feat(amsg): /cloudflare 链路载荷加密改用 Web Crypto，免 nodejs_compat 打包

[Tosd0]

改了什么

@rei-standard/amsg-server/cloudflare 此前打包必须开 nodejs_compat（载荷 AES 加密还在用 node crypto），现在整条单用户 / Cloudflare 链路不再引用任何 Node 内建模块：

	改之前	改之后
esbuild --platform=neutral 打包	报 Could not resolve "crypto"	exit 0，产物 80KB，node: 引用 0
Cloudflare Dashboard 粘贴部署	需要 compatibility_flags = ["nodejs_compat"]	免 flag（示例 wrangler.toml 已同步去掉）

• lib/encryption.js 的 5 个导出（deriveUserEncryptionKey / encryptPayload / decryptPayload / encryptForStorage / decryptFromStorage）改为基于 globalThis.crypto.subtle，全部从同步变 async，仓内所有调用点（含测试）已补 await。
• randomUUID 改从 runtime-neutral 的 webcrypto-utils.js 获取；该文件新增 hex / 标准 base64 编解码 helper。
• 多租户入口（Netlify/Neon）行为不变；tenant/ 三个多租户专用文件按计划保留 node crypto（不在 cloudflare import 图里）。

线格式兼容（命门）

与旧实现逐字节兼容：payload 12 字节 IV + base64、storage 16 字节 IV + hex iv:authTag:data、authTag 分离存放、key 派生 sha256(masterKey+userId) 前 64 hex。宽容度也对齐旧的 Buffer.from / node decipher 行为：base64url 字母表（-/_）照收，96–128 位截断 authTag 照解。

回归测试（先在旧实现上跑绿钉住格式，port 后必须仍绿）

新增 test/encryption-compat.test.mjs（16 条），用独立的 node:crypto 参考实现做跨实现互通：

• node 加密 → 新实现解密；新实现加密 → node 解密（payload / storage 两种格式都覆盖）。
• 派生 key 与 createHash('sha256') 逐字符相等；IV/tag 长度与编码布局断言。
• base64url 字段、12 字节截断 tag 可解；<96 位 tag 拒收；篡改密文/authTag 必 reject。

全仓 5 包 500 测试全绿；neutral bundle 在 Node 里端到端冒烟通过（init → get-user-key（派生 key 与源码实现一致）→ 加密 schedule-message 201）。

发版

changeset amsg-server-webcrypto-encryption.md（@rei-standard/amsg-server minor）。合并后 next 预发布线上一档（→ 2.6.0-next.2）。注意：对直接 import 这 5 个加密函数的外部消费者是 sync→async 的行为变更，迁移注意已写进 changeset。

https://claude.ai/code/session_01JmwcPeEKQoJaMrsiCBB5Dt

[gemini-code-assist]

Code Review

This pull request migrates the encryption utilities from Node's crypto module to Web Crypto (globalThis.crypto.subtle), removing the need for the nodejs_compat flag on Cloudflare Workers. As a result, key derivation and encryption/decryption functions are now asynchronous, and all calling handlers and tests have been updated to use await. Additionally, a new compatibility test suite has been added to ensure byte-level compatibility with the old implementation. Feedback on these changes highlights two performance optimization opportunities: using chunked encoding in bytesToBase64 to avoid $O(N^2)$ string concatenation bottlenecks while removing dead fallback code, and using zero-copy subarray instead of slice when extracting the ciphertext and authentication tag in aesGcmSeal.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

Performance Bottleneck & Dead Code Elimination

1. Performance Bottleneck: The current implementation performs byte-by-byte string concatenation (bin += String.fromCharCode(bytes[i])), which is highly inefficient ($O(N^2)$ memory allocations) for larger payloads (such as encrypted task payloads or message histories). Using chunked String.fromCharCode.apply is significantly faster and avoids call stack overflow.
2. Dead Code Elimination: Since the project requires Node ≥ 19 and Cloudflare Workers (both of which have global btoa built-in), the fallback to Node's Buffer is dead code and can be safely removed. This also prevents bundlers from attempting to polyfill Buffer in neutral/browser environments.

export function bytesToBase64(buf) {
  const bytes = toUint8(buf);
  const CHUNK_SIZE = 0x1000;
  let bin = '';
  for (let i = 0; i < bytes.length; i += CHUNK_SIZE) {
    bin += String.fromCharCode.apply(null, bytes.subarray(i, i + CHUNK_SIZE));
  }
  return btoa(bin);
}

[gemini-code-assist]

Performance Optimization: Zero-Copy Subarray

Using sealed.slice copies the underlying ArrayBuffer twice to create new Uint8Array instances. Since the returned ciphertext and authTag are immediately encoded to base64/hex and then discarded, there is no risk of accidental mutation.

Using sealed.subarray creates a view over the existing buffer without copying the bytes, making it a zero-copy, highly efficient alternative.

Suggested change

	return {
	ciphertext: sealed.slice(0, sealed.length - TAG_LENGTH_BYTES),
	authTag: sealed.slice(sealed.length - TAG_LENGTH_BYTES)
	};
	return {
	ciphertext: sealed.subarray(0, sealed.length - TAG_LENGTH_BYTES),
	authTag: sealed.subarray(sealed.length - TAG_LENGTH_BYTES)
	};