@atlasauth/pca-mpc 0.0.0-stage → 0.2.0

package/dist/kem-ot.js

@@ -0,0 +1,559 @@
+"use strict";
+/**
+ * Post-quantum base OT from ML-KEM — a 1-of-2 oblivious transfer whose hardness rests on Module-LWE
+ * (ML-KEM-768, FIPS 203) instead of the curve25519 discrete log. This is the end-game plan's P3
+ * ("KEM-based OT from ML-KEM") so the MPC base OT no longer has a classical, quantum-breakable root.
+ *
+ * ─── THE CONSTRUCTION (be precise and honest) ──────────────────────────────────────────────────────
+ * This is the folklore semi-honest 1-of-2 OT from a key-encapsulation mechanism — the "dual-public-key
+ * KEM-OT" (closely related to endemic/Masny–Rindal-style OT, but WITHOUT any oblivious-key derivation):
+ *
+ *   RECEIVER, choice bit c, per transfer:
+ *     • generates TWO *real* ML-KEM keypairs, (pk_c, sk_c) and (pk', sk');
+ *     • places pk_c at wire index c and pk' at wire index 1−c, and sends the ordered pair (pk_0, pk_1);
+ *     • KEEPS sk_c and DISCARDS the other secret sk' (this discard is the whole semi-honest assumption).
+ *   SENDER, messages (m_0, m_1), per transfer:
+ *     • encapsulates under each received key: (ct_b, ss_b) ← Encaps(pk_b) for b ∈ {0,1};
+ *     • one-time-pads each message under a random-oracle key: E_b = m_b ⊕ H(b ‖ ss_b), and sends
+ *       (ct_0, E_0), (ct_1, E_1).
+ *   RECEIVER recovers ONLY m_c:  ss_c ← Decaps(ct_c, sk_c); m_c = E_c ⊕ H(c ‖ ss_c).
+ *   It cannot recover m_{1−c}: it discarded sk_{1−c}, so ss_{1−c} is hidden by ML-KEM IND-CCA security
+ *   and H(1−c ‖ ss_{1−c}) is a pseudorandom pad.
+ *
+ * ─── WHY *THIS* CONSTRUCTION (soundness) ───────────────────────────────────────────────────────────
+ * A tempting alternative is an "oblivious public key": derive pk_{1−c} by HASHING some public value so
+ * the receiver provably cannot invert it. That is sound for group-based KEMs where a public key is a
+ * group element you can hash-to. It is NOT soundly implementable for ML-KEM with the primitive we have:
+ * an ML-KEM public key is a structured Module-LWE object (a matrix seed ρ plus t = A·s + e); a hash
+ * output is not a valid encapsulation target, and there is no black-box "hash → valid pk whose secret is
+ * unknown-to-everyone" for ML-KEM without a trusted setup or a specialised lattice gadget. Rolling one
+ * by hand would be exactly the hand-rolled lattice crypto this module forbids. So we use the two-real-
+ * keypairs/discard-one-secret variant, which is sound with `ml_kem768` as an opaque IND-CCA KEM.
+ *
+ * ─── SECURITY MODEL (exactly what is and is not achieved) ──────────────────────────────────────────
+ *   • Receiver-choice privacy — UNCONDITIONAL, and holds even against a *malicious* sender. The wire
+ *     message (pk_0, pk_1) is two i.i.d. honest ML-KEM public keys; the choice c only decides which
+ *     secret the receiver keeps *locally*. The two orderings are therefore identically distributed, so
+ *     the sender's view is independent of c with probability 1 (no assumption, no abort needed).
+ *   • Sender privacy (receiver learns nothing about m_{1−c}) — SEMI-HONEST only, under ML-KEM IND-CCA
+ *     security + H modelled as a random oracle. An honest-but-curious receiver discards sk_{1−c}; given
+ *     only pk_{1−c} and ct_{1−c} it cannot distinguish ss_{1−c} from random (IND-CCA), so the pad hides
+ *     m_{1−c}. A MALICIOUS receiver that *keeps both* secrets learns BOTH messages — this base OT does
+ *     not stop that by itself.
+ *   • POST-QUANTUM: both guarantees are PQ. Choice privacy is information-theoretic; sender privacy
+ *     rests on Module-LWE (ML-KEM-768, NIST security level ~3) and a hash in the ROM — no classical
+ *     discrete-log anywhere, which is the entire point of P3.
+ *
+ * ─── MALICIOUS-RECEIVER HARDENING (`kemBaseOtMal`, below) ──────────────────────────────────────────
+ * The semi-honest base OT above leaves two malicious-receiver surfaces. The committed variant
+ * `kemBaseOtMal` closes the one that CAN be closed from an opaque KEM, and documents — precisely,
+ * rather than faking a defence — the one that cannot:
+ *
+ *   CLOSED (by an RO-commitment + session binding, mirroring the EC `baseOT`'s commit round):
+ *     • ADAPTIVE / MALLEABLE / REPLAYED key material. The receiver first sends only a RO-commitment
+ *       `com = H(rn ‖ pk_0 ‖ pk_1)` to its ordered public keys (and a receiver nonce `rn`); the sender
+ *       replies with a fresh nonce `sn`; the parties set `sid = H(rn ‖ sn)`; only THEN does the receiver
+ *       open `(pk_0, pk_1)` and the sender encapsulate, binding every pad to `(sid, com)`. The sender
+ *       recomputes `com` from the opened keys and ABORTS on any mismatch. So the receiver must fix its
+ *       keys BEFORE it learns `sn` (no adaptive/precomputed/related-key choice, no cross-session replay),
+ *       and cannot open keys other than the ones it committed to — exactly the non-malleability the EC
+ *       base OT gets from `R` being a single committed group element.
+ *
+ *   NOT CLOSABLE from an OPAQUE ML-KEM, and WHY (an impossibility, not a shortcut):
+ *     • A receiver that simply runs keygen TWICE and keeps BOTH secret keys learns both messages. To
+ *       stop it the protocol would have to force one slot to a public key whose secret NOBODY knows
+ *       (the Masny–Rindal "endemic OT" idea: `pk_{1−c}` derived in the public-key space from a random
+ *       oracle / a common reference). That needs either (i) sampling / adding in ML-KEM's structured
+ *       public-key space — reaching into the Module-LWE internals this module forbids (no hand-rolled
+ *       lattice crypto), or (ii) a trusted setup / CRS. Crucially, the SAME decisional-Module-LWE
+ *       indistinguishability that makes choice privacy hold (a real `pk` ≈ a uniform one) is what makes
+ *       a cheating "both-keys-real" receiver UNDETECTABLE to the sender: it cannot tell a secretless
+ *       slot from a real one. So this residue is intrinsic to the opaque primitive.
+ *
+ * ─── LIFTING THE RESIDUE (how this plugs into the stack) ───────────────────────────────────────────
+ * The residue is closed exactly where the EC stack closes its analogue: the KOS OT-extension (`ot.ts`).
+ * KOS runs the base OTs with ROLES INVERTED (the extension *sender* is the base *receiver*, holding the
+ * secret selector s) and adds the correlation check over sacrifice rows. A base receiver keeping both
+ * secrets maps to the extension *sender* learning the extension *receiver*'s seed pairs; the KOS
+ * consistency machinery + correlation-robust hash constrain that, raising the overall extension to
+ * malicious-with-abort against a cheating extension receiver — the attack IKNP is vulnerable to. So
+ * `kemBaseOtMal` is the right base layer: it hardens everything the opaque KEM allows (commitment /
+ * binding), and defers only the intrinsic residue to the layer that already handles it.
+ *
+ * No hand-rolled lattice crypto: all PQ operations go through `ml_kem768` (keygen/encapsulate/
+ * decapsulate) as a black box. Randomness follows the module policy — a CSPRNG (`secureOtRandom`) by
+ * default, a seeded deterministic stream ONLY when a test passes one.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KEM_OT_SECRET_BYTES = exports.KemBaseOtAbort = void 0;
+exports.kemOtPad = kemOtPad;
+exports.kemBaseOtReceive = kemBaseOtReceive;
+exports.kemBaseOtSend = kemBaseOtSend;
+exports.kemBaseOtOpen = kemBaseOtOpen;
+exports.kemBaseOT = kemBaseOT;
+exports.withKemBaseOt = withKemBaseOt;
+exports.kemBaseOtMalCommit = kemBaseOtMalCommit;
+exports.kemBaseOtMalSenderNonce = kemBaseOtMalSenderNonce;
+exports.kemBaseOtMalOpen = kemBaseOtMalOpen;
+exports.kemBaseOtMalSend = kemBaseOtMalSend;
+exports.kemBaseOtMalRecover = kemBaseOtMalRecover;
+exports.kemBaseOtMal = kemBaseOtMal;
+exports.withKemBaseOtMal = withKemBaseOtMal;
+exports.kemBaseOtMalRandomSend = kemBaseOtMalRandomSend;
+exports.kemBaseOtMalRandomRecover = kemBaseOtMalRandomRecover;
+exports.kemBaseOtMalRandom = kemBaseOtMalRandom;
+const node_crypto_1 = require("node:crypto");
+const ml_kem_js_1 = require("@noble/post-quantum/ml-kem.js");
+const csprng_1 = require("./csprng");
+/** Bytes of fresh randomness fed to ML-KEM keygen (d ‖ z, FIPS 203). */
+const KEYGEN_SEED_BYTES = 64;
+/** Bytes of fresh randomness fed to ML-KEM encapsulation (the message m, FIPS 203). */
+const ENCAPS_MSG_BYTES = ml_kem_js_1.ml_kem768.msgLen; // 32
+const TAG_KEMOT = new TextEncoder().encode('atlas-pca-mpc/kem-ot-pad');
+function sha256(...chunks) {
+    const h = (0, node_crypto_1.createHash)('sha256');
+    for (const c of chunks)
+        h.update(c);
+    return new Uint8Array(h.digest());
+}
+function u32(x) {
+    const b = new Uint8Array(4);
+    b[0] = (x >>> 24) & 0xff;
+    b[1] = (x >>> 16) & 0xff;
+    b[2] = (x >>> 8) & 0xff;
+    b[3] = x & 0xff;
+    return b;
+}
+/** XOR two equal-length byte arrays into a fresh array. */
+function xorBytes(a, b) {
+    if (a.length !== b.length)
+        throw new Error('kem-ot: XOR length mismatch');
+    const out = new Uint8Array(a.length);
+    for (let i = 0; i < a.length; i++)
+        out[i] = a[i] ^ b[i];
+    return out;
+}
+/**
+ * The random-oracle pad for one slot: `H(TAG ‖ i ‖ b ‖ sharedSecret)` expanded (SHA-256 counter mode)
+ * to exactly `len` bytes. `i` binds the transfer index and `b` the slot, so the two pads of one transfer
+ * — and the pads across transfers — are domain-separated.
+ */
+function kemOtPad(index, slot, sharedSecret, len) {
+    const out = new Uint8Array(len);
+    let produced = 0;
+    let ctr = 0;
+    while (produced < len) {
+        const block = sha256(TAG_KEMOT, u32(index), Uint8Array.of(slot & 1), u32(ctr), sharedSecret);
+        for (let k = 0; k < block.length && produced < len; k++)
+            out[produced++] = block[k];
+        ctr++;
+    }
+    return out;
+}
+/**
+ * RECEIVER round 1: for each choice bit, generate two real ML-KEM keypairs, send both public keys
+ * (chosen one at wire index `c`), and retain only the chosen secret key. Returns the wire message AND
+ * the retained receiver state.
+ */
+function kemBaseOtReceive(choices, rng = (0, csprng_1.secureOtRandom)()) {
+    const publicKeys = [];
+    const secretKeys = [];
+    const retainedChoices = [];
+    for (let i = 0; i < choices.length; i++) {
+        const c = choices[i] & 1;
+        const chosen = ml_kem_js_1.ml_kem768.keygen(rng.bytes(KEYGEN_SEED_BYTES));
+        const other = ml_kem_js_1.ml_kem768.keygen(rng.bytes(KEYGEN_SEED_BYTES));
+        // Place the chosen public key at wire index c; the other at 1−c. The order is the only thing the
+        // sender sees, and both keys are i.i.d. honest keygen outputs, so it reveals nothing about c.
+        const pk0 = c === 0 ? chosen.publicKey : other.publicKey;
+        const pk1 = c === 0 ? other.publicKey : chosen.publicKey;
+        publicKeys.push([pk0, pk1]);
+        // Keep only the chosen secret; `other.secretKey` is deliberately dropped (never stored).
+        secretKeys.push(chosen.secretKey);
+        retainedChoices.push(c);
+    }
+    return { message: { publicKeys }, state: { choices: retainedChoices, secretKeys } };
+}
+/**
+ * SENDER round: encapsulate under each received public key and one-time-pad each message under
+ * `H(slot ‖ sharedSecret)`. `messages[i] = [m_0, m_1]`; the two messages of one transfer must be equal
+ * length (padding is derived to that length). Returns the sender wire message.
+ */
+function kemBaseOtSend(messages, receiverMessage, rng = (0, csprng_1.secureOtRandom)()) {
+    const { publicKeys } = receiverMessage;
+    if (messages.length !== publicKeys.length) {
+        throw new Error('kemBaseOtSend: messages/publicKeys length mismatch');
+    }
+    const ciphertexts = [];
+    const encrypted = [];
+    for (let i = 0; i < messages.length; i++) {
+        const [m0, m1] = messages[i];
+        if (m0.length !== m1.length) {
+            throw new Error(`kemBaseOtSend (index ${i}): the two messages must be equal length`);
+        }
+        const [pk0, pk1] = publicKeys[i];
+        // ml_kem768.encapsulate derandomised with fresh bytes so a seeded test stays reproducible.
+        const e0 = ml_kem_js_1.ml_kem768.encapsulate(pk0, rng.bytes(ENCAPS_MSG_BYTES));
+        const e1 = ml_kem_js_1.ml_kem768.encapsulate(pk1, rng.bytes(ENCAPS_MSG_BYTES));
+        ciphertexts.push([e0.cipherText, e1.cipherText]);
+        encrypted.push([
+            xorBytes(m0, kemOtPad(i, 0, e0.sharedSecret, m0.length)),
+            xorBytes(m1, kemOtPad(i, 1, e1.sharedSecret, m1.length)),
+        ]);
+    }
+    return { ciphertexts, encrypted };
+}
+/**
+ * RECEIVER recovery: decapsulate ONLY the chosen ciphertext with the retained secret key and unmask the
+ * chosen message. The receiver never touches the non-chosen slot (it has no secret for it). Returns
+ * `received[i] = m_{i, choices[i]}`.
+ */
+function kemBaseOtOpen(state, senderMessage) {
+    const { choices, secretKeys } = state;
+    const { ciphertexts, encrypted } = senderMessage;
+    if (ciphertexts.length !== choices.length || encrypted.length !== choices.length) {
+        throw new Error('kemBaseOtOpen: transcript/state length mismatch');
+    }
+    const received = [];
+    for (let i = 0; i < choices.length; i++) {
+        const c = choices[i] & 1;
+        const ss = ml_kem_js_1.ml_kem768.decapsulate(ciphertexts[i][c], secretKeys[i]);
+        const e = encrypted[i][c];
+        received.push(xorBytes(e, kemOtPad(i, c, ss, e.length)));
+    }
+    return received;
+}
+/**
+ * In-process combined simulator (both parties in one call), matching the shape of `baseOT` in `ot.ts`:
+ * run `count = choices.length` KEM base OTs and return the receiver's recovered messages plus the full
+ * transcript. This is the drop-in the KOS extension consumes (see `OtChannel`'s `baseOtFn` option).
+ */
+function kemBaseOT(messages, choices, rng = (0, csprng_1.secureOtRandom)()) {
+    if (messages.length !== choices.length) {
+        throw new Error('kemBaseOT: messages/choices length mismatch');
+    }
+    const { message: receiverMessage, state } = kemBaseOtReceive(choices, rng);
+    const senderMessage = kemBaseOtSend(messages, receiverMessage, rng);
+    const received = kemBaseOtOpen(state, senderMessage);
+    return {
+        received,
+        transcript: {
+            publicKeys: receiverMessage.publicKeys,
+            ciphertexts: senderMessage.ciphertexts,
+            encrypted: senderMessage.encrypted,
+        },
+    };
+}
+/**
+ * Wire the ML-KEM base OT into the existing KOS OT-extension: returns the constructor option bag for
+ * `OtChannel` that makes it run its κ setup base OTs over `kemBaseOT` (post-quantum) instead of the
+ * classical EC Chou–Orlandi `baseOT`. Everything above the base OT (the IKNP matrix, the KOS correlation
+ * check, the correlation-robust hash) is unchanged.
+ *
+ *   const ch = new OtChannel(secureOtRandom(), withKemBaseOt());
+ */
+function withKemBaseOt() {
+    return { baseOtFn: kemBaseOT };
+}
+// ===================================================================================================
+// MALICIOUS-RECEIVER HARDENING: the committed, session-bound KEM base OT (`kemBaseOtMal`).
+//
+// See the module header for the exact security model. In one line: an RO-commitment to the ordered
+// public keys + a two-nonce session id bind the receiver's key material (commit-BEFORE the sender's
+// nonce, open AFTER), and the sender aborts if the opened keys do not match the commitment — closing
+// the adaptive / malleable / replay surfaces. The intrinsic "keep both secrets" residue is deferred to
+// the KOS extension, as the header and tests document.
+// ===================================================================================================
+const TAG_KEMOT_COMMIT = new TextEncoder().encode('atlas-pca-mpc/kem-ot-commit');
+const TAG_KEMOT_SID = new TextEncoder().encode('atlas-pca-mpc/kem-ot-sid');
+const TAG_KEMOT_MALPAD = new TextEncoder().encode('atlas-pca-mpc/kem-ot-mal-pad');
+/** Bytes of a protocol nonce (receiver `rn`, sender `sn`). */
+const NONCE_BYTES = 32;
+/** Raised when the committed KEM base OT aborts: a cheating receiver (opened keys ≠ commitment) is caught. */
+class KemBaseOtAbort extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'KemBaseOtAbort';
+    }
+}
+exports.KemBaseOtAbort = KemBaseOtAbort;
+/** The RO-commitment to one transfer's ordered public keys, bound to the receiver nonce `rn`. */
+function kemMalCommit(rn, index, pk0, pk1) {
+    return sha256(TAG_KEMOT_COMMIT, rn, u32(index), pk0, pk1);
+}
+/** The session id `sid = H(TAG ‖ rn ‖ sn)` — both parties' nonces, so neither alone fixes it. */
+function kemMalSid(rn, sn) {
+    return sha256(TAG_KEMOT_SID, rn, sn);
+}
+/**
+ * The malicious-variant RO pad: `H(TAG ‖ sid ‖ com ‖ i ‖ slot ‖ ss)` expanded to `len` bytes. Binding
+ * the pad to `(sid, com)` ties the sender's encryption to the exact committed keys and this session, so
+ * a receiver that opens different keys (or replays another session) cannot unmask the message.
+ */
+function kemOtMalPad(sid, com, index, slot, sharedSecret, len) {
+    const out = new Uint8Array(len);
+    let produced = 0;
+    let ctr = 0;
+    while (produced < len) {
+        const block = sha256(TAG_KEMOT_MALPAD, sid, com, u32(index), Uint8Array.of(slot & 1), u32(ctr), sharedSecret);
+        for (let k = 0; k < block.length && produced < len; k++)
+            out[produced++] = block[k];
+        ctr++;
+    }
+    return out;
+}
+/**
+ * RECEIVER round 1: generate the keypairs (keeping only the chosen secret), draw a nonce `rn`, and send
+ * only the COMMITMENTS to the ordered public keys. Returns the round-1 wire message plus the retained
+ * state (which holds the not-yet-revealed public keys for the round-3 opening).
+ */
+function kemBaseOtMalCommit(choices, rng = (0, csprng_1.secureOtRandom)()) {
+    const rn = rng.bytes(NONCE_BYTES);
+    const publicKeys = [];
+    const secretKeys = [];
+    const retainedChoices = [];
+    const commitments = [];
+    for (let i = 0; i < choices.length; i++) {
+        const c = choices[i] & 1;
+        const chosen = ml_kem_js_1.ml_kem768.keygen(rng.bytes(KEYGEN_SEED_BYTES));
+        const other = ml_kem_js_1.ml_kem768.keygen(rng.bytes(KEYGEN_SEED_BYTES));
+        const pk0 = c === 0 ? chosen.publicKey : other.publicKey;
+        const pk1 = c === 0 ? other.publicKey : chosen.publicKey;
+        publicKeys.push([pk0, pk1]);
+        secretKeys.push(chosen.secretKey);
+        retainedChoices.push(c);
+        commitments.push(kemMalCommit(rn, i, pk0, pk1));
+    }
+    return {
+        message: { rn, commitments },
+        state: { choices: retainedChoices, secretKeys, publicKeys, rn },
+    };
+}
+/** SENDER round 2: draw the sender nonce `sn` completing the session id. */
+function kemBaseOtMalSenderNonce(rng = (0, csprng_1.secureOtRandom)()) {
+    return { sn: rng.bytes(NONCE_BYTES) };
+}
+/** RECEIVER round 3: open the committed public keys (the sender will re-check them against `com`). */
+function kemBaseOtMalOpen(state) {
+    return { publicKeys: state.publicKeys.map(([a, b]) => [a, b]) };
+}
+/**
+ * SENDER round 4: VERIFY the opened keys against the round-1 commitments (ABORT on mismatch), then
+ * encapsulate under each and one-time-pad each message with a `(sid, com)`-bound pad.
+ */
+function kemBaseOtMalSend(messages, commit, senderNonce, opening, rng = (0, csprng_1.secureOtRandom)()) {
+    const { rn, commitments } = commit;
+    const { publicKeys } = opening;
+    if (messages.length !== publicKeys.length || commitments.length !== publicKeys.length) {
+        throw new Error('kemBaseOtMalSend: messages/commitments/publicKeys length mismatch');
+    }
+    const sid = kemMalSid(rn, senderNonce.sn);
+    const ciphertexts = [];
+    const encrypted = [];
+    for (let i = 0; i < messages.length; i++) {
+        const [m0, m1] = messages[i];
+        if (m0.length !== m1.length) {
+            throw new Error(`kemBaseOtMalSend (index ${i}): the two messages must be equal length`);
+        }
+        const [pk0, pk1] = publicKeys[i];
+        // The binding check: the opened keys MUST reproduce the round-1 commitment, else a cheating
+        // receiver swapped/adapted its keys after learning the sender nonce → ABORT.
+        const com = kemMalCommit(rn, i, pk0, pk1);
+        if (!constTimeEqual(com, commitments[i])) {
+            throw new KemBaseOtAbort(`kem base OT (index ${i}): opened public keys do not match the receiver's commitment; aborting`);
+        }
+        const e0 = ml_kem_js_1.ml_kem768.encapsulate(pk0, rng.bytes(ENCAPS_MSG_BYTES));
+        const e1 = ml_kem_js_1.ml_kem768.encapsulate(pk1, rng.bytes(ENCAPS_MSG_BYTES));
+        ciphertexts.push([e0.cipherText, e1.cipherText]);
+        encrypted.push([
+            xorBytes(m0, kemOtMalPad(sid, com, i, 0, e0.sharedSecret, m0.length)),
+            xorBytes(m1, kemOtMalPad(sid, com, i, 1, e1.sharedSecret, m1.length)),
+        ]);
+    }
+    return { ciphertexts, encrypted };
+}
+/**
+ * RECEIVER round 5: decapsulate ONLY the chosen ciphertext and unmask with the `(sid, com)`-bound pad.
+ */
+function kemBaseOtMalRecover(state, senderNonce, senderMessage, tamper) {
+    const { choices, secretKeys, publicKeys, rn } = state;
+    const { ciphertexts, encrypted } = senderMessage;
+    if (ciphertexts.length !== choices.length || encrypted.length !== choices.length) {
+        throw new Error('kemBaseOtMalRecover: transcript/state length mismatch');
+    }
+    let sid = kemMalSid(rn, senderNonce.sn);
+    if (tamper?.tamperReceiverSid)
+        sid = tamper.tamperReceiverSid(sid);
+    const received = [];
+    for (let i = 0; i < choices.length; i++) {
+        const c = choices[i] & 1;
+        const [pk0, pk1] = publicKeys[i];
+        const com = kemMalCommit(rn, i, pk0, pk1);
+        const ss = ml_kem_js_1.ml_kem768.decapsulate(ciphertexts[i][c], secretKeys[i]);
+        const e = encrypted[i][c];
+        received.push(xorBytes(e, kemOtMalPad(sid, com, i, c, ss, e.length)));
+    }
+    return received;
+}
+/** Constant-time byte-equality (both the commitment check and length check in one place). */
+function constTimeEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i++)
+        diff |= a[i] ^ b[i];
+    return diff === 0;
+}
+/**
+ * In-process combined simulator for the MALICIOUS-HARDENED committed KEM base OT, matching the shape of
+ * `kemBaseOT` so it is a drop-in for `OtChannel`'s `baseOtFn` (`withKemBaseOtMal`). Runs all five
+ * rounds; a cheating receiver (opened keys ≠ commitment) makes the sender throw `KemBaseOtAbort`. The
+ * `tamper` hook injects malicious-receiver behaviour for tests.
+ */
+function kemBaseOtMal(messages, choices, rng = (0, csprng_1.secureOtRandom)(), tamper) {
+    if (messages.length !== choices.length) {
+        throw new Error('kemBaseOtMal: messages/choices length mismatch');
+    }
+    const { message: commit, state } = kemBaseOtMalCommit(choices, rng);
+    const senderNonce = kemBaseOtMalSenderNonce(rng);
+    const opening = kemBaseOtMalOpen(state);
+    // A malicious receiver may open keys OTHER than those it committed to (test-injected).
+    if (tamper?.tamperOpenedKeys)
+        tamper.tamperOpenedKeys(opening.publicKeys);
+    const senderMessage = kemBaseOtMalSend(messages, commit, senderNonce, opening, rng);
+    const received = kemBaseOtMalRecover(state, senderNonce, senderMessage, tamper);
+    return {
+        received,
+        transcript: {
+            rn: commit.rn,
+            commitments: commit.commitments,
+            sn: senderNonce.sn,
+            publicKeys: opening.publicKeys,
+            ciphertexts: senderMessage.ciphertexts,
+            encrypted: senderMessage.encrypted,
+        },
+    };
+}
+/**
+ * Wire the MALICIOUS-HARDENED committed ML-KEM base OT into the KOS OT-extension — the recommended
+ * post-quantum base. Like `withKemBaseOt`, but the κ setup base OTs run the committed/session-bound
+ * protocol (and abort on a cheating receiver). Everything above the base OT is unchanged.
+ *
+ *   const ch = new OtChannel(secureOtRandom(), withKemBaseOtMal());
+ */
+function withKemBaseOtMal() {
+    return { baseOtFn: (m, c, r) => kemBaseOtMal(m, c, r) };
+}
+// ===================================================================================================
+// COMMITTED KEM *RANDOM* OT (`kemBaseOtMalRandom`) — the random-OT face of the hardened protocol.
+//
+// The chosen-message `kemBaseOtMal` above one-time-pads the sender's messages internally and never
+// surfaces the raw KEM shared secrets. A hybrid OT COMBINER (`hybrid-ot.ts`) needs those per-slot
+// shared secrets so it can fold them with a second base OT's secrets. This variant runs the EXACT SAME
+// five-round committed/session-bound protocol — same `rn`/`sn`/`sid`, same RO-commitment to the ordered
+// public keys, same ABORT on an opened-key / commitment mismatch — but instead of padding messages it
+// returns, per transfer, a session-bound shared secret PER SLOT:
+//
+//     ss_slot = H(TAG ‖ sid ‖ com ‖ i ‖ slot ‖ Decaps/Encaps shared secret).
+//
+// The SENDER derives BOTH (`senderSecrets[i] = [ss_0, ss_1]`); the honest RECEIVER derives only the
+// chosen one (`recvSecrets[i] = ss_{choices[i]}`), because it kept only `sk_{choices[i]}`. Binding each
+// secret to `(sid, com)` makes it non-transferable across sessions / across different opened keys —
+// identical to how `kemOtMalPad` binds the chosen-message pad. The intrinsic "keep both secrets"
+// residue is UNCHANGED from the chosen-message variant (an opaque IND-CCA KEM cannot stop it; see the
+// module header) — closing it is exactly the job the hybrid combiner delegates to the EC base OT.
+// ===================================================================================================
+const TAG_KEMOT_MALSECRET = new TextEncoder().encode('atlas-pca-mpc/kem-ot-mal-secret');
+/** Byte length of a derived committed-KEM random-OT shared secret. */
+exports.KEM_OT_SECRET_BYTES = 32;
+/**
+ * The session-bound per-slot shared secret `H(TAG ‖ sid ‖ com ‖ i ‖ slot ‖ ss)` (32 bytes). Binding to
+ * `(sid, com)` ties it to the committed keys and this exact session — the random-OT analogue of
+ * `kemOtMalPad`.
+ */
+function kemOtMalSecret(sid, com, index, slot, sharedSecret) {
+    return sha256(TAG_KEMOT_MALSECRET, sid, com, u32(index), Uint8Array.of(slot & 1), sharedSecret).slice(0, exports.KEM_OT_SECRET_BYTES);
+}
+/**
+ * SENDER round 4 (RANDOM variant): VERIFY the opened keys against the round-1 commitments (ABORT on
+ * mismatch), encapsulate under each, and derive BOTH per-slot session-bound shared secrets. No messages
+ * are padded — the two secrets per transfer ARE the random output.
+ */
+function kemBaseOtMalRandomSend(commit, senderNonce, opening, rng = (0, csprng_1.secureOtRandom)()) {
+    const { rn, commitments } = commit;
+    const { publicKeys } = opening;
+    if (commitments.length !== publicKeys.length) {
+        throw new Error('kemBaseOtMalRandomSend: commitments/publicKeys length mismatch');
+    }
+    const sid = kemMalSid(rn, senderNonce.sn);
+    const ciphertexts = [];
+    const senderSecrets = [];
+    for (let i = 0; i < publicKeys.length; i++) {
+        const [pk0, pk1] = publicKeys[i];
+        // Same binding check as the chosen-message variant: opened keys MUST reproduce the commitment.
+        const com = kemMalCommit(rn, i, pk0, pk1);
+        if (!constTimeEqual(com, commitments[i])) {
+            throw new KemBaseOtAbort(`kem base OT (index ${i}): opened public keys do not match the receiver's commitment; aborting`);
+        }
+        const e0 = ml_kem_js_1.ml_kem768.encapsulate(pk0, rng.bytes(ENCAPS_MSG_BYTES));
+        const e1 = ml_kem_js_1.ml_kem768.encapsulate(pk1, rng.bytes(ENCAPS_MSG_BYTES));
+        ciphertexts.push([e0.cipherText, e1.cipherText]);
+        senderSecrets.push([
+            kemOtMalSecret(sid, com, i, 0, e0.sharedSecret),
+            kemOtMalSecret(sid, com, i, 1, e1.sharedSecret),
+        ]);
+    }
+    return { ciphertexts, senderSecrets };
+}
+/**
+ * RECEIVER round 5 (RANDOM variant): decapsulate ONLY the chosen ciphertext and derive the chosen
+ * session-bound shared secret. The receiver never touches the non-chosen slot (it kept no secret for it).
+ */
+function kemBaseOtMalRandomRecover(state, senderNonce, senderMessage, tamper) {
+    const { choices, secretKeys, publicKeys, rn } = state;
+    const { ciphertexts } = senderMessage;
+    if (ciphertexts.length !== choices.length) {
+        throw new Error('kemBaseOtMalRandomRecover: transcript/state length mismatch');
+    }
+    let sid = kemMalSid(rn, senderNonce.sn);
+    if (tamper?.tamperReceiverSid)
+        sid = tamper.tamperReceiverSid(sid);
+    const recvSecrets = [];
+    for (let i = 0; i < choices.length; i++) {
+        const c = choices[i] & 1;
+        const [pk0, pk1] = publicKeys[i];
+        const com = kemMalCommit(rn, i, pk0, pk1);
+        const ss = ml_kem_js_1.ml_kem768.decapsulate(ciphertexts[i][c], secretKeys[i]);
+        recvSecrets.push(kemOtMalSecret(sid, com, i, c, ss));
+    }
+    return recvSecrets;
+}
+/**
+ * In-process combined simulator for the committed KEM RANDOM OT. Runs the same five rounds as
+ * `kemBaseOtMal` (commit → sender nonce → open → verify+encapsulate → recover) but outputs per-slot
+ * shared secrets instead of padded messages. A cheating receiver (opened keys ≠ commitment) makes the
+ * sender throw `KemBaseOtAbort`. The `tamper` hook injects malicious-receiver behaviour for tests.
+ */
+function kemBaseOtMalRandom(choices, rng = (0, csprng_1.secureOtRandom)(), tamper) {
+    const { message: commit, state } = kemBaseOtMalCommit(choices, rng);
+    const senderNonce = kemBaseOtMalSenderNonce(rng);
+    const opening = kemBaseOtMalOpen(state);
+    // A malicious receiver may open keys OTHER than those it committed to (test-injected).
+    if (tamper?.tamperOpenedKeys)
+        tamper.tamperOpenedKeys(opening.publicKeys);
+    const senderMessage = kemBaseOtMalRandomSend(commit, senderNonce, opening, rng);
+    const recvSecrets = kemBaseOtMalRandomRecover(state, senderNonce, senderMessage, tamper);
+    return {
+        senderSecrets: senderMessage.senderSecrets,
+        recvSecrets,
+        sid: kemMalSid(commit.rn, senderNonce.sn),
+        transcript: {
+            rn: commit.rn,
+            commitments: commit.commitments,
+            sn: senderNonce.sn,
+            publicKeys: opening.publicKeys,
+            ciphertexts: senderMessage.ciphertexts,
+        },
+    };
+}
+//# sourceMappingURL=kem-ot.js.map

package/dist/kem-ot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kem-ot.js","sourceRoot":"","sources":["../src/kem-ot.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoFG;;;AA0CH,4BAUC;AA+CD,4CAqBC;AAOD,sCA2BC;AAOD,sCAiBC;AAOD,8BAmBC;AAUD,sCAEC;AAqID,gDAwBC;AAGD,0DAEC;AAGD,4CAEC;AAMD,4CAsCC;AAKD,kDAuBC;AAgBD,oCA2BC;AASD,4CAEC;AA2ED,wDAgCC;AAMD,8DAsBC;AAQD,gDAwBC;AAlqBD,6CAAyC;AACzC,6DAA0D;AAC1D,qCAA0C;AAG1C,wEAAwE;AACxE,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,uFAAuF;AACvF,MAAM,gBAAgB,GAAG,qBAAS,CAAC,MAAM,CAAC,CAAC,KAAK;AAEhD,MAAM,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,0BAA0B,CAAC,CAAC;AAEvE,SAAS,MAAM,CAAC,GAAG,MAAoB;IACrC,MAAM,CAAC,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,MAAM;QAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACpC,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,GAAG,CAAC,CAAS;IACpB,MAAM,CAAC,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;IACzB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;IACzB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC;IACxB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;IAChB,OAAO,CAAC,CAAC;AACX,CAAC;AAED,2DAA2D;AAC3D,SAAS,QAAQ,CAAC,CAAa,EAAE,CAAa;IAC5C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC1E,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACrC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;IAC1D,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,SAAgB,QAAQ,CAAC,KAAa,EAAE,IAAY,EAAE,YAAwB,EAAE,GAAW;IACzF,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,OAAO,QAAQ,GAAG,GAAG,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,YAAY,CAAC,CAAC;QAC7F,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,QAAQ,GAAG,GAAG,EAAE,CAAC,EAAE;YAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACrF,GAAG,EAAE,CAAC;IACR,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AA0CD;;;;GAIG;AACH,SAAgB,gBAAgB,CAC9B,OAAiB,EACjB,MAAgB,IAAA,uBAAc,GAAE;IAEhC,MAAM,UAAU,GAAoC,EAAE,CAAC;IACvD,MAAM,UAAU,GAAiB,EAAE,CAAC;IACpC,MAAM,eAAe,GAAa,EAAE,CAAC;IACrC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC;QAC1B,MAAM,MAAM,GAAG,qBAAS,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAC9D,MAAM,KAAK,GAAG,qBAAS,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAC7D,iGAAiG;QACjG,8FAA8F;QAC9F,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC;QACzD,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;QACzD,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;QAC5B,yFAAyF;QACzF,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAClC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAAC;AACtF,CAAC;AAED;;;;GAIG;AACH,SAAgB,aAAa,CAC3B,QAAyC,EACzC,eAAqC,EACrC,MAAgB,IAAA,uBAAc,GAAE;IAEhC,MAAM,EAAE,UAAU,EAAE,GAAG,eAAe,CAAC;IACvC,IAAI,QAAQ,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,WAAW,GAAoC,EAAE,CAAC;IACxD,MAAM,SAAS,GAAoC,EAAE,CAAC;IACtD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;QAC9B,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,0CAA0C,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,CAAE,CAAC;QAClC,2FAA2F;QAC3F,MAAM,EAAE,GAAG,qBAAS,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC;QACnE,MAAM,EAAE,GAAG,qBAAS,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC;QACnE,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QACjD,SAAS,CAAC,IAAI,CAAC;YACb,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;YACxD,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;SACzD,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;AACpC,CAAC;AAED;;;;GAIG;AACH,SAAgB,aAAa,CAC3B,KAAyB,EACzB,aAAiC;IAEjC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;IACtC,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,aAAa,CAAC;IACjD,IAAI,WAAW,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,IAAI,SAAS,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;QACjF,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,QAAQ,GAAiB,EAAE,CAAC;IAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC;QAC1B,MAAM,EAAE,GAAG,qBAAS,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC,CAAC,CAAE,EAAE,UAAU,CAAC,CAAC,CAAE,CAAC,CAAC;QACtE,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,CAAE,CAAC,CAAC,CAAE,CAAC;QAC5B,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,SAAgB,SAAS,CACvB,QAAyC,EACzC,OAAiB,EACjB,MAAgB,IAAA,uBAAc,GAAE;IAEhC,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,GAAG,gBAAgB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC3E,MAAM,aAAa,GAAG,aAAa,CAAC,QAAQ,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;IACrD,OAAO;QACL,QAAQ;QACR,UAAU,EAAE;YACV,UAAU,EAAE,eAAe,CAAC,UAAU;YACtC,WAAW,EAAE,aAAa,CAAC,WAAW;YACtC,SAAS,EAAE,aAAa,CAAC,SAAS;SACnC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,aAAa;IAC3B,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED,sGAAsG;AACtG,2FAA2F;AAC3F,EAAE;AACF,mGAAmG;AACnG,oGAAoG;AACpG,qGAAqG;AACrG,uGAAuG;AACvG,uDAAuD;AACvD,sGAAsG;AAEtG,MAAM,gBAAgB,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,6BAA6B,CAAC,CAAC;AACjF,MAAM,aAAa,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,0BAA0B,CAAC,CAAC;AAC3E,MAAM,gBAAgB,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,8BAA8B,CAAC,CAAC;AAElF,8DAA8D;AAC9D,MAAM,WAAW,GAAG,EAAE,CAAC;AAEvB,8GAA8G;AAC9G,MAAa,cAAe,SAAQ,KAAK;IACvC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AALD,wCAKC;AAED,iGAAiG;AACjG,SAAS,YAAY,CAAC,EAAc,EAAE,KAAa,EAAE,GAAe,EAAE,GAAe;IACnF,OAAO,MAAM,CAAC,gBAAgB,EAAE,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AAC5D,CAAC;AAED,iGAAiG;AACjG,SAAS,SAAS,CAAC,EAAc,EAAE,EAAc;IAC/C,OAAO,MAAM,CAAC,aAAa,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;AACvC,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAClB,GAAe,EACf,GAAe,EACf,KAAa,EACb,IAAY,EACZ,YAAwB,EACxB,GAAW;IAEX,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,OAAO,QAAQ,GAAG,GAAG,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,MAAM,CAClB,gBAAgB,EAChB,GAAG,EACH,GAAG,EACH,GAAG,CAAC,KAAK,CAAC,EACV,UAAU,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,EACvB,GAAG,CAAC,GAAG,CAAC,EACR,YAAY,CACb,CAAC;QACF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,QAAQ,GAAG,GAAG,EAAE,CAAC,EAAE;YAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACrF,GAAG,EAAE,CAAC;IACR,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AA6DD;;;;GAIG;AACH,SAAgB,kBAAkB,CAChC,OAAiB,EACjB,MAAgB,IAAA,uBAAc,GAAE;IAEhC,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAClC,MAAM,UAAU,GAAoC,EAAE,CAAC;IACvD,MAAM,UAAU,GAAiB,EAAE,CAAC;IACpC,MAAM,eAAe,GAAa,EAAE,CAAC;IACrC,MAAM,WAAW,GAAiB,EAAE,CAAC;IACrC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC;QAC1B,MAAM,MAAM,GAAG,qBAAS,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAC9D,MAAM,KAAK,GAAG,qBAAS,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAC7D,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC;QACzD,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;QACzD,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;QAC5B,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAClC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxB,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAClD,CAAC;IACD,OAAO;QACL,OAAO,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE;QAC5B,KAAK,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,EAAE;KAChE,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,SAAgB,uBAAuB,CAAC,MAAgB,IAAA,uBAAc,GAAE;IACtE,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;AACxC,CAAC;AAED,sGAAsG;AACtG,SAAgB,gBAAgB,CAAC,KAA0B;IACzD,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAA6B,CAAC,EAAE,CAAC;AAC9F,CAAC;AAED;;;GAGG;AACH,SAAgB,gBAAgB,CAC9B,QAAyC,EACzC,MAA2B,EAC3B,WAA8B,EAC9B,OAA0B,EAC1B,MAAgB,IAAA,uBAAc,GAAE;IAEhC,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC;IACnC,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;IAC/B,IAAI,QAAQ,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,IAAI,WAAW,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;QACtF,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,GAAG,GAAG,SAAS,CAAC,EAAE,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC;IAC1C,MAAM,WAAW,GAAoC,EAAE,CAAC;IACxD,MAAM,SAAS,GAAoC,EAAE,CAAC;IACtD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;QAC9B,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,0CAA0C,CAAC,CAAC;QAC1F,CAAC;QACD,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,CAAE,CAAC;QAClC,4FAA4F;QAC5F,6EAA6E;QAC7E,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QAC1C,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,cAAc,CACtB,sBAAsB,CAAC,wEAAwE,CAChG,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,GAAG,qBAAS,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC;QACnE,MAAM,EAAE,GAAG,qBAAS,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC;QACnE,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QACjD,SAAS,CAAC,IAAI,CAAC;YACb,QAAQ,CAAC,EAAE,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;YACrE,QAAQ,CAAC,EAAE,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;SACtE,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;AACpC,CAAC;AAED;;GAEG;AACH,SAAgB,mBAAmB,CACjC,KAA0B,EAC1B,WAA8B,EAC9B,aAAkC,EAClC,MAAqB;IAErB,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,KAAK,CAAC;IACtD,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,aAAa,CAAC;IACjD,IAAI,WAAW,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,IAAI,SAAS,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;QACjF,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,GAAG,GAAG,SAAS,CAAC,EAAE,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC;IACxC,IAAI,MAAM,EAAE,iBAAiB;QAAE,GAAG,GAAG,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAiB,EAAE,CAAC;IAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC;QAC1B,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,CAAE,CAAC;QAClC,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QAC1C,MAAM,EAAE,GAAG,qBAAS,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC,CAAC,CAAE,EAAE,UAAU,CAAC,CAAC,CAAE,CAAC,CAAC;QACtE,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,CAAE,CAAC,CAAC,CAAE,CAAC;QAC5B,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,6FAA6F;AAC7F,SAAS,cAAc,CAAC,CAAa,EAAE,CAAa;IAClD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;IACzD,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAED;;;;;GAKG;AACH,SAAgB,YAAY,CAC1B,QAAyC,EACzC,OAAiB,EACjB,MAAgB,IAAA,uBAAc,GAAE,EAChC,MAAqB;IAErB,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,kBAAkB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACpE,MAAM,WAAW,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACxC,uFAAuF;IACvF,IAAI,MAAM,EAAE,gBAAgB;QAAE,MAAM,CAAC,gBAAgB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC1E,MAAM,aAAa,GAAG,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACpF,MAAM,QAAQ,GAAG,mBAAmB,CAAC,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;IAChF,OAAO;QACL,QAAQ;QACR,UAAU,EAAE;YACV,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,EAAE,EAAE,WAAW,CAAC,EAAE;YAClB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,WAAW,EAAE,aAAa,CAAC,WAAW;YACtC,SAAS,EAAE,aAAa,CAAC,SAAS;SACnC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,gBAAgB;IAC9B,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;AAC1D,CAAC;AAED,sGAAsG;AACtG,kGAAkG;AAClG,EAAE;AACF,mGAAmG;AACnG,kGAAkG;AAClG,uGAAuG;AACvG,wGAAwG;AACxG,sGAAsG;AACtG,iEAAiE;AACjE,EAAE;AACF,6EAA6E;AAC7E,EAAE;AACF,oGAAoG;AACpG,wGAAwG;AACxG,oGAAoG;AACpG,iGAAiG;AACjG,sGAAsG;AACtG,kGAAkG;AAClG,sGAAsG;AAEtG,MAAM,mBAAmB,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,iCAAiC,CAAC,CAAC;AAExF,sEAAsE;AACzD,QAAA,mBAAmB,GAAG,EAAE,CAAC;AAEtC;;;;GAIG;AACH,SAAS,cAAc,CACrB,GAAe,EACf,GAAe,EACf,KAAa,EACb,IAAY,EACZ,YAAwB;IAExB,OAAO,MAAM,CAAC,mBAAmB,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,KAAK,CACnG,CAAC,EACD,2BAAmB,CACpB,CAAC;AACJ,CAAC;AA2BD;;;;GAIG;AACH,SAAgB,sBAAsB,CACpC,MAA2B,EAC3B,WAA8B,EAC9B,OAA0B,EAC1B,MAAgB,IAAA,uBAAc,GAAE;IAEhC,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC;IACnC,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;IAC/B,IAAI,WAAW,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,GAAG,GAAG,SAAS,CAAC,EAAE,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC;IAC1C,MAAM,WAAW,GAAoC,EAAE,CAAC;IACxD,MAAM,aAAa,GAAoC,EAAE,CAAC;IAC1D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,CAAE,CAAC;QAClC,+FAA+F;QAC/F,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QAC1C,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,cAAc,CACtB,sBAAsB,CAAC,wEAAwE,CAChG,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,GAAG,qBAAS,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC;QACnE,MAAM,EAAE,GAAG,qBAAS,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC;QACnE,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QACjD,aAAa,CAAC,IAAI,CAAC;YACjB,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC;YAC/C,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC;SAChD,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC;AACxC,CAAC;AAED;;;GAGG;AACH,SAAgB,yBAAyB,CACvC,KAA0B,EAC1B,WAA8B,EAC9B,aAAwC,EACxC,MAAqB;IAErB,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,KAAK,CAAC;IACtD,MAAM,EAAE,WAAW,EAAE,GAAG,aAAa,CAAC;IACtC,IAAI,WAAW,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,GAAG,GAAG,SAAS,CAAC,EAAE,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC;IACxC,IAAI,MAAM,EAAE,iBAAiB;QAAE,GAAG,GAAG,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACnE,MAAM,WAAW,GAAiB,EAAE,CAAC;IACrC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC;QAC1B,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,CAAE,CAAC;QAClC,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QAC1C,MAAM,EAAE,GAAG,qBAAS,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC,CAAC,CAAE,EAAE,UAAU,CAAC,CAAC,CAAE,CAAC,CAAC;QACtE,WAAW,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;;;GAKG;AACH,SAAgB,kBAAkB,CAChC,OAAiB,EACjB,MAAgB,IAAA,uBAAc,GAAE,EAChC,MAAqB;IAErB,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,kBAAkB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACpE,MAAM,WAAW,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACxC,uFAAuF;IACvF,IAAI,MAAM,EAAE,gBAAgB;QAAE,MAAM,CAAC,gBAAgB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC1E,MAAM,aAAa,GAAG,sBAAsB,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAChF,MAAM,WAAW,GAAG,yBAAyB,CAAC,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;IACzF,OAAO;QACL,aAAa,EAAE,aAAa,CAAC,aAAa;QAC1C,WAAW;QACX,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE,WAAW,CAAC,EAAE,CAAC;QACzC,UAAU,EAAE;YACV,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,EAAE,EAAE,WAAW,CAAC,EAAE;YAClB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,WAAW,EAAE,aAAa,CAAC,WAAW;SACvC;KACF,CAAC;AACJ,CAAC"}