@vex-chat/spire 4.1.0 → 5.0.0

package/dist/server/cliPasskeyPage.js.map

@@ -1 +1 @@
-{"version":3,"file":"cliPasskeyPage.js","sourceRoot":"","sources":["../../src/server/cliPasskeyPage.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,MAAM,GAAG,GAAG;IACR,oBAAoB;IACpB,iBAAiB;IACjB,0DAA0D;IAC1D,oBAAoB;IACpB,wBAAwB;IACxB,gBAAgB;IAChB,4BAA4B;IAC5B,2BAA2B;CAC9B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb,MAAM,gBAAgB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAyjBjB,CAAC;AAET,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAmB,EAAE;IACxD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACrC,GAAG,CAAC,GAAG,CAAC;YACJ,eAAe,EAAE,UAAU;YAC3B,yBAAyB,EAAE,GAAG;YAC9B,cAAc,EAAE,0BAA0B;YAC1C,oBAAoB,EAChB,uEAAuE;YAC3E,iBAAiB,EAAE,aAAa;YAChC,wBAAwB,EAAE,SAAS;SACtC,CAAC,CAAC;QACH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAClB,CAAC,CAAC"}
+{"version":3,"file":"cliPasskeyPage.js","sourceRoot":"","sources":["../../src/server/cliPasskeyPage.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,MAAM,GAAG,GAAG;IACR,oBAAoB;IACpB,iBAAiB;IACjB,0DAA0D;IAC1D,oBAAoB;IACpB,wBAAwB;IACxB,gBAAgB;IAChB,4BAA4B;IAC5B,2BAA2B;CAC9B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb,MAAM,gBAAgB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAg8BjB,CAAC;AAET,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAmB,EAAE;IACxD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACrC,GAAG,CAAC,GAAG,CAAC;YACJ,eAAe,EAAE,UAAU;YAC3B,yBAAyB,EAAE,GAAG;YAC9B,cAAc,EAAE,0BAA0B;YAC1C,oBAAoB,EAChB,uEAAuE;YAC3E,iBAAiB,EAAE,aAAa;YAChC,wBAAwB,EAAE,SAAS;SACtC,CAAC,CAAC;QACH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAClB,CAAC,CAAC"}

package/dist/spireListenPort.d.ts

@@ -4,8 +4,7 @@
  * Commercial licenses available at vex.wtf
  */
 /**
- * Default HTTP/WS port for the Spire API (tweetnacl and FIPS), unless
- * `API_PORT` / `apiPort` is set. Clients can tell profiles apart via `GET /status`.
+ * Default HTTP/WS port for the Spire API unless `API_PORT` / `apiPort` is set.
  */
 export declare const DEFAULT_SPIRE_API_PORT = 16777;
 /**

package/dist/spireListenPort.js

@@ -4,8 +4,7 @@
  * Commercial licenses available at vex.wtf
  */
 /**
- * Default HTTP/WS port for the Spire API (tweetnacl and FIPS), unless
- * `API_PORT` / `apiPort` is set. Clients can tell profiles apart via `GET /status`.
+ * Default HTTP/WS port for the Spire API unless `API_PORT` / `apiPort` is set.
  */
 export const DEFAULT_SPIRE_API_PORT = 16777;
 /**

package/dist/spireListenPort.js.map

@@ -1 +1 @@
-{"version":3,"file":"spireListenPort.js","sourceRoot":"","sources":["../src/spireListenPort.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,CAAC;AAE5C;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAA4B;IAC/D,IACI,OAAO,QAAQ,KAAK,QAAQ;QAC5B,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACzB,QAAQ,GAAG,CAAC,EACd,CAAC;QACC,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,sBAAsB,CAAC;AAClC,CAAC"}
+{"version":3,"file":"spireListenPort.js","sourceRoot":"","sources":["../src/spireListenPort.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;GAEG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,CAAC;AAE5C;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAA4B;IAC/D,IACI,OAAO,QAAQ,KAAK,QAAQ;QAC5B,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACzB,QAAQ,GAAG,CAAC,EACd,CAAC;QACC,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,sBAAsB,CAAC;AAClC,CAAC"}

package/dist/utils/loadEnv.d.ts

@@ -3,7 +3,6 @@
  * Licensed under AGPL-3.0. See LICENSE for details.
  * Commercial licenses available at vex.wtf
  */
-export declare function isSpireFipsEnabled(value: string | undefined): boolean;
 export declare function loadEnv(): void;
 export declare function normalizeEnvValue(value: string): string;
 export declare function validateSpireRuntimeEnv(env: Record<string, string | undefined>): void;

package/dist/utils/loadEnv.js

@@ -9,7 +9,6 @@ const NORMALIZED_ENV_VARS = [
     ...REQUIRED_ENV_VARS,
     "API_PORT",
     "SPIRE_TRUST_PROXY_HOPS",
-    "SPIRE_FIPS",
     "SPIRE_PASSKEY_RP_ID",
     "SPIRE_PASSKEY_RP_NAME",
     "SPIRE_PASSKEY_ORIGINS",
@@ -19,10 +18,6 @@ const NORMALIZED_ENV_VARS = [
 ];
 const HEX_BYTES_RE = /^(?:[0-9a-fA-F]{2})+$/;
 const TWEETNACL_SPK_HEX_LENGTH = 128;
-export function isSpireFipsEnabled(value) {
-    const normalized = value == null ? "" : normalizeEnvValue(value);
-    return normalized === "1" || normalized === "true";
-}
 /* Populate process.env with vars from .env and verify required vars are present. */
 export function loadEnv() {
     config();
@@ -51,18 +46,13 @@ export function validateSpireRuntimeEnv(env) {
     const spk = normalizeEnvValue(env["SPK"] ?? "");
     const jwtSecret = normalizeEnvValue(env["JWT_SECRET"] ?? "");
     if (!HEX_BYTES_RE.test(spk)) {
-        throw new Error("SPK must be an even-length hex string. Generate one with `pnpm --filter @vex-chat/spire gen-spk` or `gen-spk-fips`.");
-    }
-    if (isSpireFipsEnabled(env["SPIRE_FIPS"])) {
-        if (spk.length === TWEETNACL_SPK_HEX_LENGTH) {
-            throw new Error("SPIRE_FIPS=true requires an SPK from `pnpm --filter @vex-chat/spire gen-spk-fips`; the configured SPK looks like a tweetnacl key.");
-        }
+        throw new Error("SPK must be an even-length hex string. Generate one with `pnpm --filter @vex-chat/spire gen-spk`.");
     }
-    else if (spk.length !== TWEETNACL_SPK_HEX_LENGTH) {
-        throw new Error("SPIRE_FIPS is not enabled, so SPK must be 128 hex characters from `pnpm --filter @vex-chat/spire gen-spk`.");
+    if (spk.length !== TWEETNACL_SPK_HEX_LENGTH) {
+        throw new Error("SPK must be 128 hex characters from `pnpm --filter @vex-chat/spire gen-spk`.");
     }
     if (jwtSecret.length === 0) {
-        throw new Error("JWT_SECRET must be set. Generate one with `pnpm --filter @vex-chat/spire gen-spk` or `gen-spk-fips`.");
+        throw new Error("JWT_SECRET must be set. Generate one with `pnpm --filter @vex-chat/spire gen-spk`.");
     }
     if (jwtSecret.length < 32) {
         throw new Error("JWT_SECRET must contain at least 32 characters.");

package/dist/utils/loadEnv.js.map

@@ -1 +1 @@
-{"version":3,"file":"loadEnv.js","sourceRoot":"","sources":["../../src/utils/loadEnv.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,MAAM,iBAAiB,GAAG,CAAC,SAAS,EAAE,YAAY,EAAE,KAAK,CAAU,CAAC;AACpE,MAAM,mBAAmB,GAAG;IACxB,GAAG,iBAAiB;IACpB,UAAU;IACV,wBAAwB;IACxB,YAAY;IACZ,qBAAqB;IACrB,uBAAuB;IACvB,uBAAuB;IACvB,2BAA2B;IAC3B,+BAA+B;IAC/B,oCAAoC;CAC9B,CAAC;AACX,MAAM,YAAY,GAAG,uBAAuB,CAAC;AAC7C,MAAM,wBAAwB,GAAG,GAAG,CAAC;AAErC,MAAM,UAAU,kBAAkB,CAAC,KAAyB;IACxD,MAAM,UAAU,GAAG,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACjE,OAAO,UAAU,KAAK,GAAG,IAAI,UAAU,KAAK,MAAM,CAAC;AACvD,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,OAAO;IACnB,MAAM,EAAE,CAAC;IACT,sBAAsB,EAAE,CAAC;IACzB,KAAK,MAAM,QAAQ,IAAI,iBAAiB,EAAE,CAAC;QACvC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAChB,kCAAkC,QAAQ,4CAA4C,CACzF,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;IACL,CAAC;IACD,uBAAuB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,OAAO,OAAO,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACzB,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzC,IAAI,CAAC,KAAK,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACrE,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,OAAO,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,uBAAuB,CACnC,GAAuC;IAEvC,MAAM,GAAG,GAAG,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7D,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACX,qHAAqH,CACxH,CAAC;IACN,CAAC;IAED,IAAI,kBAAkB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;QACxC,IAAI,GAAG,CAAC,MAAM,KAAK,wBAAwB,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CACX,mIAAmI,CACtI,CAAC;QACN,CAAC;IACL,CAAC;SAAM,IAAI,GAAG,CAAC,MAAM,KAAK,wBAAwB,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CACX,4GAA4G,CAC/G,CAAC;IACN,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACX,sGAAsG,CACzG,CAAC;IACN,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC7D,CAAC;AACL,CAAC;AAED,SAAS,sBAAsB;IAC3B,KAAK,MAAM,IAAI,IAAI,mBAAmB,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACjD,CAAC;IACL,CAAC;AACL,CAAC"}
+{"version":3,"file":"loadEnv.js","sourceRoot":"","sources":["../../src/utils/loadEnv.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,MAAM,iBAAiB,GAAG,CAAC,SAAS,EAAE,YAAY,EAAE,KAAK,CAAU,CAAC;AACpE,MAAM,mBAAmB,GAAG;IACxB,GAAG,iBAAiB;IACpB,UAAU;IACV,wBAAwB;IACxB,qBAAqB;IACrB,uBAAuB;IACvB,uBAAuB;IACvB,2BAA2B;IAC3B,+BAA+B;IAC/B,oCAAoC;CAC9B,CAAC;AACX,MAAM,YAAY,GAAG,uBAAuB,CAAC;AAC7C,MAAM,wBAAwB,GAAG,GAAG,CAAC;AAErC,oFAAoF;AACpF,MAAM,UAAU,OAAO;IACnB,MAAM,EAAE,CAAC;IACT,sBAAsB,EAAE,CAAC;IACzB,KAAK,MAAM,QAAQ,IAAI,iBAAiB,EAAE,CAAC;QACvC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAChB,kCAAkC,QAAQ,4CAA4C,CACzF,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;IACL,CAAC;IACD,uBAAuB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,OAAO,OAAO,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACzB,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzC,IAAI,CAAC,KAAK,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACrE,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,OAAO,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,uBAAuB,CACnC,GAAuC;IAEvC,MAAM,GAAG,GAAG,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7D,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACX,mGAAmG,CACtG,CAAC;IACN,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,wBAAwB,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACX,8EAA8E,CACjF,CAAC;IACN,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACX,oFAAoF,CACvF,CAAC;IACN,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC7D,CAAC;AACL,CAAC;AAED,SAAS,sBAAsB;IAC3B,KAAK,MAAM,IAAI,IAAI,mBAAmB,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACjD,CAAC;IACL,CAAC;AACL,CAAC"}

package/dist/utils/spireXSignOpenAsync.d.ts

@@ -3,7 +3,5 @@
  * Licensed under AGPL-3.0. See LICENSE for details.
  * Commercial licenses available at vex.wtf
  */
-/**
- * Ed25519 detached-verify open: sync on tweetnacl, async for FIPS (Web Crypto).
- */
+/** Ed25519 detached-verify open. */
 export declare function spireXSignOpenAsync(signedMessage: Uint8Array, publicKey: Uint8Array): Promise<null | Uint8Array>;

package/dist/utils/spireXSignOpenAsync.js

@@ -3,14 +3,9 @@
  * Licensed under AGPL-3.0. See LICENSE for details.
  * Commercial licenses available at vex.wtf
  */
-import { getCryptoProfile, xSignOpen, xSignOpenAsync } from "@vex-chat/crypto";
-/**
- * Ed25519 detached-verify open: sync on tweetnacl, async for FIPS (Web Crypto).
- */
-export async function spireXSignOpenAsync(signedMessage, publicKey) {
-    if (getCryptoProfile() === "fips") {
-        return xSignOpenAsync(signedMessage, publicKey);
-    }
-    return xSignOpen(signedMessage, publicKey);
+import { xSignOpen } from "@vex-chat/crypto";
+/** Ed25519 detached-verify open. */
+export function spireXSignOpenAsync(signedMessage, publicKey) {
+    return Promise.resolve(xSignOpen(signedMessage, publicKey));
 }
 //# sourceMappingURL=spireXSignOpenAsync.js.map

package/dist/utils/spireXSignOpenAsync.js.map

@@ -1 +1 @@
-{"version":3,"file":"spireXSignOpenAsync.js","sourceRoot":"","sources":["../../src/utils/spireXSignOpenAsync.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAE/E;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACrC,aAAyB,EACzB,SAAqB;IAErB,IAAI,gBAAgB,EAAE,KAAK,MAAM,EAAE,CAAC;QAChC,OAAO,cAAc,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,SAAS,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;AAC/C,CAAC"}
+{"version":3,"file":"spireXSignOpenAsync.js","sourceRoot":"","sources":["../../src/utils/spireXSignOpenAsync.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE7C,oCAAoC;AACpC,MAAM,UAAU,mBAAmB,CAC/B,aAAyB,EACzB,SAAqB;IAErB,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CAAC;AAChE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vex-chat/spire",
-  "version": "4.1.0",
+  "version": "5.0.0",
   "description": "Vex server implementation in NodeJS.",
   "type": "module",
   "files": [
@@ -55,7 +55,7 @@
     "typescript-eslint": "8.58.1",
     "vitest": "4.1.4",
     "@vex-chat/eslint-config": "0.0.1",
-    "@vex-chat/libvex": "^9.1.0"
+    "@vex-chat/libvex": "^10.0.0"
   },
   "typeCoverage": {
     "atLeast": 95,
@@ -83,7 +83,7 @@
     "uuid": "^14.0.0",
     "ws": "8.21.0",
     "zod": "^4.3.6",
-    "@vex-chat/crypto": "^11.0.0",
+    "@vex-chat/crypto": "^12.0.0",
     "@vex-chat/types": "^4.3.3"
   },
   "scripts": {
@@ -108,7 +108,6 @@
     "stress:docs-pack": "pnpm run integration:docs-pack",
     "stress:llm-triage": "pnpm run integration:llm-triage",
     "gen-spk": "node scripts/gen-spk.js",
-    "gen-spk-fips": "node scripts/gen-spk-fips.js",
     "docs": "node ./scripts/generate-docs.js",
     "service:status-monitor": "node ./services/status-monitor/index.js",
     "service:status-monitor:clear-history": "node ./services/status-monitor/clear-history.js",

package/src/Database.ts

@@ -41,11 +41,7 @@ import * as fs from "node:fs/promises";
 import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 
-import {
-    fipsEcdhRawPublicKeyFromEcdsaSpkiAsync,
-    getCryptoProfile,
-    XUtils,
-} from "@vex-chat/crypto";
+import { XUtils } from "@vex-chat/crypto";
 import {
     ACCOUNT_PASSWORD_MAX_LENGTH,
     ACCOUNT_PASSWORD_MIN_LENGTH,
@@ -677,15 +673,10 @@ export class Database extends EventEmitter {
         if (!preKey) {
             throw new Error("Failed to get prekey.");
         }
-        const signKeyBytes = XUtils.decodeHex(device.signKey);
-        const signKey =
-            getCryptoProfile() === "fips"
-                ? await fipsEcdhRawPublicKeyFromEcdsaSpkiAsync(signKeyBytes)
-                : signKeyBytes;
         const keyBundle: KeyBundle = {
             otk,
             preKey,
-            signKey,
+            signKey: XUtils.decodeHex(device.signKey),
         };
         return keyBundle;
     }

package/src/Spire.ts

@@ -25,10 +25,8 @@ import express from "express";
 import { XUtils } from "@vex-chat/crypto";
 import {
     type KeyPair,
-    setCryptoProfile,
     xRandomBytes,
     xSignKeyPairFromSecret,
-    xSignKeyPairFromSecretAsync,
 } from "@vex-chat/crypto";
 import {
     ACCOUNT_PASSWORD_MAX_LENGTH,
@@ -238,52 +236,18 @@ const getCommitSha = (): string => {
 export interface SpireOptions {
     /**
      * TCP port for the HTTP/WS server. If omitted, `run.ts` + `resolveSpireListenPort`
-     * use the default (16777 for all profiles; crypto mode is in `GET /status`). Env: `API_PORT`.
+     * use the default (16777). Env: `API_PORT`.
      */
     apiPort?: number;
-    /** Default `tweetnacl`. For `fips`, use `Spire.createAsync` (FIPS key load is async). */
-    cryptoProfile?: "fips" | "tweetnacl";
     dbType?: "mysql" | "sqlite3" | "sqlite3mem" | "sqlite";
 }
 
-export function resolveTrustProxyHops(value: string | undefined): number {
-    if (value === undefined || value.trim() === "") {
-        return 0;
-    }
-    const hops = Number(value);
-    if (!Number.isInteger(hops) || hops < 0 || hops > 10) {
-        throw new Error(
-            "SPIRE_TRUST_PROXY_HOPS must be an integer from 0 to 10.",
-        );
-    }
-    return hops;
-}
-
-/**
- * Masks identifying material in the access-log URL: hyphenated UUIDs, and
- * `/device/...` path segments that hold public-key material (32B ed25519 hex, or
- * a longer P-256 SPKI hex in FIPS) — not the same pattern as a UUID.
- */
-function redactAccessLogUrl(url: string): string {
-    let s = url.replace(
-        /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/gi,
-        "[uuid]",
-    );
-    // Device id is a hex public key, not a UUID: strip the segment after /device/
-    s = s.replace(/(\/device\/)([0-9a-fA-F]{16,})(?=[/?#]|$)/g, "$1[device]");
-    return s;
-}
-
-/** FIPS: sign key loaded inside `Spire.createAsync` before the constructor runs. */
-let pendingFipsKeyPair: KeyPair | null = null;
-
 export class Spire extends EventEmitter {
     private actionTokens = new Map<string, ActionToken>();
     private api = express();
     private calls: CallManager;
     private clients: ClientManager[] = [];
     private readonly commitSha = getCommitSha();
-    private readonly cryptoProfile: "fips" | "tweetnacl";
     private db: Database;
     private dbReady = false;
     private deviceChallenges = new Map<
@@ -309,19 +273,7 @@ export class Spire extends EventEmitter {
 
     constructor(SK: string, options?: SpireOptions) {
         super();
-        this.cryptoProfile = options?.cryptoProfile ?? "tweetnacl";
-        if (pendingFipsKeyPair) {
-            this.signKeys = pendingFipsKeyPair;
-            pendingFipsKeyPair = null;
-        } else {
-            if (this.cryptoProfile === "fips") {
-                throw new Error(
-                    'FIPS: use `await Spire.createAsync(secretKeyHex, { ...options, cryptoProfile: "fips" })` instead of `new Spire()`.',
-                );
-            }
-            setCryptoProfile(this.cryptoProfile);
-            this.signKeys = xSignKeyPairFromSecret(XUtils.decodeHex(SK));
-        }
+        this.signKeys = xSignKeyPairFromSecret(XUtils.decodeHex(SK));
 
         // Proxy trust must match the deployment topology. Defaulting to zero
         // prevents direct deployments from accepting attacker-supplied
@@ -363,33 +315,6 @@ export class Spire extends EventEmitter {
         this.init(resolveSpireListenPort(options?.apiPort));
     }
 
-    /**
-     * Construct Spire when the crypto profile is `fips` (async sign-key derivation).
-     * For `tweetnacl` (default) you can use `new Spire()` directly.
-     */
-    public static async createAsync(
-        secretKeyHex: string,
-        options?: SpireOptions,
-    ): Promise<Spire> {
-        if ((options?.cryptoProfile ?? "tweetnacl") !== "fips") {
-            return new Spire(secretKeyHex, options);
-        }
-        if (typeof globalThis.crypto.subtle !== "object") {
-            throw new Error(
-                "FIPS: Spire requires `globalThis.crypto.subtle` (e.g. Node 20+ with global Web Crypto).",
-            );
-        }
-        setCryptoProfile("fips");
-        try {
-            pendingFipsKeyPair = await xSignKeyPairFromSecretAsync(
-                XUtils.decodeHex(secretKeyHex),
-            );
-            return new Spire(secretKeyHex, options);
-        } finally {
-            pendingFipsKeyPair = null;
-        }
-    }
-
     public async close(): Promise<void> {
         if (this.mailPruneInterval) {
             clearInterval(this.mailPruneInterval);
@@ -671,7 +596,7 @@ export class Spire extends EventEmitter {
 
             const ok = dbHealthy;
             if (!devApiKeySkipsRateLimits(req)) {
-                res.json({ cryptoProfile: this.cryptoProfile, ok });
+                res.json({ ok });
                 return;
             }
             const canaryEnv = process.env["CANARY"]?.trim().toLowerCase();
@@ -681,7 +606,6 @@ export class Spire extends EventEmitter {
                     canaryEnv === "true" ||
                     canaryEnv === "yes",
                 checkDurationMs,
-                cryptoProfile: this.cryptoProfile,
                 now: new Date(),
                 ok,
                 version: this.version,
@@ -1438,7 +1362,7 @@ export class Spire extends EventEmitter {
                     const message =
                         err instanceof Error ? err.message : String(err);
                     console.error(
-                        `[spire] /register failed requestId=${requestId} profile=${this.cryptoProfile} message=${message}`,
+                        `[spire] /register failed requestId=${requestId} message=${message}`,
                     );
                     if (err instanceof Error && err.stack) {
                         console.error(err.stack);
@@ -1510,6 +1434,19 @@ export class Spire extends EventEmitter {
     }
 }
 
+export function resolveTrustProxyHops(value: string | undefined): number {
+    if (value === undefined || value.trim() === "") {
+        return 0;
+    }
+    const hops = Number(value);
+    if (!Number.isInteger(hops) || hops < 0 || hops > 10) {
+        throw new Error(
+            "SPIRE_TRUST_PROXY_HOPS must be an integer from 0 to 10.",
+        );
+    }
+    return hops;
+}
+
 // Usernames are case-insensitive at the protocol level — `User` and
 // `user` must resolve to the same account. We canonicalize to
 // lowercase at the registration boundary so the persisted row, the
@@ -1518,3 +1455,17 @@ export class Spire extends EventEmitter {
 function normalizeRegistrationUsername(username: string): string {
     return username.trim().toLowerCase();
 }
+
+/**
+ * Masks identifying material in the access-log URL: hyphenated UUIDs, and
+ * `/device/...` path segments that hold Ed25519 public-key material.
+ */
+function redactAccessLogUrl(url: string): string {
+    let s = url.replace(
+        /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/gi,
+        "[uuid]",
+    );
+    // Device id is a hex public key, not a UUID: strip the segment after /device/
+    s = s.replace(/(\/device\/)([0-9a-fA-F]{16,})(?=[/?#]|$)/g, "$1[device]");
+    return s;
+}

package/src/__tests__/cliPasskeyPage.spec.ts

@@ -44,15 +44,25 @@ describe("CLI passkey page", () => {
         expect(res.headers.get("permissions-policy")).toContain(
             "publickey-credentials-create=(self)",
         );
-        expect(html).toContain("Continue with your passkey.");
+        expect(html).toContain("Continue with your passkey");
+        expect(html).toContain("--accent: #e5484d");
+        expect(html).not.toContain("radial-gradient");
+        expect(html).toContain('role="status" aria-live="polite"');
         expect(html).toContain("resolveTrustedApiBase");
         expect(html).toContain("Passkey link API origin is not trusted.");
+        expect(html).toContain("resolveCompletionCallback");
+        expect(html).toContain('callback.protocol !== "vex:" ||');
+        expect(html).toContain('callback.pathname !== "/complete" ||');
         expect(html).toContain("window.history.replaceState");
         expect(html).toContain('mode === "register-handoff"');
         expect(html).toContain('mode === "authenticate-handoff"');
         expect(html).toContain('"/auth/passkey/browser-registration/"');
         expect(html).toContain('"/auth/passkey/browser-authentication/"');
         expect(html).toContain("action.disabled = nextBusy || completed");
+        expect(html).toContain("showCompletion(");
+        expect(html).toContain("action.hidden = true");
+        expect(html).toContain('err.name === "NotAllowedError"');
+        expect(html).toContain("apiRequestError(response.status, payload)");
         expect(html).toContain("navigator.credentials.create");
         expect(html).toContain("navigator.credentials.get");
     });

package/src/__tests__/loadEnv.spec.ts

@@ -7,13 +7,11 @@
 import { describe, expect, it } from "vitest";
 
 import {
-    isSpireFipsEnabled,
     normalizeEnvValue,
     validateSpireRuntimeEnv,
 } from "../utils/loadEnv.ts";
 
 const TWEETNACL_SPK = "ab".repeat(64);
-const FIPS_SPK = "cd".repeat(90);
 const JWT_SECRET = "ef".repeat(32);
 
 describe("normalizeEnvValue", () => {
@@ -30,22 +28,11 @@ describe("normalizeEnvValue", () => {
     });
 });
 
-describe("isSpireFipsEnabled", () => {
-    it("accepts true and 1 only", () => {
-        expect(isSpireFipsEnabled("true")).toBe(true);
-        expect(isSpireFipsEnabled('"true"')).toBe(true);
-        expect(isSpireFipsEnabled("1")).toBe(true);
-        expect(isSpireFipsEnabled("false")).toBe(false);
-        expect(isSpireFipsEnabled(undefined)).toBe(false);
-    });
-});
-
 describe("validateSpireRuntimeEnv", () => {
     it("accepts quoted compose-safe tweetnacl keys", () => {
         expect(() => {
             validateSpireRuntimeEnv({
                 JWT_SECRET: `"${JWT_SECRET}"`,
-                SPIRE_FIPS: "false",
                 SPK: `"${TWEETNACL_SPK}"`,
             });
         }).not.toThrow();
@@ -60,22 +47,11 @@ describe("validateSpireRuntimeEnv", () => {
         }).toThrow(/SPK must be an even-length hex string/);
     });
 
-    it("rejects a FIPS flag with a tweetnacl-sized SPK", () => {
-        expect(() => {
-            validateSpireRuntimeEnv({
-                JWT_SECRET,
-                SPIRE_FIPS: "true",
-                SPK: TWEETNACL_SPK,
-            });
-        }).toThrow(/requires an SPK from .*gen-spk-fips/);
-    });
-
-    it("rejects a FIPS-sized SPK without the FIPS flag", () => {
+    it("rejects an SPK with the wrong length", () => {
         expect(() => {
             validateSpireRuntimeEnv({
                 JWT_SECRET,
-                SPIRE_FIPS: "false",
-                SPK: FIPS_SPK,
+                SPK: "cd".repeat(90),
             });
         }).toThrow(/SPK must be 128 hex characters/);
     });

package/src/__tests__/preKeySignature.spec.ts

@@ -5,7 +5,6 @@
  */
 
 import {
-    setCryptoProfile,
     xBoxKeyPairAsync,
     xPreKeySignaturePayload,
     xSignAsync,
@@ -13,7 +12,7 @@ import {
     XUtils,
 } from "@vex-chat/crypto";
 
-import { beforeEach, describe, expect, it } from "vitest";
+import { describe, expect, it } from "vitest";
 
 import {
     verifyDevicePayloadPreKeySignature,
@@ -31,10 +30,6 @@ async function makeSignedPreKey() {
 }
 
 describe("prekey signature validation", () => {
-    beforeEach(() => {
-        setCryptoProfile("tweetnacl");
-    });
-
     it("accepts a prekey signed by the device signing key", async () => {
         const { preKey, signature, signKeys } = await makeSignedPreKey();
 

package/src/__tests__/spireListenPort.spec.ts

@@ -12,7 +12,7 @@ import {
 } from "../spireListenPort.ts";
 
 describe("resolveSpireListenPort", () => {
-    it("uses default for tweetnacl and fips when no explicit port", () => {
+    it("uses the default when no explicit port is provided", () => {
         expect(resolveSpireListenPort(undefined)).toBe(DEFAULT_SPIRE_API_PORT);
     });
 

package/src/run.ts

@@ -9,7 +9,7 @@ import type { SpireOptions } from "./Spire.ts";
 import { Spire } from "./Spire.ts";
 import { loadEnv } from "./utils/loadEnv.ts";
 
-async function main() {
+function main() {
     // load the environment variables — loadEnv() exits if required vars are missing
     loadEnv();
 
@@ -29,21 +29,12 @@ async function main() {
         }
     }
     const dbType = parseDbType(process.env["DB_TYPE"]);
-    const fips =
-        process.env["SPIRE_FIPS"] === "1" ||
-        process.env["SPIRE_FIPS"] === "true";
-
     const options: SpireOptions = {
         ...(apiPort !== undefined ? { apiPort } : {}),
         ...(dbType !== undefined ? { dbType } : {}),
-        ...(fips ? { cryptoProfile: "fips" } : {}),
     };
 
-    if (fips) {
-        await Spire.createAsync(spk, options);
-    } else {
-        new Spire(spk, options);
-    }
+    new Spire(spk, options);
 }
 
 function parseDbType(value: string | undefined): SpireOptions["dbType"] {
@@ -58,7 +49,9 @@ function parseDbType(value: string | undefined): SpireOptions["dbType"] {
     }
 }
 
-void main().catch((err: unknown) => {
+try {
+    main();
+} catch (err: unknown) {
     console.error(err);
     process.exit(1);
-});
+}