@tacet-ink/journal-core 0.3.3 → 0.3.4

package/src/client/argon-auto.ts

@@ -1,224 +0,0 @@
-/**
- * argon-auto.ts — Argon2id 載體平台預設。
- *
- * 優先序（向後相容鐵律：setArgonLoader 照舊優先）：
- *   1. 呼叫端已 setArgonLoader 注入（非本模組自裝）＝'injected'——本模組零介入。
- *   2. 回退鏈 chain（可覆寫；預設 ['node','worker','inline']）逐項取第一個可用者：
- *      - 'node'：node:crypto.argon2 在場（argon2.ts 原生腿；本模組不注入）。
- *      - 'worker'：Web Worker（argon-worker.ts 內嵌 blob 形）；執行期失效＝若 chain 於其後含
- *        'inline' 則回退 inline（onFallback 通知＋currentArgonCarrier 翻 'inline'＝行為顯形），否則 throw。
- *      - 'inline'：同執行緒 vendor hash-wasm（WebAssembly 在場即可）。
- *   3. 皆不可用＝ERR_VAULT_KDF_UNSUPPORTED（zero-fallback：禁 PBKDF2／zeros 兜底）。
- * 裝載即 KAT：每個載體首用前跑 RFC 9106 KAT（verifyArgonKat）——錯值載體＝拒用，不只是缺席才拒。
- *
- * 'worker'／'inline' 經 setArgonLoader 全域注入（argon2.ts 派生本體唯一入口）：同頁其他 argon2.ts
- * 呼叫端共享此載體；呼叫端之後自行 setArgonLoader 即覆寫（下次 ensure 判 'injected'）。
- * resetArgonCarrier() 撤除本模組自裝載體（不動呼叫端注入）並終止 Worker。
- */
-
-import { getArgonLoader, setArgonLoader, verifyArgonKat, type ArgonLoader, type HashWasmArgon2id } from './argon2.ts';
-import { makeWorkerArgon2id, createBlobArgonWorker, type ArgonWorkerLike } from './argon-worker.ts';
-import { hashWasmArgon2Factory } from './vendor/hash-wasm-argon2.ts';
-import { VaultError } from './vault-error.ts';
-
-export type ArgonCarrierKind = 'injected' | 'node' | 'worker' | 'inline';
-export type ArgonCarrierChoice = 'node' | 'worker' | 'inline';
-export type { ArgonWorkerLike };
-
-export interface ArgonFallbackEvent {
-  from: 'worker';
-  to: 'inline';
-  error: unknown;
-}
-
-export interface ArgonCarrierOptions {
-  /** 回退鏈（預設 ['node','worker','inline']）。例：['worker']＝只准 Worker（失效即拒，不回退）。 */
-  chain?: readonly ArgonCarrierChoice[];
-  /** Worker 工廠覆寫（預設瀏覽器 blob Worker；測試／特殊宿主注入轉接層）。 */
-  createWorker?: () => ArgonWorkerLike;
-  /** Worker → inline 回退通知（行為顯形；不提供＝靜默回退但 currentArgonCarrier 仍翻 'inline'）。 */
-  onFallback?: (ev: ArgonFallbackEvent) => void;
-}
-
-export const DEFAULT_ARGON_CHAIN: readonly ArgonCarrierChoice[] = ['node', 'worker', 'inline'];
-
-function nodeArgonAvailable(): boolean {
-  const nodeCrypto = (globalThis as unknown as {
-    process?: { getBuiltinModule?: (id: string) => { argon2?: unknown } | undefined };
-  }).process?.getBuiltinModule?.('node:crypto');
-  return typeof nodeCrypto?.argon2 === 'function';
-}
-
-function workerAvailable(opts: ArgonCarrierOptions): boolean {
-  if (opts.createWorker) return true;
-  const g = globalThis as unknown as { Worker?: unknown; Blob?: unknown; URL?: { createObjectURL?: unknown } };
-  return typeof g.Worker === 'function' && typeof g.Blob === 'function' && typeof g.URL?.createObjectURL === 'function';
-}
-
-function wasmAvailable(): boolean {
-  return typeof (globalThis as unknown as { WebAssembly?: unknown }).WebAssembly === 'object';
-}
-
-// ── 狀態 ────────────────────────────────────────────────────────────────────
-
-interface AutoState {
-  loader: ArgonLoader;
-  kind: 'worker' | 'inline';
-  chainKey: string;
-  createWorker: ArgonCarrierOptions['createWorker'];
-  onFallback: ArgonCarrierOptions['onFallback'];
-  dispose(): void;
-}
-
-let auto: AutoState | null = null;
-let nodeVerified = false;
-const verified = new WeakSet<ArgonLoader>();
-let failures = 0;
-
-/** 載體終端失效累計（拋出派生本體的失效才計；回退成功不計）。vault 以前後差分辨
- *  「解包 null＝密語錯」與「載體失效」（低階 unwrap 吞錯回 null，邊界還原真因）。 */
-export function argonCarrierFailures(): number {
-  return failures;
-}
-
-/** 現行載體（未 ensure 過且無注入、非 node＝null）。 */
-export function currentArgonCarrier(): ArgonCarrierKind | null {
-  const cur = getArgonLoader();
-  if (cur) return auto && cur === auto.loader ? auto.kind : 'injected';
-  return nodeArgonAvailable() ? 'node' : null;
-}
-
-/** 撤除本模組自裝載體（呼叫端 setArgonLoader 注入不動）＋終止 Worker。 */
-export function resetArgonCarrier(): void {
-  if (!auto) return;
-  const a = auto;
-  auto = null;
-  if (getArgonLoader() === a.loader) setArgonLoader(null);
-  a.dispose();
-}
-
-// ── inline 載體（同執行緒 vendor hash-wasm；串行） ────────────────────────────
-
-function makeInlineArgon2id(): HashWasmArgon2id {
-  let mod: { argon2id: HashWasmArgon2id } | null = null;
-  let queue: Promise<unknown> = Promise.resolve();
-  return (params) => {
-    const job = queue.then(() => {
-      if (!mod) mod = hashWasmArgon2Factory();
-      return mod.argon2id(params);
-    });
-    queue = job.catch(() => undefined);
-    return job;
-  };
-}
-
-function terminal(e: unknown, what: string): VaultError {
-  failures++;
-  return new VaultError('ERR_VAULT_KDF_UNSUPPORTED', what, { cause: e });
-}
-
-function installInline(chainKey: string, opts: ArgonCarrierOptions): AutoState {
-  const inline = makeInlineArgon2id();
-  const argon2id: HashWasmArgon2id = async (params) => {
-    try { return await inline(params); } catch (e) { throw terminal(e, 'inline carrier failed'); }
-  };
-  const mod = { argon2id };
-  const st: AutoState = {
-    loader: () => Promise.resolve(mod),
-    kind: 'inline',
-    chainKey,
-    createWorker: opts.createWorker,
-    onFallback: opts.onFallback,
-    dispose: () => {},
-  };
-  return st;
-}
-
-function installWorker(chainKey: string, opts: ArgonCarrierOptions, fallbackInline: boolean): AutoState {
-  const w = makeWorkerArgon2id(opts.createWorker ?? createBlobArgonWorker);
-  let inline: HashWasmArgon2id | null = null;
-  const st: AutoState = {
-    loader: () => Promise.resolve(mod),
-    kind: 'worker',
-    chainKey,
-    createWorker: opts.createWorker,
-    onFallback: opts.onFallback,
-    dispose: () => w.terminate(),
-  };
-  const argon2id: HashWasmArgon2id = async (params) => {
-    if (st.kind === 'worker') {
-      try {
-        return await w.argon2id(params);
-      } catch (e) {
-        if (!fallbackInline) throw terminal(e, 'worker carrier failed (chain has no inline fallback)');
-        // 回退：整載體翻 inline（不再試 Worker）——顯形：kind 翻面＋onFallback 通知。
-        if (st.kind === 'worker') {
-          st.kind = 'inline';
-          w.terminate();
-          try { opts.onFallback?.({ from: 'worker', to: 'inline', error: e }); } catch { /* 通知面不影響派生 */ }
-        }
-      }
-    }
-    inline ??= makeInlineArgon2id();
-    try { return await inline(params); } catch (e) { throw terminal(e, 'inline carrier failed'); }
-  };
-  const mod = { argon2id };
-  return st;
-}
-
-async function katOrThrow(): Promise<void> {
-  let ok = false;
-  try { ok = await verifyArgonKat(); } catch (e) {
-    if (e instanceof VaultError) throw e;
-    throw terminal(e, 'carrier KAT threw');
-  }
-  if (!ok) throw terminal(null, 'carrier KAT mismatch (RFC 9106)');
-}
-
-/**
- * 確保 Argon2id 載體可用並回報種類。冪等：同選項重呼沿用既裝載體（Worker 不重建）；
- * 選項（chain／createWorker／onFallback）改變＝撤除重裝。首用載體必過 RFC 9106 KAT。
- */
-export async function ensureArgonCarrier(opts: ArgonCarrierOptions = {}): Promise<ArgonCarrierKind> {
-  const cur = getArgonLoader();
-  if (cur && (!auto || cur !== auto.loader)) {
-    // 呼叫端覆寫優先：自裝殘留（若有）撤除但不碰全域注入。
-    if (auto) { const a = auto; auto = null; a.dispose(); }
-    if (!verified.has(cur)) { await katOrThrow(); verified.add(cur); }
-    return 'injected';
-  }
-  const chain = opts.chain ?? DEFAULT_ARGON_CHAIN;
-  if (!Array.isArray(chain) || chain.length === 0 || !chain.every((c) => c === 'node' || c === 'worker' || c === 'inline')) {
-    throw new VaultError('ERR_VAULT_CONFIG', 'carrier.chain');
-  }
-  const chainKey = chain.join(',');
-  if (auto && cur === auto.loader && auto.chainKey === chainKey && auto.createWorker === opts.createWorker && auto.onFallback === opts.onFallback) {
-    return auto.kind;
-  }
-  resetArgonCarrier();
-  for (let i = 0; i < chain.length; i++) {
-    const choice = chain[i];
-    if (choice === 'node') {
-      if (!nodeArgonAvailable()) continue;
-      if (!nodeVerified) { await katOrThrow(); nodeVerified = true; }
-      return 'node';
-    }
-    if (choice === 'worker') {
-      if (!workerAvailable(opts)) continue;
-      const st = installWorker(chainKey, opts, chain.slice(i + 1).includes('inline') && wasmAvailable());
-      auto = st;
-      setArgonLoader(st.loader);
-      try { await katOrThrow(); } catch (e) { resetArgonCarrier(); throw e; }
-      return st.kind;
-    }
-    if (choice === 'inline') {
-      if (!wasmAvailable()) continue;
-      const st = installInline(chainKey, opts);
-      auto = st;
-      setArgonLoader(st.loader);
-      try { await katOrThrow(); } catch (e) { resetArgonCarrier(); throw e; }
-      return st.kind;
-    }
-  }
-  throw new VaultError('ERR_VAULT_KDF_UNSUPPORTED', 'no Argon2id carrier in chain [' + chainKey + ']');
-}

package/src/client/argon-worker.ts

@@ -1,147 +0,0 @@
-/**
- * argon-worker.ts — Argon2id Web Worker 載體：登入不卡畫面。
- *
- * Worker 本體＝內嵌 blob 形（免 bundle 步）：vendor 工廠 hashWasmArgon2Factory 的原文
- *（Function#toString）＋訊息膠水組成 Worker 源碼字串 → Blob → object URL → new Worker。
- * 協定：main → { id, password, salt, iterations, parallelism, memorySize, hashLength }；
- *       worker → { id, ok: true, out: Uint8Array } | { id, ok: false, error }。
- * 串行：main 端單一佇列（hash-wasm Argon2 禁並行——argon2.ts deriveKek2Argon 註同理），
- * worker 端亦以 promise 鏈串行（雙防線）。
- * 失敗態：建構拋出／error 事件／ok:false 回應＝本載體失效（dead），佇列內與後續請求一律 reject——
- * 回退與否由 argon-auto.ts 回退鏈決定（本檔不自帶回退，行為顯形）。
- */
-
-import type { HashWasmArgon2id } from './argon2.ts';
-import { hashWasmArgon2Factory } from './vendor/hash-wasm-argon2.ts';
-
-/** Worker 最小介面（瀏覽器 Worker 直接相容；node worker_threads 等可包轉接層注入）。 */
-export interface ArgonWorkerLike {
-  postMessage(message: unknown, transfer?: Transferable[]): void;
-  terminate(): void;
-  onmessage: ((ev: { data: unknown }) => void) | null;
-  onerror: ((ev: unknown) => void) | null;
-}
-
-/** Worker 源碼字串（self.onmessage 形；瀏覽器 DedicatedWorkerGlobalScope 語意）。 */
-export function argonWorkerSource(): string {
-  return [
-    "'use strict';",
-    'const factory = (' + hashWasmArgon2Factory.toString() + ');',
-    'let mod = null;',
-    'let q = Promise.resolve();',
-    'self.onmessage = (ev) => {',
-    '  const m = ev.data;',
-    '  q = q.then(async () => {',
-    '    try {',
-    '      if (!mod) mod = factory();',
-    "      const r = await mod.argon2id({ password: m.password, salt: m.salt, iterations: m.iterations, parallelism: m.parallelism, memorySize: m.memorySize, hashLength: m.hashLength, outputType: 'binary' });",
-    '      const out = new Uint8Array(r);',
-    '      self.postMessage({ id: m.id, ok: true, out }, [out.buffer]);',
-    '    } catch (e) {',
-    '      self.postMessage({ id: m.id, ok: false, error: String((e && e.message) || e) });',
-    '    }',
-    '  });',
-    '};',
-    '',
-  ].join('\n');
-}
-
-/** 瀏覽器預設 Worker 工廠：blob URL（CSP 需 worker-src blob:；不允許時建構拋出或 error 事件→回退鏈接手）。 */
-export function createBlobArgonWorker(): ArgonWorkerLike {
-  const url = URL.createObjectURL(new Blob([argonWorkerSource()], { type: 'text/javascript' }));
-  let w: Worker;
-  try {
-    w = new Worker(url);
-  } catch (e) {
-    URL.revokeObjectURL(url);
-    throw e;
-  }
-  const like: ArgonWorkerLike = {
-    postMessage: (m, t) => w.postMessage(m, t ?? []),
-    terminate: () => { w.terminate(); URL.revokeObjectURL(url); },
-    onmessage: null,
-    onerror: null,
-  };
-  w.onmessage = (ev) => like.onmessage?.({ data: ev.data });
-  w.onerror = (ev) => like.onerror?.(ev);
-  w.onmessageerror = (ev) => like.onerror?.(ev);
-  return like;
-}
-
-interface Pending {
-  resolve: (v: Uint8Array) => void;
-  reject: (e: unknown) => void;
-}
-
-/** Worker 載體：回 hash-wasm 同形 argon2id（argon2.ts ArgonLoader 契約）＋terminate。 */
-export function makeWorkerArgon2id(createWorker: () => ArgonWorkerLike): { argon2id: HashWasmArgon2id; terminate(): void } {
-  let worker: ArgonWorkerLike | null = null;
-  let dead: unknown = null;
-  let seq = 0;
-  const pending = new Map<number, Pending>();
-  let queue: Promise<unknown> = Promise.resolve();
-
-  const die = (e: unknown): void => {
-    if (!dead) dead = e ?? new Error('ERR_ARGON_WORKER_DEAD');
-    for (const p of pending.values()) p.reject(dead);
-    pending.clear();
-    if (worker) { try { worker.terminate(); } catch { /* 已終止 */ } }
-    worker = null;
-  };
-
-  const boot = (): ArgonWorkerLike => {
-    if (worker) return worker;
-    const w = createWorker();
-    w.onmessage = (ev) => {
-      const d = ev.data as { id?: number; ok?: boolean; out?: Uint8Array; error?: string } | null;
-      const p = d && typeof d.id === 'number' ? pending.get(d.id) : undefined;
-      if (!p || !d) return;
-      pending.delete(d.id!);
-      if (d.ok && d.out instanceof Uint8Array) p.resolve(d.out);
-      else {
-        const err = new Error('ERR_ARGON_WORKER: ' + (d.error ?? 'bad response'));
-        p.reject(err);
-        die(err); // ok:false＝worker 內 wasm 失效（CSP wasm-eval／記憶體）——整載體 dead，交回退鏈
-      }
-    };
-    w.onerror = (ev) => die(new Error('ERR_ARGON_WORKER_ERROR', { cause: ev }));
-    worker = w;
-    return w;
-  };
-
-  const run = (params: Parameters<HashWasmArgon2id>[0]): Promise<Uint8Array> =>
-    new Promise<Uint8Array>((resolve, reject) => {
-      if (dead) { reject(dead); return; }
-      let w: ArgonWorkerLike;
-      try { w = boot(); } catch (e) { die(e); reject(dead); return; }
-      const id = ++seq;
-      pending.set(id, { resolve, reject });
-      try {
-        w.postMessage({
-          id,
-          password: params.password,
-          salt: params.salt,
-          iterations: params.iterations,
-          parallelism: params.parallelism,
-          memorySize: params.memorySize,
-          hashLength: params.hashLength,
-        });
-      } catch (e) {
-        pending.delete(id);
-        die(e);
-        reject(dead);
-      }
-    });
-
-  const argon2id: HashWasmArgon2id = (params) => {
-    const job = queue.then(() => run(params));
-    queue = job.catch(() => undefined);
-    return job.then((out) => {
-      if (params.outputType === 'binary') return out;
-      if (params.outputType === 'hex') return Array.from(out).map((b) => b.toString(16).padStart(2, '0')).join('');
-      throw new Error('ERR_ARGON_WORKER_OUTPUT_TYPE');
-    });
-  };
-
-  return { argon2id, terminate: () => die(new Error('ERR_ARGON_WORKER_TERMINATED')) };
-}