@vex-chat/crypto 2.0.1 → 2.1.1

package/dist/index.js

@@ -1,3 +1,11 @@
+/// <reference lib="dom" />
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+import { numberToBytesBE } from "@noble/curves/abstract/utils";
+import { p256 } from "@noble/curves/p256";
 import { hkdf } from "@noble/hashes/hkdf.js";
 import { hmac } from "@noble/hashes/hmac.js";
 import { pbkdf2 as noblePbkdf2 } from "@noble/hashes/pbkdf2.js";
@@ -9,6 +17,218 @@ import ed2curve from "ed2curve";
 import { Packr } from "msgpackr";
 import nacl from "tweetnacl";
 import { z } from "zod/v4";
+function getWebCrypto() {
+    const cryptoCandidate = globalThis.crypto;
+    if (!isWebCryptoLike(cryptoCandidate)) {
+        throw new Error("Web Crypto API is not available in this runtime for fips profile operations.");
+    }
+    return cryptoCandidate;
+}
+function isWebCryptoLike(value) {
+    if (typeof value !== "object" || value === null) {
+        return false;
+    }
+    return ("getRandomValues" in value &&
+        typeof value.getRandomValues === "function" &&
+        "subtle" in value &&
+        typeof value.subtle === "object" &&
+        value.subtle !== null);
+}
+function randomBytesWebCrypto(length) {
+    if (!Number.isInteger(length) || length < 0) {
+        throw new Error(`Expected non-negative integer length, received ${String(length)}.`);
+    }
+    const cryptoImpl = getWebCrypto();
+    const result = new Uint8Array(length);
+    let offset = 0;
+    while (offset < length) {
+        const chunkLength = Math.min(65536, length - offset);
+        const chunk = result.subarray(offset, offset + chunkLength);
+        cryptoImpl.getRandomValues(chunk);
+        offset += chunkLength;
+    }
+    return result;
+}
+function unsupported(profile, operation) {
+    throw new Error(`Crypto profile "${profile}" does not implement ${operation} yet.`);
+}
+const tweetnaclProvider = {
+    boxBefore: (myPrivateKey, theirPublicKey) => nacl.box.before(theirPublicKey, myPrivateKey),
+    boxKeyPair: () => nacl.box.keyPair(),
+    boxKeyPairFromSecret: (secretKey) => nacl.box.keyPair.fromSecretKey(secretKey),
+    profile: "tweetnacl",
+    randomBytes: (length) => nacl.randomBytes(length),
+    secretbox: (plaintext, nonce, key) => nacl.secretbox(plaintext, nonce, key),
+    secretboxOpen: (ciphertext, nonce, key) => nacl.secretbox.open(ciphertext, nonce, key),
+    sign: (message, secretKey) => nacl.sign(message, secretKey),
+    signKeyPair: () => nacl.sign.keyPair(),
+    signKeyPairFromSecret: (secretKey) => nacl.sign.keyPair.fromSecretKey(secretKey),
+    signOpen: (signedMessage, publicKey) => nacl.sign.open(signedMessage, publicKey),
+};
+const fipsProvider = {
+    boxBefore: (myPrivateKey, theirPublicKey) => {
+        void myPrivateKey;
+        void theirPublicKey;
+        return unsupported("fips", "xDH");
+    },
+    boxKeyPair: () => unsupported("fips", "xBoxKeyPair"),
+    boxKeyPairFromSecret: (secretKey) => {
+        void secretKey;
+        return unsupported("fips", "xBoxKeyPairFromSecret");
+    },
+    profile: "fips",
+    randomBytes: (length) => randomBytesWebCrypto(length),
+    secretbox: (plaintext, nonce, key) => {
+        void plaintext;
+        void nonce;
+        void key;
+        return unsupported("fips", "xSecretbox");
+    },
+    secretboxOpen: (ciphertext, nonce, key) => {
+        void ciphertext;
+        void nonce;
+        void key;
+        return unsupported("fips", "xSecretboxOpen");
+    },
+    sign: (message, secretKey) => {
+        void message;
+        void secretKey;
+        return unsupported("fips", "xSign");
+    },
+    signKeyPair: () => unsupported("fips", "xSignKeyPair"),
+    signKeyPairFromSecret: (secretKey) => {
+        void secretKey;
+        return unsupported("fips", "xSignKeyPairFromSecret");
+    },
+    signOpen: (signedMessage, publicKey) => {
+        void signedMessage;
+        void publicKey;
+        return unsupported("fips", "xSignOpen");
+    },
+};
+const providers = {
+    fips: fipsProvider,
+    tweetnacl: tweetnaclProvider,
+};
+let activeCryptoProfile = "tweetnacl";
+let activeCryptoProvider = providers[activeCryptoProfile];
+/** Returns the currently configured crypto profile. */
+export function getCryptoProfile() {
+    return activeCryptoProfile;
+}
+/**
+ * Sets the runtime crypto profile.
+ *
+ * `tweetnacl` preserves existing behavior.
+ * `fips` currently enables only backend-agnostic helpers; NaCl-coupled
+ * primitives throw until a FIPS backend implementation is wired in.
+ */
+export function setCryptoProfile(profile) {
+    activeCryptoProfile = profile;
+    activeCryptoProvider = providers[profile];
+}
+function bytesToBase64Url(bytes) {
+    const BufferCtor = getNodeBufferCtor();
+    if (BufferCtor !== undefined) {
+        return BufferCtor.from(bytes).toString("base64url");
+    }
+    return globalThis
+        .btoa(String.fromCodePoint(...Array.from(bytes)))
+        .replace(/\+/g, "-")
+        .replace(/\//g, "_")
+        .replace(/=+/g, "");
+}
+function concatBytes(a, b) {
+    const out = new Uint8Array(a.length + b.length);
+    out.set(a, 0);
+    out.set(b, a.length);
+    return out;
+}
+function decodeFipsSignedMessage(signedMessage) {
+    if (signedMessage.length < 2) {
+        throw new Error("Invalid FIPS signed message: missing signature length prefix.");
+    }
+    const signatureLength = (signedMessage[0] ?? 0) * 256 + (signedMessage[1] ?? 0);
+    const signatureStart = 2;
+    const signatureEnd = signatureStart + signatureLength;
+    if (signedMessage.length < signatureEnd) {
+        throw new Error("Invalid FIPS signed message: signature length exceeds message length.");
+    }
+    return {
+        message: signedMessage.slice(signatureEnd),
+        signature: signedMessage.slice(signatureStart, signatureEnd),
+    };
+}
+function encodeFipsSignedMessage(signature, message) {
+    if (signature.length > 65535) {
+        throw new Error("FIPS signature too long to encode.");
+    }
+    const prefix = new Uint8Array(2);
+    prefix[0] = (signature.length >> 8) & 0xff;
+    prefix[1] = signature.length & 0xff;
+    return concatBytes(concatBytes(prefix, signature), message);
+}
+async function fipsEcdhKeyPairFrom32ByteSeed(secretKey, subtle) {
+    if (secretKey.length !== 32) {
+        throw new Error("FIPS: expected a 32-byte IKM/seed for ECDH from-secret.");
+    }
+    const d = p256.utils.normPrivateKeyToScalar(Uint8Array.from(secretKey));
+    const d32 = numberToBytesBE(d, 32);
+    const rawPub = p256.getPublicKey(d, false);
+    if (rawPub[0] !== 0x04) {
+        throw new Error("FIPS: expected uncompressed P-256 public key.");
+    }
+    const jwk = {
+        crv: "P-256",
+        d: bytesToBase64Url(d32),
+        kty: "EC",
+        x: bytesToBase64Url(rawPub.subarray(1, 33)),
+        y: bytesToBase64Url(rawPub.subarray(33, 65)),
+    };
+    const ecdhPriv = await subtle.importKey("jwk", jwk, { name: "ECDH", namedCurve: "P-256" }, true, ["deriveBits"]);
+    const ecdhPubJwk = await subtle.exportKey("jwk", ecdhPriv);
+    const ecdhPubJwkNoD = { ...ecdhPubJwk };
+    delete ecdhPubJwkNoD.d;
+    ecdhPubJwkNoD.key_ops = [];
+    const ecdhPub = await subtle.importKey("jwk", ecdhPubJwkNoD, { name: "ECDH", namedCurve: "P-256" }, true, []);
+    return {
+        publicKey: new Uint8Array(await subtle.exportKey("raw", ecdhPub)),
+        secretKey: new Uint8Array(await subtle.exportKey("pkcs8", ecdhPriv)),
+    };
+}
+async function fipsEcdhKeyPairFromPkcs8(secretKey, subtle) {
+    const ecdhPriv = await subtle.importKey("pkcs8", toBufferSource(secretKey), { name: "ECDH", namedCurve: "P-256" }, true, ["deriveBits"]);
+    const jwk = await subtle.exportKey("jwk", ecdhPriv);
+    const ecdhPubJwk = { ...jwk };
+    delete ecdhPubJwk.d;
+    ecdhPubJwk.key_ops = [];
+    const ecdhPub = await subtle.importKey("jwk", ecdhPubJwk, { name: "ECDH", namedCurve: "P-256" }, true, []);
+    return {
+        publicKey: new Uint8Array(await subtle.exportKey("raw", ecdhPub)),
+        secretKey: new Uint8Array(await subtle.exportKey("pkcs8", ecdhPriv)),
+    };
+}
+function getNodeBufferCtor() {
+    if (!("Buffer" in globalThis)) {
+        return undefined;
+    }
+    return globalThis.Buffer;
+}
+function getSubtleCrypto() {
+    return getWebCrypto().subtle;
+}
+function provider() {
+    return activeCryptoProvider;
+}
+function requireAesGcmNonce(nonce) {
+    if (nonce.length < 12) {
+        throw new Error(`AES-GCM requires a nonce of at least 12 bytes, received ${String(nonce.length)}.`);
+    }
+    return nonce.slice(0, 12);
+}
+function toBufferSource(bytes) {
+    return Uint8Array.from(bytes).buffer;
+}
 // msgpackr with useRecords:false emits standard msgpack (no nonstandard record extension).
 // moreTypes:false keeps the extension set to only what other decoders understand.
 // pack() returns Node Buffer (tight view) so consumers like axios send the correct bytes.
@@ -85,12 +305,48 @@ export class XUtils {
             c: ITERATIONS,
             dkLen: 32,
         });
-        const DECRYPTED_SIGNKEY = nacl.secretbox.open(ENCRYPTED_KEY, ENCRYPTION_NONCE, DERIVED_KEY);
+        const DECRYPTED_SIGNKEY = provider().secretboxOpen(ENCRYPTED_KEY, ENCRYPTION_NONCE, DERIVED_KEY);
         if (DECRYPTED_SIGNKEY === null) {
             throw new Error("Decryption failed. Wrong password?");
         }
         return XUtils.encodeHex(DECRYPTED_SIGNKEY);
     };
+    /**
+     * Async variant of decryptKeyData for cross-runtime/FIPS backends.
+     * Supports both profile formats emitted by encryptKeyDataAsync.
+     */
+    static decryptKeyDataAsync = async (keyData, password) => {
+        const ITERATIONS = XUtils.uint8ArrToNumber(keyData.slice(0, 6));
+        const PKBDF_SALT = keyData.slice(6, 30);
+        const ENCRYPTION_NONCE = keyData.slice(30, 54);
+        const ENCRYPTED_KEY = keyData.slice(54);
+        const DERIVED_KEY = noblePbkdf2(sha512, password, PKBDF_SALT, {
+            c: ITERATIONS,
+            dkLen: 32,
+        });
+        const decrypted = activeCryptoProfile === "fips"
+            ? await xSecretboxOpenAsync(ENCRYPTED_KEY, ENCRYPTION_NONCE, DERIVED_KEY)
+            : xSecretboxOpen(ENCRYPTED_KEY, ENCRYPTION_NONCE, DERIVED_KEY);
+        if (decrypted === null) {
+            throw new Error("Decryption failed. Wrong password?");
+        }
+        return XUtils.encodeHex(decrypted);
+    };
+    /**
+     * 32-byte AES-256 key for local at-rest encryption (e.g. sqlite) derived from
+     * identity `secretKey`. For `tweetnacl` this is the 32-byte X25519 private key.
+     * For `fips` the identity secret is PKCS#8; HKDF is applied so AES keys never
+     * equal the raw private key material.
+     */
+    static deriveLocalAtRestAesKey(identitySk, profile) {
+        if (profile === "tweetnacl") {
+            if (identitySk.length < 32) {
+                throw new Error("Expected at least 32 bytes of identity secret in tweetnacl mode.");
+            }
+            return identitySk.subarray(0, 32);
+        }
+        return new Uint8Array(hkdf(sha256, identitySk, new Uint8Array(0), new TextEncoder().encode("vex:at-rest:2.1.0-fips"), 32));
+    }
     /**
      * Returns the empty header (32 0's)
      *
@@ -122,7 +378,7 @@ export class XUtils {
     static encryptKeyData = (password, keyToSave, iterationOverride) => {
         const UNENCRYPTED_SIGNKEY = XUtils.decodeHex(keyToSave);
         const OFFSET = 1000;
-        const rand = nacl.randomBytes(2);
+        const rand = provider().randomBytes(2);
         const [N1 = 0, N2 = 0] = rand;
         const iterations = iterationOverride !== undefined && iterationOverride !== 0
             ? iterationOverride
@@ -134,7 +390,43 @@ export class XUtils {
             dkLen: 32,
         });
         const NONCE = xMakeNonce();
-        const ENCRYPTED_SIGNKEY = nacl.secretbox(UNENCRYPTED_SIGNKEY, NONCE, ENCRYPTION_KEY);
+        const ENCRYPTED_SIGNKEY = provider().secretbox(UNENCRYPTED_SIGNKEY, NONCE, ENCRYPTION_KEY);
+        const result = new Uint8Array(ITERATIONS.length +
+            PKBDF_SALT.length +
+            NONCE.length +
+            ENCRYPTED_SIGNKEY.length);
+        let offset = 0;
+        result.set(ITERATIONS, offset);
+        offset += ITERATIONS.length;
+        result.set(PKBDF_SALT, offset);
+        offset += PKBDF_SALT.length;
+        result.set(NONCE, offset);
+        offset += NONCE.length;
+        result.set(ENCRYPTED_SIGNKEY, offset);
+        return result;
+    };
+    /**
+     * Async variant of encryptKeyData for cross-runtime/FIPS backends.
+     * Format remains [iterations(6)|salt(24)|nonce(24)|ciphertext(N)].
+     */
+    static encryptKeyDataAsync = async (password, keyToSave, iterationOverride) => {
+        const UNENCRYPTED_SIGNKEY = XUtils.decodeHex(keyToSave);
+        const OFFSET = 1000;
+        const rand = xRandomBytes(2);
+        const [N1 = 0, N2 = 0] = rand;
+        const iterations = iterationOverride !== undefined && iterationOverride !== 0
+            ? iterationOverride
+            : N1 * N2 + OFFSET;
+        const ITERATIONS = XUtils.numberToUint8Arr(iterations);
+        const PKBDF_SALT = xMakeNonce();
+        const ENCRYPTION_KEY = noblePbkdf2(sha512, password, PKBDF_SALT, {
+            c: iterations,
+            dkLen: 32,
+        });
+        const NONCE = xMakeNonce();
+        const ENCRYPTED_SIGNKEY = activeCryptoProfile === "fips"
+            ? await xSecretboxAsync(UNENCRYPTED_SIGNKEY, NONCE, ENCRYPTION_KEY)
+            : xSecretbox(UNENCRYPTED_SIGNKEY, NONCE, ENCRYPTION_KEY);
         const result = new Uint8Array(ITERATIONS.length +
             PKBDF_SALT.length +
             NONCE.length +
@@ -245,14 +537,64 @@ export const xConstants = {
     KEY_LENGTH: 32,
     MIN_OTK_SUPPLY: 100,
 };
+/**
+ * FIPS: `device.signKey` in the database is the P-256 ECDSA public key (SPKI),
+ * used for account/device signature verification. X3DH on the client expects
+ * the same curve point as Web Crypto "raw" P-256 ECDH public bytes for
+ * `importEcdhPublicKey`. This converts SPKI → raw without a private key.
+ */
+export async function fipsEcdhRawPublicKeyFromEcdsaSpkiAsync(ecdsaSpki) {
+    if (ecdsaSpki.length === 0) {
+        throw new Error("FIPS: empty ECDSA SPKI.");
+    }
+    const subtle = getSubtleCrypto();
+    const ecdsaPub = await importEcdsaPublicKey(ecdsaSpki);
+    const jwk = await subtle.exportKey("jwk", ecdsaPub);
+    if (jwk.x === undefined ||
+        jwk.y === undefined ||
+        jwk.x.length === 0 ||
+        jwk.y.length === 0) {
+        throw new Error("FIPS: could not export ECDSA public as JWK.");
+    }
+    const ecdhJwk = { ...jwk };
+    delete ecdhJwk.d;
+    ecdhJwk.key_ops = [];
+    ecdhJwk.ext = true;
+    const ecdhPub = await subtle.importKey("jwk", ecdhJwk, { name: "ECDH", namedCurve: "P-256" }, true, []);
+    return new Uint8Array(await subtle.exportKey("raw", ecdhPub));
+}
 /** Generate a fresh X25519 box key pair. */
 export function xBoxKeyPair() {
-    return nacl.box.keyPair();
+    return provider().boxKeyPair();
+}
+/** Async box keypair generation for the active profile. */
+export async function xBoxKeyPairAsync() {
+    if (activeCryptoProfile === "tweetnacl") {
+        return xBoxKeyPair();
+    }
+    const subtle = getSubtleCrypto();
+    const pair = await subtle.generateKey({ name: "ECDH", namedCurve: "P-256" }, true, ["deriveBits"]);
+    return {
+        publicKey: new Uint8Array(await subtle.exportKey("raw", pair.publicKey)),
+        secretKey: new Uint8Array(await subtle.exportKey("pkcs8", pair.privateKey)),
+    };
 }
 /** Restore an X25519 box key pair from a 32-byte secret key. */
 export function xBoxKeyPairFromSecret(secretKey) {
-    return nacl.box.keyPair.fromSecretKey(secretKey);
+    return provider().boxKeyPairFromSecret(secretKey);
 }
+// ── Key pair type ───────────────────────────────────────────────────────────
+/** Async box key restore from private key material. */
+export async function xBoxKeyPairFromSecretAsync(secretKey) {
+    if (activeCryptoProfile === "tweetnacl") {
+        return xBoxKeyPairFromSecret(secretKey);
+    }
+    if (secretKey.length === 32) {
+        return fipsEcdhKeyPairFrom32ByteSeed(secretKey, getSubtleCrypto());
+    }
+    return fipsEcdhKeyPairFromPkcs8(secretKey, getSubtleCrypto());
+}
+// ── Key generation ─────────────────────────────────────────────────────────
 /**
  * Concatanates multiple Uint8Arrays.
  *
@@ -282,9 +624,48 @@ export function xConcat(...arrays) {
  * @returns The derived shared secret, SK.
  */
 export function xDH(myPrivateKey, theirPublicKey) {
-    return nacl.box.before(theirPublicKey, myPrivateKey);
+    return provider().boxBefore(myPrivateKey, theirPublicKey);
+}
+/** Async DH for cross-runtime/FIPS backends. */
+export async function xDHAsync(myPrivateKey, theirPublicKey) {
+    if (activeCryptoProfile === "tweetnacl") {
+        return xDH(myPrivateKey, theirPublicKey);
+    }
+    const subtle = getSubtleCrypto();
+    const privateKey = await importEcdhPrivateKey(myPrivateKey);
+    const publicKey = await importEcdhPublicKey(theirPublicKey);
+    const shared = await subtle.deriveBits({ name: "ECDH", public: publicKey }, privateKey, 256);
+    return new Uint8Array(shared);
 }
-// ── Key pair type ───────────────────────────────────────────────────────────
+/**
+ * In `fips` mode only: derive a P-256 ECDH `KeyPair` (raw public + pkcs8 secret)
+ * from a P-256 ECDSA `KeyPair` (spki + pkcs8) using the same private scalar in Web Crypto.
+ * In `tweetnacl` mode, use `XKeyConvert.convertKeyPair` to map Ed25519 → X25519 instead.
+ */
+export async function xEcdhKeyPairFromEcdsaKeyPairAsync(sign) {
+    if (activeCryptoProfile === "tweetnacl") {
+        return Promise.reject(new Error('xEcdhKeyPairFromEcdsaKeyPairAsync is for crypto profile "fips" only. Use XKeyConvert.convertKeyPair in tweetnacl mode.'));
+    }
+    const subtle = getSubtleCrypto();
+    const ecdsaPriv = await importEcdsaPrivateKey(sign.secretKey);
+    const jwk = await subtle.exportKey("jwk", ecdsaPriv);
+    if (typeof jwk.d !== "string" || jwk.d.length === 0) {
+        throw new Error("FIPS: could not export ECDSA private as JWK.");
+    }
+    const ecdhJwk = { ...jwk, key_ops: ["deriveBits"] };
+    ecdhJwk.ext = true;
+    const ecdhPriv = await subtle.importKey("jwk", ecdhJwk, { name: "ECDH", namedCurve: "P-256" }, true, ["deriveBits"]);
+    const ecdhPubJwk = await subtle.exportKey("jwk", ecdhPriv);
+    const ecdhPubJwkNoD = { ...ecdhPubJwk };
+    delete ecdhPubJwkNoD.d;
+    ecdhPubJwkNoD.key_ops = [];
+    const ecdhPub = await subtle.importKey("jwk", ecdhPubJwkNoD, { name: "ECDH", namedCurve: "P-256" }, true, []);
+    return {
+        publicKey: new Uint8Array(await subtle.exportKey("raw", ecdhPub)),
+        secretKey: new Uint8Array(await subtle.exportKey("pkcs8", ecdhPriv)),
+    };
+}
+// ── Signing ────────────────────────────────────────────────────────────────
 /**
  * Encode an X25519 or X448 public key PK into a byte sequence.
  * The encoding consists of 0 or 1 to represent the type of curve, followed by l
@@ -318,7 +699,6 @@ export function xEncode(curveType, publicKey) {
     }
     return Uint8Array.from(bytes);
 }
-// ── Key generation ─────────────────────────────────────────────────────────
 /**
  * Hashes some data.
  *
@@ -328,6 +708,7 @@ export function xEncode(curveType, publicKey) {
 export function xHash(data) {
     return XUtils.encodeHex(sha512(data));
 }
+// ── Symmetric encryption (XSalsa20-Poly1305) ──────────────────────────────
 export function xKDF(IKM) {
     return hkdf(sha512, IKM, xMakeSalt(xConstants.CURVE), new TextEncoder().encode(xConstants.INFO), xConstants.KEY_LENGTH);
 }
@@ -335,38 +716,130 @@ export function xKDF(IKM) {
  * Returns a 24 byte random nonce of cryptographic quality.
  */
 export function xMakeNonce() {
-    return nacl.randomBytes(24);
+    return provider().randomBytes(24);
 }
+// ── Random ─────────────────────────────────────────────────────────────────
 /** Cryptographically secure random bytes. */
 export function xRandomBytes(length) {
-    return nacl.randomBytes(length);
+    return provider().randomBytes(length);
 }
-// ── Signing ────────────────────────────────────────────────────────────────
 /** Encrypt with a shared secret key. */
 export function xSecretbox(plaintext, nonce, key) {
-    return nacl.secretbox(plaintext, nonce, key);
+    return provider().secretbox(plaintext, nonce, key);
+}
+/** Async authenticated encryption for cross-runtime/FIPS backends. */
+export async function xSecretboxAsync(plaintext, nonce, key) {
+    if (activeCryptoProfile === "tweetnacl") {
+        return xSecretbox(plaintext, nonce, key);
+    }
+    const subtle = getSubtleCrypto();
+    const iv = requireAesGcmNonce(nonce);
+    const aesKey = await importAesKey(key, ["encrypt"]);
+    const ciphertext = await subtle.encrypt({ iv: toBufferSource(iv), name: "AES-GCM" }, aesKey, toBufferSource(plaintext));
+    return new Uint8Array(ciphertext);
 }
 /** Decrypt with a shared secret key. Returns null if authentication fails. */
 export function xSecretboxOpen(ciphertext, nonce, key) {
-    return nacl.secretbox.open(ciphertext, nonce, key);
+    return provider().secretboxOpen(ciphertext, nonce, key);
+}
+/** Async authenticated decryption for cross-runtime/FIPS backends. */
+export async function xSecretboxOpenAsync(ciphertext, nonce, key) {
+    if (activeCryptoProfile === "tweetnacl") {
+        return xSecretboxOpen(ciphertext, nonce, key);
+    }
+    const subtle = getSubtleCrypto();
+    const iv = requireAesGcmNonce(nonce);
+    const aesKey = await importAesKey(key, ["decrypt"]);
+    try {
+        const plaintext = await subtle.decrypt({ iv: toBufferSource(iv), name: "AES-GCM" }, aesKey, toBufferSource(ciphertext));
+        return new Uint8Array(plaintext);
+    }
+    catch {
+        return null;
+    }
 }
-// ── Symmetric encryption (XSalsa20-Poly1305) ──────────────────────────────
 /** Sign a message with an Ed25519 secret key. Returns signed message (64-byte signature prefix + message). */
 export function xSign(message, secretKey) {
-    return nacl.sign(message, secretKey);
+    return provider().sign(message, secretKey);
+}
+/** Async signing for cross-runtime/FIPS backends. */
+export async function xSignAsync(message, secretKey) {
+    if (activeCryptoProfile === "tweetnacl") {
+        return xSign(message, secretKey);
+    }
+    const subtle = getSubtleCrypto();
+    const privateKey = await importEcdsaPrivateKey(secretKey);
+    const signature = new Uint8Array(await subtle.sign({ hash: "SHA-256", name: "ECDSA" }, privateKey, toBufferSource(message)));
+    return encodeFipsSignedMessage(signature, message);
 }
 /** Generate a fresh Ed25519 signing key pair. */
 export function xSignKeyPair() {
-    return nacl.sign.keyPair();
+    return provider().signKeyPair();
+}
+/** Async keypair generation for the active profile. */
+export async function xSignKeyPairAsync() {
+    if (activeCryptoProfile === "tweetnacl") {
+        return xSignKeyPair();
+    }
+    const subtle = getSubtleCrypto();
+    const pair = await subtle.generateKey({ name: "ECDSA", namedCurve: "P-256" }, true, ["sign", "verify"]);
+    return {
+        publicKey: new Uint8Array(await subtle.exportKey("spki", pair.publicKey)),
+        secretKey: new Uint8Array(await subtle.exportKey("pkcs8", pair.privateKey)),
+    };
 }
-// ── Random ─────────────────────────────────────────────────────────────────
 /** Restore an Ed25519 signing key pair from a 64-byte secret key. */
 export function xSignKeyPairFromSecret(secretKey) {
-    return nacl.sign.keyPair.fromSecretKey(secretKey);
+    return provider().signKeyPairFromSecret(secretKey);
+}
+/** Async restore of signing keypair for the active profile. */
+export async function xSignKeyPairFromSecretAsync(secretKey) {
+    if (activeCryptoProfile === "tweetnacl") {
+        return xSignKeyPairFromSecret(secretKey);
+    }
+    return fipsEcdsaKeyPairFromPkcs8(secretKey, getSubtleCrypto());
 }
 /** Verify and open a signed message. Returns the original message, or null if verification fails. */
 export function xSignOpen(signedMessage, publicKey) {
-    return nacl.sign.open(signedMessage, publicKey);
+    return provider().signOpen(signedMessage, publicKey);
+}
+/** Async verify/open for cross-runtime/FIPS backends. */
+export async function xSignOpenAsync(signedMessage, publicKey) {
+    if (activeCryptoProfile === "tweetnacl") {
+        return xSignOpen(signedMessage, publicKey);
+    }
+    const subtle = getSubtleCrypto();
+    const parsed = decodeFipsSignedMessage(signedMessage);
+    const verifyKey = await importEcdsaPublicKey(publicKey);
+    const valid = await subtle.verify({ hash: "SHA-256", name: "ECDSA" }, verifyKey, toBufferSource(parsed.signature), toBufferSource(parsed.message));
+    return valid ? parsed.message : null;
+}
+async function fipsEcdsaKeyPairFromPkcs8(secretKey, subtle) {
+    const ecdsaPriv = await importEcdsaPrivateKey(secretKey);
+    const jwk = await subtle.exportKey("jwk", ecdsaPriv);
+    const ecdsaPubJwk = { ...jwk };
+    delete ecdsaPubJwk.d;
+    ecdsaPubJwk.key_ops = ["verify"];
+    const ecdsaPub = await subtle.importKey("jwk", ecdsaPubJwk, { name: "ECDSA", namedCurve: "P-256" }, true, ["verify"]);
+    return {
+        publicKey: new Uint8Array(await subtle.exportKey("spki", ecdsaPub)),
+        secretKey: Uint8Array.from(secretKey),
+    };
+}
+async function importAesKey(key, usages) {
+    return getSubtleCrypto().importKey("raw", toBufferSource(key), { name: "AES-GCM" }, false, usages);
+}
+async function importEcdhPrivateKey(secretKey) {
+    return getSubtleCrypto().importKey("pkcs8", toBufferSource(secretKey), { name: "ECDH", namedCurve: "P-256" }, true, ["deriveBits"]);
+}
+async function importEcdhPublicKey(publicKey) {
+    return getSubtleCrypto().importKey("raw", toBufferSource(publicKey), { name: "ECDH", namedCurve: "P-256" }, true, []);
+}
+async function importEcdsaPrivateKey(secretKey) {
+    return getSubtleCrypto().importKey("pkcs8", toBufferSource(secretKey), { name: "ECDSA", namedCurve: "P-256" }, true, ["sign"]);
+}
+async function importEcdsaPublicKey(publicKey) {
+    return getSubtleCrypto().importKey("spki", toBufferSource(publicKey), { name: "ECDSA", namedCurve: "P-256" }, true, ["verify"]);
 }
 /**
  * @internal