@h-ai/crypto 1.0.0-beta.18 → 1.0.0-beta.19

package/README.en.md

@@ -27,6 +27,8 @@ A cryptography module for asymmetric encryption, hashing, symmetric encryption,
 
 ### Quick start
 
+Concurrent `close()` invalidates an unfinished `init()`, so late initialization cannot reopen the module. Wait for that initialization to settle before initializing again.
+
 ```ts
 import { crypto } from '@h-ai/crypto'
 

package/README.ja.md

@@ -29,6 +29,8 @@
 
 ### クイックスタート
 
+並行する `close()` は未完了の `init()` を無効にし、遅い初期化がモジュールを再開しないようにします。その初期化の完了を待ってから再初期化できます。
+
 ```ts
 import { crypto } from '@h-ai/crypto'
 

package/README.md

@@ -27,6 +27,8 @@
 
 ### 快速开始
 
+并发调用 `close()` 会使尚未完成的 `init()` 失效，迟到初始化不会重新打开模块；等待该次初始化返回后可再次初始化。
+
 ```ts
 import { crypto } from '@h-ai/crypto'
 

package/dist/index.d.ts

@@ -2229,4 +2229,5 @@ interface ReldbTransportKeyStore extends TransportKeyStore {
  */
 declare function createReldbTransportKeyStore(options: CreateReldbTransportKeyStoreOptions): ReldbTransportKeyStore;
 
-export { type AsymmetricEncryptOptions, type AsymmetricOperations, type CipherMode, type CreateRedisTransportKeyStoreOptions, type CreateReldbTransportKeyStoreOptions, type CryptoFunctions, type EncryptWithIVResult, type EncryptedPayload, type EncryptedRequestPayload, HaiCryptoError, type HashOperations, type HashOptions, type KeyExchangeRequest, type KeyExchangeResponse, type KeyPair, type PasswordConfig, type PasswordOperations, type ReadTransportBodyOptions, type ReldbTransportKeyStore, type SignOptions, type SymmetricCbcEncryptedPayload, type SymmetricCiphertextEncoding, type SymmetricDecryptInput, type SymmetricEncryptOptions, type SymmetricEncryptedPayload, type SymmetricMode, type SymmetricOperations, TRANSPORT_BODY_LIMITS, TRANSPORT_PLAINTEXT_RANGE, TRANSPORT_PROTOCOL, TRANSPORT_TIME_LIMITS, type TransportBodyLimits, TransportBodyTooLargeError, type TransportClient, type TransportCreateServerOptions, type TransportCryptoServiceLike, type TransportEncryptionManager, type TransportKeyPair, type TransportKeyStore, type TransportMessageContext, type TransportOperations, type TransportRequestContext, type TransportServerKeyRing, TransportTimeError, authenticateTransportRequest, createInMemoryKeyStore, createRedisTransportKeyStore, createReldbTransportKeyStore, createTransportBodyPolicy, createTransportErrorResponse, crypto, isValidSM2PublicKey, parseTransportServerKeyRing, readTransportBody, resolveTransportBodyLimits };
+export { HaiCryptoError, TRANSPORT_BODY_LIMITS, TRANSPORT_PLAINTEXT_RANGE, TRANSPORT_PROTOCOL, TRANSPORT_TIME_LIMITS, TransportBodyTooLargeError, TransportTimeError, authenticateTransportRequest, createInMemoryKeyStore, createRedisTransportKeyStore, createReldbTransportKeyStore, createTransportBodyPolicy, createTransportErrorResponse, crypto, isValidSM2PublicKey, parseTransportServerKeyRing, readTransportBody, resolveTransportBodyLimits };
+export type { AsymmetricEncryptOptions, AsymmetricOperations, CipherMode, CreateRedisTransportKeyStoreOptions, CreateReldbTransportKeyStoreOptions, CryptoFunctions, EncryptWithIVResult, EncryptedPayload, EncryptedRequestPayload, HashOperations, HashOptions, KeyExchangeRequest, KeyExchangeResponse, KeyPair, PasswordConfig, PasswordOperations, ReadTransportBodyOptions, ReldbTransportKeyStore, SignOptions, SymmetricCbcEncryptedPayload, SymmetricCiphertextEncoding, SymmetricDecryptInput, SymmetricEncryptOptions, SymmetricEncryptedPayload, SymmetricMode, SymmetricOperations, TransportBodyLimits, TransportClient, TransportCreateServerOptions, TransportCryptoServiceLike, TransportEncryptionManager, TransportKeyPair, TransportKeyStore, TransportMessageContext, TransportOperations, TransportRequestContext, TransportServerKeyRing };

package/dist/index.js

@@ -385,7 +385,11 @@ function createSM2() {
       } catch (error) {
         return err(
           HaiCryptoError.KEY_GENERATION_FAILED,
-          cryptoM("crypto_sm2KeyPairGenerateFailed", { params: { error: error instanceof Error ? error.message : String(error) } }),
+          cryptoM("crypto_sm2KeyPairGenerateFailed", {
+            params: {
+              error: error instanceof Error ? error.message : String(error)
+            }
+          }),
           error
         );
       }
@@ -424,7 +428,11 @@ function createSM2() {
       } catch (error) {
         return err(
           HaiCryptoError.ENCRYPTION_FAILED,
-          cryptoM("crypto_sm2EncryptFailed", { params: { error: error instanceof Error ? error.message : String(error) } }),
+          cryptoM("crypto_sm2EncryptFailed", {
+            params: {
+              error: error instanceof Error ? error.message : String(error)
+            }
+          }),
           error
         );
       }
@@ -463,7 +471,11 @@ function createSM2() {
       } catch (error) {
         return err(
           HaiCryptoError.DECRYPTION_FAILED,
-          cryptoM("crypto_sm2DecryptFailedWithError", { params: { error: error instanceof Error ? error.message : String(error) } }),
+          cryptoM("crypto_sm2DecryptFailedWithError", {
+            params: {
+              error: error instanceof Error ? error.message : String(error)
+            }
+          }),
           error
         );
       }
@@ -498,7 +510,11 @@ function createSM2() {
       } catch (error) {
         return err(
           HaiCryptoError.SIGN_FAILED,
-          cryptoM("crypto_sm2SignFailed", { params: { error: error instanceof Error ? error.message : String(error) } }),
+          cryptoM("crypto_sm2SignFailed", {
+            params: {
+              error: error instanceof Error ? error.message : String(error)
+            }
+          }),
           error
         );
       }
@@ -529,7 +545,11 @@ function createSM2() {
       } catch (error) {
         return err(
           HaiCryptoError.VERIFY_FAILED,
-          cryptoM("crypto_sm2VerifyFailed", { params: { error: error instanceof Error ? error.message : String(error) } }),
+          cryptoM("crypto_sm2VerifyFailed", {
+            params: {
+              error: error instanceof Error ? error.message : String(error)
+            }
+          }),
           error
         );
       }
@@ -595,7 +615,11 @@ function createSM3() {
       } catch (error) {
         return err(
           HaiCryptoError.HASH_FAILED,
-          cryptoM("crypto_sm3HashFailed", { params: { error: error instanceof Error ? error.message : String(error) } }),
+          cryptoM("crypto_sm3HashFailed", {
+            params: {
+              error: error instanceof Error ? error.message : String(error)
+            }
+          }),
           error
         );
       }
@@ -634,7 +658,11 @@ function createSM3() {
       } catch (error) {
         return err(
           HaiCryptoError.HMAC_FAILED,
-          cryptoM("crypto_sm3HmacFailed", { params: { error: error instanceof Error ? error.message : String(error) } }),
+          cryptoM("crypto_sm3HmacFailed", {
+            params: {
+              error: error instanceof Error ? error.message : String(error)
+            }
+          }),
           error
         );
       }
@@ -655,7 +683,11 @@ function createSM3() {
       } catch (error) {
         return err(
           HaiCryptoError.HASH_FAILED,
-          cryptoM("crypto_sm3VerifyFailed", { params: { error: error instanceof Error ? error.message : String(error) } }),
+          cryptoM("crypto_sm3VerifyFailed", {
+            params: {
+              error: error instanceof Error ? error.message : String(error)
+            }
+          }),
           error
         );
       }
@@ -743,7 +775,11 @@ function createSM4() {
       } catch (error) {
         return err(
           HaiCryptoError.ENCRYPTION_FAILED,
-          cryptoM("crypto_sm4EncryptFailed", { params: { error: error instanceof Error ? error.message : String(error) } }),
+          cryptoM("crypto_sm4EncryptFailed", {
+            params: {
+              error: error instanceof Error ? error.message : String(error)
+            }
+          }),
           error
         );
       }
@@ -791,7 +827,11 @@ function createSM4() {
       } catch (error) {
         return err(
           HaiCryptoError.DECRYPTION_FAILED,
-          cryptoM("crypto_sm4DecryptFailedWithError", { params: { error: error instanceof Error ? error.message : String(error) } }),
+          cryptoM("crypto_sm4DecryptFailedWithError", {
+            params: {
+              error: error instanceof Error ? error.message : String(error)
+            }
+          }),
           error
         );
       }
@@ -827,7 +867,12 @@ function createSM4() {
      * @returns 成功时返回明文；失败时同 decrypt
      */
     decryptWithIV(ciphertext, key, iv) {
-      return this.decrypt({ mode: "cbc", ciphertext, iv, encoding: "hex" }, key);
+      return this.decrypt({
+        mode: "cbc",
+        ciphertext,
+        iv,
+        encoding: "hex"
+      }, key);
     },
     /** 校验密钥格式是否合法（32 字符十六进制） */
     isValidKey(key) {
@@ -873,8 +918,11 @@ function resolveTransportBodyLimits(maxPlaintextBytes, options = {}) {
     maxPlaintextBytes = required ?? TRANSPORT_BODY_LIMITS.plaintextBytes;
   if (!Number.isSafeInteger(maxPlaintextBytes) || maxPlaintextBytes < TRANSPORT_PLAINTEXT_RANGE.min || maxPlaintextBytes > TRANSPORT_PLAINTEXT_RANGE.max)
     throw new RangeError(cryptoM("crypto_transportBodyLimitInvalid"));
-  if (required !== void 0 && maxPlaintextBytes < required)
-    throw new RangeError(cryptoM("crypto_transportBodyLimitConflict", { params: { limit: maxPlaintextBytes, required } }));
+  if (required !== void 0 && maxPlaintextBytes < required) {
+    throw new RangeError(cryptoM("crypto_transportBodyLimitConflict", {
+      params: { limit: maxPlaintextBytes, required }
+    }));
+  }
   return Object.freeze({ ...TRANSPORT_BODY_LIMITS, plaintextBytes: maxPlaintextBytes, encryptedPayloadBytes: 2 * maxPlaintextBytes + 32768 });
 }
 var TransportBodyTooLargeError = class extends RangeError {
@@ -946,7 +994,10 @@ function createTransportBodyPolicy(maxPlaintextBytes, routes = {}) {
   const entries = Object.entries(routes);
   if (entries.length > 100 || entries.some(([path]) => !path.startsWith("/") || path.includes("?") || path.includes("#") || path.split("/").some((part) => part.includes("*") && part !== "*")))
     throw new RangeError(cryptoM("crypto_transportBodyLimitInvalid"));
-  const configured = entries.map(([path, bytes]) => ({ parts: path.split("/"), limits: resolveTransportBodyLimits(bytes) }));
+  const configured = entries.map(([path, bytes]) => ({
+    parts: path.split("/"),
+    limits: resolveTransportBodyLimits(bytes)
+  }));
   const maximum = resolveTransportBodyLimits(Math.max(ordinary.plaintextBytes, ...configured.map((route) => route.limits.plaintextBytes)));
   let small = 0;
   let large = 0;
@@ -957,22 +1008,26 @@ function createTransportBodyPolicy(maxPlaintextBytes, routes = {}) {
       const matching = configured.filter((route) => route.parts.length === parts.length && route.parts.every((part, index) => part === "*" || part === parts[index]));
       const limits = matching.length ? matching.reduce((left, right) => left.limits.plaintextBytes < right.limits.plaintextBytes ? left : right).limits : ordinary;
       const heavy = matching.length > 0 && limits.plaintextBytes > TRANSPORT_BODY_LIMITS.plaintextBytes;
-      if (heavy ? large >= 2 : small >= 16)
+      if (heavy ? large >= 2 : small >= 16) {
         return null;
+      }
       if (heavy)
         large++;
       else
         small++;
       let released = false;
-      return { limits, release() {
-        if (released)
-          return;
-        released = true;
-        if (heavy)
-          large--;
-        else
-          small--;
-      } };
+      return {
+        limits,
+        release() {
+          if (released)
+            return;
+          released = true;
+          if (heavy)
+            large--;
+          else
+            small--;
+        }
+      };
     }
   };
 }
@@ -1045,7 +1100,14 @@ function sealTransportPayload(service, plaintext, context, direction, status, re
     const wrapped = service.asymmetric.encrypt(JSON.stringify([encryptionKey, authenticationKey]), recipientPublicKey);
     if (!encrypted.success || !wrapped.success)
       return transportAuthenticationFailure();
-    const payload = { context: { ...context }, direction, status, encryptedKey: wrapped.data, ciphertext: encrypted.data.ciphertext, iv: encrypted.data.iv };
+    const payload = {
+      context: { ...context },
+      direction,
+      status,
+      encryptedKey: wrapped.data,
+      ciphertext: encrypted.data.ciphertext,
+      iv: encrypted.data.iv
+    };
     const text = authenticatedText(payload);
     const tag = service.hash.hmac(text, authenticationKey);
     if (!tag.success)
@@ -1103,7 +1165,11 @@ function sameTransportContext(a, b) {
 var TransportTimeError = class extends Error {
   constructor(context, serverTime) {
     const validTime = typeof serverTime === "number" && Number.isSafeInteger(serverTime) && serverTime >= 0 && serverTime <= 864e13 ? serverTime : void 0;
-    const message = validTime === void 0 ? cryptoM("crypto_transportTimeInvalid") : cryptoM("crypto_transportTimeInvalidWithServerTime", { params: { serverTime: new Date(validTime).toISOString().replace("T", " ").replace(/\.\d{3}Z$/, " UTC") } });
+    const message = validTime === void 0 ? cryptoM("crypto_transportTimeInvalid") : cryptoM("crypto_transportTimeInvalidWithServerTime", {
+      params: {
+        serverTime: new Date(validTime).toISOString().replace("T", " ").replace(/\.\d{3}Z$/, " UTC")
+      }
+    });
     super(message);
     this.context = context;
     this.name = "TransportTimeError";
@@ -1116,14 +1182,23 @@ var TransportTimeError = class extends Error {
 async function createTransportErrorResponse(error, authenticated) {
   const isTimeError = error instanceof TransportTimeError;
   const status = isTimeError ? 400 : error.direction === "request" ? 413 : 500;
-  const publicError = { code: error.code, message: isTimeError ? cryptoM("crypto_transportTimeInvalid") : error.message, httpStatus: status, details: isTimeError ? void 0 : {
-    direction: error.direction,
-    stage: error.stage,
-    limitBytes: error.limitBytes,
-    actualBytes: error.actualBytes
-  } };
+  const publicError = {
+    code: error.code,
+    message: isTimeError ? cryptoM("crypto_transportTimeInvalid") : error.message,
+    httpStatus: status,
+    details: isTimeError ? void 0 : {
+      direction: error.direction,
+      stage: error.stage,
+      limitBytes: error.limitBytes,
+      actualBytes: error.actualBytes
+    }
+  };
   if (authenticated) {
-    const encryptedError = isTimeError && error.serverTime !== void 0 ? { ...publicError, message: error.message, details: { serverTime: error.serverTime } } : publicError;
+    const encryptedError = isTimeError && error.serverTime !== void 0 ? {
+      ...publicError,
+      message: error.message,
+      details: { serverTime: error.serverTime }
+    } : publicError;
     const body = JSON.stringify({ success: false, error: encryptedError });
     const encrypted = await authenticated.manager.encryptResponse(authenticated.context, body, status);
     if (encrypted.success) {
@@ -1135,7 +1210,10 @@ async function createTransportErrorResponse(error, authenticated) {
       return Response.json(encrypted.data, { status, headers });
     }
   }
-  return new Response(JSON.stringify({ success: false, error: publicError }), { status, headers: { "Content-Type": "application/json; charset=utf-8" } });
+  return new Response(JSON.stringify({ success: false, error: publicError }), {
+    status,
+    headers: { "Content-Type": "application/json; charset=utf-8" }
+  });
 }
 
 // src/transport/crypto-transport-client.ts
@@ -1175,7 +1253,9 @@ function createTransportClient(options) {
       if (!response.ok) {
         void response.body?.cancel().catch(() => {
         });
-        return err(HaiCommonError.INTERNAL_ERROR, cryptoM("crypto_transportKeyExchangeHttpFailed", { params: { status: response.status } }));
+        return err(HaiCommonError.INTERNAL_ERROR, cryptoM("crypto_transportKeyExchangeHttpFailed", {
+          params: { status: response.status }
+        }));
       }
       let body;
       try {
@@ -1338,7 +1418,12 @@ function createTransportClient(options) {
       }
       if (envelope && new TextEncoder().encode(envelope).byteLength > TRANSPORT_BODY_LIMITS.envelopeHeaderBytes)
         throw new TransportBodyTooLargeError(TRANSPORT_BODY_LIMITS.envelopeHeaderBytes, new TextEncoder().encode(envelope).byteLength, { direction: "response", stage: "header" });
-      payload = JSON.parse(envelope ?? await readTransportBody(response.body, { maxBytes: bodyLimits.encryptedPayloadBytes, direction: "response", stage: "encrypted", signal }));
+      payload = JSON.parse(envelope ?? await readTransportBody(response.body, {
+        maxBytes: bodyLimits.encryptedPayloadBytes,
+        direction: "response",
+        stage: "encrypted",
+        signal
+      }));
     } catch (error) {
       if (error instanceof TransportBodyTooLargeError)
         throw error;
@@ -1516,7 +1601,10 @@ function createTransportEncryption(cryptoService, options) {
       try {
         if (!isValidEncryptedPayload(payload, bodyLimits) || payload.direction !== "request" || payload.status !== 0)
           return transportAuthenticationFailure();
-        const authenticated = { ...payload, context: { ...payload.context } };
+        const authenticated = {
+          ...payload,
+          context: { ...payload.context }
+        };
         const c = authenticated.context;
         const pathHash = hashTransportPath(cryptoService, expected.path);
         if (!pathHash.success || c.clientId !== expected.clientId || c.method !== expected.method || c.pathHash !== pathHash.data) {
@@ -1559,6 +1647,7 @@ function createTransportEncryption(cryptoService, options) {
 var logger = core.logger.child({ module: "crypto", scope: "main" });
 var initialized = false;
 var initInProgress = false;
+var lifecycleGeneration = 0;
 var currentAsymmetric = null;
 var currentHash = null;
 var currentSymmetric = null;
@@ -1576,7 +1665,10 @@ function getCrypto() {
 }
 var transportOperations = {
   createServer: (options) => getCrypto().isInitialized ? createTransportEncryption(getCrypto(), options) : notInitialized.result(),
-  createClient: (options) => createTransportClient({ crypto: getCrypto(), ...options }),
+  createClient: (options) => createTransportClient({
+    crypto: getCrypto(),
+    ...options
+  }),
   protocol: TRANSPORT_PROTOCOL
 };
 var crypto2 = {
@@ -1593,15 +1685,24 @@ var crypto2 = {
       logger.warn("Crypto init already in progress, skipping concurrent call");
       return err(
         HaiCryptoError.INIT_FAILED,
-        cryptoM("crypto_initFailed", { params: { error: "Concurrent initialization detected" } })
+        cryptoM("crypto_initFailed", {
+          params: { error: "Concurrent initialization detected" }
+        })
       );
     }
     initInProgress = true;
+    const generation = ++lifecycleGeneration;
     try {
       await Promise.resolve();
+      if (generation !== lifecycleGeneration)
+        return notInitialized.result();
       if (initialized) {
         logger.warn("Crypto module is already initialized, reinitializing");
-        await crypto2.close();
+        currentAsymmetric = null;
+        currentHash = null;
+        currentSymmetric = null;
+        currentPassword = null;
+        initialized = false;
       }
       logger.info("Initializing crypto module");
       currentAsymmetric = createSM2();
@@ -1621,7 +1722,9 @@ var crypto2 = {
       return err(
         HaiCryptoError.INIT_FAILED,
         cryptoM("crypto_initFailed", {
-          params: { error: error instanceof Error ? error.message : String(error) }
+          params: {
+            error: error instanceof Error ? error.message : String(error)
+          }
         }),
         error
       );
@@ -1661,6 +1764,7 @@ var crypto2 = {
    * 关闭后访问 asymmetric/hash/symmetric/password 会返回 NOT_INITIALIZED 错误。
    */
   async close() {
+    lifecycleGeneration++;
     if (!initialized) {
       logger.info("Crypto module already closed, skipping");
       return;
@@ -1954,7 +2058,10 @@ function createReldbTransportKeyStore(options) {
   }
   async function pruneRows(tx) {
     let removed = 0;
-    for (const [table, id, expiry] of [[TRANSPORT_KEY_TABLE, "client_id", "expires_at_ms"], [TRANSPORT_REQUEST_TABLE, "request_key", "expires_at"]]) {
+    for (const [table, id, expiry] of [
+      [TRANSPORT_KEY_TABLE, "client_id", "expires_at_ms"],
+      [TRANSPORT_REQUEST_TABLE, "request_key", "expires_at"]
+    ]) {
       removed += unwrapResult2("tx.execute", await tx.execute(
         `DELETE FROM ${table} WHERE ${expiry} <= ${nowSql()} AND ${id} IN (SELECT ${id} FROM (SELECT ${id} FROM ${table} WHERE ${expiry} <= ${nowSql()} LIMIT ${PRUNE_BATCH_SIZE}) AS expired)`
       )).changes;
@@ -2009,7 +2116,10 @@ function createReldbTransportKeyStore(options) {
       const insertSql = options.reldb.config?.type === "mysql" ? `INSERT IGNORE INTO ${TRANSPORT_REQUEST_TABLE} (request_key, expires_at) VALUES (?, ?)` : `INSERT INTO ${TRANSPORT_REQUEST_TABLE} (request_key, expires_at) VALUES (?, ?) ON CONFLICT (request_key) DO NOTHING`;
       const inserted = unwrapResult2("reldb.sql.execute", await options.reldb.sql.execute(
         insertSql,
-        [JSON.stringify([clientId, requestId]), expiresAt]
+        [
+          JSON.stringify([clientId, requestId]),
+          expiresAt
+        ]
       ));
       return inserted.changes === 1;
     },