@vex-chat/spire 1.0.4 → 1.2.0

package/package.json

@@ -1,122 +1,111 @@
 {
-    "name": "@vex-chat/spire",
-    "version": "1.0.4",
-    "description": "Vex server implementation in NodeJS.",
-    "type": "module",
-    "files": [
-        "dist",
-        "src",
-        "LICENSE",
-        "LICENSE-COMMERCIAL",
-        "LICENSING.md",
-        "CLA.md"
-    ],
-    "author": "Extra <extrahash@protonmail.com>",
-    "license": "AGPL-3.0-or-later",
-    "engines": {
-        "node": ">=24.0.0",
-        "npm": ">=10.0.0"
-    },
-    "packageManager": "npm@10.9.2",
-    "publishConfig": {
-        "access": "public",
-        "registry": "https://registry.npmjs.org/"
-    },
-    "scripts": {
-        "preinstall": "npx only-allow npm",
-        "start": "node --experimental-strip-types src/run.ts",
-        "restart": "pm2 restart spire && pm2 logs spire",
-        "build": "tsc && node scripts/clean-dist-tests.mjs",
-        "format": "prettier --write .",
-        "format:check": "prettier --check .",
-        "copyright:check": "node scripts/copyright-headers.mjs --check",
-        "copyright:apply": "node scripts/copyright-headers.mjs",
-        "lint": "eslint src/ scripts/stress/",
-        "lint:fix": "eslint src/ scripts/stress/ --fix",
-        "prepare": "husky || true",
-        "test": "vitest run",
-        "stress:web": "node --experimental-strip-types scripts/stress/spire-stress.ts",
-        "stress:cli": "node --experimental-strip-types scripts/stress/stress-cli-sweep.ts",
-        "stress:repo-manifest": "node --experimental-strip-types scripts/stress/stress-repo-manifest.ts",
-        "stress:docs-pack": "node --experimental-strip-types scripts/stress/stress-docs-pack.ts",
-        "stress:llm-triage": "node --experimental-strip-types scripts/stress/stress-llm-triage.ts",
-        "gen-spk": "node scripts/gen-spk.js",
-        "docs": "node ./scripts/generate-docs.js",
-        "service:status-monitor": "node ./services/status-monitor/index.js",
-        "service:status-monitor:clear-history": "node ./services/status-monitor/clear-history.js",
-        "service:deploy-hook": "node ./services/deploy-hook/index.js",
-        "monitor": "node ./services/status-monitor/index.js"
-    },
-    "devDependencies": {
-        "@changesets/cli": "2.30.0",
-        "@socketsecurity/cli": "1.1.84",
-        "@types/better-sqlite3": "7.6.13",
-        "@types/cors": "2.8.19",
-        "@types/express": "5.0.6",
-        "@types/jsonwebtoken": "9.0.10",
-        "@types/morgan": "1.9.10",
-        "@types/multer": "2.1.0",
-        "@types/node": "25.6.0",
-        "@types/uuid": "10.0.0",
-        "@types/ws": "8.18.1",
-        "@vex-chat/libvex": "5.2.0",
-        "@vitest/eslint-plugin": "1.6.15",
-        "axios": "1.15.0",
-        "eslint": "10.2.0",
-        "eslint-config-prettier": "10.1.8",
-        "eslint-plugin-n": "17.24.0",
-        "eslint-plugin-perfectionist": "5.8.0",
-        "husky": "9.1.7",
-        "lint-staged": "16.4.0",
-        "npm-package-json-lint": "10.2.1",
-        "prettier": "3.8.2",
-        "type-coverage": "2.29.7",
-        "typedoc": "0.28.18",
-        "typescript": "6.0.2",
-        "typescript-eslint": "8.58.1",
-        "vitest": "4.1.4"
-    },
-    "typeCoverage": {
-        "atLeast": 95,
-        "ignoreCatch": true
-    },
-    "lint-staged": {
-        "*.ts": [
-            "eslint --fix",
-            "prettier --write"
-        ],
-        "*.{yml,yaml}": [
-            "prettier --write"
-        ]
-    },
-    "overrides": {
-        "@types/ws": "8.18.1",
-        "@types/readable-stream": "4.0.11",
-        "lodash": "4.18.1",
-        "minimatch": "10.2.5"
-    },
-    "dependencies": {
-        "@asyncapi/web-component": "2.6.5",
-        "@scalar/express-api-reference": "0.9.7",
-        "@vex-chat/crypto": "2.0.1",
-        "@vex-chat/types": "2.0.0",
-        "argon2": "0.44.0",
-        "better-sqlite3": "11.10.0",
-        "cors": "2.8.6",
-        "dotenv": "17.4.1",
-        "express": "5.2.1",
-        "express-rate-limit": "8.3.2",
-        "file-type": "22.0.1",
-        "helmet": "8.1.0",
-        "jsonwebtoken": "9.0.3",
-        "kysely": "0.28.16",
-        "morgan": "1.10.1",
-        "msgpackr": "1.11.8",
-        "multer": "2.1.1",
-        "parse-duration": "2.1.6",
-        "tweetnacl": "1.0.3",
-        "uuid": "8.3.2",
-        "ws": "8.20.0",
-        "zod": "4.3.6"
-    }
-}
+  "name": "@vex-chat/spire",
+  "version": "1.2.0",
+  "description": "Vex server implementation in NodeJS.",
+  "type": "module",
+  "files": [
+    "dist",
+    "src",
+    "LICENSE",
+    "LICENSE-COMMERCIAL",
+    "LICENSING.md",
+    "CLA.md"
+  ],
+  "author": "Extra <extrahash@protonmail.com>",
+  "license": "AGPL-3.0-or-later",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/vex-protocol/vex-protocol.git",
+    "directory": "apps/spire"
+  },
+  "bugs": {
+    "url": "https://github.com/vex-protocol/vex-protocol/issues"
+  },
+  "homepage": "https://github.com/vex-protocol/vex-protocol/tree/master/apps/spire#readme",
+  "engines": {
+    "node": ">=24.0.0"
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "devDependencies": {
+    "@changesets/cli": "2.30.0",
+    "@socketsecurity/cli": "1.1.84",
+    "@types/better-sqlite3": "7.6.13",
+    "@types/cors": "2.8.19",
+    "@types/express": "5.0.6",
+    "@types/express-serve-static-core": "5.1.1",
+    "@types/jsonwebtoken": "9.0.10",
+    "@types/morgan": "1.9.10",
+    "@types/multer": "2.1.0",
+    "@types/node": "^25.6.0",
+    "@types/ws": "8.18.1",
+    "@vitest/eslint-plugin": "1.6.15",
+    "axios": "1.15.0",
+    "eslint": "10.2.0",
+    "eslint-config-prettier": "10.1.8",
+    "eslint-plugin-n": "17.24.0",
+    "eslint-plugin-perfectionist": "5.8.0",
+    "husky": "9.1.7",
+    "lint-staged": "16.4.0",
+    "prettier": "3.8.2",
+    "type-coverage": "2.29.7",
+    "typedoc": "0.28.18",
+    "typescript": "6.0.2",
+    "typescript-eslint": "8.58.1",
+    "vitest": "4.1.4",
+    "@vex-chat/eslint-config": "0.0.1",
+    "@vex-chat/libvex": "^6.0.0"
+  },
+  "typeCoverage": {
+    "atLeast": 95,
+    "ignoreCatch": true
+  },
+  "dependencies": {
+    "@asyncapi/web-component": "2.6.5",
+    "@scalar/express-api-reference": "0.9.7",
+    "argon2": "0.44.0",
+    "better-sqlite3": "11.10.0",
+    "cors": "2.8.6",
+    "dotenv": "17.4.1",
+    "express": "5.2.1",
+    "express-rate-limit": "8.3.2",
+    "file-type": "22.0.1",
+    "helmet": "8.1.0",
+    "jsonwebtoken": "9.0.3",
+    "kysely": "^0.28.16",
+    "morgan": "1.10.1",
+    "msgpackr": "^1.11.9",
+    "multer": "2.1.1",
+    "parse-duration": "2.1.6",
+    "tweetnacl": "1.0.3",
+    "uuid": "^14.0.0",
+    "ws": "8.20.0",
+    "zod": "^4.3.6",
+    "@vex-chat/crypto": "^3.0.0",
+    "@vex-chat/types": "^3.0.0"
+  },
+  "scripts": {
+    "rebuild:sqlite": "pnpm rebuild better-sqlite3",
+    "start": "node --experimental-strip-types src/run.ts",
+    "restart": "pm2 restart spire && pm2 logs spire",
+    "build": "tsc && node scripts/clean-dist-tests.mjs",
+    "format": "prettier --write .",
+    "format:check": "prettier --check .",
+    "lint": "eslint src/ scripts/stress/",
+    "lint:fix": "eslint src/ scripts/stress/ --fix",
+    "test": "vitest run",
+    "stress:web": "node --experimental-strip-types scripts/stress/spire-stress.ts",
+    "stress:cli": "node --experimental-strip-types scripts/stress/stress-cli-sweep.ts",
+    "stress:repo-manifest": "node --experimental-strip-types scripts/stress/stress-repo-manifest.ts",
+    "stress:docs-pack": "node --experimental-strip-types scripts/stress/stress-docs-pack.ts",
+    "stress:llm-triage": "node --experimental-strip-types scripts/stress/stress-llm-triage.ts",
+    "gen-spk": "node scripts/gen-spk.js",
+    "gen-spk-fips": "node scripts/gen-spk-fips.js",
+    "docs": "node ./scripts/generate-docs.js",
+    "service:status-monitor": "node ./services/status-monitor/index.js",
+    "service:status-monitor:clear-history": "node ./services/status-monitor/clear-history.js",
+    "monitor": "node ./services/status-monitor/index.js"
+  }
+}

package/src/ClientManager.ts

@@ -23,7 +23,6 @@ import { EventEmitter } from "events";
 import { setTimeout as sleep } from "node:timers/promises";
 
 import { xConcat, XUtils } from "@vex-chat/crypto";
-import { xSignOpen } from "@vex-chat/crypto";
 import { MailWSSchema, SocketAuthErrors } from "@vex-chat/types";
 
 import { parse as uuidParse, validate as uuidValidate } from "uuid";
@@ -31,6 +30,7 @@ import { parse as uuidParse, validate as uuidValidate } from "uuid";
 import { TOKEN_EXPIRY } from "./Spire.ts";
 import { createUint8UUID } from "./utils/createUint8UUID.ts";
 import { msgpack } from "./utils/msgpack.ts";
+import { spireXSignOpenAsync } from "./utils/spireXSignOpenAsync.ts";
 
 export const POWER_LEVELS = {
     CREATE: 50,
@@ -341,7 +341,7 @@ export class ClientManager extends EventEmitter {
             const devices = await this.db.retrieveUserDeviceList([user.userID]);
             let message: null | Uint8Array = null;
             for (const device of devices) {
-                const verified = xSignOpen(
+                const verified = await spireXSignOpenAsync(
                     msg.signed,
                     XUtils.decodeHex(device.signKey),
                 );

package/src/Database.ts

@@ -32,7 +32,11 @@ import * as fs from "node:fs/promises";
 import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 
-import { XUtils } from "@vex-chat/crypto";
+import {
+    fipsEcdhRawPublicKeyFromEcdsaSpkiAsync,
+    getCryptoProfile,
+    XUtils,
+} from "@vex-chat/crypto";
 import { MailType } from "@vex-chat/types";
 
 import argon2 from "argon2";
@@ -124,21 +128,9 @@ export interface InternalUserRecord extends UserRecord {
 }
 
 export class Database extends EventEmitter {
-    private db: Kysely<ServerDatabase>;
-
-    /** Underlying better-sqlite3 handle (file or :memory:). */
-    private readonly rawSqlite: InstanceType<typeof BetterSqlite3>;
+    private static readonly EMOJI_LIST_CACHE_TTL_MS = 10_000;
 
-    /**
-     * In-process cache for {@link retrieveUserDeviceList} when queried for a
-     * single owner. Libvex calls GET /user/:id/devices on every outgoing
-     * `forward()`; stress runs otherwise hammer SQLite with identical reads.
-     * Cleared on device create/delete and when the DB is closed.
-     */
-    private readonly userDeviceListCache = new Map<
-        string,
-        { devices: Device[]; until: number }
-    >();
+    private db: Kysely<ServerDatabase>;
 
     /**
      * Short TTL cache for {@link retrieveEmojiList} (key = server id, stored as
@@ -151,8 +143,8 @@ export class Database extends EventEmitter {
         { rows: Emoji[]; until: number }
     >();
 
-    private static readonly USER_DEVICE_LIST_CACHE_TTL_MS = 10_000;
-    private static readonly EMOJI_LIST_CACHE_TTL_MS = 10_000;
+    /** Underlying better-sqlite3 handle (file or :memory:). */
+    private readonly rawSqlite: InstanceType<typeof BetterSqlite3>;
 
     constructor(options?: SpireOptions) {
         super();
@@ -188,70 +180,7 @@ export class Database extends EventEmitter {
         void this.init();
     }
 
-    /**
-     * Dev-only snapshot of SQLite files + pragmas (same process as Spire).
-     * Not for production callers.
-     */
-    public getDevSqliteMonitor(): Record<string, unknown> {
-        const openedAs = this.rawSqlite.name;
-        const absPath =
-            openedAs === ":memory:"
-                ? ":memory:"
-                : path.isAbsolute(openedAs)
-                  ? openedAs
-                  : path.resolve(process.cwd(), openedAs);
-
-        const journalMode = this.rawSqlite.pragma("journal_mode", {
-            simple: true,
-        });
-        const synchronous = this.rawSqlite.pragma("synchronous", {
-            simple: true,
-        });
-        const busyTimeout = this.rawSqlite.pragma("busy_timeout", {
-            simple: true,
-        });
-        const cacheSize = this.rawSqlite.pragma("cache_size", { simple: true });
-        const pageCount = this.rawSqlite.pragma("page_count", { simple: true });
-        const pageSize = this.rawSqlite.pragma("page_size", { simple: true });
-        const freelistCount = this.rawSqlite.pragma("freelist_count", {
-            simple: true,
-        });
-
-        const out: Record<string, unknown> = {
-            absPath,
-            busyTimeout,
-            cacheSize,
-            freelistCount,
-            journalMode,
-            openedAs,
-            pageCount,
-            pageSize,
-            synchronous,
-        };
-
-        if (openedAs !== ":memory:") {
-            const filePaths = {
-                main: absPath,
-                shm: `${absPath}-shm`,
-                wal: `${absPath}-wal`,
-            };
-            out["filePaths"] = filePaths;
-            const sizes: Record<string, number> = {};
-            for (const [label, fp] of Object.entries(filePaths)) {
-                try {
-                    sizes[label] = statSync(fp).size;
-                } catch {
-                    sizes[label] = 0;
-                }
-            }
-            out["fileBytes"] = sizes;
-        }
-
-        return out;
-    }
-
     public async close(): Promise<void> {
-        this.userDeviceListCache.clear();
         this.emojiListByServerCache.clear();
         await this.db.destroy();
     }
@@ -283,7 +212,6 @@ export class Database extends EventEmitter {
         };
 
         await this.db.insertInto("devices").values(device).execute();
-        this.userDeviceListCache.delete(owner);
 
         const medPreKeys = {
             deviceID: device.deviceID,
@@ -423,12 +351,6 @@ export class Database extends EventEmitter {
     }
 
     public async deleteDevice(deviceID: string): Promise<void> {
-        const ownerRow = await this.db
-            .selectFrom("devices")
-            .select("owner")
-            .where("deviceID", "=", deviceID)
-            .executeTakeFirst();
-
         await this.db
             .deleteFrom("preKeys")
             .where("deviceID", "=", deviceID)
@@ -444,10 +366,6 @@ export class Database extends EventEmitter {
             .set({ deleted: 1 })
             .where("deviceID", "=", deviceID)
             .execute();
-
-        if (ownerRow?.owner) {
-            this.userDeviceListCache.delete(ownerRow.owner);
-        }
     }
 
     public async deleteEmoji(emojiID: string): Promise<void> {
@@ -502,6 +420,68 @@ export class Database extends EventEmitter {
             .execute();
     }
 
+    /**
+     * Dev-only snapshot of SQLite files + pragmas (same process as Spire).
+     * Not for production callers.
+     */
+    public getDevSqliteMonitor(): Record<string, unknown> {
+        const openedAs = this.rawSqlite.name;
+        const absPath =
+            openedAs === ":memory:"
+                ? ":memory:"
+                : path.isAbsolute(openedAs)
+                  ? openedAs
+                  : path.resolve(process.cwd(), openedAs);
+
+        const journalMode = this.rawSqlite.pragma("journal_mode", {
+            simple: true,
+        });
+        const synchronous = this.rawSqlite.pragma("synchronous", {
+            simple: true,
+        });
+        const busyTimeout = this.rawSqlite.pragma("busy_timeout", {
+            simple: true,
+        });
+        const cacheSize = this.rawSqlite.pragma("cache_size", { simple: true });
+        const pageCount = this.rawSqlite.pragma("page_count", { simple: true });
+        const pageSize = this.rawSqlite.pragma("page_size", { simple: true });
+        const freelistCount = this.rawSqlite.pragma("freelist_count", {
+            simple: true,
+        });
+
+        const out: Record<string, unknown> = {
+            absPath,
+            busyTimeout,
+            cacheSize,
+            freelistCount,
+            journalMode,
+            openedAs,
+            pageCount,
+            pageSize,
+            synchronous,
+        };
+
+        if (openedAs !== ":memory:") {
+            const filePaths = {
+                main: absPath,
+                shm: `${absPath}-shm`,
+                wal: `${absPath}-wal`,
+            };
+            out["filePaths"] = filePaths;
+            const sizes: Record<string, number> = {};
+            for (const [label, fp] of Object.entries(filePaths)) {
+                try {
+                    sizes[label] = statSync(fp).size;
+                } catch {
+                    sizes[label] = 0;
+                }
+            }
+            out["fileBytes"] = sizes;
+        }
+
+        return out;
+    }
+
     public async getKeyBundle(deviceID: string): Promise<KeyBundle | null> {
         const device = await this.retrieveDevice(deviceID);
         if (!device) {
@@ -512,10 +492,15 @@ export class Database extends EventEmitter {
         if (!preKey) {
             throw new Error("Failed to get prekey.");
         }
+        const signKeyBytes = XUtils.decodeHex(device.signKey);
+        const signKey =
+            getCryptoProfile() === "fips"
+                ? await fipsEcdhRawPublicKeyFromEcdsaSpkiAsync(signKeyBytes)
+                : signKeyBytes;
         const keyBundle: KeyBundle = {
             otk,
             preKey,
-            signKey: XUtils.decodeHex(device.signKey),
+            signKey,
         };
         return keyBundle;
     }
@@ -942,37 +927,20 @@ export class Database extends EventEmitter {
         return row ? toUserRecord(row) : null;
     }
 
+    /**
+     * All devices for the given user ID(s), **no in-process cache** — a prior
+     * 10s TTL was removed: concurrent GET + POST could end with a stale
+     * snapshot overwriting the map after a new device was inserted (automation
+     * and `POST /user/:id/devices` must see a fresh list on the next read).
+     */
     public async retrieveUserDeviceList(userIDs: string[]): Promise<Device[]> {
-        const now = Date.now();
-        if (userIDs.length === 1) {
-            const owner = userIDs[0];
-            if (typeof owner === "string") {
-                const hit = this.userDeviceListCache.get(owner);
-                if (hit && hit.until > now) {
-                    return hit.devices.map((d) => ({ ...d }));
-                }
-            }
-        }
-
         const rows = await this.db
             .selectFrom("devices")
             .selectAll()
             .where("owner", "in", userIDs)
             .where("deleted", "=", 0)
             .execute();
-        const devices = rows.map(toDevice);
-
-        if (userIDs.length === 1) {
-            const owner = userIDs[0];
-            if (typeof owner === "string") {
-                this.userDeviceListCache.set(owner, {
-                    devices: devices.map((d) => ({ ...d })),
-                    until: now + Database.USER_DEVICE_LIST_CACHE_TTL_MS,
-                });
-            }
-        }
-
-        return devices;
+        return rows.map(toDevice);
     }
 
     public async retrieveUsers(): Promise<InternalUserRecord[]> {
@@ -989,6 +957,7 @@ export class Database extends EventEmitter {
         const entry: MailSQL = {
             authorID: userID,
             cipher: XUtils.encodeHex(mail.cipher),
+            // Opaque transport metadata (X3DH initial payload or ratchet header).
             extra: XUtils.encodeHex(mail.extra),
             forward: mail.forward,
             group: mail.group ? XUtils.encodeHex(mail.group) : null,