@vex-chat/crypto 10.0.0 → 12.0.0

package/dist/index.js

@@ -3,8 +3,6 @@
  * Licensed under AGPL-3.0. See LICENSE for details.
  * Commercial licenses available at vex.wtf
  */
-import { numberToBytesBE } from "@noble/curves/abstract/utils";
-import { p256 } from "@noble/curves/p256";
 import { hkdf } from "@noble/hashes/hkdf.js";
 import { hmac } from "@noble/hashes/hmac.js";
 import { pbkdf2 as noblePbkdf2 } from "@noble/hashes/pbkdf2.js";
@@ -16,13 +14,11 @@ import ed2curve from "ed2curve";
 import { Packr } from "msgpackr";
 import nacl from "tweetnacl";
 import { z } from "zod/v4";
-function getWebCrypto() {
-    const cryptoCandidate = globalThis.crypto;
-    if (!isWebCryptoLike(cryptoCandidate)) {
-        throw new Error("Web Crypto API is not available in this runtime for fips profile operations.");
-    }
-    return cryptoCandidate;
-}
+const KEY_DATA_HEADER_BYTES = 54;
+const KEY_DATA_MAC_BYTES = 16;
+const KEY_DATA_PBKDF2_ITERATIONS = 220_000;
+const KEY_DATA_PBKDF2_MIN_ITERATIONS = 1_000;
+const KEY_DATA_PBKDF2_MAX_ITERATIONS = 2_000_000;
 function isWebCryptoLike(value) {
     if (typeof value !== "object" || value === null) {
         return false;
@@ -33,29 +29,27 @@ function isWebCryptoLike(value) {
         typeof value.subtle === "object" &&
         value.subtle !== null);
 }
-function randomBytesWebCrypto(length) {
-    if (!Number.isInteger(length) || length < 0) {
-        throw new Error(`Expected non-negative integer length, received ${String(length)}.`);
-    }
-    const cryptoImpl = getWebCrypto();
-    const result = new Uint8Array(length);
-    let offset = 0;
-    while (offset < length) {
-        const chunkLength = Math.min(65536, length - offset);
-        const chunk = result.subarray(offset, offset + chunkLength);
-        cryptoImpl.getRandomValues(chunk);
-        offset += chunkLength;
+async function pbkdf2Sha512Async(password, salt, iterations) {
+    const cryptoCandidate = globalThis.crypto;
+    if (!isWebCryptoLike(cryptoCandidate)) {
+        return noblePbkdf2(sha512, password, salt, {
+            c: iterations,
+            dkLen: 32,
+        });
     }
-    return result;
-}
-function unsupported(profile, operation) {
-    throw new Error(`Crypto profile "${profile}" does not implement ${operation} yet.`);
+    const passwordKey = await cryptoCandidate.subtle.importKey("raw", new TextEncoder().encode(password), "PBKDF2", false, ["deriveBits"]);
+    const bits = await cryptoCandidate.subtle.deriveBits({
+        hash: "SHA-512",
+        iterations,
+        name: "PBKDF2",
+        salt: new Uint8Array(salt),
+    }, passwordKey, 256);
+    return new Uint8Array(bits);
 }
 const tweetnaclProvider = {
     boxBefore: (myPrivateKey, theirPublicKey) => nacl.box.before(theirPublicKey, myPrivateKey),
     boxKeyPair: () => nacl.box.keyPair(),
     boxKeyPairFromSecret: (secretKey) => nacl.box.keyPair.fromSecretKey(secretKey),
-    profile: "tweetnacl",
     randomBytes: (length) => nacl.randomBytes(length),
     secretbox: (plaintext, nonce, key) => nacl.secretbox(plaintext, nonce, key),
     secretboxOpen: (ciphertext, nonce, key) => nacl.secretbox.open(ciphertext, nonce, key),
@@ -64,182 +58,8 @@ const tweetnaclProvider = {
     signKeyPairFromSecret: (secretKey) => nacl.sign.keyPair.fromSecretKey(secretKey),
     signOpen: (signedMessage, publicKey) => nacl.sign.open(signedMessage, publicKey),
 };
-const fipsProvider = {
-    boxBefore: (myPrivateKey, theirPublicKey) => {
-        void myPrivateKey;
-        void theirPublicKey;
-        return unsupported("fips", "xDH");
-    },
-    boxKeyPair: () => unsupported("fips", "xBoxKeyPair"),
-    boxKeyPairFromSecret: (secretKey) => {
-        void secretKey;
-        return unsupported("fips", "xBoxKeyPairFromSecret");
-    },
-    profile: "fips",
-    randomBytes: (length) => randomBytesWebCrypto(length),
-    secretbox: (plaintext, nonce, key) => {
-        void plaintext;
-        void nonce;
-        void key;
-        return unsupported("fips", "xSecretbox");
-    },
-    secretboxOpen: (ciphertext, nonce, key) => {
-        void ciphertext;
-        void nonce;
-        void key;
-        return unsupported("fips", "xSecretboxOpen");
-    },
-    sign: (message, secretKey) => {
-        void message;
-        void secretKey;
-        return unsupported("fips", "xSign");
-    },
-    signKeyPair: () => unsupported("fips", "xSignKeyPair"),
-    signKeyPairFromSecret: (secretKey) => {
-        void secretKey;
-        return unsupported("fips", "xSignKeyPairFromSecret");
-    },
-    signOpen: (signedMessage, publicKey) => {
-        void signedMessage;
-        void publicKey;
-        return unsupported("fips", "xSignOpen");
-    },
-};
-const providers = {
-    fips: fipsProvider,
-    tweetnacl: tweetnaclProvider,
-};
-let activeCryptoProfile = "tweetnacl";
-let activeCryptoProvider = providers[activeCryptoProfile];
-/** Returns the currently configured crypto profile. */
-export function getCryptoProfile() {
-    return activeCryptoProfile;
-}
-/**
- * Sets the runtime crypto profile.
- *
- * `tweetnacl` preserves existing behavior.
- * `fips` currently enables only backend-agnostic helpers; NaCl-coupled
- * primitives throw until a FIPS backend implementation is wired in.
- */
-export function setCryptoProfile(profile) {
-    activeCryptoProfile = profile;
-    activeCryptoProvider = providers[profile];
-}
-const cryptoProfileScopeStack = [];
-/**
- * Saves the current profile and switches to `profile`. Pair every call with
- * {@link leaveCryptoProfileScope} in a `finally` block.
- *
- * **Why:** `setCryptoProfile` is process-wide. Several async libvex `Client`s
- * can overlap on `readMail`; a naive save/restore in `finally` can reset the
- * profile while another client still needs FIPS — `xSecretboxOpenAsync` then
- * reads `tweetnacl` and fails to decrypt AES-GCM payloads. Nesting this stack
- * fixes that.
- */
-export function enterCryptoProfileScope(profile) {
-    cryptoProfileScopeStack.push(activeCryptoProfile);
-    setCryptoProfile(profile);
-}
-/** Restores the profile saved by the innermost {@link enterCryptoProfileScope}. */
-export function leaveCryptoProfileScope() {
-    const prev = cryptoProfileScopeStack.pop();
-    if (prev === undefined) {
-        throw new Error("leaveCryptoProfileScope called without a matching enterCryptoProfileScope");
-    }
-    setCryptoProfile(prev);
-}
-function bytesToBase64Url(bytes) {
-    return globalThis
-        .btoa(String.fromCodePoint(...Array.from(bytes)))
-        .replace(/\+/g, "-")
-        .replace(/\//g, "_")
-        .replace(/=+/g, "");
-}
-function concatBytes(a, b) {
-    const out = new Uint8Array(a.length + b.length);
-    out.set(a, 0);
-    out.set(b, a.length);
-    return out;
-}
-function decodeFipsSignedMessage(signedMessage) {
-    if (signedMessage.length < 2) {
-        throw new Error("Invalid FIPS signed message: missing signature length prefix.");
-    }
-    const signatureLength = (signedMessage[0] ?? 0) * 256 + (signedMessage[1] ?? 0);
-    const signatureStart = 2;
-    const signatureEnd = signatureStart + signatureLength;
-    if (signedMessage.length < signatureEnd) {
-        throw new Error("Invalid FIPS signed message: signature length exceeds message length.");
-    }
-    return {
-        message: signedMessage.slice(signatureEnd),
-        signature: signedMessage.slice(signatureStart, signatureEnd),
-    };
-}
-function encodeFipsSignedMessage(signature, message) {
-    if (signature.length > 65535) {
-        throw new Error("FIPS signature too long to encode.");
-    }
-    const prefix = new Uint8Array(2);
-    prefix[0] = (signature.length >> 8) & 0xff;
-    prefix[1] = signature.length & 0xff;
-    return concatBytes(concatBytes(prefix, signature), message);
-}
-async function fipsEcdhKeyPairFrom32ByteSeed(secretKey, subtle) {
-    if (secretKey.length !== 32) {
-        throw new Error("FIPS: expected a 32-byte IKM/seed for ECDH from-secret.");
-    }
-    const d = p256.utils.normPrivateKeyToScalar(Uint8Array.from(secretKey));
-    const d32 = numberToBytesBE(d, 32);
-    const rawPub = p256.getPublicKey(d, false);
-    if (rawPub[0] !== 0x04) {
-        throw new Error("FIPS: expected uncompressed P-256 public key.");
-    }
-    const jwk = {
-        crv: "P-256",
-        d: bytesToBase64Url(d32),
-        kty: "EC",
-        x: bytesToBase64Url(rawPub.subarray(1, 33)),
-        y: bytesToBase64Url(rawPub.subarray(33, 65)),
-    };
-    const ecdhPriv = await subtle.importKey("jwk", jwk, { name: "ECDH", namedCurve: "P-256" }, true, ["deriveBits"]);
-    const ecdhPubJwk = await subtle.exportKey("jwk", ecdhPriv);
-    const ecdhPubJwkNoD = { ...ecdhPubJwk };
-    delete ecdhPubJwkNoD.d;
-    ecdhPubJwkNoD.key_ops = [];
-    const ecdhPub = await subtle.importKey("jwk", ecdhPubJwkNoD, { name: "ECDH", namedCurve: "P-256" }, true, []);
-    return {
-        publicKey: new Uint8Array(await subtle.exportKey("raw", ecdhPub)),
-        secretKey: new Uint8Array(await subtle.exportKey("pkcs8", ecdhPriv)),
-    };
-}
-async function fipsEcdhKeyPairFromPkcs8(secretKey, subtle) {
-    const ecdhPriv = await subtle.importKey("pkcs8", toBufferSource(secretKey), { name: "ECDH", namedCurve: "P-256" }, true, ["deriveBits"]);
-    const jwk = await subtle.exportKey("jwk", ecdhPriv);
-    const ecdhPubJwk = { ...jwk };
-    delete ecdhPubJwk.d;
-    ecdhPubJwk.key_ops = [];
-    const ecdhPub = await subtle.importKey("jwk", ecdhPubJwk, { name: "ECDH", namedCurve: "P-256" }, true, []);
-    return {
-        publicKey: new Uint8Array(await subtle.exportKey("raw", ecdhPub)),
-        secretKey: new Uint8Array(await subtle.exportKey("pkcs8", ecdhPriv)),
-    };
-}
-function getSubtleCrypto() {
-    return getWebCrypto().subtle;
-}
 function provider() {
-    return activeCryptoProvider;
-}
-function requireAesGcmNonce(nonce) {
-    if (nonce.length < 12) {
-        throw new Error(`AES-GCM requires a nonce of at least 12 bytes, received ${String(nonce.length)}.`);
-    }
-    return nonce.slice(0, 12);
-}
-function toBufferSource(bytes) {
-    return Uint8Array.from(bytes).buffer;
+    return tweetnaclProvider;
 }
 // msgpackr with useRecords:false emits standard msgpack (no nonstandard record extension).
 // moreTypes:false keeps the extension set to only what other decoders understand.
@@ -266,8 +86,8 @@ export class XUtils {
      * Checks if two buffer-like objects are equal.
      * When lengths match, comparison is constant-time in the inputs (no early exit on first differing byte).
      *
-     * @param buf1
-     * @param buf2
+     * @param buf1 - First buffer to compare.
+     * @param buf2 - Second buffer to compare.
      *
      * @returns True if equal, else false.
      */
@@ -297,19 +117,25 @@ export class XUtils {
         if (hexString.length === 0) {
             return new Uint8Array();
         }
-        const matches = hexString.match(/.{1,2}/g) ?? [];
-        return new Uint8Array(matches.map((byte) => parseInt(byte, 16)));
+        if (hexString.length % 2 !== 0 || !/^[0-9a-fA-F]+$/.test(hexString)) {
+            throw new Error("Expected an even-length hexadecimal string.");
+        }
+        const bytes = new Uint8Array(hexString.length / 2);
+        for (let i = 0; i < bytes.length; i += 1) {
+            bytes[i] = Number.parseInt(hexString.slice(i * 2, i * 2 + 2), 16);
+        }
+        return bytes;
     }
     /**
      * Decrypts a secret key from the binary format produced by encryptKeyData().
      * No I/O — the caller handles reading the data.
      *
-     * @param keyData The encrypted key data as a Uint8Array.
-     * @param password The password used to encrypt.
+     * @param keyData - The encrypted key data as a Uint8Array.
+     * @param password - The password used to encrypt.
      * @returns The hex-encoded secret key.
      */
     static decryptKeyData = (keyData, password) => {
-        const ITERATIONS = XUtils.uint8ArrToNumber(keyData.slice(0, 6));
+        const ITERATIONS = XUtils.readKeyDataIterations(keyData);
         const PKBDF_SALT = keyData.slice(6, 30);
         const ENCRYPTION_NONCE = keyData.slice(30, 54);
         const ENCRYPTED_KEY = keyData.slice(54);
@@ -317,47 +143,48 @@ export class XUtils {
             c: ITERATIONS,
             dkLen: 32,
         });
-        const DECRYPTED_SIGNKEY = provider().secretboxOpen(ENCRYPTED_KEY, ENCRYPTION_NONCE, DERIVED_KEY);
-        if (DECRYPTED_SIGNKEY === null) {
-            throw new Error("Decryption failed. Wrong password?");
+        try {
+            const DECRYPTED_SIGNKEY = provider().secretboxOpen(ENCRYPTED_KEY, ENCRYPTION_NONCE, DERIVED_KEY);
+            if (DECRYPTED_SIGNKEY === null) {
+                throw new Error("Decryption failed. Wrong password?");
+            }
+            const decryptedHex = XUtils.encodeHex(DECRYPTED_SIGNKEY);
+            DECRYPTED_SIGNKEY.fill(0);
+            return decryptedHex;
+        }
+        finally {
+            DERIVED_KEY.fill(0);
         }
-        return XUtils.encodeHex(DECRYPTED_SIGNKEY);
     };
-    /**
-     * Async variant of decryptKeyData for cross-runtime/FIPS backends.
-     * Supports both profile formats emitted by encryptKeyDataAsync.
-     */
+    /** Async variant of decryptKeyData for cross-runtime callers. */
     static decryptKeyDataAsync = async (keyData, password) => {
-        const ITERATIONS = XUtils.uint8ArrToNumber(keyData.slice(0, 6));
+        const ITERATIONS = XUtils.readKeyDataIterations(keyData);
         const PKBDF_SALT = keyData.slice(6, 30);
         const ENCRYPTION_NONCE = keyData.slice(30, 54);
         const ENCRYPTED_KEY = keyData.slice(54);
-        const DERIVED_KEY = noblePbkdf2(sha512, password, PKBDF_SALT, {
-            c: ITERATIONS,
-            dkLen: 32,
-        });
-        const decrypted = activeCryptoProfile === "fips"
-            ? await xSecretboxOpenAsync(ENCRYPTED_KEY, ENCRYPTION_NONCE, DERIVED_KEY)
-            : xSecretboxOpen(ENCRYPTED_KEY, ENCRYPTION_NONCE, DERIVED_KEY);
-        if (decrypted === null) {
-            throw new Error("Decryption failed. Wrong password?");
+        const DERIVED_KEY = await pbkdf2Sha512Async(password, PKBDF_SALT, ITERATIONS);
+        try {
+            const decrypted = xSecretboxOpen(ENCRYPTED_KEY, ENCRYPTION_NONCE, DERIVED_KEY);
+            if (decrypted === null) {
+                throw new Error("Decryption failed. Wrong password?");
+            }
+            const decryptedHex = XUtils.encodeHex(decrypted);
+            decrypted.fill(0);
+            return decryptedHex;
+        }
+        finally {
+            DERIVED_KEY.fill(0);
         }
-        return XUtils.encodeHex(decrypted);
     };
     /**
-     * 32-byte AES-256 key for local at-rest encryption (e.g. sqlite) derived from
-     * identity `secretKey`. For `tweetnacl` this is the 32-byte X25519 private key.
-     * For `fips` the identity secret is PKCS#8; HKDF is applied so AES keys never
-     * equal the raw private key material.
+     * Derive a purpose-separated 32-byte key for local at-rest encryption.
+     * The result never aliases raw identity-key bytes.
      */
-    static deriveLocalAtRestAesKey(identitySk, profile) {
-        if (profile === "tweetnacl") {
-            if (identitySk.length < 32) {
-                throw new Error("Expected at least 32 bytes of identity secret in tweetnacl mode.");
-            }
-            return identitySk.subarray(0, 32);
+    static deriveLocalAtRestAesKey(identitySk) {
+        if (identitySk.length < 32) {
+            throw new Error("Expected at least 32 bytes of identity secret.");
         }
-        return new Uint8Array(hkdf(sha256, identitySk, new Uint8Array(0), new TextEncoder().encode("vex:at-rest:2.1.0-fips"), 32));
+        return new Uint8Array(hkdf(sha256, identitySk, new Uint8Array(0), new TextEncoder().encode("vex:at-rest:3:tweetnacl"), 32));
     }
     /**
      * Returns the empty header (32 0's)
@@ -382,19 +209,14 @@ export class XUtils {
      *
      * Format: [iterations(6)|salt(24)|nonce(24)|ciphertext(N)]
      *
-     * @param password The password to derive the encryption key from.
-     * @param keyToSave The hex-encoded secret key to encrypt.
-     * @param iterationOverride Optional PBKDF2 iteration count (random if omitted).
+     * @param password - The password to derive the encryption key from.
+     * @param keyToSave - The hex-encoded secret key to encrypt.
+     * @param iterationOverride - Optional PBKDF2 iteration count (220,000 if omitted).
      * @returns The encrypted key data as a Uint8Array.
      */
     static encryptKeyData = (password, keyToSave, iterationOverride) => {
         const UNENCRYPTED_SIGNKEY = XUtils.decodeHex(keyToSave);
-        const OFFSET = 1000;
-        const rand = provider().randomBytes(2);
-        const [N1 = 0, N2 = 0] = rand;
-        const iterations = iterationOverride !== undefined && iterationOverride !== 0
-            ? iterationOverride
-            : N1 * N2 + OFFSET;
+        const iterations = XUtils.validateKeyDataIterations(iterationOverride ?? KEY_DATA_PBKDF2_ITERATIONS);
         const ITERATIONS = XUtils.numberToUint8Arr(iterations);
         const PKBDF_SALT = xMakeNonce();
         const ENCRYPTION_KEY = noblePbkdf2(sha512, password, PKBDF_SALT, {
@@ -402,7 +224,14 @@ export class XUtils {
             dkLen: 32,
         });
         const NONCE = xMakeNonce();
-        const ENCRYPTED_SIGNKEY = provider().secretbox(UNENCRYPTED_SIGNKEY, NONCE, ENCRYPTION_KEY);
+        let ENCRYPTED_SIGNKEY;
+        try {
+            ENCRYPTED_SIGNKEY = provider().secretbox(UNENCRYPTED_SIGNKEY, NONCE, ENCRYPTION_KEY);
+        }
+        finally {
+            ENCRYPTION_KEY.fill(0);
+            UNENCRYPTED_SIGNKEY.fill(0);
+        }
         const result = new Uint8Array(ITERATIONS.length +
             PKBDF_SALT.length +
             NONCE.length +
@@ -417,28 +246,22 @@ export class XUtils {
         result.set(ENCRYPTED_SIGNKEY, offset);
         return result;
     };
-    /**
-     * Async variant of encryptKeyData for cross-runtime/FIPS backends.
-     * Format remains [iterations(6)|salt(24)|nonce(24)|ciphertext(N)].
-     */
+    /** Async variant of encryptKeyData for cross-runtime callers. */
     static encryptKeyDataAsync = async (password, keyToSave, iterationOverride) => {
         const UNENCRYPTED_SIGNKEY = XUtils.decodeHex(keyToSave);
-        const OFFSET = 1000;
-        const rand = xRandomBytes(2);
-        const [N1 = 0, N2 = 0] = rand;
-        const iterations = iterationOverride !== undefined && iterationOverride !== 0
-            ? iterationOverride
-            : N1 * N2 + OFFSET;
+        const iterations = XUtils.validateKeyDataIterations(iterationOverride ?? KEY_DATA_PBKDF2_ITERATIONS);
         const ITERATIONS = XUtils.numberToUint8Arr(iterations);
         const PKBDF_SALT = xMakeNonce();
-        const ENCRYPTION_KEY = noblePbkdf2(sha512, password, PKBDF_SALT, {
-            c: iterations,
-            dkLen: 32,
-        });
+        const ENCRYPTION_KEY = await pbkdf2Sha512Async(password, PKBDF_SALT, iterations);
         const NONCE = xMakeNonce();
-        const ENCRYPTED_SIGNKEY = activeCryptoProfile === "fips"
-            ? await xSecretboxAsync(UNENCRYPTED_SIGNKEY, NONCE, ENCRYPTION_KEY)
-            : xSecretbox(UNENCRYPTED_SIGNKEY, NONCE, ENCRYPTION_KEY);
+        let ENCRYPTED_SIGNKEY;
+        try {
+            ENCRYPTED_SIGNKEY = xSecretbox(UNENCRYPTED_SIGNKEY, NONCE, ENCRYPTION_KEY);
+        }
+        finally {
+            ENCRYPTION_KEY.fill(0);
+            UNENCRYPTED_SIGNKEY.fill(0);
+        }
         const result = new Uint8Array(ITERATIONS.length +
             PKBDF_SALT.length +
             NONCE.length +
@@ -458,7 +281,7 @@ export class XUtils {
      * The integer must be positive, and it must be able to be stored
      * in six bytes.
      *
-     * @param n The number to convert.
+     * @param n - The number to convert.
      * @returns The Uint8Array representation of n.
      */
     static numberToUint8Arr(n) {
@@ -475,8 +298,8 @@ export class XUtils {
     /**
      * Packs a javascript object and a 32 byte header into a vex message.
      *
-     * @param msg Message body (msgpack-serialized).
-     * @param header Optional 32-byte header; defaults to an empty header.
+     * @param msg - Message body (msgpack-serialized).
+     * @param header - Optional 32-byte header; defaults to an empty header.
      * @returns the packed message.
      */
     static packMessage(msg, header) {
@@ -487,7 +310,7 @@ export class XUtils {
     /**
      * Converts a Uint8Array representation of an integer back into a number.
      *
-     * @param arr The array to convert.
+     * @param arr - The array to convert.
      * @returns the number representation of arr.
      */
     static uint8ArrToNumber(arr) {
@@ -501,7 +324,7 @@ export class XUtils {
      * Takes a vex message and unpacks it into its header and a javascript object
      * representation of its body.
      *
-     * @param msg Full wire message (32-byte header + msgpack body).
+     * @param msg - Full wire message (32-byte header + msgpack body).
      * @returns [32 byte header, message body]
      */
     static unpackMessage(msg) {
@@ -518,26 +341,58 @@ export class XUtils {
             .parse(raw);
         return [msgh, msgb];
     }
+    static readKeyDataIterations(keyData) {
+        if (keyData.length < KEY_DATA_HEADER_BYTES + KEY_DATA_MAC_BYTES) {
+            throw new Error("Encrypted key data is truncated.");
+        }
+        return XUtils.validateKeyDataIterations(XUtils.uint8ArrToNumber(keyData.slice(0, 6)));
+    }
+    static validateKeyDataIterations(iterations) {
+        if (!Number.isSafeInteger(iterations) ||
+            iterations < KEY_DATA_PBKDF2_MIN_ITERATIONS ||
+            iterations > KEY_DATA_PBKDF2_MAX_ITERATIONS) {
+            throw new Error(`PBKDF2 iterations must be between ${String(KEY_DATA_PBKDF2_MIN_ITERATIONS)} and ${String(KEY_DATA_PBKDF2_MAX_ITERATIONS)}.`);
+        }
+        return iterations;
+    }
 }
 /**
  * Returns a 32 byte HMAC of a javscript object.
  *
- * @param msg the message to create the HMAC of
- * @param SK the secret key to create the HMAC with
+ * @param msg - The message to create the HMAC of.
+ * @param SK - The secret key to create the HMAC with.
  */
 export function xHMAC(msg, SK) {
     const packedMsg = msgpackEncode(msg);
     return hmac(sha256, SK, packedMsg);
 }
+/** Derive independent payload-encryption and envelope-authentication keys. */
+export function xMessageKeySubkeys(messageKey) {
+    if (messageKey.length < 32) {
+        throw new Error("Message keys must contain at least 32 bytes.");
+    }
+    return {
+        authenticationKey: hmac(sha256, messageKey, XUtils.decodeUTF8("vex:message:auth:v1")),
+        encryptionKey: hmac(sha256, messageKey, XUtils.decodeUTF8("vex:message:encryption:v1")),
+    };
+}
 /**
  * Gets a word list representation of a byte sequence.
  *
- * @param entropy The bytes to derive the wordlist from.
- * @param wordList Optional, override the wordlist. See bip39 docs for details.
+ * @param entropy - The bytes to derive the wordlist from.
+ * @param wordList - Optional override for the wordlist. See bip39 docs for details.
  */
 export function xMnemonic(entropy, wordList) {
     return bip39.entropyToMnemonic(XUtils.encodeHex(entropy), wordList);
 }
+/** Domain-separated payload signed for X3DH signed and one-time prekeys. */
+export function xPreKeySignaturePayload(publicKey, kind) {
+    if (publicKey.length === 0) {
+        throw new Error("Prekey public key cannot be empty.");
+    }
+    const separator = new Uint8Array([0]);
+    return xConcat(XUtils.decodeUTF8("vex:x3dh:prekey:v2"), separator, XUtils.decodeUTF8("tweetnacl"), separator, XUtils.decodeUTF8(kind), separator, publicKey);
+}
 /**
  * Constants for vex.
  */
@@ -549,68 +404,28 @@ export const xConstants = {
     KEY_LENGTH: 32,
     MIN_OTK_SUPPLY: 100,
 };
-/**
- * FIPS: `device.signKey` in the database is the P-256 ECDSA public key (SPKI),
- * used for account/device signature verification. X3DH on the client expects
- * the same curve point as Web Crypto "raw" P-256 ECDH public bytes for
- * `importEcdhPublicKey`. This converts SPKI → raw without a private key.
- */
-export async function fipsEcdhRawPublicKeyFromEcdsaSpkiAsync(ecdsaSpki) {
-    if (ecdsaSpki.length === 0) {
-        throw new Error("FIPS: empty ECDSA SPKI.");
-    }
-    const subtle = getSubtleCrypto();
-    const ecdsaPub = await importEcdsaPublicKey(ecdsaSpki);
-    const jwk = await subtle.exportKey("jwk", ecdsaPub);
-    if (jwk.x === undefined ||
-        jwk.y === undefined ||
-        jwk.x.length === 0 ||
-        jwk.y.length === 0) {
-        throw new Error("FIPS: could not export ECDSA public as JWK.");
-    }
-    const ecdhJwk = { ...jwk };
-    delete ecdhJwk.d;
-    ecdhJwk.key_ops = [];
-    ecdhJwk.ext = true;
-    const ecdhPub = await subtle.importKey("jwk", ecdhJwk, { name: "ECDH", namedCurve: "P-256" }, true, []);
-    return new Uint8Array(await subtle.exportKey("raw", ecdhPub));
-}
 /** Generate a fresh X25519 box key pair. */
 export function xBoxKeyPair() {
     return provider().boxKeyPair();
 }
-/** Async box keypair generation for the active profile. */
-export async function xBoxKeyPairAsync() {
-    if (activeCryptoProfile === "tweetnacl") {
-        return xBoxKeyPair();
-    }
-    const subtle = getSubtleCrypto();
-    const pair = await subtle.generateKey({ name: "ECDH", namedCurve: "P-256" }, true, ["deriveBits"]);
-    return {
-        publicKey: new Uint8Array(await subtle.exportKey("raw", pair.publicKey)),
-        secretKey: new Uint8Array(await subtle.exportKey("pkcs8", pair.privateKey)),
-    };
+/** Async X25519 box keypair generation. */
+export function xBoxKeyPairAsync() {
+    return Promise.resolve(xBoxKeyPair());
 }
 /** Restore an X25519 box key pair from a 32-byte secret key. */
 export function xBoxKeyPairFromSecret(secretKey) {
     return provider().boxKeyPairFromSecret(secretKey);
 }
 // ── Key pair type ───────────────────────────────────────────────────────────
-/** Async box key restore from private key material. */
-export async function xBoxKeyPairFromSecretAsync(secretKey) {
-    if (activeCryptoProfile === "tweetnacl") {
-        return xBoxKeyPairFromSecret(secretKey);
-    }
-    if (secretKey.length === 32) {
-        return fipsEcdhKeyPairFrom32ByteSeed(secretKey, getSubtleCrypto());
-    }
-    return fipsEcdhKeyPairFromPkcs8(secretKey, getSubtleCrypto());
+/** Async X25519 box key restore from private key material. */
+export function xBoxKeyPairFromSecretAsync(secretKey) {
+    return Promise.resolve(xBoxKeyPairFromSecret(secretKey));
 }
 // ── Key generation ─────────────────────────────────────────────────────────
 /**
  * Concatanates multiple Uint8Arrays.
  *
- * @param arrays As many Uint8Arrays as you would like to concatanate.
+ * @param arrays - The Uint8Arrays to concatenate.
  */
 export function xConcat(...arrays) {
     const totalLength = arrays.reduce((acc, value) => acc + value.length, 0);
@@ -631,51 +446,16 @@ export function xConcat(...arrays) {
  * Derives a shared Secret Key from a known private key and
  * a peer's known public key.
  *
- * @param myPrivateKey Your own private key
- * @param theirPublicKey Their public key
+ * @param myPrivateKey - Your own private key.
+ * @param theirPublicKey - Their public key.
  * @returns The derived shared secret, SK.
  */
 export function xDH(myPrivateKey, theirPublicKey) {
     return provider().boxBefore(myPrivateKey, theirPublicKey);
 }
-/** Async DH for cross-runtime/FIPS backends. */
-export async function xDHAsync(myPrivateKey, theirPublicKey) {
-    if (activeCryptoProfile === "tweetnacl") {
-        return xDH(myPrivateKey, theirPublicKey);
-    }
-    const subtle = getSubtleCrypto();
-    const privateKey = await importEcdhPrivateKey(myPrivateKey);
-    const publicKey = await importEcdhPublicKey(theirPublicKey);
-    const shared = await subtle.deriveBits({ name: "ECDH", public: publicKey }, privateKey, 256);
-    return new Uint8Array(shared);
-}
-/**
- * In `fips` mode only: derive a P-256 ECDH `KeyPair` (raw public + pkcs8 secret)
- * from a P-256 ECDSA `KeyPair` (spki + pkcs8) using the same private scalar in Web Crypto.
- * In `tweetnacl` mode, use `XKeyConvert.convertKeyPair` to map Ed25519 → X25519 instead.
- */
-export async function xEcdhKeyPairFromEcdsaKeyPairAsync(sign) {
-    if (activeCryptoProfile === "tweetnacl") {
-        return Promise.reject(new Error('xEcdhKeyPairFromEcdsaKeyPairAsync is for crypto profile "fips" only. Use XKeyConvert.convertKeyPair in tweetnacl mode.'));
-    }
-    const subtle = getSubtleCrypto();
-    const ecdsaPriv = await importEcdsaPrivateKey(sign.secretKey);
-    const jwk = await subtle.exportKey("jwk", ecdsaPriv);
-    if (typeof jwk.d !== "string" || jwk.d.length === 0) {
-        throw new Error("FIPS: could not export ECDSA private as JWK.");
-    }
-    const ecdhJwk = { ...jwk, key_ops: ["deriveBits"] };
-    ecdhJwk.ext = true;
-    const ecdhPriv = await subtle.importKey("jwk", ecdhJwk, { name: "ECDH", namedCurve: "P-256" }, true, ["deriveBits"]);
-    const ecdhPubJwk = await subtle.exportKey("jwk", ecdhPriv);
-    const ecdhPubJwkNoD = { ...ecdhPubJwk };
-    delete ecdhPubJwkNoD.d;
-    ecdhPubJwkNoD.key_ops = [];
-    const ecdhPub = await subtle.importKey("jwk", ecdhPubJwkNoD, { name: "ECDH", namedCurve: "P-256" }, true, []);
-    return {
-        publicKey: new Uint8Array(await subtle.exportKey("raw", ecdhPub)),
-        secretKey: new Uint8Array(await subtle.exportKey("pkcs8", ecdhPriv)),
-    };
+/** Async X25519 DH. */
+export function xDHAsync(myPrivateKey, theirPublicKey) {
+    return Promise.resolve(xDH(myPrivateKey, theirPublicKey));
 }
 // ── Signing ────────────────────────────────────────────────────────────────
 /**
@@ -714,7 +494,7 @@ export function xEncode(curveType, publicKey) {
 /**
  * Hashes some data.
  *
- * @param data the data to hash.
+ * @param data - The data to hash.
  * @returns The hash of the data.
  */
 export function xHash(data) {
@@ -739,119 +519,49 @@ export function xRandomBytes(length) {
 export function xSecretbox(plaintext, nonce, key) {
     return provider().secretbox(plaintext, nonce, key);
 }
-/** Async authenticated encryption for cross-runtime/FIPS backends. */
-export async function xSecretboxAsync(plaintext, nonce, key) {
-    if (activeCryptoProfile === "tweetnacl") {
-        return xSecretbox(plaintext, nonce, key);
-    }
-    const subtle = getSubtleCrypto();
-    const iv = requireAesGcmNonce(nonce);
-    const aesKey = await importAesKey(key, ["encrypt"]);
-    const ciphertext = await subtle.encrypt({ iv: toBufferSource(iv), name: "AES-GCM" }, aesKey, toBufferSource(plaintext));
-    return new Uint8Array(ciphertext);
+/** Async XSalsa20-Poly1305 encryption. */
+export function xSecretboxAsync(plaintext, nonce, key) {
+    return Promise.resolve(xSecretbox(plaintext, nonce, key));
 }
 /** Decrypt with a shared secret key. Returns null if authentication fails. */
 export function xSecretboxOpen(ciphertext, nonce, key) {
     return provider().secretboxOpen(ciphertext, nonce, key);
 }
-/** Async authenticated decryption for cross-runtime/FIPS backends. */
-export async function xSecretboxOpenAsync(ciphertext, nonce, key) {
-    if (activeCryptoProfile === "tweetnacl") {
-        return xSecretboxOpen(ciphertext, nonce, key);
-    }
-    const subtle = getSubtleCrypto();
-    const iv = requireAesGcmNonce(nonce);
-    const aesKey = await importAesKey(key, ["decrypt"]);
-    try {
-        const plaintext = await subtle.decrypt({ iv: toBufferSource(iv), name: "AES-GCM" }, aesKey, toBufferSource(ciphertext));
-        return new Uint8Array(plaintext);
-    }
-    catch {
-        return null;
-    }
+/** Async XSalsa20-Poly1305 decryption. */
+export function xSecretboxOpenAsync(ciphertext, nonce, key) {
+    return Promise.resolve(xSecretboxOpen(ciphertext, nonce, key));
 }
 /** Sign a message with an Ed25519 secret key. Returns signed message (64-byte signature prefix + message). */
 export function xSign(message, secretKey) {
     return provider().sign(message, secretKey);
 }
-/** Async signing for cross-runtime/FIPS backends. */
-export async function xSignAsync(message, secretKey) {
-    if (activeCryptoProfile === "tweetnacl") {
-        return xSign(message, secretKey);
-    }
-    const subtle = getSubtleCrypto();
-    const privateKey = await importEcdsaPrivateKey(secretKey);
-    const signature = new Uint8Array(await subtle.sign({ hash: "SHA-256", name: "ECDSA" }, privateKey, toBufferSource(message)));
-    return encodeFipsSignedMessage(signature, message);
+/** Async Ed25519 signing. */
+export function xSignAsync(message, secretKey) {
+    return Promise.resolve(xSign(message, secretKey));
 }
 /** Generate a fresh Ed25519 signing key pair. */
 export function xSignKeyPair() {
     return provider().signKeyPair();
 }
-/** Async keypair generation for the active profile. */
-export async function xSignKeyPairAsync() {
-    if (activeCryptoProfile === "tweetnacl") {
-        return xSignKeyPair();
-    }
-    const subtle = getSubtleCrypto();
-    const pair = await subtle.generateKey({ name: "ECDSA", namedCurve: "P-256" }, true, ["sign", "verify"]);
-    return {
-        publicKey: new Uint8Array(await subtle.exportKey("spki", pair.publicKey)),
-        secretKey: new Uint8Array(await subtle.exportKey("pkcs8", pair.privateKey)),
-    };
+/** Async Ed25519 keypair generation. */
+export function xSignKeyPairAsync() {
+    return Promise.resolve(xSignKeyPair());
 }
 /** Restore an Ed25519 signing key pair from a 64-byte secret key. */
 export function xSignKeyPairFromSecret(secretKey) {
     return provider().signKeyPairFromSecret(secretKey);
 }
-/** Async restore of signing keypair for the active profile. */
-export async function xSignKeyPairFromSecretAsync(secretKey) {
-    if (activeCryptoProfile === "tweetnacl") {
-        return xSignKeyPairFromSecret(secretKey);
-    }
-    return fipsEcdsaKeyPairFromPkcs8(secretKey, getSubtleCrypto());
+/** Async restore of an Ed25519 signing keypair. */
+export function xSignKeyPairFromSecretAsync(secretKey) {
+    return Promise.resolve(xSignKeyPairFromSecret(secretKey));
 }
 /** Verify and open a signed message. Returns the original message, or null if verification fails. */
 export function xSignOpen(signedMessage, publicKey) {
     return provider().signOpen(signedMessage, publicKey);
 }
-/** Async verify/open for cross-runtime/FIPS backends. */
-export async function xSignOpenAsync(signedMessage, publicKey) {
-    if (activeCryptoProfile === "tweetnacl") {
-        return xSignOpen(signedMessage, publicKey);
-    }
-    const subtle = getSubtleCrypto();
-    const parsed = decodeFipsSignedMessage(signedMessage);
-    const verifyKey = await importEcdsaPublicKey(publicKey);
-    const valid = await subtle.verify({ hash: "SHA-256", name: "ECDSA" }, verifyKey, toBufferSource(parsed.signature), toBufferSource(parsed.message));
-    return valid ? parsed.message : null;
-}
-async function fipsEcdsaKeyPairFromPkcs8(secretKey, subtle) {
-    const ecdsaPriv = await importEcdsaPrivateKey(secretKey);
-    const jwk = await subtle.exportKey("jwk", ecdsaPriv);
-    const ecdsaPubJwk = { ...jwk };
-    delete ecdsaPubJwk.d;
-    ecdsaPubJwk.key_ops = ["verify"];
-    const ecdsaPub = await subtle.importKey("jwk", ecdsaPubJwk, { name: "ECDSA", namedCurve: "P-256" }, true, ["verify"]);
-    return {
-        publicKey: new Uint8Array(await subtle.exportKey("spki", ecdsaPub)),
-        secretKey: Uint8Array.from(secretKey),
-    };
-}
-async function importAesKey(key, usages) {
-    return getSubtleCrypto().importKey("raw", toBufferSource(key), { name: "AES-GCM" }, false, usages);
-}
-async function importEcdhPrivateKey(secretKey) {
-    return getSubtleCrypto().importKey("pkcs8", toBufferSource(secretKey), { name: "ECDH", namedCurve: "P-256" }, true, ["deriveBits"]);
-}
-async function importEcdhPublicKey(publicKey) {
-    return getSubtleCrypto().importKey("raw", toBufferSource(publicKey), { name: "ECDH", namedCurve: "P-256" }, true, []);
-}
-async function importEcdsaPrivateKey(secretKey) {
-    return getSubtleCrypto().importKey("pkcs8", toBufferSource(secretKey), { name: "ECDSA", namedCurve: "P-256" }, true, ["sign"]);
-}
-async function importEcdsaPublicKey(publicKey) {
-    return getSubtleCrypto().importKey("spki", toBufferSource(publicKey), { name: "ECDSA", namedCurve: "P-256" }, true, ["verify"]);
+/** Async Ed25519 verify/open. */
+export function xSignOpenAsync(signedMessage, publicKey) {
+    return Promise.resolve(xSignOpen(signedMessage, publicKey));
 }
 /**
  * @internal