@atlasauth/pca-mpc 0.1.0 → 0.2.0

package/dist/endemic-ot.d.ts

@@ -0,0 +1,209 @@
+/**
+ * TRUE post-quantum, maliciously-secure base OT — the ENDEMIC OT of Masny–Rindal (ePrint 2019/706)
+ * instantiated over Module-LWE (Kyber-768 K-PKE), the RECOMMENDED / default PQ base OT for this stack.
+ *
+ * ─── WHY THIS EXISTS ────────────────────────────────────────────────────────────────────────────────
+ * The semi-honest ML-KEM base OT (`kem-ot.ts`) has an INTRINSIC residue against a malicious receiver:
+ * a receiver can run KEM keygen twice and keep BOTH secret keys, learning both messages, and the
+ * decisional-MLWE indistinguishability that gives it choice privacy makes that cheat undetectable to
+ * the sender. `hybrid-ot.ts` masks the residue with a *classical* EC half, but a receiver that is
+ * SIMULTANEOUSLY quantum AND malicious defeats the EC half with Shor. This module closes the residue
+ * in ONE post-quantum primitive: the receiver provably cannot form two decryptable branches, because
+ * one branch's public key is forced to be a UNIFORM ring element through a random oracle.
+ *
+ * ─── THE CONSTRUCTION (faithful to libOTe's `MasnyRindal`, group → lattice) ──────────────────────────
+ * libOTe's battle-tested `MasnyRindal` base OT works in a group `G` with a hash-to-group RO `H`:
+ *   • sender publishes `S = s·G`;
+ *   • receiver (choice `c`) picks `r` and a random point `N`, sets the CHOICE point `C = r·G − H(N)`,
+ *     places `C` at slot `c` and `N` at slot `1−c`, and sends the pair;
+ *   • sender derives, per slot `b`, `shared_b = s·(P_b + H(P_{1−b}))`, so `shared_c = s·r·G = r·S`
+ *     (which the receiver recomputes) while `shared_{1−c} = s·(N + H(C))` needs the discrete log of a
+ *     fresh RO point — a CDH the receiver cannot solve.
+ * We keep this EXACT additive structure but replace the group's Diffie–Hellman with Kyber K-PKE, where
+ * the "group" is the public-key ring-vector space `R_q^k` (an additive group) and `H` hashes to a
+ * UNIFORM ring vector (the standard FIPS-203 `SampleNTT` sampler — the one Kyber uses for its matrix A):
+ *
+ *   RECEIVER (choice `c`, transfer `i`), with session nonce `rn` and `sid = H(rn)`:
+ *     • real K-PKE keygen -> public key `(t̂_real ‖ rho)`, secret key `sk`;
+ *     • sample a UNIFORM ring vector `N` (the non-chosen slot's value);
+ *     • `C = t̂_real − Hpk(sid, i, N)`   (ring subtraction, `Hpk` = hash-to-uniform-ring);
+ *     • place `C` at slot `c`, `N` at slot `1−c`; send the ordered pair `(P_0, P_1)` and `rho`.
+ *   SENDER (random payloads `ρ_0, ρ_1 ∈ {0,1}^256`), per transfer:
+ *     • effective public key per slot:  `t̂_b = P_b + Hpk(sid, i, P_{1−b})`, `pk_b = (t̂_b ‖ rho)`;
+ *       -> `t̂_c = C + Hpk(sid,i,N) = t̂_real` (a REAL key, the receiver holds its `sk`), while
+ *          `t̂_{1−c} = N + Hpk(sid,i,C)` is `N +` a FRESH uniform RO value = UNIFORM (no secret exists);
+ *     • K-PKE CPA-encrypt `ρ_b` under `pk_b` -> `ct_b`; pad `k_b = Hpad(sid,i,b,ρ_b)`; send `(ct_0,ct_1)`.
+ *   RECEIVER recovers ONLY slot `c`:  `ρ_c = Dec(sk, ct_c)`,  `k_c = Hpad(sid,i,c,ρ_c)`.
+ * (The chosen-message wrapper one-time-pads `m_b` under `k_b` and adds an RO commitment, exactly like
+ * the EC `baseOT`, so a malicious sender's inconsistent ciphertext is caught — `EndemicLweOtAbort`.)
+ *
+ * ─── SECURITY ACHIEVED (precise, post-quantum, honest) ───────────────────────────────────────────────
+ *   • SENDER PRIVACY — the ENDEMIC property: a (even malicious) receiver cannot learn `m_{1−c}`.
+ *     Its branch `1−c` has a UNIFORM public key `t̂_{1−c}`; recovering the payload `ρ_{1−c}` from
+ *     `ct_{1−c}` is exactly breaking the semantic (IND-CPA) security of K-PKE encryption under a
+ *     UNIFORM public key — which is the standard Kyber IND-CPA "hybrid-1" game and REDUCES TO
+ *     DECISIONAL MODULE-LWE. Concretely: for a uniform `t̂`, the ciphertext `(u = Aᵀr+e₁, v = t̂ᵀr+e₂+ρ)`
+ *     is pseudorandom under dMLWE on the encryption randomness `r` (with the uniform `t̂` supplying the
+ *     extra row), so `ρ_{1−c}` — hence `k_{1−c}`, hence `m_{1−c}` — is hidden. And a malicious receiver
+ *     CANNOT make BOTH branches decryptable: fixing slot `c` to a real key determines `P_c`, so
+ *     `Hpk(sid,i,P_c)` is a FRESH uniform RO value and `t̂_{1−c}=P_{1−c}+Hpk(sid,i,P_c)` is uniform;
+ *     finding a low-norm secret for a uniform target is Module-SIS-hard. (This is the residue the
+ *     opaque ML-KEM base OT could not close.)
+ *   • RECEIVER (CHOICE) PRIVACY — COMPUTATIONAL under decisional Module-LWE, even against a malicious
+ *     or QUANTUM sender. The wire carries `(P_0, P_1, rho)`; the sender derives `t̂_0, t̂_1`, exactly ONE
+ *     of which is a real MLWE sample `A∘ŝ+ê` (the chosen branch) and the other uniform. Telling which
+ *     index is the real key is precisely decisional Module-LWE. (Unlike the group/DDH instantiation,
+ *     this is computational, not statistical — a real lattice key is not uniform; we do NOT overclaim.)
+ *   • POST-QUANTUM: both guarantees rest only on Module-LWE (ML-KEM-768, NIST category 3) + a random
+ *     oracle (SHAKE/SHA3). No discrete log anywhere.
+ *
+ * ─── COMPOSITION WITH KOS (how this becomes many malicious OTs) ──────────────────────────────────────
+ * `OtChannel` consumes this as its `κ = 128` setup base OTs, with ROLES INVERTED: the extension SENDER
+ * plays base-RECEIVER holding the secret selector `s`, and the extension RECEIVER plays base-SENDER
+ * providing the `κ` seed pairs. The two endemic guarantees are exactly what the KOS layer needs:
+ *   • base receiver-privacy (dMLWE) hides the extension sender's selector `s` from a malicious
+ *     extension receiver — the property IKNP relies on for the unchosen messages to stay hidden; and
+ *   • the endemic "learn ≤ one" property means the extension sender learns exactly one seed per pair.
+ * The KOS correlation check over the sacrifice rows then upgrades the whole extension to
+ * MALICIOUS-with-abort against a cheating extension receiver (the IKNP attack). So endemic base OTs +
+ * the existing KOS check in `ot.ts` = maliciously-secure, post-quantum OT. Endemic security is a
+ * (deliberately) weaker notion in which corrupt parties may fix their own outputs; lifting it to
+ * standard malicious OT via actively-secure OT extension is precisely the Masny–Rindal result, and the
+ * KOS layer here is unchanged — only the base is swapped. The `extend`-level tests prove the composed
+ * results are IDENTICAL to the EC and ML-KEM bases.
+ *
+ * ─── HONEST RESIDUAL ─────────────────────────────────────────────────────────────────────────────────
+ * The Kyber core is the vetted `pqc_kyber` reference compiled to WASM (`@atlasauth/pca-mpc-lwe-ot-wasm`);
+ * it is a PROTOTYPE and is NOT claimed constant-time (same caveat as `kem-ot.ts`/`ec.ts`, docs §7.1) —
+ * a documented side-channel boundary, not a break of the stated MLWE/ROM security. Decryption of K-PKE
+ * has a negligible (~2⁻¹³⁹ for Kyber-768) failure probability, inherited from the primitive.
+ *
+ * No hand-rolled lattice crypto: keygen / CPA-encrypt / CPA-decrypt and the uniform-ring sampler all go
+ * through the vetted crate; this module only hashes (SHA-256 RO), XORs, and marshals byte vectors.
+ */
+import { type BaseOtFn, type OtChannel, type OtRandom } from './ot';
+/** Kyber-768 byte sizes, surfaced from the lattice core. */
+export declare const PK_BYTES: number;
+export declare const SK_BYTES: number;
+export declare const CT_BYTES: number;
+export declare const TVEC_BYTES: number;
+export declare const SYM_BYTES: number;
+/** Re-export the vetted lattice primitives (used by the hybrid combiner alternatives and the tests). */
+export declare const kpkeKeygen: (seed: Uint8Array) => {
+    publicKey: Uint8Array;
+    secretKey: Uint8Array;
+};
+export declare const kpkeEnc: (publicKey: Uint8Array, message: Uint8Array, coins: Uint8Array) => Uint8Array;
+export declare const kpkeDec: (secretKey: Uint8Array, ciphertext: Uint8Array) => Uint8Array;
+export declare const ringAdd: (a: Uint8Array, b: Uint8Array) => Uint8Array;
+export declare const ringSub: (a: Uint8Array, b: Uint8Array) => Uint8Array;
+export declare const hashToRing: (input: Uint8Array) => Uint8Array;
+/** The session id `sid = H(TAG ‖ rn)` binding every RO query to this OT instance's receiver nonce. */
+export declare function endemicSessionId(rn: Uint8Array): Uint8Array;
+/**
+ * The endemic random-OT pad oracle, exposed for the hybrid combiner and the security tests:
+ * `H(TAG ‖ sid ‖ i ‖ slot ‖ ρ)` expanded to `len` bytes, where `ρ` is the K-PKE payload of that slot.
+ */
+export declare function endemicLwePad(sid: Uint8Array, index: number, slot: number, payload: Uint8Array, len: number): Uint8Array;
+/** Byte length of a derived endemic random-OT shared secret (= a K-PKE payload). */
+export declare const ENDEMIC_SECRET_BYTES: number;
+/** Raised when the endemic base OT aborts: a malicious sender's ciphertext fails its RO commitment. */
+export declare class EndemicLweOtAbort extends Error {
+    constructor(message: string);
+}
+/** Receiver round-1 wire message. */
+export interface EndemicLweReceiverMessage {
+    /** Receiver session nonce. */
+    rn: Uint8Array;
+    /** For each transfer i, the ordered ring-vector pair `[P_0, P_1]` (each `TVEC_BYTES`). */
+    points: Array<[Uint8Array, Uint8Array]>;
+    /** For each transfer i, the shared matrix seed `rho` (32 B) of that transfer's real keypair. */
+    rhos: Uint8Array[];
+}
+/** The receiver's retained state (it keeps only the chosen branch's secret key). */
+export interface EndemicLweReceiverState {
+    choices: number[];
+    /** `secretKeys[i]` is the IND-CPA secret key for the receiver's real key placed at slot `choices[i]`. */
+    secretKeys: Uint8Array[];
+    rhos: Uint8Array[];
+    rn: Uint8Array;
+    sid: Uint8Array;
+}
+/**
+ * RECEIVER round 1: for each choice bit, generate a real K-PKE keypair, sample a uniform ring vector
+ * `N`, set the choice vector `C = t̂_real − Hpk(sid,i,N)`, place `C` at slot `c` and `N` at slot `1−c`,
+ * send the ordered pair + `rho`, and retain only the chosen branch's secret key.
+ */
+export declare function endemicLweReceive(choices: number[], rng?: OtRandom): {
+    message: EndemicLweReceiverMessage;
+    state: EndemicLweReceiverState;
+};
+/** Sender wire message of the RANDOM endemic OT: the two ciphertexts per transfer (sender-local pads). */
+export interface EndemicLweRandomSenderMessage {
+    ciphertexts: Array<[Uint8Array, Uint8Array]>;
+    /** Sender-LOCAL: both per-slot pads `[k_0, k_1]` per transfer (never sent). */
+    senderPads: Array<[Uint8Array, Uint8Array]>;
+}
+/** TEST-ONLY malicious-sender injection (corrupt the ciphertexts on the wire). */
+export interface EndemicLweTamper {
+    tamperCiphertexts?: (ciphertexts: Array<[Uint8Array, Uint8Array]>) => void;
+}
+/**
+ * SENDER round (RANDOM variant): derive each slot's effective public key `pk_b = (P_b + Hpk(sid,i,P_{1−b}) ‖ rho)`,
+ * CPA-encrypt a fresh random payload under each, and output both per-slot pads. No messages are padded
+ * — the two pads per transfer ARE the random output (consumed by the hybrid combiner / the chosen-message
+ * wrapper below).
+ */
+export declare function endemicLweSendRandom(message: EndemicLweReceiverMessage, rng?: OtRandom, tamper?: EndemicLweTamper): EndemicLweRandomSenderMessage;
+/**
+ * RECEIVER recovery (RANDOM variant): decapsulate ONLY the chosen ciphertext (the chosen branch's
+ * effective key equals the receiver's real key) and derive the chosen pad. The non-chosen slot's key
+ * is uniform, so its ciphertext is unrecoverable (the endemic property).
+ */
+export declare function endemicLweRecoverRandom(state: EndemicLweReceiverState, senderMessage: EndemicLweRandomSenderMessage): Uint8Array[];
+/** Full RANDOM endemic base OT (both parties in-process); the random-OT face reused by the combiner. */
+export interface EndemicLweRandomResult {
+    /** Sender's per-slot pads `[k_0, k_1]` (the sender learns BOTH). */
+    senderPads: Array<[Uint8Array, Uint8Array]>;
+    /** Receiver's chosen pad `k_{choices[i]}` (the honest receiver learns ONE). */
+    recvPads: Uint8Array[];
+    sid: Uint8Array;
+    message: EndemicLweReceiverMessage;
+    ciphertexts: Array<[Uint8Array, Uint8Array]>;
+}
+/** In-process RANDOM endemic base OT. */
+export declare function endemicLweBaseOtRandom(choices: number[], rng?: OtRandom, tamper?: EndemicLweTamper): EndemicLweRandomResult;
+/** A full chosen-message endemic base-OT transcript, exposed for inspection/tests. */
+export interface EndemicLweTranscript {
+    rn: Uint8Array;
+    points: Array<[Uint8Array, Uint8Array]>;
+    rhos: Uint8Array[];
+    ciphertexts: Array<[Uint8Array, Uint8Array]>;
+    /** For each transfer i, `[E_0, E_1]` with `E_b = m_b ⊕ k_b`. */
+    encrypted: Array<[Uint8Array, Uint8Array]>;
+    /** For each transfer i, `[com_0, com_1]`. */
+    commitments: Array<[Uint8Array, Uint8Array]>;
+}
+export interface EndemicLweResult {
+    received: Uint8Array[];
+    transcript: EndemicLweTranscript;
+}
+/**
+ * In-process CHOSEN-MESSAGE endemic base OT: `messages[i] = [m0, m1]` (the two must be equal length);
+ * `choices[i] ∈ {0,1}`. The sender one-time-pads each message under the endemic random-OT pads and
+ * commits to each; the receiver recovers `m_{choices[i]}` and checks the commitment, aborting
+ * (`EndemicLweOtAbort`) on any inconsistency. A drop-in for `OtChannel`'s `baseOtFn`.
+ */
+export declare function endemicLweBaseOT(messages: Array<[Uint8Array, Uint8Array]>, choices: number[], rng?: OtRandom, tamper?: EndemicLweTamper): EndemicLweResult;
+/**
+ * The chosen-message endemic base OT as a `BaseOtFn` (only `received` is part of the contract).
+ */
+export declare const endemicLweBaseOtFn: BaseOtFn;
+/**
+ * Wire the endemic ML-KEM base OT into the KOS OT-extension — the RECOMMENDED post-quantum,
+ * maliciously-secure base. Everything above the base OT (the IKNP matrix, the KOS correlation check,
+ * the correlation-robust hash) is unchanged; only the `κ` setup base OTs run the endemic protocol.
+ *
+ *   const ch = new OtChannel(secureOtRandom(), withEndemicLweBaseOt());
+ */
+export declare function withEndemicLweBaseOt(): ConstructorParameters<typeof OtChannel>[1];

package/dist/endemic-ot.js

@@ -0,0 +1,405 @@
+"use strict";
+/**
+ * TRUE post-quantum, maliciously-secure base OT — the ENDEMIC OT of Masny–Rindal (ePrint 2019/706)
+ * instantiated over Module-LWE (Kyber-768 K-PKE), the RECOMMENDED / default PQ base OT for this stack.
+ *
+ * ─── WHY THIS EXISTS ────────────────────────────────────────────────────────────────────────────────
+ * The semi-honest ML-KEM base OT (`kem-ot.ts`) has an INTRINSIC residue against a malicious receiver:
+ * a receiver can run KEM keygen twice and keep BOTH secret keys, learning both messages, and the
+ * decisional-MLWE indistinguishability that gives it choice privacy makes that cheat undetectable to
+ * the sender. `hybrid-ot.ts` masks the residue with a *classical* EC half, but a receiver that is
+ * SIMULTANEOUSLY quantum AND malicious defeats the EC half with Shor. This module closes the residue
+ * in ONE post-quantum primitive: the receiver provably cannot form two decryptable branches, because
+ * one branch's public key is forced to be a UNIFORM ring element through a random oracle.
+ *
+ * ─── THE CONSTRUCTION (faithful to libOTe's `MasnyRindal`, group → lattice) ──────────────────────────
+ * libOTe's battle-tested `MasnyRindal` base OT works in a group `G` with a hash-to-group RO `H`:
+ *   • sender publishes `S = s·G`;
+ *   • receiver (choice `c`) picks `r` and a random point `N`, sets the CHOICE point `C = r·G − H(N)`,
+ *     places `C` at slot `c` and `N` at slot `1−c`, and sends the pair;
+ *   • sender derives, per slot `b`, `shared_b = s·(P_b + H(P_{1−b}))`, so `shared_c = s·r·G = r·S`
+ *     (which the receiver recomputes) while `shared_{1−c} = s·(N + H(C))` needs the discrete log of a
+ *     fresh RO point — a CDH the receiver cannot solve.
+ * We keep this EXACT additive structure but replace the group's Diffie–Hellman with Kyber K-PKE, where
+ * the "group" is the public-key ring-vector space `R_q^k` (an additive group) and `H` hashes to a
+ * UNIFORM ring vector (the standard FIPS-203 `SampleNTT` sampler — the one Kyber uses for its matrix A):
+ *
+ *   RECEIVER (choice `c`, transfer `i`), with session nonce `rn` and `sid = H(rn)`:
+ *     • real K-PKE keygen -> public key `(t̂_real ‖ rho)`, secret key `sk`;
+ *     • sample a UNIFORM ring vector `N` (the non-chosen slot's value);
+ *     • `C = t̂_real − Hpk(sid, i, N)`   (ring subtraction, `Hpk` = hash-to-uniform-ring);
+ *     • place `C` at slot `c`, `N` at slot `1−c`; send the ordered pair `(P_0, P_1)` and `rho`.
+ *   SENDER (random payloads `ρ_0, ρ_1 ∈ {0,1}^256`), per transfer:
+ *     • effective public key per slot:  `t̂_b = P_b + Hpk(sid, i, P_{1−b})`, `pk_b = (t̂_b ‖ rho)`;
+ *       -> `t̂_c = C + Hpk(sid,i,N) = t̂_real` (a REAL key, the receiver holds its `sk`), while
+ *          `t̂_{1−c} = N + Hpk(sid,i,C)` is `N +` a FRESH uniform RO value = UNIFORM (no secret exists);
+ *     • K-PKE CPA-encrypt `ρ_b` under `pk_b` -> `ct_b`; pad `k_b = Hpad(sid,i,b,ρ_b)`; send `(ct_0,ct_1)`.
+ *   RECEIVER recovers ONLY slot `c`:  `ρ_c = Dec(sk, ct_c)`,  `k_c = Hpad(sid,i,c,ρ_c)`.
+ * (The chosen-message wrapper one-time-pads `m_b` under `k_b` and adds an RO commitment, exactly like
+ * the EC `baseOT`, so a malicious sender's inconsistent ciphertext is caught — `EndemicLweOtAbort`.)
+ *
+ * ─── SECURITY ACHIEVED (precise, post-quantum, honest) ───────────────────────────────────────────────
+ *   • SENDER PRIVACY — the ENDEMIC property: a (even malicious) receiver cannot learn `m_{1−c}`.
+ *     Its branch `1−c` has a UNIFORM public key `t̂_{1−c}`; recovering the payload `ρ_{1−c}` from
+ *     `ct_{1−c}` is exactly breaking the semantic (IND-CPA) security of K-PKE encryption under a
+ *     UNIFORM public key — which is the standard Kyber IND-CPA "hybrid-1" game and REDUCES TO
+ *     DECISIONAL MODULE-LWE. Concretely: for a uniform `t̂`, the ciphertext `(u = Aᵀr+e₁, v = t̂ᵀr+e₂+ρ)`
+ *     is pseudorandom under dMLWE on the encryption randomness `r` (with the uniform `t̂` supplying the
+ *     extra row), so `ρ_{1−c}` — hence `k_{1−c}`, hence `m_{1−c}` — is hidden. And a malicious receiver
+ *     CANNOT make BOTH branches decryptable: fixing slot `c` to a real key determines `P_c`, so
+ *     `Hpk(sid,i,P_c)` is a FRESH uniform RO value and `t̂_{1−c}=P_{1−c}+Hpk(sid,i,P_c)` is uniform;
+ *     finding a low-norm secret for a uniform target is Module-SIS-hard. (This is the residue the
+ *     opaque ML-KEM base OT could not close.)
+ *   • RECEIVER (CHOICE) PRIVACY — COMPUTATIONAL under decisional Module-LWE, even against a malicious
+ *     or QUANTUM sender. The wire carries `(P_0, P_1, rho)`; the sender derives `t̂_0, t̂_1`, exactly ONE
+ *     of which is a real MLWE sample `A∘ŝ+ê` (the chosen branch) and the other uniform. Telling which
+ *     index is the real key is precisely decisional Module-LWE. (Unlike the group/DDH instantiation,
+ *     this is computational, not statistical — a real lattice key is not uniform; we do NOT overclaim.)
+ *   • POST-QUANTUM: both guarantees rest only on Module-LWE (ML-KEM-768, NIST category 3) + a random
+ *     oracle (SHAKE/SHA3). No discrete log anywhere.
+ *
+ * ─── COMPOSITION WITH KOS (how this becomes many malicious OTs) ──────────────────────────────────────
+ * `OtChannel` consumes this as its `κ = 128` setup base OTs, with ROLES INVERTED: the extension SENDER
+ * plays base-RECEIVER holding the secret selector `s`, and the extension RECEIVER plays base-SENDER
+ * providing the `κ` seed pairs. The two endemic guarantees are exactly what the KOS layer needs:
+ *   • base receiver-privacy (dMLWE) hides the extension sender's selector `s` from a malicious
+ *     extension receiver — the property IKNP relies on for the unchosen messages to stay hidden; and
+ *   • the endemic "learn ≤ one" property means the extension sender learns exactly one seed per pair.
+ * The KOS correlation check over the sacrifice rows then upgrades the whole extension to
+ * MALICIOUS-with-abort against a cheating extension receiver (the IKNP attack). So endemic base OTs +
+ * the existing KOS check in `ot.ts` = maliciously-secure, post-quantum OT. Endemic security is a
+ * (deliberately) weaker notion in which corrupt parties may fix their own outputs; lifting it to
+ * standard malicious OT via actively-secure OT extension is precisely the Masny–Rindal result, and the
+ * KOS layer here is unchanged — only the base is swapped. The `extend`-level tests prove the composed
+ * results are IDENTICAL to the EC and ML-KEM bases.
+ *
+ * ─── HONEST RESIDUAL ─────────────────────────────────────────────────────────────────────────────────
+ * The Kyber core is the vetted `pqc_kyber` reference compiled to WASM (`@atlasauth/pca-mpc-lwe-ot-wasm`);
+ * it is a PROTOTYPE and is NOT claimed constant-time (same caveat as `kem-ot.ts`/`ec.ts`, docs §7.1) —
+ * a documented side-channel boundary, not a break of the stated MLWE/ROM security. Decryption of K-PKE
+ * has a negligible (~2⁻¹³⁹ for Kyber-768) failure probability, inherited from the primitive.
+ *
+ * No hand-rolled lattice crypto: keygen / CPA-encrypt / CPA-decrypt and the uniform-ring sampler all go
+ * through the vetted crate; this module only hashes (SHA-256 RO), XORs, and marshals byte vectors.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.endemicLweBaseOtFn = exports.EndemicLweOtAbort = exports.ENDEMIC_SECRET_BYTES = exports.hashToRing = exports.ringSub = exports.ringAdd = exports.kpkeDec = exports.kpkeEnc = exports.kpkeKeygen = exports.SYM_BYTES = exports.TVEC_BYTES = exports.CT_BYTES = exports.SK_BYTES = exports.PK_BYTES = void 0;
+exports.endemicSessionId = endemicSessionId;
+exports.endemicLwePad = endemicLwePad;
+exports.endemicLweReceive = endemicLweReceive;
+exports.endemicLweSendRandom = endemicLweSendRandom;
+exports.endemicLweRecoverRandom = endemicLweRecoverRandom;
+exports.endemicLweBaseOtRandom = endemicLweBaseOtRandom;
+exports.endemicLweBaseOT = endemicLweBaseOT;
+exports.withEndemicLweBaseOt = withEndemicLweBaseOt;
+const node_crypto_1 = require("node:crypto");
+const node_module_1 = require("node:module");
+const node_path_1 = require("node:path");
+const csprng_1 = require("./csprng");
+/** Narrow an opaque module to the `LatticeCore` surface without `any` — every member must be present. */
+function asLatticeCore(mod) {
+    if (typeof mod !== 'object' || mod === null)
+        return null;
+    const m = mod;
+    const fns = ['kpkeKeygen', 'kpkeEnc', 'kpkeDec', 'ringAdd', 'ringSub', 'hashToRing'];
+    for (const name of fns)
+        if (typeof m[name] !== 'function')
+            return null;
+    const nums = ['PK_BYTES', 'SK_BYTES', 'CT_BYTES', 'TVEC_BYTES', 'SYM_BYTES'];
+    for (const name of nums)
+        if (typeof m[name] !== 'number')
+            return null;
+    return mod;
+}
+function loadLatticeCore() {
+    const require = (0, node_module_1.createRequire)(__filename);
+    const candidates = [
+        '@atlasauth/pca-mpc-lwe-ot-wasm',
+        (0, node_path_1.join)(__dirname, '..', '..', 'pca-mpc-lwe-ot-wasm', 'dist', 'index.js'),
+    ];
+    for (const spec of candidates) {
+        try {
+            const loaded = asLatticeCore(require(spec));
+            if (loaded !== null)
+                return loaded;
+        }
+        catch {
+            // try the next candidate
+        }
+    }
+    throw new Error('endemic-ot: could not load @atlasauth/pca-mpc-lwe-ot-wasm (the Kyber lattice core is required; ' +
+        'build it with `pnpm --filter @atlasauth/pca-mpc-lwe-ot-wasm build:wasm && ... build`)');
+}
+const core = loadLatticeCore();
+/** Kyber-768 byte sizes, surfaced from the lattice core. */
+exports.PK_BYTES = core.PK_BYTES;
+exports.SK_BYTES = core.SK_BYTES;
+exports.CT_BYTES = core.CT_BYTES;
+exports.TVEC_BYTES = core.TVEC_BYTES;
+exports.SYM_BYTES = core.SYM_BYTES;
+/** Re-export the vetted lattice primitives (used by the hybrid combiner alternatives and the tests). */
+exports.kpkeKeygen = core.kpkeKeygen.bind(core);
+exports.kpkeEnc = core.kpkeEnc.bind(core);
+exports.kpkeDec = core.kpkeDec.bind(core);
+exports.ringAdd = core.ringAdd.bind(core);
+exports.ringSub = core.ringSub.bind(core);
+exports.hashToRing = core.hashToRing.bind(core);
+// ===================================================================================================
+// Random-oracle helpers (SHA-256 based, domain-separated). The hash-to-uniform-ring oracle lives in
+// the wasm core; here we build its input and the pad / commitment / session-id oracles.
+// ===================================================================================================
+const TAG_SID = new TextEncoder().encode('atlas-pca-mpc/endemic-lwe-ot-sid');
+const TAG_HPK = new TextEncoder().encode('atlas-pca-mpc/endemic-lwe-ot-hpk');
+const TAG_N = new TextEncoder().encode('atlas-pca-mpc/endemic-lwe-ot-N');
+const TAG_PAD = new TextEncoder().encode('atlas-pca-mpc/endemic-lwe-ot-pad');
+const TAG_COMMIT = new TextEncoder().encode('atlas-pca-mpc/endemic-lwe-ot-commit');
+function sha256(...chunks) {
+    const h = (0, node_crypto_1.createHash)('sha256');
+    for (const c of chunks)
+        h.update(c);
+    return new Uint8Array(h.digest());
+}
+function u32(x) {
+    const b = new Uint8Array(4);
+    b[0] = (x >>> 24) & 0xff;
+    b[1] = (x >>> 16) & 0xff;
+    b[2] = (x >>> 8) & 0xff;
+    b[3] = x & 0xff;
+    return b;
+}
+function concat(...parts) {
+    let n = 0;
+    for (const p of parts)
+        n += p.length;
+    const out = new Uint8Array(n);
+    let o = 0;
+    for (const p of parts) {
+        out.set(p, o);
+        o += p.length;
+    }
+    return out;
+}
+function xorBytes(a, b) {
+    if (a.length !== b.length)
+        throw new Error('endemic-ot: XOR length mismatch');
+    const out = new Uint8Array(a.length);
+    for (let i = 0; i < a.length; i++)
+        out[i] = a[i] ^ b[i];
+    return out;
+}
+function ctEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i++)
+        diff |= a[i] ^ b[i];
+    return diff === 0;
+}
+/** The session id `sid = H(TAG ‖ rn)` binding every RO query to this OT instance's receiver nonce. */
+function endemicSessionId(rn) {
+    return sha256(TAG_SID, rn);
+}
+/** `Hpk(sid, i, other)` — the uniform ring vector the branch's effective key is offset by; `other` is
+ *  the OTHER slot's value (mirrors libOTe keying `H` by the opposite point). */
+function hpk(sid, i, other) {
+    return core.hashToRing(concat(TAG_HPK, sid, u32(i), other));
+}
+/** The one-time pad / random-OT output for a slot: `H(TAG ‖ sid ‖ i ‖ slot ‖ ctr ‖ ρ)` to `len` bytes. */
+function padBytes(sid, i, slot, payload, len) {
+    const out = new Uint8Array(len);
+    let produced = 0;
+    let ctr = 0;
+    while (produced < len) {
+        const block = sha256(TAG_PAD, sid, u32(i), Uint8Array.of(slot & 1), u32(ctr), payload);
+        for (let k = 0; k < block.length && produced < len; k++)
+            out[produced++] = block[k];
+        ctr++;
+    }
+    return out;
+}
+/**
+ * The endemic random-OT pad oracle, exposed for the hybrid combiner and the security tests:
+ * `H(TAG ‖ sid ‖ i ‖ slot ‖ ρ)` expanded to `len` bytes, where `ρ` is the K-PKE payload of that slot.
+ */
+function endemicLwePad(sid, index, slot, payload, len) {
+    return padBytes(sid, index, slot, payload, len);
+}
+/** Per-message RO commitment `com = H(TAG ‖ sid ‖ i ‖ slot ‖ msg ‖ pad)`. */
+function commitBytes(sid, i, slot, msg, pad) {
+    return sha256(TAG_COMMIT, sid, u32(i), Uint8Array.of(slot & 1), msg, pad);
+}
+// ===================================================================================================
+// Protocol, as explicit rounds (matching the in-process, transcript-returning style of kem-ot.ts).
+// ===================================================================================================
+/** Byte length of a derived endemic random-OT shared secret (= a K-PKE payload). */
+exports.ENDEMIC_SECRET_BYTES = exports.SYM_BYTES;
+/** Raised when the endemic base OT aborts: a malicious sender's ciphertext fails its RO commitment. */
+class EndemicLweOtAbort extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'EndemicLweOtAbort';
+    }
+}
+exports.EndemicLweOtAbort = EndemicLweOtAbort;
+/**
+ * RECEIVER round 1: for each choice bit, generate a real K-PKE keypair, sample a uniform ring vector
+ * `N`, set the choice vector `C = t̂_real − Hpk(sid,i,N)`, place `C` at slot `c` and `N` at slot `1−c`,
+ * send the ordered pair + `rho`, and retain only the chosen branch's secret key.
+ */
+function endemicLweReceive(choices, rng = (0, csprng_1.secureOtRandom)()) {
+    const rn = rng.bytes(exports.SYM_BYTES);
+    const sid = endemicSessionId(rn);
+    const points = [];
+    const rhos = [];
+    const secretKeys = [];
+    const retained = [];
+    for (let i = 0; i < choices.length; i++) {
+        const c = choices[i] & 1;
+        const { publicKey, secretKey } = core.kpkeKeygen(rng.bytes(exports.SYM_BYTES));
+        const tReal = publicKey.slice(0, exports.TVEC_BYTES);
+        const rho = publicKey.slice(exports.TVEC_BYTES);
+        // A uniform ring vector for the non-chosen slot (RO of fresh receiver randomness).
+        const nSlot = core.hashToRing(concat(TAG_N, sid, u32(i), rng.bytes(exports.SYM_BYTES)));
+        const cPoint = core.ringSub(tReal, hpk(sid, i, nSlot));
+        points.push(c === 0 ? [cPoint, nSlot] : [nSlot, cPoint]);
+        rhos.push(rho);
+        secretKeys.push(secretKey);
+        retained.push(c);
+    }
+    return { message: { rn, points, rhos }, state: { choices: retained, secretKeys, rhos, rn, sid } };
+}
+/**
+ * SENDER round (RANDOM variant): derive each slot's effective public key `pk_b = (P_b + Hpk(sid,i,P_{1−b}) ‖ rho)`,
+ * CPA-encrypt a fresh random payload under each, and output both per-slot pads. No messages are padded
+ * — the two pads per transfer ARE the random output (consumed by the hybrid combiner / the chosen-message
+ * wrapper below).
+ */
+function endemicLweSendRandom(message, rng = (0, csprng_1.secureOtRandom)(), tamper) {
+    const sid = endemicSessionId(message.rn);
+    const { points, rhos } = message;
+    const ciphertexts = [];
+    const senderPads = [];
+    for (let i = 0; i < points.length; i++) {
+        const [p0, p1] = points[i];
+        const rho = rhos[i];
+        const effT0 = core.ringAdd(p0, hpk(sid, i, p1));
+        const effT1 = core.ringAdd(p1, hpk(sid, i, p0));
+        const pk0 = concat(effT0, rho);
+        const pk1 = concat(effT1, rho);
+        const r0 = rng.bytes(exports.SYM_BYTES);
+        const r1 = rng.bytes(exports.SYM_BYTES);
+        const ct0 = core.kpkeEnc(pk0, r0, rng.bytes(exports.SYM_BYTES));
+        const ct1 = core.kpkeEnc(pk1, r1, rng.bytes(exports.SYM_BYTES));
+        ciphertexts.push([ct0, ct1]);
+        senderPads.push([
+            padBytes(sid, i, 0, r0, exports.ENDEMIC_SECRET_BYTES),
+            padBytes(sid, i, 1, r1, exports.ENDEMIC_SECRET_BYTES),
+        ]);
+    }
+    if (tamper?.tamperCiphertexts)
+        tamper.tamperCiphertexts(ciphertexts);
+    return { ciphertexts, senderPads };
+}
+/**
+ * RECEIVER recovery (RANDOM variant): decapsulate ONLY the chosen ciphertext (the chosen branch's
+ * effective key equals the receiver's real key) and derive the chosen pad. The non-chosen slot's key
+ * is uniform, so its ciphertext is unrecoverable (the endemic property).
+ */
+function endemicLweRecoverRandom(state, senderMessage) {
+    const { choices, secretKeys, sid } = state;
+    const { ciphertexts } = senderMessage;
+    const recvPads = [];
+    for (let i = 0; i < choices.length; i++) {
+        const c = choices[i] & 1;
+        const payload = core.kpkeDec(secretKeys[i], ciphertexts[i][c]);
+        recvPads.push(padBytes(sid, i, c, payload, exports.ENDEMIC_SECRET_BYTES));
+    }
+    return recvPads;
+}
+/** In-process RANDOM endemic base OT. */
+function endemicLweBaseOtRandom(choices, rng = (0, csprng_1.secureOtRandom)(), tamper) {
+    const { message, state } = endemicLweReceive(choices, rng);
+    const senderMessage = endemicLweSendRandom(message, rng, tamper);
+    const recvPads = endemicLweRecoverRandom(state, senderMessage);
+    return {
+        senderPads: senderMessage.senderPads,
+        recvPads,
+        sid: state.sid,
+        message,
+        ciphertexts: senderMessage.ciphertexts,
+    };
+}
+/**
+ * In-process CHOSEN-MESSAGE endemic base OT: `messages[i] = [m0, m1]` (the two must be equal length);
+ * `choices[i] ∈ {0,1}`. The sender one-time-pads each message under the endemic random-OT pads and
+ * commits to each; the receiver recovers `m_{choices[i]}` and checks the commitment, aborting
+ * (`EndemicLweOtAbort`) on any inconsistency. A drop-in for `OtChannel`'s `baseOtFn`.
+ */
+function endemicLweBaseOT(messages, choices, rng = (0, csprng_1.secureOtRandom)(), tamper) {
+    if (messages.length !== choices.length)
+        throw new Error('endemicLweBaseOT: messages/choices length mismatch');
+    const { message, state } = endemicLweReceive(choices, rng);
+    const sid = state.sid;
+    // Sender: derive effective keys, encrypt a random payload per slot, then one-time-pad + commit each
+    // message under the pad expanded to the message length.
+    const ciphertexts = [];
+    const encrypted = [];
+    const commitments = [];
+    for (let i = 0; i < messages.length; i++) {
+        const [m0, m1] = messages[i];
+        if (m0.length !== m1.length) {
+            throw new Error(`endemicLweBaseOT (index ${i}): the two messages must be equal length`);
+        }
+        const [p0, p1] = message.points[i];
+        const rho = message.rhos[i];
+        const effT0 = core.ringAdd(p0, hpk(sid, i, p1));
+        const effT1 = core.ringAdd(p1, hpk(sid, i, p0));
+        const r0 = rng.bytes(exports.SYM_BYTES);
+        const r1 = rng.bytes(exports.SYM_BYTES);
+        ciphertexts.push([
+            core.kpkeEnc(concat(effT0, rho), r0, rng.bytes(exports.SYM_BYTES)),
+            core.kpkeEnc(concat(effT1, rho), r1, rng.bytes(exports.SYM_BYTES)),
+        ]);
+        const pad0 = padBytes(sid, i, 0, r0, m0.length);
+        const pad1 = padBytes(sid, i, 1, r1, m1.length);
+        encrypted.push([xorBytes(m0, pad0), xorBytes(m1, pad1)]);
+        commitments.push([commitBytes(sid, i, 0, m0, pad0), commitBytes(sid, i, 1, m1, pad1)]);
+    }
+    if (tamper?.tamperCiphertexts)
+        tamper.tamperCiphertexts(encrypted);
+    // Receiver: decrypt the chosen ciphertext, unmask the chosen message, check the commitment.
+    const received = [];
+    for (let i = 0; i < messages.length; i++) {
+        const c = choices[i] & 1;
+        const payload = core.kpkeDec(state.secretKeys[i], ciphertexts[i][c]);
+        const e = encrypted[i][c];
+        const pad = padBytes(sid, i, c, payload, e.length);
+        const m = xorBytes(e, pad);
+        if (!ctEqual(commitBytes(sid, i, c, m, pad), commitments[i][c])) {
+            throw new EndemicLweOtAbort(`endemic base OT (index ${i}): sender ciphertext inconsistent with its commitment; aborting`);
+        }
+        received.push(m);
+    }
+    return {
+        received,
+        transcript: { rn: message.rn, points: message.points, rhos: message.rhos, ciphertexts, encrypted, commitments },
+    };
+}
+/**
+ * The chosen-message endemic base OT as a `BaseOtFn` (only `received` is part of the contract).
+ */
+const endemicLweBaseOtFn = (messages, choices, rng) => ({
+    received: endemicLweBaseOT(messages, choices, rng).received,
+});
+exports.endemicLweBaseOtFn = endemicLweBaseOtFn;
+/**
+ * Wire the endemic ML-KEM base OT into the KOS OT-extension — the RECOMMENDED post-quantum,
+ * maliciously-secure base. Everything above the base OT (the IKNP matrix, the KOS correlation check,
+ * the correlation-robust hash) is unchanged; only the `κ` setup base OTs run the endemic protocol.
+ *
+ *   const ch = new OtChannel(secureOtRandom(), withEndemicLweBaseOt());
+ */
+function withEndemicLweBaseOt() {
+    return { baseOtFn: exports.endemicLweBaseOtFn };
+}
+//# sourceMappingURL=endemic-ot.js.map

package/dist/endemic-ot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"endemic-ot.js","sourceRoot":"","sources":["../src/endemic-ot.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkFG;;;AAkIH,4CAEC;AAyBD,sCAQC;AA+CD,8CAwBC;AAoBD,oDA4BC;AAOD,0DAaC;AAcD,wDAeC;AA2BD,4CA2DC;AAgBD,oDAEC;AAnbD,6CAAyC;AACzC,6CAA4C;AAC5C,yCAAiC;AACjC,qCAA0C;AAwB1C,yGAAyG;AACzG,SAAS,aAAa,CAAC,GAAY;IACjC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,MAAM,GAAG,GAAG,CAAC,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;IACrF,KAAK,MAAM,IAAI,IAAI,GAAG;QAAE,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,UAAU;YAAE,OAAO,IAAI,CAAC;IACvE,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;IAC7E,KAAK,MAAM,IAAI,IAAI,IAAI;QAAE,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;IACtE,OAAO,GAAkB,CAAC;AAC5B,CAAC;AAED,SAAS,eAAe;IACtB,MAAM,OAAO,GAAG,IAAA,2BAAa,EAAC,UAAU,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG;QACjB,gCAAgC;QAChC,IAAA,gBAAI,EAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,qBAAqB,EAAE,MAAM,EAAE,UAAU,CAAC;KACvE,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;YAC5C,IAAI,MAAM,KAAK,IAAI;gBAAE,OAAO,MAAM,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,yBAAyB;QAC3B,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CACb,iGAAiG;QAC/F,uFAAuF,CAC1F,CAAC;AACJ,CAAC;AAED,MAAM,IAAI,GAAgB,eAAe,EAAE,CAAC;AAE5C,4DAA4D;AAC/C,QAAA,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;AACzB,QAAA,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;AACzB,QAAA,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;AACzB,QAAA,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;AAC7B,QAAA,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;AAExC,wGAAwG;AAC3F,QAAA,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACxC,QAAA,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAClC,QAAA,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAClC,QAAA,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAClC,QAAA,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAClC,QAAA,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAErD,sGAAsG;AACtG,oGAAoG;AACpG,wFAAwF;AACxF,sGAAsG;AAEtG,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,kCAAkC,CAAC,CAAC;AAC7E,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,kCAAkC,CAAC,CAAC;AAC7E,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,gCAAgC,CAAC,CAAC;AACzE,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,kCAAkC,CAAC,CAAC;AAC7E,MAAM,UAAU,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,qCAAqC,CAAC,CAAC;AAEnF,SAAS,MAAM,CAAC,GAAG,MAAoB;IACrC,MAAM,CAAC,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,MAAM;QAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACpC,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,GAAG,CAAC,CAAS;IACpB,MAAM,CAAC,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;IACzB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;IACzB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC;IACxB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;IAChB,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,MAAM,CAAC,GAAG,KAAmB;IACpC,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;IACrC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACd,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,QAAQ,CAAC,CAAa,EAAE,CAAa;IAC5C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAC9E,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACrC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;IAC1D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,OAAO,CAAC,CAAa,EAAE,CAAa;IAC3C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;IACzD,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,sGAAsG;AACtG,SAAgB,gBAAgB,CAAC,EAAc;IAC7C,OAAO,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED;gFACgF;AAChF,SAAS,GAAG,CAAC,GAAe,EAAE,CAAS,EAAE,KAAiB;IACxD,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED,0GAA0G;AAC1G,SAAS,QAAQ,CAAC,GAAe,EAAE,CAAS,EAAE,IAAY,EAAE,OAAmB,EAAE,GAAW;IAC1F,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,OAAO,QAAQ,GAAG,GAAG,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;QACvF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,QAAQ,GAAG,GAAG,EAAE,CAAC,EAAE;YAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACrF,GAAG,EAAE,CAAC;IACR,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,SAAgB,aAAa,CAC3B,GAAe,EACf,KAAa,EACb,IAAY,EACZ,OAAmB,EACnB,GAAW;IAEX,OAAO,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;AAClD,CAAC;AAED,6EAA6E;AAC7E,SAAS,WAAW,CAAC,GAAe,EAAE,CAAS,EAAE,IAAY,EAAE,GAAe,EAAE,GAAe;IAC7F,OAAO,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AAC5E,CAAC;AAED,sGAAsG;AACtG,mGAAmG;AACnG,sGAAsG;AAEtG,oFAAoF;AACvE,QAAA,oBAAoB,GAAG,iBAAS,CAAC;AAE9C,uGAAuG;AACvG,MAAa,iBAAkB,SAAQ,KAAK;IAC1C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AALD,8CAKC;AAsBD;;;;GAIG;AACH,SAAgB,iBAAiB,CAC/B,OAAiB,EACjB,MAAgB,IAAA,uBAAc,GAAE;IAEhC,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,iBAAS,CAAC,CAAC;IAChC,MAAM,GAAG,GAAG,gBAAgB,CAAC,EAAE,CAAC,CAAC;IACjC,MAAM,MAAM,GAAoC,EAAE,CAAC;IACnD,MAAM,IAAI,GAAiB,EAAE,CAAC;IAC9B,MAAM,UAAU,GAAiB,EAAE,CAAC;IACpC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC;QAC1B,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,iBAAS,CAAC,CAAC,CAAC;QACvE,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAU,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,kBAAU,CAAC,CAAC;QACxC,mFAAmF;QACnF,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,iBAAS,CAAC,CAAC,CAAC,CAAC;QAChF,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;QACvD,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACf,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3B,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC;AACpG,CAAC;AAcD;;;;;GAKG;AACH,SAAgB,oBAAoB,CAClC,OAAkC,EAClC,MAAgB,IAAA,uBAAc,GAAE,EAChC,MAAyB;IAEzB,MAAM,GAAG,GAAG,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACzC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;IACjC,MAAM,WAAW,GAAoC,EAAE,CAAC;IACxD,MAAM,UAAU,GAAoC,EAAE,CAAC;IACvD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACrB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAChD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC/B,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC/B,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,iBAAS,CAAC,CAAC;QAChC,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,iBAAS,CAAC,CAAC;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,iBAAS,CAAC,CAAC,CAAC;QACxD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,iBAAS,CAAC,CAAC,CAAC;QACxD,WAAW,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;QAC7B,UAAU,CAAC,IAAI,CAAC;YACd,QAAQ,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,4BAAoB,CAAC;YAC7C,QAAQ,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,4BAAoB,CAAC;SAC9C,CAAC,CAAC;IACL,CAAC;IACD,IAAI,MAAM,EAAE,iBAAiB;QAAE,MAAM,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;IACrE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,SAAgB,uBAAuB,CACrC,KAA8B,EAC9B,aAA4C;IAE5C,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;IAC3C,MAAM,EAAE,WAAW,EAAE,GAAG,aAAa,CAAC;IACtC,MAAM,QAAQ,GAAiB,EAAE,CAAC;IAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC;QAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAE,EAAE,WAAW,CAAC,CAAC,CAAE,CAAC,CAAC,CAAE,CAAC,CAAC;QAClE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,4BAAoB,CAAC,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAaD,yCAAyC;AACzC,SAAgB,sBAAsB,CACpC,OAAiB,EACjB,MAAgB,IAAA,uBAAc,GAAE,EAChC,MAAyB;IAEzB,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,iBAAiB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC3D,MAAM,aAAa,GAAG,oBAAoB,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,uBAAuB,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;IAC/D,OAAO;QACL,UAAU,EAAE,aAAa,CAAC,UAAU;QACpC,QAAQ;QACR,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,OAAO;QACP,WAAW,EAAE,aAAa,CAAC,WAAW;KACvC,CAAC;AACJ,CAAC;AAqBD;;;;;GAKG;AACH,SAAgB,gBAAgB,CAC9B,QAAyC,EACzC,OAAiB,EACjB,MAAgB,IAAA,uBAAc,GAAE,EAChC,MAAyB;IAEzB,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IAE9G,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,iBAAiB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC3D,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IAEtB,oGAAoG;IACpG,wDAAwD;IACxD,MAAM,WAAW,GAAoC,EAAE,CAAC;IACxD,MAAM,SAAS,GAAoC,EAAE,CAAC;IACtD,MAAM,WAAW,GAAoC,EAAE,CAAC;IACxD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;QAC9B,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,0CAA0C,CAAC,CAAC;QAC1F,CAAC;QACD,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC;QACpC,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAChD,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,iBAAS,CAAC,CAAC;QAChC,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,iBAAS,CAAC,CAAC;QAChC,WAAW,CAAC,IAAI,CAAC;YACf,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,iBAAS,CAAC,CAAC;YAC1D,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,iBAAS,CAAC,CAAC;SAC3D,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;QAChD,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QACzD,WAAW,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,WAAW,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACzF,CAAC;IAED,IAAI,MAAM,EAAE,iBAAiB;QAAE,MAAM,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAEnE,4FAA4F;IAC5F,MAAM,QAAQ,GAAiB,EAAE,CAAC;IAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC;QAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAE,EAAE,WAAW,CAAC,CAAC,CAAE,CAAC,CAAC,CAAE,CAAC,CAAC;QACxE,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,CAAE,CAAC,CAAC,CAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;QACnD,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC3B,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,WAAW,CAAC,CAAC,CAAE,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,iBAAiB,CACzB,0BAA0B,CAAC,iEAAiE,CAC7F,CAAC;QACJ,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;IAED,OAAO;QACL,QAAQ;QACR,UAAU,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE;KAChH,CAAC;AACJ,CAAC;AAED;;GAEG;AACI,MAAM,kBAAkB,GAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACvE,QAAQ,EAAE,gBAAgB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,QAAQ;CAC5D,CAAC,CAAC;AAFU,QAAA,kBAAkB,sBAE5B;AAEH;;;;;;GAMG;AACH,SAAgB,oBAAoB;IAClC,OAAO,EAAE,QAAQ,EAAE,0BAAkB,EAAE,CAAC;AAC1C,CAAC"}