@atlasauth/pca-mpc 0.0.0-stage → 0.2.0

package/dist/mascot.d.ts

@@ -0,0 +1,189 @@
+/**
+ * The NO-DEALER offline phase (MASCOT-style) — the last trust assumption removed.
+ *
+ * The SPDZ online layer (`spdz.ts`/`spdz-runner.ts`) is maliciously secure with abort, but until now
+ * its *preprocessing* — the global MAC key α, the authenticated Beaver triples, and the authenticated
+ * input sharings — came from a TRUSTED DEALER who knew α and generated everything. This module removes
+ * that dealer. All preprocessing is derived from real oblivious transfer (`ot.ts`), so:
+ *
+ *   • **The MAC key α is distributed, never reconstructed.** Each party i samples its own share α_i
+ *     locally; `α = Σ α_i` is a value no party ever holds and the protocol never forms. (The in-process
+ *     simulator can sum the shares for test assertions — see `MacContext.alpha` — but no per-party view
+ *     and no protocol step contains α.)
+ *
+ *   • **Beaver triples are generated by the parties from OT, no dealer.** Each party samples its own
+ *     shares a_i, b_i of two random values; the product share `c = a·b` is obtained by OT-multiplying
+ *     the share vectors (Gilboa), and the SPDZ MACs on a, b, c are obtained by OT-multiplying α's shares
+ *     against each value's shares. No party learns a, b or c; no party learns α.
+ *
+ * ## The one OT-based primitive: `otShareMultiply`
+ *
+ * Given additive sharings `⟨x⟩ = (x_0,…,x_{n−1})` and `⟨y⟩`, the parties want an additive sharing
+ * `⟨z⟩` with `Σ z = (Σ x)(Σ y)`, learning nothing else. Expand:
+ *
+ *     (Σ_i x_i)(Σ_j y_j) = Σ_i x_i·y_i  +  Σ_{i≠j} x_i·y_j.
+ *
+ * The diagonal `x_i·y_i` each party computes locally. Each cross term `x_i·y_j` (i≠j) is turned into an
+ * additive sharing between party i and party j by **Gilboa's OT multiplication**: party i (holding x_i)
+ * is the OT RECEIVER using the bits of x_i as choices; party j (holding y_j) is the OT SENDER. For bit
+ * k of x_i, the sender offers `(ρ_k, ρ_k + 2^k·y_j)` for a fresh random ρ_k; the receiver's choice bit
+ * `(x_i)_k` selects `ρ_k + (x_i)_k·2^k·y_j`. Summed over k the receiver gets `x_i·y_j + Σρ_k` and the
+ * sender keeps `−Σρ_k`, an additive sharing of `x_i·y_j`. Because the OT hides both the choice and the
+ * unchosen message, neither party learns the other's share.
+ *
+ * ## Malicious security (docs §7.1)
+ *
+ * The OT is now **malicious-secure**: Chou–Orlandi base OT + IKNP extension **with the KOS correlation
+ * check** (`ot.ts`), so a cheating OT-extension receiver is caught and the extension aborts. On top of
+ * that, triple generation runs the **MASCOT sacrifice**: every delivered triple is generated as a PAIR
+ * `(a,b,c)` and `(â,b,ĉ)` sharing `b`, and one is *sacrificed* to check the other under the MACs — a
+ * party that fed wrong OT inputs (producing `c ≠ a·b`, even one that is internally MAC-consistent) is
+ * caught when the sacrifice residual `τ = e·c − ĉ − (e·a−â)·b` opens to a non-zero value, or when the
+ * commit-then-open MAC-check on the sacrifice openings fails. There is also an **input-consistency
+ * check** (`checkInputConsistency`): a random masked combination of authenticated inputs is opened and
+ * MAC-checked, catching any input whose MAC does not match its value. Both the sacrifice and the input
+ * check ABORT (throw `MacCheckAbort`) rather than emit a bad triple / bad input.
+ *
+ * So the whole stack is now **malicious-with-abort, dishonest-majority** end to end: malicious-secure
+ * no-dealer OFFLINE (KOS OT + MASCOT sacrifice + input check, `α` never reconstructed) feeding the
+ * malicious-with-abort SPDZ ONLINE phase (the MAC-check still catches any online deviation). The base
+ * OTs are themselves malicious-secure (committed Chou–Orlandi: Schnorr PoK + point validation, `ot.ts`
+ * / `ec.ts`), and all randomness here is the CSPRNG by DEFAULT — construct `NoDealerOffline` WITHOUT a
+ * seed for production (`SecureFieldRng` + `secureOtRandom`); passing a seed selects the deterministic
+ * SplitMix64 stream for reproducible tests only. Residual boundary (docs §7.1): just two honestly
+ * unavoidable items — constant-time field arithmetic (a native/WASM workstream) and a real async
+ * network/transport (including the interactive secure coin-flip for the public MAC-check challenge).
+ */
+import { type SharedValue } from './sharing';
+import { type AuthSV, type AuthTriple, type MacContext } from './spdz';
+/**
+ * A TEST-ONLY injection modelling a MALICIOUS party in the OFFLINE phase: when the triple PRODUCT
+ * multiplication at index `productMul` runs (0-based, counting only the OT multiplications that form a
+ * triple's `c = a·b`), `delta` is XOR... added into one party's product share. The resulting triple has
+ * `c = a·b + delta` but is still internally MAC-consistent (the authentication runs on the corrupted
+ * share) — exactly the "bad OT input" a malicious party can mount, which MACs ALONE cannot catch and
+ * the MASCOT SACRIFICE is designed to catch. Models "corrupting an OT message/share in the offline".
+ */
+export interface OfflineDeviation {
+    /** Which triple-product OT multiplication to corrupt (0-based across all products this instance makes). */
+    productMul: number;
+    /** Field delta added to party 0's product share, making c = a·b + delta (self-consistently MAC'd). */
+    delta: bigint;
+}
+/** Options for the no-dealer offline phase. */
+export interface NoDealerOptions {
+    /** Run the MASCOT sacrifice on every delivered triple (default true = malicious-secure). */
+    sacrifice?: boolean;
+    /** A test-only offline deviation (a malicious party corrupting a product share). */
+    deviation?: OfflineDeviation;
+}
+/**
+ * The no-dealer offline phase for a fixed party count `n`. Holds the distributed MAC key (α_i only),
+ * and a reusable set of per-ordered-pair OT-extension channels so the κ base OTs are amortized across
+ * every triple and input it produces. Deterministic given its seed (production: a CSPRNG per party).
+ *
+ * MALICIOUS-secure: the OT extension carries the KOS correlation check (`ot.ts`), and every delivered
+ * triple survives the MASCOT sacrifice. `checkInputConsistency` provides the input check.
+ */
+export declare class NoDealerOffline {
+    readonly n: number;
+    /** α_i: party i's locally-sampled share of the MAC key. Σ α_i = α (never formed by any party). */
+    readonly alphaShares: bigint[];
+    private readonly rng;
+    private readonly seed;
+    /** Whether randomness is a deterministic (test) seed; when false, all randomness is the CSPRNG. */
+    private readonly deterministic;
+    /** OT channels keyed "i->j": receiver = party i, sender = party j. Base OTs run on first use. */
+    private readonly channels;
+    /** Whether to run the MASCOT sacrifice per delivered triple (malicious-secure when true). */
+    private readonly sacrificeOn;
+    /** Test-only offline deviation (a malicious party corrupting a product share). */
+    private readonly deviation?;
+    /** Count of triple-product OT multiplications performed (for targeting `deviation.productMul`). */
+    private productMulCount;
+    constructor(n: number, seed?: bigint, opts?: NoDealerOptions);
+    /**
+     * The SPDZ MAC context the online runner consumes. It carries ONLY `alphaShares` for the protocol;
+     * `alpha` is the sum the in-process simulator computes for TEST ASSERTIONS and is never used by any
+     * protocol step or held by any party.
+     */
+    get macContext(): MacContext;
+    private channel;
+    /**
+     * Gilboa OT multiplication of two scalars held by different parties. Party `i` holds `xi` (OT
+     * receiver, choice bits = bits of xi); party `j` holds `yj` (OT sender). Returns `[shareI, shareJ]`
+     * with `shareI + shareJ = xi·yj (mod p)`, neither party learning the other's input or share.
+     */
+    private gilboa;
+    /**
+     * OT-based share multiplication: given additive sharings `x`, `y` (length n), returns an additive
+     * sharing `z` with `Σ z = (Σ x)(Σ y) mod p`. Diagonal terms are local; each cross term is a Gilboa OT
+     * multiplication. No party learns Σx, Σy, or Σz.
+     */
+    otShareMultiply(x: SharedValue, y: SharedValue): SharedValue;
+    /** Authenticate a value sharing: produce MAC shares γ with Σ γ = α·(Σ value), via OT (no dealer). */
+    private authenticate;
+    /**
+     * The product sharing `c` (Σc = a·b) for a triple, via OT. Counts as a triple PRODUCT so a test
+     * `deviation` can corrupt one — modelling a malicious party that feeds a wrong OT input and gets a
+     * wrong-but-self-MAC-consistent product share (only the sacrifice catches this).
+     */
+    private tripleProduct;
+    /** A RAW authenticated triple (a, b, c=a·b) from OT, before the sacrifice. No dealer. */
+    private rawTriple;
+    /** A RAW authenticated triple (â, b, ĉ=â·b) SHARING the given authenticated `b` — the sacrifice pair. */
+    private rawTripleWithB;
+    /**
+     * The MASCOT **sacrifice** check. Given two triples sharing `b`, `(a,b,c)` (the one to KEEP) and
+     * `(â,b,ĉ)` (the one to SACRIFICE), draw a public random challenge `e`, open `ρ = e·a − â`, form the
+     * authenticated residual `⟦τ⟧ = e·⟦c⟧ − ⟦ĉ⟧ − ρ·⟦b⟧`, open `τ`, run the commit-then-open MAC-check on
+     * both openings, and require `τ = 0`. If both triples are correct, `τ = e·(c−ab) − (ĉ−âb) = 0`; if the
+     * kept triple has `c = ab + δ`, then `τ = e·δ`, which is non-zero (e ≠ 0, δ ≠ 0) — ABORT. Lying in the
+     * `τ` opening to force a zero value is caught by the MAC-check (the forged MAC won't reconcile). The
+     * sacrificed triple is consumed by the check and discarded; the kept triple is certified `c = a·b`.
+     */
+    private sacrifice;
+    /**
+     * Generate ONE authenticated Beaver triple with NO dealer, MALICIOUS-secure. Each party samples its
+     * own a_i, b_i; the product sharing c (Σc = a·b) comes from OT; every component is MAC'd via OT
+     * against the α shares. When the sacrifice is on (default), a SECOND triple sharing `b` is generated
+     * and sacrificed to certify `c = a·b` under the MACs, so a malformed triple ABORTS rather than being
+     * emitted. No party learns a, b, c, or α.
+     */
+    genAuthTriple(): AuthTriple;
+    /** Generate `count` authenticated triples (channels/base-OTs amortized across all of them). */
+    genAuthTriples(count: number): AuthTriple[];
+    /**
+     * Authenticated input sharing of `value`, owned by party `owner`, with NO dealer. The owner splits
+     * its own value into additive shares (local); the MAC `α·value` is computed via OT against the α
+     * shares. A malicious owner can of course choose any value (inputs are unconstrained in SPDZ), but it
+     * cannot make the sharing inconsistent with its MAC — the online MAC-check binds it.
+     */
+    authInput(value: bigint, owner: number): AuthSV;
+    /**
+     * The MASCOT **input-consistency check**: verify that a batch of authenticated inputs each satisfy
+     * `Σγ = α·(Σvalue)` — i.e. their MACs match their values — WITHOUT revealing any value, and ABORT if
+     * not. A malicious party that produced an input whose MAC does not match its value (e.g. by feeding a
+     * bad OT input to the authentication) is caught here rather than only downstream.
+     *
+     * Method: draw public random coefficients `e_k`, generate ONE fresh OT-authenticated random mask
+     * `⟦r⟧`, form `⟦w⟧ = Σ_k e_k·⟦x_k⟧ + ⟦r⟧`, partial-open `w` (masked by the uniform `r`, so no input
+     * leaks), and run the commit-then-open MAC-check on that opening. If some input's MAC is off by `δ`,
+     * the opened `w` carries MAC residual `Σ e_k·δ_k ≠ 0` w.h.p. over the random `e_k`, and the MAC-check
+     * aborts. No-op for an empty batch.
+     */
+    checkInputConsistency(inputs: ReadonlyArray<AuthSV>): void;
+}
+/**
+ * The offline material a malicious-secure runner consumes. A `NoDealerOffline` IS one of these
+ * (duck-typed by `macContext`/`genAuthTriple`/`authInput`), so the runner can take either this or the
+ * trusted-dealer functions behind the same tiny interface.
+ */
+export interface OfflineProvider {
+    readonly n: number;
+    readonly macContext: MacContext;
+    genAuthTriple(): AuthTriple;
+    authInput(value: bigint, owner: number): AuthSV;
+}
+/** Convenience: a fresh no-dealer offline phase for `n` parties (malicious-secure by default). */
+export declare function makeNoDealerOffline(n: number, seed?: bigint, opts?: NoDealerOptions): NoDealerOffline;

package/dist/mascot.js

@@ -0,0 +1,322 @@
+"use strict";
+/**
+ * The NO-DEALER offline phase (MASCOT-style) — the last trust assumption removed.
+ *
+ * The SPDZ online layer (`spdz.ts`/`spdz-runner.ts`) is maliciously secure with abort, but until now
+ * its *preprocessing* — the global MAC key α, the authenticated Beaver triples, and the authenticated
+ * input sharings — came from a TRUSTED DEALER who knew α and generated everything. This module removes
+ * that dealer. All preprocessing is derived from real oblivious transfer (`ot.ts`), so:
+ *
+ *   • **The MAC key α is distributed, never reconstructed.** Each party i samples its own share α_i
+ *     locally; `α = Σ α_i` is a value no party ever holds and the protocol never forms. (The in-process
+ *     simulator can sum the shares for test assertions — see `MacContext.alpha` — but no per-party view
+ *     and no protocol step contains α.)
+ *
+ *   • **Beaver triples are generated by the parties from OT, no dealer.** Each party samples its own
+ *     shares a_i, b_i of two random values; the product share `c = a·b` is obtained by OT-multiplying
+ *     the share vectors (Gilboa), and the SPDZ MACs on a, b, c are obtained by OT-multiplying α's shares
+ *     against each value's shares. No party learns a, b or c; no party learns α.
+ *
+ * ## The one OT-based primitive: `otShareMultiply`
+ *
+ * Given additive sharings `⟨x⟩ = (x_0,…,x_{n−1})` and `⟨y⟩`, the parties want an additive sharing
+ * `⟨z⟩` with `Σ z = (Σ x)(Σ y)`, learning nothing else. Expand:
+ *
+ *     (Σ_i x_i)(Σ_j y_j) = Σ_i x_i·y_i  +  Σ_{i≠j} x_i·y_j.
+ *
+ * The diagonal `x_i·y_i` each party computes locally. Each cross term `x_i·y_j` (i≠j) is turned into an
+ * additive sharing between party i and party j by **Gilboa's OT multiplication**: party i (holding x_i)
+ * is the OT RECEIVER using the bits of x_i as choices; party j (holding y_j) is the OT SENDER. For bit
+ * k of x_i, the sender offers `(ρ_k, ρ_k + 2^k·y_j)` for a fresh random ρ_k; the receiver's choice bit
+ * `(x_i)_k` selects `ρ_k + (x_i)_k·2^k·y_j`. Summed over k the receiver gets `x_i·y_j + Σρ_k` and the
+ * sender keeps `−Σρ_k`, an additive sharing of `x_i·y_j`. Because the OT hides both the choice and the
+ * unchosen message, neither party learns the other's share.
+ *
+ * ## Malicious security (docs §7.1)
+ *
+ * The OT is now **malicious-secure**: Chou–Orlandi base OT + IKNP extension **with the KOS correlation
+ * check** (`ot.ts`), so a cheating OT-extension receiver is caught and the extension aborts. On top of
+ * that, triple generation runs the **MASCOT sacrifice**: every delivered triple is generated as a PAIR
+ * `(a,b,c)` and `(â,b,ĉ)` sharing `b`, and one is *sacrificed* to check the other under the MACs — a
+ * party that fed wrong OT inputs (producing `c ≠ a·b`, even one that is internally MAC-consistent) is
+ * caught when the sacrifice residual `τ = e·c − ĉ − (e·a−â)·b` opens to a non-zero value, or when the
+ * commit-then-open MAC-check on the sacrifice openings fails. There is also an **input-consistency
+ * check** (`checkInputConsistency`): a random masked combination of authenticated inputs is opened and
+ * MAC-checked, catching any input whose MAC does not match its value. Both the sacrifice and the input
+ * check ABORT (throw `MacCheckAbort`) rather than emit a bad triple / bad input.
+ *
+ * So the whole stack is now **malicious-with-abort, dishonest-majority** end to end: malicious-secure
+ * no-dealer OFFLINE (KOS OT + MASCOT sacrifice + input check, `α` never reconstructed) feeding the
+ * malicious-with-abort SPDZ ONLINE phase (the MAC-check still catches any online deviation). The base
+ * OTs are themselves malicious-secure (committed Chou–Orlandi: Schnorr PoK + point validation, `ot.ts`
+ * / `ec.ts`), and all randomness here is the CSPRNG by DEFAULT — construct `NoDealerOffline` WITHOUT a
+ * seed for production (`SecureFieldRng` + `secureOtRandom`); passing a seed selects the deterministic
+ * SplitMix64 stream for reproducible tests only. Residual boundary (docs §7.1): just two honestly
+ * unavoidable items — constant-time field arithmetic (a native/WASM workstream) and a real async
+ * network/transport (including the interactive secure coin-flip for the public MAC-check challenge).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NoDealerOffline = void 0;
+exports.makeNoDealerOffline = makeNoDealerOffline;
+const field_1 = require("./field");
+const csprng_1 = require("./csprng");
+const sharing_1 = require("./sharing");
+const spdz_1 = require("./spdz");
+const ot_1 = require("./ot");
+/** Number of bits needed to represent any element of F_p (p = 2^61 − 1 ⇒ values use bits 0..60). */
+const FIELD_BITS = 61;
+/**
+ * The no-dealer offline phase for a fixed party count `n`. Holds the distributed MAC key (α_i only),
+ * and a reusable set of per-ordered-pair OT-extension channels so the κ base OTs are amortized across
+ * every triple and input it produces. Deterministic given its seed (production: a CSPRNG per party).
+ *
+ * MALICIOUS-secure: the OT extension carries the KOS correlation check (`ot.ts`), and every delivered
+ * triple survives the MASCOT sacrifice. `checkInputConsistency` provides the input check.
+ */
+class NoDealerOffline {
+    n;
+    /** α_i: party i's locally-sampled share of the MAC key. Σ α_i = α (never formed by any party). */
+    alphaShares;
+    rng;
+    seed;
+    /** Whether randomness is a deterministic (test) seed; when false, all randomness is the CSPRNG. */
+    deterministic;
+    /** OT channels keyed "i->j": receiver = party i, sender = party j. Base OTs run on first use. */
+    channels = new Map();
+    /** Whether to run the MASCOT sacrifice per delivered triple (malicious-secure when true). */
+    sacrificeOn;
+    /** Test-only offline deviation (a malicious party corrupting a product share). */
+    deviation;
+    /** Count of triple-product OT multiplications performed (for targeting `deviation.productMul`). */
+    productMulCount = 0;
+    constructor(n, seed, opts = {}) {
+        if (!Number.isInteger(n) || n < 1)
+            throw new Error('NoDealerOffline: n must be a positive integer');
+        this.n = n;
+        // CSPRNG by DEFAULT (production); a deterministic SplitMix64 stream ONLY when a test seed is given
+        // (docs §7.1 item c). `this.seed` is kept for per-pair OT-stream derivation in the deterministic case.
+        this.deterministic = seed !== undefined;
+        this.seed = seed ?? 0xabcdef12345n;
+        this.rng = this.deterministic ? new field_1.FieldRng(this.seed) : new csprng_1.SecureFieldRng();
+        this.sacrificeOn = opts.sacrifice ?? true;
+        this.deviation = opts.deviation;
+        // DISTRIBUTED MAC-KEY GENERATION: each party samples its own α_i locally. α is never reconstructed.
+        this.alphaShares = Array.from({ length: n }, () => this.rng.next());
+    }
+    /**
+     * The SPDZ MAC context the online runner consumes. It carries ONLY `alphaShares` for the protocol;
+     * `alpha` is the sum the in-process simulator computes for TEST ASSERTIONS and is never used by any
+     * protocol step or held by any party.
+     */
+    get macContext() {
+        let alpha = 0n;
+        for (const ai of this.alphaShares)
+            alpha = (0, field_1.fadd)(alpha, ai);
+        return { n: this.n, alphaShares: this.alphaShares.slice(), alpha };
+    }
+    channel(i, j) {
+        const key = `${i}->${j}`;
+        let ch = this.channels.get(key);
+        if (!ch) {
+            // CSPRNG by default; a distinct DETERMINISTIC OT stream per ordered pair only under a test seed.
+            const otRng = this.deterministic
+                ? (0, ot_1.otRandom)((0, ot_1.splitMix64)(this.seed ^ (BigInt(i + 1) * 0x100000001b3n) ^ (BigInt(j + 1) * 0x1000000000n)))
+                : (0, csprng_1.secureOtRandom)();
+            ch = new ot_1.OtChannel(otRng);
+            this.channels.set(key, ch);
+        }
+        return ch;
+    }
+    /**
+     * Gilboa OT multiplication of two scalars held by different parties. Party `i` holds `xi` (OT
+     * receiver, choice bits = bits of xi); party `j` holds `yj` (OT sender). Returns `[shareI, shareJ]`
+     * with `shareI + shareJ = xi·yj (mod p)`, neither party learning the other's input or share.
+     */
+    gilboa(i, j, xi, yj) {
+        const x = (0, field_1.mod)(xi);
+        const y = (0, field_1.mod)(yj);
+        // Sender draws fresh masks ρ_k and offers (ρ_k, ρ_k + 2^k·y) for each bit k.
+        const choiceBits = new Array(FIELD_BITS);
+        const msg0 = new Array(FIELD_BITS);
+        const msg1 = new Array(FIELD_BITS);
+        let senderSum = 0n; // Σ ρ_k
+        let pow = 1n; // 2^k mod p (k ≤ 60 ⇒ no wrap)
+        for (let k = 0; k < FIELD_BITS; k++) {
+            const rho = this.rng.next();
+            senderSum = (0, field_1.fadd)(senderSum, rho);
+            msg0[k] = rho;
+            msg1[k] = (0, field_1.fadd)(rho, (0, field_1.fmul)(pow, y));
+            choiceBits[k] = Number((x >> BigInt(k)) & 1n);
+            pow = (pow * 2n) % field_1.PRIME;
+        }
+        const { received } = this.channel(i, j).extend(choiceBits, msg0, msg1);
+        let receiverSum = 0n; // Σ (received_k mod p)
+        for (let k = 0; k < FIELD_BITS; k++)
+            receiverSum = (0, field_1.fadd)(receiverSum, (0, field_1.mod)(received[k]));
+        // shareI + shareJ = Σ received − Σ ρ = (xi·yj + Σρ) − Σρ = xi·yj.
+        return [receiverSum, (0, field_1.fneg)(senderSum)];
+    }
+    /**
+     * OT-based share multiplication: given additive sharings `x`, `y` (length n), returns an additive
+     * sharing `z` with `Σ z = (Σ x)(Σ y) mod p`. Diagonal terms are local; each cross term is a Gilboa OT
+     * multiplication. No party learns Σx, Σy, or Σz.
+     */
+    otShareMultiply(x, y) {
+        if (x.length !== this.n || y.length !== this.n)
+            throw new Error('otShareMultiply: wrong length');
+        const z = x.map((xi, i) => (0, field_1.fmul)(xi, y[i])); // diagonal x_i·y_i (local)
+        for (let i = 0; i < this.n; i++) {
+            for (let j = 0; j < this.n; j++) {
+                if (i === j)
+                    continue;
+                const [si, sj] = this.gilboa(i, j, x[i], y[j]); // sharing of x_i·y_j
+                z[i] = (0, field_1.fadd)(z[i], si);
+                z[j] = (0, field_1.fadd)(z[j], sj);
+            }
+        }
+        return z;
+    }
+    /** Authenticate a value sharing: produce MAC shares γ with Σ γ = α·(Σ value), via OT (no dealer). */
+    authenticate(valueShares) {
+        return this.otShareMultiply(this.alphaShares, valueShares);
+    }
+    /**
+     * The product sharing `c` (Σc = a·b) for a triple, via OT. Counts as a triple PRODUCT so a test
+     * `deviation` can corrupt one — modelling a malicious party that feeds a wrong OT input and gets a
+     * wrong-but-self-MAC-consistent product share (only the sacrifice catches this).
+     */
+    tripleProduct(x, y) {
+        const z = this.otShareMultiply(x, y);
+        const idx = this.productMulCount++;
+        const dev = this.deviation;
+        if (dev && dev.productMul === idx)
+            z[0] = (0, field_1.fadd)(z[0], dev.delta);
+        return z;
+    }
+    /** A RAW authenticated triple (a, b, c=a·b) from OT, before the sacrifice. No dealer. */
+    rawTriple() {
+        const aShares = Array.from({ length: this.n }, () => this.rng.next());
+        const bShares = Array.from({ length: this.n }, () => this.rng.next());
+        const cShares = this.tripleProduct(aShares, bShares);
+        return {
+            a: { value: aShares, mac: this.authenticate(aShares) },
+            b: { value: bShares, mac: this.authenticate(bShares) },
+            c: { value: cShares, mac: this.authenticate(cShares) },
+        };
+    }
+    /** A RAW authenticated triple (â, b, ĉ=â·b) SHARING the given authenticated `b` — the sacrifice pair. */
+    rawTripleWithB(b) {
+        const aShares = Array.from({ length: this.n }, () => this.rng.next());
+        const cShares = this.tripleProduct(aShares, b.value);
+        return {
+            a: { value: aShares, mac: this.authenticate(aShares) },
+            b,
+            c: { value: cShares, mac: this.authenticate(cShares) },
+        };
+    }
+    /**
+     * The MASCOT **sacrifice** check. Given two triples sharing `b`, `(a,b,c)` (the one to KEEP) and
+     * `(â,b,ĉ)` (the one to SACRIFICE), draw a public random challenge `e`, open `ρ = e·a − â`, form the
+     * authenticated residual `⟦τ⟧ = e·⟦c⟧ − ⟦ĉ⟧ − ρ·⟦b⟧`, open `τ`, run the commit-then-open MAC-check on
+     * both openings, and require `τ = 0`. If both triples are correct, `τ = e·(c−ab) − (ĉ−âb) = 0`; if the
+     * kept triple has `c = ab + δ`, then `τ = e·δ`, which is non-zero (e ≠ 0, δ ≠ 0) — ABORT. Lying in the
+     * `τ` opening to force a zero value is caught by the MAC-check (the forged MAC won't reconcile). The
+     * sacrificed triple is consumed by the check and discarded; the kept triple is certified `c = a·b`.
+     */
+    sacrifice(keep, sac) {
+        const ctx = this.macContext;
+        const engine = new spdz_1.SpdzEngine(ctx, []);
+        let e = this.rng.next();
+        if (e === 0n)
+            e = 1n; // public random challenge, non-zero
+        const rho = engine.open((0, spdz_1.subAuth)((0, spdz_1.scaleAuth)(keep.a, e), sac.a), 'sacrifice:rho');
+        let tau = (0, spdz_1.subAuth)((0, spdz_1.scaleAuth)(keep.c, e), sac.c);
+        tau = (0, spdz_1.subAuth)(tau, (0, spdz_1.scaleAuth)(keep.b, rho));
+        const tauValue = engine.open(tau, 'sacrifice:tau');
+        engine.macCheck(this.rng); // commit-then-open MAC-check on ρ and τ; throws MacCheckAbort on a forged MAC
+        if (tauValue !== 0n) {
+            throw new spdz_1.MacCheckAbort(`MASCOT sacrifice FAILED: residual τ=${tauValue} != 0 — a malformed Beaver triple (c != a·b) was detected in the offline phase; aborting with no triple emitted`);
+        }
+    }
+    /**
+     * Generate ONE authenticated Beaver triple with NO dealer, MALICIOUS-secure. Each party samples its
+     * own a_i, b_i; the product sharing c (Σc = a·b) comes from OT; every component is MAC'd via OT
+     * against the α shares. When the sacrifice is on (default), a SECOND triple sharing `b` is generated
+     * and sacrificed to certify `c = a·b` under the MACs, so a malformed triple ABORTS rather than being
+     * emitted. No party learns a, b, c, or α.
+     */
+    genAuthTriple() {
+        if (!this.sacrificeOn)
+            return this.rawTriple();
+        const keep = this.rawTriple();
+        const sac = this.rawTripleWithB(keep.b);
+        this.sacrifice(keep, sac);
+        return keep;
+    }
+    /** Generate `count` authenticated triples (channels/base-OTs amortized across all of them). */
+    genAuthTriples(count) {
+        const out = [];
+        for (let k = 0; k < count; k++)
+            out.push(this.genAuthTriple());
+        return out;
+    }
+    /**
+     * Authenticated input sharing of `value`, owned by party `owner`, with NO dealer. The owner splits
+     * its own value into additive shares (local); the MAC `α·value` is computed via OT against the α
+     * shares. A malicious owner can of course choose any value (inputs are unconstrained in SPDZ), but it
+     * cannot make the sharing inconsistent with its MAC — the online MAC-check binds it.
+     */
+    authInput(value, owner) {
+        if (owner < 0 || owner >= this.n)
+            throw new Error('authInput: owner out of range');
+        const valueShares = (0, sharing_1.share)((0, field_1.mod)(value), this.n, this.rng);
+        return { value: valueShares, mac: this.authenticate(valueShares) };
+    }
+    /**
+     * The MASCOT **input-consistency check**: verify that a batch of authenticated inputs each satisfy
+     * `Σγ = α·(Σvalue)` — i.e. their MACs match their values — WITHOUT revealing any value, and ABORT if
+     * not. A malicious party that produced an input whose MAC does not match its value (e.g. by feeding a
+     * bad OT input to the authentication) is caught here rather than only downstream.
+     *
+     * Method: draw public random coefficients `e_k`, generate ONE fresh OT-authenticated random mask
+     * `⟦r⟧`, form `⟦w⟧ = Σ_k e_k·⟦x_k⟧ + ⟦r⟧`, partial-open `w` (masked by the uniform `r`, so no input
+     * leaks), and run the commit-then-open MAC-check on that opening. If some input's MAC is off by `δ`,
+     * the opened `w` carries MAC residual `Σ e_k·δ_k ≠ 0` w.h.p. over the random `e_k`, and the MAC-check
+     * aborts. No-op for an empty batch.
+     */
+    checkInputConsistency(inputs) {
+        if (inputs.length === 0)
+            return;
+        for (const inp of inputs) {
+            if (inp.value.length !== this.n || inp.mac.length !== this.n) {
+                throw new Error('checkInputConsistency: input party count mismatch');
+            }
+        }
+        const ctx = this.macContext;
+        const engine = new spdz_1.SpdzEngine(ctx, []);
+        // Fresh OT-authenticated random mask ⟦r⟧ (hides w so no input value is revealed).
+        const rShares = Array.from({ length: this.n }, () => this.rng.next());
+        let w = { value: rShares, mac: this.authenticate(rShares) };
+        for (const inp of inputs) {
+            let e = this.rng.next(); // public random coefficient
+            if (e === 0n)
+                e = 1n; // weight every input (0 would skip one); bias is negligible (prob 1/p)
+            w = addAuthLocal(w, (0, spdz_1.scaleAuth)(inp, e));
+        }
+        engine.open(w, 'input-check:w');
+        engine.macCheck(this.rng); // throws MacCheckAbort if any input's MAC is inconsistent with its value
+    }
+}
+exports.NoDealerOffline = NoDealerOffline;
+/** Local authenticated addition (kept here to avoid widening mascot's spdz import surface). */
+function addAuthLocal(x, y) {
+    return {
+        value: x.value.map((xi, i) => (0, field_1.fadd)(xi, y.value[i])),
+        mac: x.mac.map((mi, i) => (0, field_1.fadd)(mi, y.mac[i])),
+    };
+}
+/** Convenience: a fresh no-dealer offline phase for `n` parties (malicious-secure by default). */
+function makeNoDealerOffline(n, seed, opts) {
+    return new NoDealerOffline(n, seed, opts);
+}
+//# sourceMappingURL=mascot.js.map

package/dist/mascot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mascot.js","sourceRoot":"","sources":["../src/mascot.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;;;AAsTH,kDAMC;AA1TD,mCAAiE;AACjE,qCAA0D;AAC1D,uCAAoD;AACpD,iCAQgB;AAChB,6BAAsE;AAEtE,oGAAoG;AACpG,MAAM,UAAU,GAAG,EAAE,CAAC;AAyBtB;;;;;;;GAOG;AACH,MAAa,eAAe;IACjB,CAAC,CAAS;IACnB,kGAAkG;IACzF,WAAW,CAAW;IACd,GAAG,CAAW;IACd,IAAI,CAAS;IAC9B,mGAAmG;IAClF,aAAa,CAAU;IACxC,iGAAiG;IAChF,QAAQ,GAAG,IAAI,GAAG,EAAqB,CAAC;IACzD,6FAA6F;IAC5E,WAAW,CAAU;IACtC,kFAAkF;IACjE,SAAS,CAAoB;IAC9C,mGAAmG;IAC3F,eAAe,GAAG,CAAC,CAAC;IAE5B,YAAY,CAAS,EAAE,IAAa,EAAE,OAAwB,EAAE;QAC9D,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACpG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACX,mGAAmG;QACnG,uGAAuG;QACvG,IAAI,CAAC,aAAa,GAAG,IAAI,KAAK,SAAS,CAAC;QACxC,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,cAAc,CAAC;QACnC,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,gBAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,uBAAc,EAAE,CAAC;QAC/E,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC;QAC1C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAChC,oGAAoG;QACpG,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACtE,CAAC;IAED;;;;OAIG;IACH,IAAI,UAAU;QACZ,IAAI,KAAK,GAAG,EAAE,CAAC;QACf,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,WAAW;YAAE,KAAK,GAAG,IAAA,YAAI,EAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC3D,OAAO,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC;IACrE,CAAC;IAEO,OAAO,CAAC,CAAS,EAAE,CAAS;QAClC,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,IAAI,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,iGAAiG;YACjG,MAAM,KAAK,GAAa,IAAI,CAAC,aAAa;gBACxC,CAAC,CAAC,IAAA,aAAQ,EAAC,IAAA,eAAU,EAAC,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC;gBACtG,CAAC,CAAC,IAAA,uBAAc,GAAE,CAAC;YACrB,EAAE,GAAG,IAAI,cAAS,CAAC,KAAK,CAAC,CAAC;YAC1B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED;;;;OAIG;IACK,MAAM,CAAC,CAAS,EAAE,CAAS,EAAE,EAAU,EAAE,EAAU;QACzD,MAAM,CAAC,GAAG,IAAA,WAAG,EAAC,EAAE,CAAC,CAAC;QAClB,MAAM,CAAC,GAAG,IAAA,WAAG,EAAC,EAAE,CAAC,CAAC;QAClB,6EAA6E;QAC7E,MAAM,UAAU,GAAa,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC;QACnD,MAAM,IAAI,GAAa,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAa,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC;QAC7C,IAAI,SAAS,GAAG,EAAE,CAAC,CAAC,QAAQ;QAC5B,IAAI,GAAG,GAAG,EAAE,CAAC,CAAC,+BAA+B;QAC7C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC;YACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YAC5B,SAAS,GAAG,IAAA,YAAI,EAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YACjC,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;YACd,IAAI,CAAC,CAAC,CAAC,GAAG,IAAA,YAAI,EAAC,GAAG,EAAE,IAAA,YAAI,EAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;YAClC,UAAU,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;YAC9C,GAAG,GAAG,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,aAAK,CAAC;QAC3B,CAAC;QACD,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACvE,IAAI,WAAW,GAAG,EAAE,CAAC,CAAC,uBAAuB;QAC7C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,EAAE,CAAC,EAAE;YAAE,WAAW,GAAG,IAAA,YAAI,EAAC,WAAW,EAAE,IAAA,WAAG,EAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC;QACxF,kEAAkE;QAClE,OAAO,CAAC,WAAW,EAAE,IAAA,YAAI,EAAC,SAAS,CAAC,CAAC,CAAC;IACxC,CAAC;IAED;;;;OAIG;IACH,eAAe,CAAC,CAAc,EAAE,CAAc;QAC5C,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACjG,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,IAAA,YAAI,EAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,2BAA2B;QACxE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAChC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;gBAChC,IAAI,CAAC,KAAK,CAAC;oBAAE,SAAS;gBACtB,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,qBAAqB;gBACvE,CAAC,CAAC,CAAC,CAAC,GAAG,IAAA,YAAI,EAAC,CAAC,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC;gBACvB,CAAC,CAAC,CAAC,CAAC,GAAG,IAAA,YAAI,EAAC,CAAC,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,qGAAqG;IAC7F,YAAY,CAAC,WAAwB;QAC3C,OAAO,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IAC7D,CAAC;IAED;;;;OAIG;IACK,aAAa,CAAC,CAAc,EAAE,CAAc;QAClD,MAAM,CAAC,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC;QAC3B,IAAI,GAAG,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG;YAAE,CAAC,CAAC,CAAC,CAAC,GAAG,IAAA,YAAI,EAAC,CAAC,CAAC,CAAC,CAAE,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QACjE,OAAO,CAAC,CAAC;IACX,CAAC;IAED,yFAAyF;IACjF,SAAS;QACf,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACtE,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACtE,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACrD,OAAO;YACL,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE;YACtD,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE;YACtD,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE;SACvD,CAAC;IACJ,CAAC;IAED,yGAAyG;IACjG,cAAc,CAAC,CAAS;QAC9B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACtE,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QACrD,OAAO;YACL,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE;YACtD,CAAC;YACD,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE;SACvD,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACK,SAAS,CAAC,IAAgB,EAAE,GAAe;QACjD,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC;QAC5B,MAAM,MAAM,GAAG,IAAI,iBAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACvC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,KAAK,EAAE;YAAE,CAAC,GAAG,EAAE,CAAC,CAAC,oCAAoC;QAC1D,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAA,cAAO,EAAC,IAAA,gBAAS,EAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;QAC/E,IAAI,GAAG,GAAG,IAAA,cAAO,EAAC,IAAA,gBAAS,EAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QAC/C,GAAG,GAAG,IAAA,cAAO,EAAC,GAAG,EAAE,IAAA,gBAAS,EAAC,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;QACnD,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,8EAA8E;QACzG,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;YACpB,MAAM,IAAI,oBAAa,CACrB,uCAAuC,QAAQ,iHAAiH,CACjK,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,aAAa;QACX,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC;QAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,+FAA+F;IAC/F,cAAc,CAAC,KAAa;QAC1B,MAAM,GAAG,GAAiB,EAAE,CAAC;QAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE;YAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;QAC/D,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;OAKG;IACH,SAAS,CAAC,KAAa,EAAE,KAAa;QACpC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACnF,MAAM,WAAW,GAAG,IAAA,eAAK,EAAC,IAAA,WAAG,EAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QACxD,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,EAAE,CAAC;IACrE,CAAC;IAED;;;;;;;;;;;OAWG;IACH,qBAAqB,CAAC,MAA6B;QACjD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAChC,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;YACzB,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,EAAE,CAAC;gBAC7D,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC;QAC5B,MAAM,MAAM,GAAG,IAAI,iBAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACvC,kFAAkF;QAClF,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACtE,IAAI,CAAC,GAAW,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;QACpE,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;YACzB,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,4BAA4B;YACrD,IAAI,CAAC,KAAK,EAAE;gBAAE,CAAC,GAAG,EAAE,CAAC,CAAC,uEAAuE;YAC7F,CAAC,GAAG,YAAY,CAAC,CAAC,EAAE,IAAA,gBAAS,EAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QACzC,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;QAChC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,yEAAyE;IACtG,CAAC;CACF;AA7OD,0CA6OC;AAED,+FAA+F;AAC/F,SAAS,YAAY,CAAC,CAAS,EAAE,CAAS;IACxC,OAAO;QACL,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,IAAA,YAAI,EAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;QACpD,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,IAAA,YAAI,EAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,CAAC;KAC/C,CAAC;AACJ,CAAC;AAcD,kGAAkG;AAClG,SAAgB,mBAAmB,CACjC,CAAS,EACT,IAAa,EACb,IAAsB;IAEtB,OAAO,IAAI,eAAe,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAC5C,CAAC"}