Use the native implementation of crypto APIs (#8568)

Author: vicb

.changeset/rotten-monkeys-tan.md

@@ -0,0 +1,5 @@
+---
+"@cloudflare/unenv-preset": minor
+---
+
+Use the native implementation of crypto APIs

packages/unenv-preset/package.json

@@ -54,7 +54,7 @@
 	},
 	"peerDependencies": {
 		"unenv": "2.0.0-rc.15",
-		"workerd": "^1.20250310.0"
+		"workerd": "^1.20250311.0"
 	},
 	"peerDependenciesMeta": {
 		"workerd": {

packages/unenv-preset/src/runtime/node/crypto.ts

@@ -2,95 +2,69 @@
 // so extract it separately from the other exports
 import {
 	Cipher,
-	Cipheriv,
 	constants,
 	createCipher,
-	createCipheriv,
 	createDecipher,
-	createDecipheriv,
-	createECDH,
-	createSign,
-	createVerify,
 	Decipher,
-	Decipheriv,
-	diffieHellman,
-	ECDH,
-	getCipherInfo,
-	hash,
-	privateDecrypt,
-	privateEncrypt,
 	pseudoRandomBytes,
-	publicDecrypt,
-	publicEncrypt,
-	Sign,
-	sign,
 	webcrypto as unenvCryptoWebcrypto,
-	Verify,
-	verify,
 } from "unenv/node/crypto";
 import type nodeCrypto from "node:crypto";
 
-export {
-	Cipher,
-	Cipheriv,
-	Decipher,
-	Decipheriv,
-	ECDH,
-	Sign,
-	Verify,
-	constants,
-	createCipheriv,
-	createDecipheriv,
-	createECDH,
-	createSign,
-	createVerify,
-	diffieHellman,
-	getCipherInfo,
-	hash,
-	privateDecrypt,
-	privateEncrypt,
-	publicDecrypt,
-	publicEncrypt,
-	sign,
-	verify,
-} from "unenv/node/crypto";
+export { Cipher, constants, Decipher } from "unenv/node/crypto";
 
 const workerdCrypto = process.getBuiltinModule("node:crypto");
 
-// TODO: Ideally this list is not hardcoded but instead is generated when the preset is being generated in the `env()` call
-//       This generation should use information from https://github.com/cloudflare/workerd/issues/2097
 export const {
 	Certificate,
-	DiffieHellman,
-	DiffieHellmanGroup,
-	Hash,
-	Hmac,
-	KeyObject,
-	X509Certificate,
 	checkPrime,
 	checkPrimeSync,
+	// @ts-expect-error
+	Cipheriv,
+	createCipheriv,
+	createDecipheriv,
 	createDiffieHellman,
 	createDiffieHellmanGroup,
+	createECDH,
 	createHash,
 	createHmac,
 	createPrivateKey,
 	createPublicKey,
 	createSecretKey,
+	createSign,
+	createVerify,
+	// @ts-expect-error
+	Decipheriv,
+	diffieHellman,
+	DiffieHellman,
+	DiffieHellmanGroup,
+	ECDH,
+	fips,
 	generateKey,
 	generateKeyPair,
 	generateKeyPairSync,
 	generateKeySync,
 	generatePrime,
 	generatePrimeSync,
+	getCipherInfo,
 	getCiphers,
 	getCurves,
 	getDiffieHellman,
 	getFips,
 	getHashes,
+	getRandomValues,
+	hash,
+	Hash,
 	hkdf,
 	hkdfSync,
+	Hmac,
+	KeyObject,
 	pbkdf2,
 	pbkdf2Sync,
+	privateDecrypt,
+	privateEncrypt,
+	publicDecrypt,
+	publicEncrypt,
 	randomBytes,
 	randomFill,
 	randomFillSync,
@@ -101,27 +75,24 @@ export const {
 	secureHeapUsed,
 	setEngine,
 	setFips,
+	sign,
+	Sign,
 	subtle,
 	timingSafeEqual,
+	verify,
+	Verify,
+	X509Certificate,
 } = workerdCrypto;
 
-// Special case getRandomValues as it must be bound to the webcrypto object
-export const getRandomValues = workerdCrypto.getRandomValues.bind(
-	workerdCrypto.webcrypto
-);
-
+// See https://github.com/cloudflare/workerd/issues/3751
 export const webcrypto = {
-	// @ts-expect-error unenv has unknown type
+	// @ts-expect-error
 	CryptoKey: unenvCryptoWebcrypto.CryptoKey,
 	getRandomValues,
 	randomUUID,
 	subtle,
 } satisfies typeof nodeCrypto.webcrypto;
 
-// Node.js exposes fips only via the default export 🤷🏼‍♂️
-// so extract it separately from the other exports
-const fips = workerdCrypto.fips;
-
 export default {
 	/**
 	 * manually unroll unenv-polyfilled-symbols to make it tree-shakeable
@@ -137,35 +108,21 @@ export default {
 	X509Certificate,
 	// @ts-expect-error @types/node is out of date - this is a bug in typings
 	constants,
-	// @ts-expect-error unenv has unknown type
 	createCipheriv,
-	// @ts-expect-error unenv has unknown type
 	createDecipheriv,
-	// @ts-expect-error unenv has unknown type
 	createECDH,
-	// @ts-expect-error unenv has unknown type
 	createSign,
-	// @ts-expect-error unenv has unknown type
 	createVerify,
-	// @ts-expect-error unenv has unknown type
 	diffieHellman,
-	// @ts-expect-error unenv has unknown type
 	getCipherInfo,
-	// @ts-expect-error unenv has unknown type
 	hash,
-	// @ts-expect-error unenv has unknown type
 	privateDecrypt,
-	// @ts-expect-error unenv has unknown type
 	privateEncrypt,
-	// @ts-expect-error unenv has unknown type
 	publicDecrypt,
-	// @ts-expect-error unenv has unknown type
 	publicEncrypt,
 	scrypt,
 	scryptSync,
-	// @ts-expect-error unenv has unknown type
 	sign,
-	// @ts-expect-error unenv has unknown type
 	verify,
 
 	// default-only export from unenv