@atlasauth/pca-mpc 0.0.0-stage → 0.2.0

package/dist/ot.js

@@ -0,0 +1,536 @@
+"use strict";
+/**
+ * Oblivious transfer — the real cryptographic root of the no-dealer offline phase.
+ *
+ * A 1-out-of-2 OT lets a RECEIVER with a choice bit `c` obtain exactly message `m_c` from a SENDER's
+ * pair `(m_0, m_1)`, such that the sender learns nothing about `c` and the receiver learns nothing
+ * about `m_{1−c}`. That single primitive is enough to multiply two parties' secret shares without a
+ * dealer (Gilboa's trick, see `mascot.ts`), which is enough to generate Beaver triples and SPDZ MACs
+ * with no trusted party. This module provides OT two ways:
+ *
+ *  1. **Base OT — MALICIOUSLY-secure Chou–Orlandi over the Ed25519 subgroup (`ec.ts`).** The core is
+ *     "simplest OT": sender samples `y`, publishes `S = y·B`, holds `T = y·S`; receiver with choice `c`
+ *     samples `x`, publishes `R = x·B + c·S`, derives pad `k = H(x·S)`; sender derives `k_b = H(y·R − b·T)`
+ *     for `b∈{0,1}`; since `y·R = x·(y·B) + c·T`, `k_c = k` while `k_{1−c}` is `H` of a point the receiver
+ *     can't compute (it would need the discrete log). **Receiver-choice privacy is information-theoretic
+ *     in the transcript:** `R = x·B + c·S` with `x` uniform is a uniform subgroup element whatever `c` is
+ *     — for every observed `R` there is one `x` consistent with `c=0` and one with `c=1` (`x' = x − y`),
+ *     so the sender's view is identically distributed for both choices. Two additions upgrade this from
+ *     semi-honest to **malicious-secure against both a cheating sender AND a cheating receiver** (docs
+ *     §7.1 item a):
+ *       • **the sender proves knowledge of `y` with a Schnorr NIZK on `S = y·B`** (`ec.ts`), so a sender
+ *         cannot use an `S` it cannot open (e.g. one crafted to leak the receiver's choice) — the
+ *         receiver verifies the proof and ABORTS before forming `R`;
+ *       • **every received point is validated** (on-curve + prime-order-subgroup cofactor check +
+ *         non-identity): the receiver validates `S`, the sender validates every `R_i`, so neither party
+ *         can inject an off-curve / small-order / mixed-order point for a small-subgroup attack.
+ *     The IKNP setup consumes this as a **random OT** (`malBaseRandomOT`): the two transferred seeds ARE
+ *     the RO pads `(H(y·R), H(y·R − T))`, so there are **no sender-chosen ciphertexts** and hence no
+ *     selective-failure surface — the only abort (bad `S`/proof/`R_i`) is independent of the receiver's
+ *     selector, which is exactly what malicious security of the role-inverted base OTs requires. The
+ *     chosen-message `baseOT` wrapper (random OT + one-time-pad + a commit-to-message check) is used by
+ *     the direct OT tests; its commitment catches a sender that encrypts inconsistently with its commitment.
+ *
+ *  2. **OT extension — IKNP + the KOS consistency check (MALICIOUS-secure).** Base OT needs public-key
+ *     ops per transfer; the offline phase needs hundreds of thousands of OTs. IKNP turns `κ = 128` base
+ *     OTs (done once) into arbitrarily many OTs using only a hash/PRG. Roles invert for the base OTs:
+ *     the extension SENDER plays base-receiver with a secret selector `s ∈ {0,1}^κ`; the extension
+ *     RECEIVER plays base-sender with `κ` seed pairs. Thereafter each extension round of `m` OTs costs
+ *     `κ` PRG expansions plus `~3·m` hashes. Correctness: the receiver recovers exactly `m_{c_j}` for
+ *     every `j`; the sender's `s` (hidden by the base OTs) and the correlation-robust hash keep the
+ *     unchosen messages hidden.
+ *
+ *     Plain IKNP is only SEMI-HONEST: a cheating RECEIVER can send an extension matrix `u` that encodes
+ *     *different* choice vectors in different columns, which breaks the row correlation `q_j = t_j ⊕
+ *     (b_j·s)` and lets the receiver learn bits of the sender's selector `s` (and thus the unchosen
+ *     messages). The **KOS correlation check** (Keller–Orsini–Scholl, "Actively Secure OT Extension
+ *     with Optimal Overhead") closes exactly this: after `u` is on the wire, the parties draw public
+ *     random weights `χ_j ∈ GF(2^κ)` (one per row, bound to `u` by a Fiat–Shamir hash here), the
+ *     receiver reveals `x = Σ_j b_j·χ_j` and `t = Σ_j χ_j·t_j`, and the sender checks
+ *     `Σ_j χ_j·q_j == t ⊕ x·s` in GF(2^κ). Honestly this always holds (`q_j = t_j ⊕ b_j·s`); a receiver
+ *     who deviated in `u` satisfies it with probability ≤ `2^{-κ} = 2^{-128}`, so a deviation ABORTS.
+ *     The check is run over `m + κ + SSEC` rows — the extra `κ + SSEC` random "sacrifice" OT rows mask
+ *     the revealed combination (receiver privacy) and give statistical soundness. This makes the OT
+ *     extension **malicious-secure**, not just semi-honest.
+ *
+ * In-process model: both parties run in one process and the functions take *both* parties' inputs and
+ * return the receiver's outputs plus an inspectable transcript (the receiver's wire message `R`, the
+ * sender's ciphertexts, the IKNP `u` matrix). That is exactly what the tests assert over: receiver
+ * correctness, sender-side choice-hiding from the transcript, and the KOS check aborting on a tampered
+ * `u`. See docs §7.1 for the remaining boundary (real async transport, constant-time, CSPRNG).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OtChannel = exports.BaseOtAbort = exports.MalOtAbort = exports.SSEC = exports.KAPPA = void 0;
+exports.splitMix64 = splitMix64;
+exports.otRandom = otRandom;
+exports.malBaseRandomOT = malBaseRandomOT;
+exports.baseOT = baseOT;
+const node_crypto_1 = require("node:crypto");
+const ec_1 = require("./ec");
+const gf128_1 = require("./gf128");
+const csprng_1 = require("./csprng");
+/** IKNP security parameter (number of base OTs / width of the selector s). */
+exports.KAPPA = 128;
+/**
+ * KOS statistical-security parameter: the number of EXTRA random check-OT rows (beyond the `κ` that
+ * mask the revealed combination) appended to every extension round. Together `κ + SSEC` padding rows
+ * give the correlation check its receiver-privacy and statistical soundness margin.
+ */
+exports.SSEC = 64;
+/** Raised when the KOS correlation check fails: a cheating OT-extension receiver is detected → ABORT. */
+class MalOtAbort extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'MalOtAbort';
+    }
+}
+exports.MalOtAbort = MalOtAbort;
+/** Seed length in bytes for base-OT messages / IKNP seeds (κ = 128 bits). */
+const SEED_BYTES = exports.KAPPA / 8;
+/** A raw SplitMix64 64-bit stream (deterministic). Production uses a CSPRNG with a secret seed. */
+function splitMix64(seed) {
+    const MASK64 = (1n << 64n) - 1n;
+    let s = seed & MASK64;
+    return () => {
+        s = (s + 0x9e3779b97f4a7c15n) & MASK64;
+        let z = s;
+        z = ((z ^ (z >> 30n)) * 0xbf58476d1ce4e5b9n) & MASK64;
+        z = ((z ^ (z >> 27n)) * 0x94d049bb133111ebn) & MASK64;
+        z = (z ^ (z >> 31n)) & MASK64;
+        return z;
+    };
+}
+/** Build an OtRandom from a SplitMix64-style 64-bit stream (deterministic; CSPRNG in production). */
+function otRandom(next64) {
+    return {
+        scalar() {
+            // Assemble 256 bits then reduce mod L; reject 0.
+            for (;;) {
+                let acc = 0n;
+                for (let i = 0; i < 4; i++)
+                    acc = (acc << 64n) | next64();
+                const s = acc % ec_1.L;
+                if (s !== 0n)
+                    return s;
+            }
+        },
+        bytes(n) {
+            const out = new Uint8Array(n);
+            let have = 0;
+            while (have < n) {
+                let v = next64();
+                for (let i = 0; i < 8 && have < n; i++) {
+                    out[have++] = Number(v & 0xffn);
+                    v >>= 8n;
+                }
+            }
+            return out;
+        },
+    };
+}
+// --------------------------------------------------------------------------------------------------
+// Hash / PRG helpers (SHA-256 based). Deterministic; a production build uses the same constructions
+// over a CSPRNG and a formally correlation-robust hash.
+// --------------------------------------------------------------------------------------------------
+function sha256(...chunks) {
+    const h = (0, node_crypto_1.createHash)('sha256');
+    for (const c of chunks)
+        h.update(c);
+    return new Uint8Array(h.digest());
+}
+function u32(x) {
+    const b = new Uint8Array(4);
+    b[0] = (x >>> 24) & 0xff;
+    b[1] = (x >>> 16) & 0xff;
+    b[2] = (x >>> 8) & 0xff;
+    b[3] = x & 0xff;
+    return b;
+}
+/** Key-derivation from a group point: H("ot-kdf" ‖ index ‖ encode(P)) → SEED_BYTES bytes. */
+function kdfPoint(index, p) {
+    return sha256(TAG_KDF, u32(index), (0, ec_1.encodePoint)(p)).slice(0, SEED_BYTES);
+}
+const TAG_KDF = new TextEncoder().encode('atlas-pca-mpc/ot-kdf');
+const TAG_PRG = new TextEncoder().encode('atlas-pca-mpc/ot-prg');
+const TAG_CRH = new TextEncoder().encode('atlas-pca-mpc/ot-crh');
+const TAG_KOS = new TextEncoder().encode('atlas-pca-mpc/ot-kos');
+const TAG_COMMIT = new TextEncoder().encode('atlas-pca-mpc/ot-msg-commit');
+/**
+ * Derive the KOS row-weights χ_j ∈ GF(2^128) for one extension round, bound to the committed `u`
+ * matrix (Fiat–Shamir). The sender and receiver both derive the SAME χ from the `u` on the wire, so a
+ * cheating receiver cannot pick `u` after seeing χ. In the real protocol χ comes from a secure
+ * coin-flip after the receiver commits to `u`; the transcript-hash here models that round and keeps the
+ * check deterministic for tests. The seed expands through a fast (non-crypto) stream — fine because χ
+ * only needs to be unpredictable-before-commit and uniform, which the hash seed provides.
+ */
+function kosChallenges(u, mExt) {
+    const h = (0, node_crypto_1.createHash)('sha256');
+    h.update(TAG_KOS);
+    h.update(u32(u.length));
+    const buf = new Uint8Array(SEED_BYTES);
+    for (const col of u) {
+        let v = col;
+        for (let i = 0; i < SEED_BYTES; i++) {
+            buf[i] = Number(v & 0xffn);
+            v >>= 8n;
+        }
+        h.update(buf);
+    }
+    const digest = new Uint8Array(h.digest());
+    let lo = 0n;
+    for (let i = 0; i < 8; i++)
+        lo |= BigInt(digest[i]) << BigInt(8 * i);
+    let hi = 0n;
+    for (let i = 8; i < 16; i++)
+        hi |= BigInt(digest[i]) << BigInt(8 * (i - 8));
+    const s0 = splitMix64(lo === 0n ? 1n : lo);
+    const s1 = splitMix64(hi === 0n ? 0x9e3779b97f4a7c15n : hi);
+    const chi = new Array(mExt);
+    for (let j = 0; j < mExt; j++)
+        chi[j] = (s0() << 64n) | s1();
+    return chi;
+}
+/** XOR into `acc` the χ_j for every SET bit `j` of the (≤ mExt-bit) column `col`, fast via 32-bit words. */
+function accumSetBits(col, chi, acc) {
+    let v = col;
+    let base = 0;
+    while (v > 0n) {
+        let w = Number(v & 0xffffffffn) >>> 0;
+        v >>= 32n;
+        while (w !== 0) {
+            const b = w & -w; // lowest set bit
+            const j = base + (31 - Math.clz32(b));
+            acc = (0, gf128_1.gf128Add)(acc, chi[j]);
+            w ^= b;
+        }
+        base += 32;
+    }
+    return acc;
+}
+/** XOR two equal-length byte arrays. */
+function xorBytes(a, b) {
+    const out = new Uint8Array(a.length);
+    for (let i = 0; i < a.length; i++)
+        out[i] = a[i] ^ b[i];
+    return out;
+}
+/** PRG: expand a seed to `nbits` bits as a bigint, from block offset `startBlock` (counter mode). */
+function prgBits(seed, startBlock, nbits) {
+    const nBlocks = Math.ceil(nbits / 256);
+    let acc = 0n;
+    let produced = 0;
+    for (let t = 0; t < nBlocks; t++) {
+        const block = sha256(TAG_PRG, seed, u32(startBlock + t));
+        for (let i = 0; i < 32 && produced < nbits; i++) {
+            acc |= BigInt(block[i]) << BigInt(produced);
+            produced += 8;
+        }
+    }
+    // Mask to exactly nbits.
+    return acc & ((1n << BigInt(nbits)) - 1n);
+}
+/** Correlation-robust hash H(j, row) → a 64-bit mask (field messages are < 2^61). */
+function crh(j, row) {
+    const rowBytes = new Uint8Array(SEED_BYTES);
+    let v = row;
+    for (let i = 0; i < SEED_BYTES; i++) {
+        rowBytes[i] = Number(v & 0xffn);
+        v >>= 8n;
+    }
+    const d = sha256(TAG_CRH, u32(j), rowBytes);
+    let acc = 0n;
+    for (let i = 0; i < 8; i++)
+        acc |= BigInt(d[i]) << BigInt(8 * i);
+    return acc;
+}
+// --------------------------------------------------------------------------------------------------
+// Base OT — MALICIOUSLY-secure Chou–Orlandi, batched (docs §7.1 item a).
+//
+// Two hardening layers upgrade the semi-honest "simplest OT" to malicious security against BOTH roles:
+//   • the SENDER proves knowledge of `y` with a Schnorr NIZK on `S = y·B` (`ec.ts`); the receiver
+//     verifies it and ABORTS before forming any `R`, so a sender cannot use an `S` it cannot open;
+//   • every point crossing the trust boundary is validated (on-curve + prime-order cofactor check +
+//     non-identity): the receiver validates `S` (and the proof's `U`), the sender validates every
+//     `R_i`, so neither party can inject an off-curve / small-order / mixed-order point.
+// The core is run as a RANDOM OT (`malBaseRandomOT`): the two transferred seeds ARE the RO pads, so
+// there are no sender-chosen ciphertexts and no selective-failure surface. The chosen-message `baseOT`
+// wrapper then one-time-pads the messages under those pads AND sends a per-message RO commitment; the
+// receiver recomputes the commitment on the message+pad it recovers and aborts on a mismatch — this is
+// what catches a sender that encrypts a message inconsistent with what it committed.
+// --------------------------------------------------------------------------------------------------
+/** Raised when a base OT aborts: a cheating sender (bad proof / inconsistent ciphertext) is detected. */
+class BaseOtAbort extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'BaseOtAbort';
+    }
+}
+exports.BaseOtAbort = BaseOtAbort;
+/** Per-message RO commitment com_{i,b} = H(TAG ‖ i ‖ b ‖ msg ‖ pad). */
+function otCommit(i, b, msg, pad) {
+    return sha256(TAG_COMMIT, u32(i), Uint8Array.of(b & 1), msg, pad);
+}
+function ctEqual(a, b) {
+    return a.length === b.length && (0, node_crypto_1.timingSafeEqual)(Buffer.from(a), Buffer.from(b));
+}
+/**
+ * The MALICIOUS-secure RANDOM base OT: `count = choices.length` 1-of-2 random OTs. The sender publishes
+ * `S = y·B` with a Schnorr proof of knowledge of `y`; the receiver validates `S` + the proof and
+ * ABORTS on failure, then forms its `R_i`; the sender validates every `R_i` and derives the pad pairs.
+ * No messages are transferred — the pads ARE the random output. `tamper` injects malicious behaviour
+ * for tests. Both parties are simulated in-process.
+ */
+function malBaseRandomOT(choices, rng = (0, csprng_1.secureOtRandom)(), tamper) {
+    const count = choices.length;
+    // --- Sender setup: S = y·B, T = y·S, and a Schnorr proof of knowledge of y. ---
+    const y = rng.scalar();
+    const S0 = (0, ec_1.mulBase)(y);
+    const Tpt = (0, ec_1.mul)(y, S0); // T = y·S = y²·B
+    const proof0 = (0, ec_1.schnorrProve)(y, S0, () => rng.scalar());
+    // What actually goes on the wire (a malicious sender may tamper either).
+    const S = tamper?.tamperS ? tamper.tamperS(S0) : S0;
+    const proof = tamper?.tamperProof ? tamper.tamperProof(proof0) : proof0;
+    // --- Receiver: validate the sender's point + proof BEFORE forming any R (malicious-sender guard). ---
+    (0, ec_1.assertInSubgroup)(S, 'base-OT S (received by receiver)');
+    if (!(0, ec_1.schnorrVerify)(S, proof)) {
+        throw new BaseOtAbort('base OT: sender Schnorr proof-of-knowledge of S=y·B failed; aborting');
+    }
+    // --- Receiver: choose x_i, form R_i = x_i·B (+ S if c_i=1), derive recvPad_i = H(x_i·S). ---
+    const R = [];
+    const recvPads = [];
+    for (let i = 0; i < count; i++) {
+        const x = rng.scalar();
+        const ci = choices[i] & 1;
+        const Ri = ci === 1 ? (0, ec_1.add)((0, ec_1.mulBase)(x), S) : (0, ec_1.mulBase)(x);
+        R.push(Ri);
+        recvPads.push(kdfPoint(i, (0, ec_1.mul)(x, S)));
+    }
+    // A malicious receiver may tamper the R it sends on the wire (test-injected).
+    if (tamper?.tamperR)
+        tamper.tamperR(R);
+    // --- Sender: validate every received R_i (malicious-receiver / small-subgroup guard), then derive pads. ---
+    const senderPads = [];
+    for (let i = 0; i < count; i++) {
+        (0, ec_1.assertInSubgroup)(R[i], `base-OT R_${i} (received by sender)`);
+        const yR = (0, ec_1.mul)(y, R[i]);
+        senderPads.push([kdfPoint(i, yR), kdfPoint(i, (0, ec_1.sub)(yR, Tpt))]);
+    }
+    return { S, proof, R, senderPads, recvPads };
+}
+/**
+ * Run `count` MALICIOUS-secure base OTs in one batch (chosen-message, over the random OT above).
+ * `messages[i] = [m0, m1]` (SEED_BYTES each), the sender's pair; `choices[i] ∈ {0,1}` the receiver's
+ * choice. The sender one-time-pads each message under the random-OT pads and commits to each message;
+ * the receiver recovers `m_{i,c_i}` and checks the commitment, aborting (`BaseOtAbort`) on any
+ * inconsistency. Returns the receiver's recovered messages and the full transcript.
+ */
+function baseOT(messages, choices, rng = (0, csprng_1.secureOtRandom)(), tamper) {
+    if (messages.length !== choices.length)
+        throw new Error('baseOT: messages/choices length mismatch');
+    const count = messages.length;
+    const ro = malBaseRandomOT(choices, rng, tamper);
+    // Sender: E_{i,b} = m_{i,b} ⊕ pad_{i,b}, and commit com_{i,b} = H(i ‖ b ‖ m_{i,b} ‖ pad_{i,b}).
+    const ct = [];
+    const com = [];
+    for (let i = 0; i < count; i++) {
+        const [p0, p1] = ro.senderPads[i];
+        ct.push([xorBytes(messages[i][0], p0), xorBytes(messages[i][1], p1)]);
+        com.push([otCommit(i, 0, messages[i][0], p0), otCommit(i, 1, messages[i][1], p1)]);
+    }
+    // A malicious sender may corrupt the ciphertexts on the wire (inconsistent with the commitment).
+    if (tamper?.tamperCiphertext)
+        tamper.tamperCiphertext(ct);
+    // Receiver: decrypt the chosen ciphertext with its pad, then CHECK the commitment it can open.
+    const received = [];
+    for (let i = 0; i < count; i++) {
+        const ci = choices[i] & 1;
+        const m = xorBytes(ct[i][ci], ro.recvPads[i]);
+        const check = otCommit(i, ci, m, ro.recvPads[i]);
+        if (!ctEqual(check, com[i][ci])) {
+            throw new BaseOtAbort(`base OT (index ${i}): sender ciphertext inconsistent with its commitment; aborting`);
+        }
+        received.push(m);
+    }
+    return { received, transcript: { S: ro.S, proof: ro.proof, R: ro.R, ct, com } };
+}
+// --------------------------------------------------------------------------------------------------
+// OT extension — IKNP (semi-honest), as a stateful in-process channel for one (receiver, sender) pair.
+// --------------------------------------------------------------------------------------------------
+/**
+ * An IKNP OT-extension channel between a fixed RECEIVER (choice bits) and SENDER (message pairs). The
+ * κ base OTs run lazily on the first `extend`; each later `extend(m)` is a cheap PRG+hash round. The
+ * channel is stateful (advances per-seed PRG counters) so many rounds compose into one amortized setup.
+ */
+class OtChannel {
+    rng;
+    /** Optional post-quantum (or otherwise custom) base OT for the κ setup OTs; defaults to EC `baseOT`. */
+    baseOtFn;
+    ready = false;
+    // Extension-sender state: selector s (κ bits) and the κ seeds it learned (k_i^{s_i}).
+    s = [];
+    sBits = 0n; // s packed as a κ-bit bigint (cached)
+    senderSeeds = [];
+    senderBlk = [];
+    // Extension-receiver state: κ seed pairs.
+    recvSeed0 = [];
+    recvSeed1 = [];
+    recvBlk0 = [];
+    recvBlk1 = [];
+    /** The base-OT transcript (available after setup) — exposed for inspection/tests. */
+    baseTranscript;
+    /**
+     * TEST-ONLY injection modelling a MALICIOUS extension RECEIVER: if set, it is called with the honest
+     * `u` matrix (κ columns, each `mExt` bits) just before it goes "on the wire", and may mutate it (e.g.
+     * XOR a delta into one or more columns) to encode inconsistent choices. The KOS check is computed
+     * over the tampered `u` (what the sender sees) while the receiver's revealed `(x, t)` stay honest, so
+     * a non-trivial tamper is caught — the real malicious-receiver attack that KOS defeats.
+     */
+    tamperU;
+    round = 0;
+    /**
+     * `rng` defaults to the CSPRNG (`secureOtRandom`, `node:crypto`) — production randomness. Pass a
+     * deterministic `otRandom(splitMix64(seed))` ONLY to make a test bit-reproducible (docs §7.1 item c).
+     */
+    constructor(rng = (0, csprng_1.secureOtRandom)(), opts) {
+        this.rng = rng;
+        this.baseOtFn = opts?.baseOtFn;
+    }
+    setup() {
+        // Extension-RECEIVER is the base-SENDER: it generates κ seed pairs.
+        const messages = [];
+        for (let i = 0; i < exports.KAPPA; i++) {
+            const k0 = this.rng.bytes(SEED_BYTES);
+            const k1 = this.rng.bytes(SEED_BYTES);
+            this.recvSeed0.push(k0);
+            this.recvSeed1.push(k1);
+            this.recvBlk0.push(0);
+            this.recvBlk1.push(0);
+            messages.push([k0, k1]);
+        }
+        // Extension-SENDER is the base-RECEIVER with selector s: it learns k_i^{s_i}.
+        this.s = Array.from({ length: exports.KAPPA }, () => {
+            const b = this.rng.bytes(1);
+            return b[0] & 1;
+        });
+        if (this.baseOtFn) {
+            // Custom (e.g. post-quantum ML-KEM) base OT: its transcript shape differs, so leave the
+            // EC-typed `baseTranscript` unset.
+            this.senderSeeds = this.baseOtFn(messages, this.s, this.rng).received;
+        }
+        else {
+            const base = baseOT(messages, this.s, this.rng);
+            this.senderSeeds = base.received;
+            this.baseTranscript = base.transcript;
+        }
+        this.senderBlk = new Array(exports.KAPPA).fill(0);
+        let acc = 0n;
+        for (let i = 0; i < exports.KAPPA; i++)
+            acc |= BigInt(this.s[i]) << BigInt(i);
+        this.sBits = acc;
+        this.ready = true;
+    }
+    /** Selector s as a κ-bit bigint (sender-side secret; exposed only for tests). */
+    get selector() {
+        if (!this.ready)
+            this.setup();
+        return this.sBits;
+    }
+    /**
+     * One MALICIOUS-secure extension round: `choiceBits[j] ∈ {0,1}` (receiver), `msg0[j]/msg1[j]`
+     * field-element messages (sender). Returns the receiver's chosen messages `msg_{choiceBits[j]}[j]`
+     * for the `m` real rows. The round transparently appends `κ + SSEC` random check-OT rows and runs the
+     * **KOS correlation check** over all `m + κ + SSEC` rows; a cheating receiver (tampered `u`) is caught
+     * there and the round throws `MalOtAbort`. `uMatrix` (the receiver→sender wire message, now
+     * `mExt`-bit) is returned for tests.
+     */
+    extend(choiceBits, msg0, msg1) {
+        if (!this.ready)
+            this.setup();
+        const m = choiceBits.length;
+        if (msg0.length !== m || msg1.length !== m)
+            throw new Error('OtChannel.extend: length mismatch');
+        if (m === 0)
+            return { received: [], uMatrix: [] };
+        const roundIdx = this.round++;
+        // --- KOS padding: append κ+SSEC random check-OT rows (no messages are transferred for them). ---
+        const pad = exports.KAPPA + exports.SSEC;
+        const mExt = m + pad;
+        const padChoice = new Array(pad);
+        for (let p = 0; p < pad; p++)
+            padChoice[p] = this.rng.bytes(1)[0] & 1;
+        // Full choice vector (real ‖ padding) as an mExt-bit bigint, and a per-row accessor for the check.
+        let bvec = 0n;
+        for (let j = 0; j < m; j++)
+            if (choiceBits[j] & 1)
+                bvec |= 1n << BigInt(j);
+        for (let p = 0; p < pad; p++)
+            if (padChoice[p] & 1)
+                bvec |= 1n << BigInt(m + p);
+        const blocks = Math.ceil(mExt / 256);
+        // Receiver forms t_i, u_i = PRG(k1) ⊕ t_i ⊕ bvec  (over all mExt rows).
+        const t = new Array(exports.KAPPA);
+        const u = new Array(exports.KAPPA);
+        for (let i = 0; i < exports.KAPPA; i++) {
+            const ti = prgBits(this.recvSeed0[i], this.recvBlk0[i], mExt);
+            const gi = prgBits(this.recvSeed1[i], this.recvBlk1[i], mExt);
+            this.recvBlk0[i] += blocks;
+            this.recvBlk1[i] += blocks;
+            t[i] = ti;
+            u[i] = gi ^ ti ^ bvec;
+        }
+        // A malicious receiver may tamper the u it sends on the wire (test-injected).
+        if (this.tamperU)
+            this.tamperU(u, roundIdx);
+        // Sender computes q_i = (s_i ? u_i : 0) ⊕ PRG(k_i^{s_i}).  => q_i = t_i ⊕ (s_i · bvec) if honest.
+        const q = new Array(exports.KAPPA);
+        for (let i = 0; i < exports.KAPPA; i++) {
+            const ks = prgBits(this.senderSeeds[i], this.senderBlk[i], mExt);
+            this.senderBlk[i] += blocks;
+            q[i] = (this.s[i] === 1 ? u[i] : 0n) ^ ks;
+        }
+        const sBits = this.sBits;
+        // --- KOS correlation check (GF(2^128), column-domain fold over all mExt rows). ---
+        // χ_j bound to the (possibly tampered) u on the wire. Receiver reveals x = Σ b_j·χ_j and
+        // t_comb = Σ χ_j·t_j; sender checks Σ χ_j·q_j == t_comb ⊕ x·s. Honestly q_j = t_j ⊕ b_j·s so it
+        // holds; a receiver who tampered u passes with prob ≤ 2^{-128}, else ABORT.
+        const chi = kosChallenges(u, mExt);
+        // x = Σ_{j: b_j=1} χ_j  (receiver side; over real + padding choices, so real choices stay masked).
+        let x = 0n;
+        x = accumSetBits(bvec, chi, x);
+        // t_comb = Σ_i (Σ_{j: t_i has bit j} χ_j)·x^i ;  q_comb likewise from q_i.
+        let tComb = 0n;
+        let qComb = 0n;
+        for (let i = 0; i < exports.KAPPA; i++) {
+            const at = accumSetBits(t[i], chi, 0n);
+            const aq = accumSetBits(q[i], chi, 0n);
+            tComb = (0, gf128_1.gf128Add)(tComb, (0, gf128_1.gf128MulByXi)(at, i));
+            qComb = (0, gf128_1.gf128Add)(qComb, (0, gf128_1.gf128MulByXi)(aq, i));
+        }
+        const expected = (0, gf128_1.gf128Add)(tComb, (0, gf128_1.gf128Mul)(x, sBits));
+        if (qComb !== expected) {
+            throw new MalOtAbort(`KOS correlation check FAILED (round ${roundIdx}): a cheating OT-extension receiver was detected; aborting`);
+        }
+        // --- Only the m real rows carry messages. Sender: y0_j = msg0_j ⊕ H(j,qrow_j), y1 ⊕ H(j,qrow⊕s). ---
+        const y0 = new Array(m);
+        const y1 = new Array(m);
+        for (let j = 0; j < m; j++) {
+            let qrow = 0n;
+            for (let i = 0; i < exports.KAPPA; i++)
+                qrow |= ((q[i] >> BigInt(j)) & 1n) << BigInt(i);
+            y0[j] = msg0[j] ^ crh(j, qrow);
+            y1[j] = msg1[j] ^ crh(j, qrow ^ sBits);
+        }
+        // Receiver: recovered_j = y_{b_j}[j] ⊕ H(j, trow_j).
+        const received = new Array(m);
+        for (let j = 0; j < m; j++) {
+            let trow = 0n;
+            for (let i = 0; i < exports.KAPPA; i++)
+                trow |= ((t[i] >> BigInt(j)) & 1n) << BigInt(i);
+            const bj = choiceBits[j] & 1;
+            received[j] = (bj === 1 ? y1[j] : y0[j]) ^ crh(j, trow);
+        }
+        return { received, uMatrix: u };
+    }
+}
+exports.OtChannel = OtChannel;
+//# sourceMappingURL=ot.js.map

package/dist/ot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ot.js","sourceRoot":"","sources":["../src/ot.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;;;AAiDH,gCAWC;AAGD,4BAwBC;AA+ND,0CA8CC;AASD,wBAsCC;AAjZD,6CAA0D;AAC1D,6BAYc;AACd,mCAA2D;AAC3D,qCAA0C;AAE1C,8EAA8E;AACjE,QAAA,KAAK,GAAG,GAAG,CAAC;AAEzB;;;;GAIG;AACU,QAAA,IAAI,GAAG,EAAE,CAAC;AAEvB,yGAAyG;AACzG,MAAa,UAAW,SAAQ,KAAK;IACnC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;IAC3B,CAAC;CACF;AALD,gCAKC;AAED,6EAA6E;AAC7E,MAAM,UAAU,GAAG,aAAK,GAAG,CAAC,CAAC;AAU7B,mGAAmG;AACnG,SAAgB,UAAU,CAAC,IAAY;IACrC,MAAM,MAAM,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC;IAChC,IAAI,CAAC,GAAG,IAAI,GAAG,MAAM,CAAC;IACtB,OAAO,GAAG,EAAE;QACV,CAAC,GAAG,CAAC,CAAC,GAAG,mBAAmB,CAAC,GAAG,MAAM,CAAC;QACvC,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,mBAAmB,CAAC,GAAG,MAAM,CAAC;QACtD,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,mBAAmB,CAAC,GAAG,MAAM,CAAC;QACtD,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC;QAC9B,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;AACJ,CAAC;AAED,qGAAqG;AACrG,SAAgB,QAAQ,CAAC,MAAoB;IAC3C,OAAO;QACL,MAAM;YACJ,iDAAiD;YACjD,SAAS,CAAC;gBACR,IAAI,GAAG,GAAG,EAAE,CAAC;gBACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;oBAAE,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC;gBAC1D,MAAM,CAAC,GAAG,GAAG,GAAG,MAAC,CAAC;gBAClB,IAAI,CAAC,KAAK,EAAE;oBAAE,OAAO,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QACD,KAAK,CAAC,CAAS;YACb,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;YAC9B,IAAI,IAAI,GAAG,CAAC,CAAC;YACb,OAAO,IAAI,GAAG,CAAC,EAAE,CAAC;gBAChB,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC;gBACjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;oBACvC,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;oBAChC,CAAC,KAAK,EAAE,CAAC;gBACX,CAAC;YACH,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;KACF,CAAC;AACJ,CAAC;AAED,qGAAqG;AACrG,oGAAoG;AACpG,wDAAwD;AACxD,qGAAqG;AAErG,SAAS,MAAM,CAAC,GAAG,MAAoB;IACrC,MAAM,CAAC,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,MAAM;QAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACpC,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,GAAG,CAAC,CAAS;IACpB,MAAM,CAAC,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;IACzB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;IACzB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC;IACxB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;IAChB,OAAO,CAAC,CAAC;AACX,CAAC;AAED,6FAA6F;AAC7F,SAAS,QAAQ,CAAC,KAAa,EAAE,CAAQ;IACvC,OAAO,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,IAAA,gBAAW,EAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;AAC1E,CAAC;AACD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC;AACjE,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC;AACjE,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC;AACjE,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC;AACjE,MAAM,UAAU,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,6BAA6B,CAAC,CAAC;AAE3E;;;;;;;GAOG;AACH,SAAS,aAAa,CAAC,CAAW,EAAE,IAAY;IAC9C,MAAM,CAAC,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClB,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACxB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;IACvC,KAAK,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC;QACpB,IAAI,CAAC,GAAG,GAAG,CAAC;QACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC;YACpC,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;YAC3B,CAAC,KAAK,EAAE,CAAC;QACX,CAAC;QACD,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAChB,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1C,IAAI,EAAE,GAAG,EAAE,CAAC;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;QAAE,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,IAAI,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACtE,IAAI,EAAE,GAAG,EAAE,CAAC;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE;QAAE,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,IAAI,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC7E,MAAM,EAAE,GAAG,UAAU,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC3C,MAAM,EAAE,GAAG,UAAU,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAa,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC;IACtC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC;IAC7D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4GAA4G;AAC5G,SAAS,YAAY,CAAC,GAAW,EAAE,GAAa,EAAE,GAAW;IAC3D,IAAI,CAAC,GAAG,GAAG,CAAC;IACZ,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC;QACd,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QACtC,CAAC,KAAK,GAAG,CAAC;QACV,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACf,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB;YACnC,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACtC,GAAG,GAAG,IAAA,gBAAQ,EAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAE,CAAC,CAAC;YAC7B,CAAC,IAAI,CAAC,CAAC;QACT,CAAC;QACD,IAAI,IAAI,EAAE,CAAC;IACb,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,wCAAwC;AACxC,SAAS,QAAQ,CAAC,CAAa,EAAE,CAAa;IAC5C,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACrC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;IAC1D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,qGAAqG;AACrG,SAAS,OAAO,CAAC,IAAgB,EAAE,UAAkB,EAAE,KAAa;IAClE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC;IACvC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,EAAE,CAAC,EAAE,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC;QACzD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,QAAQ,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;YAChD,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC7C,QAAQ,IAAI,CAAC,CAAC;QAChB,CAAC;IACH,CAAC;IACD,yBAAyB;IACzB,OAAO,GAAG,GAAG,CAAC,CAAC,EAAE,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED,qFAAqF;AACrF,SAAS,GAAG,CAAC,CAAS,EAAE,GAAW;IACjC,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;IAC5C,IAAI,CAAC,GAAG,GAAG,CAAC;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,QAAQ,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;QAChC,CAAC,KAAK,EAAE,CAAC;IACX,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC5C,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;QAAE,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,qGAAqG;AACrG,yEAAyE;AACzE,EAAE;AACF,uGAAuG;AACvG,kGAAkG;AAClG,mGAAmG;AACnG,oGAAoG;AACpG,kGAAkG;AAClG,yFAAyF;AACzF,oGAAoG;AACpG,uGAAuG;AACvG,sGAAsG;AACtG,uGAAuG;AACvG,qFAAqF;AACrF,qGAAqG;AAErG,yGAAyG;AACzG,MAAa,WAAY,SAAQ,KAAK;IACpC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF;AALD,kCAKC;AAiED,wEAAwE;AACxE,SAAS,QAAQ,CAAC,CAAS,EAAE,CAAS,EAAE,GAAe,EAAE,GAAe;IACtE,OAAO,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,OAAO,CAAC,CAAa,EAAE,CAAa;IAC3C,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,IAAA,6BAAe,EAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAClF,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,eAAe,CAC7B,OAAiB,EACjB,MAAgB,IAAA,uBAAc,GAAE,EAChC,MAAqB;IAErB,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC;IAE7B,iFAAiF;IACjF,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;IACvB,MAAM,EAAE,GAAG,IAAA,YAAO,EAAC,CAAC,CAAC,CAAC;IACtB,MAAM,GAAG,GAAG,IAAA,QAAG,EAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,iBAAiB;IACzC,MAAM,MAAM,GAAG,IAAA,iBAAY,EAAC,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAEvD,yEAAyE;IACzE,MAAM,CAAC,GAAG,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpD,MAAM,KAAK,GAAG,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAExE,uGAAuG;IACvG,IAAA,qBAAgB,EAAC,CAAC,EAAE,kCAAkC,CAAC,CAAC;IACxD,IAAI,CAAC,IAAA,kBAAa,EAAC,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,WAAW,CAAC,sEAAsE,CAAC,CAAC;IAChG,CAAC;IAED,8FAA8F;IAC9F,MAAM,CAAC,GAAY,EAAE,CAAC;IACtB,MAAM,QAAQ,GAAiB,EAAE,CAAC;IAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QACvB,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC;QAC3B,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAA,QAAG,EAAC,IAAA,YAAO,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAA,YAAO,EAAC,CAAC,CAAC,CAAC;QACtD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACX,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAA,QAAG,EAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,8EAA8E;IAC9E,IAAI,MAAM,EAAE,OAAO;QAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAEvC,6GAA6G;IAC7G,MAAM,UAAU,GAAoC,EAAE,CAAC;IACvD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/B,IAAA,qBAAgB,EAAC,CAAC,CAAC,CAAC,CAAE,EAAE,aAAa,CAAC,uBAAuB,CAAC,CAAC;QAC/D,MAAM,EAAE,GAAG,IAAA,QAAG,EAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;QACzB,UAAU,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC,EAAE,IAAA,QAAG,EAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AAC/C,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,MAAM,CACpB,QAAyC,EACzC,OAAiB,EACjB,MAAgB,IAAA,uBAAc,GAAE,EAChC,MAAqB;IAErB,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IACpG,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC;IAE9B,MAAM,EAAE,GAAG,eAAe,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IAEjD,gGAAgG;IAChG,MAAM,EAAE,GAAoC,EAAE,CAAC;IAC/C,MAAM,GAAG,GAAoC,EAAE,CAAC;IAChD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/B,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC,CAAE,CAAC;QACnC,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QACxE,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACvF,CAAC;IAED,iGAAiG;IACjG,IAAI,MAAM,EAAE,gBAAgB;QAAE,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;IAE1D,+FAA+F;IAC/F,MAAM,QAAQ,GAAiB,EAAE,CAAC;IAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/B,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC;QAC3B,MAAM,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAE,CAAC,EAAE,CAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC;QAClD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAE,CAAC,EAAE,CAAE,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,WAAW,CACnB,kBAAkB,CAAC,iEAAiE,CACrF,CAAC;QACJ,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC;AAClF,CAAC;AAED,qGAAqG;AACrG,uGAAuG;AACvG,qGAAqG;AAErG;;;;GAIG;AACH,MAAa,SAAS;IACH,GAAG,CAAW;IAC/B,wGAAwG;IACvF,QAAQ,CAAY;IAC7B,KAAK,GAAG,KAAK,CAAC;IAEtB,sFAAsF;IAC9E,CAAC,GAAa,EAAE,CAAC;IACjB,KAAK,GAAG,EAAE,CAAC,CAAC,sCAAsC;IAClD,WAAW,GAAiB,EAAE,CAAC;IAC/B,SAAS,GAAa,EAAE,CAAC;IAEjC,0CAA0C;IAClC,SAAS,GAAiB,EAAE,CAAC;IAC7B,SAAS,GAAiB,EAAE,CAAC;IAC7B,QAAQ,GAAa,EAAE,CAAC;IACxB,QAAQ,GAAa,EAAE,CAAC;IAEhC,qFAAqF;IACrF,cAAc,CAAoB;IAElC;;;;;;OAMG;IACH,OAAO,CAAwC;IACvC,KAAK,GAAG,CAAC,CAAC;IAElB;;;OAGG;IACH,YAAY,MAAgB,IAAA,uBAAc,GAAE,EAAE,IAA8B;QAC1E,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,QAAQ,GAAG,IAAI,EAAE,QAAQ,CAAC;IACjC,CAAC;IAEO,KAAK;QACX,oEAAoE;QACpE,MAAM,QAAQ,GAAoC,EAAE,CAAC;QACrD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,aAAK,EAAE,CAAC,EAAE,EAAE,CAAC;YAC/B,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACtC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACtC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACxB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACxB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACtB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACtB,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QAC1B,CAAC;QACD,8EAA8E;QAC9E,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,aAAK,EAAE,EAAE,GAAG,EAAE;YAC1C,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC5B,OAAO,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC;QACnB,CAAC,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,wFAAwF;YACxF,mCAAmC;YACnC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QACxE,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;YAChD,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC;YACjC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC;QACxC,CAAC;QACD,IAAI,CAAC,SAAS,GAAG,IAAI,KAAK,CAAC,aAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1C,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,aAAK,EAAE,CAAC,EAAE;YAAE,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC;QACvE,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC;QACjB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACpB,CAAC;IAED,iFAAiF;IACjF,IAAI,QAAQ;QACV,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CACJ,UAAoB,EACpB,IAAc,EACd,IAAc;QAEd,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC;QAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACjG,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QAElD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QAE9B,kGAAkG;QAClG,MAAM,GAAG,GAAG,aAAK,GAAG,YAAI,CAAC;QACzB,MAAM,IAAI,GAAG,CAAC,GAAG,GAAG,CAAC;QACrB,MAAM,SAAS,GAAa,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE;YAAE,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC;QAEvE,mGAAmG;QACnG,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;YAAE,IAAI,UAAU,CAAC,CAAC,CAAE,GAAG,CAAC;gBAAE,IAAI,IAAI,EAAE,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC;QAC5E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE;YAAE,IAAI,SAAS,CAAC,CAAC,CAAE,GAAG,CAAC;gBAAE,IAAI,IAAI,EAAE,IAAI,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAEjF,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;QAErC,wEAAwE;QACxE,MAAM,CAAC,GAAa,IAAI,KAAK,CAAC,aAAK,CAAC,CAAC;QACrC,MAAM,CAAC,GAAa,IAAI,KAAK,CAAC,aAAK,CAAC,CAAC;QACrC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,aAAK,EAAE,CAAC,EAAE,EAAE,CAAC;YAC/B,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAE,EAAE,IAAI,CAAC,CAAC;YAChE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAE,EAAE,IAAI,CAAC,CAAC;YAChE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAE,IAAI,MAAM,CAAC;YAC5B,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAE,IAAI,MAAM,CAAC;YAC5B,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YACV,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QACxB,CAAC;QAED,8EAA8E;QAC9E,IAAI,IAAI,CAAC,OAAO;YAAE,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QAE5C,kGAAkG;QAClG,MAAM,CAAC,GAAa,IAAI,KAAK,CAAC,aAAK,CAAC,CAAC;QACrC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,aAAK,EAAE,CAAC,EAAE,EAAE,CAAC;YAC/B,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAE,EAAE,IAAI,CAAC,CAAC;YACnE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAE,IAAI,MAAM,CAAC;YAC7B,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC;QAC9C,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QAEzB,oFAAoF;QACpF,yFAAyF;QACzF,gGAAgG;QAChG,4EAA4E;QAC5E,MAAM,GAAG,GAAG,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACnC,mGAAmG;QACnG,IAAI,CAAC,GAAG,EAAE,CAAC;QACX,CAAC,GAAG,YAAY,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QAC/B,2EAA2E;QAC3E,IAAI,KAAK,GAAG,EAAE,CAAC;QACf,IAAI,KAAK,GAAG,EAAE,CAAC;QACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,aAAK,EAAE,CAAC,EAAE,EAAE,CAAC;YAC/B,MAAM,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,CAAE,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YACxC,MAAM,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,CAAE,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YACxC,KAAK,GAAG,IAAA,gBAAQ,EAAC,KAAK,EAAE,IAAA,oBAAY,EAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;YAC7C,KAAK,GAAG,IAAA,gBAAQ,EAAC,KAAK,EAAE,IAAA,oBAAY,EAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/C,CAAC;QACD,MAAM,QAAQ,GAAG,IAAA,gBAAQ,EAAC,KAAK,EAAE,IAAA,gBAAQ,EAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;QACrD,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YACvB,MAAM,IAAI,UAAU,CAClB,uCAAuC,QAAQ,4DAA4D,CAC5G,CAAC;QACJ,CAAC;QAED,sGAAsG;QACtG,MAAM,EAAE,GAAa,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;QAClC,MAAM,EAAE,GAAa,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;QAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,aAAK,EAAE,CAAC,EAAE;gBAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC;YACjF,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,GAAG,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;YAChC,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,GAAG,GAAG,CAAC,CAAC,EAAE,IAAI,GAAG,KAAK,CAAC,CAAC;QAC1C,CAAC;QAED,qDAAqD;QACrD,MAAM,QAAQ,GAAa,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;QACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,aAAK,EAAE,CAAC,EAAE;gBAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC;YACjF,MAAM,EAAE,GAAG,UAAU,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC;YAC9B,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAE,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAC5D,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAClC,CAAC;CACF;AAtLD,8BAsLC"}

package/dist/party.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Per-stakeholder local evaluation. Each party (user, org, regulator, ...) runs ITS OWN Policy VM
+ * locally and distills the result to a tiny DECISION VECTOR — the only thing that enters the MPC.
+ * The party's policy (its envelope, risk weights, predicates, budget) never leaves its process.
+ *
+ * We reuse `@atlasauth/pca`'s `decide()` as the per-party Policy VM (read-only; we import it, we do
+ * not modify it). The three fields we extract are exactly the ones with a well-defined composition:
+ *   - allow  = `releaseGuardianShare`  (this party admits the action at all)
+ *   - t      = `requiredThreshold.t`   (the proof strength this party demands: 1|2|3)
+ *   - rQuant = quantize(`r`)           (this party's risk score, quantized to {0..Q})
+ */
+import { type DecideInput } from '@atlasauth/pca';
+/** Granularity of the r-quantization. r in [0,1] maps to an integer bucket in {0..Q}. */
+export declare const DEFAULT_Q = 100;
+/** A stakeholder and its PRIVATE Policy-VM input (never shared with other parties). */
+export interface PartyPolicy {
+    /** Human-readable id (e.g. "user", "org", "regulator"); for labelling only. */
+    id: string;
+    /** The party's own `@atlasauth/pca` decision input: its envelope, risk inputs, budget, etc. */
+    decideInput: DecideInput;
+}
+/** The small, composable decision a party contributes to the MPC. */
+export interface DecisionVector {
+    /** 1 = this party admits the action; 0 = this party denies. */
+    allow: 0 | 1;
+    /** Proof-strength threshold this party requires. */
+    t: 1 | 2 | 3;
+    /** Risk score quantized to {0..Q}. */
+    rQuant: number;
+}
+/** Quantize r in [0,1] to an integer in {0..Q}. Non-finite => worst case (Q). */
+export declare function quantizeR(r: number, Q?: number): number;
+/**
+ * Evaluate a party's own policy to its decision vector, reusing the PCA Policy VM. Pure: `decide` is
+ * total and never throws, so this never throws. The returned vector is the party's PRIVATE input to
+ * the composition.
+ */
+export declare function evaluateParty(policy: PartyPolicy, Q?: number): DecisionVector;

package/dist/party.js

@@ -0,0 +1,40 @@
+"use strict";
+/**
+ * Per-stakeholder local evaluation. Each party (user, org, regulator, ...) runs ITS OWN Policy VM
+ * locally and distills the result to a tiny DECISION VECTOR — the only thing that enters the MPC.
+ * The party's policy (its envelope, risk weights, predicates, budget) never leaves its process.
+ *
+ * We reuse `@atlasauth/pca`'s `decide()` as the per-party Policy VM (read-only; we import it, we do
+ * not modify it). The three fields we extract are exactly the ones with a well-defined composition:
+ *   - allow  = `releaseGuardianShare`  (this party admits the action at all)
+ *   - t      = `requiredThreshold.t`   (the proof strength this party demands: 1|2|3)
+ *   - rQuant = quantize(`r`)           (this party's risk score, quantized to {0..Q})
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_Q = void 0;
+exports.quantizeR = quantizeR;
+exports.evaluateParty = evaluateParty;
+const pca_1 = require("@atlasauth/pca");
+/** Granularity of the r-quantization. r in [0,1] maps to an integer bucket in {0..Q}. */
+exports.DEFAULT_Q = 100;
+/** Quantize r in [0,1] to an integer in {0..Q}. Non-finite => worst case (Q). */
+function quantizeR(r, Q = exports.DEFAULT_Q) {
+    if (!Number.isFinite(r))
+        return Q;
+    const q = Math.round(Math.max(0, Math.min(1, r)) * Q);
+    return Math.max(0, Math.min(Q, q));
+}
+/**
+ * Evaluate a party's own policy to its decision vector, reusing the PCA Policy VM. Pure: `decide` is
+ * total and never throws, so this never throws. The returned vector is the party's PRIVATE input to
+ * the composition.
+ */
+function evaluateParty(policy, Q = exports.DEFAULT_Q) {
+    const d = (0, pca_1.decide)(policy.decideInput);
+    return {
+        allow: d.releaseGuardianShare ? 1 : 0,
+        t: d.requiredThreshold.t,
+        rQuant: quantizeR(d.r, Q),
+    };
+}
+//# sourceMappingURL=party.js.map

package/dist/party.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"party.js","sourceRoot":"","sources":["../src/party.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;AA0BH,8BAIC;AAOD,sCAOC;AA1CD,wCAA0D;AAE1D,yFAAyF;AAC5E,QAAA,SAAS,GAAG,GAAG,CAAC;AAoB7B,iFAAiF;AACjF,SAAgB,SAAS,CAAC,CAAS,EAAE,IAAY,iBAAS;IACxD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IAClC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACtD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,SAAgB,aAAa,CAAC,MAAmB,EAAE,IAAY,iBAAS;IACtE,MAAM,CAAC,GAAG,IAAA,YAAM,EAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACrC,OAAO;QACL,KAAK,EAAE,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACrC,CAAC,EAAE,CAAC,CAAC,iBAAiB,CAAC,CAAC;QACxB,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;KAC1B,CAAC;AACJ,CAAC"}