@vex-chat/libvex 5.2.0 → 5.3.1

package/dist/Client.js

@@ -1,13 +1,111 @@
-import { xBoxKeyPair, xBoxKeyPairFromSecret, xConcat, xConstants, xDH, xEncode, xHMAC, xKDF, XKeyConvert, xMakeNonce, xMnemonic, xRandomBytes, xSecretbox, xSecretboxOpen, xSign, xSignKeyPair, xSignKeyPairFromSecret, XUtils, } from "@vex-chat/crypto";
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+import { getCryptoProfile, setCryptoProfile, xBoxKeyPairAsync, xBoxKeyPairFromSecretAsync, xConcat, xConstants, xDHAsync, xEcdhKeyPairFromEcdsaKeyPairAsync, xEncode, xHMAC, xKDF, XKeyConvert, xMakeNonce, xMnemonic, xRandomBytes, xSecretboxAsync, xSecretboxOpenAsync, xSignAsync, xSignKeyPair, xSignKeyPairAsync, xSignKeyPairFromSecret, xSignKeyPairFromSecretAsync, XUtils, } from "@vex-chat/crypto";
 import { MailType, MailWSSchema, PermissionSchema, WSMessageSchema, } from "@vex-chat/types";
 import axios, { isAxiosError } from "axios";
 import { EventEmitter } from "eventemitter3";
 import * as uuid from "uuid";
 import { z } from "zod/v4";
 import { WebSocketAdapter } from "./transport/websocket.js";
+import { decodeFipsInitialExtraV1, decodeFipsSubsequentExtraV1, encodeFipsInitialExtraV1, encodeFipsSubsequentExtraV1, fipsP256AdFromIdentityPubs, fipsP256PreKeySignPayload, isFipsInitialExtraV1, isFipsSubsequentExtraV1, } from "./utils/fipsMailExtra.js";
 function sleep(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
 }
+function isRecord(x) {
+    return typeof x === "object" && x !== null;
+}
+/**
+ * Spire 5+ JSON error bodies use `{ "error": { "message", "requestId"?, "details"? } }`.
+ * Responses are `arraybuffer` — decode UTF-8 and parse for a one-line `Error` message
+ * (plus requestId) instead of a raw JSON blob.
+ */
+function spireErrorBodyMessage(data, max = 8_000) {
+    let text;
+    if (data instanceof ArrayBuffer) {
+        text = new TextDecoder("utf-8", { fatal: false }).decode(new Uint8Array(data));
+    }
+    else if (data instanceof Uint8Array) {
+        text = new TextDecoder("utf-8", { fatal: false }).decode(data);
+    }
+    else {
+        return String(data).slice(0, max);
+    }
+    const t = text.trim();
+    if (t.startsWith("{")) {
+        try {
+            // JSON.parse is typed as any; assign into unknown for safe narrowing.
+            const parsed = JSON.parse(t);
+            if (!isRecord(parsed)) {
+                return t.length > max ? t.slice(0, max) + "…" : t;
+            }
+            const errField = parsed["error"];
+            if (!isRecord(errField)) {
+                return t.length > max ? t.slice(0, max) + "…" : t;
+            }
+            const message = errField["message"];
+            if (typeof message !== "string") {
+                return t.length > max ? t.slice(0, max) + "…" : t;
+            }
+            const parts = [message];
+            const requestId = errField["requestId"];
+            if (typeof requestId === "string" && requestId.length > 0) {
+                parts.push(`(requestId: ${requestId})`);
+            }
+            if (errField["details"] !== undefined) {
+                let d = JSON.stringify(errField["details"]);
+                if (d.length > 500) {
+                    d = d.slice(0, 500) + "…";
+                }
+                parts.push(d);
+            }
+            return parts.join(" ");
+        }
+        catch {
+            /* fall through to raw */
+        }
+    }
+    return t.length > max ? t.slice(0, max) + "…" : t;
+}
+/**
+ * Set `LIBVEX_DEBUG_DM=1` (e.g. in vitest / shell) to log DM multi-device / X3DH paths.
+ * Uses indirect `globalThis` lookup so the bare `process` global never appears in
+ * source that the platform-guard plugin scans (browser/RN/Tauri).
+ */
+function libvexDebugDmEnabled() {
+    try {
+        const g = Object.getOwnPropertyDescriptor(globalThis, "\u0070rocess");
+        if (!g) {
+            return false;
+        }
+        const proc = typeof g.get === "function" ? g.get() : g.value;
+        if (typeof proc !== "object" || proc === null) {
+            return false;
+        }
+        const envDesc = Object.getOwnPropertyDescriptor(proc, "env");
+        if (!envDesc) {
+            return false;
+        }
+        const env = typeof envDesc.get === "function" ? envDesc.get() : envDesc.value;
+        if (typeof env !== "object" || env === null) {
+            return false;
+        }
+        return Reflect.get(env, "LIBVEX_DEBUG_DM") === "1";
+    }
+    catch {
+        return false;
+    }
+}
+function debugLibvexDm(msg, data) {
+    if (!libvexDebugDmEnabled()) {
+        return;
+    }
+    const payload = data ? `${msg} ${JSON.stringify(data)}` : msg;
+    // eslint-disable-next-line no-console -- gated by LIBVEX_DEBUG_DM; remove when debugging is done
+    console.error(`[libvex:debug-dm] ${payload}`);
+}
 import { msgpack } from "./codec.js";
 import { ActionTokenCodec, AuthResponseCodec, ChannelArrayCodec, ChannelCodec, ConnectResponseCodec, decodeAxios, DeviceArrayCodec, DeviceChallengeCodec, DeviceCodec, EmojiArrayCodec, EmojiCodec, FileSQLCodec, InviteArrayCodec, InviteCodec, KeyBundleCodec, OtkCountCodec, PermissionArrayCodec, PermissionCodec, ServerArrayCodec, ServerCodec, UserArrayCodec, UserCodec, WhoamiCodec, } from "./codecs.js";
 import { capitalize } from "./utils/capitalize.js";
@@ -42,12 +140,14 @@ export class Client {
      * Pass-through utility from `@vex-chat/crypto`.
      */
     static decryptKeyData = XUtils.decryptKeyData;
+    static decryptKeyDataAsync = XUtils.decryptKeyDataAsync;
     /**
      * Encrypts a secret key with a password.
      *
      * Pass-through utility from `@vex-chat/crypto`.
      */
     static encryptKeyData = XUtils.encryptKeyData;
+    static encryptKeyDataAsync = XUtils.encryptKeyDataAsync;
     static NOT_FOUND_TTL = 30 * 60 * 1000;
     /**
      * Browser-safe NODE_ENV accessor.
@@ -319,6 +419,11 @@ export class Client {
     isAlive = true;
     mailInterval;
     manuallyClosing = false;
+    /**
+     * Bumped when the WebSocket is torn down and re-opened so the previous
+     * `postAuth` loop exits instead of overlapping a new one.
+     */
+    postAuthVersion = 0;
     /* Retrieves the userID with the user identifier.
     user identifier is checked for userID, then signkey,
     and finally falls back to username. */
@@ -337,9 +442,12 @@ export class Client {
     user;
     userRecords = {};
     xKeyRing;
-    constructor(privateKey, options, storage) {
-        // (no super — composition, not inheritance)
+    cryptoProfile;
+    constructor(material, options, storage) {
         this.options = options;
+        this.cryptoProfile = material.cryptoProfile;
+        this.signKeys = material.signKeys;
+        this.idKeys = material.idKeys;
         if (options?.unsafeHttp) {
             const env = Client.getNodeEnv();
             if (env !== "development" && env !== "test") {
@@ -351,13 +459,6 @@ export class Client {
         else {
             this.prefixes = { HTTP: "https://", WS: "wss://" };
         }
-        this.signKeys = privateKey
-            ? xSignKeyPairFromSecret(XUtils.decodeHex(privateKey))
-            : xSignKeyPair();
-        this.idKeys = XKeyConvert.convertKeyPair(this.signKeys);
-        if (!this.idKeys) {
-            throw new Error("Could not convert key to X25519!");
-        }
         this.host = options?.host || "api.vex.wtf";
         const dbFileName = options?.inMemoryDb
             ? ":memory:"
@@ -396,29 +497,73 @@ export class Client {
      * ```
      */
     static create = async (privateKey, options, storage) => {
-        const opts = options;
-        const sk = privateKey ?? XUtils.encodeHex(xSignKeyPair().secretKey);
+        const profile = options?.cryptoProfile ?? "tweetnacl";
+        setCryptoProfile(profile);
+        if (profile === "fips" &&
+            typeof globalThis.crypto.subtle !== "object") {
+            throw new Error('cryptoProfile="fips" requires Web Crypto (globalThis.crypto.subtle).');
+        }
+        let signKeys;
+        if (privateKey) {
+            const d = XUtils.decodeHex(privateKey);
+            signKeys =
+                profile === "tweetnacl"
+                    ? xSignKeyPairFromSecret(d)
+                    : await xSignKeyPairFromSecretAsync(d);
+        }
+        else {
+            signKeys =
+                profile === "tweetnacl"
+                    ? xSignKeyPair()
+                    : await xSignKeyPairAsync();
+        }
+        const idKeys = profile === "tweetnacl"
+            ? (() => {
+                const c = XKeyConvert.convertKeyPair(signKeys);
+                if (!c) {
+                    throw new Error("Could not convert key to X25519!");
+                }
+                return c;
+            })()
+            : await xEcdhKeyPairFromEcdsaKeyPairAsync(signKeys);
+        const atRestAes = XUtils.deriveLocalAtRestAesKey(idKeys.secretKey, profile);
         let resolvedStorage = storage;
         if (!resolvedStorage) {
             const { createNodeStorage } = await import("./storage/node.js");
-            const dbFileName = opts?.inMemoryDb
+            const dbFileName = options?.inMemoryDb
                 ? ":memory:"
-                : XUtils.encodeHex(xSignKeyPairFromSecret(XUtils.decodeHex(sk)).publicKey) + ".sqlite";
-            const dbPath = opts?.dbFolder
-                ? opts.dbFolder + "/" + dbFileName
+                : XUtils.encodeHex(signKeys.publicKey) + ".sqlite";
+            const dbPath = options?.dbFolder
+                ? options.dbFolder + "/" + dbFileName
                 : dbFileName;
-            resolvedStorage = createNodeStorage(dbPath, sk);
-        }
-        const client = new Client(sk, opts, resolvedStorage);
+            resolvedStorage = createNodeStorage(dbPath, atRestAes);
+        }
+        await resolvedStorage.init();
+        const client = new Client({
+            cryptoProfile: profile,
+            idKeys,
+            signKeys,
+        }, options, resolvedStorage);
         await client.init();
         return client;
     };
     /**
-     * Generates an ed25519 secret key as a hex string.
-     *
-     * @returns A secret key to use for the client. Save it permanently somewhere safe.
+     * Generates a signing secret key as a hex string (tweetnacl: Ed25519; fips: P-256 pkcs8).
+     * In `fips` mode, use `Client.generateSecretKeyAsync()` instead (Web Crypto is async).
      */
     static generateSecretKey() {
+        if (getCryptoProfile() === "fips") {
+            throw new Error('Use await Client.generateSecretKeyAsync() when the active crypto profile is "fips".');
+        }
+        return XUtils.encodeHex(xSignKeyPair().secretKey);
+    }
+    /**
+     * Async key generation — required for `fips` profile; safe for `tweetnacl` as well.
+     */
+    static async generateSecretKeyAsync() {
+        if (getCryptoProfile() === "fips") {
+            return XUtils.encodeHex((await xSignKeyPairAsync()).secretKey);
+        }
         return XUtils.encodeHex(xSignKeyPair().secretKey);
     }
     /**
@@ -436,17 +581,23 @@ export class Client {
     }
     static deserializeExtra(type, extra) {
         switch (type) {
-            case MailType.initial:
-                /* 32 bytes for signkey, 32 bytes for ephemeral key,
-                 68 bytes for AD, 6 bytes for otk index (empty for no otk) */
+            case MailType.initial: {
+                if (isFipsInitialExtraV1(extra)) {
+                    const [a, b, c, d] = decodeFipsInitialExtraV1(extra);
+                    return [a, b, c, d];
+                }
+                /* 32B sign | 32B eph | 32B PK | 68B AD | 6B index (tweetnacl) */
                 const signKey = extra.slice(0, 32);
                 const ephKey = extra.slice(32, 64);
                 const ad = extra.slice(96, 164);
                 const index = extra.slice(164, 170);
                 return [signKey, ephKey, ad, index];
+            }
             case MailType.subsequent:
-                const publicKey = extra;
-                return [publicKey];
+                if (isFipsSubsequentExtraV1(extra)) {
+                    return [decodeFipsSubsequentExtraV1(extra)];
+                }
+                return [extra];
             default:
                 return [];
         }
@@ -562,8 +713,8 @@ export class Client {
         if (!connectToken) {
             throw new Error("Couldn't get connect token.");
         }
-        const signed = xSign(Uint8Array.from(uuid.parse(connectToken.key)), this.signKeys.secretKey);
-        const res = await this.http.post(this.getHost() + "/device/" + this.device.deviceID + "/connect", msgpack.encode({ signed }), { headers: { "Content-Type": "application/msgpack" } });
+        const signedAsync = await xSignAsync(Uint8Array.from(uuid.parse(connectToken.key)), this.signKeys.secretKey);
+        const res = await this.http.post(this.getHost() + "/device/" + this.device.deviceID + "/connect", msgpack.encode({ signed: signedAsync }), { headers: { "Content-Type": "application/msgpack" } });
         const { deviceToken } = decodeAxios(ConnectResponseCodec, res.data);
         this.http.defaults.headers.common["X-Device-Token"] = deviceToken;
         this.initSocket();
@@ -572,6 +723,50 @@ export class Client {
         await new Promise((r) => setTimeout(r, 0));
         await this.negotiateOTK();
     }
+    /**
+     * Tears down the current WebSocket and opens a new one, keeping the same
+     * session (user + device in storage). Restarts the post-auth mail loop.
+     * Use for long-running processes or e2e where a fresh socket matches a
+     * newly-registered second device.
+     */
+    async reconnectWebsocket() {
+        this.postAuthVersion++;
+        if (this.pingInterval) {
+            clearInterval(this.pingInterval);
+            this.pingInterval = null;
+        }
+        this.socket.close();
+        try {
+            await new Promise((resolve, reject) => {
+                const t = setTimeout(() => {
+                    this.off("connected", onC);
+                    reject(new Error("reconnectWebsocket: timed out waiting for authorized"));
+                }, 15_000);
+                const onC = () => {
+                    clearTimeout(t);
+                    this.off("connected", onC);
+                    resolve();
+                };
+                this.on("connected", onC);
+                try {
+                    this.initSocket();
+                }
+                catch (err) {
+                    clearTimeout(t);
+                    this.off("connected", onC);
+                    const e = err instanceof Error
+                        ? err
+                        : new Error(String(err), { cause: err });
+                    reject(e);
+                }
+            });
+        }
+        catch (e) {
+            throw e instanceof Error ? e : new Error(String(e), { cause: e });
+        }
+        await new Promise((r) => setTimeout(r, 0));
+        await this.negotiateOTK();
+    }
     /**
      * Delete all local data — message history, encryption sessions, and prekeys.
      * Closes the client afterward. Credentials (keychain) must be cleared by the consumer.
@@ -629,6 +824,12 @@ export class Client {
             return { ok: true };
         }
         catch (err) {
+            if (isAxiosError(err) && err.response) {
+                return {
+                    error: spireErrorBodyMessage(err.response.data),
+                    ok: false,
+                };
+            }
             const error = err instanceof Error ? err.message : String(err);
             return { error, ok: false };
         }
@@ -653,7 +854,7 @@ export class Client {
                 signKey: signKeyHex,
             }), { headers: { "Content-Type": "application/msgpack" } });
             const { challenge, challengeID } = decodeAxios(DeviceChallengeCodec, challengeRes.data);
-            const signed = XUtils.encodeHex(xSign(XUtils.decodeHex(challenge), this.signKeys.secretKey));
+            const signed = XUtils.encodeHex(await xSignAsync(XUtils.decodeHex(challenge), this.signKeys.secretKey));
             const verifyRes = await this.http.post(this.getHost() + "/auth/device/verify", msgpack.encode({ challengeID, signed }), { headers: { "Content-Type": "application/msgpack" } });
             const { token, user } = decodeAxios(AuthResponseCodec, verifyRes.data);
             this.setUser(user);
@@ -710,7 +911,7 @@ export class Client {
         const regKey = await this.getToken("register");
         if (regKey) {
             const signKey = XUtils.encodeHex(this.signKeys.publicKey);
-            const signed = XUtils.encodeHex(xSign(Uint8Array.from(uuid.parse(regKey.key)), this.signKeys.secretKey));
+            const signed = XUtils.encodeHex(await xSignAsync(Uint8Array.from(uuid.parse(regKey.key)), this.signKeys.secretKey));
             const preKeyIndex = this.xKeyRing.preKeys.index;
             const regMsg = {
                 deviceName: this.options?.deviceName ?? "unknown",
@@ -729,11 +930,10 @@ export class Client {
             }
             catch (err) {
                 if (isAxiosError(err) && err.response) {
-                    const raw = err.response.data;
-                    const msg = raw instanceof ArrayBuffer || raw instanceof Uint8Array
-                        ? new TextDecoder().decode(raw)
-                        : String(raw);
-                    return [null, new Error(msg)];
+                    return [
+                        null,
+                        new Error(spireErrorBodyMessage(err.response.data)),
+                    ];
                 }
                 return [
                     null,
@@ -792,41 +992,45 @@ export class Client {
     }
     // returns the file details and the encryption key
     async createFile(file) {
-        const nonce = xMakeNonce();
-        const key = xBoxKeyPair();
-        const box = xSecretbox(Uint8Array.from(file), nonce, key.secretKey);
-        if (typeof FormData !== "undefined") {
-            const fpayload = new FormData();
-            fpayload.set("owner", this.getDevice().deviceID);
-            fpayload.set("nonce", XUtils.encodeHex(nonce));
-            fpayload.set("file", new Blob([new Uint8Array(box)]));
-            const fres = await this.http.post(this.getHost() + "/file", fpayload, {
-                headers: { "Content-Type": "multipart/form-data" },
-                onUploadProgress: (progressEvent) => {
-                    const percentCompleted = Math.round((progressEvent.loaded * 100) /
-                        (progressEvent.total ?? 1));
-                    const { loaded, total = 0 } = progressEvent;
-                    const progress = {
-                        direction: "upload",
-                        loaded,
-                        progress: percentCompleted,
-                        token: XUtils.encodeHex(nonce),
-                        total,
-                    };
-                    this.emitter.emit("fileProgress", progress);
-                },
-            });
-            const fcreatedFile = decodeAxios(FileSQLCodec, fres.data);
-            return [fcreatedFile, XUtils.encodeHex(key.secretKey)];
-        }
-        const payload = {
-            file: XUtils.encodeBase64(box),
-            nonce: XUtils.encodeHex(nonce),
-            owner: this.getDevice().deviceID,
-        };
-        const res = await this.http.post(this.getHost() + "/file/json", msgpack.encode(payload), { headers: { "Content-Type": "application/msgpack" } });
-        const createdFile = decodeAxios(FileSQLCodec, res.data);
-        return [createdFile, XUtils.encodeHex(key.secretKey)];
+        return this.runWithThisCryptoProfile(async () => {
+            const nonce = xMakeNonce();
+            const fileKey = this.cryptoProfile === "fips"
+                ? xRandomBytes(32)
+                : (await xBoxKeyPairAsync()).secretKey;
+            const box = await xSecretboxAsync(Uint8Array.from(file), nonce, fileKey);
+            if (typeof FormData !== "undefined") {
+                const fpayload = new FormData();
+                fpayload.set("owner", this.getDevice().deviceID);
+                fpayload.set("nonce", XUtils.encodeHex(nonce));
+                fpayload.set("file", new Blob([new Uint8Array(box)]));
+                const fres = await this.http.post(this.getHost() + "/file", fpayload, {
+                    headers: { "Content-Type": "multipart/form-data" },
+                    onUploadProgress: (progressEvent) => {
+                        const percentCompleted = Math.round((progressEvent.loaded * 100) /
+                            (progressEvent.total ?? 1));
+                        const { loaded, total = 0 } = progressEvent;
+                        const progress = {
+                            direction: "upload",
+                            loaded,
+                            progress: percentCompleted,
+                            token: XUtils.encodeHex(nonce),
+                            total,
+                        };
+                        this.emitter.emit("fileProgress", progress);
+                    },
+                });
+                const fcreatedFile = decodeAxios(FileSQLCodec, fres.data);
+                return [fcreatedFile, XUtils.encodeHex(fileKey)];
+            }
+            const payload = {
+                file: XUtils.encodeBase64(box),
+                nonce: XUtils.encodeHex(nonce),
+                owner: this.getDevice().deviceID,
+            };
+            const res = await this.http.post(this.getHost() + "/file/json", msgpack.encode(payload), { headers: { "Content-Type": "application/msgpack" } });
+            const createdFile = decodeAxios(FileSQLCodec, res.data);
+            return [createdFile, XUtils.encodeHex(fileKey)];
+        });
     }
     async createInvite(serverID, duration) {
         const payload = {
@@ -836,145 +1040,190 @@ export class Client {
         const res = await this.http.post(this.getHost() + "/server/" + serverID + "/invites", msgpack.encode(payload), { headers: { "Content-Type": "application/msgpack" } });
         return decodeAxios(InviteCodec, res.data);
     }
-    createPreKey() {
-        const preKeyPair = xBoxKeyPair();
+    async createPreKey() {
+        const preKeyPair = await xBoxKeyPairAsync();
+        const toSign = this.cryptoProfile === "fips"
+            ? fipsP256PreKeySignPayload(preKeyPair.publicKey)
+            : xEncode(xConstants.CURVE, preKeyPair.publicKey);
         return {
             keyPair: preKeyPair,
-            signature: xSign(xEncode(xConstants.CURVE, preKeyPair.publicKey), this.signKeys.secretKey),
+            signature: await xSignAsync(toSign, this.signKeys.secretKey),
         };
     }
     async createServer(name) {
         const res = await this.http.post(this.getHost() + "/server/" + globalThis.btoa(name));
         return decodeAxios(ServerCodec, res.data);
     }
-    async createSession(device, user, message, group, 
-    /* this is passed through if the first message is
-    part of a group message */
-    mailID, forward) {
-        let keyBundle;
+    /**
+     * `xDHAsync` and other helpers in `@vex-chat/crypto` use the process-wide
+     * active profile. When several {@link Client} instances use different
+     * `cryptoProfile` values, scope the global to this instance for the duration
+     * of that crypto work.
+     */
+    async runWithThisCryptoProfile(fn) {
+        const prev = getCryptoProfile();
+        if (prev === this.cryptoProfile) {
+            return await fn();
+        }
+        setCryptoProfile(this.cryptoProfile);
         try {
-            keyBundle = await this.retrieveKeyBundle(device.deviceID);
+            return await fn();
         }
-        catch {
-            return;
+        finally {
+            setCryptoProfile(prev);
         }
-        if (!this.xKeyRing) {
-            if (this.manuallyClosing) {
-                return;
+    }
+    async createSession(device, user, message, group, 
+    /* this is passed through if the first message is
+    part of a group message */
+    mailID, forward, 
+    /**
+     * When `readMail` triggers a best-effort session re-establish, key-bundle
+     * errors should not reject the full read pipeline.
+     */
+    allowKeyBundleFailure = false) {
+        return this.runWithThisCryptoProfile(async () => {
+            let keyBundle;
+            try {
+                keyBundle = await this.retrieveKeyBundle(device.deviceID);
             }
-            throw new Error("Key ring not initialized.");
-        }
-        // my keys
-        const IK_A = this.xKeyRing.identityKeys.secretKey;
-        const IK_AP = this.xKeyRing.identityKeys.publicKey;
-        const EK_A = this.xKeyRing.ephemeralKeys.secretKey;
-        // their keys
-        const IK_B_raw = XKeyConvert.convertPublicKey(new Uint8Array(keyBundle.signKey));
-        if (!IK_B_raw) {
-            throw new Error("Could not convert sign key to X25519.");
-        }
-        const IK_B = IK_B_raw;
-        const SPK_B = new Uint8Array(keyBundle.preKey.publicKey);
-        const OPK_B = keyBundle.otk
-            ? new Uint8Array(keyBundle.otk.publicKey)
-            : null;
-        // diffie hellman functions
-        const DH1 = xDH(new Uint8Array(IK_A), SPK_B);
-        const DH2 = xDH(new Uint8Array(EK_A), IK_B);
-        const DH3 = xDH(new Uint8Array(EK_A), SPK_B);
-        const DH4 = OPK_B ? xDH(new Uint8Array(EK_A), OPK_B) : null;
-        // initial key material
-        const IKM = DH4 ? xConcat(DH1, DH2, DH3, DH4) : xConcat(DH1, DH2, DH3);
-        // one time key index
-        const IDX = keyBundle.otk
-            ? XUtils.numberToUint8Arr(keyBundle.otk.index ?? 0)
-            : XUtils.numberToUint8Arr(0);
-        // shared secret key
-        const SK = xKDF(IKM);
-        const PK = xBoxKeyPairFromSecret(SK).publicKey;
-        const AD = xConcat(xEncode(xConstants.CURVE, IK_AP), xEncode(xConstants.CURVE, IK_B));
-        const nonce = xMakeNonce();
-        const cipher = xSecretbox(message, nonce, SK);
-        /* 32 bytes for signkey, 32 bytes for ephemeral key,
-        68 bytes for AD, 6 bytes for otk index (empty for no otk) */
-        const extra = xConcat(this.signKeys.publicKey, this.xKeyRing.ephemeralKeys.publicKey, PK, AD, IDX);
-        const mail = {
-            authorID: this.getUser().userID,
-            cipher,
-            extra,
-            forward,
-            group,
-            mailID: mailID || uuid.v4(),
-            mailType: MailType.initial,
-            nonce,
-            readerID: user.userID,
-            recipient: device.deviceID,
-            sender: this.getDevice().deviceID,
-        };
-        const hmac = xHMAC(mail, SK);
-        const msg = {
-            action: "CREATE",
-            data: mail,
-            resourceType: "mail",
-            transmissionID: uuid.v4(),
-            type: "resource",
-        };
-        // discard the ephemeral keys
-        this.newEphemeralKeys();
-        const sessionEntry = {
-            deviceID: device.deviceID,
-            fingerprint: XUtils.encodeHex(AD),
-            lastUsed: new Date().toISOString(),
-            mode: "initiator",
-            publicKey: XUtils.encodeHex(PK),
-            sessionID: uuid.v4(),
-            SK: XUtils.encodeHex(SK),
-            userID: user.userID,
-            verified: false,
-        };
-        await this.database.saveSession(sessionEntry);
-        this.emitter.emit("session", sessionEntry, user);
-        // emit the message
-        const forwardedMsg = forward
-            ? messageSchema.parse(msgpack.decode(message))
-            : null;
-        const emitMsg = forwardedMsg
-            ? { ...forwardedMsg, forward: true }
-            : {
-                authorID: mail.authorID,
-                decrypted: true,
-                direction: "outgoing",
-                forward: mail.forward,
-                group: mail.group ? uuid.stringify(mail.group) : null,
-                mailID: mail.mailID,
-                message: XUtils.encodeUTF8(message),
-                nonce: XUtils.encodeHex(new Uint8Array(mail.nonce)),
-                readerID: mail.readerID,
-                recipient: mail.recipient,
-                sender: mail.sender,
-                timestamp: new Date().toISOString(),
-            };
-        this.emitter.emit("message", emitMsg);
-        // send mail and wait for response
-        await new Promise((res, rej) => {
-            const callback = (packedMsg) => {
-                const [_header, receivedMsg] = XUtils.unpackMessage(packedMsg);
-                if (receivedMsg.transmissionID === msg.transmissionID) {
-                    this.socket.off("message", callback);
-                    const parsed = WSMessageSchema.safeParse(receivedMsg);
-                    if (parsed.success && parsed.data.type === "success") {
-                        res(parsed.data.data);
-                    }
-                    else {
-                        rej(new Error("Mail delivery failed: " +
-                            JSON.stringify(receivedMsg)));
-                    }
+            catch (e) {
+                if (allowKeyBundleFailure) {
+                    return;
                 }
+                const wrap = e instanceof Error ? e : new Error(String(e), { cause: e });
+                throw new Error(`Failed to load keyBundle for device ${device.deviceID}: ${wrap.message}`, { cause: e });
+            }
+            if (!this.xKeyRing) {
+                if (this.manuallyClosing) {
+                    return;
+                }
+                throw new Error("Key ring not initialized.");
+            }
+            // my keys
+            const IK_A = this.xKeyRing.identityKeys.secretKey;
+            const IK_AP = this.xKeyRing.identityKeys.publicKey;
+            const EK_A = this.xKeyRing.ephemeralKeys.secretKey;
+            const fips = this.cryptoProfile === "fips";
+            // their keys — FIPS: `signKey` in bundle is the peer P-256 ECDH identity (raw, typically 65B).
+            const SPK_B = new Uint8Array(keyBundle.preKey.publicKey);
+            const OPK_B = keyBundle.otk
+                ? new Uint8Array(keyBundle.otk.publicKey)
+                : null;
+            const IK_B = fips
+                ? new Uint8Array(keyBundle.signKey)
+                : (() => {
+                    const c = XKeyConvert.convertPublicKey(new Uint8Array(keyBundle.signKey));
+                    if (!c) {
+                        throw new Error("Could not convert sign key to X25519.");
+                    }
+                    return c;
+                })();
+            // diffie hellman functions
+            const DH1 = await xDHAsync(new Uint8Array(IK_A), SPK_B);
+            const DH2 = await xDHAsync(new Uint8Array(EK_A), IK_B);
+            const DH3 = await xDHAsync(new Uint8Array(EK_A), SPK_B);
+            const DH4 = OPK_B
+                ? await xDHAsync(new Uint8Array(EK_A), OPK_B)
+                : null;
+            // initial key material
+            const IKM = DH4
+                ? xConcat(DH1, DH2, DH3, DH4)
+                : xConcat(DH1, DH2, DH3);
+            // one time key index
+            const IDX = keyBundle.otk
+                ? XUtils.numberToUint8Arr(keyBundle.otk.index ?? 0)
+                : XUtils.numberToUint8Arr(0);
+            // shared secret key
+            const SK = xKDF(IKM);
+            const PK = (await xBoxKeyPairFromSecretAsync(SK)).publicKey;
+            const AD = fips
+                ? fipsP256AdFromIdentityPubs(IK_AP, new Uint8Array(keyBundle.signKey))
+                : xConcat(xEncode(xConstants.CURVE, IK_AP), xEncode(xConstants.CURVE, IK_B));
+            const nonce = xMakeNonce();
+            const cipher = await xSecretboxAsync(message, nonce, SK);
+            const signKeyWire = fips ? IK_AP : this.signKeys.publicKey;
+            const ephKeyWire = this.xKeyRing.ephemeralKeys.publicKey;
+            const extra = fips
+                ? encodeFipsInitialExtraV1(signKeyWire, ephKeyWire, PK, AD, IDX)
+                : xConcat(this.signKeys.publicKey, this.xKeyRing.ephemeralKeys.publicKey, PK, AD, IDX);
+            const mail = {
+                authorID: this.getUser().userID,
+                cipher,
+                extra,
+                forward,
+                group,
+                mailID: mailID || uuid.v4(),
+                mailType: MailType.initial,
+                nonce,
+                readerID: user.userID,
+                recipient: device.deviceID,
+                sender: this.getDevice().deviceID,
+            };
+            const hmac = xHMAC(mail, SK);
+            const msg = {
+                action: "CREATE",
+                data: mail,
+                resourceType: "mail",
+                transmissionID: uuid.v4(),
+                type: "resource",
             };
-            this.socket.on("message", callback);
-            void this.send(msg, hmac);
+            // discard the ephemeral keys
+            await this.newEphemeralKeys();
+            const sessionEntry = {
+                deviceID: device.deviceID,
+                fingerprint: XUtils.encodeHex(AD),
+                lastUsed: new Date().toISOString(),
+                mode: "initiator",
+                publicKey: XUtils.encodeHex(PK),
+                sessionID: uuid.v4(),
+                SK: XUtils.encodeHex(SK),
+                userID: user.userID,
+                verified: false,
+            };
+            await this.database.saveSession(sessionEntry);
+            this.emitter.emit("session", sessionEntry, user);
+            // emit the message
+            const forwardedMsg = forward
+                ? messageSchema.parse(msgpack.decode(message))
+                : null;
+            const emitMsg = forwardedMsg
+                ? { ...forwardedMsg, forward: true }
+                : {
+                    authorID: mail.authorID,
+                    decrypted: true,
+                    direction: "outgoing",
+                    forward: mail.forward,
+                    group: mail.group ? uuid.stringify(mail.group) : null,
+                    mailID: mail.mailID,
+                    message: XUtils.encodeUTF8(message),
+                    nonce: XUtils.encodeHex(new Uint8Array(mail.nonce)),
+                    readerID: mail.readerID,
+                    recipient: mail.recipient,
+                    sender: mail.sender,
+                    timestamp: new Date().toISOString(),
+                };
+            this.emitter.emit("message", emitMsg);
+            // send mail and wait for response
+            await new Promise((res, rej) => {
+                const callback = (packedMsg) => {
+                    const [_header, receivedMsg] = XUtils.unpackMessage(packedMsg);
+                    if (receivedMsg.transmissionID === msg.transmissionID) {
+                        this.socket.off("message", callback);
+                        const parsed = WSMessageSchema.safeParse(receivedMsg);
+                        if (parsed.success && parsed.data.type === "success") {
+                            res(parsed.data.data);
+                        }
+                        else {
+                            rej(new Error("Mail delivery failed: " +
+                                JSON.stringify(receivedMsg)));
+                        }
+                    }
+                };
+                this.socket.on("message", callback);
+                void this.send(msg, hmac);
+            });
         });
-        this.sending.delete(device.deviceID);
     }
     async deleteChannel(channelID) {
         await this.http.delete(this.getHost() + "/channel/" + channelID);
@@ -1056,19 +1305,17 @@ export class Client {
         }
         const msgBytes = Uint8Array.from(msgpack.encode(copy));
         const devices = await this.fetchUserDeviceListWithBackoff(this.getUser().userID, "own");
-        const promises = [];
         for (const device of devices) {
-            if (device.deviceID !== this.getDevice().deviceID) {
-                promises.push(this.sendMail(device, this.getUser(), msgBytes, null, copy.mailID, true));
+            if (device.deviceID === this.getDevice().deviceID) {
+                continue;
             }
-        }
-        void Promise.allSettled(promises).then((results) => {
-            for (const result of results) {
-                const { status } = result;
-                if (status === "rejected") {
-                }
+            try {
+                await this.sendMail(device, this.getUser(), msgBytes, null, copy.mailID, true);
             }
-        });
+            catch {
+                /* best-effort per device; parallel handshakes share ephemeral state */
+            }
+        }
     }
     async getChannelByID(channelID) {
         try {
@@ -1151,18 +1398,45 @@ export class Client {
                 .array(mailInboxEntry)
                 .parse(msgpack.decode(mailBuffer));
             const inbox = rawInbox.sort((a, b) => b[2].localeCompare(a[2]));
+            if (libvexDebugDmEnabled()) {
+                const did = (() => {
+                    try {
+                        return this.getDevice().deviceID;
+                    }
+                    catch {
+                        return "(no device)";
+                    }
+                })();
+                debugLibvexDm("getMail: inbox", {
+                    deviceID: did,
+                    count: String(inbox.length),
+                });
+            }
             for (const mailDetails of inbox) {
                 const [mailHeader, mailBody, timestamp] = mailDetails;
                 try {
+                    if (libvexDebugDmEnabled()) {
+                        debugLibvexDm("getMail: readMail one", {
+                            mailID: mailBody.mailID,
+                            type: String(mailBody.mailType),
+                            recipient: mailBody.recipient,
+                        });
+                    }
                     await this.readMail(mailHeader, mailBody, timestamp);
                 }
-                catch (_readMailErr) {
-                    // non-fatal — inspect _readMailErr in a debugger
+                catch (readMailErr) {
+                    if (libvexDebugDmEnabled()) {
+                        // eslint-disable-next-line no-console -- LIBVEX_DEBUG_DM only
+                        console.error("[libvex:debug-dm] readMail threw", readMailErr);
+                    }
                 }
             }
         }
-        catch (_fetchErr) {
-            // non-fatal — inspect _fetchErr in a debugger
+        catch (fetchErr) {
+            if (libvexDebugDmEnabled()) {
+                // eslint-disable-next-line no-console -- LIBVEX_DEBUG_DM only
+                console.error("[libvex:debug-dm] getMail fetch failed", fetchErr);
+            }
         }
         this.fetchingMail = false;
     }
@@ -1411,7 +1685,7 @@ export class Client {
                 const msg = parseResult.data;
                 switch (msg.type) {
                     case "challenge":
-                        this.respond(msg);
+                        void this.respond(msg);
                         break;
                     case "error":
                         break;
@@ -1470,14 +1744,14 @@ export class Client {
         }
         await this.submitOTK(needs);
     }
-    newEphemeralKeys() {
+    async newEphemeralKeys() {
         if (!this.xKeyRing) {
             if (this.manuallyClosing) {
                 return;
             }
             throw new Error("Key ring not initialized.");
         }
-        this.xKeyRing.ephemeralKeys = xBoxKeyPair();
+        this.xKeyRing.ephemeralKeys = await xBoxKeyPairAsync();
     }
     ping() {
         if (!this.isAlive) {
@@ -1497,7 +1771,7 @@ export class Client {
         const existingPreKeys = await this.database.getPreKeys();
         const preKeys = existingPreKeys ??
             (await (async () => {
-                const unsaved = this.createPreKey();
+                const unsaved = await this.createPreKey();
                 const [saved] = await this.database.savePreKeys([unsaved], false);
                 if (!saved || saved.index == null)
                     throw new Error("Failed to save prekey — no index returned.");
@@ -1508,7 +1782,7 @@ export class Client {
             this.sessionRecords[session.publicKey] =
                 sqlSessionToCrypto(session);
         }
-        const ephemeralKeys = xBoxKeyPair();
+        const ephemeralKeys = await xBoxKeyPairAsync();
         this.xKeyRing = {
             ephemeralKeys,
             identityKeys,
@@ -1516,11 +1790,15 @@ export class Client {
         };
     }
     async postAuth() {
+        const versionAtStart = this.postAuthVersion;
         let count = 0;
         for (;;) {
             if (this.isManualCloseInFlight()) {
                 return;
             }
+            if (this.postAuthVersion !== versionAtStart) {
+                return;
+            }
             try {
                 await this.getMail();
                 count++;
@@ -1534,12 +1812,18 @@ export class Client {
             if (this.isManualCloseInFlight()) {
                 return;
             }
+            if (this.postAuthVersion !== versionAtStart) {
+                return;
+            }
             // Chunk the idle delay so `close()` can unwind instead of waiting
             // out one full 60s timer (which would keep the process alive).
             for (let i = 0; i < 60; i++) {
                 if (this.isManualCloseInFlight()) {
                     return;
                 }
+                if (this.postAuthVersion !== versionAtStart) {
+                    return;
+                }
                 await sleep(1000);
             }
         }
@@ -1549,10 +1833,28 @@ export class Client {
     }
     async readMail(header, mail, timestamp) {
         if (this.seenMailIDs.has(mail.mailID)) {
+            if (libvexDebugDmEnabled()) {
+                try {
+                    debugLibvexDm("readMail: skip (seen mailID)", {
+                        mailID: mail.mailID,
+                        thisDevice: this.getDevice().deviceID,
+                    });
+                }
+                catch {
+                    debugLibvexDm("readMail: skip (seen mailID)", {
+                        mailID: mail.mailID,
+                    });
+                }
+            }
             return;
         }
         this.seenMailIDs.add(mail.mailID);
         if (this.manuallyClosing) {
+            if (libvexDebugDmEnabled()) {
+                debugLibvexDm("readMail: skip (manually closing)", {
+                    mailID: mail.mailID,
+                });
+            }
             return;
         }
         this.sendReceipt(new Uint8Array(mail.nonce));
@@ -1563,207 +1865,297 @@ export class Client {
         }
         this.reading = true;
         try {
-            const healSession = async () => {
-                if (this.manuallyClosing || !this.xKeyRing) {
-                    return;
-                }
-                const deviceEntry = await this.getDeviceByID(mail.sender);
-                const [user, _err] = await this.fetchUser(mail.authorID);
-                if (deviceEntry && user) {
-                    void this.createSession(deviceEntry, user, XUtils.decodeUTF8(`��RETRY_REQUEST:${mail.mailID}��`), mail.group, uuid.v4(), false);
-                }
-            };
-            switch (mail.mailType) {
-                case MailType.initial:
-                    const extraParts = Client.deserializeExtra(MailType.initial, new Uint8Array(mail.extra));
-                    const signKey = extraParts[0];
-                    const ephKey = extraParts[1];
-                    const indexBytes = extraParts[3];
-                    if (!signKey || !ephKey || !indexBytes) {
-                        throw new Error("Malformed initial mail extra: missing signKey, ephKey, or indexBytes");
-                    }
-                    const preKeyIndex = XUtils.uint8ArrToNumber(indexBytes);
-                    const otk = preKeyIndex === 0
-                        ? null
-                        : await this.database.getOneTimeKey(preKeyIndex);
-                    if (otk?.index !== preKeyIndex && preKeyIndex !== 0) {
-                        return;
-                    }
-                    // their public keys
-                    const IK_A_raw = XKeyConvert.convertPublicKey(signKey);
-                    if (!IK_A_raw) {
+            await this.runWithThisCryptoProfile(async () => {
+                const healSession = async () => {
+                    if (this.manuallyClosing || !this.xKeyRing) {
                         return;
                     }
-                    const IK_A = IK_A_raw;
-                    const EK_A = ephKey;
-                    if (!this.xKeyRing) {
-                        return;
+                    const deviceEntry = await this.getDeviceByID(mail.sender);
+                    const [user, _err] = await this.fetchUser(mail.authorID);
+                    if (deviceEntry && user) {
+                        void this.createSession(deviceEntry, user, XUtils.decodeUTF8(`��RETRY_REQUEST:${mail.mailID}��`), mail.group, uuid.v4(), false, true);
                     }
-                    // my private keys
-                    const IK_B = this.xKeyRing.identityKeys.secretKey;
-                    const IK_BP = this.xKeyRing.identityKeys.publicKey;
-                    const SPK_B = this.xKeyRing.preKeys.keyPair.secretKey;
-                    const OPK_B = otk ? otk.keyPair.secretKey : null;
-                    // diffie hellman functions
-                    const DH1 = xDH(SPK_B, IK_A);
-                    const DH2 = xDH(IK_B, EK_A);
-                    const DH3 = xDH(SPK_B, EK_A);
-                    const DH4 = OPK_B ? xDH(OPK_B, EK_A) : null;
-                    // initial key material
-                    const IKM = DH4
-                        ? xConcat(DH1, DH2, DH3, DH4)
-                        : xConcat(DH1, DH2, DH3);
-                    // shared secret key
-                    const SK = xKDF(IKM);
-                    const PK = xBoxKeyPairFromSecret(SK).publicKey;
-                    const hmac = xHMAC(mail, SK);
-                    // associated data
-                    const AD = xConcat(xEncode(xConstants.CURVE, IK_A), xEncode(xConstants.CURVE, IK_BP));
-                    if (!XUtils.bytesEqual(hmac, header)) {
-                        return;
-                    }
-                    const unsealed = xSecretboxOpen(new Uint8Array(mail.cipher), new Uint8Array(mail.nonce), SK);
-                    if (unsealed) {
-                        let plaintext = "";
-                        if (!mail.forward) {
-                            plaintext = XUtils.encodeUTF8(unsealed);
+                };
+                switch (mail.mailType) {
+                    case MailType.initial:
+                        const extraParts = Client.deserializeExtra(MailType.initial, new Uint8Array(mail.extra));
+                        const signKey = extraParts[0];
+                        const ephKey = extraParts[1];
+                        const indexBytes = extraParts[3];
+                        if (!signKey || !ephKey || !indexBytes) {
+                            throw new Error("Malformed initial mail extra: missing signKey, ephKey, or indexBytes");
                         }
-                        // emit the message
-                        const fwdMsg1 = mail.forward
-                            ? messageSchema.parse(msgpack.decode(unsealed))
-                            : null;
-                        const message = fwdMsg1
-                            ? { ...fwdMsg1, forward: true }
-                            : {
-                                authorID: mail.authorID,
-                                decrypted: true,
-                                direction: "incoming",
-                                forward: mail.forward,
-                                group: mail.group
-                                    ? uuid.stringify(mail.group)
-                                    : null,
-                                mailID: mail.mailID,
-                                message: plaintext,
-                                nonce: XUtils.encodeHex(new Uint8Array(mail.nonce)),
-                                readerID: mail.readerID,
-                                recipient: mail.recipient,
-                                sender: mail.sender,
-                                timestamp: timestamp,
-                            };
-                        this.emitter.emit("message", message);
-                        // discard onetimekey
-                        await this.database.deleteOneTimeKey(preKeyIndex);
-                        const deviceEntry = await this.getDeviceByID(mail.sender);
-                        if (!deviceEntry) {
-                            throw new Error("Couldn't get device entry.");
+                        const preKeyIndex = XUtils.uint8ArrToNumber(indexBytes);
+                        const otk = preKeyIndex === 0
+                            ? null
+                            : await this.database.getOneTimeKey(preKeyIndex);
+                        if (otk?.index !== preKeyIndex && preKeyIndex !== 0) {
+                            if (libvexDebugDmEnabled()) {
+                                try {
+                                    debugLibvexDm("readMail initial: abort (otk index mismatch)", {
+                                        mailID: mail.mailID,
+                                        preKeyIndex: String(preKeyIndex),
+                                        otkIndex: String(otk?.index ?? "null"),
+                                        thisDevice: this.getDevice().deviceID,
+                                    });
+                                }
+                                catch {
+                                    debugLibvexDm("readMail initial: abort (otk index mismatch)", {
+                                        mailID: mail.mailID,
+                                    });
+                                }
+                            }
+                            return;
                         }
-                        const [userEntry, _userErr] = await this.fetchUser(deviceEntry.owner);
-                        if (!userEntry) {
-                            throw new Error("Couldn't get user entry.");
+                        // their public keys
+                        const fipsRead = isFipsInitialExtraV1(new Uint8Array(mail.extra));
+                        const IK_A = fipsRead
+                            ? signKey
+                            : (() => {
+                                const c = XKeyConvert.convertPublicKey(signKey);
+                                if (!c) {
+                                    return null;
+                                }
+                                return c;
+                            })();
+                        if (!IK_A) {
+                            if (libvexDebugDmEnabled()) {
+                                try {
+                                    debugLibvexDm("readMail initial: abort (IK_A null, Ed→X25519?)", {
+                                        mailID: mail.mailID,
+                                        fips: String(fipsRead),
+                                        thisDevice: this.getDevice().deviceID,
+                                    });
+                                }
+                                catch {
+                                    debugLibvexDm("readMail initial: abort (IK_A null)", {
+                                        mailID: mail.mailID,
+                                    });
+                                }
+                            }
+                            return;
                         }
-                        this.userRecords[userEntry.userID] = userEntry;
-                        this.deviceRecords[deviceEntry.deviceID] = deviceEntry;
-                        // save session
-                        const newSession = {
-                            deviceID: mail.sender,
-                            fingerprint: XUtils.encodeHex(AD),
-                            lastUsed: new Date().toISOString(),
-                            mode: "receiver",
-                            publicKey: XUtils.encodeHex(PK),
-                            sessionID: uuid.v4(),
-                            SK: XUtils.encodeHex(SK),
-                            userID: userEntry.userID,
-                            verified: false,
-                        };
-                        await this.database.saveSession(newSession);
-                        const [user] = await this.fetchUser(newSession.userID);
-                        if (user) {
-                            this.emitter.emit("session", newSession, user);
+                        const EK_A = ephKey;
+                        if (!this.xKeyRing) {
+                            if (libvexDebugDmEnabled()) {
+                                debugLibvexDm("readMail initial: abort (no xKeyRing)", {
+                                    mailID: mail.mailID,
+                                });
+                            }
+                            return;
+                        }
+                        // my private keys
+                        const IK_B = this.xKeyRing.identityKeys.secretKey;
+                        const IK_BP = this.xKeyRing.identityKeys.publicKey;
+                        const SPK_B = this.xKeyRing.preKeys.keyPair.secretKey;
+                        const OPK_B = otk ? otk.keyPair.secretKey : null;
+                        // diffie hellman functions
+                        const DH1 = await xDHAsync(SPK_B, IK_A);
+                        const DH2 = await xDHAsync(IK_B, EK_A);
+                        const DH3 = await xDHAsync(SPK_B, EK_A);
+                        const DH4 = OPK_B ? await xDHAsync(OPK_B, EK_A) : null;
+                        // initial key material
+                        const IKM = DH4
+                            ? xConcat(DH1, DH2, DH3, DH4)
+                            : xConcat(DH1, DH2, DH3);
+                        // shared secret key
+                        const SK = xKDF(IKM);
+                        const PK = (await xBoxKeyPairFromSecretAsync(SK))
+                            .publicKey;
+                        const hmac = xHMAC(mail, SK);
+                        // associated data
+                        const AD = fipsRead
+                            ? fipsP256AdFromIdentityPubs(IK_A, IK_BP)
+                            : xConcat(xEncode(xConstants.CURVE, IK_A), xEncode(xConstants.CURVE, IK_BP));
+                        if (!XUtils.bytesEqual(hmac, header)) {
+                            if (libvexDebugDmEnabled()) {
+                                try {
+                                    debugLibvexDm("readMail initial: abort (HMAC mismatch)", {
+                                        mailID: mail.mailID,
+                                        preKeyIndex: String(preKeyIndex),
+                                        thisDevice: this.getDevice().deviceID,
+                                    });
+                                }
+                                catch {
+                                    debugLibvexDm("readMail initial: abort (HMAC mismatch)", {
+                                        mailID: mail.mailID,
+                                    });
+                                }
+                            }
+                            return;
+                        }
+                        const unsealed = await xSecretboxOpenAsync(new Uint8Array(mail.cipher), new Uint8Array(mail.nonce), SK);
+                        if (unsealed) {
+                            let plaintext = "";
+                            if (!mail.forward) {
+                                plaintext = XUtils.encodeUTF8(unsealed);
+                            }
+                            // emit the message
+                            const fwdMsg1 = mail.forward
+                                ? messageSchema.parse(msgpack.decode(unsealed))
+                                : null;
+                            const message = fwdMsg1
+                                ? { ...fwdMsg1, forward: true }
+                                : {
+                                    authorID: mail.authorID,
+                                    decrypted: true,
+                                    direction: "incoming",
+                                    forward: mail.forward,
+                                    group: mail.group
+                                        ? uuid.stringify(mail.group)
+                                        : null,
+                                    mailID: mail.mailID,
+                                    message: plaintext,
+                                    nonce: XUtils.encodeHex(new Uint8Array(mail.nonce)),
+                                    readerID: mail.readerID,
+                                    recipient: mail.recipient,
+                                    sender: mail.sender,
+                                    timestamp: timestamp,
+                                };
+                            this.emitter.emit("message", message);
+                            if (libvexDebugDmEnabled()) {
+                                try {
+                                    debugLibvexDm("readMail initial: ok (emit message)", {
+                                        mailID: mail.mailID,
+                                        preKeyIndex: String(preKeyIndex),
+                                        thisDevice: this.getDevice().deviceID,
+                                        plaintextLen: String(plaintext.length),
+                                    });
+                                }
+                                catch {
+                                    debugLibvexDm("readMail initial: ok (emit message)", {
+                                        mailID: mail.mailID,
+                                    });
+                                }
+                            }
+                            // preKeyIndex 0 = med prekey only (no OTK in the X3DH path). Do
+                            // not call deleteOneTimeKey(0) — that is not "remove OTK row 0".
+                            if (preKeyIndex !== 0) {
+                                await this.database.deleteOneTimeKey(preKeyIndex);
+                            }
+                            const deviceEntry = await this.getDeviceByID(mail.sender);
+                            if (!deviceEntry) {
+                                throw new Error("Couldn't get device entry.");
+                            }
+                            const [userEntry, _userErr] = await this.fetchUser(deviceEntry.owner);
+                            if (!userEntry) {
+                                throw new Error("Couldn't get user entry.");
+                            }
+                            this.userRecords[userEntry.userID] = userEntry;
+                            this.deviceRecords[deviceEntry.deviceID] =
+                                deviceEntry;
+                            // save session
+                            const newSession = {
+                                deviceID: mail.sender,
+                                fingerprint: XUtils.encodeHex(AD),
+                                lastUsed: new Date().toISOString(),
+                                mode: "receiver",
+                                publicKey: XUtils.encodeHex(PK),
+                                sessionID: uuid.v4(),
+                                SK: XUtils.encodeHex(SK),
+                                userID: userEntry.userID,
+                                verified: false,
+                            };
+                            await this.database.saveSession(newSession);
+                            const [user] = await this.fetchUser(newSession.userID);
+                            if (user) {
+                                this.emitter.emit("session", newSession, user);
+                            }
+                            else {
+                            }
                         }
                         else {
+                            if (libvexDebugDmEnabled()) {
+                                debugLibvexDm("readMail initial: abort (xSecretboxOpen null)", {
+                                    mailID: mail.mailID,
+                                    preKeyIndex: String(preKeyIndex),
+                                });
+                            }
                         }
-                    }
-                    else {
-                    }
-                    break;
-                case MailType.subsequent:
-                    const publicKey = Client.deserializeExtra(mail.mailType, new Uint8Array(mail.extra))[0];
-                    if (!publicKey) {
-                        throw new Error("Malformed subsequent mail extra: missing publicKey");
-                    }
-                    let session = await this.getSessionByPubkey(publicKey);
-                    let retries = 0;
-                    while (!session) {
-                        if (retries >= 3) {
-                            break;
+                        break;
+                    case MailType.subsequent: {
+                        const extraBuf = new Uint8Array(mail.extra);
+                        const publicKey = isFipsSubsequentExtraV1(extraBuf)
+                            ? decodeFipsSubsequentExtraV1(extraBuf)
+                            : Client.deserializeExtra(mail.mailType, extraBuf)[0];
+                        if (!publicKey) {
+                            throw new Error("Malformed subsequent mail extra: missing publicKey");
                         }
-                        await sleep(100 * 2 ** retries);
-                        retries++;
-                        session = await this.getSessionByPubkey(publicKey);
-                    }
-                    if (!session) {
-                        void healSession();
-                        return;
-                    }
-                    const HMAC = xHMAC(mail, session.SK);
-                    if (!XUtils.bytesEqual(HMAC, header)) {
-                        void healSession();
-                        return;
-                    }
-                    const decrypted = xSecretboxOpen(new Uint8Array(mail.cipher), new Uint8Array(mail.nonce), session.SK);
-                    if (decrypted) {
-                        const fwdMsg2 = mail.forward
-                            ? messageSchema.parse(msgpack.decode(decrypted))
-                            : null;
-                        const message = fwdMsg2
-                            ? {
-                                ...fwdMsg2,
-                                forward: true,
+                        let session = await this.getSessionByPubkey(publicKey);
+                        let retries = 0;
+                        while (!session) {
+                            if (retries >= 3) {
+                                break;
                             }
-                            : {
+                            await sleep(100 * 2 ** retries);
+                            retries++;
+                            session = await this.getSessionByPubkey(publicKey);
+                        }
+                        if (!session) {
+                            void healSession();
+                            return;
+                        }
+                        const HMAC = xHMAC(mail, session.SK);
+                        if (!XUtils.bytesEqual(HMAC, header)) {
+                            void healSession();
+                            return;
+                        }
+                        const decrypted = await xSecretboxOpenAsync(new Uint8Array(mail.cipher), new Uint8Array(mail.nonce), session.SK);
+                        if (decrypted) {
+                            const fwdMsg2 = mail.forward
+                                ? messageSchema.parse(msgpack.decode(decrypted))
+                                : null;
+                            const message = fwdMsg2
+                                ? {
+                                    ...fwdMsg2,
+                                    forward: true,
+                                }
+                                : {
+                                    authorID: mail.authorID,
+                                    decrypted: true,
+                                    direction: "incoming",
+                                    forward: mail.forward,
+                                    group: mail.group
+                                        ? uuid.stringify(mail.group)
+                                        : null,
+                                    mailID: mail.mailID,
+                                    message: XUtils.encodeUTF8(decrypted),
+                                    nonce: XUtils.encodeHex(new Uint8Array(mail.nonce)),
+                                    readerID: mail.readerID,
+                                    recipient: mail.recipient,
+                                    sender: mail.sender,
+                                    timestamp: timestamp,
+                                };
+                            this.emitter.emit("message", message);
+                            void this.database.markSessionUsed(session.sessionID);
+                        }
+                        else {
+                            void healSession();
+                            // emit the message
+                            const message = {
                                 authorID: mail.authorID,
-                                decrypted: true,
+                                decrypted: false,
                                 direction: "incoming",
                                 forward: mail.forward,
                                 group: mail.group
                                     ? uuid.stringify(mail.group)
                                     : null,
                                 mailID: mail.mailID,
-                                message: XUtils.encodeUTF8(decrypted),
+                                message: "",
                                 nonce: XUtils.encodeHex(new Uint8Array(mail.nonce)),
                                 readerID: mail.readerID,
                                 recipient: mail.recipient,
                                 sender: mail.sender,
                                 timestamp: timestamp,
                             };
-                        this.emitter.emit("message", message);
-                        void this.database.markSessionUsed(session.sessionID);
-                    }
-                    else {
-                        void healSession();
-                        // emit the message
-                        const message = {
-                            authorID: mail.authorID,
-                            decrypted: false,
-                            direction: "incoming",
-                            forward: mail.forward,
-                            group: mail.group
-                                ? uuid.stringify(mail.group)
-                                : null,
-                            mailID: mail.mailID,
-                            message: "",
-                            nonce: XUtils.encodeHex(new Uint8Array(mail.nonce)),
-                            readerID: mail.readerID,
-                            recipient: mail.recipient,
-                            sender: mail.sender,
-                            timestamp: timestamp,
-                        };
-                        this.emitter.emit("message", message);
+                            this.emitter.emit("message", message);
+                        }
+                        break;
                     }
-                    break;
-                default:
-                    break;
-            }
+                    default:
+                        break;
+                }
+            });
         }
         finally {
             this.reading = false;
@@ -1792,8 +2184,11 @@ export class Client {
         if (!token) {
             throw new Error("Couldn't fetch token.");
         }
+        // Stored on Spire for signature verification: Ed25519 (hex) in tweetnacl;
+        // P-256 ECDSA SPKI (hex) in FIPS. The server maps this to a raw ECDH
+        // identity in `getKeyBundle` for X3DH; see spire `Database.getKeyBundle`.
         const signKey = this.getKeys().public;
-        const signed = XUtils.encodeHex(xSign(Uint8Array.from(uuid.parse(token.key)), this.signKeys.secretKey));
+        const signed = XUtils.encodeHex(await xSignAsync(Uint8Array.from(uuid.parse(token.key)), this.signKeys.secretKey));
         const devPreKeyIndex = this.xKeyRing.preKeys.index;
         const devMsg = {
             deviceName: this.options?.deviceName ?? "unknown",
@@ -1811,9 +2206,9 @@ export class Client {
             "/devices", msgpack.encode(devMsg), { headers: { "Content-Type": "application/msgpack" } });
         return decodeAxios(DeviceCodec, res.data);
     }
-    respond(msg) {
+    async respond(msg) {
         const response = {
-            signed: xSign(new Uint8Array(msg.challenge), this.signKeys.secretKey),
+            signed: await xSignAsync(new Uint8Array(msg.challenge), this.signKeys.secretKey),
             transmissionID: msg.transmissionID,
             type: "response",
         };
@@ -1849,7 +2244,7 @@ export class Client {
             },
         });
         const fileData = res.data;
-        const decrypted = xSecretboxOpen(new Uint8Array(fileData), XUtils.decodeHex(details.nonce), XUtils.decodeHex(key));
+        const decrypted = await xSecretboxOpenAsync(new Uint8Array(fileData), XUtils.decodeHex(details.nonce), XUtils.decodeHex(key));
         if (decrypted) {
             return {
                 data: new Uint8Array(decrypted),
@@ -1916,7 +2311,6 @@ export class Client {
             this.userRecords[user.userID] = user;
         }
         const mailID = uuid.v4();
-        const promises = [];
         const userIDs = [...new Set(userList.map((user) => user.userID))];
         const devices = await this.getMultiUserDeviceList(userIDs);
         for (const device of devices) {
@@ -1924,15 +2318,13 @@ export class Client {
             if (!ownerRecord) {
                 continue;
             }
-            promises.push(this.sendMail(device, ownerRecord, XUtils.decodeUTF8(message), uuidToUint8(channelID), mailID, false));
-        }
-        void Promise.allSettled(promises).then((results) => {
-            for (const result of results) {
-                const { status } = result;
-                if (status === "rejected") {
-                }
+            try {
+                await this.sendMail(device, ownerRecord, XUtils.decodeUTF8(message), uuidToUint8(channelID), mailID, false);
             }
-        });
+            catch {
+                /* best-effort; each device needs its own X3DH handshake (sequential) */
+            }
+        }
     }
     /* Sends encrypted mail to a user. */
     async sendMail(device, user, msg, group, mailID, forward, retry = false) {
@@ -1940,74 +2332,97 @@ export class Client {
             await sleep(100);
         }
         this.sending.set(device.deviceID, device);
-        const session = await this.database.getSessionByDeviceID(device.deviceID);
-        if (!session || retry) {
-            await this.createSession(device, user, msg, group, mailID, forward);
-            return;
-        }
-        const nonce = xMakeNonce();
-        const cipher = xSecretbox(msg, nonce, session.SK);
-        const extra = session.publicKey;
-        const mail = {
-            authorID: this.getUser().userID,
-            cipher,
-            extra,
-            forward,
-            group,
-            mailID: mailID || uuid.v4(),
-            mailType: MailType.subsequent,
-            nonce,
-            readerID: session.userID,
-            recipient: device.deviceID,
-            sender: this.getDevice().deviceID,
-        };
-        const msgb = {
-            action: "CREATE",
-            data: mail,
-            resourceType: "mail",
-            transmissionID: uuid.v4(),
-            type: "resource",
-        };
-        const hmac = xHMAC(mail, session.SK);
-        const fwdOut = forward
-            ? messageSchema.parse(msgpack.decode(msg))
-            : null;
-        const outMsg = fwdOut
-            ? { ...fwdOut, forward: true }
-            : {
-                authorID: mail.authorID,
-                decrypted: true,
-                direction: "outgoing",
-                forward: mail.forward,
-                group: mail.group ? uuid.stringify(mail.group) : null,
-                mailID: mail.mailID,
-                message: XUtils.encodeUTF8(msg),
-                nonce: XUtils.encodeHex(new Uint8Array(mail.nonce)),
-                readerID: mail.readerID,
-                recipient: mail.recipient,
-                sender: mail.sender,
-                timestamp: new Date().toISOString(),
-            };
-        this.emitter.emit("message", outMsg);
-        await new Promise((res, rej) => {
-            const callback = (packedMsg) => {
-                const [_header, receivedMsg] = XUtils.unpackMessage(packedMsg);
-                if (receivedMsg.transmissionID === msgb.transmissionID) {
-                    this.socket.off("message", callback);
-                    const parsed = WSMessageSchema.safeParse(receivedMsg);
-                    if (parsed.success && parsed.data.type === "success") {
-                        res(parsed.data.data);
-                    }
-                    else {
-                        rej(new Error("Mail delivery failed: " +
-                            JSON.stringify(receivedMsg)));
-                    }
+        try {
+            const session = await this.database.getSessionByDeviceID(device.deviceID);
+            if (!session || retry) {
+                if (libvexDebugDmEnabled()) {
+                    debugLibvexDm("sendMail: createSession path", {
+                        peerDevice: device.deviceID,
+                        retry: String(retry),
+                        hasSession: String(!!session),
+                    });
                 }
+                await this.createSession(device, user, msg, group, mailID, forward, false);
+                if (libvexDebugDmEnabled()) {
+                    debugLibvexDm("sendMail: createSession returned", {
+                        peerDevice: device.deviceID,
+                    });
+                }
+                return;
+            }
+            if (libvexDebugDmEnabled()) {
+                debugLibvexDm("sendMail: subsequent path", {
+                    peerDevice: device.deviceID,
+                });
+            }
+            const nonce = xMakeNonce();
+            const cipher = await xSecretboxAsync(msg, nonce, session.SK);
+            const extra = this.cryptoProfile === "fips"
+                ? encodeFipsSubsequentExtraV1(session.publicKey)
+                : session.publicKey;
+            const mail = {
+                authorID: this.getUser().userID,
+                cipher,
+                extra,
+                forward,
+                group,
+                mailID: mailID || uuid.v4(),
+                mailType: MailType.subsequent,
+                nonce,
+                readerID: session.userID,
+                recipient: device.deviceID,
+                sender: this.getDevice().deviceID,
             };
-            this.socket.on("message", callback);
-            void this.send(msgb, hmac);
-        });
-        this.sending.delete(device.deviceID);
+            const msgb = {
+                action: "CREATE",
+                data: mail,
+                resourceType: "mail",
+                transmissionID: uuid.v4(),
+                type: "resource",
+            };
+            const hmac = xHMAC(mail, session.SK);
+            const fwdOut = forward
+                ? messageSchema.parse(msgpack.decode(msg))
+                : null;
+            const outMsg = fwdOut
+                ? { ...fwdOut, forward: true }
+                : {
+                    authorID: mail.authorID,
+                    decrypted: true,
+                    direction: "outgoing",
+                    forward: mail.forward,
+                    group: mail.group ? uuid.stringify(mail.group) : null,
+                    mailID: mail.mailID,
+                    message: XUtils.encodeUTF8(msg),
+                    nonce: XUtils.encodeHex(new Uint8Array(mail.nonce)),
+                    readerID: mail.readerID,
+                    recipient: mail.recipient,
+                    sender: mail.sender,
+                    timestamp: new Date().toISOString(),
+                };
+            this.emitter.emit("message", outMsg);
+            await new Promise((res, rej) => {
+                const callback = (packedMsg) => {
+                    const [_header, receivedMsg] = XUtils.unpackMessage(packedMsg);
+                    if (receivedMsg.transmissionID === msgb.transmissionID) {
+                        this.socket.off("message", callback);
+                        const parsed = WSMessageSchema.safeParse(receivedMsg);
+                        if (parsed.success && parsed.data.type === "success") {
+                            res(parsed.data.data);
+                        }
+                        else {
+                            rej(new Error("Mail delivery failed: " +
+                                JSON.stringify(receivedMsg)));
+                        }
+                    }
+                };
+                this.socket.on("message", callback);
+                void this.send(msgb, hmac);
+            });
+        }
+        finally {
+            this.sending.delete(device.deviceID);
+        }
     }
     async sendMessage(userID, message) {
         try {
@@ -2018,19 +2433,85 @@ export class Client {
             if (!userEntry) {
                 throw new Error("Couldn't get user entry.");
             }
-            const deviceList = await this.fetchUserDeviceListWithBackoff(userID, "peer");
-            const mailID = uuid.v4();
-            const promises = [];
-            for (const device of deviceList) {
-                promises.push(this.sendMail(device, userEntry, XUtils.decodeUTF8(message), null, mailID, false));
+            const afterBackoff = await this.fetchUserDeviceListWithBackoff(userID, "peer");
+            // Back-to-back GETs, merged by deviceID: a second read can list a device
+            // that was not visible in the first snapshot (automation + multi-device)
+            // without adding a fixed sleep.
+            let deviceListRaw = afterBackoff;
+            try {
+                const again = await this.fetchUserDeviceListOnce(userID);
+                const byId = new Map();
+                for (const d of afterBackoff) {
+                    byId.set(d.deviceID, d);
+                }
+                for (const d of again) {
+                    byId.set(d.deviceID, d);
+                }
+                deviceListRaw = [...byId.values()];
+            }
+            catch {
+                deviceListRaw = afterBackoff;
+            }
+            if (deviceListRaw.length === 0) {
+                throw new Error("No devices for user — cannot send direct message.");
             }
-            void Promise.allSettled(promises).then((results) => {
-                for (const result of results) {
-                    const { status } = result;
-                    if (status === "rejected") {
+            // Stable order (Peer device list is otherwise DB-order dependent).
+            const deviceList = [...deviceListRaw].sort((a, b) => a.deviceID.localeCompare(b.deviceID, "en"));
+            if (libvexDebugDmEnabled()) {
+                debugLibvexDm("sendMessage: peer device list (merged, sorted)", {
+                    userID,
+                    nAfterBackoff: String(afterBackoff.length),
+                    nMerged: String(deviceListRaw.length),
+                    nSorted: String(deviceList.length),
+                    ourDevice: this.getDevice().deviceID,
+                });
+                for (const [i, d] of deviceList.entries()) {
+                    debugLibvexDm(`sendMessage: device[${String(i)}]`, {
+                        deviceID: d.deviceID,
+                    });
+                }
+            }
+            let lastErr;
+            let failCount = 0;
+            for (const device of deviceList) {
+                const mailID = uuid.v4();
+                try {
+                    if (libvexDebugDmEnabled()) {
+                        debugLibvexDm("sendMessage: sendMail start", {
+                            recipientDevice: device.deviceID,
+                            mailID,
+                        });
+                    }
+                    await this.sendMail(device, userEntry, XUtils.decodeUTF8(message), null, mailID, false);
+                    if (libvexDebugDmEnabled()) {
+                        debugLibvexDm("sendMessage: sendMail ok", {
+                            recipientDevice: device.deviceID,
+                        });
                     }
                 }
-            });
+                catch (e) {
+                    if (libvexDebugDmEnabled()) {
+                        // eslint-disable-next-line no-console -- LIBVEX_DEBUG_DM only
+                        console.error("[libvex:debug-dm] sendMessage: sendMail failed for device", device.deviceID, e);
+                    }
+                    lastErr = e;
+                    failCount += 1;
+                }
+            }
+            if (failCount > 0) {
+                const base = lastErr instanceof Error
+                    ? lastErr
+                    : new Error(String(lastErr));
+                if (failCount === deviceList.length) {
+                    throw base;
+                }
+                // Multi-device: do not “succeed” when only one device of several got mail —
+                // callers and tests have no per-device result and the other copy times out.
+                const partial = new Error(`Direct message failed to reach ${String(failCount)} of ` +
+                    `${String(deviceList.length)} peer device(s) (X3DH/post).`);
+                partial.cause = base;
+                throw partial;
+            }
         }
         catch (err) {
             throw err;
@@ -2053,7 +2534,7 @@ export class Client {
     async submitOTK(amount) {
         const otks = [];
         for (let i = 0; i < amount; i++) {
-            otks[i] = this.createPreKey();
+            otks.push(await this.createPreKey());
         }
         const savedKeys = await this.database.savePreKeys(otks, true);
         await this.http.post(this.getHost() + "/device/" + this.getDevice().deviceID + "/otk", msgpack.encode(savedKeys.map((key) => this.censorPreKey(key))), {