zapo-js 0.1.1 → 0.2.0

package/dist/crypto/curves/Ed25519.js

@@ -2,7 +2,6 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Ed25519 = void 0;
 const node_crypto_1 = require("node:crypto");
-const encoding_1 = require("../core/encoding");
 const constants_1 = require("../curves/constants");
 const types_1 = require("../curves/types");
 const bytes_1 = require("../../util/bytes");
@@ -14,27 +13,27 @@ class Ed25519 {
         ]));
         const privateJwk = await node_crypto_1.webcrypto.subtle.exportKey('jwk', keys.privateKey);
         return {
-            pubKey: (0, encoding_1.decodeBase64Url)(privateJwk.x, 'ed25519 public key'),
-            privKey: (0, encoding_1.decodeBase64Url)(privateJwk.d, 'ed25519 private key')
+            pubKey: (0, bytes_1.decodeBase64Url)(privateJwk.x, 'ed25519 public key'),
+            privKey: (0, bytes_1.decodeBase64Url)(privateJwk.d, 'ed25519 private key')
         };
     }
     static async keyPairFromPrivateKey(privKey) {
-        (0, encoding_1.assert32)(privKey, 'ed25519 private key');
+        (0, bytes_1.assertByteLength)(privKey, 32, 'ed25519 private key must be 32 bytes');
         const privateKey = await node_crypto_1.webcrypto.subtle.importKey('pkcs8', (0, types_1.pkcs8FromRawPrivate)(constants_1.ED25519_PKCS8_PREFIX, privKey), { name: 'Ed25519' }, true, ['sign']);
         const privateJwk = await node_crypto_1.webcrypto.subtle.exportKey('jwk', privateKey);
         return {
-            pubKey: (0, encoding_1.decodeBase64Url)(privateJwk.x, 'ed25519 public key'),
-            privKey: (0, encoding_1.decodeBase64Url)(privateJwk.d, 'ed25519 private key')
+            pubKey: (0, bytes_1.decodeBase64Url)(privateJwk.x, 'ed25519 public key'),
+            privKey: (0, bytes_1.decodeBase64Url)(privateJwk.d, 'ed25519 private key')
         };
     }
     static async sign(message, privKey) {
-        (0, encoding_1.assert32)(privKey, 'ed25519 private key');
+        (0, bytes_1.assertByteLength)(privKey, 32, 'ed25519 private key must be 32 bytes');
         const privateKey = await node_crypto_1.webcrypto.subtle.importKey('pkcs8', (0, types_1.pkcs8FromRawPrivate)(constants_1.ED25519_PKCS8_PREFIX, privKey), { name: 'Ed25519' }, false, ['sign']);
         const signature = await node_crypto_1.webcrypto.subtle.sign('Ed25519', privateKey, message);
         return (0, bytes_1.toBytesView)(signature);
     }
     static async verify(message, signature, pubKey) {
-        (0, encoding_1.assert32)(pubKey, 'ed25519 public key');
+        (0, bytes_1.assertByteLength)(pubKey, 32, 'ed25519 public key must be 32 bytes');
         const publicKey = await node_crypto_1.webcrypto.subtle.importKey('raw', pubKey, { name: 'Ed25519' }, false, ['verify']);
         return node_crypto_1.webcrypto.subtle.verify('Ed25519', publicKey, signature, message);
     }

package/dist/crypto/curves/X25519.js

@@ -4,31 +4,45 @@ exports.X25519 = void 0;
 exports.clampCurvePrivateKeyInPlace = clampCurvePrivateKeyInPlace;
 exports.montgomeryToEdwardsPublic = montgomeryToEdwardsPublic;
 const node_crypto_1 = require("node:crypto");
-const encoding_1 = require("../core/encoding");
 const constants_1 = require("../curves/constants");
 const types_1 = require("../curves/types");
-const le_1 = require("../math/le");
-const mod_1 = require("../math/mod");
+const constants_2 = require("../math/constants");
+const fe_1 = require("../math/fe");
 const bytes_1 = require("../../util/bytes");
+// Pre-allocated temps for montgomeryToEdwardsPublic (safe: single-threaded)
+const _mx = (0, fe_1.fe)();
+const _m1 = (0, fe_1.fe)();
+const _m2 = (0, fe_1.fe)();
+const _m3 = (0, fe_1.fe)();
+// p-1 = 2^255-20 in LE bytes: 0xEC, 0xFF×30, 0x7F
+// Mask bit 255 before comparing (non-canonical inputs may have it set)
+function isFieldPMinus1(b) {
+    if (b[0] !== 0xec || (b[31] & 0x7f) !== 0x7f)
+        return false;
+    for (let i = 1; i < 31; i++)
+        if (b[i] !== 0xff)
+            return false;
+    return true;
+}
 function clampCurvePrivateKeyInPlace(privateKey) {
-    if (privateKey.length !== 32) {
-        throw new Error(`invalid curve25519 private key length ${privateKey.length}`);
-    }
+    (0, bytes_1.assertByteLength)(privateKey, 32, `invalid curve25519 private key length ${privateKey.length}`);
     privateKey[0] &= 248;
     privateKey[31] &= 127;
     privateKey[31] |= 64;
     return privateKey;
 }
 function montgomeryToEdwardsPublic(curvePublicKey, signBit) {
-    if (curvePublicKey.length !== 32) {
-        throw new Error(`invalid curve25519 public key length ${curvePublicKey.length}`);
-    }
-    const x = (0, le_1.bytesToBigIntLE)(curvePublicKey);
-    if (x === mod_1.FIELD_P - 1n) {
+    (0, bytes_1.assertByteLength)(curvePublicKey, 32, `invalid curve25519 public key length ${curvePublicKey.length}`);
+    if (isFieldPMinus1(curvePublicKey)) {
         throw new Error('invalid curve25519 low-order public key');
     }
-    const y = (0, mod_1.mod)((x - 1n) * (0, mod_1.modInv)(x + 1n));
-    const encoded = (0, le_1.bigIntToBytesLE)(y, 32);
+    (0, fe_1.feFromBytes)(_mx, curvePublicKey);
+    (0, fe_1.feSub)(_m1, _mx, constants_2.FE_ONE);
+    (0, fe_1.feAdd)(_m2, _mx, constants_2.FE_ONE);
+    (0, fe_1.feInv)(_m3, _m2);
+    (0, fe_1.feMul)(_m1, _m1, _m3);
+    const encoded = new Uint8Array(32);
+    (0, fe_1.fePack)(encoded, _m1);
     encoded[31] = (encoded[31] & 0x7f) | (signBit & 0x80);
     return encoded;
 }
@@ -39,24 +53,26 @@ class X25519 {
         ]));
         const privateJwk = await node_crypto_1.webcrypto.subtle.exportKey('jwk', keys.privateKey);
         return {
-            pubKey: (0, encoding_1.decodeBase64Url)(privateJwk.x, 'x25519 public key'),
-            privKey: (0, encoding_1.decodeBase64Url)(privateJwk.d, 'x25519 private key')
+            pubKey: (0, bytes_1.decodeBase64Url)(privateJwk.x, 'x25519 public key'),
+            privKey: (0, bytes_1.decodeBase64Url)(privateJwk.d, 'x25519 private key')
         };
     }
     static async keyPairFromPrivateKey(privKey) {
-        (0, encoding_1.assert32)(privKey, 'x25519 private key');
+        (0, bytes_1.assertByteLength)(privKey, 32, 'x25519 private key must be 32 bytes');
         const privateKey = await node_crypto_1.webcrypto.subtle.importKey('pkcs8', (0, types_1.pkcs8FromRawPrivate)(constants_1.X25519_PKCS8_PREFIX, privKey), { name: 'X25519' }, true, ['deriveBits']);
         const privateJwk = await node_crypto_1.webcrypto.subtle.exportKey('jwk', privateKey);
         return {
-            pubKey: (0, encoding_1.decodeBase64Url)(privateJwk.x, 'x25519 public key'),
-            privKey: (0, encoding_1.decodeBase64Url)(privateJwk.d, 'x25519 private key')
+            pubKey: (0, bytes_1.decodeBase64Url)(privateJwk.x, 'x25519 public key'),
+            privKey: (0, bytes_1.decodeBase64Url)(privateJwk.d, 'x25519 private key')
         };
     }
     static async scalarMult(privKey, pubKey) {
-        (0, encoding_1.assert32)(privKey, 'x25519 private key');
-        (0, encoding_1.assert32)(pubKey, 'x25519 public key');
-        const privateKey = await node_crypto_1.webcrypto.subtle.importKey('pkcs8', (0, types_1.pkcs8FromRawPrivate)(constants_1.X25519_PKCS8_PREFIX, privKey), { name: 'X25519' }, false, ['deriveBits']);
-        const publicKey = await node_crypto_1.webcrypto.subtle.importKey('raw', pubKey, { name: 'X25519' }, false, []);
+        (0, bytes_1.assertByteLength)(privKey, 32, 'x25519 private key must be 32 bytes');
+        (0, bytes_1.assertByteLength)(pubKey, 32, 'x25519 public key must be 32 bytes');
+        const [privateKey, publicKey] = await Promise.all([
+            node_crypto_1.webcrypto.subtle.importKey('pkcs8', (0, types_1.pkcs8FromRawPrivate)(constants_1.X25519_PKCS8_PREFIX, privKey), { name: 'X25519' }, false, ['deriveBits']),
+            node_crypto_1.webcrypto.subtle.importKey('raw', pubKey, { name: 'X25519' }, false, [])
+        ]);
         const sharedBits = await node_crypto_1.webcrypto.subtle.deriveBits({ name: 'X25519', public: publicKey }, privateKey, 256);
         return (0, bytes_1.toBytesView)(sharedBits);
     }

package/dist/crypto/index.js

@@ -14,9 +14,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.X25519 = exports.Ed25519 = void 0;
+exports.X25519 = void 0;
 __exportStar(require("./core"), exports);
-var Ed25519_1 = require("./curves/Ed25519");
-Object.defineProperty(exports, "Ed25519", { enumerable: true, get: function () { return Ed25519_1.Ed25519; } });
 var X25519_1 = require("./curves/X25519");
 Object.defineProperty(exports, "X25519", { enumerable: true, get: function () { return X25519_1.X25519; } });

package/dist/crypto/math/constants.js

@@ -1,44 +1,21 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.IDENTITY_POINT = exports.BASE_POINT = exports.TWO_D = exports.EDWARDS_D = exports.GROUP_L = exports.FIELD_P = void 0;
+exports.IDENTITY_POINT = exports.BASE_POINT = exports.FE_ONE = exports.FE_ZERO = exports.FE_TWO_D = exports.GROUP_L = exports.FIELD_P = void 0;
+const fe_1 = require("../math/fe");
 exports.FIELD_P = (1n << 255n) - 19n;
 exports.GROUP_L = (1n << 252n) + 27742317777372353535851937790883648493n;
-function modField(value) {
-    const remainder = value % exports.FIELD_P;
-    return remainder >= 0n ? remainder : remainder + exports.FIELD_P;
-}
-function modPowField(base, exponent) {
-    let result = 1n;
-    let current = modField(base);
-    let power = exponent;
-    while (power > 0n) {
-        if ((power & 1n) === 1n) {
-            result = modField(result * current);
-        }
-        current = modField(current * current);
-        power >>= 1n;
-    }
-    return result;
-}
-function modInvField(value) {
-    if (value === 0n) {
-        throw new Error('field inversion by zero');
-    }
-    return modPowField(value, exports.FIELD_P - 2n);
-}
-const BASE_X = 15112221349535400772501151409588531511454012693041857206046113283949847762202n;
-const BASE_Y = 46316835694926478169428394003475163141307993866256225615783033603165251855960n;
-exports.EDWARDS_D = modField(-121665n * modInvField(121666n));
-exports.TWO_D = modField(2n * exports.EDWARDS_D);
+exports.FE_TWO_D = (0, fe_1.feFromBigInt)(16295367250680780974490674513165176452449235426866156013048779062215315747161n);
+exports.FE_ZERO = (0, fe_1.fe)();
+exports.FE_ONE = (0, fe_1.feFromBigInt)(1n);
 exports.BASE_POINT = Object.freeze({
-    x: BASE_X,
-    y: BASE_Y,
-    z: 1n,
-    t: modField(BASE_X * BASE_Y)
+    x: (0, fe_1.feFromBigInt)(15112221349535400772501151409588531511454012693041857206046113283949847762202n),
+    y: (0, fe_1.feFromBigInt)(46316835694926478169428394003475163141307993866256225615783033603165251855960n),
+    z: (0, fe_1.feFromBigInt)(1n),
+    t: (0, fe_1.feFromBigInt)(46827403850823179245072216630277197565144205554125654976674165829533817101731n)
 });
 exports.IDENTITY_POINT = Object.freeze({
-    x: 0n,
-    y: 1n,
-    z: 1n,
-    t: 0n
+    x: (0, fe_1.feFromBigInt)(0n),
+    y: (0, fe_1.feFromBigInt)(1n),
+    z: (0, fe_1.feFromBigInt)(1n),
+    t: (0, fe_1.feFromBigInt)(0n)
 });

package/dist/crypto/math/edwards.js

@@ -3,62 +3,189 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.scalarMultBase = scalarMultBase;
 exports.encodeExtendedPoint = encodeExtendedPoint;
 const constants_1 = require("../math/constants");
-const le_1 = require("../math/le");
+const fe_1 = require("../math/fe");
 const mod_1 = require("../math/mod");
+// Pre-allocated temporaries for point operations (safe: JS is single-threaded)
+const _a = (0, fe_1.fe)();
+const _b = (0, fe_1.fe)();
+const _c = (0, fe_1.fe)();
+const _d = (0, fe_1.fe)();
+const _e = (0, fe_1.fe)();
+const _f = (0, fe_1.fe)();
+const _g = (0, fe_1.fe)();
+const _h = (0, fe_1.fe)();
+// Pre-allocated output points for hot-path operations
+function mutablePoint() {
+    return { x: (0, fe_1.fe)(), y: (0, fe_1.fe)(), z: (0, fe_1.fe)(), t: (0, fe_1.fe)() };
+}
+const _addOut = mutablePoint();
+const _dblOut = mutablePoint();
+const _negOut = mutablePoint();
+// Temporaries for feInv inside encodeExtendedPoint
+const _invZinv = (0, fe_1.fe)();
+const _invX = (0, fe_1.fe)();
+const _invY = (0, fe_1.fe)();
+const _invXBytes = new Uint8Array(32);
+function addPointInto(out, a, b) {
+    (0, fe_1.feSub)(_a, a.y, a.x);
+    (0, fe_1.feSub)(_b, b.y, b.x);
+    (0, fe_1.feMul)(_a, _a, _b); // aTerm
+    (0, fe_1.feAdd)(_b, a.y, a.x);
+    (0, fe_1.feAdd)(_c, b.y, b.x);
+    (0, fe_1.feMul)(_b, _b, _c); // bTerm
+    (0, fe_1.feMul)(_c, constants_1.FE_TWO_D, a.t);
+    (0, fe_1.feMul)(_c, _c, b.t); // cTerm
+    (0, fe_1.feAdd)(_d, a.z, a.z);
+    (0, fe_1.feMul)(_d, _d, b.z); // dTerm
+    (0, fe_1.feSub)(_e, _b, _a); // eTerm
+    (0, fe_1.feSub)(_f, _d, _c); // fTerm
+    (0, fe_1.feAdd)(_g, _d, _c); // gTerm
+    (0, fe_1.feAdd)(_h, _b, _a); // hTerm
+    (0, fe_1.feMul)(out.x, _e, _f);
+    (0, fe_1.feMul)(out.y, _g, _h);
+    (0, fe_1.feMul)(out.z, _f, _g);
+    (0, fe_1.feMul)(out.t, _e, _h);
+}
+function doublePointInto(out, point) {
+    (0, fe_1.feMul)(_a, point.x, point.x); // aTerm = x^2
+    (0, fe_1.feMul)(_b, point.y, point.y); // bTerm = y^2
+    (0, fe_1.feMul)(_c, point.z, point.z);
+    (0, fe_1.feAdd)(_c, _c, _c); // cTerm = 2*z^2
+    (0, fe_1.feNeg)(_d, _a); // dTerm = -aTerm (a=-1 for ed25519)
+    (0, fe_1.feAdd)(_e, point.x, point.y);
+    (0, fe_1.feMul)(_e, _e, _e);
+    (0, fe_1.feAdd)(_f, _a, _b);
+    (0, fe_1.feSub)(_e, _e, _f); // eTerm = (x+y)^2 - aTerm - bTerm
+    (0, fe_1.feAdd)(_g, _d, _b); // gTerm = dTerm + bTerm
+    (0, fe_1.feSub)(_f, _g, _c); // fTerm = gTerm - cTerm
+    (0, fe_1.feSub)(_h, _d, _b); // hTerm = dTerm - bTerm
+    (0, fe_1.feMul)(out.x, _e, _f);
+    (0, fe_1.feMul)(out.y, _g, _h);
+    (0, fe_1.feMul)(out.z, _f, _g);
+    (0, fe_1.feMul)(out.t, _e, _h);
+}
+function negatePointInto(out, p) {
+    (0, fe_1.feNeg)(out.x, p.x);
+    (0, fe_1.feCopy)(out.y, p.y);
+    (0, fe_1.feCopy)(out.z, p.z);
+    (0, fe_1.feNeg)(out.t, p.t);
+}
+function clonePoint(p) {
+    const x = (0, fe_1.fe)();
+    const y = (0, fe_1.fe)();
+    const z = (0, fe_1.fe)();
+    const t = (0, fe_1.fe)();
+    (0, fe_1.feCopy)(x, p.x);
+    (0, fe_1.feCopy)(y, p.y);
+    (0, fe_1.feCopy)(z, p.z);
+    (0, fe_1.feCopy)(t, p.t);
+    return { x, y, z, t };
+}
+// Allocating versions for precomputation (runs once at module load)
 function addPoint(a, b) {
-    const y1MinusX1 = (0, mod_1.mod)(a.y - a.x);
-    const y2MinusX2 = (0, mod_1.mod)(b.y - b.x);
-    const y1PlusX1 = (0, mod_1.mod)(a.y + a.x);
-    const y2PlusX2 = (0, mod_1.mod)(b.y + b.x);
-    const aTerm = (0, mod_1.mod)(y1MinusX1 * y2MinusX2);
-    const bTerm = (0, mod_1.mod)(y1PlusX1 * y2PlusX2);
-    const cTerm = (0, mod_1.mod)(constants_1.TWO_D * a.t * b.t);
-    const dTerm = (0, mod_1.mod)(2n * a.z * b.z);
-    const eTerm = (0, mod_1.mod)(bTerm - aTerm);
-    const fTerm = (0, mod_1.mod)(dTerm - cTerm);
-    const gTerm = (0, mod_1.mod)(dTerm + cTerm);
-    const hTerm = (0, mod_1.mod)(bTerm + aTerm);
-    return {
-        x: (0, mod_1.mod)(eTerm * fTerm),
-        y: (0, mod_1.mod)(gTerm * hTerm),
-        z: (0, mod_1.mod)(fTerm * gTerm),
-        t: (0, mod_1.mod)(eTerm * hTerm)
-    };
+    addPointInto(_addOut, a, b);
+    return clonePoint(_addOut);
 }
-function doublePoint(point) {
-    const aTerm = (0, mod_1.mod)(point.x * point.x);
-    const bTerm = (0, mod_1.mod)(point.y * point.y);
-    const cTerm = (0, mod_1.mod)(2n * point.z * point.z);
-    const dTerm = (0, mod_1.mod)(-aTerm);
-    const eTerm = (0, mod_1.mod)((0, mod_1.mod)((point.x + point.y) * (point.x + point.y)) - aTerm - bTerm);
-    const gTerm = (0, mod_1.mod)(dTerm + bTerm);
-    const fTerm = (0, mod_1.mod)(gTerm - cTerm);
-    const hTerm = (0, mod_1.mod)(dTerm - bTerm);
-    return {
-        x: (0, mod_1.mod)(eTerm * fTerm),
-        y: (0, mod_1.mod)(gTerm * hTerm),
-        z: (0, mod_1.mod)(fTerm * gTerm),
-        t: (0, mod_1.mod)(eTerm * hTerm)
-    };
+function doublePoint(a) {
+    doublePointInto(_dblOut, a);
+    return clonePoint(_dblOut);
 }
+const W = 5;
+const halfW = 1 << W;
+const mask = halfW - 1;
+const precomp = new Array(1 << (W - 1));
+precomp[0] = constants_1.BASE_POINT;
+const _dbl = doublePoint(constants_1.BASE_POINT);
+for (let i = 1; i < precomp.length; i++) {
+    precomp[i] = addPoint(precomp[i - 1], _dbl);
+}
+// Pre-allocated scratch buffers for scalarMultBase (safe: JS is single-threaded)
+const _naf = new Int8Array(256);
+const _loopResult = mutablePoint();
+const _loopDbl = mutablePoint();
+const _loopAdd = mutablePoint();
 function scalarMultBase(scalar) {
     let k = (0, mod_1.modGroup)(scalar);
-    let result = constants_1.IDENTITY_POINT;
-    let addend = constants_1.BASE_POINT;
+    if (k === 0n)
+        return clonePoint(constants_1.IDENTITY_POINT);
+    const naf = _naf;
+    naf.fill(0);
+    let nafLen = 0;
     while (k > 0n) {
         if ((k & 1n) === 1n) {
-            result = addPoint(result, addend);
+            let digit = Number(k & BigInt(mask));
+            if (digit >= halfW >> 1)
+                digit -= halfW;
+            naf[nafLen++] = digit;
+            k -= BigInt(digit);
+        }
+        else {
+            nafLen++;
         }
-        addend = doublePoint(addend);
         k >>= 1n;
     }
-    return result;
+    // Copy identity into loop result
+    (0, fe_1.feCopy)(_loopResult.x, constants_1.IDENTITY_POINT.x);
+    (0, fe_1.feCopy)(_loopResult.y, constants_1.IDENTITY_POINT.y);
+    (0, fe_1.feCopy)(_loopResult.z, constants_1.IDENTITY_POINT.z);
+    (0, fe_1.feCopy)(_loopResult.t, constants_1.IDENTITY_POINT.t);
+    for (let i = nafLen - 1; i >= 0; i--) {
+        doublePointInto(_loopDbl, _loopResult);
+        // swap dbl → result
+        const tmpX = _loopResult.x;
+        _loopResult.x = _loopDbl.x;
+        _loopDbl.x = tmpX;
+        const tmpY = _loopResult.y;
+        _loopResult.y = _loopDbl.y;
+        _loopDbl.y = tmpY;
+        const tmpZ = _loopResult.z;
+        _loopResult.z = _loopDbl.z;
+        _loopDbl.z = tmpZ;
+        const tmpT = _loopResult.t;
+        _loopResult.t = _loopDbl.t;
+        _loopDbl.t = tmpT;
+        const digit = naf[i];
+        if (digit > 0) {
+            addPointInto(_loopAdd, _loopResult, precomp[(digit - 1) >> 1]);
+            const ax = _loopResult.x;
+            _loopResult.x = _loopAdd.x;
+            _loopAdd.x = ax;
+            const ay = _loopResult.y;
+            _loopResult.y = _loopAdd.y;
+            _loopAdd.y = ay;
+            const az = _loopResult.z;
+            _loopResult.z = _loopAdd.z;
+            _loopAdd.z = az;
+            const at = _loopResult.t;
+            _loopResult.t = _loopAdd.t;
+            _loopAdd.t = at;
+        }
+        else if (digit < 0) {
+            negatePointInto(_negOut, precomp[(-digit - 1) >> 1]);
+            addPointInto(_loopAdd, _loopResult, _negOut);
+            const ax = _loopResult.x;
+            _loopResult.x = _loopAdd.x;
+            _loopAdd.x = ax;
+            const ay = _loopResult.y;
+            _loopResult.y = _loopAdd.y;
+            _loopAdd.y = ay;
+            const az = _loopResult.z;
+            _loopResult.z = _loopAdd.z;
+            _loopAdd.z = az;
+            const at = _loopResult.t;
+            _loopResult.t = _loopAdd.t;
+            _loopAdd.t = at;
+        }
+    }
+    return clonePoint(_loopResult);
 }
 function encodeExtendedPoint(point) {
-    const zInv = (0, mod_1.modInv)(point.z);
-    const x = (0, mod_1.mod)(point.x * zInv);
-    const y = (0, mod_1.mod)(point.y * zInv);
-    const encoded = (0, le_1.bigIntToBytesLE)(y, 32);
-    encoded[31] = (encoded[31] & 0x7f) | Number((x & 1n) << 7n);
+    (0, fe_1.feInv)(_invZinv, point.z);
+    (0, fe_1.feMul)(_invX, point.x, _invZinv);
+    (0, fe_1.feMul)(_invY, point.y, _invZinv);
+    const encoded = new Uint8Array(32);
+    (0, fe_1.fePack)(encoded, _invY);
+    (0, fe_1.fePack)(_invXBytes, _invX);
+    encoded[31] = (encoded[31] & 0x7f) | ((_invXBytes[0] & 1) << 7);
     return encoded;
 }