zapo-js 0.1.2 → 0.3.0

package/dist/client/tokens/cs-token.js

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CsTokenGenerator = void 0;
+const core_1 = require("../../crypto/core");
+const bytes_1 = require("../../util/bytes");
+const collections_1 = require("../../util/collections");
+const CS_TOKEN_CACHE_MAX = 5;
+class CsTokenGenerator {
+    constructor() {
+        this.cachedKey = null;
+        this.cachedSalt = null;
+        this.cache = new Map();
+    }
+    async generate(nctSalt, accountLid) {
+        const cached = this.cache.get(accountLid);
+        if (cached && this.isSameSalt(nctSalt)) {
+            return cached;
+        }
+        const key = await this.resolveKey(nctSalt);
+        const result = await (0, core_1.hmacSign)(key, bytes_1.TEXT_ENCODER.encode(accountLid));
+        (0, collections_1.setBoundedMapEntry)(this.cache, accountLid, result, CS_TOKEN_CACHE_MAX);
+        return result;
+    }
+    invalidate() {
+        this.cachedKey = null;
+        this.cachedSalt = null;
+        this.cache.clear();
+    }
+    isSameSalt(salt) {
+        if (!this.cachedSalt || this.cachedSalt.length !== salt.length) {
+            return false;
+        }
+        for (let i = 0; i < salt.length; i += 1) {
+            if (this.cachedSalt[i] !== salt[i]) {
+                return false;
+            }
+        }
+        return true;
+    }
+    async resolveKey(salt) {
+        if (this.cachedKey && this.isSameSalt(salt)) {
+            return this.cachedKey;
+        }
+        this.cachedKey = await (0, core_1.importHmacKey)(salt);
+        this.cachedSalt = salt;
+        this.cache.clear();
+        return this.cachedKey;
+    }
+}
+exports.CsTokenGenerator = CsTokenGenerator;

package/dist/client/tokens/tc-token.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.computeBucket = computeBucket;
+exports.tokenExpirationCutoffS = tokenExpirationCutoffS;
+exports.isTokenExpired = isTokenExpired;
+exports.shouldSendNewToken = shouldSendNewToken;
+exports.clampDuration = clampDuration;
+function computeBucket(unixTimeS, durationS) {
+    return Math.floor(unixTimeS / durationS);
+}
+function tokenExpirationCutoffS(nowS, durationS, numBuckets) {
+    const currentBucket = computeBucket(nowS, durationS);
+    const cutoffBucket = currentBucket - numBuckets;
+    return cutoffBucket * durationS;
+}
+function isTokenExpired(tokenTimestampS, nowS, durationS, numBuckets) {
+    const cutoff = tokenExpirationCutoffS(nowS, durationS, numBuckets);
+    return tokenTimestampS < cutoff;
+}
+function shouldSendNewToken(senderTimestampS, nowS, senderDurationS) {
+    return computeBucket(senderTimestampS, senderDurationS) !== computeBucket(nowS, senderDurationS);
+}
+function clampDuration(durationS, maxDurationS) {
+    return Math.min(durationS, maxDurationS);
+}

package/dist/crypto/core/index.js

@@ -3,7 +3,7 @@
  * Cryptographic utilities
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ed25519VerifyRaw = exports.aesCtrDecrypt = exports.aesCtrEncrypt = exports.pbkdf2DeriveAesCtrKey = exports.hmacSign = exports.importHmacSha512Key = exports.importHmacKey = exports.aesCbcDecrypt = exports.aesCbcEncrypt = exports.importAesCbcKey = exports.aesGcmDecrypt = exports.aesGcmEncrypt = exports.importAesGcmKey = exports.sha512 = exports.sha256 = exports.sha1 = exports.randomIntAsync = exports.randomBytesAsync = exports.buildNonce = exports.readVersionedContent = exports.prependVersion = exports.toRawPubKey = exports.toSerializedPubKey = exports.hkdfSplit = exports.hkdf = exports.X25519 = exports.Ed25519 = void 0;
+exports.xeddsaVerify = exports.xeddsaSign = exports.aesCtrDecrypt = exports.aesCtrEncrypt = exports.pbkdf2DeriveAesCtrKey = exports.hmacSign = exports.importHmacSha512Key = exports.importHmacKey = exports.aesCbcDecrypt = exports.aesCbcEncrypt = exports.importAesCbcKey = exports.aesGcmDecrypt = exports.aesGcmEncrypt = exports.importAesGcmKey = exports.sha512 = exports.sha256 = exports.sha1 = exports.randomIntAsync = exports.randomFillAsync = exports.randomBytesAsync = exports.buildNonce = exports.readVersionedContent = exports.prependVersion = exports.toRawPubKey = exports.toSerializedPubKey = exports.hkdfSplit = exports.hkdf = exports.X25519 = exports.Ed25519 = void 0;
 var Ed25519_1 = require("../curves/Ed25519");
 Object.defineProperty(exports, "Ed25519", { enumerable: true, get: function () { return Ed25519_1.Ed25519; } });
 var X25519_1 = require("../curves/X25519");
@@ -20,6 +20,7 @@ var nonce_1 = require("../core/nonce");
 Object.defineProperty(exports, "buildNonce", { enumerable: true, get: function () { return nonce_1.buildNonce; } });
 var random_1 = require("../core/random");
 Object.defineProperty(exports, "randomBytesAsync", { enumerable: true, get: function () { return random_1.randomBytesAsync; } });
+Object.defineProperty(exports, "randomFillAsync", { enumerable: true, get: function () { return random_1.randomFillAsync; } });
 Object.defineProperty(exports, "randomIntAsync", { enumerable: true, get: function () { return random_1.randomIntAsync; } });
 var primitives_1 = require("../core/primitives");
 Object.defineProperty(exports, "sha1", { enumerable: true, get: function () { return primitives_1.sha1; } });
@@ -37,4 +38,6 @@ Object.defineProperty(exports, "hmacSign", { enumerable: true, get: function ()
 Object.defineProperty(exports, "pbkdf2DeriveAesCtrKey", { enumerable: true, get: function () { return primitives_1.pbkdf2DeriveAesCtrKey; } });
 Object.defineProperty(exports, "aesCtrEncrypt", { enumerable: true, get: function () { return primitives_1.aesCtrEncrypt; } });
 Object.defineProperty(exports, "aesCtrDecrypt", { enumerable: true, get: function () { return primitives_1.aesCtrDecrypt; } });
-Object.defineProperty(exports, "ed25519VerifyRaw", { enumerable: true, get: function () { return primitives_1.ed25519VerifyRaw; } });
+var xeddsa_1 = require("../core/xeddsa");
+Object.defineProperty(exports, "xeddsaSign", { enumerable: true, get: function () { return xeddsa_1.xeddsaSign; } });
+Object.defineProperty(exports, "xeddsaVerify", { enumerable: true, get: function () { return xeddsa_1.xeddsaVerify; } });

package/dist/crypto/core/keys.js

@@ -5,21 +5,21 @@ exports.toRawPubKey = toRawPubKey;
 exports.versionByte = versionByte;
 exports.prependVersion = prependVersion;
 exports.readVersionedContent = readVersionedContent;
-const constants_1 = require("../core/constants");
 const bytes_1 = require("../../util/bytes");
+const SERIALIZED_PUB_KEY_PREFIX = 5;
 /**
  * Converts a 32-byte raw public key to 33-byte serialized format (with 0x05 prefix)
  */
 function toSerializedPubKey(key) {
     if (key.length === 33) {
-        if (key[0] !== constants_1.SERIALIZED_PUB_KEY_PREFIX) {
+        if (key[0] !== SERIALIZED_PUB_KEY_PREFIX) {
             throw new Error('invalid serialized signal public key prefix');
         }
         return key;
     }
     (0, bytes_1.assertByteLength)(key, 32, `invalid signal public key length ${key.length}`);
     const out = new Uint8Array(33);
-    out[0] = constants_1.SERIALIZED_PUB_KEY_PREFIX;
+    out[0] = SERIALIZED_PUB_KEY_PREFIX;
     out.set(key, 1);
     return out;
 }
@@ -30,7 +30,7 @@ function toRawPubKey(key) {
     if (key.length === 32) {
         return key;
     }
-    if (key.length === 33 && key[0] === constants_1.SERIALIZED_PUB_KEY_PREFIX) {
+    if (key.length === 33 && key[0] === SERIALIZED_PUB_KEY_PREFIX) {
         return key.subarray(1);
     }
     throw new Error(`invalid signal public key length ${key.length}`);

package/dist/crypto/core/nonce.js

@@ -3,6 +3,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.buildNonce = buildNonce;
 /**
  * Builds a 12-byte nonce for AES-GCM encryption with counter in the last 4 bytes.
+ * Allocates a new buffer per call because concurrent Noise encrypt/decrypt operations
+ * may hold references to different nonces simultaneously.
  * Throws if counter exceeds uint32 range to prevent nonce reuse.
  */
 function buildNonce(counter) {

package/dist/crypto/core/primitives.js

@@ -19,7 +19,6 @@ exports.hmacSign = hmacSign;
 exports.pbkdf2DeriveAesCtrKey = pbkdf2DeriveAesCtrKey;
 exports.aesCtrEncrypt = aesCtrEncrypt;
 exports.aesCtrDecrypt = aesCtrDecrypt;
-exports.ed25519VerifyRaw = ed25519VerifyRaw;
 const node_crypto_1 = require("node:crypto");
 const bytes_1 = require("../../util/bytes");
 async function digestBytes(algorithm, value) {
@@ -109,10 +108,3 @@ async function aesCtrEncrypt(key, counter, plaintext) {
 async function aesCtrDecrypt(key, counter, ciphertext) {
     return (0, bytes_1.toBytesView)(await node_crypto_1.webcrypto.subtle.decrypt({ name: 'AES-CTR', counter, length: 64 }, key, ciphertext));
 }
-// ============================================
-// Ed25519 raw verify (for Signal variant sigs)
-// ============================================
-async function ed25519VerifyRaw(publicKey, signature, message) {
-    const cryptoKey = await node_crypto_1.webcrypto.subtle.importKey('raw', publicKey, { name: 'Ed25519' }, false, ['verify']);
-    return node_crypto_1.webcrypto.subtle.verify('Ed25519', cryptoKey, signature, message);
-}

package/dist/crypto/core/random.js

@@ -1,13 +1,29 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.randomIntAsync = void 0;
-exports.randomBytesAsync = randomBytesAsync;
+exports.randomBytesAsync = exports.randomIntAsync = void 0;
+exports.randomFillAsync = randomFillAsync;
 const node_crypto_1 = require("node:crypto");
 const node_util_1 = require("node:util");
-const bytes_1 = require("../../util/bytes");
-const randomBytesAsyncImpl = (0, node_util_1.promisify)(node_crypto_1.randomBytes);
-const randomIntAsyncImpl = (0, node_util_1.promisify)(node_crypto_1.randomInt);
-async function randomBytesAsync(size) {
-    return (0, bytes_1.toBytesView)(await randomBytesAsyncImpl(size));
+async function randomFillAsync(target, offset, size) {
+    await new Promise((resolve, reject) => {
+        const onDone = (error) => {
+            if (error) {
+                reject(error);
+                return;
+            }
+            resolve();
+        };
+        if (offset === undefined) {
+            (0, node_crypto_1.randomFill)(target, onDone);
+            return;
+        }
+        if (size === undefined) {
+            (0, node_crypto_1.randomFill)(target, offset, onDone);
+            return;
+        }
+        (0, node_crypto_1.randomFill)(target, offset, size, onDone);
+    });
+    return target;
 }
-exports.randomIntAsync = randomIntAsyncImpl;
+exports.randomIntAsync = (0, node_util_1.promisify)(node_crypto_1.randomInt);
+exports.randomBytesAsync = (0, node_util_1.promisify)(node_crypto_1.randomBytes);

package/dist/crypto/core/xeddsa.js

@@ -0,0 +1,57 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.xeddsaVerify = xeddsaVerify;
+exports.xeddsaSign = xeddsaSign;
+const primitives_1 = require("../core/primitives");
+const random_1 = require("../core/random");
+const Ed25519_1 = require("../curves/Ed25519");
+const X25519_1 = require("../curves/X25519");
+const edwards_1 = require("../math/edwards");
+const le_1 = require("../math/le");
+const mod_1 = require("../math/mod");
+const bytes_1 = require("../../util/bytes");
+const PREFIX_SIGNATURE_RANDOM = new Uint8Array([
+    0xfe, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+]);
+async function xeddsaVerify(curvePublicKey, message, signature) {
+    if (signature.length !== 64) {
+        return false;
+    }
+    if ((signature[63] & 0x60) !== 0) {
+        return false;
+    }
+    const lastByteIndex = 63;
+    const originalLastByte = signature[lastByteIndex];
+    const signBit = originalLastByte & 0x80;
+    signature[lastByteIndex] = originalLastByte & 0x7f;
+    const edPublic = (0, X25519_1.montgomeryToEdwardsPublic)(curvePublicKey, signBit);
+    try {
+        return await Ed25519_1.Ed25519.verify(message, signature, edPublic);
+    }
+    finally {
+        signature[lastByteIndex] = originalLastByte;
+    }
+}
+async function xeddsaSign(privateKey, message) {
+    (0, bytes_1.assertByteLength)(privateKey, 32, `invalid curve25519 private key length ${privateKey.length}`);
+    const clampedPrivateKey = (0, X25519_1.clampCurvePrivateKeyInPlace)(privateKey);
+    const privateScalar = (0, le_1.bytesToBigIntLE)(clampedPrivateKey);
+    const encodedPublic = (0, edwards_1.encodeExtendedPoint)((0, edwards_1.scalarMultBase)(privateScalar));
+    const pubKeySignBit = encodedPublic[31] & 0x80;
+    const randomSuffix = await (0, random_1.randomBytesAsync)(64);
+    const hashInput = (0, bytes_1.concatBytes)([
+        PREFIX_SIGNATURE_RANDOM,
+        clampedPrivateKey,
+        message,
+        randomSuffix
+    ]);
+    const r = (0, mod_1.modGroup)((0, le_1.bytesToBigIntLE)(await (0, primitives_1.sha512)(hashInput)));
+    const encodedR = (0, edwards_1.encodeExtendedPoint)((0, edwards_1.scalarMultBase)(r));
+    const hInput = (0, bytes_1.concatBytes)([encodedR, encodedPublic, message]);
+    const h = (0, mod_1.modGroup)((0, le_1.bytesToBigIntLE)(await (0, primitives_1.sha512)(hInput)));
+    const s = (0, mod_1.modGroup)(r + h * privateScalar);
+    const encodedS = (0, le_1.bigIntToBytesLE)(s, 32);
+    encodedS[31] = (encodedS[31] & 0x7f) | pubKeySignBit;
+    return (0, bytes_1.concatBytes)([encodedR, encodedS]);
+}

package/dist/crypto/curves/X25519.js

@@ -6,9 +6,26 @@ exports.montgomeryToEdwardsPublic = montgomeryToEdwardsPublic;
 const node_crypto_1 = require("node:crypto");
 const constants_1 = require("../curves/constants");
 const types_1 = require("../curves/types");
-const le_1 = require("../math/le");
-const mod_1 = require("../math/mod");
+const constants_2 = require("../math/constants");
+const fe_1 = require("../math/fe");
 const bytes_1 = require("../../util/bytes");
+const runtime_1 = require("../../util/runtime");
+const IS_BUN = (0, runtime_1.isBunRuntime)();
+// Pre-allocated temps for montgomeryToEdwardsPublic (safe: single-threaded)
+const _mx = (0, fe_1.fe)();
+const _m1 = (0, fe_1.fe)();
+const _m2 = (0, fe_1.fe)();
+const _m3 = (0, fe_1.fe)();
+// p-1 = 2^255-20 in LE bytes: 0xEC, 0xFF×30, 0x7F
+// Mask bit 255 before comparing (non-canonical inputs may have it set)
+function isFieldPMinus1(b) {
+    if (b[0] !== 0xec || (b[31] & 0x7f) !== 0x7f)
+        return false;
+    for (let i = 1; i < 31; i++)
+        if (b[i] !== 0xff)
+            return false;
+    return true;
+}
 function clampCurvePrivateKeyInPlace(privateKey) {
     (0, bytes_1.assertByteLength)(privateKey, 32, `invalid curve25519 private key length ${privateKey.length}`);
     privateKey[0] &= 248;
@@ -18,12 +35,16 @@ function clampCurvePrivateKeyInPlace(privateKey) {
 }
 function montgomeryToEdwardsPublic(curvePublicKey, signBit) {
     (0, bytes_1.assertByteLength)(curvePublicKey, 32, `invalid curve25519 public key length ${curvePublicKey.length}`);
-    const x = (0, le_1.bytesToBigIntLE)(curvePublicKey);
-    if (x === mod_1.FIELD_P - 1n) {
+    if (isFieldPMinus1(curvePublicKey)) {
         throw new Error('invalid curve25519 low-order public key');
     }
-    const y = (0, mod_1.mod)((x - 1n) * (0, mod_1.modInv)(x + 1n));
-    const encoded = (0, le_1.bigIntToBytesLE)(y, 32);
+    (0, fe_1.feFromBytes)(_mx, curvePublicKey);
+    (0, fe_1.feSub)(_m1, _mx, constants_2.FE_ONE);
+    (0, fe_1.feAdd)(_m2, _mx, constants_2.FE_ONE);
+    (0, fe_1.feInv)(_m3, _m2);
+    (0, fe_1.feMul)(_m1, _m1, _m3);
+    const encoded = new Uint8Array(32);
+    (0, fe_1.fePack)(encoded, _m1);
     encoded[31] = (encoded[31] & 0x7f) | (signBit & 0x80);
     return encoded;
 }
@@ -50,6 +71,22 @@ class X25519 {
     static async scalarMult(privKey, pubKey) {
         (0, bytes_1.assertByteLength)(privKey, 32, 'x25519 private key must be 32 bytes');
         (0, bytes_1.assertByteLength)(pubKey, 32, 'x25519 public key must be 32 bytes');
+        // TODO: When Bun supports deriveBits with X25519 change to Async Web Crypto API
+        // https://github.com/oven-sh/bun/pull/29152
+        if (IS_BUN) {
+            const spki = new Uint8Array(constants_1.X25519_SPKI_PREFIX.length + 32);
+            spki.set(constants_1.X25519_SPKI_PREFIX, 0);
+            spki.set(pubKey, constants_1.X25519_SPKI_PREFIX.length);
+            const shared = (0, node_crypto_1.diffieHellman)({
+                privateKey: (0, node_crypto_1.createPrivateKey)({
+                    key: (0, types_1.pkcs8FromRawPrivate)(constants_1.X25519_PKCS8_PREFIX, privKey),
+                    format: 'der',
+                    type: 'pkcs8'
+                }),
+                publicKey: (0, node_crypto_1.createPublicKey)({ key: spki, format: 'der', type: 'spki' })
+            });
+            return (0, bytes_1.toBytesView)(shared);
+        }
         const [privateKey, publicKey] = await Promise.all([
             node_crypto_1.webcrypto.subtle.importKey('pkcs8', (0, types_1.pkcs8FromRawPrivate)(constants_1.X25519_PKCS8_PREFIX, privKey), { name: 'X25519' }, false, ['deriveBits']),
             node_crypto_1.webcrypto.subtle.importKey('raw', pubKey, { name: 'X25519' }, false, [])

package/dist/crypto/curves/constants.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ED25519_PKCS8_PREFIX = exports.X25519_PKCS8_PREFIX = void 0;
+exports.ED25519_PKCS8_PREFIX = exports.X25519_SPKI_PREFIX = exports.X25519_PKCS8_PREFIX = void 0;
 const bytes_1 = require("../../util/bytes");
 exports.X25519_PKCS8_PREFIX = (0, bytes_1.hexToBytes)('302e020100300506032b656e04220420');
+exports.X25519_SPKI_PREFIX = (0, bytes_1.hexToBytes)('302a300506032b656e032100');
 exports.ED25519_PKCS8_PREFIX = (0, bytes_1.hexToBytes)('302e020100300506032b657004220420');

package/dist/crypto/index.js

@@ -14,4 +14,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.X25519 = void 0;
 __exportStar(require("./core"), exports);
+var X25519_1 = require("./curves/X25519");
+Object.defineProperty(exports, "X25519", { enumerable: true, get: function () { return X25519_1.X25519; } });

package/dist/crypto/math/constants.js

@@ -1,44 +1,21 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.IDENTITY_POINT = exports.BASE_POINT = exports.TWO_D = exports.EDWARDS_D = exports.GROUP_L = exports.FIELD_P = void 0;
+exports.IDENTITY_POINT = exports.BASE_POINT = exports.FE_ONE = exports.FE_ZERO = exports.FE_TWO_D = exports.GROUP_L = exports.FIELD_P = void 0;
+const fe_1 = require("../math/fe");
 exports.FIELD_P = (1n << 255n) - 19n;
 exports.GROUP_L = (1n << 252n) + 27742317777372353535851937790883648493n;
-function modField(value) {
-    const remainder = value % exports.FIELD_P;
-    return remainder >= 0n ? remainder : remainder + exports.FIELD_P;
-}
-function modPowField(base, exponent) {
-    let result = 1n;
-    let current = modField(base);
-    let power = exponent;
-    while (power > 0n) {
-        if ((power & 1n) === 1n) {
-            result = modField(result * current);
-        }
-        current = modField(current * current);
-        power >>= 1n;
-    }
-    return result;
-}
-function modInvField(value) {
-    if (value === 0n) {
-        throw new Error('field inversion by zero');
-    }
-    return modPowField(value, exports.FIELD_P - 2n);
-}
-const BASE_X = 15112221349535400772501151409588531511454012693041857206046113283949847762202n;
-const BASE_Y = 46316835694926478169428394003475163141307993866256225615783033603165251855960n;
-exports.EDWARDS_D = modField(-121665n * modInvField(121666n));
-exports.TWO_D = modField(2n * exports.EDWARDS_D);
+exports.FE_TWO_D = (0, fe_1.feFromBigInt)(16295367250680780974490674513165176452449235426866156013048779062215315747161n);
+exports.FE_ZERO = (0, fe_1.fe)();
+exports.FE_ONE = (0, fe_1.feFromBigInt)(1n);
 exports.BASE_POINT = Object.freeze({
-    x: BASE_X,
-    y: BASE_Y,
-    z: 1n,
-    t: modField(BASE_X * BASE_Y)
+    x: (0, fe_1.feFromBigInt)(15112221349535400772501151409588531511454012693041857206046113283949847762202n),
+    y: (0, fe_1.feFromBigInt)(46316835694926478169428394003475163141307993866256225615783033603165251855960n),
+    z: (0, fe_1.feFromBigInt)(1n),
+    t: (0, fe_1.feFromBigInt)(46827403850823179245072216630277197565144205554125654976674165829533817101731n)
 });
 exports.IDENTITY_POINT = Object.freeze({
-    x: 0n,
-    y: 1n,
-    z: 1n,
-    t: 0n
+    x: (0, fe_1.feFromBigInt)(0n),
+    y: (0, fe_1.feFromBigInt)(1n),
+    z: (0, fe_1.feFromBigInt)(1n),
+    t: (0, fe_1.feFromBigInt)(0n)
 });

package/dist/crypto/math/edwards.js

@@ -3,62 +3,189 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.scalarMultBase = scalarMultBase;
 exports.encodeExtendedPoint = encodeExtendedPoint;
 const constants_1 = require("../math/constants");
-const le_1 = require("../math/le");
+const fe_1 = require("../math/fe");
 const mod_1 = require("../math/mod");
+// Pre-allocated temporaries for point operations (safe: JS is single-threaded)
+const _a = (0, fe_1.fe)();
+const _b = (0, fe_1.fe)();
+const _c = (0, fe_1.fe)();
+const _d = (0, fe_1.fe)();
+const _e = (0, fe_1.fe)();
+const _f = (0, fe_1.fe)();
+const _g = (0, fe_1.fe)();
+const _h = (0, fe_1.fe)();
+// Pre-allocated output points for hot-path operations
+function mutablePoint() {
+    return { x: (0, fe_1.fe)(), y: (0, fe_1.fe)(), z: (0, fe_1.fe)(), t: (0, fe_1.fe)() };
+}
+const _addOut = mutablePoint();
+const _dblOut = mutablePoint();
+const _negOut = mutablePoint();
+// Temporaries for feInv inside encodeExtendedPoint
+const _invZinv = (0, fe_1.fe)();
+const _invX = (0, fe_1.fe)();
+const _invY = (0, fe_1.fe)();
+const _invXBytes = new Uint8Array(32);
+function addPointInto(out, a, b) {
+    (0, fe_1.feSub)(_a, a.y, a.x);
+    (0, fe_1.feSub)(_b, b.y, b.x);
+    (0, fe_1.feMul)(_a, _a, _b); // aTerm
+    (0, fe_1.feAdd)(_b, a.y, a.x);
+    (0, fe_1.feAdd)(_c, b.y, b.x);
+    (0, fe_1.feMul)(_b, _b, _c); // bTerm
+    (0, fe_1.feMul)(_c, constants_1.FE_TWO_D, a.t);
+    (0, fe_1.feMul)(_c, _c, b.t); // cTerm
+    (0, fe_1.feAdd)(_d, a.z, a.z);
+    (0, fe_1.feMul)(_d, _d, b.z); // dTerm
+    (0, fe_1.feSub)(_e, _b, _a); // eTerm
+    (0, fe_1.feSub)(_f, _d, _c); // fTerm
+    (0, fe_1.feAdd)(_g, _d, _c); // gTerm
+    (0, fe_1.feAdd)(_h, _b, _a); // hTerm
+    (0, fe_1.feMul)(out.x, _e, _f);
+    (0, fe_1.feMul)(out.y, _g, _h);
+    (0, fe_1.feMul)(out.z, _f, _g);
+    (0, fe_1.feMul)(out.t, _e, _h);
+}
+function doublePointInto(out, point) {
+    (0, fe_1.feMul)(_a, point.x, point.x); // aTerm = x^2
+    (0, fe_1.feMul)(_b, point.y, point.y); // bTerm = y^2
+    (0, fe_1.feMul)(_c, point.z, point.z);
+    (0, fe_1.feAdd)(_c, _c, _c); // cTerm = 2*z^2
+    (0, fe_1.feNeg)(_d, _a); // dTerm = -aTerm (a=-1 for ed25519)
+    (0, fe_1.feAdd)(_e, point.x, point.y);
+    (0, fe_1.feMul)(_e, _e, _e);
+    (0, fe_1.feAdd)(_f, _a, _b);
+    (0, fe_1.feSub)(_e, _e, _f); // eTerm = (x+y)^2 - aTerm - bTerm
+    (0, fe_1.feAdd)(_g, _d, _b); // gTerm = dTerm + bTerm
+    (0, fe_1.feSub)(_f, _g, _c); // fTerm = gTerm - cTerm
+    (0, fe_1.feSub)(_h, _d, _b); // hTerm = dTerm - bTerm
+    (0, fe_1.feMul)(out.x, _e, _f);
+    (0, fe_1.feMul)(out.y, _g, _h);
+    (0, fe_1.feMul)(out.z, _f, _g);
+    (0, fe_1.feMul)(out.t, _e, _h);
+}
+function negatePointInto(out, p) {
+    (0, fe_1.feNeg)(out.x, p.x);
+    (0, fe_1.feCopy)(out.y, p.y);
+    (0, fe_1.feCopy)(out.z, p.z);
+    (0, fe_1.feNeg)(out.t, p.t);
+}
+function clonePoint(p) {
+    const x = (0, fe_1.fe)();
+    const y = (0, fe_1.fe)();
+    const z = (0, fe_1.fe)();
+    const t = (0, fe_1.fe)();
+    (0, fe_1.feCopy)(x, p.x);
+    (0, fe_1.feCopy)(y, p.y);
+    (0, fe_1.feCopy)(z, p.z);
+    (0, fe_1.feCopy)(t, p.t);
+    return { x, y, z, t };
+}
+// Allocating versions for precomputation (runs once at module load)
 function addPoint(a, b) {
-    const y1MinusX1 = (0, mod_1.mod)(a.y - a.x);
-    const y2MinusX2 = (0, mod_1.mod)(b.y - b.x);
-    const y1PlusX1 = (0, mod_1.mod)(a.y + a.x);
-    const y2PlusX2 = (0, mod_1.mod)(b.y + b.x);
-    const aTerm = (0, mod_1.mod)(y1MinusX1 * y2MinusX2);
-    const bTerm = (0, mod_1.mod)(y1PlusX1 * y2PlusX2);
-    const cTerm = (0, mod_1.mod)(constants_1.TWO_D * a.t * b.t);
-    const dTerm = (0, mod_1.mod)(2n * a.z * b.z);
-    const eTerm = (0, mod_1.mod)(bTerm - aTerm);
-    const fTerm = (0, mod_1.mod)(dTerm - cTerm);
-    const gTerm = (0, mod_1.mod)(dTerm + cTerm);
-    const hTerm = (0, mod_1.mod)(bTerm + aTerm);
-    return {
-        x: (0, mod_1.mod)(eTerm * fTerm),
-        y: (0, mod_1.mod)(gTerm * hTerm),
-        z: (0, mod_1.mod)(fTerm * gTerm),
-        t: (0, mod_1.mod)(eTerm * hTerm)
-    };
+    addPointInto(_addOut, a, b);
+    return clonePoint(_addOut);
 }
-function doublePoint(point) {
-    const aTerm = (0, mod_1.mod)(point.x * point.x);
-    const bTerm = (0, mod_1.mod)(point.y * point.y);
-    const cTerm = (0, mod_1.mod)(2n * point.z * point.z);
-    const dTerm = (0, mod_1.mod)(-aTerm);
-    const eTerm = (0, mod_1.mod)((0, mod_1.mod)((point.x + point.y) * (point.x + point.y)) - aTerm - bTerm);
-    const gTerm = (0, mod_1.mod)(dTerm + bTerm);
-    const fTerm = (0, mod_1.mod)(gTerm - cTerm);
-    const hTerm = (0, mod_1.mod)(dTerm - bTerm);
-    return {
-        x: (0, mod_1.mod)(eTerm * fTerm),
-        y: (0, mod_1.mod)(gTerm * hTerm),
-        z: (0, mod_1.mod)(fTerm * gTerm),
-        t: (0, mod_1.mod)(eTerm * hTerm)
-    };
+function doublePoint(a) {
+    doublePointInto(_dblOut, a);
+    return clonePoint(_dblOut);
 }
+const W = 5;
+const halfW = 1 << W;
+const mask = halfW - 1;
+const precomp = new Array(1 << (W - 1));
+precomp[0] = constants_1.BASE_POINT;
+const _dbl = doublePoint(constants_1.BASE_POINT);
+for (let i = 1; i < precomp.length; i++) {
+    precomp[i] = addPoint(precomp[i - 1], _dbl);
+}
+// Pre-allocated scratch buffers for scalarMultBase (safe: JS is single-threaded)
+const _naf = new Int8Array(256);
+const _loopResult = mutablePoint();
+const _loopDbl = mutablePoint();
+const _loopAdd = mutablePoint();
 function scalarMultBase(scalar) {
     let k = (0, mod_1.modGroup)(scalar);
-    let result = constants_1.IDENTITY_POINT;
-    let addend = constants_1.BASE_POINT;
+    if (k === 0n)
+        return clonePoint(constants_1.IDENTITY_POINT);
+    const naf = _naf;
+    naf.fill(0);
+    let nafLen = 0;
     while (k > 0n) {
         if ((k & 1n) === 1n) {
-            result = addPoint(result, addend);
+            let digit = Number(k & BigInt(mask));
+            if (digit >= halfW >> 1)
+                digit -= halfW;
+            naf[nafLen++] = digit;
+            k -= BigInt(digit);
+        }
+        else {
+            nafLen++;
         }
-        addend = doublePoint(addend);
         k >>= 1n;
     }
-    return result;
+    // Copy identity into loop result
+    (0, fe_1.feCopy)(_loopResult.x, constants_1.IDENTITY_POINT.x);
+    (0, fe_1.feCopy)(_loopResult.y, constants_1.IDENTITY_POINT.y);
+    (0, fe_1.feCopy)(_loopResult.z, constants_1.IDENTITY_POINT.z);
+    (0, fe_1.feCopy)(_loopResult.t, constants_1.IDENTITY_POINT.t);
+    for (let i = nafLen - 1; i >= 0; i--) {
+        doublePointInto(_loopDbl, _loopResult);
+        // swap dbl → result
+        const tmpX = _loopResult.x;
+        _loopResult.x = _loopDbl.x;
+        _loopDbl.x = tmpX;
+        const tmpY = _loopResult.y;
+        _loopResult.y = _loopDbl.y;
+        _loopDbl.y = tmpY;
+        const tmpZ = _loopResult.z;
+        _loopResult.z = _loopDbl.z;
+        _loopDbl.z = tmpZ;
+        const tmpT = _loopResult.t;
+        _loopResult.t = _loopDbl.t;
+        _loopDbl.t = tmpT;
+        const digit = naf[i];
+        if (digit > 0) {
+            addPointInto(_loopAdd, _loopResult, precomp[(digit - 1) >> 1]);
+            const ax = _loopResult.x;
+            _loopResult.x = _loopAdd.x;
+            _loopAdd.x = ax;
+            const ay = _loopResult.y;
+            _loopResult.y = _loopAdd.y;
+            _loopAdd.y = ay;
+            const az = _loopResult.z;
+            _loopResult.z = _loopAdd.z;
+            _loopAdd.z = az;
+            const at = _loopResult.t;
+            _loopResult.t = _loopAdd.t;
+            _loopAdd.t = at;
+        }
+        else if (digit < 0) {
+            negatePointInto(_negOut, precomp[(-digit - 1) >> 1]);
+            addPointInto(_loopAdd, _loopResult, _negOut);
+            const ax = _loopResult.x;
+            _loopResult.x = _loopAdd.x;
+            _loopAdd.x = ax;
+            const ay = _loopResult.y;
+            _loopResult.y = _loopAdd.y;
+            _loopAdd.y = ay;
+            const az = _loopResult.z;
+            _loopResult.z = _loopAdd.z;
+            _loopAdd.z = az;
+            const at = _loopResult.t;
+            _loopResult.t = _loopAdd.t;
+            _loopAdd.t = at;
+        }
+    }
+    return clonePoint(_loopResult);
 }
 function encodeExtendedPoint(point) {
-    const zInv = (0, mod_1.modInv)(point.z);
-    const x = (0, mod_1.mod)(point.x * zInv);
-    const y = (0, mod_1.mod)(point.y * zInv);
-    const encoded = (0, le_1.bigIntToBytesLE)(y, 32);
-    encoded[31] = (encoded[31] & 0x7f) | Number((x & 1n) << 7n);
+    (0, fe_1.feInv)(_invZinv, point.z);
+    (0, fe_1.feMul)(_invX, point.x, _invZinv);
+    (0, fe_1.feMul)(_invY, point.y, _invZinv);
+    const encoded = new Uint8Array(32);
+    (0, fe_1.fePack)(encoded, _invY);
+    (0, fe_1.fePack)(_invXBytes, _invX);
+    encoded[31] = (encoded[31] & 0x7f) | ((_invXBytes[0] & 1) << 7);
     return encoded;
 }