@atlasauth/pca-mpc 0.0.0-stage → 0.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (57) hide show
  1. package/LICENSE +21 -0
  2. package/README.md +65 -2
  3. package/dist/beaver.d.ts +49 -0
  4. package/dist/beaver.js +72 -0
  5. package/dist/beaver.js.map +1 -0
  6. package/dist/compose.d.ts +21 -0
  7. package/dist/compose.js +33 -0
  8. package/dist/compose.js.map +1 -0
  9. package/dist/csprng.d.ts +46 -0
  10. package/dist/csprng.js +86 -0
  11. package/dist/csprng.js.map +1 -0
  12. package/dist/ec.d.ts +130 -0
  13. package/dist/ec.js +475 -0
  14. package/dist/ec.js.map +1 -0
  15. package/dist/endemic-ot.d.ts +209 -0
  16. package/dist/endemic-ot.js +405 -0
  17. package/dist/endemic-ot.js.map +1 -0
  18. package/dist/field.d.ts +34 -0
  19. package/dist/field.js +65 -0
  20. package/dist/field.js.map +1 -0
  21. package/dist/gf128.d.ts +23 -0
  22. package/dist/gf128.js +59 -0
  23. package/dist/gf128.js.map +1 -0
  24. package/dist/hybrid-ot.d.ts +153 -0
  25. package/dist/hybrid-ot.js +241 -0
  26. package/dist/hybrid-ot.js.map +1 -0
  27. package/dist/index.d.ts +29 -0
  28. package/dist/index.js +46 -0
  29. package/dist/index.js.map +1 -0
  30. package/dist/kem-ot.d.ts +292 -0
  31. package/dist/kem-ot.js +559 -0
  32. package/dist/kem-ot.js.map +1 -0
  33. package/dist/mascot.d.ts +189 -0
  34. package/dist/mascot.js +322 -0
  35. package/dist/mascot.js.map +1 -0
  36. package/dist/ot.d.ts +212 -0
  37. package/dist/ot.js +536 -0
  38. package/dist/ot.js.map +1 -0
  39. package/dist/party.d.ts +38 -0
  40. package/dist/party.js +40 -0
  41. package/dist/party.js.map +1 -0
  42. package/dist/runner.d.ts +56 -0
  43. package/dist/runner.js +97 -0
  44. package/dist/runner.js.map +1 -0
  45. package/dist/sharing.d.ts +40 -0
  46. package/dist/sharing.js +97 -0
  47. package/dist/sharing.js.map +1 -0
  48. package/dist/spdz-runner.d.ts +50 -0
  49. package/dist/spdz-runner.js +107 -0
  50. package/dist/spdz-runner.js.map +1 -0
  51. package/dist/spdz.d.ts +136 -0
  52. package/dist/spdz.js +243 -0
  53. package/dist/spdz.js.map +1 -0
  54. package/dist/thermometer.d.ts +22 -0
  55. package/dist/thermometer.js +41 -0
  56. package/dist/thermometer.js.map +1 -0
  57. package/package.json +58 -3
package/dist/ec.js ADDED
@@ -0,0 +1,475 @@
1
+ "use strict";
2
+ /**
3
+ * A small, self-contained prime-order elliptic-curve group, used by the base oblivious transfer in
4
+ * `ot.ts`. The no-dealer offline phase (MASCOT-style triple generation) rests on real OT, and real OT
5
+ * rests on a real group with a hard discrete log — this module provides that group with nothing but
6
+ * BigInt arithmetic, so the whole stack stays dependency-free and testable in-process.
7
+ *
8
+ * Curve: **Ed25519** (twisted Edwards `−x² + y² = 1 + d·x²·y²` over `F_q`, `q = 2^255 − 19`). We work
9
+ * exclusively in the prime-order subgroup of order `L = 2^252 + 27742317777372353535851937790883648493`
10
+ * generated by the standard base point `B`, keeping every scalar in `[0, L)`; all group elements we
11
+ * ever form are scalar multiples of subgroup points, so they stay in the subgroup. Points are held in
12
+ * **extended coordinates** `(X, Y, Z, T)` with `x = X/Z`, `y = Y/Z`, `T = XY/Z`, and combined with the
13
+ * unified ("hwcd-3") addition law, which is *complete* on the subgroup — there are no special cases to
14
+ * branch on, which is exactly what keeps the implementation free of the subtle point-at-infinity bugs
15
+ * that plague short-Weierstrass code.
16
+ *
17
+ * SECURITY NOTES (prototype honesty, mirrored in docs §7.1):
18
+ * - **Point validation IS implemented** (`isOnCurve` / `hasPrimeOrder` / `assertInSubgroup`): every
19
+ * point a party RECEIVES across the OT trust boundary is validated to be on the curve and in the
20
+ * prime-order subgroup (cofactor check `[L]·P = O`), and non-identity, so a malicious party cannot
21
+ * inject an off-curve / small-order / mixed-order point to mount a small-subgroup attack. A
22
+ * `schnorrProve`/`schnorrVerify` NIZK of knowledge of the sender's discrete log `y` (`S = y·B`)
23
+ * binds `S` to a known exponent, which — with validation — is what makes the base OT malicious-secure.
24
+ * - **Constant-time: the secret-scalar multiplications now run in a constant-time WASM core by
25
+ * DEFAULT.** BigInt modular arithmetic branches on operand size and is not constant-time; rather than
26
+ * pretend otherwise, the security-critical ops (every secret-scalar multiply/point-combine: `mulBase`,
27
+ * `mul`, `add`, `sub`, `neg`, and the `[L]·P` cofactor ladder) are routed through `@atlasauth/pca-mpc-wasm`
28
+ * (a `curve25519-dalek` core compiled to WebAssembly) whenever it loads, which is the default. The
29
+ * pure-BigInt path below is retained verbatim as a graceful fallback for when the WASM core is
30
+ * unavailable, and is proven byte-for-byte equivalent to it (see the backend section and
31
+ * `ec-wasm.test.ts`). The remaining BigInt marshalling (point compress/decompress) operates on
32
+ * public point values, never the secret scalar, and is not claimed constant-time (docs §7.1).
33
+ * - Discrete log in the order-`L` subgroup is the hardness the OT's receiver-choice privacy relies on.
34
+ */
35
+ Object.defineProperty(exports, "__esModule", { value: true });
36
+ exports.PointValidationError = exports.BASE = exports.IDENTITY = exports.L = exports.Q = void 0;
37
+ exports.modFq = modFq;
38
+ exports.dbl = dbl;
39
+ exports.isWasmCurveActive = isWasmCurveActive;
40
+ exports.compressPoint = compressPoint;
41
+ exports.decompressPoint = decompressPoint;
42
+ exports.add = add;
43
+ exports.mul = mul;
44
+ exports.mulBase = mulBase;
45
+ exports.sub = sub;
46
+ exports.neg = neg;
47
+ exports.toAffine = toAffine;
48
+ exports.equal = equal;
49
+ exports.encodePoint = encodePoint;
50
+ exports.isOnCurve = isOnCurve;
51
+ exports.isIdentity = isIdentity;
52
+ exports.hasPrimeOrder = hasPrimeOrder;
53
+ exports.isInSubgroup = isInSubgroup;
54
+ exports.assertInSubgroup = assertInSubgroup;
55
+ exports.schnorrProve = schnorrProve;
56
+ exports.schnorrVerify = schnorrVerify;
57
+ const node_crypto_1 = require("node:crypto");
58
+ const node_module_1 = require("node:module");
59
+ const node_path_1 = require("node:path");
60
+ /** Field prime q = 2^255 − 19. */
61
+ exports.Q = 2n ** 255n - 19n;
62
+ /** Prime order of the base-point subgroup. Scalars live in [0, L). */
63
+ exports.L = 2n ** 252n + 27742317777372353535851937790883648493n;
64
+ // d = −121665 / 121666 (mod q).
65
+ const D = modFq(-121665n * invFq(121666n));
66
+ // √(−1) mod q = 2^((q−1)/4) (used by the point decompression that round-trips the WASM core's
67
+ // canonical 32-byte compressed encoding back into an extended-coordinate `Point`).
68
+ const SQRT_M1 = powFq(2n, (exports.Q - 1n) / 4n);
69
+ /** The identity (neutral) element, affine (0, 1). */
70
+ exports.IDENTITY = { X: 0n, Y: 1n, Z: 1n, T: 0n };
71
+ /** The standard Ed25519 base point B (a generator of the order-L subgroup). */
72
+ exports.BASE = fromAffine(15112221349535400772501151409588531511454012693041857206046113283949847762202n, 46316835694926478169428394003475163141307993866256225615783033603165251855960n);
73
+ /** Canonical representative in [0, q). */
74
+ function modFq(x) {
75
+ const r = x % exports.Q;
76
+ return r >= 0n ? r : r + exports.Q;
77
+ }
78
+ /** Modular inverse in F_q via Fermat (q prime): a^(q−2). */
79
+ function invFq(a) {
80
+ return powFq(modFq(a), exports.Q - 2n);
81
+ }
82
+ function powFq(base, exp) {
83
+ let b = modFq(base);
84
+ let e = exp;
85
+ let acc = 1n;
86
+ while (e > 0n) {
87
+ if (e & 1n)
88
+ acc = (acc * b) % exports.Q;
89
+ b = (b * b) % exports.Q;
90
+ e >>= 1n;
91
+ }
92
+ return acc;
93
+ }
94
+ function fromAffine(x, y) {
95
+ const X = modFq(x);
96
+ const Y = modFq(y);
97
+ return { X, Y, Z: 1n, T: modFq(X * Y) };
98
+ }
99
+ /**
100
+ * Unified complete addition (twisted Edwards a=−1, "add-2008-hwcd-3"). Works for P=Q too (so doubling
101
+ * is just `add(P, P)`), and is complete on the prime-order subgroup — no exceptional cases.
102
+ */
103
+ function addPure(p1, p2) {
104
+ const A = (modFq(p1.Y - p1.X) * modFq(p2.Y - p2.X)) % exports.Q;
105
+ const B = (modFq(p1.Y + p1.X) * modFq(p2.Y + p2.X)) % exports.Q;
106
+ const C = (((p1.T * 2n) % exports.Q) * D % exports.Q) * p2.T % exports.Q;
107
+ const Dd = (((p1.Z * 2n) % exports.Q) * p2.Z) % exports.Q;
108
+ const E = modFq(B - A);
109
+ const F = modFq(Dd - C);
110
+ const G = modFq(Dd + C);
111
+ const H = modFq(B + A);
112
+ return {
113
+ X: (E * F) % exports.Q,
114
+ Y: (G * H) % exports.Q,
115
+ T: (E * H) % exports.Q,
116
+ Z: (F * G) % exports.Q,
117
+ };
118
+ }
119
+ /**
120
+ * Dedicated doubling (twisted Edwards a=−1, "dbl-2008-hwcd") — cheaper than the unified add, used to
121
+ * speed up the scalar ladder. Complete on the subgroup.
122
+ */
123
+ function dbl(p) {
124
+ const A = (p.X * p.X) % exports.Q;
125
+ const B = (p.Y * p.Y) % exports.Q;
126
+ const C = (2n * ((p.Z * p.Z) % exports.Q)) % exports.Q;
127
+ const Dd = modFq(-A); // a·A with a = −1
128
+ const s = modFq(p.X + p.Y);
129
+ const E = modFq((s * s) % exports.Q - A - B);
130
+ const G = modFq(Dd + B);
131
+ const F = modFq(G - C);
132
+ const H = modFq(Dd - B);
133
+ return {
134
+ X: (E * F) % exports.Q,
135
+ Y: (G * H) % exports.Q,
136
+ T: (E * H) % exports.Q,
137
+ Z: (F * G) % exports.Q,
138
+ };
139
+ }
140
+ /** Scalar multiplication [k]P (double-and-add), pure-BigInt. k is reduced mod L; k=0 ⇒ identity. */
141
+ function mulPure(k, p) {
142
+ let e = k % exports.L;
143
+ if (e < 0n)
144
+ e += exports.L;
145
+ let acc = exports.IDENTITY;
146
+ let base = p;
147
+ while (e > 0n) {
148
+ if (e & 1n)
149
+ acc = addPure(acc, base);
150
+ base = dbl(base);
151
+ e >>= 1n;
152
+ }
153
+ return acc;
154
+ }
155
+ /** [k]·BASE, pure-BigInt. */
156
+ function mulBasePure(k) {
157
+ return mulPure(k, exports.BASE);
158
+ }
159
+ /** P − Q, pure-BigInt. */
160
+ function subPure(p1, p2) {
161
+ return addPure(p1, negPure(p2));
162
+ }
163
+ /** −P = (−X : Y : Z : −T), pure-BigInt. */
164
+ function negPure(p) {
165
+ return { X: modFq(-p.X), Y: p.Y, Z: p.Z, T: modFq(-p.T) };
166
+ }
167
+ /** `undefined` = not yet probed; `null` = probed and unavailable (use the pure fallback). */
168
+ let wasmBackend;
169
+ /** Narrow an opaque module to the `WasmCurve` surface without using `any` — every op must be present. */
170
+ function asWasmCurve(mod) {
171
+ if (typeof mod !== 'object' || mod === null)
172
+ return null;
173
+ const m = mod;
174
+ const needed = ['mulBase', 'mul', 'add', 'sub', 'neg', 'isOnCurve', 'isIdentity', 'isInSubgroup'];
175
+ for (const name of needed) {
176
+ if (typeof m[name] !== 'function')
177
+ return null;
178
+ }
179
+ return mod;
180
+ }
181
+ /**
182
+ * Lazily load the constant-time WASM curve core, once. Tries the resolved workspace dependency first,
183
+ * then the sibling package's built `dist` (the stable path whether this module runs from `src` under
184
+ * vitest or from `dist` after a build — `__dirname/../../pca-mpc-wasm/dist` is the same in both). Any
185
+ * failure (package missing, wasm cannot instantiate) is swallowed and pins the pure-BigInt fallback.
186
+ */
187
+ function wasmCurve() {
188
+ if (wasmBackend !== undefined)
189
+ return wasmBackend;
190
+ wasmBackend = null;
191
+ try {
192
+ const require = (0, node_module_1.createRequire)(__filename);
193
+ const candidates = [
194
+ '@atlasauth/pca-mpc-wasm',
195
+ (0, node_path_1.join)(__dirname, '..', '..', 'pca-mpc-wasm', 'dist', 'index.js'),
196
+ ];
197
+ for (const spec of candidates) {
198
+ try {
199
+ const loaded = asWasmCurve(require(spec));
200
+ if (loaded !== null) {
201
+ wasmBackend = loaded;
202
+ break;
203
+ }
204
+ }
205
+ catch {
206
+ // try the next candidate
207
+ }
208
+ }
209
+ }
210
+ catch {
211
+ wasmBackend = null;
212
+ }
213
+ return wasmBackend;
214
+ }
215
+ /** Whether the constant-time WASM curve backend is active (else the pure-BigInt path is in use). */
216
+ function isWasmCurveActive() {
217
+ return wasmCurve() !== null;
218
+ }
219
+ /**
220
+ * Canonical 32-byte compressed Ed25519 encoding of a point (little-endian `y`, sign of `x` in bit 255)
221
+ * — the wire form the WASM core speaks. Faithful for on-curve points; the matching inverse is
222
+ * `decompressPoint`.
223
+ */
224
+ function compressPoint(p) {
225
+ const { x, y } = toAffine(p);
226
+ const out = feBytes(y);
227
+ out[31] = (out[31] | (Number(x & 1n) << 7)) & 0xff;
228
+ return out;
229
+ }
230
+ /**
231
+ * Decode a canonical 32-byte compressed encoding back into an extended-coordinate `Point` (RFC 8032
232
+ * §5.1.3 x-recovery). Used to bring a WASM-core result back into the `Point` representation so the rest
233
+ * of `ec.ts`/`ot.ts` (affine encoding, KDF hashing, equality) sees byte-identical values to the pure
234
+ * path. Throws `PointValidationError` on a non-canonical / off-curve encoding.
235
+ */
236
+ function decompressPoint(bytes) {
237
+ if (bytes.length !== 32)
238
+ throw new PointValidationError('decompressPoint: expected 32 bytes');
239
+ const sign = (bytes[31] >> 7) & 1;
240
+ let y = 0n;
241
+ for (let i = 0; i < 32; i++)
242
+ y |= BigInt(bytes[i]) << BigInt(8 * i);
243
+ y &= (1n << 255n) - 1n; // clear the sign bit
244
+ if (y >= exports.Q)
245
+ throw new PointValidationError('decompressPoint: non-canonical y (≥ q)');
246
+ const y2 = modFq(y * y);
247
+ const u = modFq(y2 - 1n);
248
+ const v = modFq(D * y2 + 1n);
249
+ const v3 = modFq(modFq(v * v) * v);
250
+ const v7 = modFq(modFq(v3 * v3) * v);
251
+ let x = modFq(modFq(u * v3) * powFq(modFq(u * v7), (exports.Q - 5n) / 8n));
252
+ const vx2 = modFq(v * modFq(x * x));
253
+ if (vx2 === modFq(u)) {
254
+ // x is correct as-is
255
+ }
256
+ else if (vx2 === modFq(-u)) {
257
+ x = modFq(x * SQRT_M1);
258
+ }
259
+ else {
260
+ throw new PointValidationError('decompressPoint: not on curve');
261
+ }
262
+ if (x === 0n && sign === 1)
263
+ throw new PointValidationError('decompressPoint: non-canonical sign');
264
+ if (Number(x & 1n) !== sign)
265
+ x = modFq(exports.Q - x);
266
+ return fromAffine(x, y);
267
+ }
268
+ // --- Public group-op dispatchers: constant-time WASM core when loaded, pure BigInt otherwise. ---
269
+ /**
270
+ * Unified complete addition P + Q. Routes through the constant-time WASM core when available (inputs
271
+ * are on-curve points everywhere the OT stack calls this), else the pure-BigInt `add-2008-hwcd-3`.
272
+ */
273
+ function add(p1, p2) {
274
+ const w = wasmCurve();
275
+ if (w !== null)
276
+ return decompressPoint(w.add(compressPoint(p1), compressPoint(p2)));
277
+ return addPure(p1, p2);
278
+ }
279
+ /** Scalar multiplication [k]P (k reduced mod L; k=0 ⇒ identity). WASM core when available. */
280
+ function mul(k, p) {
281
+ const w = wasmCurve();
282
+ if (w !== null)
283
+ return decompressPoint(w.mul(k, compressPoint(p)));
284
+ return mulPure(k, p);
285
+ }
286
+ /** [k]·BASE. WASM core when available (the fixed-base secret-scalar multiply). */
287
+ function mulBase(k) {
288
+ const w = wasmCurve();
289
+ if (w !== null)
290
+ return decompressPoint(w.mulBase(k));
291
+ return mulBasePure(k);
292
+ }
293
+ /** P − Q. WASM core when available. */
294
+ function sub(p1, p2) {
295
+ const w = wasmCurve();
296
+ if (w !== null)
297
+ return decompressPoint(w.sub(compressPoint(p1), compressPoint(p2)));
298
+ return subPure(p1, p2);
299
+ }
300
+ /** −P. WASM core when available. */
301
+ function neg(p) {
302
+ const w = wasmCurve();
303
+ if (w !== null)
304
+ return decompressPoint(w.neg(compressPoint(p)));
305
+ return negPure(p);
306
+ }
307
+ /** Affine (x, y) of a point (one inversion). Identity ⇒ (0, 1). */
308
+ function toAffine(p) {
309
+ const zinv = invFq(p.Z);
310
+ return { x: modFq(p.X * zinv), y: modFq(p.Y * zinv) };
311
+ }
312
+ /** Whether two points are equal as group elements (compare in affine). */
313
+ function equal(p1, p2) {
314
+ // X1*Z2 == X2*Z1 and Y1*Z2 == Y2*Z1 (projective equality, no inversion).
315
+ return (modFq(p1.X * p2.Z) === modFq(p2.X * p1.Z) && modFq(p1.Y * p2.Z) === modFq(p2.Y * p1.Z));
316
+ }
317
+ /** 32-byte little-endian encoding of a field element (for hashing points deterministically). */
318
+ function feBytes(a) {
319
+ const out = new Uint8Array(32);
320
+ let v = modFq(a);
321
+ for (let i = 0; i < 32; i++) {
322
+ out[i] = Number(v & 0xffn);
323
+ v >>= 8n;
324
+ }
325
+ return out;
326
+ }
327
+ /** Canonical 64-byte encoding of a point (affine x‖y), the input to the OT key-derivation hash. */
328
+ function encodePoint(p) {
329
+ const { x, y } = toAffine(p);
330
+ const out = new Uint8Array(64);
331
+ out.set(feBytes(x), 0);
332
+ out.set(feBytes(y), 32);
333
+ return out;
334
+ }
335
+ // ==================================================================================================
336
+ // POINT VALIDATION (malicious-security hardening, docs §7.1 item b).
337
+ //
338
+ // A party must never trust a group element received from a (possibly malicious) peer. Three checks
339
+ // together reject every point that could enable a small-subgroup / invalid-curve attack:
340
+ // (1) on-curve: the extended coordinates satisfy the twisted-Edwards equation (and the T-invariant),
341
+ // (2) subgroup: [L]·P = O, the cofactor check — rejects small-order (order | 8) AND mixed-order
342
+ // points, so only genuine order-L (prime-order subgroup) points survive,
343
+ // (3) non-identity where the protocol forbids it (S = y·B with y = 0, or a degenerate R).
344
+ // These are wired into every OT point decode in `ot.ts`.
345
+ // ==================================================================================================
346
+ /** Raised when a received point fails on-curve / subgroup / identity validation. */
347
+ class PointValidationError extends Error {
348
+ constructor(message) {
349
+ super(message);
350
+ this.name = 'PointValidationError';
351
+ }
352
+ }
353
+ exports.PointValidationError = PointValidationError;
354
+ /**
355
+ * Scalar multiplication `[k]·P` WITHOUT the mod-L reduction that `mul` applies. `mul` reduces `k mod L`
356
+ * (correct for subgroup scalars, but it would turn `[L]·P` into `[0]·P = O` for every P and so cannot
357
+ * test subgroup membership). This raw ladder is used only by `hasPrimeOrder`.
358
+ */
359
+ function scalarMulRaw(k, p) {
360
+ let e = k < 0n ? -k : k;
361
+ let acc = exports.IDENTITY;
362
+ let base = p;
363
+ while (e > 0n) {
364
+ if (e & 1n)
365
+ acc = addPure(acc, base);
366
+ base = dbl(base);
367
+ e >>= 1n;
368
+ }
369
+ return acc;
370
+ }
371
+ /**
372
+ * Whether `p`'s extended coordinates lie on the Ed25519 curve. Checks projectively (no inversion):
373
+ * - `Z ≠ 0` (a valid projective point),
374
+ * - the T-invariant `T·Z ≡ X·Y`,
375
+ * - the twisted-Edwards equation (`a = −1`) cleared of denominators: `(Y² − X²)·Z² ≡ Z⁴ + d·X²·Y²`.
376
+ * An off-curve / malformed point fails here before any scalar work.
377
+ */
378
+ function isOnCurve(p) {
379
+ if (modFq(p.Z) === 0n)
380
+ return false;
381
+ if (modFq(p.T * p.Z) !== modFq(p.X * p.Y))
382
+ return false;
383
+ const X2 = modFq(p.X * p.X);
384
+ const Y2 = modFq(p.Y * p.Y);
385
+ const Z2 = modFq(p.Z * p.Z);
386
+ const lhs = modFq((Y2 - X2) * Z2);
387
+ const Z4 = modFq(Z2 * Z2);
388
+ const dxy = modFq(modFq(D * X2) * Y2);
389
+ const rhs = modFq(Z4 + dxy);
390
+ return lhs === rhs;
391
+ }
392
+ /** Whether `p` is the identity (neutral) element (affine `(0, 1)`). */
393
+ function isIdentity(p) {
394
+ return equal(p, exports.IDENTITY);
395
+ }
396
+ /**
397
+ * The cofactor check: whether `[L]·P = O`, i.e. `p` lies in the prime-order-`L` subgroup. For an
398
+ * on-curve point this is true iff `p` has order dividing `L`; since `L` is prime this means order `1`
399
+ * (identity) or order `L`. So on-curve ∧ `hasPrimeOrder` ∧ ¬identity ⟺ a genuine prime-order point.
400
+ * Rejects every small-order point (order | 8) and every mixed-order point (order `h·L`, `h | 8`, `h>1`).
401
+ */
402
+ function hasPrimeOrderPure(p) {
403
+ return equal(scalarMulRaw(exports.L, p), exports.IDENTITY);
404
+ }
405
+ /**
406
+ * The cofactor check `[L]·P = O`. When the constant-time WASM core is loaded, the `[L]·P` scalar work
407
+ * runs inside it (the point is compressed to its canonical 32-byte form — faithful for ON-curve points,
408
+ * which is the only case this is reached with in the validation flow — and the core's torsion check is
409
+ * exactly `[L]·P = O`); otherwise it falls back to the pure-BigInt raw ladder. Both agree bit-for-bit
410
+ * (the `[L]·P = O ⟺ torsion-free ∨ identity` equivalence), so the observable result is identical.
411
+ */
412
+ function hasPrimeOrder(p) {
413
+ const w = wasmCurve();
414
+ if (w !== null && isOnCurve(p)) {
415
+ const c = compressPoint(p);
416
+ // torsion-free ⟺ order 1 or L; include the identity explicitly so this matches the pure
417
+ // `[L]·O = O ⇒ true` semantics (the pure ladder returns true for the identity too).
418
+ return w.isInSubgroup(c) || w.isIdentity(c);
419
+ }
420
+ return hasPrimeOrderPure(p);
421
+ }
422
+ /** Whether `p` is a valid non-identity point of the prime-order subgroup (the OT point contract). */
423
+ function isInSubgroup(p) {
424
+ return isOnCurve(p) && !isIdentity(p) && hasPrimeOrder(p);
425
+ }
426
+ /** Assert `p` is a valid non-identity prime-order-subgroup point, else throw `PointValidationError`. */
427
+ function assertInSubgroup(p, label = 'point') {
428
+ if (!isOnCurve(p))
429
+ throw new PointValidationError(`${label}: not on curve`);
430
+ if (isIdentity(p))
431
+ throw new PointValidationError(`${label}: identity element (forbidden here)`);
432
+ if (!hasPrimeOrder(p)) {
433
+ throw new PointValidationError(`${label}: not in the prime-order subgroup (small-order/cofactor)`);
434
+ }
435
+ }
436
+ const TAG_SCHNORR = new TextEncoder().encode('atlas-pca-mpc/schnorr-dlog');
437
+ /** Fiat–Shamir challenge `e = H(tag ‖ B ‖ S ‖ U) mod L` (64 hash bytes ⇒ negligible modular bias). */
438
+ function schnorrChallenge(S, U) {
439
+ const d = (0, node_crypto_1.createHash)('sha512')
440
+ .update(TAG_SCHNORR)
441
+ .update(encodePoint(exports.BASE))
442
+ .update(encodePoint(S))
443
+ .update(encodePoint(U))
444
+ .digest();
445
+ let acc = 0n;
446
+ for (const b of d)
447
+ acc = (acc << 8n) | BigInt(b);
448
+ return acc % exports.L;
449
+ }
450
+ /** Prove knowledge of `y` with `S = y·B`. `rnd` draws the (secret) nonce `r ∈ [1, L)`. */
451
+ function schnorrProve(y, S, rnd) {
452
+ // The nonce must be a non-zero subgroup scalar; `rnd` already draws from [1, L), the guard is belt-and-braces.
453
+ let r = ((rnd() % exports.L) + exports.L) % exports.L;
454
+ if (r === 0n)
455
+ r = 1n;
456
+ const U = mulBase(r);
457
+ const e = schnorrChallenge(S, U);
458
+ let z = (r + e * (((y % exports.L) + exports.L) % exports.L)) % exports.L;
459
+ if (z < 0n)
460
+ z += exports.L;
461
+ return { U, z };
462
+ }
463
+ /**
464
+ * Verify a Schnorr proof for `S`: `z` is in range, `U` is a valid subgroup point, and `z·B = U + e·S`
465
+ * for the recomputed challenge `e`. Returns false on any failure (the OT layer turns that into an abort).
466
+ */
467
+ function schnorrVerify(S, proof) {
468
+ if (proof.z < 0n || proof.z >= exports.L)
469
+ return false;
470
+ if (!isInSubgroup(proof.U))
471
+ return false;
472
+ const e = schnorrChallenge(S, proof.U);
473
+ return equal(mulBase(proof.z), add(proof.U, mul(e, S)));
474
+ }
475
+ //# sourceMappingURL=ec.js.map
package/dist/ec.js.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"ec.js","sourceRoot":"","sources":["../src/ec.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;;;AAqCH,sBAGC;AAkDD,kBAgBC;AAiHD,8CAEC;AAOD,sCAKC;AAQD,0CAwBC;AAQD,kBAIC;AAGD,kBAIC;AAGD,0BAIC;AAGD,kBAIC;AAGD,kBAIC;AAGD,4BAGC;AAGD,sBAKC;AAcD,kCAMC;AA8CD,8BAWC;AAGD,gCAEC;AAmBD,sCASC;AAGD,oCAEC;AAGD,4CAMC;AAiCD,oCASC;AAMD,sCAKC;AA9eD,6CAAyC;AACzC,6CAA4C;AAC5C,yCAAiC;AAEjC,kCAAkC;AACrB,QAAA,CAAC,GAAG,EAAE,IAAI,IAAI,GAAG,GAAG,CAAC;AAElC,sEAAsE;AACzD,QAAA,CAAC,GAAG,EAAE,IAAI,IAAI,GAAG,uCAAuC,CAAC;AAEtE,gCAAgC;AAChC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;AAE3C,8FAA8F;AAC9F,mFAAmF;AACnF,MAAM,OAAO,GAAG,KAAK,CAAC,EAAE,EAAE,CAAC,SAAC,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;AAUzC,qDAAqD;AACxC,QAAA,QAAQ,GAAU,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC;AAE9D,+EAA+E;AAClE,QAAA,IAAI,GAAU,UAAU,CACnC,8EAA8E,EAC9E,8EAA8E,CAC/E,CAAC;AAEF,0CAA0C;AAC1C,SAAgB,KAAK,CAAC,CAAS;IAC7B,MAAM,CAAC,GAAG,CAAC,GAAG,SAAC,CAAC;IAChB,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,SAAC,CAAC;AAC7B,CAAC;AAED,4DAA4D;AAC5D,SAAS,KAAK,CAAC,CAAS;IACtB,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,SAAC,GAAG,EAAE,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,KAAK,CAAC,IAAY,EAAE,GAAW;IACtC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IACpB,IAAI,CAAC,GAAG,GAAG,CAAC;IACZ,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC;QACd,IAAI,CAAC,GAAG,EAAE;YAAE,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,SAAC,CAAC;QAChC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,SAAC,CAAC;QAChB,CAAC,KAAK,EAAE,CAAC;IACX,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,UAAU,CAAC,CAAS,EAAE,CAAS;IACtC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACnB,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACnB,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;AAC1C,CAAC;AAED;;;GAGG;AACH,SAAS,OAAO,CAAC,EAAS,EAAE,EAAS;IACnC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,SAAC,CAAC;IACxD,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,SAAC,CAAC;IACxD,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,SAAC,CAAC,GAAG,CAAC,GAAG,SAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,SAAC,CAAC;IACjD,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,SAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,SAAC,CAAC;IAC1C,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,MAAM,CAAC,GAAG,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACxB,MAAM,CAAC,GAAG,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACxB,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,OAAO;QACL,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,SAAC;QACd,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,SAAC;QACd,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,SAAC;QACd,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,SAAC;KACf,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAgB,GAAG,CAAC,CAAQ;IAC1B,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,SAAC,CAAC;IAC1B,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,SAAC,CAAC;IAC1B,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,SAAC,CAAC,CAAC,GAAG,SAAC,CAAC;IACvC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,kBAAkB;IACxC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,SAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,MAAM,CAAC,GAAG,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACxB,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,MAAM,CAAC,GAAG,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACxB,OAAO;QACL,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,SAAC;QACd,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,SAAC;QACd,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,SAAC;QACd,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,SAAC;KACf,CAAC;AACJ,CAAC;AAED,oGAAoG;AACpG,SAAS,OAAO,CAAC,CAAS,EAAE,CAAQ;IAClC,IAAI,CAAC,GAAG,CAAC,GAAG,SAAC,CAAC;IACd,IAAI,CAAC,GAAG,EAAE;QAAE,CAAC,IAAI,SAAC,CAAC;IACnB,IAAI,GAAG,GAAG,gBAAQ,CAAC;IACnB,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC;QACd,IAAI,CAAC,GAAG,EAAE;YAAE,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACrC,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC,KAAK,EAAE,CAAC;IACX,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,6BAA6B;AAC7B,SAAS,WAAW,CAAC,CAAS;IAC5B,OAAO,OAAO,CAAC,CAAC,EAAE,YAAI,CAAC,CAAC;AAC1B,CAAC;AAED,0BAA0B;AAC1B,SAAS,OAAO,CAAC,EAAS,EAAE,EAAS;IACnC,OAAO,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;AAClC,CAAC;AAED,2CAA2C;AAC3C,SAAS,OAAO,CAAC,CAAQ;IACvB,OAAO,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5D,CAAC;AAqCD,6FAA6F;AAC7F,IAAI,WAAyC,CAAC;AAE9C,yGAAyG;AACzG,SAAS,WAAW,CAAC,GAAY;IAC/B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,MAAM,MAAM,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC;IAClG,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAC1B,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,UAAU;YAAE,OAAO,IAAI,CAAC;IACjD,CAAC;IACD,OAAO,GAAgB,CAAC;AAC1B,CAAC;AAED;;;;;GAKG;AACH,SAAS,SAAS;IAChB,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,WAAW,CAAC;IAClD,WAAW,GAAG,IAAI,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAA,2BAAa,EAAC,UAAU,CAAC,CAAC;QAC1C,MAAM,UAAU,GAAG;YACjB,yBAAyB;YACzB,IAAA,gBAAI,EAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,UAAU,CAAC;SAChE,CAAC;QACF,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC1C,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;oBACpB,WAAW,GAAG,MAAM,CAAC;oBACrB,MAAM;gBACR,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,yBAAyB;YAC3B,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,WAAW,GAAG,IAAI,CAAC;IACrB,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,oGAAoG;AACpG,SAAgB,iBAAiB;IAC/B,OAAO,SAAS,EAAE,KAAK,IAAI,CAAC;AAC9B,CAAC;AAED;;;;GAIG;AACH,SAAgB,aAAa,CAAC,CAAQ;IACpC,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC7B,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACvB,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAE,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IACpD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,SAAgB,eAAe,CAAC,KAAiB;IAC/C,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,IAAI,oBAAoB,CAAC,oCAAoC,CAAC,CAAC;IAC9F,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,CAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE;QAAE,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACrE,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,qBAAqB;IAC7C,IAAI,CAAC,IAAI,SAAC;QAAE,MAAM,IAAI,oBAAoB,CAAC,wCAAwC,CAAC,CAAC;IACrF,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,MAAM,CAAC,GAAG,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;IACzB,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7B,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,SAAC,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACnE,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACpC,IAAI,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACrB,qBAAqB;IACvB,CAAC;SAAM,IAAI,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC;IACzB,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,oBAAoB,CAAC,+BAA+B,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,CAAC,KAAK,EAAE,IAAI,IAAI,KAAK,CAAC;QAAE,MAAM,IAAI,oBAAoB,CAAC,qCAAqC,CAAC,CAAC;IAClG,IAAI,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI;QAAE,CAAC,GAAG,KAAK,CAAC,SAAC,GAAG,CAAC,CAAC,CAAC;IAC9C,OAAO,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC1B,CAAC;AAED,mGAAmG;AAEnG;;;GAGG;AACH,SAAgB,GAAG,CAAC,EAAS,EAAE,EAAS;IACtC,MAAM,CAAC,GAAG,SAAS,EAAE,CAAC;IACtB,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACpF,OAAO,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AACzB,CAAC;AAED,8FAA8F;AAC9F,SAAgB,GAAG,CAAC,CAAS,EAAE,CAAQ;IACrC,MAAM,CAAC,GAAG,SAAS,EAAE,CAAC;IACtB,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,OAAO,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACvB,CAAC;AAED,kFAAkF;AAClF,SAAgB,OAAO,CAAC,CAAS;IAC/B,MAAM,CAAC,GAAG,SAAS,EAAE,CAAC;IACtB,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC;AACxB,CAAC;AAED,uCAAuC;AACvC,SAAgB,GAAG,CAAC,EAAS,EAAE,EAAS;IACtC,MAAM,CAAC,GAAG,SAAS,EAAE,CAAC;IACtB,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACpF,OAAO,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AACzB,CAAC;AAED,oCAAoC;AACpC,SAAgB,GAAG,CAAC,CAAQ;IAC1B,MAAM,CAAC,GAAG,SAAS,EAAE,CAAC;IACtB,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChE,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC;AAED,mEAAmE;AACnE,SAAgB,QAAQ,CAAC,CAAQ;IAC/B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxB,OAAO,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC;AACxD,CAAC;AAED,0EAA0E;AAC1E,SAAgB,KAAK,CAAC,EAAS,EAAE,EAAS;IACxC,yEAAyE;IACzE,OAAO,CACL,KAAK,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CACvF,CAAC;AACJ,CAAC;AAED,gGAAgG;AAChG,SAAS,OAAO,CAAC,CAAS;IACxB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC/B,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;QAC3B,CAAC,KAAK,EAAE,CAAC;IACX,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,mGAAmG;AACnG,SAAgB,WAAW,CAAC,CAAQ;IAClC,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC7B,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC/B,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACvB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACxB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,qGAAqG;AACrG,qEAAqE;AACrE,EAAE;AACF,mGAAmG;AACnG,yFAAyF;AACzF,yGAAyG;AACzG,oGAAoG;AACpG,2FAA2F;AAC3F,4FAA4F;AAC5F,yDAAyD;AACzD,qGAAqG;AAErG,oFAAoF;AACpF,MAAa,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AALD,oDAKC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,CAAS,EAAE,CAAQ;IACvC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxB,IAAI,GAAG,GAAG,gBAAQ,CAAC;IACnB,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC;QACd,IAAI,CAAC,GAAG,EAAE;YAAE,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACrC,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC,KAAK,EAAE,CAAC;IACX,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,SAAS,CAAC,CAAQ;IAChC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IACpC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACxD,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;IAClC,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1B,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,KAAK,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC;IAC5B,OAAO,GAAG,KAAK,GAAG,CAAC;AACrB,CAAC;AAED,uEAAuE;AACvE,SAAgB,UAAU,CAAC,CAAQ;IACjC,OAAO,KAAK,CAAC,CAAC,EAAE,gBAAQ,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,CAAQ;IACjC,OAAO,KAAK,CAAC,YAAY,CAAC,SAAC,EAAE,CAAC,CAAC,EAAE,gBAAQ,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,aAAa,CAAC,CAAQ;IACpC,MAAM,CAAC,GAAG,SAAS,EAAE,CAAC;IACtB,IAAI,CAAC,KAAK,IAAI,IAAI,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;QAC3B,wFAAwF;QACxF,oFAAoF;QACpF,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,qGAAqG;AACrG,SAAgB,YAAY,CAAC,CAAQ;IACnC,OAAO,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,wGAAwG;AACxG,SAAgB,gBAAgB,CAAC,CAAQ,EAAE,KAAK,GAAG,OAAO;IACxD,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,oBAAoB,CAAC,GAAG,KAAK,gBAAgB,CAAC,CAAC;IAC5E,IAAI,UAAU,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,oBAAoB,CAAC,GAAG,KAAK,qCAAqC,CAAC,CAAC;IACjG,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,oBAAoB,CAAC,GAAG,KAAK,0DAA0D,CAAC,CAAC;IACrG,CAAC;AACH,CAAC;AAiBD,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,4BAA4B,CAAC,CAAC;AAE3E,sGAAsG;AACtG,SAAS,gBAAgB,CAAC,CAAQ,EAAE,CAAQ;IAC1C,MAAM,CAAC,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC;SAC3B,MAAM,CAAC,WAAW,CAAC;SACnB,MAAM,CAAC,WAAW,CAAC,YAAI,CAAC,CAAC;SACzB,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;SACtB,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;SACtB,MAAM,EAAE,CAAC;IACZ,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,CAAC;QAAE,GAAG,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACjD,OAAO,GAAG,GAAG,SAAC,CAAC;AACjB,CAAC;AAED,0FAA0F;AAC1F,SAAgB,YAAY,CAAC,CAAS,EAAE,CAAQ,EAAE,GAAiB;IACjE,+GAA+G;IAC/G,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,SAAC,CAAC,GAAG,SAAC,CAAC,GAAG,SAAC,CAAC;IAC9B,IAAI,CAAC,KAAK,EAAE;QAAE,CAAC,GAAG,EAAE,CAAC;IACrB,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACrB,MAAM,CAAC,GAAG,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACjC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,SAAC,CAAC,GAAG,SAAC,CAAC,GAAG,SAAC,CAAC,CAAC,GAAG,SAAC,CAAC;IAC1C,IAAI,CAAC,GAAG,EAAE;QAAE,CAAC,IAAI,SAAC,CAAC;IACnB,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,SAAgB,aAAa,CAAC,CAAQ,EAAE,KAAmB;IACzD,IAAI,KAAK,CAAC,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC,CAAC,IAAI,SAAC;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,MAAM,CAAC,GAAG,gBAAgB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IACvC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1D,CAAC"}