opts) {
+  const bizStr = buildSortedParams(opts.params, false);
+  const source = bizStr + opts.appSecret + (opts.cipherText ?? "");
+  return opts.digest.sign(source, opts.appSecret);
+}
+function verifyTop(opts) {
+  return opts.digest.verify(opts.signature, (() => {
+    const bizStr = buildSortedParams(opts.params, false);
+    return bizStr + opts.appSecret + (opts.cipherText ?? "");
+  })(), opts.appSecret);
+}
+
+// src/protocol/top/strategy.ts
+var PROTOCOL2 = "top";
+var topProtocol = {
+  kind: PROTOCOL2,
+  async buildRequest(input, ctx) {
+    const cipherName = input.cipher || "aes-256-gcm";
+    const digestName = input.digest || "hmac-sha256";
+    const cipher = getCipher(cipherName);
+    const digest = getDigest(digestName);
+    const bizJson = JSON.stringify(input.biz);
+    const r = cipher.encrypt(Buffer.from(bizJson, "utf-8"), {
+      key: ctx.encryptionKey,
+      rsaPublicKeyPem: ctx.rsaPublicKeyPem
+    });
+    const cipherText = r.data.toString("base64");
+    const iv = r.iv.toString("base64");
+    const tag = r.tag?.toString("base64");
+    const encryptedKey = r.encryptedKey?.toString("base64");
+    const sysParams = {
+      method: input.path,
+      // TOP 风格:path 实际是 method 名
+      app_key: ctx.appKey,
+      timestamp: Date.now(),
+      v: "2.0",
+      sign_method: digestName,
+      cipher: cipherName,
+      format: "json"
+    };
+    if (input.session) sysParams.session = input.session;
+    const paramsForSign = {
+      ...input.biz,
+      method: sysParams.method,
+      app_key: sysParams.appKey,
+      timestamp: sysParams.timestamp,
+      v: sysParams.v,
+      sign_method: sysParams.sign_method,
+      cipher: sysParams.cipher
+    };
+    if (input.session) paramsForSign.session = input.session;
+    const signature = signTop({
+      appSecret: ctx.appSecret,
+      params: paramsForSign,
+      cipherText,
+      digest
+    });
+    const envelope = {
+      protocol: PROTOCOL2,
+      ...sysParams,
+      biz_content: cipherText,
+      sign: signature
+    };
+    if (iv) envelope.iv = iv;
+    if (tag) envelope.authTag = tag;
+    if (encryptedKey) envelope.encrypted_key = encryptedKey;
+    return envelope;
+  },
+  async parseAndVerify(raw, ctx) {
+    const appKey = raw.app_key || ctx.app.appKey;
+    if (!appKey) throw new SecureError(1203 /* MISSING_APP_KEY */, "TOP \u534F\u8BAE\u7F3A\u5C11 app_key");
+    const method = raw.method;
+    if (!method) throw new SecureError(1204 /* MISSING_METHOD */, "TOP \u534F\u8BAE\u7F3A\u5C11 method");
+    const cipherName = raw.cipher || "aes-256-gcm";
+    const digestName = raw.sign_method || "hmac-sha256";
+    if (ctx.app.allowedCiphers?.length && !ctx.app.allowedCiphers.includes(cipherName)) {
+      throw new SecureError(1003 /* UNSUPPORTED_CIPHER */, `app ${appKey} \u4E0D\u5141\u8BB8 cipher: ${cipherName}`);
+    }
+    if (ctx.app.allowedDigests?.length && !ctx.app.allowedDigests.includes(digestName)) {
+      throw new SecureError(1105 /* SIGN_METHOD_NOT_ALLOWED */, `app ${appKey} \u4E0D\u5141\u8BB8 sign_method: ${digestName}`);
+    }
+    const timestamp = Number(raw.timestamp);
+    validateTimestamp2(timestamp, ctx.requestWindowMs);
+    await checkNonce2(ctx.nonceStore, raw.nonce || `top:${method}:${timestamp}`, ctx.requestWindowMs);
+    const bizContent = raw.biz_content;
+    if (!bizContent) throw new SecureError(1302 /* INVALID_PAYLOAD */, "TOP \u534F\u8BAE\u7F3A\u5C11 biz_content");
+    const iv = raw.iv;
+    const tag = raw.authTag;
+    const encryptedKey = raw.encrypted_key;
+    const cipher = getCipher(cipherName);
+    const plain = cipher.decrypt(Buffer.from(bizContent, "base64"), {
+      key: ctx.encryptionKey,
+      iv: iv ? Buffer.from(iv, "base64") : Buffer.alloc(0),
+      tag: tag ? Buffer.from(tag, "base64") : void 0,
+      encryptedKey: encryptedKey ? Buffer.from(encryptedKey, "base64") : void 0,
+      rsaPrivateKeyPem: ctx.rsaPrivateKeyPem
+    });
+    const biz = JSON.parse(plain.toString("utf-8"));
+    const digest = getDigest(digestName);
+    const paramsForSign = {
+      ...biz,
+      method,
+      app_key: appKey,
+      timestamp,
+      v: raw.v,
+      sign_method: digestName,
+      cipher: cipherName
+    };
+    if (raw.session) paramsForSign.session = raw.session;
+    const ok = verifyTop({
+      appSecret: ctx.app.appSecret,
+      params: paramsForSign,
+      cipherText: bizContent,
+      digest,
+      signature: raw.sign
+    });
+    if (!ok) throw new SecureError(1101 /* SIGNATURE_MISMATCH */, "TOP \u534F\u8BAE\u7B7E\u540D\u9A8C\u8BC1\u5931\u8D25");
+    return {
+      appKey,
+      method,
+      path: method,
+      session: raw.session,
+      biz
+    };
+  },
+  async buildResponse(biz, ctx) {
+    const cipherName = "aes-256-gcm";
+    const digestName = "hmac-sha256";
+    const cipher = getCipher(cipherName);
+    const digest = getDigest(digestName);
+    const r = cipher.encrypt(Buffer.from(JSON.stringify(biz), "utf-8"), { key: ctx.encryptionKey });
+    const cipherText = r.data.toString("base64");
+    const iv = r.iv.toString("base64");
+    const tag = r.tag?.toString("base64");
+    const timestamp = Date.now();
+    const paramsForSign = {
+      app_key: ctx.app.appKey,
+      timestamp,
+      sign_method: digestName,
+      cipher: cipherName
+    };
+    const sign = signTop({ appSecret: ctx.app.appSecret, params: paramsForSign, cipherText, digest });
+    return {
+      protocol: PROTOCOL2,
+      app_key: ctx.app.appKey,
+      timestamp,
+      v: "2.0",
+      sign_method: digestName,
+      cipher: cipherName,
+      biz_content: cipherText,
+      iv,
+      authTag: tag,
+      sign
+    };
+  }
+};
+function validateTimestamp2(ts, windowMs) {
+  const now = Date.now();
+  if (!ts) throw new SecureError(1104 /* INVALID_TIMESTAMP */, "\u65F6\u95F4\u6233\u65E0\u6548");
+  if (ts > now + 5e3) throw new SecureError(1104 /* INVALID_TIMESTAMP */, "\u65F6\u95F4\u6233\u6765\u81EA\u672A\u6765");
+  if (now - ts > windowMs) throw new SecureError(1102 /* TIMESTAMP_EXPIRED */, "\u8BF7\u6C42\u5DF2\u8FC7\u671F");
+}
+async function checkNonce2(store, nonce, windowMs) {
+  if (!store) return;
+  const ttl = Math.ceil(windowMs * 2 / 1e3);
+  const r = await store.set(`nonce:${nonce}`, "1", "EX", ttl, "NX");
+  if (r === null) throw new SecureError(1103 /* NONCE_REUSED */, "nonce \u5DF2\u88AB\u4F7F\u7528");
+}
+
+// src/protocol/registry.ts
+var protocolRegistry = /* @__PURE__ */ new Map([
+  ["custom", customProtocol],
+  ["top", topProtocol]
+]);
+function getProtocol(kind) {
+  const p = protocolRegistry.get(kind);
+  if (!p) throw new SecureError(1202 /* PROTOCOL_NOT_FOUND */, `Unsupported protocol: ${kind}`);
+  return p;
+}
+function pickProtocol(envelope, defaultKind = "top") {
+  const k = envelope.protocol || defaultKind;
+  return getProtocol(k);
+}
+
+// src/client/SecureClient.ts
+init_errors();
+var SecureClient = class {
+  constructor(config) {
+    this.baseURL = config.baseURL.replace(/\/$/, "");
+    this.encryptionKey = parseKeyHex(config.encryptionKey);
+    this.hmacSecret = parseSecret(config.hmacSecret).toString("utf-8");
+    this.appKey = config.appKey;
+    this.defaultProtocol = config.protocol ?? "top";
+    this.defaultCipher = config.cipher ?? "aes-256-gcm";
+    this.defaultDigest = config.digest ?? "hmac-sha256";
+    this.defaultHeaders = config.defaultHeaders ?? {};
+    this.requestWindowMs = config.requestWindowMs ?? 3e5;
+    this.rsaPublicKeyPem = config.rsaPublicKeyPem;
+    this.fetchImpl = config.fetchImpl ?? (typeof fetch !== "undefined" ? fetch : (() => {
+      throw new SecureError(1301 /* INVALID_REQUEST */, "fetch \u4E0D\u53EF\u7528,\u8BF7\u901A\u8FC7 fetchImpl \u6CE8\u5165");
+    })());
+  }
+  /**
+   * 发起加密请求并解密响应
+   */
+  async request(method, path, options = {}) {
+    const protocol = pickProtocol({ protocol: options.protocol ?? this.defaultProtocol });
+    const envelope = await protocol.buildRequest(
+      {
+        method,
+        path,
+        biz: options.body ?? {},
+        body: options.body,
+        session: options.session,
+        cipher: options.cipher ?? this.defaultCipher,
+        digest: options.digest ?? this.defaultDigest
+      },
+      {
+        appKey: this.appKey ?? "browser",
+        appSecret: this.hmacSecret,
+        encryptionKey: this.encryptionKey,
+        hmacSecret: this.hmacSecret,
+        rsaPublicKeyPem: this.rsaPublicKeyPem
+      }
+    );
+    const url = this.baseURL + path;
+    const resp = await this.fetchImpl(url, {
+      method: "POST",
+      // 加密请求统一用 POST 发送
+      headers: {
+        "Content-Type": "application/json",
+        ...this.defaultHeaders,
+        ...options.headers ?? {}
+      },
+      body: JSON.stringify(envelope),
+      signal: options.signal
+    });
+    const respJson = await resp.json().catch(() => ({}));
+    if (respJson && (respJson.biz_content || respJson.encryptedPayload)) {
+      const respProtocol = pickProtocol(respJson, this.defaultProtocol);
+      try {
+        const plain = await this.decryptResponseOnly(respJson, respProtocol.kind);
+        return plain;
+      } catch (e) {
+        if (respJson.biz_content) {
+          const cipherName = respJson.cipher || this.defaultCipher || "aes-256-gcm";
+          const { getCipher: getCipher2 } = await Promise.resolve().then(() => (init_registry(), registry_exports));
+          const cipher = getCipher2(cipherName);
+          const plain = cipher.decrypt(Buffer.from(respJson.biz_content, "base64"), {
+            iv: Buffer.from(respJson.iv || "", "base64"),
+            tag: respJson.authTag ? Buffer.from(respJson.authTag, "base64") : void 0,
+            key: this.encryptionKey
+          });
+          return JSON.parse(plain.toString("utf-8"));
+        }
+        if (respJson.encryptedPayload) {
+          const { getCipher: getCipher2 } = await Promise.resolve().then(() => (init_registry(), registry_exports));
+          const cipher = getCipher2("aes-256-gcm");
+          const plain = cipher.decrypt(Buffer.from(respJson.encryptedPayload, "base64"), {
+            iv: Buffer.from(respJson.iv, "base64"),
+            tag: respJson.authTag ? Buffer.from(respJson.authTag, "base64") : void 0,
+            key: this.encryptionKey
+          });
+          return JSON.parse(plain.toString("utf-8"));
+        }
+        throw e;
+      }
+    }
+    return respJson;
+  }
+  async decryptResponseOnly(envelope, protocolKind) {
+    if (envelope.biz_content) {
+      const { getCipher: getCipher2 } = await Promise.resolve().then(() => (init_registry(), registry_exports));
+      const cipherName = envelope.cipher || this.defaultCipher || "aes-256-gcm";
+      const cipher = getCipher2(cipherName);
+      return JSON.parse(cipher.decrypt(Buffer.from(envelope.biz_content, "base64"), {
+        key: this.encryptionKey,
+        iv: Buffer.from(envelope.iv || "", "base64"),
+        tag: envelope.authTag ? Buffer.from(envelope.authTag, "base64") : void 0
+      }).toString("utf-8"));
+    }
+    if (envelope.encryptedPayload) {
+      const { getCipher: getCipher2 } = await Promise.resolve().then(() => (init_registry(), registry_exports));
+      const cipher = getCipher2("aes-256-gcm");
+      return JSON.parse(cipher.decrypt(Buffer.from(envelope.encryptedPayload, "base64"), {
+        key: this.encryptionKey,
+        iv: Buffer.from(envelope.iv, "base64"),
+        tag: envelope.authTag ? Buffer.from(envelope.authTag, "base64") : void 0
+      }).toString("utf-8"));
+    }
+    return envelope;
+  }
+  get(path, options) {
+    return this.request("GET", path, options);
+  }
+  post(path, body, options) {
+    return this.request("POST", path, { ...options ?? {}, body });
+  }
+  put(path, body, options) {
+    return this.request("PUT", path, { ...options ?? {}, body });
+  }
+  delete(path, options) {
+    return this.request("DELETE", path, options);
+  }
+  patch(path, body, options) {
+    return this.request("PATCH", path, { ...options ?? {}, body });
+  }
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  SecureClient
+});
+//# sourceMappingURL=client.js.map