zapo-js 0.1.1 → 0.2.0

package/dist/esm/client/tokens/tc-token.js

@@ -0,0 +1,18 @@
+export function computeBucket(unixTimeS, durationS) {
+    return Math.floor(unixTimeS / durationS);
+}
+export function tokenExpirationCutoffS(nowS, durationS, numBuckets) {
+    const currentBucket = computeBucket(nowS, durationS);
+    const cutoffBucket = currentBucket - numBuckets;
+    return cutoffBucket * durationS;
+}
+export function isTokenExpired(tokenTimestampS, nowS, durationS, numBuckets) {
+    const cutoff = tokenExpirationCutoffS(nowS, durationS, numBuckets);
+    return tokenTimestampS < cutoff;
+}
+export function shouldSendNewToken(senderTimestampS, nowS, senderDurationS) {
+    return computeBucket(senderTimestampS, senderDurationS) !== computeBucket(nowS, senderDurationS);
+}
+export function clampDuration(durationS, maxDurationS) {
+    return Math.min(durationS, maxDurationS);
+}

package/dist/esm/crypto/core/hkdf.js

@@ -1,22 +1,17 @@
 import { webcrypto } from 'node:crypto';
 import { EMPTY_BYTES, TEXT_ENCODER, toBytesView } from '../../util/bytes.js';
-/**
- * HKDF key derivation using SHA-256
- */
 export async function hkdf(ikm, salt, info, outLength) {
     const key = await webcrypto.subtle.importKey('raw', ikm, 'HKDF', false, ['deriveBits']);
+    const infoBytes = typeof info === 'string' ? (info === '' ? EMPTY_BYTES : TEXT_ENCODER.encode(info)) : info;
     const bits = await webcrypto.subtle.deriveBits({
         name: 'HKDF',
         hash: 'SHA-256',
         salt: salt ?? EMPTY_BYTES,
-        info: typeof info === 'string' ? TEXT_ENCODER.encode(info) : info
+        info: infoBytes
     }, key, outLength * 8);
     return toBytesView(bits);
 }
-/**
- * HKDF key derivation that outputs two 32-byte keys
- */
 export async function hkdfSplit(ikm, salt, info) {
     const out = await hkdf(ikm, salt, info, 64);
-    return [out.subarray(0, 32), out.subarray(32, 64)];
+    return [out.subarray(0, 32), out.subarray(32)];
 }

package/dist/esm/crypto/core/index.js

@@ -3,9 +3,8 @@
  */
 export { Ed25519 } from '../curves/Ed25519.js';
 export { X25519 } from '../curves/X25519.js';
-export { decodeBase64Url, assert32 } from '../core/encoding.js';
 export { hkdf, hkdfSplit } from '../core/hkdf.js';
 export { toSerializedPubKey, toRawPubKey, prependVersion, readVersionedContent } from '../core/keys.js';
 export { buildNonce } from '../core/nonce.js';
-export { randomBytesAsync, randomIntAsync } from '../core/random.js';
-export { sha1, sha256, sha512, importAesGcmKey, aesGcmEncrypt, aesGcmDecrypt, importAesCbcKey, aesCbcEncrypt, aesCbcDecrypt, importHmacKey, importHmacSha512Key, hmacSign, pbkdf2DeriveAesCtrKey, aesCtrEncrypt, aesCtrDecrypt, ed25519VerifyRaw } from '../core/primitives.js';
+export { randomBytesAsync, randomFillAsync, randomIntAsync } from '../core/random.js';
+export { sha1, sha256, sha512, importAesGcmKey, aesGcmEncrypt, aesGcmDecrypt, importAesCbcKey, aesCbcEncrypt, aesCbcDecrypt, importHmacKey, importHmacSha512Key, hmacSign, pbkdf2DeriveAesCtrKey, aesCtrEncrypt, aesCtrDecrypt } from '../core/primitives.js';

package/dist/esm/crypto/core/keys.js

@@ -1,4 +1,5 @@
-import { SERIALIZED_PUB_KEY_PREFIX } from '../core/constants.js';
+import { assertByteLength } from '../../util/bytes.js';
+const SERIALIZED_PUB_KEY_PREFIX = 5;
 /**
  * Converts a 32-byte raw public key to 33-byte serialized format (with 0x05 prefix)
  */
@@ -9,9 +10,7 @@ export function toSerializedPubKey(key) {
         }
         return key;
     }
-    if (key.length !== 32) {
-        throw new Error(`invalid signal public key length ${key.length}`);
-    }
+    assertByteLength(key, 32, `invalid signal public key length ${key.length}`);
     const out = new Uint8Array(33);
     out[0] = SERIALIZED_PUB_KEY_PREFIX;
     out.set(key, 1);

package/dist/esm/crypto/core/nonce.js

@@ -1,5 +1,7 @@
 /**
  * Builds a 12-byte nonce for AES-GCM encryption with counter in the last 4 bytes.
+ * Allocates a new buffer per call because concurrent Noise encrypt/decrypt operations
+ * may hold references to different nonces simultaneously.
  * Throws if counter exceeds uint32 range to prevent nonce reuse.
  */
 export function buildNonce(counter) {

package/dist/esm/crypto/core/primitives.js

@@ -3,17 +3,20 @@
  */
 import { createHash, webcrypto } from 'node:crypto';
 import { EMPTY_BYTES, toBytesView } from '../../util/bytes.js';
+async function digestBytes(algorithm, value) {
+    return toBytesView(await webcrypto.subtle.digest(algorithm, value));
+}
 // ============================================
 // Hash functions
 // ============================================
 export async function sha256(value) {
-    return toBytesView(await webcrypto.subtle.digest('SHA-256', value));
+    return digestBytes('SHA-256', value);
 }
 export async function sha1(value) {
-    return toBytesView(await webcrypto.subtle.digest('SHA-1', value));
+    return digestBytes('SHA-1', value);
 }
 export async function sha512(value) {
-    return toBytesView(await webcrypto.subtle.digest('SHA-512', value));
+    return digestBytes('SHA-512', value);
 }
 export function md5Bytes(input) {
     return toBytesView(createHash('md5').update(input).digest());
@@ -25,12 +28,10 @@ export async function importAesGcmKey(raw, usages) {
     return webcrypto.subtle.importKey('raw', raw, 'AES-GCM', false, usages);
 }
 export async function aesGcmEncrypt(key, nonce, plaintext, aad = EMPTY_BYTES) {
-    const result = await webcrypto.subtle.encrypt({ name: 'AES-GCM', iv: nonce, additionalData: aad }, key, plaintext);
-    return toBytesView(result);
+    return toBytesView(await webcrypto.subtle.encrypt({ name: 'AES-GCM', iv: nonce, additionalData: aad }, key, plaintext));
 }
 export async function aesGcmDecrypt(key, nonce, ciphertext, aad = EMPTY_BYTES) {
-    const result = await webcrypto.subtle.decrypt({ name: 'AES-GCM', iv: nonce, additionalData: aad }, key, ciphertext);
-    return toBytesView(result);
+    return toBytesView(await webcrypto.subtle.decrypt({ name: 'AES-GCM', iv: nonce, additionalData: aad }, key, ciphertext));
 }
 // ============================================
 // AES-CBC (for Signal protocol)
@@ -42,12 +43,10 @@ export async function importAesCbcKey(keyBytes) {
     ]);
 }
 export async function aesCbcEncrypt(key, iv, plaintext) {
-    const result = await webcrypto.subtle.encrypt({ name: 'AES-CBC', iv }, key, plaintext);
-    return toBytesView(result);
+    return toBytesView(await webcrypto.subtle.encrypt({ name: 'AES-CBC', iv }, key, plaintext));
 }
 export async function aesCbcDecrypt(key, iv, ciphertext) {
-    const result = await webcrypto.subtle.decrypt({ name: 'AES-CBC', iv }, key, ciphertext);
-    return toBytesView(result);
+    return toBytesView(await webcrypto.subtle.decrypt({ name: 'AES-CBC', iv }, key, ciphertext));
 }
 // ============================================
 // HMAC-SHA256 (for Signal protocol)
@@ -86,17 +85,8 @@ export async function pbkdf2DeriveAesCtrKey(password, salt, iterations) {
 // AES-CTR (for pairing code crypto)
 // ============================================
 export async function aesCtrEncrypt(key, counter, plaintext) {
-    const result = await webcrypto.subtle.encrypt({ name: 'AES-CTR', counter, length: 64 }, key, plaintext);
-    return toBytesView(result);
+    return toBytesView(await webcrypto.subtle.encrypt({ name: 'AES-CTR', counter, length: 64 }, key, plaintext));
 }
 export async function aesCtrDecrypt(key, counter, ciphertext) {
-    const result = await webcrypto.subtle.decrypt({ name: 'AES-CTR', counter, length: 64 }, key, ciphertext);
-    return toBytesView(result);
-}
-// ============================================
-// Ed25519 raw verify (for Signal variant sigs)
-// ============================================
-export async function ed25519VerifyRaw(publicKey, signature, message) {
-    const cryptoKey = await webcrypto.subtle.importKey('raw', publicKey, { name: 'Ed25519' }, false, ['verify']);
-    return webcrypto.subtle.verify('Ed25519', cryptoKey, signature, message);
+    return toBytesView(await webcrypto.subtle.decrypt({ name: 'AES-CTR', counter, length: 64 }, key, ciphertext));
 }

package/dist/esm/crypto/core/random.js

@@ -1,28 +1,30 @@
-import { randomBytes, randomInt } from 'node:crypto';
+import { randomBytes, randomFill, randomInt } from 'node:crypto';
+import { promisify } from 'node:util';
 import { toBytesView } from '../../util/bytes.js';
-/**
- * Generates cryptographically secure random bytes
- */
-export function randomBytesAsync(size) {
-    return new Promise((resolve, reject) => {
-        randomBytes(size, (error, buffer) => {
-            if (error)
-                reject(error);
-            else
-                resolve(toBytesView(buffer));
-        });
-    });
+const randomBytesAsyncImpl = promisify(randomBytes);
+const randomIntAsyncImpl = promisify(randomInt);
+export async function randomBytesAsync(size) {
+    return toBytesView(await randomBytesAsyncImpl(size));
 }
-/**
- * Generates a cryptographically secure random integer in the range [min, max)
- */
-export function randomIntAsync(min, max) {
-    return new Promise((resolve, reject) => {
-        randomInt(min, max, (error, value) => {
-            if (error)
+export async function randomFillAsync(target, offset, size) {
+    await new Promise((resolve, reject) => {
+        const onDone = (error) => {
+            if (error) {
                 reject(error);
-            else
-                resolve(value);
-        });
+                return;
+            }
+            resolve();
+        };
+        if (offset === undefined) {
+            randomFill(target, onDone);
+            return;
+        }
+        if (size === undefined) {
+            randomFill(target, offset, onDone);
+            return;
+        }
+        randomFill(target, offset, size, onDone);
     });
+    return target;
 }
+export const randomIntAsync = randomIntAsyncImpl;

package/dist/esm/crypto/curves/Ed25519.js

@@ -1,8 +1,7 @@
 import { webcrypto } from 'node:crypto';
-import { assert32, decodeBase64Url } from '../core/encoding.js';
 import { ED25519_PKCS8_PREFIX } from '../curves/constants.js';
 import { pkcs8FromRawPrivate } from '../curves/types.js';
-import { toBytesView } from '../../util/bytes.js';
+import { assertByteLength, decodeBase64Url, toBytesView } from '../../util/bytes.js';
 export class Ed25519 {
     static async generateKeyPair() {
         const keys = (await webcrypto.subtle.generateKey({ name: 'Ed25519' }, true, [
@@ -16,7 +15,7 @@ export class Ed25519 {
         };
     }
     static async keyPairFromPrivateKey(privKey) {
-        assert32(privKey, 'ed25519 private key');
+        assertByteLength(privKey, 32, 'ed25519 private key must be 32 bytes');
         const privateKey = await webcrypto.subtle.importKey('pkcs8', pkcs8FromRawPrivate(ED25519_PKCS8_PREFIX, privKey), { name: 'Ed25519' }, true, ['sign']);
         const privateJwk = await webcrypto.subtle.exportKey('jwk', privateKey);
         return {
@@ -25,13 +24,13 @@ export class Ed25519 {
         };
     }
     static async sign(message, privKey) {
-        assert32(privKey, 'ed25519 private key');
+        assertByteLength(privKey, 32, 'ed25519 private key must be 32 bytes');
         const privateKey = await webcrypto.subtle.importKey('pkcs8', pkcs8FromRawPrivate(ED25519_PKCS8_PREFIX, privKey), { name: 'Ed25519' }, false, ['sign']);
         const signature = await webcrypto.subtle.sign('Ed25519', privateKey, message);
         return toBytesView(signature);
     }
     static async verify(message, signature, pubKey) {
-        assert32(pubKey, 'ed25519 public key');
+        assertByteLength(pubKey, 32, 'ed25519 public key must be 32 bytes');
         const publicKey = await webcrypto.subtle.importKey('raw', pubKey, { name: 'Ed25519' }, false, ['verify']);
         return webcrypto.subtle.verify('Ed25519', publicKey, signature, message);
     }

package/dist/esm/crypto/curves/X25519.js

@@ -1,29 +1,43 @@
 import { webcrypto } from 'node:crypto';
-import { assert32, decodeBase64Url } from '../core/encoding.js';
 import { X25519_PKCS8_PREFIX } from '../curves/constants.js';
 import { pkcs8FromRawPrivate } from '../curves/types.js';
-import { bigIntToBytesLE, bytesToBigIntLE } from '../math/le.js';
-import { FIELD_P, mod, modInv } from '../math/mod.js';
-import { toBytesView } from '../../util/bytes.js';
+import { FE_ONE } from '../math/constants.js';
+import { fe, feAdd, feFromBytes, feInv, feMul, fePack, feSub } from '../math/fe.js';
+import { assertByteLength, decodeBase64Url, toBytesView } from '../../util/bytes.js';
+// Pre-allocated temps for montgomeryToEdwardsPublic (safe: single-threaded)
+const _mx = fe();
+const _m1 = fe();
+const _m2 = fe();
+const _m3 = fe();
+// p-1 = 2^255-20 in LE bytes: 0xEC, 0xFF×30, 0x7F
+// Mask bit 255 before comparing (non-canonical inputs may have it set)
+function isFieldPMinus1(b) {
+    if (b[0] !== 0xec || (b[31] & 0x7f) !== 0x7f)
+        return false;
+    for (let i = 1; i < 31; i++)
+        if (b[i] !== 0xff)
+            return false;
+    return true;
+}
 export function clampCurvePrivateKeyInPlace(privateKey) {
-    if (privateKey.length !== 32) {
-        throw new Error(`invalid curve25519 private key length ${privateKey.length}`);
-    }
+    assertByteLength(privateKey, 32, `invalid curve25519 private key length ${privateKey.length}`);
     privateKey[0] &= 248;
     privateKey[31] &= 127;
     privateKey[31] |= 64;
     return privateKey;
 }
 export function montgomeryToEdwardsPublic(curvePublicKey, signBit) {
-    if (curvePublicKey.length !== 32) {
-        throw new Error(`invalid curve25519 public key length ${curvePublicKey.length}`);
-    }
-    const x = bytesToBigIntLE(curvePublicKey);
-    if (x === FIELD_P - 1n) {
+    assertByteLength(curvePublicKey, 32, `invalid curve25519 public key length ${curvePublicKey.length}`);
+    if (isFieldPMinus1(curvePublicKey)) {
         throw new Error('invalid curve25519 low-order public key');
     }
-    const y = mod((x - 1n) * modInv(x + 1n));
-    const encoded = bigIntToBytesLE(y, 32);
+    feFromBytes(_mx, curvePublicKey);
+    feSub(_m1, _mx, FE_ONE);
+    feAdd(_m2, _mx, FE_ONE);
+    feInv(_m3, _m2);
+    feMul(_m1, _m1, _m3);
+    const encoded = new Uint8Array(32);
+    fePack(encoded, _m1);
     encoded[31] = (encoded[31] & 0x7f) | (signBit & 0x80);
     return encoded;
 }
@@ -39,7 +53,7 @@ export class X25519 {
         };
     }
     static async keyPairFromPrivateKey(privKey) {
-        assert32(privKey, 'x25519 private key');
+        assertByteLength(privKey, 32, 'x25519 private key must be 32 bytes');
         const privateKey = await webcrypto.subtle.importKey('pkcs8', pkcs8FromRawPrivate(X25519_PKCS8_PREFIX, privKey), { name: 'X25519' }, true, ['deriveBits']);
         const privateJwk = await webcrypto.subtle.exportKey('jwk', privateKey);
         return {
@@ -48,10 +62,12 @@ export class X25519 {
         };
     }
     static async scalarMult(privKey, pubKey) {
-        assert32(privKey, 'x25519 private key');
-        assert32(pubKey, 'x25519 public key');
-        const privateKey = await webcrypto.subtle.importKey('pkcs8', pkcs8FromRawPrivate(X25519_PKCS8_PREFIX, privKey), { name: 'X25519' }, false, ['deriveBits']);
-        const publicKey = await webcrypto.subtle.importKey('raw', pubKey, { name: 'X25519' }, false, []);
+        assertByteLength(privKey, 32, 'x25519 private key must be 32 bytes');
+        assertByteLength(pubKey, 32, 'x25519 public key must be 32 bytes');
+        const [privateKey, publicKey] = await Promise.all([
+            webcrypto.subtle.importKey('pkcs8', pkcs8FromRawPrivate(X25519_PKCS8_PREFIX, privKey), { name: 'X25519' }, false, ['deriveBits']),
+            webcrypto.subtle.importKey('raw', pubKey, { name: 'X25519' }, false, [])
+        ]);
         const sharedBits = await webcrypto.subtle.deriveBits({ name: 'X25519', public: publicKey }, privateKey, 256);
         return toBytesView(sharedBits);
     }

package/dist/esm/crypto/index.js

@@ -1,3 +1,2 @@
 export * from './core/index.js';
-export { Ed25519 } from './curves/Ed25519.js';
 export { X25519 } from './curves/X25519.js';

package/dist/esm/crypto/math/constants.js

@@ -1,41 +1,18 @@
+import { fe, feFromBigInt } from '../math/fe.js';
 export const FIELD_P = (1n << 255n) - 19n;
 export const GROUP_L = (1n << 252n) + 27742317777372353535851937790883648493n;
-function modField(value) {
-    const remainder = value % FIELD_P;
-    return remainder >= 0n ? remainder : remainder + FIELD_P;
-}
-function modPowField(base, exponent) {
-    let result = 1n;
-    let current = modField(base);
-    let power = exponent;
-    while (power > 0n) {
-        if ((power & 1n) === 1n) {
-            result = modField(result * current);
-        }
-        current = modField(current * current);
-        power >>= 1n;
-    }
-    return result;
-}
-function modInvField(value) {
-    if (value === 0n) {
-        throw new Error('field inversion by zero');
-    }
-    return modPowField(value, FIELD_P - 2n);
-}
-const BASE_X = 15112221349535400772501151409588531511454012693041857206046113283949847762202n;
-const BASE_Y = 46316835694926478169428394003475163141307993866256225615783033603165251855960n;
-export const EDWARDS_D = modField(-121665n * modInvField(121666n));
-export const TWO_D = modField(2n * EDWARDS_D);
+export const FE_TWO_D = feFromBigInt(16295367250680780974490674513165176452449235426866156013048779062215315747161n);
+export const FE_ZERO = fe();
+export const FE_ONE = feFromBigInt(1n);
 export const BASE_POINT = Object.freeze({
-    x: BASE_X,
-    y: BASE_Y,
-    z: 1n,
-    t: modField(BASE_X * BASE_Y)
+    x: feFromBigInt(15112221349535400772501151409588531511454012693041857206046113283949847762202n),
+    y: feFromBigInt(46316835694926478169428394003475163141307993866256225615783033603165251855960n),
+    z: feFromBigInt(1n),
+    t: feFromBigInt(46827403850823179245072216630277197565144205554125654976674165829533817101731n)
 });
 export const IDENTITY_POINT = Object.freeze({
-    x: 0n,
-    y: 1n,
-    z: 1n,
-    t: 0n
+    x: feFromBigInt(0n),
+    y: feFromBigInt(1n),
+    z: feFromBigInt(1n),
+    t: feFromBigInt(0n)
 });

package/dist/esm/crypto/math/edwards.js

@@ -1,60 +1,187 @@
-import { BASE_POINT, IDENTITY_POINT, TWO_D } from '../math/constants.js';
-import { bigIntToBytesLE } from '../math/le.js';
-import { mod, modGroup, modInv } from '../math/mod.js';
+import { BASE_POINT, FE_TWO_D, IDENTITY_POINT } from '../math/constants.js';
+import { fe, feAdd, feCopy, feInv, feMul, feNeg, fePack, feSub } from '../math/fe.js';
+import { modGroup } from '../math/mod.js';
+// Pre-allocated temporaries for point operations (safe: JS is single-threaded)
+const _a = fe();
+const _b = fe();
+const _c = fe();
+const _d = fe();
+const _e = fe();
+const _f = fe();
+const _g = fe();
+const _h = fe();
+// Pre-allocated output points for hot-path operations
+function mutablePoint() {
+    return { x: fe(), y: fe(), z: fe(), t: fe() };
+}
+const _addOut = mutablePoint();
+const _dblOut = mutablePoint();
+const _negOut = mutablePoint();
+// Temporaries for feInv inside encodeExtendedPoint
+const _invZinv = fe();
+const _invX = fe();
+const _invY = fe();
+const _invXBytes = new Uint8Array(32);
+function addPointInto(out, a, b) {
+    feSub(_a, a.y, a.x);
+    feSub(_b, b.y, b.x);
+    feMul(_a, _a, _b); // aTerm
+    feAdd(_b, a.y, a.x);
+    feAdd(_c, b.y, b.x);
+    feMul(_b, _b, _c); // bTerm
+    feMul(_c, FE_TWO_D, a.t);
+    feMul(_c, _c, b.t); // cTerm
+    feAdd(_d, a.z, a.z);
+    feMul(_d, _d, b.z); // dTerm
+    feSub(_e, _b, _a); // eTerm
+    feSub(_f, _d, _c); // fTerm
+    feAdd(_g, _d, _c); // gTerm
+    feAdd(_h, _b, _a); // hTerm
+    feMul(out.x, _e, _f);
+    feMul(out.y, _g, _h);
+    feMul(out.z, _f, _g);
+    feMul(out.t, _e, _h);
+}
+function doublePointInto(out, point) {
+    feMul(_a, point.x, point.x); // aTerm = x^2
+    feMul(_b, point.y, point.y); // bTerm = y^2
+    feMul(_c, point.z, point.z);
+    feAdd(_c, _c, _c); // cTerm = 2*z^2
+    feNeg(_d, _a); // dTerm = -aTerm (a=-1 for ed25519)
+    feAdd(_e, point.x, point.y);
+    feMul(_e, _e, _e);
+    feAdd(_f, _a, _b);
+    feSub(_e, _e, _f); // eTerm = (x+y)^2 - aTerm - bTerm
+    feAdd(_g, _d, _b); // gTerm = dTerm + bTerm
+    feSub(_f, _g, _c); // fTerm = gTerm - cTerm
+    feSub(_h, _d, _b); // hTerm = dTerm - bTerm
+    feMul(out.x, _e, _f);
+    feMul(out.y, _g, _h);
+    feMul(out.z, _f, _g);
+    feMul(out.t, _e, _h);
+}
+function negatePointInto(out, p) {
+    feNeg(out.x, p.x);
+    feCopy(out.y, p.y);
+    feCopy(out.z, p.z);
+    feNeg(out.t, p.t);
+}
+function clonePoint(p) {
+    const x = fe();
+    const y = fe();
+    const z = fe();
+    const t = fe();
+    feCopy(x, p.x);
+    feCopy(y, p.y);
+    feCopy(z, p.z);
+    feCopy(t, p.t);
+    return { x, y, z, t };
+}
+// Allocating versions for precomputation (runs once at module load)
 function addPoint(a, b) {
-    const y1MinusX1 = mod(a.y - a.x);
-    const y2MinusX2 = mod(b.y - b.x);
-    const y1PlusX1 = mod(a.y + a.x);
-    const y2PlusX2 = mod(b.y + b.x);
-    const aTerm = mod(y1MinusX1 * y2MinusX2);
-    const bTerm = mod(y1PlusX1 * y2PlusX2);
-    const cTerm = mod(TWO_D * a.t * b.t);
-    const dTerm = mod(2n * a.z * b.z);
-    const eTerm = mod(bTerm - aTerm);
-    const fTerm = mod(dTerm - cTerm);
-    const gTerm = mod(dTerm + cTerm);
-    const hTerm = mod(bTerm + aTerm);
-    return {
-        x: mod(eTerm * fTerm),
-        y: mod(gTerm * hTerm),
-        z: mod(fTerm * gTerm),
-        t: mod(eTerm * hTerm)
-    };
-}
-function doublePoint(point) {
-    const aTerm = mod(point.x * point.x);
-    const bTerm = mod(point.y * point.y);
-    const cTerm = mod(2n * point.z * point.z);
-    const dTerm = mod(-aTerm);
-    const eTerm = mod(mod((point.x + point.y) * (point.x + point.y)) - aTerm - bTerm);
-    const gTerm = mod(dTerm + bTerm);
-    const fTerm = mod(gTerm - cTerm);
-    const hTerm = mod(dTerm - bTerm);
-    return {
-        x: mod(eTerm * fTerm),
-        y: mod(gTerm * hTerm),
-        z: mod(fTerm * gTerm),
-        t: mod(eTerm * hTerm)
-    };
+    addPointInto(_addOut, a, b);
+    return clonePoint(_addOut);
+}
+function doublePoint(a) {
+    doublePointInto(_dblOut, a);
+    return clonePoint(_dblOut);
 }
+const W = 5;
+const halfW = 1 << W;
+const mask = halfW - 1;
+const precomp = new Array(1 << (W - 1));
+precomp[0] = BASE_POINT;
+const _dbl = doublePoint(BASE_POINT);
+for (let i = 1; i < precomp.length; i++) {
+    precomp[i] = addPoint(precomp[i - 1], _dbl);
+}
+// Pre-allocated scratch buffers for scalarMultBase (safe: JS is single-threaded)
+const _naf = new Int8Array(256);
+const _loopResult = mutablePoint();
+const _loopDbl = mutablePoint();
+const _loopAdd = mutablePoint();
 export function scalarMultBase(scalar) {
     let k = modGroup(scalar);
-    let result = IDENTITY_POINT;
-    let addend = BASE_POINT;
+    if (k === 0n)
+        return clonePoint(IDENTITY_POINT);
+    const naf = _naf;
+    naf.fill(0);
+    let nafLen = 0;
     while (k > 0n) {
         if ((k & 1n) === 1n) {
-            result = addPoint(result, addend);
+            let digit = Number(k & BigInt(mask));
+            if (digit >= halfW >> 1)
+                digit -= halfW;
+            naf[nafLen++] = digit;
+            k -= BigInt(digit);
+        }
+        else {
+            nafLen++;
         }
-        addend = doublePoint(addend);
         k >>= 1n;
     }
-    return result;
+    // Copy identity into loop result
+    feCopy(_loopResult.x, IDENTITY_POINT.x);
+    feCopy(_loopResult.y, IDENTITY_POINT.y);
+    feCopy(_loopResult.z, IDENTITY_POINT.z);
+    feCopy(_loopResult.t, IDENTITY_POINT.t);
+    for (let i = nafLen - 1; i >= 0; i--) {
+        doublePointInto(_loopDbl, _loopResult);
+        // swap dbl → result
+        const tmpX = _loopResult.x;
+        _loopResult.x = _loopDbl.x;
+        _loopDbl.x = tmpX;
+        const tmpY = _loopResult.y;
+        _loopResult.y = _loopDbl.y;
+        _loopDbl.y = tmpY;
+        const tmpZ = _loopResult.z;
+        _loopResult.z = _loopDbl.z;
+        _loopDbl.z = tmpZ;
+        const tmpT = _loopResult.t;
+        _loopResult.t = _loopDbl.t;
+        _loopDbl.t = tmpT;
+        const digit = naf[i];
+        if (digit > 0) {
+            addPointInto(_loopAdd, _loopResult, precomp[(digit - 1) >> 1]);
+            const ax = _loopResult.x;
+            _loopResult.x = _loopAdd.x;
+            _loopAdd.x = ax;
+            const ay = _loopResult.y;
+            _loopResult.y = _loopAdd.y;
+            _loopAdd.y = ay;
+            const az = _loopResult.z;
+            _loopResult.z = _loopAdd.z;
+            _loopAdd.z = az;
+            const at = _loopResult.t;
+            _loopResult.t = _loopAdd.t;
+            _loopAdd.t = at;
+        }
+        else if (digit < 0) {
+            negatePointInto(_negOut, precomp[(-digit - 1) >> 1]);
+            addPointInto(_loopAdd, _loopResult, _negOut);
+            const ax = _loopResult.x;
+            _loopResult.x = _loopAdd.x;
+            _loopAdd.x = ax;
+            const ay = _loopResult.y;
+            _loopResult.y = _loopAdd.y;
+            _loopAdd.y = ay;
+            const az = _loopResult.z;
+            _loopResult.z = _loopAdd.z;
+            _loopAdd.z = az;
+            const at = _loopResult.t;
+            _loopResult.t = _loopAdd.t;
+            _loopAdd.t = at;
+        }
+    }
+    return clonePoint(_loopResult);
 }
 export function encodeExtendedPoint(point) {
-    const zInv = modInv(point.z);
-    const x = mod(point.x * zInv);
-    const y = mod(point.y * zInv);
-    const encoded = bigIntToBytesLE(y, 32);
-    encoded[31] = (encoded[31] & 0x7f) | Number((x & 1n) << 7n);
+    feInv(_invZinv, point.z);
+    feMul(_invX, point.x, _invZinv);
+    feMul(_invY, point.y, _invZinv);
+    const encoded = new Uint8Array(32);
+    fePack(encoded, _invY);
+    fePack(_invXBytes, _invX);
+    encoded[31] = (encoded[31] & 0x7f) | ((_invXBytes[0] & 1) << 7);
     return encoded;
 }