perf: improve rust verifier memory usage

.github/workflows/rust-event-verifier-benchmark.yml

@@ -0,0 +1,60 @@
+name: Rust event verifier benchmark
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+    paths:
+      - packages/ndk/lib/data_layer/repositories/verifiers/rust_event_verifier_native.dart
+      - packages/ndk/lib/src/rust_lib.dart
+      - packages/ndk/rust/**
+      - packages/ndk/tool/benchmark_rust_event_verifier.dart
+      - .github/workflows/rust-event-verifier-benchmark.yml
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+concurrency:
+  group: rust-event-verifier-benchmark-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  benchmark:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: packages/ndk
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Set up Flutter
+        uses: subosito/flutter-action@v2
+        with:
+          flutter-version: ${{ env.FLUTTER_VERSION }}
+          channel: stable
+          architecture: ${{ matrix.architecture }}
+          cache: true
+
+      - name: Install dependencies
+        run: dart pub get
+
+      - name: Run benchmark
+        run: dart run tool/benchmark_rust_event_verifier.dart > benchmark-results.json
+
+      - name: Record and compare benchmark
+        uses: benchmark-action/github-action-benchmark@v1
+        with:
+          name: Rust event verifier
+          tool: customSmallerIsBetter
+          output-file-path: packages/ndk/benchmark-results.json
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          gh-pages-branch: benchmark-data
+          benchmark-data-dir-path: rust-event-verifier
+          auto-push: ${{ github.event_name == 'push' }}
+          save-data-file: ${{ github.event_name == 'push' }}
+          alert-threshold: 110%
+          comment-on-alert: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository }}
+          summary-always: true

.github/workflows/tests.yaml

@@ -24,7 +24,7 @@ jobs:
       - run: dart pub get
       - run: dart format --output=none .
       - run: dart analyze --no-fatal-warnings
-      - run: dart test --coverage="coverage" -j 2
+      - run: dart test --coverage="coverage" -j 1
       - run: dart test ./example -j 2
       - run: dart pub global activate coverage
       - run: $HOME/.pub-cache/bin/format_coverage --ignore-files **/*.g.dart --lcov --check-ignore --in=coverage --out=coverage.lcov --report-on=lib

packages/ndk/codecov.yml → codecov.yml

@@ -5,7 +5,7 @@ coverage:
     project:
       default:
         target: auto      # baseline = previous commit's coverage
-        threshold: 5%     # ✅ allow up to 5% drop — tune this to your X
+        threshold: 5%     # allow up to a 5% coverage drop
     patch:
       default:
-        target: 80%          # only require 80% of NEW lines to be covere
+        target: 80%       # require 80% coverage of new lines

packages/ndk/lib/data_layer/repositories/verifiers/rust_event_verifier_native.dart

@@ -3,6 +3,7 @@ import 'dart:ffi';
 import 'package:ffi/ffi.dart';
 
 import '../../../domain_layer/entities/nip_01_event.dart';
+import '../../../domain_layer/entities/nip_01_utils.dart';
 import '../../../domain_layer/repositories/event_verifier.dart';
 import '../../../src/rust_lib.dart' as rust_lib;
 
@@ -16,71 +17,51 @@ class RustEventVerifier implements EventVerifier {
 
   @override
   Future<bool> verify(Nip01Event event) async {
-    // Check if signature is present
-    if (event.sig == null) {
+    final signature = event.sig;
+    if (signature == null ||
+        !_isHex(event.id, 64) ||
+        !_isHex(event.pubKey, 64) ||
+        !_isHex(signature, 128) ||
+        !Nip01Utils.isIdValid(event)) {
       return false;
     }
 
-    // Convert strings to native pointers
-    final eventIdPtr = event.id.toNativeUtf8();
-    final pubKeyPtr = event.pubKey.toNativeUtf8();
-    final contentPtr = event.content.toNativeUtf8();
-    final signaturePtr = event.sig!.toNativeUtf8();
-
-    // Prepare tags data
-    final tags = event.tags;
-    final tagsCount = tags.length;
-
-    // Calculate total number of strings across all tags
-    int totalStrings = 0;
-    for (final tag in tags) {
-      totalStrings += tag.length;
-    }
-
-    // Allocate arrays for tags
-    final tagsLengths = calloc<Uint32>(tagsCount == 0 ? 1 : tagsCount);
-    final tagsData = calloc<Pointer<Utf8>>(
-      totalStrings == 0 ? 1 : totalStrings,
-    );
+    // The validated event id commits to every event field. Only the fixed-size
+    // Schnorr inputs need to cross FFI. One packed allocation replaces the
+    // previous allocation per field, tag, and nested Rust String.
+    const packedLength = 64 + 64 + 128;
+    final packed = malloc<Uint8>(packedLength);
 
     try {
-      // Fill tag data
-      int stringIndex = 0;
-      for (int i = 0; i < tagsCount; i++) {
-        tagsLengths[i] = tags[i].length;
-        for (final element in tags[i]) {
-          tagsData[stringIndex] = element.toNativeUtf8();
-          stringIndex++;
-        }
-      }
-
-      // Call the native function
-      final result = rust_lib.verifyNostrEventNative(
-        eventIdPtr,
-        pubKeyPtr,
-        event.createdAt,
-        event.kind,
-        tagsData,
-        tagsLengths,
-        tagsCount,
-        contentPtr,
-        signaturePtr,
-      );
-
-      return result == 1;
+      final bytes = packed.asTypedList(packedLength);
+      _copyAscii(event.id, bytes, 0);
+      _copyAscii(event.pubKey, bytes, 64);
+      _copyAscii(signature, bytes, 128);
+      return rust_lib.verifySchnorrSignaturePackedNative(
+            packed,
+            packedLength,
+          ) ==
+          1;
     } finally {
-      // Free all allocated memory
-      calloc.free(eventIdPtr);
-      calloc.free(pubKeyPtr);
-      calloc.free(contentPtr);
-      calloc.free(signaturePtr);
+      malloc.free(packed);
+    }
+  }
+
+  static bool _isHex(String value, int expectedLength) {
+    if (value.length != expectedLength) return false;
+    for (final codeUnit in value.codeUnits) {
+      final digit = codeUnit >= 0x30 && codeUnit <= 0x39;
+      final lower = codeUnit >= 0x61 && codeUnit <= 0x66;
+      final upper = codeUnit >= 0x41 && codeUnit <= 0x46;
+      if (!digit && !lower && !upper) return false;
+    }
+    return true;
+  }
 
-      // Free tag string pointers
-      for (int i = 0; i < totalStrings; i++) {
-        calloc.free(tagsData[i]);
-      }
-      calloc.free(tagsData);
-      calloc.free(tagsLengths);
+  static void _copyAscii(String source, List<int> target, int offset) {
+    final codeUnits = source.codeUnits;
+    for (var index = 0; index < codeUnits.length; index++) {
+      target[offset + index] = codeUnits[index];
     }
   }
 }

packages/ndk/lib/src/cli/native_library_errors.dart

@@ -0,0 +1,8 @@
+bool isNativeLibraryLoadError(ArgumentError error) {
+  final message = error.toString().toLowerCase();
+  return message.contains('dynamic library') ||
+      message.contains('failed to lookup symbol') ||
+      message.contains("couldn't resolve native function") ||
+      message.contains('no available native assets') ||
+      message.contains('failed to load');
+}

packages/ndk/lib/src/cli/ndk_cli_app.dart

@@ -6,6 +6,7 @@ import 'package:ndk/ndk.dart';
 
 import 'cli_accounts_store.dart';
 import 'cli_command.dart';
+import 'native_library_errors.dart';
 
 class NdkCliApp {
   final String appName;
@@ -238,21 +239,14 @@ class _CliEventVerifier implements EventVerifier {
       _enableFallback();
       return _fallbackVerifier.verify(event);
     } on ArgumentError catch (error) {
-      if (!_isNativeLibraryLoadError(error)) {
+      if (!isNativeLibraryLoadError(error)) {
         rethrow;
       }
       _enableFallback();
       return _fallbackVerifier.verify(event);
     }
   }
 
-  bool _isNativeLibraryLoadError(ArgumentError error) {
-    final message = error.toString().toLowerCase();
-    return message.contains('dynamic library') ||
-        message.contains('verify_nostr_event') ||
-        message.contains('failed to load');
-  }
-
   void _enableFallback() {
     _useFallback = true;
     if (_loggedFallback) {

packages/ndk/lib/src/rust_lib.dart

@@ -39,6 +39,17 @@ external int verifyNostrEventNative(
   Pointer<Utf8> signatureHex,
 );
 
+/// Verifies a Nostr Schnorr signature from one packed ASCII buffer containing
+/// event id (64 bytes), pubkey (64 bytes), and signature (128 bytes).
+@Native<Int32 Function(Pointer<Uint8>, IntPtr)>(
+  symbol: 'verify_schnorr_signature_packed',
+  isLeaf: true,
+)
+external int verifySchnorrSignaturePackedNative(
+  Pointer<Uint8> packed,
+  int packedLength,
+);
+
 // ── Quantum-Secure ML-DSA (FIPS 204) bindings ──────────────────────────
 //
 // These were CRYSTALS-Dilithium. NIST altered the algorithm during

packages/ndk/rust/src/lib.rs

@@ -5,7 +5,7 @@ use std::slice;
 
 use fips204::traits::{KeyGen, SerDes, Signer, Verifier};
 use fips204::{ml_dsa_44, ml_dsa_65, ml_dsa_87};
-use hex::decode;
+use hex::decode_to_slice;
 use hkdf::Hkdf;
 use secp256k1::{schnorr::Signature, XOnlyPublicKey, SECP256K1};
 use sha2::{Digest, Sha256};
@@ -118,39 +118,63 @@ pub unsafe extern "C" fn verify_schnorr_signature(
     }
 }
 
+/// Verifies a Schnorr signature from one fixed-size packed ASCII buffer:
+/// event id (64 bytes), pubkey (64 bytes), signature (128 bytes).
+///
+/// # Safety
+/// `packed` must point to `packed_len` readable bytes. The function rejects
+/// null pointers and every length other than 256 before reading the buffer.
+#[unsafe(no_mangle)]
+pub unsafe extern "C" fn verify_schnorr_signature_packed(
+    packed: *const u8,
+    packed_len: usize,
+) -> i32 {
+    const PACKED_LEN: usize = 64 + 64 + 128;
+    if packed.is_null() || packed_len != PACKED_LEN {
+        return 0;
+    }
+    let bytes = unsafe { slice::from_raw_parts(packed, packed_len) };
+    let event_id_hex = &bytes[..64];
+    let pub_key_hex = &bytes[64..128];
+    let signature_hex = &bytes[128..];
+
+    if verify_schnorr_signature_bytes(pub_key_hex, event_id_hex, signature_hex) {
+        1
+    } else {
+        0
+    }
+}
+
 fn verify_schnorr_signature_internal(
     pub_key_hex: &str,
     event_id_hex: &str,
     signature_hex: &str,
 ) -> bool {
-    let pub_key_bytes = match decode(pub_key_hex) {
-        Ok(bytes) => bytes,
-        Err(_) => return false,
-    };
-
-    let event_id_bytes = match decode(event_id_hex) {
-        Ok(bytes) => bytes,
-        Err(_) => return false,
-    };
-
-    let signature_bytes = match decode(signature_hex) {
-        Ok(bytes) => bytes,
-        Err(_) => return false,
-    };
+    verify_schnorr_signature_bytes(
+        pub_key_hex.as_bytes(),
+        event_id_hex.as_bytes(),
+        signature_hex.as_bytes(),
+    )
+}
 
-    if event_id_bytes.len() != 32 || pub_key_bytes.len() != 32 || signature_bytes.len() != 64 {
+fn verify_schnorr_signature_bytes(
+    pub_key_hex: &[u8],
+    event_id_hex: &[u8],
+    signature_hex: &[u8],
+) -> bool {
+    if pub_key_hex.len() != 64 || event_id_hex.len() != 64 || signature_hex.len() != 128 {
         return false;
     }
 
-    let pub_key_array: [u8; 32] = match pub_key_bytes.try_into() {
-        Ok(arr) => arr,
-        Err(_) => return false,
-    };
-
-    let signature_array: [u8; 64] = match signature_bytes.try_into() {
-        Ok(arr) => arr,
-        Err(_) => return false,
-    };
+    let mut pub_key_array = [0u8; 32];
+    let mut event_id_array = [0u8; 32];
+    let mut signature_array = [0u8; 64];
+    if decode_to_slice(pub_key_hex, &mut pub_key_array).is_err()
+        || decode_to_slice(event_id_hex, &mut event_id_array).is_err()
+        || decode_to_slice(signature_hex, &mut signature_array).is_err()
+    {
+        return false;
+    }
 
     let pubkey = match XOnlyPublicKey::from_byte_array(pub_key_array) {
         Ok(key) => key,
@@ -160,7 +184,7 @@ fn verify_schnorr_signature_internal(
     let signature = Signature::from_byte_array(signature_array);
 
     SECP256K1
-        .verify_schnorr(&signature, &event_id_bytes, &pubkey)
+        .verify_schnorr(&signature, &event_id_array, &pubkey)
         .is_ok()
 }