@rei-standard/amsg-server 2.6.0-next.1 → 2.6.0-next.2

package/dist/{cloudflare-5Ryuxz10.d.cts → cloudflare-B-E51VjP.d.cts}

@@ -1,5 +1,4 @@
-import { createDecipheriv, createHash, randomBytes as randomBytes$1, createCipheriv, randomUUID } from 'crypto';
-import { validateAvatarUrl, readReasoningContent, stripReasoningTags, buildReasoningPush, buildContentPush, toUint8, base64UrlToBytes, normalizeVapidSubject, concatBytes } from '@rei-standard/amsg-shared';
+import { validateAvatarUrl, toUint8, concatBytes, base64UrlToBytes, readReasoningContent, stripReasoningTags, buildReasoningPush, buildContentPush, normalizeVapidSubject } from '@rei-standard/amsg-shared';
 
 /**
  * Validation utility library (SDK version)
@@ -407,26 +406,160 @@ function getHeader(headers = {}, name) {
   return '';
 }
 
+/**
+ * Runtime-neutral crypto + encoding helpers.
+ *
+ * Everything in here is implemented on top of WHATWG-standard primitives
+ * (`globalThis.crypto.subtle`, `TextEncoder`, `Uint8Array`) so the package
+ * runs on Cloudflare Workers, Vercel Edge, Netlify Edge, Deno, Bun, and
+ * Node ≥ 19 with zero polyfills. The Node adapter polyfills
+ * `globalThis.crypto` for Node 18 deployments before any of these are
+ * touched.
+ */
+
+const TEXT_ENCODER = new TextEncoder();
+const TEXT_DECODER = new TextDecoder('utf-8', { fatal: false });
+
+/** UTF-8 encode a string into a Uint8Array. */
+function utf8(str) {
+  return TEXT_ENCODER.encode(String(str));
+}
+
+/** UTF-8 decode a Uint8Array / ArrayBuffer into a string. */
+function utf8Decode(buf) {
+  return TEXT_DECODER.decode(toUint8(buf));
+}
+
+
+/** Encode bytes as standard base64 (with padding). */
+function bytesToBase64(buf) {
+  const bytes = toUint8(buf);
+  let bin = '';
+  for (let i = 0; i < bytes.length; i++) {
+    bin += String.fromCharCode(bytes[i]);
+  }
+  // btoa is available in all Web Crypto runtimes (browsers, Workers, Node 16+).
+  return (typeof btoa === 'function')
+    ? btoa(bin)
+    : Buffer.from(bin, 'binary').toString('base64');
+}
+
+/** Encode bytes as base64url (no padding). */
+function bytesToBase64Url(buf) {
+  return bytesToBase64(buf).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/g, '');
+}
+
+/** Encode bytes as lowercase hex. */
+function bytesToHex(buf) {
+  const bytes = toUint8(buf);
+  let out = '';
+  for (let i = 0; i < bytes.length; i++) {
+    out += bytes[i].toString(16).padStart(2, '0');
+  }
+  return out;
+}
+
+/** Decode a hex string into a Uint8Array. */
+function hexToBytes(hex) {
+  const out = new Uint8Array(hex.length / 2);
+  for (let i = 0; i < out.length; i++) {
+    out[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+  }
+  return out;
+}
+
+
+/** Encode a JSON-serializable value as base64url (UTF-8 JSON). */
+function jsonToBase64Url(value) {
+  return bytesToBase64Url(utf8(JSON.stringify(value)));
+}
+
+/** `crypto.randomUUID()`. The Node adapter polyfills `globalThis.crypto`. */
+function randomUUID() {
+  return globalThis.crypto.randomUUID();
+}
+
+/** Cryptographically random bytes. */
+function randomBytes(n) {
+  const out = new Uint8Array(n);
+  globalThis.crypto.getRandomValues(out);
+  return out;
+}
+
 /**
  * Encryption utility library (SDK version)
- * ReiStandard SDK v2.0.1
  *
  * Wraps AES-256-GCM operations for request/response and storage encryption.
+ * Implemented on `globalThis.crypto.subtle` (Web Crypto) so the module runs
+ * on Cloudflare Workers and other edge runtimes without `nodejs_compat`, as
+ * well as on Node ≥ 19. All exports are async because SubtleCrypto is.
+ *
+ * Wire formats are byte-identical to the previous node:crypto implementation
+ * (pinned by test/encryption-compat.test.mjs):
+ *   - payload:  12-byte IV, base64 `{ iv, authTag, encryptedData }`
+ *   - storage:  16-byte IV, hex `iv:authTag:encryptedData`
+ * Web Crypto appends the GCM auth tag to the ciphertext, while these formats
+ * carry it detached — aesGcmSeal / aesGcmOpen below own that seam.
  */
 
 
+// Decoder for the wire formats' base64 fields. base64UrlToBytes normalizes
+// the url-safe alphabet and padding first, so it accepts both standard and
+// url-safe base64 — same leniency as node's Buffer.from(x, 'base64').
+const base64ToBytes = base64UrlToBytes;
+
+const TAG_LENGTH_BYTES = 16; // AES-GCM auth tag emitted on encrypt
+
+function importAesKey(hexKey, usage) {
+  return globalThis.crypto.subtle.importKey(
+    'raw',
+    hexToBytes(hexKey),
+    { name: 'AES-GCM' },
+    false,
+    [usage]
+  );
+}
+
+/** AES-256-GCM encrypt; returns the ciphertext and the detached 16-byte tag. */
+async function aesGcmSeal(hexKey, iv, plaintextBytes) {
+  const key = await importAesKey(hexKey, 'encrypt');
+  const sealed = new Uint8Array(await globalThis.crypto.subtle.encrypt(
+    { name: 'AES-GCM', iv, tagLength: TAG_LENGTH_BYTES * 8 },
+    key,
+    plaintextBytes
+  ));
+  return {
+    ciphertext: sealed.slice(0, sealed.length - TAG_LENGTH_BYTES),
+    authTag: sealed.slice(sealed.length - TAG_LENGTH_BYTES)
+  };
+}
+
+/** AES-256-GCM decrypt from detached-tag form; returns plaintext bytes. */
+async function aesGcmOpen(hexKey, iv, ciphertext, authTag) {
+  const key = await importAesKey(hexKey, 'decrypt');
+  // node's decipher accepted GCM tags truncated down to 96 bits; mirror that
+  // by sizing tagLength from the provided tag. Anything outside the standard
+  // 96–128-bit range keeps 128 and fails authentication, as it did before.
+  const tagBits = authTag.length * 8;
+  const tagLength = tagBits >= 96 && tagBits <= 128 ? tagBits : 128;
+  const plain = await globalThis.crypto.subtle.decrypt(
+    { name: 'AES-GCM', iv, tagLength },
+    key,
+    concatBytes(ciphertext, authTag)
+  );
+  return new Uint8Array(plain);
+}
+
 /**
  * Derive a user-specific encryption key from the master key.
  *
  * @param {string} userId    - Unique user identifier.
  * @param {string} masterKey - 64-char hex master key.
- * @returns {string} 64-char hex key.
+ * @returns {Promise<string>} 64-char hex key.
  */
-function deriveUserEncryptionKey(userId, masterKey) {
-  return createHash('sha256')
-    .update(masterKey + userId)
-    .digest('hex')
-    .slice(0, 64);
+async function deriveUserEncryptionKey(userId, masterKey) {
+  const digest = await globalThis.crypto.subtle.digest('SHA-256', utf8(masterKey + userId));
+  return bytesToHex(new Uint8Array(digest)).slice(0, 64);
 }
 
 /**
@@ -434,25 +567,17 @@ function deriveUserEncryptionKey(userId, masterKey) {
  *
  * @param {{ iv: string, authTag: string, encryptedData: string }} encryptedPayload
  * @param {string} encryptionKey - 64-char hex key.
- * @returns {Object} Decrypted JSON object.
+ * @returns {Promise<Object>} Decrypted JSON object.
  */
-function decryptPayload(encryptedPayload, encryptionKey) {
+async function decryptPayload(encryptedPayload, encryptionKey) {
   const { iv, authTag, encryptedData } = encryptedPayload;
-
-  const decipher = createDecipheriv(
-    'aes-256-gcm',
-    Buffer.from(encryptionKey, 'hex'),
-    Buffer.from(iv, 'base64')
+  const plain = await aesGcmOpen(
+    encryptionKey,
+    base64ToBytes(iv),
+    base64ToBytes(encryptedData),
+    base64ToBytes(authTag)
   );
-
-  decipher.setAuthTag(Buffer.from(authTag, 'base64'));
-
-  const decrypted = Buffer.concat([
-    decipher.update(Buffer.from(encryptedData, 'base64')),
-    decipher.final()
-  ]);
-
-  return JSON.parse(decrypted.toString('utf8'));
+  return JSON.parse(utf8Decode(plain));
 }
 
 /**
@@ -460,19 +585,17 @@ function decryptPayload(encryptedPayload, encryptionKey) {
  *
  * @param {string|Object} payload
  * @param {string} encryptionKey - 64-char hex key.
- * @returns {{ iv: string, authTag: string, encryptedData: string }}
+ * @returns {Promise<{ iv: string, authTag: string, encryptedData: string }>}
  */
-function encryptPayload(payload, encryptionKey) {
+async function encryptPayload(payload, encryptionKey) {
   const plaintext = typeof payload === 'string' ? payload : JSON.stringify(payload);
-  const iv = randomBytes$1(12);
-  const cipher = createCipheriv('aes-256-gcm', Buffer.from(encryptionKey, 'hex'), iv);
-  const encrypted = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
-  const authTag = cipher.getAuthTag();
+  const iv = randomBytes(12);
+  const { ciphertext, authTag } = await aesGcmSeal(encryptionKey, iv, utf8(plaintext));
 
   return {
-    iv: iv.toString('base64'),
-    authTag: authTag.toString('base64'),
-    encryptedData: encrypted.toString('base64')
+    iv: bytesToBase64(iv),
+    authTag: bytesToBase64(authTag),
+    encryptedData: bytesToBase64(ciphertext)
   };
 }
 
@@ -481,14 +604,12 @@ function encryptPayload(payload, encryptionKey) {
  *
  * @param {string} text          - Plaintext string.
  * @param {string} encryptionKey - 64-char hex key.
- * @returns {string} Format: iv:authTag:encryptedData
+ * @returns {Promise<string>} Format: iv:authTag:encryptedData
  */
-function encryptForStorage(text, encryptionKey) {
-  const iv = randomBytes$1(16);
-  const cipher = createCipheriv('aes-256-gcm', Buffer.from(encryptionKey, 'hex'), iv);
-  const encrypted = cipher.update(text, 'utf8', 'hex') + cipher.final('hex');
-  const authTag = cipher.getAuthTag();
-  return `${iv.toString('hex')}:${authTag.toString('hex')}:${encrypted}`;
+async function encryptForStorage(text, encryptionKey) {
+  const iv = randomBytes(16);
+  const { ciphertext, authTag } = await aesGcmSeal(encryptionKey, iv, utf8(text));
+  return `${bytesToHex(iv)}:${bytesToHex(authTag)}:${bytesToHex(ciphertext)}`;
 }
 
 /**
@@ -496,17 +617,17 @@ function encryptForStorage(text, encryptionKey) {
  *
  * @param {string} encryptedText - Format: iv:authTag:encryptedData
  * @param {string} encryptionKey - 64-char hex key.
- * @returns {string} Plaintext string.
+ * @returns {Promise<string>} Plaintext string.
  */
-function decryptFromStorage(encryptedText, encryptionKey) {
+async function decryptFromStorage(encryptedText, encryptionKey) {
   const [ivHex, authTagHex, encryptedDataHex] = encryptedText.split(':');
-  const decipher = createDecipheriv(
-    'aes-256-gcm',
-    Buffer.from(encryptionKey, 'hex'),
-    Buffer.from(ivHex, 'hex')
+  const plain = await aesGcmOpen(
+    encryptionKey,
+    hexToBytes(ivHex),
+    hexToBytes(encryptedDataHex),
+    hexToBytes(authTagHex)
   );
-  decipher.setAuthTag(Buffer.from(authTagHex, 'hex'));
-  return decipher.update(encryptedDataHex, 'hex', 'utf8') + decipher.final('utf8');
+  return utf8Decode(plain);
 }
 
 /**
@@ -548,7 +669,7 @@ function createGetUserKeyHandler(ctx) {
       body: {
         success: true,
         data: {
-          userKey: deriveUserEncryptionKey(userId, masterKey),
+          userKey: await deriveUserEncryptionKey(userId, masterKey),
           version: 1
         }
       }
@@ -675,8 +796,8 @@ async function processSingleMessage(task, ctx, providedMasterKey) {
       return { success: false, messagesSent: 0, error: 'TENANT_MASTER_KEY_MISSING' };
     }
 
-    const userKey = deriveUserEncryptionKey(task.user_id, masterKey);
-    const decryptedPayload = JSON.parse(decryptFromStorage(task.encrypted_payload, userKey));
+    const userKey = await deriveUserEncryptionKey(task.user_id, masterKey);
+    const decryptedPayload = JSON.parse(await decryptFromStorage(task.encrypted_payload, userKey));
 
     let messageContent;
     /** @type {unknown} */
@@ -1076,11 +1197,11 @@ function createScheduleMessageHandler(ctx) {
     }
 
     const encryptedBody = parsedBody.data;
+    const userKey = await deriveUserEncryptionKey(userId, masterKey);
 
     let payload;
     try {
-      const userKey = deriveUserEncryptionKey(userId, masterKey);
-      payload = decryptPayload(encryptedBody, userKey);
+      payload = await decryptPayload(encryptedBody, userKey);
     } catch (error) {
       if (error instanceof SyntaxError) {
         return { status: 400, body: { success: false, error: { code: 'INVALID_PAYLOAD_FORMAT', message: '解密后的数据不是有效 JSON' } } };
@@ -1105,7 +1226,6 @@ function createScheduleMessageHandler(ctx) {
     }
 
     const taskUuid = payload.uuid || randomUUID();
-    const userKey = deriveUserEncryptionKey(userId, masterKey);
 
     const fullTaskData = {
       contactName: payload.contactName,
@@ -1133,7 +1253,7 @@ function createScheduleMessageHandler(ctx) {
       metadata: payload.metadata || {}
     };
 
-    const encryptedPayload = encryptForStorage(JSON.stringify(fullTaskData), userKey);
+    const encryptedPayload = await encryptForStorage(JSON.stringify(fullTaskData), userKey);
 
     /**
      * In-server instant path. Delivers an instant message through this
@@ -1347,8 +1467,8 @@ async function runScheduledTick(ctx) {
     }
 
     try {
-      const userKey = deriveUserEncryptionKey(task.user_id, masterKey);
-      const decryptedPayload = JSON.parse(decryptFromStorage(task.encrypted_payload, userKey));
+      const userKey = await deriveUserEncryptionKey(task.user_id, masterKey);
+      const decryptedPayload = JSON.parse(await decryptFromStorage(task.encrypted_payload, userKey));
 
       if (decryptedPayload.recurrenceType === 'none') {
         await db.deleteTaskById(task.id);
@@ -1458,11 +1578,11 @@ function createUpdateMessageHandler(ctx) {
     }
 
     const encryptedBody = parsedBody.data;
-    const userKey = deriveUserEncryptionKey(userId, masterKey);
+    const userKey = await deriveUserEncryptionKey(userId, masterKey);
     let updates;
 
     try {
-      updates = decryptPayload(encryptedBody, userKey);
+      updates = await decryptPayload(encryptedBody, userKey);
     } catch (_error) {
       return { status: 400, body: { success: false, error: { code: 'DECRYPTION_FAILED', message: '请求体解密失败' } } };
     }
@@ -1538,7 +1658,7 @@ function createUpdateMessageHandler(ctx) {
       return { status: 409, body: { success: false, error: { code: 'TASK_ALREADY_COMPLETED', message: '任务已完成或已失败，无法更新' } } };
     }
 
-    const existingData = JSON.parse(decryptFromStorage(existingTask.encrypted_payload, userKey));
+    const existingData = JSON.parse(await decryptFromStorage(existingTask.encrypted_payload, userKey));
 
     // When the caller switches prompt source (completePrompt ↔ messages),
     // null out the other so storage stays one-of (matches schedule-message
@@ -1567,7 +1687,7 @@ function createUpdateMessageHandler(ctx) {
       ...(Object.prototype.hasOwnProperty.call(updates, 'splitPattern') && { splitPattern: updates.splitPattern ?? null })
     };
 
-    const encryptedPayload = encryptForStorage(JSON.stringify(updatedData), userKey);
+    const encryptedPayload = await encryptForStorage(JSON.stringify(updatedData), userKey);
     const extraFields = updates.nextSendAt ? { next_send_at: updates.nextSendAt } : undefined;
 
     const result = await db.updateTaskByUuid(taskUuid, userId, encryptedPayload, extraFields);
@@ -1694,10 +1814,10 @@ function createMessagesHandler(ctx) {
 
     const { tasks, total } = await db.listTasks(userId, { status, limit, offset });
 
-    const userKey = deriveUserEncryptionKey(userId, masterKey);
+    const userKey = await deriveUserEncryptionKey(userId, masterKey);
 
-    const decryptedTasks = tasks.map(task => {
-      const decrypted = JSON.parse(decryptFromStorage(task.encrypted_payload, userKey));
+    const decryptedTasks = await Promise.all(tasks.map(async task => {
+      const decrypted = JSON.parse(await decryptFromStorage(task.encrypted_payload, userKey));
       return {
         id: task.id,
         uuid: task.uuid,
@@ -1711,13 +1831,13 @@ function createMessagesHandler(ctx) {
         createdAt: task.created_at,
         updatedAt: task.updated_at
       };
-    });
+    }));
 
     const responsePayload = {
       tasks: decryptedTasks,
       pagination: { total, limit, offset, hasMore: offset + limit < total }
     };
-    const encryptedResponse = encryptPayload(responsePayload, userKey);
+    const encryptedResponse = await encryptPayload(responsePayload, userKey);
 
     return {
       status: 200,
@@ -2253,53 +2373,6 @@ function createSingleUserServer(config) {
   };
 }
 
-/**
- * Runtime-neutral crypto + encoding helpers.
- *
- * Everything in here is implemented on top of WHATWG-standard primitives
- * (`globalThis.crypto.subtle`, `TextEncoder`, `Uint8Array`) so the package
- * runs on Cloudflare Workers, Vercel Edge, Netlify Edge, Deno, Bun, and
- * Node ≥ 19 with zero polyfills. The Node adapter polyfills
- * `globalThis.crypto` for Node 18 deployments before any of these are
- * touched.
- */
-
-const TEXT_ENCODER = new TextEncoder();
-new TextDecoder('utf-8', { fatal: false });
-
-/** UTF-8 encode a string into a Uint8Array. */
-function utf8(str) {
-  return TEXT_ENCODER.encode(String(str));
-}
-
-
-/** Encode bytes as base64url (no padding). */
-function bytesToBase64Url(buf) {
-  const bytes = toUint8(buf);
-  let bin = '';
-  for (let i = 0; i < bytes.length; i++) {
-    bin += String.fromCharCode(bytes[i]);
-  }
-  // btoa is available in all Web Crypto runtimes (browsers, Workers, Node 16+).
-  const b64 = (typeof btoa === 'function')
-    ? btoa(bin)
-    : Buffer.from(bin, 'binary').toString('base64');
-  return b64.replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/g, '');
-}
-
-
-/** Encode a JSON-serializable value as base64url (UTF-8 JSON). */
-function jsonToBase64Url(value) {
-  return bytesToBase64Url(utf8(JSON.stringify(value)));
-}
-
-/** Cryptographically random bytes. */
-function randomBytes(n) {
-  const out = new Uint8Array(n);
-  globalThis.crypto.getRandomValues(out);
-  return out;
-}
-
 /**
  * Web Push — RFC 8030 (transport) + RFC 8291 (aes128gcm payload encryption)
  *           + RFC 8292 (VAPID).