@vex-chat/libvex 9.1.1 → 10.0.0

package/src/__tests__/harness/shared-suite.ts

@@ -11,27 +11,18 @@
  * Runs register → login → connect → send/receive DM against a real spire.
  *
  * **Vitest e2e only** — the published `Client` does not read the environment;
- * app code passes `ClientOptions` (`host`, `devApiKey`, `cryptoProfile`, …).
+ * app code passes `ClientOptions` (`host`, `devApiKey`, …).
  * These `process.env` values are for running **this** repo’s platform tests
  * (shell, CI, or your own env injection — not a “libvex .env” contract).
  * - `API_URL` — Spire base, e.g. `http://127.0.0.1:16777` or `host:port` (http assumed).
- *   When set, `beforeAll` reads `GET …/status` `cryptoProfile` and **sets the
- *   test process to match** (so a FIPS Spire does not require a separate client flag).
- *   A post-check then fails if the client and server still disagree.
  * - `DEV_API_KEY` — must match the Spire `DEV_API_KEY` so the client can send
  *   `x-dev-api-key` and avoid dev rate limits.
- * - `LIBVEX_E2E_SKIP_STATUS_CHECK=1` — opt out of the /status profile read + check
- *   (e.g. older Spire). Then `LIBVEX_E2E_CRYPTO` or default tweetnacl is used.
- * - `LIBVEX_E2E_CRYPTO` — optional override: `fips` | `tweetnacl` (wins over auto
- *   detect from /status; use to force a profile when you know what you need).
  * - `LIBVEX_DEBUG_DM=1` — logs DM/X3dh paths in `Client` to stderr (remove / gate off when done).
  */
 
 import type { ClientOptions, Message } from "../../index.js";
 import type { Storage } from "../../Storage.js";
 
-import { getCryptoProfile, setCryptoProfile } from "@vex-chat/crypto";
-
 import { isHttpError } from "../../http.js";
 import { Client } from "../../index.js";
 
@@ -47,14 +38,11 @@ export function platformSuite(
         const password = "platform-test-pw";
 
         beforeAll(async () => {
-            const profile = await resolveE2eCryptoProfile();
-            setCryptoProfile(profile);
             const SK = await e2eGenerateSecretKey();
 
             const opts: ClientOptions = e2eClientOptionsBase();
             const storage = await makeStorage(SK, opts);
             client = await Client.create(SK, opts, storage);
-            await assertSpireCryptoProfileMatchesTest();
         });
 
         afterAll(async () => {
@@ -640,53 +628,6 @@ function apiUrlOverrideFromEnv():
     };
 }
 
-async function assertSpireCryptoProfileMatchesTest(): Promise<void> {
-    if (process.env["LIBVEX_E2E_SKIP_STATUS_CHECK"] === "1") {
-        return;
-    }
-    const url = spireStatusUrlFromEnv();
-    if (url === null) {
-        return;
-    }
-    const want = getCryptoProfile();
-    let res: Response;
-    try {
-        res = await fetch(url, { method: "GET" });
-    } catch (e: unknown) {
-        const msg = e instanceof Error ? e.message : String(e);
-        throw new Error(
-            `libvex e2e: could not GET ${url} (check API_URL; is Spire running?): ${msg}`,
-        );
-    }
-    if (!res.ok) {
-        throw new Error(
-            `libvex e2e: ${url} returned HTTP ${String(res.status)} — Spire not reachable on this base URL?`,
-        );
-    }
-    const data: unknown = await res.json();
-    if (
-        typeof data !== "object" ||
-        data === null ||
-        !("cryptoProfile" in data) ||
-        typeof (data as { cryptoProfile: unknown }).cryptoProfile !== "string"
-    ) {
-        throw new Error(
-            `libvex e2e: Spire /status is missing a string "cryptoProfile" (upgrade Spire) or set LIBVEX_E2E_SKIP_STATUS_CHECK=1 to skip this check`,
-        );
-    }
-    const gotStr = (data as { cryptoProfile: string }).cryptoProfile;
-    if (gotStr !== "fips" && gotStr !== "tweetnacl") {
-        throw new Error(
-            `libvex e2e: Spire /status cryptoProfile is not fips|tweetnacl: ${gotStr}`,
-        );
-    }
-    if (gotStr !== want) {
-        throw new Error(
-            `libvex e2e: Spire is cryptoProfile=${gotStr} (see SPIRE_FIPS + SPK) but this test has getCryptoProfile()=${want}. Use matching keys/scripts (gen-spk.js vs gen-spk-fips.js) and the same mode on client and server.`,
-        );
-    }
-}
-
 function connectAndWait(
     c: Client,
     label: string,
@@ -713,90 +654,13 @@ function e2eClientOptionsBase(): ClientOptions {
     return {
         inMemoryDb: true,
         ...apiUrlOverrideFromEnv(),
-        cryptoProfile: getCryptoProfile(),
     };
 }
 
-/** `LIBVEX_E2E_CRYPTO` only — used when status auto-detect is skipped. */
-function e2eCryptoProfileFromEnvOnly(): "fips" | "tweetnacl" {
-    const v = process.env["LIBVEX_E2E_CRYPTO"]?.trim().toLowerCase();
-    if (v === "fips" || v === "p-256" || v === "p256") {
-        return "fips";
-    }
-    if (v === "tweetnacl" || v === "nacl" || v === "ed25519") {
-        return "tweetnacl";
-    }
-    return "tweetnacl";
-}
-
 async function e2eGenerateSecretKey(): Promise<string> {
     return await Client.generateSecretKeyAsync();
 }
 
-/**
- * Picks the signing profile for the suite: optional env override, else `GET` Spire
- * `/status` when `API_URL` is set, else tweetnacl.
- */
-async function resolveE2eCryptoProfile(): Promise<"fips" | "tweetnacl"> {
-    if (process.env["LIBVEX_E2E_SKIP_STATUS_CHECK"] === "1") {
-        return e2eCryptoProfileFromEnvOnly();
-    }
-    const v = process.env["LIBVEX_E2E_CRYPTO"]?.trim().toLowerCase();
-    if (v === "fips" || v === "p-256" || v === "p256") {
-        return "fips";
-    }
-    if (v === "tweetnacl" || v === "nacl" || v === "ed25519") {
-        return "tweetnacl";
-    }
-    if (v !== undefined && v.length > 0) {
-        throw new Error(
-            `libvex e2e: invalid LIBVEX_E2E_CRYPTO=${JSON.stringify(v)}. Use fips, tweetnacl, or leave unset to auto-detect from Spire /status`,
-        );
-    }
-    const url = spireStatusUrlFromEnv();
-    if (url === null) {
-        return "tweetnacl";
-    }
-    let res: Response;
-    try {
-        res = await fetch(url, { method: "GET" });
-    } catch {
-        return "tweetnacl";
-    }
-    if (!res.ok) {
-        return "tweetnacl";
-    }
-    const data: unknown = await res.json();
-    if (
-        typeof data !== "object" ||
-        data === null ||
-        !("cryptoProfile" in data)
-    ) {
-        return "tweetnacl";
-    }
-    const cp = (data as { cryptoProfile: unknown }).cryptoProfile;
-    if (cp === "fips" || cp === "tweetnacl") {
-        return cp;
-    }
-    return "tweetnacl";
-}
-
-/**
- * `GET` `{API_URL or http://}{host}/status` — used for crypto profile preflight
- * (must match `getCryptoProfile()` when running e2e against a custom Spire).
- */
-function spireStatusUrlFromEnv(): null | string {
-    const raw = process.env["API_URL"]?.trim();
-    if (raw === undefined || raw.length === 0) {
-        return null;
-    }
-    if (/^https?:\/\//i.test(raw)) {
-        const u = new URL(raw);
-        return `${u.protocol}//${u.host}/status`;
-    }
-    return `http://${raw}/status`;
-}
-
 /*
 type ClientE2EInternals = { getMail(): Promise<void> };
 type ClientE2EDeviceList = {

package/src/__tests__/platform-browser.test.ts

@@ -6,8 +6,6 @@
 
 import type { ClientOptions } from "../index.js";
 
-import { getCryptoProfile } from "@vex-chat/crypto";
-
 import { resolveAtRestAesKeyFromSignKeyHex } from "../utils/resolveAtRestAesKey.js";
 
 import { MemoryStorage } from "./harness/memory-storage.js";
@@ -18,10 +16,7 @@ import { MemoryStorage } from "./harness/memory-storage.js";
 import { platformSuite } from "./harness/shared-suite.js";
 
 platformSuite("browser", async (SK: string, _opts: ClientOptions) => {
-    const atRest = await resolveAtRestAesKeyFromSignKeyHex(
-        SK,
-        getCryptoProfile(),
-    );
+    const atRest = await resolveAtRestAesKeyFromSignKeyHex(SK);
     const storage = new MemoryStorage(atRest);
     await storage.init();
     return storage;

package/src/__tests__/platform-node.test.ts

@@ -6,18 +6,12 @@
 
 import type { ClientOptions } from "../index.js";
 
-import { getCryptoProfile } from "@vex-chat/crypto";
-
 import { createNodeStorage } from "../storage/node.js";
 import { resolveAtRestAesKeyFromSignKeyHex } from "../utils/resolveAtRestAesKey.js";
 
 import { platformSuite } from "./harness/shared-suite.js";
 
-// Profile is set in shared-suite `beforeAll` (see `LIBVEX_E2E_CRYPTO`).
 platformSuite("node", async (SK: string, _opts: ClientOptions) => {
-    const atRest = await resolveAtRestAesKeyFromSignKeyHex(
-        SK,
-        getCryptoProfile(),
-    );
+    const atRest = await resolveAtRestAesKeyFromSignKeyHex(SK);
     return createNodeStorage(":memory:", atRest);
 });

package/src/__tests__/prekey-reuse.test.ts

@@ -5,22 +5,19 @@
  */
 
 import type { PreKeysCrypto, UnsavedPreKey, XKeyRing } from "../types/index.js";
-import type { CryptoProfile, KeyPair } from "@vex-chat/crypto";
+import type { KeyPair } from "@vex-chat/crypto";
 
 import {
-    setCryptoProfile,
     xBoxKeyPairAsync,
-    xEcdhKeyPairFromEcdsaKeyPairAsync,
     XKeyConvert,
     xPreKeySignaturePayload,
     xSignAsync,
     xSignKeyPair,
-    xSignKeyPairAsync,
     xSignOpenAsync,
     XUtils,
 } from "@vex-chat/crypto";
 
-import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { describe, expect, it } from "vitest";
 
 import { Client } from "../Client.js";
 
@@ -28,11 +25,10 @@ import { MemoryStorage } from "./harness/memory-storage.js";
 
 interface KeyRingHarness {
     createPreKey: (kind: "one-time" | "signed") => Promise<UnsavedPreKey>;
-    cryptoProfile: CryptoProfile;
     database: MemoryStorage;
     idKeys: KeyPair;
     isPreKeySignedByCurrentDevice: (preKey: PreKeysCrypto) => Promise<boolean>;
-    runWithThisCryptoProfile: <T>(fn: () => Promise<T>) => Promise<T>;
+    runCrypto: <T>(fn: () => Promise<T>) => Promise<T>;
     sessionRecords: Record<string, unknown>;
     signKeys: KeyPair;
     xKeyRing?: XKeyRing;
@@ -42,35 +38,21 @@ const clientMethods = Client.prototype as unknown as {
     createPreKey: (kind: "one-time" | "signed") => Promise<UnsavedPreKey>;
     isPreKeySignedByCurrentDevice: (preKey: PreKeysCrypto) => Promise<boolean>;
     populateKeyRing: () => Promise<void>;
-    runWithThisCryptoProfile: <T>(fn: () => Promise<T>) => Promise<T>;
+    runCrypto: <T>(fn: () => Promise<T>) => Promise<T>;
 };
 
 async function isValidFor(
     preKey: PreKeysCrypto,
     signKeys: KeyPair,
-    profile: CryptoProfile = "tweetnacl",
 ): Promise<boolean> {
-    setCryptoProfile(profile);
     const opened = await xSignOpenAsync(preKey.signature, signKeys.publicKey);
-    const payload = xPreKeySignaturePayload(
-        preKey.keyPair.publicKey,
-        "signed",
-        profile,
-    );
+    const payload = xPreKeySignaturePayload(preKey.keyPair.publicKey, "signed");
     return Boolean(opened && XUtils.bytesEqual(opened, payload));
 }
 
-async function makeSignedPreKey(
-    signKeys: KeyPair,
-    profile: CryptoProfile = "tweetnacl",
-): Promise<UnsavedPreKey> {
-    setCryptoProfile(profile);
+async function makeSignedPreKey(signKeys: KeyPair): Promise<UnsavedPreKey> {
     const keyPair = await xBoxKeyPairAsync();
-    const payload = xPreKeySignaturePayload(
-        keyPair.publicKey,
-        "signed",
-        profile,
-    );
+    const payload = xPreKeySignaturePayload(keyPair.publicKey, "signed");
     return {
         keyPair,
         signature: await xSignAsync(payload, signKeys.secretKey),
@@ -78,14 +60,6 @@ async function makeSignedPreKey(
 }
 
 describe("local signed prekey reuse", () => {
-    beforeEach(() => {
-        setCryptoProfile("tweetnacl");
-    });
-
-    afterEach(() => {
-        setCryptoProfile("tweetnacl");
-    });
-
     it("regenerates a stored prekey signed by a different device key", async () => {
         const staleSignKeys = xSignKeyPair();
         const currentSignKeys = xSignKeyPair();
@@ -103,12 +77,11 @@ describe("local signed prekey reuse", () => {
 
         const harness: KeyRingHarness = {
             createPreKey: clientMethods.createPreKey,
-            cryptoProfile: "tweetnacl",
             database: storage,
             idKeys,
             isPreKeySignedByCurrentDevice:
                 clientMethods.isPreKeySignedByCurrentDevice,
-            runWithThisCryptoProfile: clientMethods.runWithThisCryptoProfile,
+            runCrypto: clientMethods.runCrypto,
             sessionRecords: {},
             signKeys: currentSignKeys,
         };
@@ -127,46 +100,4 @@ describe("local signed prekey reuse", () => {
         expect(persisted).not.toBeNull();
         expect(await isValidFor(persisted!, currentSignKeys)).toBe(true);
     });
-
-    it("reuses a valid FIPS prekey when the global profile is tweetnacl", async () => {
-        setCryptoProfile("fips");
-        const currentSignKeys = await xSignKeyPairAsync();
-        const idKeys = await xEcdhKeyPairFromEcdsaKeyPairAsync(currentSignKeys);
-        const storedPreKey = await makeSignedPreKey(currentSignKeys, "fips");
-
-        const storage = new MemoryStorage(new Uint8Array(32).fill(8));
-        await storage.init();
-        await storage.savePreKeys([storedPreKey], false);
-
-        setCryptoProfile("tweetnacl");
-        const harness: KeyRingHarness = {
-            createPreKey: clientMethods.createPreKey,
-            cryptoProfile: "fips",
-            database: storage,
-            idKeys,
-            isPreKeySignedByCurrentDevice:
-                clientMethods.isPreKeySignedByCurrentDevice,
-            runWithThisCryptoProfile: clientMethods.runWithThisCryptoProfile,
-            sessionRecords: {},
-            signKeys: currentSignKeys,
-        };
-
-        await clientMethods.populateKeyRing.call(harness);
-
-        expect(harness.xKeyRing).toBeDefined();
-        expect(harness.xKeyRing!.preKeys.index).toBe(1);
-        expect(
-            XUtils.bytesEqual(
-                harness.xKeyRing!.preKeys.keyPair.publicKey,
-                storedPreKey.keyPair.publicKey,
-            ),
-        ).toBe(true);
-        expect(
-            await isValidFor(
-                harness.xKeyRing!.preKeys,
-                currentSignKeys,
-                "fips",
-            ),
-        ).toBe(true);
-    });
 });

package/src/__tests__/verifyKeyBundle.test.ts

@@ -4,48 +4,42 @@
  * Commercial licenses available at vex.wtf
  */
 
-import type { CryptoProfile, KeyPair } from "@vex-chat/crypto";
+import type { KeyPair } from "@vex-chat/crypto";
 import type { Device, KeyBundle, KeyBundleEntry } from "@vex-chat/types";
 
 import {
-    setCryptoProfile,
     xBoxKeyPairAsync,
-    xEcdhKeyPairFromEcdsaKeyPairAsync,
     xPreKeySignaturePayload,
     xSignAsync,
     xSignKeyPairAsync,
     XUtils,
 } from "@vex-chat/crypto";
 
-import { afterEach, describe, expect, it } from "vitest";
+import { describe, expect, it } from "vitest";
 
 import { verifyKeyBundleSignatures } from "../utils/verifyKeyBundle.js";
 
-describe.sequential("verifyKeyBundleSignatures", () => {
-    afterEach(() => {
-        setCryptoProfile("tweetnacl");
-    });
-
-    it("accepts a valid tweetnacl key bundle", async () => {
-        const { device, keyBundle } = await makeBundle("tweetnacl");
+describe("verifyKeyBundleSignatures", () => {
+    it("accepts a valid key bundle", async () => {
+        const { device, keyBundle } = await makeBundle();
 
         await expect(
-            verifyKeyBundleSignatures(keyBundle, device, "tweetnacl"),
+            verifyKeyBundleSignatures(keyBundle, device),
         ).resolves.toBeUndefined();
     });
 
     it("rejects a tampered signed prekey public key", async () => {
-        const { device, keyBundle } = await makeBundle("tweetnacl");
+        const { device, keyBundle } = await makeBundle();
         const tampered = cloneBundle(keyBundle);
         tampered.preKey.publicKey = flipFirstByte(tampered.preKey.publicKey);
 
         await expect(
-            verifyKeyBundleSignatures(tampered, device, "tweetnacl"),
+            verifyKeyBundleSignatures(tampered, device),
         ).rejects.toThrow("signed prekey signature is invalid");
     });
 
     it("rejects a tampered one-time prekey public key", async () => {
-        const { device, keyBundle } = await makeBundle("tweetnacl", true);
+        const { device, keyBundle } = await makeBundle(true);
         const tampered = cloneBundle(keyBundle);
         if (!tampered.otk) {
             throw new Error("Expected OTK fixture.");
@@ -53,28 +47,20 @@ describe.sequential("verifyKeyBundleSignatures", () => {
         tampered.otk.publicKey = flipFirstByte(tampered.otk.publicKey);
 
         await expect(
-            verifyKeyBundleSignatures(tampered, device, "tweetnacl"),
+            verifyKeyBundleSignatures(tampered, device),
         ).rejects.toThrow("one-time prekey signature is invalid");
     });
 
     it("rejects a bundle identity key that does not match the device", async () => {
-        const { device, keyBundle } = await makeBundle("tweetnacl");
+        const { device, keyBundle } = await makeBundle();
         const other = await xSignKeyPairAsync();
         const tampered = cloneBundle(keyBundle);
         tampered.signKey = other.publicKey;
 
         await expect(
-            verifyKeyBundleSignatures(tampered, device, "tweetnacl"),
+            verifyKeyBundleSignatures(tampered, device),
         ).rejects.toThrow("identity key does not match");
     });
-
-    it("accepts a valid FIPS key bundle", async () => {
-        const { device, keyBundle } = await makeBundle("fips", true);
-
-        await expect(
-            verifyKeyBundleSignatures(keyBundle, device, "fips"),
-        ).resolves.toBeUndefined();
-    });
 });
 
 function cloneBundle(bundle: KeyBundle): KeyBundle {
@@ -105,15 +91,9 @@ function flipFirstByte(value: Uint8Array): Uint8Array {
 }
 
 async function makeBundle(
-    profile: CryptoProfile,
     includeOtk = false,
 ): Promise<{ device: Device; keyBundle: KeyBundle }> {
-    setCryptoProfile(profile);
     const signKeys = await xSignKeyPairAsync();
-    const identityPublic =
-        profile === "fips"
-            ? (await xEcdhKeyPairFromEcdsaKeyPairAsync(signKeys)).publicKey
-            : signKeys.publicKey;
     const device: Device = {
         deleted: false,
         deviceID: "device-a",
@@ -124,19 +104,12 @@ async function makeBundle(
     };
 
     const keyBundle: KeyBundle = {
-        preKey: await makeBundleEntry(
-            signKeys,
-            profile,
-            device.deviceID,
-            1,
-            "signed",
-        ),
-        signKey: identityPublic,
+        preKey: await makeBundleEntry(signKeys, device.deviceID, 1, "signed"),
+        signKey: signKeys.publicKey,
     };
     if (includeOtk) {
         keyBundle.otk = await makeBundleEntry(
             signKeys,
-            profile,
             device.deviceID,
             2,
             "one-time",
@@ -148,13 +121,12 @@ async function makeBundle(
 
 async function makeBundleEntry(
     signKeys: KeyPair,
-    profile: CryptoProfile,
     deviceID: string,
     index: number,
     kind: "one-time" | "signed",
 ): Promise<KeyBundleEntry> {
     const preKey = await xBoxKeyPairAsync();
-    const payload = xPreKeySignaturePayload(preKey.publicKey, kind, profile);
+    const payload = xPreKeySignaturePayload(preKey.publicKey, kind);
     return {
         deviceID,
         index,

package/src/preset/node.ts

@@ -16,14 +16,10 @@ import type { PlatformPreset } from "./common.js";
 export function nodePreset(): PlatformPreset {
     return {
         async createStorage(dbName, privateKey): Promise<Storage> {
-            const { getCryptoProfile } = await import("@vex-chat/crypto");
             const { createNodeStorage } = await import("../storage/node.js");
             const { resolveAtRestAesKeyFromSignKeyHex } =
                 await import("../utils/resolveAtRestAesKey.js");
-            const atRest = await resolveAtRestAesKeyFromSignKeyHex(
-                privateKey,
-                getCryptoProfile(),
-            );
+            const atRest = await resolveAtRestAesKeyFromSignKeyHex(privateKey);
             return createNodeStorage(dbName, atRest);
         },
         deviceName: process.platform,

package/src/preset/test.ts

@@ -15,15 +15,11 @@ import type { PlatformPreset } from "./common.js";
 export function testPreset(): PlatformPreset {
     return {
         async createStorage(_dbName, privateKey) {
-            const { getCryptoProfile } = await import("@vex-chat/crypto");
             const { resolveAtRestAesKeyFromSignKeyHex } =
                 await import("../utils/resolveAtRestAesKey.js");
             const { MemoryStorage } =
                 await import("../__tests__/harness/memory-storage.js");
-            const atRest = await resolveAtRestAesKeyFromSignKeyHex(
-                privateKey,
-                getCryptoProfile(),
-            );
+            const atRest = await resolveAtRestAesKeyFromSignKeyHex(privateKey);
             const storage = new MemoryStorage(atRest);
             await storage.init();
             return storage;

package/src/storage/sqlite.ts

@@ -37,13 +37,9 @@ import type { Device, PreKeysSQL, SessionSQL } from "@vex-chat/types";
  * smaller “crypto state” store separate from bulk message history.
  */
 import {
-    getCryptoProfile,
     xBoxKeyPairFromSecret,
-    xBoxKeyPairFromSecretAsync,
     xMakeNonce,
-    xSecretbox,
     xSecretboxAsync,
-    xSecretboxOpen,
     xSecretboxOpenAsync,
     XUtils,
 } from "@vex-chat/crypto";
@@ -223,10 +219,7 @@ export class SqliteStorage extends EventEmitter implements Storage {
         const rawSk = await this.unsealHex(otkInfo.privateKey);
         return {
             index: otkInfo.index,
-            keyPair:
-                getCryptoProfile() === "fips"
-                    ? await xBoxKeyPairFromSecretAsync(XUtils.decodeHex(rawSk))
-                    : xBoxKeyPairFromSecret(XUtils.decodeHex(rawSk)),
+            keyPair: xBoxKeyPairFromSecret(XUtils.decodeHex(rawSk)),
             signature: XUtils.decodeHex(otkInfo.signature),
         };
     }
@@ -246,10 +239,7 @@ export class SqliteStorage extends EventEmitter implements Storage {
         const rawPk = await this.unsealHex(preKeyInfo.privateKey);
         return {
             index: preKeyInfo.index,
-            keyPair:
-                getCryptoProfile() === "fips"
-                    ? await xBoxKeyPairFromSecretAsync(XUtils.decodeHex(rawPk))
-                    : xBoxKeyPairFromSecret(XUtils.decodeHex(rawPk)),
+            keyPair: xBoxKeyPairFromSecret(XUtils.decodeHex(rawPk)),
             signature: XUtils.decodeHex(preKeyInfo.signature),
         };
     }
@@ -947,10 +937,7 @@ export class SqliteStorage extends EventEmitter implements Storage {
 
     private async sealBytes(plaintext: Uint8Array): Promise<string> {
         const nonce = xMakeNonce();
-        const fips = getCryptoProfile() === "fips";
-        const ct = fips
-            ? await xSecretboxAsync(plaintext, nonce, this.atRestAesKey)
-            : xSecretbox(plaintext, nonce, this.atRestAesKey);
+        const ct = await xSecretboxAsync(plaintext, nonce, this.atRestAesKey);
         const sealed = new Uint8Array(nonce.length + ct.length);
         sealed.set(nonce);
         sealed.set(ct, nonce.length);
@@ -1038,10 +1025,7 @@ export class SqliteStorage extends EventEmitter implements Storage {
         }
         const nonce = bytes.slice(0, STORAGE_NONCE_BYTES);
         const ct = bytes.slice(STORAGE_NONCE_BYTES);
-        const fips = getCryptoProfile() === "fips";
-        const plain = fips
-            ? await xSecretboxOpenAsync(ct, nonce, this.atRestAesKey)
-            : xSecretboxOpen(ct, nonce, this.atRestAesKey);
+        const plain = await xSecretboxOpenAsync(ct, nonce, this.atRestAesKey);
         if (!plain) {
             throw new Error("Failed to decrypt sealed column value.");
         }

package/src/utils/resolveAtRestAesKey.ts

@@ -4,36 +4,20 @@
  * Commercial licenses available at vex.wtf
  */
 
-import {
-    type CryptoProfile,
-    xEcdhKeyPairFromEcdsaKeyPairAsync,
-    XKeyConvert,
-    xSignKeyPairFromSecret,
-    xSignKeyPairFromSecretAsync,
-    XUtils,
-} from "@vex-chat/crypto";
+import { XKeyConvert, xSignKeyPairFromSecret, XUtils } from "@vex-chat/crypto";
 
 /**
  * Produces the 32-byte at-rest key used by {@link Storage} (sqlite, memory) from
  * a hex signing secret, matching the derivation used by {@link Client.create}.
- * `setCryptoProfile(profile)` should already be in effect (or `tweetnacl` implied).
  */
-export async function resolveAtRestAesKeyFromSignKeyHex(
+export function resolveAtRestAesKeyFromSignKeyHex(
     privateKeyHex: string,
-    profile: CryptoProfile,
 ): Promise<Uint8Array> {
     const dec = XUtils.decodeHex(privateKeyHex);
-    if (profile === "tweetnacl") {
-        const sign = xSignKeyPairFromSecret(dec);
-        const id = XKeyConvert.convertKeyPair(sign);
-        if (!id) {
-            throw new Error(
-                "Could not convert signing key to X25519 identity.",
-            );
-        }
-        return XUtils.deriveLocalAtRestAesKey(id.secretKey, "tweetnacl");
+    const sign = xSignKeyPairFromSecret(dec);
+    const id = XKeyConvert.convertKeyPair(sign);
+    if (!id) {
+        throw new Error("Could not convert signing key to X25519 identity.");
     }
-    const sign = await xSignKeyPairFromSecretAsync(dec);
-    const id = await xEcdhKeyPairFromEcdsaKeyPairAsync(sign);
-    return XUtils.deriveLocalAtRestAesKey(id.secretKey, "fips");
+    return Promise.resolve(XUtils.deriveLocalAtRestAesKey(id.secretKey));
 }