zapo-js 0.1.2 → 0.3.0

package/dist/esm/client/tokens/tc-token.js

@@ -0,0 +1,18 @@
+export function computeBucket(unixTimeS, durationS) {
+    return Math.floor(unixTimeS / durationS);
+}
+export function tokenExpirationCutoffS(nowS, durationS, numBuckets) {
+    const currentBucket = computeBucket(nowS, durationS);
+    const cutoffBucket = currentBucket - numBuckets;
+    return cutoffBucket * durationS;
+}
+export function isTokenExpired(tokenTimestampS, nowS, durationS, numBuckets) {
+    const cutoff = tokenExpirationCutoffS(nowS, durationS, numBuckets);
+    return tokenTimestampS < cutoff;
+}
+export function shouldSendNewToken(senderTimestampS, nowS, senderDurationS) {
+    return computeBucket(senderTimestampS, senderDurationS) !== computeBucket(nowS, senderDurationS);
+}
+export function clampDuration(durationS, maxDurationS) {
+    return Math.min(durationS, maxDurationS);
+}

package/dist/esm/crypto/core/index.js

@@ -6,5 +6,6 @@ export { X25519 } from '../curves/X25519.js';
 export { hkdf, hkdfSplit } from '../core/hkdf.js';
 export { toSerializedPubKey, toRawPubKey, prependVersion, readVersionedContent } from '../core/keys.js';
 export { buildNonce } from '../core/nonce.js';
-export { randomBytesAsync, randomIntAsync } from '../core/random.js';
-export { sha1, sha256, sha512, importAesGcmKey, aesGcmEncrypt, aesGcmDecrypt, importAesCbcKey, aesCbcEncrypt, aesCbcDecrypt, importHmacKey, importHmacSha512Key, hmacSign, pbkdf2DeriveAesCtrKey, aesCtrEncrypt, aesCtrDecrypt, ed25519VerifyRaw } from '../core/primitives.js';
+export { randomBytesAsync, randomFillAsync, randomIntAsync } from '../core/random.js';
+export { sha1, sha256, sha512, importAesGcmKey, aesGcmEncrypt, aesGcmDecrypt, importAesCbcKey, aesCbcEncrypt, aesCbcDecrypt, importHmacKey, importHmacSha512Key, hmacSign, pbkdf2DeriveAesCtrKey, aesCtrEncrypt, aesCtrDecrypt } from '../core/primitives.js';
+export { xeddsaSign, xeddsaVerify } from '../core/xeddsa.js';

package/dist/esm/crypto/core/keys.js

@@ -1,5 +1,5 @@
-import { SERIALIZED_PUB_KEY_PREFIX } from '../core/constants.js';
 import { assertByteLength } from '../../util/bytes.js';
+const SERIALIZED_PUB_KEY_PREFIX = 5;
 /**
  * Converts a 32-byte raw public key to 33-byte serialized format (with 0x05 prefix)
  */

package/dist/esm/crypto/core/nonce.js

@@ -1,5 +1,7 @@
 /**
  * Builds a 12-byte nonce for AES-GCM encryption with counter in the last 4 bytes.
+ * Allocates a new buffer per call because concurrent Noise encrypt/decrypt operations
+ * may hold references to different nonces simultaneously.
  * Throws if counter exceeds uint32 range to prevent nonce reuse.
  */
 export function buildNonce(counter) {

package/dist/esm/crypto/core/primitives.js

@@ -90,10 +90,3 @@ export async function aesCtrEncrypt(key, counter, plaintext) {
 export async function aesCtrDecrypt(key, counter, ciphertext) {
     return toBytesView(await webcrypto.subtle.decrypt({ name: 'AES-CTR', counter, length: 64 }, key, ciphertext));
 }
-// ============================================
-// Ed25519 raw verify (for Signal variant sigs)
-// ============================================
-export async function ed25519VerifyRaw(publicKey, signature, message) {
-    const cryptoKey = await webcrypto.subtle.importKey('raw', publicKey, { name: 'Ed25519' }, false, ['verify']);
-    return webcrypto.subtle.verify('Ed25519', cryptoKey, signature, message);
-}

package/dist/esm/crypto/core/random.js

@@ -1,9 +1,25 @@
-import { randomBytes, randomInt } from 'node:crypto';
+import { randomBytes, randomFill, randomInt } from 'node:crypto';
 import { promisify } from 'node:util';
-import { toBytesView } from '../../util/bytes.js';
-const randomBytesAsyncImpl = promisify(randomBytes);
-const randomIntAsyncImpl = promisify(randomInt);
-export async function randomBytesAsync(size) {
-    return toBytesView(await randomBytesAsyncImpl(size));
+export async function randomFillAsync(target, offset, size) {
+    await new Promise((resolve, reject) => {
+        const onDone = (error) => {
+            if (error) {
+                reject(error);
+                return;
+            }
+            resolve();
+        };
+        if (offset === undefined) {
+            randomFill(target, onDone);
+            return;
+        }
+        if (size === undefined) {
+            randomFill(target, offset, onDone);
+            return;
+        }
+        randomFill(target, offset, size, onDone);
+    });
+    return target;
 }
-export const randomIntAsync = randomIntAsyncImpl;
+export const randomIntAsync = promisify(randomInt);
+export const randomBytesAsync = promisify(randomBytes);

package/dist/esm/crypto/core/xeddsa.js

@@ -0,0 +1,53 @@
+import { sha512 } from '../core/primitives.js';
+import { randomBytesAsync } from '../core/random.js';
+import { Ed25519 } from '../curves/Ed25519.js';
+import { clampCurvePrivateKeyInPlace, montgomeryToEdwardsPublic } from '../curves/X25519.js';
+import { encodeExtendedPoint, scalarMultBase } from '../math/edwards.js';
+import { bigIntToBytesLE, bytesToBigIntLE } from '../math/le.js';
+import { modGroup } from '../math/mod.js';
+import { assertByteLength, concatBytes } from '../../util/bytes.js';
+const PREFIX_SIGNATURE_RANDOM = new Uint8Array([
+    0xfe, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+]);
+export async function xeddsaVerify(curvePublicKey, message, signature) {
+    if (signature.length !== 64) {
+        return false;
+    }
+    if ((signature[63] & 0x60) !== 0) {
+        return false;
+    }
+    const lastByteIndex = 63;
+    const originalLastByte = signature[lastByteIndex];
+    const signBit = originalLastByte & 0x80;
+    signature[lastByteIndex] = originalLastByte & 0x7f;
+    const edPublic = montgomeryToEdwardsPublic(curvePublicKey, signBit);
+    try {
+        return await Ed25519.verify(message, signature, edPublic);
+    }
+    finally {
+        signature[lastByteIndex] = originalLastByte;
+    }
+}
+export async function xeddsaSign(privateKey, message) {
+    assertByteLength(privateKey, 32, `invalid curve25519 private key length ${privateKey.length}`);
+    const clampedPrivateKey = clampCurvePrivateKeyInPlace(privateKey);
+    const privateScalar = bytesToBigIntLE(clampedPrivateKey);
+    const encodedPublic = encodeExtendedPoint(scalarMultBase(privateScalar));
+    const pubKeySignBit = encodedPublic[31] & 0x80;
+    const randomSuffix = await randomBytesAsync(64);
+    const hashInput = concatBytes([
+        PREFIX_SIGNATURE_RANDOM,
+        clampedPrivateKey,
+        message,
+        randomSuffix
+    ]);
+    const r = modGroup(bytesToBigIntLE(await sha512(hashInput)));
+    const encodedR = encodeExtendedPoint(scalarMultBase(r));
+    const hInput = concatBytes([encodedR, encodedPublic, message]);
+    const h = modGroup(bytesToBigIntLE(await sha512(hInput)));
+    const s = modGroup(r + h * privateScalar);
+    const encodedS = bigIntToBytesLE(s, 32);
+    encodedS[31] = (encodedS[31] & 0x7f) | pubKeySignBit;
+    return concatBytes([encodedR, encodedS]);
+}

package/dist/esm/crypto/curves/X25519.js

@@ -1,9 +1,26 @@
-import { webcrypto } from 'node:crypto';
-import { X25519_PKCS8_PREFIX } from '../curves/constants.js';
+import { createPrivateKey, createPublicKey, diffieHellman, webcrypto } from 'node:crypto';
+import { X25519_PKCS8_PREFIX, X25519_SPKI_PREFIX } from '../curves/constants.js';
 import { pkcs8FromRawPrivate } from '../curves/types.js';
-import { bigIntToBytesLE, bytesToBigIntLE } from '../math/le.js';
-import { FIELD_P, mod, modInv } from '../math/mod.js';
+import { FE_ONE } from '../math/constants.js';
+import { fe, feAdd, feFromBytes, feInv, feMul, fePack, feSub } from '../math/fe.js';
 import { assertByteLength, decodeBase64Url, toBytesView } from '../../util/bytes.js';
+import { isBunRuntime } from '../../util/runtime.js';
+const IS_BUN = isBunRuntime();
+// Pre-allocated temps for montgomeryToEdwardsPublic (safe: single-threaded)
+const _mx = fe();
+const _m1 = fe();
+const _m2 = fe();
+const _m3 = fe();
+// p-1 = 2^255-20 in LE bytes: 0xEC, 0xFF×30, 0x7F
+// Mask bit 255 before comparing (non-canonical inputs may have it set)
+function isFieldPMinus1(b) {
+    if (b[0] !== 0xec || (b[31] & 0x7f) !== 0x7f)
+        return false;
+    for (let i = 1; i < 31; i++)
+        if (b[i] !== 0xff)
+            return false;
+    return true;
+}
 export function clampCurvePrivateKeyInPlace(privateKey) {
     assertByteLength(privateKey, 32, `invalid curve25519 private key length ${privateKey.length}`);
     privateKey[0] &= 248;
@@ -13,12 +30,16 @@ export function clampCurvePrivateKeyInPlace(privateKey) {
 }
 export function montgomeryToEdwardsPublic(curvePublicKey, signBit) {
     assertByteLength(curvePublicKey, 32, `invalid curve25519 public key length ${curvePublicKey.length}`);
-    const x = bytesToBigIntLE(curvePublicKey);
-    if (x === FIELD_P - 1n) {
+    if (isFieldPMinus1(curvePublicKey)) {
         throw new Error('invalid curve25519 low-order public key');
     }
-    const y = mod((x - 1n) * modInv(x + 1n));
-    const encoded = bigIntToBytesLE(y, 32);
+    feFromBytes(_mx, curvePublicKey);
+    feSub(_m1, _mx, FE_ONE);
+    feAdd(_m2, _mx, FE_ONE);
+    feInv(_m3, _m2);
+    feMul(_m1, _m1, _m3);
+    const encoded = new Uint8Array(32);
+    fePack(encoded, _m1);
     encoded[31] = (encoded[31] & 0x7f) | (signBit & 0x80);
     return encoded;
 }
@@ -45,6 +66,22 @@ export class X25519 {
     static async scalarMult(privKey, pubKey) {
         assertByteLength(privKey, 32, 'x25519 private key must be 32 bytes');
         assertByteLength(pubKey, 32, 'x25519 public key must be 32 bytes');
+        // TODO: When Bun supports deriveBits with X25519 change to Async Web Crypto API
+        // https://github.com/oven-sh/bun/pull/29152
+        if (IS_BUN) {
+            const spki = new Uint8Array(X25519_SPKI_PREFIX.length + 32);
+            spki.set(X25519_SPKI_PREFIX, 0);
+            spki.set(pubKey, X25519_SPKI_PREFIX.length);
+            const shared = diffieHellman({
+                privateKey: createPrivateKey({
+                    key: pkcs8FromRawPrivate(X25519_PKCS8_PREFIX, privKey),
+                    format: 'der',
+                    type: 'pkcs8'
+                }),
+                publicKey: createPublicKey({ key: spki, format: 'der', type: 'spki' })
+            });
+            return toBytesView(shared);
+        }
         const [privateKey, publicKey] = await Promise.all([
             webcrypto.subtle.importKey('pkcs8', pkcs8FromRawPrivate(X25519_PKCS8_PREFIX, privKey), { name: 'X25519' }, false, ['deriveBits']),
             webcrypto.subtle.importKey('raw', pubKey, { name: 'X25519' }, false, [])

package/dist/esm/crypto/curves/constants.js

@@ -1,3 +1,4 @@
 import { hexToBytes } from '../../util/bytes.js';
 export const X25519_PKCS8_PREFIX = hexToBytes('302e020100300506032b656e04220420');
+export const X25519_SPKI_PREFIX = hexToBytes('302a300506032b656e032100');
 export const ED25519_PKCS8_PREFIX = hexToBytes('302e020100300506032b657004220420');

package/dist/esm/crypto/index.js

@@ -1 +1,2 @@
 export * from './core/index.js';
+export { X25519 } from './curves/X25519.js';

package/dist/esm/crypto/math/constants.js

@@ -1,41 +1,18 @@
+import { fe, feFromBigInt } from '../math/fe.js';
 export const FIELD_P = (1n << 255n) - 19n;
 export const GROUP_L = (1n << 252n) + 27742317777372353535851937790883648493n;
-function modField(value) {
-    const remainder = value % FIELD_P;
-    return remainder >= 0n ? remainder : remainder + FIELD_P;
-}
-function modPowField(base, exponent) {
-    let result = 1n;
-    let current = modField(base);
-    let power = exponent;
-    while (power > 0n) {
-        if ((power & 1n) === 1n) {
-            result = modField(result * current);
-        }
-        current = modField(current * current);
-        power >>= 1n;
-    }
-    return result;
-}
-function modInvField(value) {
-    if (value === 0n) {
-        throw new Error('field inversion by zero');
-    }
-    return modPowField(value, FIELD_P - 2n);
-}
-const BASE_X = 15112221349535400772501151409588531511454012693041857206046113283949847762202n;
-const BASE_Y = 46316835694926478169428394003475163141307993866256225615783033603165251855960n;
-export const EDWARDS_D = modField(-121665n * modInvField(121666n));
-export const TWO_D = modField(2n * EDWARDS_D);
+export const FE_TWO_D = feFromBigInt(16295367250680780974490674513165176452449235426866156013048779062215315747161n);
+export const FE_ZERO = fe();
+export const FE_ONE = feFromBigInt(1n);
 export const BASE_POINT = Object.freeze({
-    x: BASE_X,
-    y: BASE_Y,
-    z: 1n,
-    t: modField(BASE_X * BASE_Y)
+    x: feFromBigInt(15112221349535400772501151409588531511454012693041857206046113283949847762202n),
+    y: feFromBigInt(46316835694926478169428394003475163141307993866256225615783033603165251855960n),
+    z: feFromBigInt(1n),
+    t: feFromBigInt(46827403850823179245072216630277197565144205554125654976674165829533817101731n)
 });
 export const IDENTITY_POINT = Object.freeze({
-    x: 0n,
-    y: 1n,
-    z: 1n,
-    t: 0n
+    x: feFromBigInt(0n),
+    y: feFromBigInt(1n),
+    z: feFromBigInt(1n),
+    t: feFromBigInt(0n)
 });

package/dist/esm/crypto/math/edwards.js

@@ -1,60 +1,187 @@
-import { BASE_POINT, IDENTITY_POINT, TWO_D } from '../math/constants.js';
-import { bigIntToBytesLE } from '../math/le.js';
-import { mod, modGroup, modInv } from '../math/mod.js';
+import { BASE_POINT, FE_TWO_D, IDENTITY_POINT } from '../math/constants.js';
+import { fe, feAdd, feCopy, feInv, feMul, feNeg, fePack, feSub } from '../math/fe.js';
+import { modGroup } from '../math/mod.js';
+// Pre-allocated temporaries for point operations (safe: JS is single-threaded)
+const _a = fe();
+const _b = fe();
+const _c = fe();
+const _d = fe();
+const _e = fe();
+const _f = fe();
+const _g = fe();
+const _h = fe();
+// Pre-allocated output points for hot-path operations
+function mutablePoint() {
+    return { x: fe(), y: fe(), z: fe(), t: fe() };
+}
+const _addOut = mutablePoint();
+const _dblOut = mutablePoint();
+const _negOut = mutablePoint();
+// Temporaries for feInv inside encodeExtendedPoint
+const _invZinv = fe();
+const _invX = fe();
+const _invY = fe();
+const _invXBytes = new Uint8Array(32);
+function addPointInto(out, a, b) {
+    feSub(_a, a.y, a.x);
+    feSub(_b, b.y, b.x);
+    feMul(_a, _a, _b); // aTerm
+    feAdd(_b, a.y, a.x);
+    feAdd(_c, b.y, b.x);
+    feMul(_b, _b, _c); // bTerm
+    feMul(_c, FE_TWO_D, a.t);
+    feMul(_c, _c, b.t); // cTerm
+    feAdd(_d, a.z, a.z);
+    feMul(_d, _d, b.z); // dTerm
+    feSub(_e, _b, _a); // eTerm
+    feSub(_f, _d, _c); // fTerm
+    feAdd(_g, _d, _c); // gTerm
+    feAdd(_h, _b, _a); // hTerm
+    feMul(out.x, _e, _f);
+    feMul(out.y, _g, _h);
+    feMul(out.z, _f, _g);
+    feMul(out.t, _e, _h);
+}
+function doublePointInto(out, point) {
+    feMul(_a, point.x, point.x); // aTerm = x^2
+    feMul(_b, point.y, point.y); // bTerm = y^2
+    feMul(_c, point.z, point.z);
+    feAdd(_c, _c, _c); // cTerm = 2*z^2
+    feNeg(_d, _a); // dTerm = -aTerm (a=-1 for ed25519)
+    feAdd(_e, point.x, point.y);
+    feMul(_e, _e, _e);
+    feAdd(_f, _a, _b);
+    feSub(_e, _e, _f); // eTerm = (x+y)^2 - aTerm - bTerm
+    feAdd(_g, _d, _b); // gTerm = dTerm + bTerm
+    feSub(_f, _g, _c); // fTerm = gTerm - cTerm
+    feSub(_h, _d, _b); // hTerm = dTerm - bTerm
+    feMul(out.x, _e, _f);
+    feMul(out.y, _g, _h);
+    feMul(out.z, _f, _g);
+    feMul(out.t, _e, _h);
+}
+function negatePointInto(out, p) {
+    feNeg(out.x, p.x);
+    feCopy(out.y, p.y);
+    feCopy(out.z, p.z);
+    feNeg(out.t, p.t);
+}
+function clonePoint(p) {
+    const x = fe();
+    const y = fe();
+    const z = fe();
+    const t = fe();
+    feCopy(x, p.x);
+    feCopy(y, p.y);
+    feCopy(z, p.z);
+    feCopy(t, p.t);
+    return { x, y, z, t };
+}
+// Allocating versions for precomputation (runs once at module load)
 function addPoint(a, b) {
-    const y1MinusX1 = mod(a.y - a.x);
-    const y2MinusX2 = mod(b.y - b.x);
-    const y1PlusX1 = mod(a.y + a.x);
-    const y2PlusX2 = mod(b.y + b.x);
-    const aTerm = mod(y1MinusX1 * y2MinusX2);
-    const bTerm = mod(y1PlusX1 * y2PlusX2);
-    const cTerm = mod(TWO_D * a.t * b.t);
-    const dTerm = mod(2n * a.z * b.z);
-    const eTerm = mod(bTerm - aTerm);
-    const fTerm = mod(dTerm - cTerm);
-    const gTerm = mod(dTerm + cTerm);
-    const hTerm = mod(bTerm + aTerm);
-    return {
-        x: mod(eTerm * fTerm),
-        y: mod(gTerm * hTerm),
-        z: mod(fTerm * gTerm),
-        t: mod(eTerm * hTerm)
-    };
-}
-function doublePoint(point) {
-    const aTerm = mod(point.x * point.x);
-    const bTerm = mod(point.y * point.y);
-    const cTerm = mod(2n * point.z * point.z);
-    const dTerm = mod(-aTerm);
-    const eTerm = mod(mod((point.x + point.y) * (point.x + point.y)) - aTerm - bTerm);
-    const gTerm = mod(dTerm + bTerm);
-    const fTerm = mod(gTerm - cTerm);
-    const hTerm = mod(dTerm - bTerm);
-    return {
-        x: mod(eTerm * fTerm),
-        y: mod(gTerm * hTerm),
-        z: mod(fTerm * gTerm),
-        t: mod(eTerm * hTerm)
-    };
+    addPointInto(_addOut, a, b);
+    return clonePoint(_addOut);
+}
+function doublePoint(a) {
+    doublePointInto(_dblOut, a);
+    return clonePoint(_dblOut);
 }
+const W = 5;
+const halfW = 1 << W;
+const mask = halfW - 1;
+const precomp = new Array(1 << (W - 1));
+precomp[0] = BASE_POINT;
+const _dbl = doublePoint(BASE_POINT);
+for (let i = 1; i < precomp.length; i++) {
+    precomp[i] = addPoint(precomp[i - 1], _dbl);
+}
+// Pre-allocated scratch buffers for scalarMultBase (safe: JS is single-threaded)
+const _naf = new Int8Array(256);
+const _loopResult = mutablePoint();
+const _loopDbl = mutablePoint();
+const _loopAdd = mutablePoint();
 export function scalarMultBase(scalar) {
     let k = modGroup(scalar);
-    let result = IDENTITY_POINT;
-    let addend = BASE_POINT;
+    if (k === 0n)
+        return clonePoint(IDENTITY_POINT);
+    const naf = _naf;
+    naf.fill(0);
+    let nafLen = 0;
     while (k > 0n) {
         if ((k & 1n) === 1n) {
-            result = addPoint(result, addend);
+            let digit = Number(k & BigInt(mask));
+            if (digit >= halfW >> 1)
+                digit -= halfW;
+            naf[nafLen++] = digit;
+            k -= BigInt(digit);
+        }
+        else {
+            nafLen++;
         }
-        addend = doublePoint(addend);
         k >>= 1n;
     }
-    return result;
+    // Copy identity into loop result
+    feCopy(_loopResult.x, IDENTITY_POINT.x);
+    feCopy(_loopResult.y, IDENTITY_POINT.y);
+    feCopy(_loopResult.z, IDENTITY_POINT.z);
+    feCopy(_loopResult.t, IDENTITY_POINT.t);
+    for (let i = nafLen - 1; i >= 0; i--) {
+        doublePointInto(_loopDbl, _loopResult);
+        // swap dbl → result
+        const tmpX = _loopResult.x;
+        _loopResult.x = _loopDbl.x;
+        _loopDbl.x = tmpX;
+        const tmpY = _loopResult.y;
+        _loopResult.y = _loopDbl.y;
+        _loopDbl.y = tmpY;
+        const tmpZ = _loopResult.z;
+        _loopResult.z = _loopDbl.z;
+        _loopDbl.z = tmpZ;
+        const tmpT = _loopResult.t;
+        _loopResult.t = _loopDbl.t;
+        _loopDbl.t = tmpT;
+        const digit = naf[i];
+        if (digit > 0) {
+            addPointInto(_loopAdd, _loopResult, precomp[(digit - 1) >> 1]);
+            const ax = _loopResult.x;
+            _loopResult.x = _loopAdd.x;
+            _loopAdd.x = ax;
+            const ay = _loopResult.y;
+            _loopResult.y = _loopAdd.y;
+            _loopAdd.y = ay;
+            const az = _loopResult.z;
+            _loopResult.z = _loopAdd.z;
+            _loopAdd.z = az;
+            const at = _loopResult.t;
+            _loopResult.t = _loopAdd.t;
+            _loopAdd.t = at;
+        }
+        else if (digit < 0) {
+            negatePointInto(_negOut, precomp[(-digit - 1) >> 1]);
+            addPointInto(_loopAdd, _loopResult, _negOut);
+            const ax = _loopResult.x;
+            _loopResult.x = _loopAdd.x;
+            _loopAdd.x = ax;
+            const ay = _loopResult.y;
+            _loopResult.y = _loopAdd.y;
+            _loopAdd.y = ay;
+            const az = _loopResult.z;
+            _loopResult.z = _loopAdd.z;
+            _loopAdd.z = az;
+            const at = _loopResult.t;
+            _loopResult.t = _loopAdd.t;
+            _loopAdd.t = at;
+        }
+    }
+    return clonePoint(_loopResult);
 }
 export function encodeExtendedPoint(point) {
-    const zInv = modInv(point.z);
-    const x = mod(point.x * zInv);
-    const y = mod(point.y * zInv);
-    const encoded = bigIntToBytesLE(y, 32);
-    encoded[31] = (encoded[31] & 0x7f) | Number((x & 1n) << 7n);
+    feInv(_invZinv, point.z);
+    feMul(_invX, point.x, _invZinv);
+    feMul(_invY, point.y, _invZinv);
+    const encoded = new Uint8Array(32);
+    fePack(encoded, _invY);
+    fePack(_invXBytes, _invX);
+    encoded[31] = (encoded[31] & 0x7f) | ((_invXBytes[0] & 1) << 7);
     return encoded;
 }