1 files changed, 2 insertions, 18 deletions
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/keyderive.js b/packages/meshbay-hub/src/meshbay_hub/static/keyderive.js
index 879f56f..33b1cf2 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/keyderive.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/keyderive.js
@@ -256,15 +256,9 @@ async function deriveRecoveryKey(R, username) {
 // ── Bundle encryption ─────────────────────────────────────────────────────────
 
 /**
- * Encrypt the keypair bundle with the password-derived AES key.
- * Bundle format: JSON { skEd: base64(pkcs8), skX: base64(pkcs8) }
+ * Encrypt the keypair bundle with a bundle key derived at sign-in. Always
+ * writes v2. Bundle format: JSON { skEd: base64(pkcs8), skX: base64(pkcs8) }
  */
-async function encryptBundle(skEdRaw, skXRaw, password, username) {
-  const aesKey = await deriveEncryptionKey(password, username);
-  return encryptBundleWithKey(skEdRaw, skXRaw, aesKey);
-}
-
-/** Same, when the key was already derived at sign-in. Always writes v2. */
 async function encryptBundleWithKey(skEdRaw, skXRaw, aesKey) {
   const nonce  = crypto.getRandomValues(new Uint8Array(12));
   const data   = new TextEncoder().encode(JSON.stringify({
@@ -289,16 +283,6 @@ function bundleVersion(bundleB64) {
   } catch { return 1; }
 }
 
-/**
- * Decrypt a keypair bundle. Throws if password is wrong.
- */
-async function decryptBundle(bundleB64, password, username) {
-  const key = bundleVersion(bundleB64) === 2
-    ? await deriveEncryptionKey(password, username)
-    : await deriveEncryptionKeyV1(password, username);
-  return decryptBundleWithKey(bundleB64, key);
-}
-
 // ── Registration ──────────────────────────────────────────────────────────────
 
 /**