@objectstack/service-settings 6.2.0 → 6.4.0

package/dist/index.cjs

@@ -1,7 +1,9 @@
 "use strict";
+var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -15,6 +17,14 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/index.ts
@@ -606,17 +616,51 @@ function coerceEnvValue(raw, hint) {
 
 // src/in-memory-crypto-provider.ts
 var import_node_crypto = require("crypto");
+var isWebContainerRuntime = () => {
+  const g = globalThis;
+  return typeof g !== "undefined" && (Boolean(g.process?.versions?.webcontainer) || Boolean(g.process?.env?.SHELL?.includes?.("jsh")) || Boolean(g.process?.env?.STACKBLITZ));
+};
+var nobleGcmPromise;
+var loadNobleGcm = () => {
+  if (!nobleGcmPromise) {
+    nobleGcmPromise = (async () => {
+      try {
+        const mod = await import("@noble/ciphers/aes.js");
+        return mod.gcm;
+      } catch (err) {
+        console.warn(
+          `[InMemoryCryptoProvider] WebContainer detected but @noble/ciphers not installed: ${err?.message ?? err}. Falling back to node:crypto (will throw).`
+        );
+        return void 0;
+      }
+    })();
+  }
+  return nobleGcmPromise;
+};
 var InMemoryCryptoProvider = class {
   constructor(opts = {}) {
     this.key = opts.key ?? (0, import_node_crypto.randomBytes)(32);
+    this.useNoble = isWebContainerRuntime();
   }
   async encrypt(plain, ctx) {
     const iv = (0, import_node_crypto.randomBytes)(12);
-    const cipher = (0, import_node_crypto.createCipheriv)("aes-256-gcm", this.key, iv);
-    cipher.setAAD(Buffer.from(this.aadOf(ctx), "utf8"));
-    const enc = Buffer.concat([cipher.update(plain, "utf8"), cipher.final()]);
-    const tag = cipher.getAuthTag();
-    const blob = Buffer.concat([iv, tag, enc]).toString("base64");
+    const aad = Buffer.from(this.aadOf(ctx), "utf8");
+    const plainBytes = Buffer.from(plain, "utf8");
+    let blob;
+    if (this.useNoble) {
+      const gcm = await loadNobleGcm();
+      if (gcm) {
+        const cipher = gcm(this.key, iv, aad);
+        const ctWithTag = cipher.encrypt(plainBytes);
+        const ct = ctWithTag.subarray(0, ctWithTag.length - 16);
+        const tag = ctWithTag.subarray(ctWithTag.length - 16);
+        blob = Buffer.concat([iv, Buffer.from(tag), Buffer.from(ct)]).toString("base64");
+      } else {
+        blob = this.encryptNode(plainBytes, iv, aad);
+      }
+    } else {
+      blob = this.encryptNode(plainBytes, iv, aad);
+    }
     return {
       id: "sec_" + (0, import_node_crypto.randomBytes)(16).toString("hex"),
       kmsKeyId: "local:in-memory:v1",
@@ -630,8 +674,18 @@ var InMemoryCryptoProvider = class {
     const iv = buf.subarray(0, 12);
     const tag = buf.subarray(12, 28);
     const data = buf.subarray(28);
+    const aad = Buffer.from(this.aadOf(ctx), "utf8");
+    if (this.useNoble) {
+      const gcm = await loadNobleGcm();
+      if (gcm) {
+        const cipher = gcm(this.key, iv, aad);
+        const ctWithTag = Buffer.concat([data, tag]);
+        const out = cipher.decrypt(ctWithTag);
+        return Buffer.from(out).toString("utf8");
+      }
+    }
     const decipher = (0, import_node_crypto.createDecipheriv)("aes-256-gcm", this.key, iv);
-    decipher.setAAD(Buffer.from(this.aadOf(ctx), "utf8"));
+    decipher.setAAD(aad);
     decipher.setAuthTag(tag);
     return Buffer.concat([decipher.update(data), decipher.final()]).toString("utf8");
   }
@@ -648,6 +702,13 @@ var InMemoryCryptoProvider = class {
   digest(plain) {
     return "sha256:" + (0, import_node_crypto.createHash)("sha256").update(plain, "utf8").digest("hex");
   }
+  encryptNode(plainBytes, iv, aad) {
+    const cipher = (0, import_node_crypto.createCipheriv)("aes-256-gcm", this.key, iv);
+    cipher.setAAD(aad);
+    const enc = Buffer.concat([cipher.update(plainBytes), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    return Buffer.concat([iv, tag, enc]).toString("base64");
+  }
   aadOf(ctx) {
     return [ctx.namespace, ctx.key].join("|");
   }