zapo-js 0.1.2 → 0.2.0

package/dist/client/messaging/fanout.js

@@ -1,24 +1,23 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createDeviceFanoutResolver = createDeviceFanoutResolver;
+const PromiseDedup_1 = require("../../infra/perf/PromiseDedup");
 const jid_1 = require("../../protocol/jid");
 const primitives_1 = require("../../util/primitives");
 function createDeviceFanoutResolver(options) {
     const { signalDeviceSync, getCurrentMeJid, getCurrentMeLid, logger } = options;
-    const requireCurrentMeJid = (context) => {
-        const meJid = getCurrentMeJid();
-        if (meJid) {
-            return meJid;
-        }
-        throw new Error(`${context} requires registered meJid`);
-    };
+    const dedup = new PromiseDedup_1.PromiseDedup();
     const resolveDirectFanoutDeviceJids = async (recipientJid, selfDeviceJidForRecipient) => {
         const recipientUserJid = (0, jid_1.toUserJid)(recipientJid);
         const meUserJid = (0, jid_1.toUserJid)(selfDeviceJidForRecipient);
         const targets = recipientUserJid === meUserJid ? [recipientUserJid] : [recipientUserJid, meUserJid];
         try {
             const synced = await signalDeviceSync.syncDeviceList(targets);
-            const byUser = new Map(synced.map((entry) => [(0, jid_1.toUserJid)(entry.jid), entry.deviceJids]));
+            const byUser = new Map();
+            for (let index = 0; index < synced.length; index += 1) {
+                const entry = synced[index];
+                byUser.set((0, jid_1.toUserJid)(entry.jid), entry.deviceJids);
+            }
             const fanout = new Set();
             const recipientDevices = byUser.get(recipientUserJid) ?? [];
             if (recipientDevices.length === 0) {
@@ -48,7 +47,7 @@ function createDeviceFanoutResolver(options) {
             return [recipientUserJid];
         }
     };
-    const resolveGroupParticipantDeviceJids = async (participantUserJids) => {
+    const resolveGroupParticipantDeviceJidsInternal = async (participantUserJids) => {
         const meDeviceJids = new Set();
         const meJid = getCurrentMeJid();
         if (meJid) {
@@ -74,7 +73,11 @@ function createDeviceFanoutResolver(options) {
                 });
             }
         }
-        const candidateUsers = [...new Set(participantUserJids)];
+        const candidateUserSet = new Set();
+        for (let index = 0; index < participantUserJids.length; index += 1) {
+            candidateUserSet.add(participantUserJids[index]);
+        }
+        const candidateUsers = Array.from(candidateUserSet);
         if (candidateUsers.length === 0) {
             return [];
         }
@@ -92,6 +95,9 @@ function createDeviceFanoutResolver(options) {
                 }
                 for (const deviceJid of entry.deviceJids) {
                     const normalizedDeviceJid = (0, jid_1.normalizeDeviceJid)(deviceJid);
+                    if ((0, jid_1.isHostedDeviceJid)(normalizedDeviceJid)) {
+                        continue;
+                    }
                     if (meDeviceJids.has(normalizedDeviceJid)) {
                         continue;
                     }
@@ -125,7 +131,10 @@ function createDeviceFanoutResolver(options) {
         }
     };
     const resolveOwnPeerDeviceJids = async () => {
-        const meJid = requireCurrentMeJid('resolveOwnPeerDeviceJids');
+        const meJid = getCurrentMeJid();
+        if (!meJid) {
+            throw new Error('resolveOwnPeerDeviceJids requires registered meJid');
+        }
         const meUserJid = (0, jid_1.toUserJid)(meJid);
         const meDevices = new Set();
         meDevices.add((0, jid_1.normalizeDeviceJid)(meJid));
@@ -180,6 +189,7 @@ function createDeviceFanoutResolver(options) {
         }
         return meLid;
     };
+    const resolveGroupParticipantDeviceJids = (participantUserJids) => dedup.run(`group:${participantUserJids.join(',')}`, () => resolveGroupParticipantDeviceJidsInternal(participantUserJids));
     return {
         resolveDirectFanoutDeviceJids,
         resolveGroupParticipantDeviceJids,

package/dist/client/messaging/participants.js

@@ -1,10 +1,12 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createGroupParticipantsCache = createGroupParticipantsCache;
+const PromiseDedup_1 = require("../../infra/perf/PromiseDedup");
 const jid_1 = require("../../protocol/jid");
 const primitives_1 = require("../../util/primitives");
 function createGroupParticipantsCache(options) {
     const { participantsStore, queryGroupParticipantJids, logger } = options;
+    const dedup = new PromiseDedup_1.PromiseDedup();
     const sanitizeParticipantUsers = (participants) => {
         const deduped = new Set();
         for (const participant of participants) {
@@ -120,7 +122,7 @@ function createGroupParticipantsCache(options) {
         }
         return sanitizeParticipantUsers(candidates);
     };
-    const refreshParticipantUsers = async (groupJid) => {
+    const refreshParticipantUsers = (groupJid) => dedup.run(`refresh:${groupJid}`, async () => {
         const queried = await queryGroupParticipantJids(groupJid);
         const participants = sanitizeParticipantUsers(queried);
         await participantsStore.upsertGroupParticipants({
@@ -129,14 +131,14 @@ function createGroupParticipantsCache(options) {
             updatedAtMs: Date.now()
         });
         return participants;
-    };
-    const resolveParticipantUsers = async (groupJid) => {
+    });
+    const resolveParticipantUsers = (groupJid) => dedup.run(`resolve:${groupJid}`, async () => {
         const cached = await participantsStore.getGroupParticipants(groupJid);
         if (cached && cached.participants.length > 0) {
             return sanitizeParticipantUsers(cached.participants);
         }
         return refreshParticipantUsers(groupJid);
-    };
+    });
     const mutateFromGroupEvent = async (event) => {
         const groupJid = resolveGroupJidForParticipantCacheEvent(event);
         if (!groupJid) {

package/dist/client/persistence/WriteBehindPersistence.js

@@ -0,0 +1,129 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WriteBehindPersistence = void 0;
+const BackgroundQueue_1 = require("../../infra/perf/BackgroundQueue");
+const primitives_1 = require("../../util/primitives");
+function mergeThread(previous, incoming) {
+    return {
+        jid: incoming.jid,
+        name: incoming.name ?? previous.name,
+        unreadCount: incoming.unreadCount ?? previous.unreadCount,
+        archived: incoming.archived ?? previous.archived,
+        pinned: incoming.pinned ?? previous.pinned,
+        muteEndMs: incoming.muteEndMs ?? previous.muteEndMs,
+        markedAsUnread: incoming.markedAsUnread ?? previous.markedAsUnread,
+        ephemeralExpiration: incoming.ephemeralExpiration ?? previous.ephemeralExpiration
+    };
+}
+function mergeContact(previous, incoming) {
+    return {
+        jid: incoming.jid,
+        displayName: incoming.displayName ?? previous.displayName,
+        pushName: incoming.pushName ?? previous.pushName,
+        lid: incoming.lid ?? previous.lid,
+        phoneNumber: incoming.phoneNumber ?? previous.phoneNumber,
+        lastUpdatedMs: Math.max(previous.lastUpdatedMs, incoming.lastUpdatedMs)
+    };
+}
+class WriteBehindPersistence {
+    constructor(stores, logger, options = {}) {
+        this.logger = logger;
+        this.flushTimeoutMs = options.flushTimeoutMs ?? 5000;
+        const queueOptions = (domain) => ({
+            maxPendingKeys: options.maxPendingKeys ?? 4096,
+            maxWriteConcurrency: options.maxWriteConcurrency ?? 4,
+            flushTimeoutMs: this.flushTimeoutMs,
+            onError: (key, error, attempt) => {
+                this.logger.warn('write-behind error', {
+                    domain,
+                    key,
+                    attempt,
+                    message: (0, primitives_1.toError)(error).message
+                });
+            },
+            onPressure: (pendingKeys) => {
+                this.logger.warn('write-behind pressure', {
+                    domain,
+                    pendingKeys
+                });
+            },
+            onDiscard: (key) => {
+                this.logger.warn('write-behind discarded pending write', {
+                    domain,
+                    key
+                });
+            }
+        });
+        this.queues = {
+            messages: new BackgroundQueue_1.BackgroundQueue((_key, value) => stores.messageStore.upsert(value), queueOptions('messages')),
+            threads: new BackgroundQueue_1.BackgroundQueue((_key, value) => stores.threadStore.upsert(value), {
+                ...queueOptions('threads'),
+                coalesce: (previous, incoming) => mergeThread(previous, incoming)
+            }),
+            contacts: new BackgroundQueue_1.BackgroundQueue((_key, value) => stores.contactStore.upsert(value), {
+                ...queueOptions('contacts'),
+                coalesce: (previous, incoming) => mergeContact(previous, incoming)
+            })
+        };
+    }
+    persistMessage(record) {
+        this.queues.messages.enqueue(`msg:${record.id}`, record);
+    }
+    persistMessageAsync(record) {
+        return this.queues.messages.enqueueAsync(`msg:${record.id}`, record);
+    }
+    persistThread(record) {
+        this.queues.threads.enqueue(`thread:${record.jid}`, record);
+    }
+    persistThreadAsync(record) {
+        return this.queues.threads.enqueueAsync(`thread:${record.jid}`, record);
+    }
+    persistContact(record) {
+        this.queues.contacts.enqueue(`contact:${record.jid}`, record);
+    }
+    persistContactAsync(record) {
+        return this.queues.contacts.enqueueAsync(`contact:${record.jid}`, record);
+    }
+    async flush(timeoutMs = this.flushTimeoutMs) {
+        const [messages, threads, contacts] = await Promise.all([
+            this.queues.messages.flush(timeoutMs),
+            this.queues.threads.flush(timeoutMs),
+            this.queues.contacts.flush(timeoutMs)
+        ]);
+        const result = this.toDrainResult(messages, threads, contacts);
+        if (result.remaining > 0) {
+            this.logger.warn('write-behind flush finished with pending writes', {
+                messagesRemaining: messages.remaining,
+                threadsRemaining: threads.remaining,
+                contactsRemaining: contacts.remaining
+            });
+        }
+        return result;
+    }
+    async destroy(timeoutMs = this.flushTimeoutMs) {
+        const [messages, threads, contacts] = await Promise.all([
+            this.queues.messages.destroy(timeoutMs),
+            this.queues.threads.destroy(timeoutMs),
+            this.queues.contacts.destroy(timeoutMs)
+        ]);
+        const result = this.toDrainResult(messages, threads, contacts);
+        if (result.remaining > 0) {
+            this.logger.warn('write-behind destroy finished with pending writes', {
+                messagesRemaining: messages.remaining,
+                threadsRemaining: threads.remaining,
+                contactsRemaining: contacts.remaining
+            });
+        }
+        return result;
+    }
+    toDrainResult(messages, threads, contacts) {
+        return {
+            messages,
+            threads,
+            contacts,
+            flushed: messages.flushed + threads.flushed + contacts.flushed,
+            remaining: messages.remaining + threads.remaining + contacts.remaining
+        };
+    }
+}
+exports.WriteBehindPersistence = WriteBehindPersistence;

package/dist/client/tokens/cs-token.js

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CsTokenGenerator = void 0;
+const core_1 = require("../../crypto/core");
+const bytes_1 = require("../../util/bytes");
+const collections_1 = require("../../util/collections");
+const CS_TOKEN_CACHE_MAX = 5;
+class CsTokenGenerator {
+    constructor() {
+        this.cachedKey = null;
+        this.cachedSalt = null;
+        this.cache = new Map();
+    }
+    async generate(nctSalt, accountLid) {
+        const cached = this.cache.get(accountLid);
+        if (cached && this.isSameSalt(nctSalt)) {
+            return cached;
+        }
+        const key = await this.resolveKey(nctSalt);
+        const result = await (0, core_1.hmacSign)(key, bytes_1.TEXT_ENCODER.encode(accountLid));
+        (0, collections_1.setBoundedMapEntry)(this.cache, accountLid, result, CS_TOKEN_CACHE_MAX);
+        return result;
+    }
+    invalidate() {
+        this.cachedKey = null;
+        this.cachedSalt = null;
+        this.cache.clear();
+    }
+    isSameSalt(salt) {
+        if (!this.cachedSalt || this.cachedSalt.length !== salt.length) {
+            return false;
+        }
+        for (let i = 0; i < salt.length; i += 1) {
+            if (this.cachedSalt[i] !== salt[i]) {
+                return false;
+            }
+        }
+        return true;
+    }
+    async resolveKey(salt) {
+        if (this.cachedKey && this.isSameSalt(salt)) {
+            return this.cachedKey;
+        }
+        this.cachedKey = await (0, core_1.importHmacKey)(salt);
+        this.cachedSalt = salt;
+        this.cache.clear();
+        return this.cachedKey;
+    }
+}
+exports.CsTokenGenerator = CsTokenGenerator;

package/dist/client/tokens/tc-token.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.computeBucket = computeBucket;
+exports.tokenExpirationCutoffS = tokenExpirationCutoffS;
+exports.isTokenExpired = isTokenExpired;
+exports.shouldSendNewToken = shouldSendNewToken;
+exports.clampDuration = clampDuration;
+function computeBucket(unixTimeS, durationS) {
+    return Math.floor(unixTimeS / durationS);
+}
+function tokenExpirationCutoffS(nowS, durationS, numBuckets) {
+    const currentBucket = computeBucket(nowS, durationS);
+    const cutoffBucket = currentBucket - numBuckets;
+    return cutoffBucket * durationS;
+}
+function isTokenExpired(tokenTimestampS, nowS, durationS, numBuckets) {
+    const cutoff = tokenExpirationCutoffS(nowS, durationS, numBuckets);
+    return tokenTimestampS < cutoff;
+}
+function shouldSendNewToken(senderTimestampS, nowS, senderDurationS) {
+    return computeBucket(senderTimestampS, senderDurationS) !== computeBucket(nowS, senderDurationS);
+}
+function clampDuration(durationS, maxDurationS) {
+    return Math.min(durationS, maxDurationS);
+}

package/dist/crypto/core/index.js

@@ -3,7 +3,7 @@
  * Cryptographic utilities
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ed25519VerifyRaw = exports.aesCtrDecrypt = exports.aesCtrEncrypt = exports.pbkdf2DeriveAesCtrKey = exports.hmacSign = exports.importHmacSha512Key = exports.importHmacKey = exports.aesCbcDecrypt = exports.aesCbcEncrypt = exports.importAesCbcKey = exports.aesGcmDecrypt = exports.aesGcmEncrypt = exports.importAesGcmKey = exports.sha512 = exports.sha256 = exports.sha1 = exports.randomIntAsync = exports.randomBytesAsync = exports.buildNonce = exports.readVersionedContent = exports.prependVersion = exports.toRawPubKey = exports.toSerializedPubKey = exports.hkdfSplit = exports.hkdf = exports.X25519 = exports.Ed25519 = void 0;
+exports.aesCtrDecrypt = exports.aesCtrEncrypt = exports.pbkdf2DeriveAesCtrKey = exports.hmacSign = exports.importHmacSha512Key = exports.importHmacKey = exports.aesCbcDecrypt = exports.aesCbcEncrypt = exports.importAesCbcKey = exports.aesGcmDecrypt = exports.aesGcmEncrypt = exports.importAesGcmKey = exports.sha512 = exports.sha256 = exports.sha1 = exports.randomIntAsync = exports.randomFillAsync = exports.randomBytesAsync = exports.buildNonce = exports.readVersionedContent = exports.prependVersion = exports.toRawPubKey = exports.toSerializedPubKey = exports.hkdfSplit = exports.hkdf = exports.X25519 = exports.Ed25519 = void 0;
 var Ed25519_1 = require("../curves/Ed25519");
 Object.defineProperty(exports, "Ed25519", { enumerable: true, get: function () { return Ed25519_1.Ed25519; } });
 var X25519_1 = require("../curves/X25519");
@@ -20,6 +20,7 @@ var nonce_1 = require("../core/nonce");
 Object.defineProperty(exports, "buildNonce", { enumerable: true, get: function () { return nonce_1.buildNonce; } });
 var random_1 = require("../core/random");
 Object.defineProperty(exports, "randomBytesAsync", { enumerable: true, get: function () { return random_1.randomBytesAsync; } });
+Object.defineProperty(exports, "randomFillAsync", { enumerable: true, get: function () { return random_1.randomFillAsync; } });
 Object.defineProperty(exports, "randomIntAsync", { enumerable: true, get: function () { return random_1.randomIntAsync; } });
 var primitives_1 = require("../core/primitives");
 Object.defineProperty(exports, "sha1", { enumerable: true, get: function () { return primitives_1.sha1; } });
@@ -37,4 +38,3 @@ Object.defineProperty(exports, "hmacSign", { enumerable: true, get: function ()
 Object.defineProperty(exports, "pbkdf2DeriveAesCtrKey", { enumerable: true, get: function () { return primitives_1.pbkdf2DeriveAesCtrKey; } });
 Object.defineProperty(exports, "aesCtrEncrypt", { enumerable: true, get: function () { return primitives_1.aesCtrEncrypt; } });
 Object.defineProperty(exports, "aesCtrDecrypt", { enumerable: true, get: function () { return primitives_1.aesCtrDecrypt; } });
-Object.defineProperty(exports, "ed25519VerifyRaw", { enumerable: true, get: function () { return primitives_1.ed25519VerifyRaw; } });

package/dist/crypto/core/keys.js

@@ -5,21 +5,21 @@ exports.toRawPubKey = toRawPubKey;
 exports.versionByte = versionByte;
 exports.prependVersion = prependVersion;
 exports.readVersionedContent = readVersionedContent;
-const constants_1 = require("../core/constants");
 const bytes_1 = require("../../util/bytes");
+const SERIALIZED_PUB_KEY_PREFIX = 5;
 /**
  * Converts a 32-byte raw public key to 33-byte serialized format (with 0x05 prefix)
  */
 function toSerializedPubKey(key) {
     if (key.length === 33) {
-        if (key[0] !== constants_1.SERIALIZED_PUB_KEY_PREFIX) {
+        if (key[0] !== SERIALIZED_PUB_KEY_PREFIX) {
             throw new Error('invalid serialized signal public key prefix');
         }
         return key;
     }
     (0, bytes_1.assertByteLength)(key, 32, `invalid signal public key length ${key.length}`);
     const out = new Uint8Array(33);
-    out[0] = constants_1.SERIALIZED_PUB_KEY_PREFIX;
+    out[0] = SERIALIZED_PUB_KEY_PREFIX;
     out.set(key, 1);
     return out;
 }
@@ -30,7 +30,7 @@ function toRawPubKey(key) {
     if (key.length === 32) {
         return key;
     }
-    if (key.length === 33 && key[0] === constants_1.SERIALIZED_PUB_KEY_PREFIX) {
+    if (key.length === 33 && key[0] === SERIALIZED_PUB_KEY_PREFIX) {
         return key.subarray(1);
     }
     throw new Error(`invalid signal public key length ${key.length}`);

package/dist/crypto/core/nonce.js

@@ -3,6 +3,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.buildNonce = buildNonce;
 /**
  * Builds a 12-byte nonce for AES-GCM encryption with counter in the last 4 bytes.
+ * Allocates a new buffer per call because concurrent Noise encrypt/decrypt operations
+ * may hold references to different nonces simultaneously.
  * Throws if counter exceeds uint32 range to prevent nonce reuse.
  */
 function buildNonce(counter) {

package/dist/crypto/core/primitives.js

@@ -19,7 +19,6 @@ exports.hmacSign = hmacSign;
 exports.pbkdf2DeriveAesCtrKey = pbkdf2DeriveAesCtrKey;
 exports.aesCtrEncrypt = aesCtrEncrypt;
 exports.aesCtrDecrypt = aesCtrDecrypt;
-exports.ed25519VerifyRaw = ed25519VerifyRaw;
 const node_crypto_1 = require("node:crypto");
 const bytes_1 = require("../../util/bytes");
 async function digestBytes(algorithm, value) {
@@ -109,10 +108,3 @@ async function aesCtrEncrypt(key, counter, plaintext) {
 async function aesCtrDecrypt(key, counter, ciphertext) {
     return (0, bytes_1.toBytesView)(await node_crypto_1.webcrypto.subtle.decrypt({ name: 'AES-CTR', counter, length: 64 }, key, ciphertext));
 }
-// ============================================
-// Ed25519 raw verify (for Signal variant sigs)
-// ============================================
-async function ed25519VerifyRaw(publicKey, signature, message) {
-    const cryptoKey = await node_crypto_1.webcrypto.subtle.importKey('raw', publicKey, { name: 'Ed25519' }, false, ['verify']);
-    return node_crypto_1.webcrypto.subtle.verify('Ed25519', cryptoKey, signature, message);
-}

package/dist/crypto/core/random.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.randomIntAsync = void 0;
 exports.randomBytesAsync = randomBytesAsync;
+exports.randomFillAsync = randomFillAsync;
 const node_crypto_1 = require("node:crypto");
 const node_util_1 = require("node:util");
 const bytes_1 = require("../../util/bytes");
@@ -10,4 +11,25 @@ const randomIntAsyncImpl = (0, node_util_1.promisify)(node_crypto_1.randomInt);
 async function randomBytesAsync(size) {
     return (0, bytes_1.toBytesView)(await randomBytesAsyncImpl(size));
 }
+async function randomFillAsync(target, offset, size) {
+    await new Promise((resolve, reject) => {
+        const onDone = (error) => {
+            if (error) {
+                reject(error);
+                return;
+            }
+            resolve();
+        };
+        if (offset === undefined) {
+            (0, node_crypto_1.randomFill)(target, onDone);
+            return;
+        }
+        if (size === undefined) {
+            (0, node_crypto_1.randomFill)(target, offset, onDone);
+            return;
+        }
+        (0, node_crypto_1.randomFill)(target, offset, size, onDone);
+    });
+    return target;
+}
 exports.randomIntAsync = randomIntAsyncImpl;

package/dist/crypto/curves/X25519.js

@@ -6,9 +6,24 @@ exports.montgomeryToEdwardsPublic = montgomeryToEdwardsPublic;
 const node_crypto_1 = require("node:crypto");
 const constants_1 = require("../curves/constants");
 const types_1 = require("../curves/types");
-const le_1 = require("../math/le");
-const mod_1 = require("../math/mod");
+const constants_2 = require("../math/constants");
+const fe_1 = require("../math/fe");
 const bytes_1 = require("../../util/bytes");
+// Pre-allocated temps for montgomeryToEdwardsPublic (safe: single-threaded)
+const _mx = (0, fe_1.fe)();
+const _m1 = (0, fe_1.fe)();
+const _m2 = (0, fe_1.fe)();
+const _m3 = (0, fe_1.fe)();
+// p-1 = 2^255-20 in LE bytes: 0xEC, 0xFF×30, 0x7F
+// Mask bit 255 before comparing (non-canonical inputs may have it set)
+function isFieldPMinus1(b) {
+    if (b[0] !== 0xec || (b[31] & 0x7f) !== 0x7f)
+        return false;
+    for (let i = 1; i < 31; i++)
+        if (b[i] !== 0xff)
+            return false;
+    return true;
+}
 function clampCurvePrivateKeyInPlace(privateKey) {
     (0, bytes_1.assertByteLength)(privateKey, 32, `invalid curve25519 private key length ${privateKey.length}`);
     privateKey[0] &= 248;
@@ -18,12 +33,16 @@ function clampCurvePrivateKeyInPlace(privateKey) {
 }
 function montgomeryToEdwardsPublic(curvePublicKey, signBit) {
     (0, bytes_1.assertByteLength)(curvePublicKey, 32, `invalid curve25519 public key length ${curvePublicKey.length}`);
-    const x = (0, le_1.bytesToBigIntLE)(curvePublicKey);
-    if (x === mod_1.FIELD_P - 1n) {
+    if (isFieldPMinus1(curvePublicKey)) {
         throw new Error('invalid curve25519 low-order public key');
     }
-    const y = (0, mod_1.mod)((x - 1n) * (0, mod_1.modInv)(x + 1n));
-    const encoded = (0, le_1.bigIntToBytesLE)(y, 32);
+    (0, fe_1.feFromBytes)(_mx, curvePublicKey);
+    (0, fe_1.feSub)(_m1, _mx, constants_2.FE_ONE);
+    (0, fe_1.feAdd)(_m2, _mx, constants_2.FE_ONE);
+    (0, fe_1.feInv)(_m3, _m2);
+    (0, fe_1.feMul)(_m1, _m1, _m3);
+    const encoded = new Uint8Array(32);
+    (0, fe_1.fePack)(encoded, _m1);
     encoded[31] = (encoded[31] & 0x7f) | (signBit & 0x80);
     return encoded;
 }

package/dist/crypto/index.js

@@ -14,4 +14,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.X25519 = void 0;
 __exportStar(require("./core"), exports);
+var X25519_1 = require("./curves/X25519");
+Object.defineProperty(exports, "X25519", { enumerable: true, get: function () { return X25519_1.X25519; } });

package/dist/crypto/math/constants.js

@@ -1,44 +1,21 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.IDENTITY_POINT = exports.BASE_POINT = exports.TWO_D = exports.EDWARDS_D = exports.GROUP_L = exports.FIELD_P = void 0;
+exports.IDENTITY_POINT = exports.BASE_POINT = exports.FE_ONE = exports.FE_ZERO = exports.FE_TWO_D = exports.GROUP_L = exports.FIELD_P = void 0;
+const fe_1 = require("../math/fe");
 exports.FIELD_P = (1n << 255n) - 19n;
 exports.GROUP_L = (1n << 252n) + 27742317777372353535851937790883648493n;
-function modField(value) {
-    const remainder = value % exports.FIELD_P;
-    return remainder >= 0n ? remainder : remainder + exports.FIELD_P;
-}
-function modPowField(base, exponent) {
-    let result = 1n;
-    let current = modField(base);
-    let power = exponent;
-    while (power > 0n) {
-        if ((power & 1n) === 1n) {
-            result = modField(result * current);
-        }
-        current = modField(current * current);
-        power >>= 1n;
-    }
-    return result;
-}
-function modInvField(value) {
-    if (value === 0n) {
-        throw new Error('field inversion by zero');
-    }
-    return modPowField(value, exports.FIELD_P - 2n);
-}
-const BASE_X = 15112221349535400772501151409588531511454012693041857206046113283949847762202n;
-const BASE_Y = 46316835694926478169428394003475163141307993866256225615783033603165251855960n;
-exports.EDWARDS_D = modField(-121665n * modInvField(121666n));
-exports.TWO_D = modField(2n * exports.EDWARDS_D);
+exports.FE_TWO_D = (0, fe_1.feFromBigInt)(16295367250680780974490674513165176452449235426866156013048779062215315747161n);
+exports.FE_ZERO = (0, fe_1.fe)();
+exports.FE_ONE = (0, fe_1.feFromBigInt)(1n);
 exports.BASE_POINT = Object.freeze({
-    x: BASE_X,
-    y: BASE_Y,
-    z: 1n,
-    t: modField(BASE_X * BASE_Y)
+    x: (0, fe_1.feFromBigInt)(15112221349535400772501151409588531511454012693041857206046113283949847762202n),
+    y: (0, fe_1.feFromBigInt)(46316835694926478169428394003475163141307993866256225615783033603165251855960n),
+    z: (0, fe_1.feFromBigInt)(1n),
+    t: (0, fe_1.feFromBigInt)(46827403850823179245072216630277197565144205554125654976674165829533817101731n)
 });
 exports.IDENTITY_POINT = Object.freeze({
-    x: 0n,
-    y: 1n,
-    z: 1n,
-    t: 0n
+    x: (0, fe_1.feFromBigInt)(0n),
+    y: (0, fe_1.feFromBigInt)(1n),
+    z: (0, fe_1.feFromBigInt)(1n),
+    t: (0, fe_1.feFromBigInt)(0n)
 });