@atlasauth/pca-mpc 0.3.0 → 0.4.0

package/dist/mascot.js

@@ -32,6 +32,16 @@
  * sender keeps `−Σρ_k`, an additive sharing of `x_i·y_j`. Because the OT hides both the choice and the
  * unchosen message, neither party learns the other's share.
  *
+ * ## Selective failure (RT-04) and the privacy-amplified choice bits
+ *
+ * With plain binary choice bits the sender can corrupt one message pair so the run aborts iff a chosen bit of
+ * the receiver's share is 1 - abort / no-abort then leaks a share bit, hence (through the public Beaver opening)
+ * an honest input bit. The receiver therefore does NOT choose with the bits of its share: it draws
+ * `61 + 3s` (= 253) uniform bits `b` and its share is `<g, b>` for a public gadget `g` (`enc.ts`, the MASCOT remedy;
+ * `s = statSec = 40`). A predicate that holds with probability at least 2^-s leaves `<g,b>` within 2^-s of uniform;
+ * a rarer predicate is observed with probability below 2^-s. The same encoding covers the MAC-key shares. The
+ * price is 253 OTs per multiplication instead of 61.
+ *
  * ## Malicious security (docs §7.1)
  *
  * The OT is now **malicious-secure**: Chou–Orlandi base OT + IKNP extension **with the KOS correlation
@@ -56,15 +66,31 @@
  * network/transport (including the interactive secure coin-flip for the public MAC-check challenge).
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.NoDealerOffline = void 0;
+exports.NoDealerOffline = exports.OfflineCheatingAbort = void 0;
 exports.makeNoDealerOffline = makeNoDealerOffline;
 const field_1 = require("./field");
+const enc_1 = require("./enc");
 const csprng_1 = require("./csprng");
 const sharing_1 = require("./sharing");
 const spdz_1 = require("./spdz");
 const ot_1 = require("./ot");
-/** Number of bits needed to represent any element of F_p (p = 2^61 − 1 ⇒ values use bits 0..60). */
-const FIELD_BITS = 61;
+/**
+ * A sacrifice / MAC-check abort in the OFFLINE phase together with the parties whose OT transcript is
+ * inconsistent. `blamed` lists a party when (i) as an OT sender it offered a pair that does not contain the
+ * value the receiver actually obtained, or (ii) the product share it used differs from the one its OT
+ * transcripts imply (a wrong operand). Empty when nothing in the disclosed transcript is inconsistent (e.g.
+ * the lie was on an unchosen branch). The transcript disclosed is that of the DISCARDED triple only (random
+ * triple shares and OT masks, never a MAC-key share, never an input), so naming does not weaken privacy.
+ */
+class OfflineCheatingAbort extends spdz_1.MacCheckAbort {
+    blamed;
+    constructor(message, blamed) {
+        super(blamed.length ? `${message}; offline OT transcript names party ${blamed.join(', ')}` : message);
+        this.name = 'OfflineCheatingAbort';
+        this.blamed = blamed;
+    }
+}
+exports.OfflineCheatingAbort = OfflineCheatingAbort;
 /**
  * The no-dealer offline phase for a fixed party count `n`. Holds the distributed MAC key (α_i only),
  * and a reusable set of per-ordered-pair OT-extension channels so the κ base OTs are amortized across
@@ -75,8 +101,17 @@ const FIELD_BITS = 61;
  */
 class NoDealerOffline {
     n;
-    /** α_i: party i's locally-sampled share of the MAC key. Σ α_i = α (never formed by any party). */
+    /** α_i: party i's locally-sampled share of MAC key 0. Σ α_i = α (never formed by any party). */
     alphaShares;
+    /** Shares of every MAC key: `keyShares[l][i]` is party i's share of key l (`keyShares[0] === alphaShares`). */
+    keyShares;
+    /** The choice-bit encodings of the MAC-key shares (`keyEnc[l][i]` encodes `keyShares[l][i]`). */
+    keyEnc;
+    /** The public gadget vector of the OT choice-bit encoding (`enc.ts`). */
+    gadget;
+    /** The statistical parameter of the encoding. */
+    statSec;
+    sacrificePartners;
     rng;
     seed;
     /** Whether randomness is a deterministic (test) seed; when false, all randomness is the CSPRNG. */
@@ -89,6 +124,9 @@ class NoDealerOffline {
     deviation;
     /** Count of triple-product OT multiplications performed (for targeting `deviation.productMul`). */
     productMulCount = 0;
+    /** Transcript of the triple being generated (for attribution on abort); null when not recording. */
+    log = null;
+    claims = [];
     constructor(n, seed, opts = {}) {
         if (!Number.isInteger(n) || n < 1)
             throw new Error('NoDealerOffline: n must be a positive integer');
@@ -101,7 +139,18 @@ class NoDealerOffline {
         this.sacrificeOn = opts.sacrifice ?? true;
         this.deviation = opts.deviation;
         // DISTRIBUTED MAC-KEY GENERATION: each party samples its own α_i locally. α is never reconstructed.
-        this.alphaShares = Array.from({ length: n }, () => this.rng.next());
+        const keys = opts.macKeys ?? spdz_1.MAC_KEYS;
+        if (!Number.isInteger(keys) || keys < 1 || keys > 16)
+            throw new Error('NoDealerOffline: macKeys must be an integer in [1, 16]');
+        this.statSec = opts.statSec ?? enc_1.STAT_SEC;
+        this.gadget = (0, enc_1.makeGadget)(this.statSec, () => this.rng.next(), opts.unsafeStatSec === true);
+        this.keyEnc = Array.from({ length: keys }, () => Array.from({ length: n }, () => (0, enc_1.sampleEnc)(this.gadget, this.rng)));
+        this.keyShares = this.keyEnc.map((row) => row.map((e) => e.value));
+        this.alphaShares = this.keyShares[0];
+        this.sacrificePartners = opts.sacrificePartners ?? spdz_1.SACRIFICE_PARTNERS;
+        if (!Number.isInteger(this.sacrificePartners) || this.sacrificePartners < 1 || this.sacrificePartners > 8) {
+            throw new Error('NoDealerOffline: sacrificePartners must be an integer in [1, 8]');
+        }
     }
     /**
      * The SPDZ MAC context the online runner consumes. It carries ONLY `alphaShares` for the protocol;
@@ -109,10 +158,13 @@ class NoDealerOffline {
      * protocol step or held by any party.
      */
     get macContext() {
-        let alpha = 0n;
-        for (const ai of this.alphaShares)
-            alpha = (0, field_1.fadd)(alpha, ai);
-        return { n: this.n, alphaShares: this.alphaShares.slice(), alpha };
+        const keys = this.keyShares.map((shares) => {
+            let alpha = 0n;
+            for (const ai of shares)
+                alpha = (0, field_1.fadd)(alpha, ai);
+            return { alphaShares: shares.slice(), alpha };
+        });
+        return { n: this.n, ...keys[0], extraKeys: keys.slice(1) };
     }
     channel(i, j) {
         const key = `${i}->${j}`;
@@ -128,130 +180,204 @@ class NoDealerOffline {
         return ch;
     }
     /**
-     * Gilboa OT multiplication of two scalars held by different parties. Party `i` holds `xi` (OT
-     * receiver, choice bits = bits of xi); party `j` holds `yj` (OT sender). Returns `[shareI, shareJ]`
-     * with `shareI + shareJ = xi·yj (mod p)`, neither party learning the other's input or share.
+     * A fresh uniform receiver operand for `party` (uniform bits, and the share they encode). Every share a
+     * party multiplies with as OT receiver (triple shares, MAC-key shares) comes from here: the bits are the OT
+     * choice bits, so a selective-failure abort tells the sender only about bits of `b`, not about the share.
      */
-    gilboa(i, j, xi, yj) {
-        const x = (0, field_1.mod)(xi);
-        const y = (0, field_1.mod)(yj);
-        // Sender draws fresh masks ρ_k and offers (ρ_k, ρ_k + 2^k·y) for each bit k.
-        const choiceBits = new Array(FIELD_BITS);
-        const msg0 = new Array(FIELD_BITS);
-        const msg1 = new Array(FIELD_BITS);
-        let senderSum = 0n; // Σ ρ_k
-        let pow = 1n; // 2^k mod p (k ≤ 60 ⇒ no wrap)
-        for (let k = 0; k < FIELD_BITS; k++) {
-            const rho = this.rng.next();
-            senderSum = (0, field_1.fadd)(senderSum, rho);
-            msg0[k] = rho;
-            msg1[k] = (0, field_1.fadd)(rho, (0, field_1.fmul)(pow, y));
-            choiceBits[k] = Number((x >> BigInt(k)) & 1n);
-            pow = (pow * 2n) % field_1.PRIME;
-        }
-        const { received } = this.channel(i, j).extend(choiceBits, msg0, msg1);
-        let receiverSum = 0n; // Σ (received_k mod p)
-        for (let k = 0; k < FIELD_BITS; k++)
-            receiverSum = (0, field_1.fadd)(receiverSum, (0, field_1.mod)(received[k]));
-        // shareI + shareJ = Σ received − Σ ρ = (xi·yj + Σρ) − Σρ = xi·yj.
-        return [receiverSum, (0, field_1.fneg)(senderSum)];
+    sampleShare(party) {
+        void party;
+        return (0, enc_1.sampleEnc)(this.gadget, this.rng);
     }
     /**
-     * OT-based share multiplication: given additive sharings `x`, `y` (length n), returns an additive
-     * sharing `z` with `Σ z = (Σ x)(Σ y) mod p`. Diagonal terms are local; each cross term is a Gilboa OT
-     * multiplication. No party learns Σx, Σy, or Σz.
+     * BATCHED OT-based share multiplication. Each request `{x, y}` is a pair of additive sharings (length n) whose product
+     * sharing `z` (`Σ z = (Σ x)(Σ y) mod p`) is wanted. All requests are multiplied with ONE OT-extension round per ordered
+     * pair (the KOS padding rows and the per-round fixed costs are paid once, not per multiplication). Diagonal terms are
+     * local; each cross term `x_i·y_j` is a Gilboa multiplication in which party `i` is the OT receiver with choice bits
+     * `bits` and weights `gad` (its operand is `<gad, bits>`) and party `j` offers `(ρ_k, ρ_k + gad_k·y_j)`. No party learns
+     * Σx, Σy or Σz.
+     *
+     * Entries of `x` given as `EncShare` use their own choice bits (privacy-amplified, see `enc.ts`). A plain bigint `x_i`
+     * has no uniform encoding, so it is split as `x_i = e + d` with a fresh encoded `e` and `d = x_i − e` (uniform given what
+     * an encoded-bit leak reveals), and both halves are multiplied.
      */
-    otShareMultiply(x, y) {
-        if (x.length !== this.n || y.length !== this.n)
-            throw new Error('otShareMultiply: wrong length');
-        const z = x.map((xi, i) => (0, field_1.fmul)(xi, y[i])); // diagonal x_i·y_i (local)
-        for (let i = 0; i < this.n; i++) {
-            for (let j = 0; j < this.n; j++) {
+    mulBatch(reqs) {
+        const n = this.n;
+        for (const r of reqs)
+            if (r.x.length !== n || r.y.length !== n)
+                throw new Error('otShareMultiply: wrong length');
+        const pieces = reqs.map((r) => r.x.map((xi) => {
+            if (typeof xi !== 'bigint')
+                return { value: xi.value, parts: [{ bits: xi.bits, gad: this.gadget }] };
+            const v = (0, field_1.mod)(xi);
+            const e = (0, enc_1.sampleEnc)(this.gadget, this.rng);
+            const d = (0, enc_1.plainShare)((0, field_1.fsub)(v, e.value));
+            return {
+                value: v,
+                parts: [
+                    { bits: e.bits, gad: this.gadget },
+                    { bits: d.bits, gad: enc_1.PLAIN_GADGET },
+                ],
+            };
+        }));
+        const z = reqs.map((r, q) => pieces[q].map((p, i) => (0, field_1.fmul)(p.value, r.y[i]))); // diagonal x_i·y_i (local)
+        for (let i = 0; i < n; i++) {
+            for (let j = 0; j < n; j++) {
                 if (i === j)
                     continue;
-                const [si, sj] = this.gilboa(i, j, x[i], y[j]); // sharing of x_i·y_j
-                z[i] = (0, field_1.fadd)(z[i], si);
-                z[j] = (0, field_1.fadd)(z[j], sj);
+                let rows = 0;
+                for (let q = 0; q < reqs.length; q++)
+                    for (const part of pieces[q][i].parts)
+                        rows += part.bits.length;
+                const bits = new Array(rows);
+                const msg0 = new Array(rows);
+                const msg1 = new Array(rows);
+                const segs = [];
+                let at = 0;
+                for (let q = 0; q < reqs.length; q++) {
+                    const y = (0, field_1.mod)(reqs[q].y[j]);
+                    for (const part of pieces[q][i].parts) {
+                        const len = part.bits.length;
+                        let senderSum = 0n; // Σ ρ_k
+                        for (let k = 0; k < len; k++) {
+                            const rho = this.rng.next();
+                            senderSum = (0, field_1.fadd)(senderSum, rho);
+                            bits[at + k] = part.bits[k];
+                            msg0[at + k] = rho;
+                            msg1[at + k] = (0, field_1.fadd)(rho, (0, field_1.fmul)(part.gad[k], y));
+                        }
+                        segs.push({ q, start: at, len, senderSum });
+                        at += len;
+                    }
+                }
+                const { received } = this.channel(i, j).extend(bits, msg0, msg1);
+                this.log?.push({ receiver: i, sender: j, msg0, msg1, received });
+                for (const sg of segs) {
+                    let receiverSum = 0n; // Σ (received_k mod p)
+                    for (let k = 0; k < sg.len; k++)
+                        receiverSum = (0, field_1.fadd)(receiverSum, (0, field_1.mod)(received[sg.start + k]));
+                    // shareI + shareJ = Σ received − Σ ρ = (<gad,bits>·y_j + Σρ) − Σρ = <gad,bits>·y_j.
+                    z[sg.q][i] = (0, field_1.fadd)(z[sg.q][i], receiverSum);
+                    z[sg.q][j] = (0, field_1.fadd)(z[sg.q][j], (0, field_1.fneg)(sg.senderSum));
+                }
             }
         }
         return z;
     }
-    /** Authenticate a value sharing: produce MAC shares γ with Σ γ = α·(Σ value), via OT (no dealer). */
+    /** One OT multiplication (see `mulBatch`): `Σ z = (Σ x)(Σ y)`. */
+    otShareMultiply(x, y) {
+        return this.mulBatch([{ x, y }])[0];
+    }
+    /** Authenticate a value sharing: MAC shares γ^(l) with Σ γ^(l) = α^(l)·(Σ value) for every key l, via OT (no dealer). */
     authenticate(valueShares) {
-        return this.otShareMultiply(this.alphaShares, valueShares);
+        return this.toAuth(valueShares, this.mulBatch(this.keyEnc.map((alphas) => ({ x: alphas, y: valueShares }))));
     }
-    /**
-     * The product sharing `c` (Σc = a·b) for a triple, via OT. Counts as a triple PRODUCT so a test
-     * `deviation` can corrupt one — modelling a malicious party that feeds a wrong OT input and gets a
-     * wrong-but-self-MAC-consistent product share (only the sacrifice catches this).
-     */
-    tripleProduct(x, y) {
-        const z = this.otShareMultiply(x, y);
+    toAuth(value, macs) {
+        return { value, mac: macs[0], extraMac: macs.slice(1) };
+    }
+    /** Test hook (deviation) + attribution record for a triple product sharing `implied`; returns the claimed sharing. */
+    claimProduct(implied) {
+        const z = implied.slice();
         const idx = this.productMulCount++;
         const dev = this.deviation;
         if (dev && dev.productMul === idx)
             z[0] = (0, field_1.fadd)(z[0], dev.delta);
+        this.claims.push({ claimed: z, implied });
         return z;
     }
-    /** A RAW authenticated triple (a, b, c=a·b) from OT, before the sacrifice. No dealer. */
-    rawTriple() {
-        const aShares = Array.from({ length: this.n }, () => this.rng.next());
-        const bShares = Array.from({ length: this.n }, () => this.rng.next());
-        const cShares = this.tripleProduct(aShares, bShares);
-        return {
-            a: { value: aShares, mac: this.authenticate(aShares) },
-            b: { value: bShares, mac: this.authenticate(bShares) },
-            c: { value: cShares, mac: this.authenticate(cShares) },
-        };
-    }
-    /** A RAW authenticated triple (â, b, ĉ=â·b) SHARING the given authenticated `b` — the sacrifice pair. */
-    rawTripleWithB(b) {
-        const aShares = Array.from({ length: this.n }, () => this.rng.next());
-        const cShares = this.tripleProduct(aShares, b.value);
-        return {
-            a: { value: aShares, mac: this.authenticate(aShares) },
-            b,
-            c: { value: cShares, mac: this.authenticate(cShares) },
-        };
-    }
     /**
-     * The MASCOT **sacrifice** check. Given two triples sharing `b`, `(a,b,c)` (the one to KEEP) and
-     * `(â,b,ĉ)` (the one to SACRIFICE), draw a public random challenge `e`, open `ρ = e·a − â`, form the
-     * authenticated residual `⟦τ⟧ = e·⟦c⟧ − ⟦ĉ⟧ − ρ·⟦b⟧`, open `τ`, run the commit-then-open MAC-check on
-     * both openings, and require `τ = 0`. If both triples are correct, `τ = e·(c−ab) − (ĉ−âb) = 0`; if the
-     * kept triple has `c = ab + δ`, then `τ = e·δ`, which is non-zero (e ≠ 0, δ ≠ 0) — ABORT. Lying in the
-     * `τ` opening to force a zero value is caught by the MAC-check (the forged MAC won't reconcile). The
-     * sacrificed triple is consumed by the check and discarded; the kept triple is certified `c = a·b`.
+     * One raw authenticated triple `(a, b, c = a·b)` together with `partners` sacrifice triples `(â_r, b, ĉ_r)` sharing `b`,
+     * from OT with NO dealer, in TWO batched OT layers: layer 1 = all products and the MACs of every value known before them,
+     * layer 2 = the MACs of the products. Each value's MAC is `α^(l)·value` for every key `l`.
      */
-    sacrifice(keep, sac) {
-        const ctx = this.macContext;
-        const engine = new spdz_1.SpdzEngine(ctx, []);
-        let e = this.rng.next();
-        if (e === 0n)
-            e = 1n; // public random challenge, non-zero
-        const rho = engine.open((0, spdz_1.subAuth)((0, spdz_1.scaleAuth)(keep.a, e), sac.a), 'sacrifice:rho');
-        let tau = (0, spdz_1.subAuth)((0, spdz_1.scaleAuth)(keep.c, e), sac.c);
-        tau = (0, spdz_1.subAuth)(tau, (0, spdz_1.scaleAuth)(keep.b, rho));
-        const tauValue = engine.open(tau, 'sacrifice:tau');
-        engine.macCheck(this.rng); // commit-then-open MAC-check on ρ and τ; throws MacCheckAbort on a forged MAC
-        if (tauValue !== 0n) {
-            throw new spdz_1.MacCheckAbort(`MASCOT sacrifice FAILED: residual τ=${tauValue} != 0 — a malformed Beaver triple (c != a·b) was detected in the offline phase; aborting with no triple emitted`);
+    rawTripleWithPartners(partners) {
+        const n = this.n;
+        const K = this.keyEnc.length;
+        const aEnc = Array.from({ length: n }, (_, i) => this.sampleShare(i));
+        const bShares = Array.from({ length: n }, () => this.rng.next());
+        const ahEnc = Array.from({ length: partners }, () => Array.from({ length: n }, (_, i) => this.sampleShare(i)));
+        const aVal = aEnc.map((e) => e.value);
+        const ahVal = ahEnc.map((row) => row.map((e) => e.value));
+        const reqs = [{ x: aEnc, y: bShares }];
+        for (let r = 0; r < partners; r++)
+            reqs.push({ x: ahEnc[r], y: bShares });
+        const macStart = reqs.length;
+        for (let l = 0; l < K; l++) {
+            reqs.push({ x: this.keyEnc[l], y: aVal });
+            reqs.push({ x: this.keyEnc[l], y: bShares });
+            for (let r = 0; r < partners; r++)
+                reqs.push({ x: this.keyEnc[l], y: ahVal[r] });
+        }
+        const z1 = this.mulBatch(reqs);
+        const cShares = this.claimProduct(z1[0]);
+        const chShares = Array.from({ length: partners }, (_, r) => this.claimProduct(z1[1 + r]));
+        const per = 2 + partners;
+        const macOf = (off) => Array.from({ length: K }, (_, l) => z1[macStart + l * per + off]);
+        const reqs2 = [];
+        for (let l = 0; l < K; l++) {
+            reqs2.push({ x: this.keyEnc[l], y: cShares });
+            for (let r = 0; r < partners; r++)
+                reqs2.push({ x: this.keyEnc[l], y: chShares[r] });
         }
+        const z2 = this.mulBatch(reqs2);
+        const per2 = 1 + partners;
+        const macOf2 = (off) => Array.from({ length: K }, (_, l) => z2[l * per2 + off]);
+        const b = this.toAuth(bShares, macOf(1));
+        const keep = { a: this.toAuth(aVal, macOf(0)), b, c: this.toAuth(cShares, macOf2(0)) };
+        const parts = Array.from({ length: partners }, (_, r) => ({
+            a: this.toAuth(ahVal[r], macOf(2 + r)),
+            b,
+            c: this.toAuth(chShares[r], macOf2(1 + r)),
+        }));
+        return { keep, partners: parts };
+    }
+    /** Name the parties whose transcript of the discarded triple is inconsistent (see `OfflineCheatingAbort`). */
+    attribute(abort) {
+        const blamed = new Set();
+        for (const r of this.log ?? []) {
+            for (let k = 0; k < r.received.length; k++) {
+                const got = (0, field_1.mod)(r.received[k]);
+                if (got !== r.msg0[k] && got !== r.msg1[k]) {
+                    blamed.add(r.sender); // the receiver holds a value the sender never offered
+                    break;
+                }
+            }
+        }
+        for (const c of this.claims) {
+            c.claimed.forEach((v, i) => {
+                if (v !== c.implied[i])
+                    blamed.add(i); // a product share that does not follow from its OT transcripts
+            });
+        }
+        return new OfflineCheatingAbort(abort.message, [...blamed].sort((p, q) => p - q));
     }
     /**
      * Generate ONE authenticated Beaver triple with NO dealer, MALICIOUS-secure. Each party samples its
      * own a_i, b_i; the product sharing c (Σc = a·b) comes from OT; every component is MAC'd via OT
      * against the α shares. When the sacrifice is on (default), a SECOND triple sharing `b` is generated
      * and sacrificed to certify `c = a·b` under the MACs, so a malformed triple ABORTS rather than being
-     * emitted. No party learns a, b, c, or α.
+     * emitted. No party learns a, b, c, or α. The OT choice bits are privacy-amplified (`enc.ts`), so whether
+     * a run aborts is statistically independent of any share an honest party holds (RT-04). An abort throws
+     * `OfflineCheatingAbort`, which names the party whose OT transcript is inconsistent where one is.
      */
     genAuthTriple() {
         if (!this.sacrificeOn)
-            return this.rawTriple();
-        const keep = this.rawTriple();
-        const sac = this.rawTripleWithB(keep.b);
-        this.sacrifice(keep, sac);
-        return keep;
+            return this.rawTripleWithPartners(0).keep;
+        this.log = [];
+        this.claims = [];
+        try {
+            const { keep, partners } = this.rawTripleWithPartners(this.sacrificePartners);
+            // The MASCOT sacrifice (spdz.ts `sacrificeVerify`): throws MacCheckAbort and emits no triple on a bad c.
+            return (0, spdz_1.sacrificeVerify)([{ keep, partners }], this.macContext, this.rng)[0];
+        }
+        catch (e) {
+            if (e instanceof spdz_1.MacCheckAbort)
+                throw this.attribute(e);
+            throw e;
+        }
+        finally {
+            this.log = null;
+            this.claims = [];
+        }
     }
     /** Generate `count` authenticated triples (channels/base-OTs amortized across all of them). */
     genAuthTriples(count) {
@@ -270,7 +396,7 @@ class NoDealerOffline {
         if (owner < 0 || owner >= this.n)
             throw new Error('authInput: owner out of range');
         const valueShares = (0, sharing_1.share)((0, field_1.mod)(value), this.n, this.rng);
-        return { value: valueShares, mac: this.authenticate(valueShares) };
+        return this.authenticate(valueShares);
     }
     /**
      * The MASCOT **input-consistency check**: verify that a batch of authenticated inputs each satisfy
@@ -296,25 +422,18 @@ class NoDealerOffline {
         const engine = new spdz_1.SpdzEngine(ctx, []);
         // Fresh OT-authenticated random mask ⟦r⟧ (hides w so no input value is revealed).
         const rShares = Array.from({ length: this.n }, () => this.rng.next());
-        let w = { value: rShares, mac: this.authenticate(rShares) };
+        let w = this.authenticate(rShares);
         for (const inp of inputs) {
             let e = this.rng.next(); // public random coefficient
             if (e === 0n)
                 e = 1n; // weight every input (0 would skip one); bias is negligible (prob 1/p)
-            w = addAuthLocal(w, (0, spdz_1.scaleAuth)(inp, e));
+            w = (0, spdz_1.addAuth)(w, (0, spdz_1.scaleAuth)(inp, e));
         }
         engine.open(w, 'input-check:w');
         engine.macCheck(this.rng); // throws MacCheckAbort if any input's MAC is inconsistent with its value
     }
 }
 exports.NoDealerOffline = NoDealerOffline;
-/** Local authenticated addition (kept here to avoid widening mascot's spdz import surface). */
-function addAuthLocal(x, y) {
-    return {
-        value: x.value.map((xi, i) => (0, field_1.fadd)(xi, y.value[i])),
-        mac: x.mac.map((mi, i) => (0, field_1.fadd)(mi, y.mac[i])),
-    };
-}
 /** Convenience: a fresh no-dealer offline phase for `n` parties (malicious-secure by default). */
 function makeNoDealerOffline(n, seed, opts) {
     return new NoDealerOffline(n, seed, opts);

package/dist/mascot.js.map

@@ -1 +1 @@
-{"version":3,"file":"mascot.js","sourceRoot":"","sources":["../src/mascot.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;;;AAsTH,kDAMC;AA1TD,mCAAiE;AACjE,qCAA0D;AAC1D,uCAAoD;AACpD,iCAQgB;AAChB,6BAAsE;AAEtE,oGAAoG;AACpG,MAAM,UAAU,GAAG,EAAE,CAAC;AAyBtB;;;;;;;GAOG;AACH,MAAa,eAAe;IACjB,CAAC,CAAS;IACnB,kGAAkG;IACzF,WAAW,CAAW;IACd,GAAG,CAAW;IACd,IAAI,CAAS;IAC9B,mGAAmG;IAClF,aAAa,CAAU;IACxC,iGAAiG;IAChF,QAAQ,GAAG,IAAI,GAAG,EAAqB,CAAC;IACzD,6FAA6F;IAC5E,WAAW,CAAU;IACtC,kFAAkF;IACjE,SAAS,CAAoB;IAC9C,mGAAmG;IAC3F,eAAe,GAAG,CAAC,CAAC;IAE5B,YAAY,CAAS,EAAE,IAAa,EAAE,OAAwB,EAAE;QAC9D,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACpG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACX,mGAAmG;QACnG,uGAAuG;QACvG,IAAI,CAAC,aAAa,GAAG,IAAI,KAAK,SAAS,CAAC;QACxC,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,cAAc,CAAC;QACnC,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,gBAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,uBAAc,EAAE,CAAC;QAC/E,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC;QAC1C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAChC,oGAAoG;QACpG,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACtE,CAAC;IAED;;;;OAIG;IACH,IAAI,UAAU;QACZ,IAAI,KAAK,GAAG,EAAE,CAAC;QACf,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,WAAW;YAAE,KAAK,GAAG,IAAA,YAAI,EAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC3D,OAAO,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC;IACrE,CAAC;IAEO,OAAO,CAAC,CAAS,EAAE,CAAS;QAClC,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,IAAI,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,iGAAiG;YACjG,MAAM,KAAK,GAAa,IAAI,CAAC,aAAa;gBACxC,CAAC,CAAC,IAAA,aAAQ,EAAC,IAAA,eAAU,EAAC,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC;gBACtG,CAAC,CAAC,IAAA,uBAAc,GAAE,CAAC;YACrB,EAAE,GAAG,IAAI,cAAS,CAAC,KAAK,CAAC,CAAC;YAC1B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED;;;;OAIG;IACK,MAAM,CAAC,CAAS,EAAE,CAAS,EAAE,EAAU,EAAE,EAAU;QACzD,MAAM,CAAC,GAAG,IAAA,WAAG,EAAC,EAAE,CAAC,CAAC;QAClB,MAAM,CAAC,GAAG,IAAA,WAAG,EAAC,EAAE,CAAC,CAAC;QAClB,6EAA6E;QAC7E,MAAM,UAAU,GAAa,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC;QACnD,MAAM,IAAI,GAAa,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAa,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC;QAC7C,IAAI,SAAS,GAAG,EAAE,CAAC,CAAC,QAAQ;QAC5B,IAAI,GAAG,GAAG,EAAE,CAAC,CAAC,+BAA+B;QAC7C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC;YACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YAC5B,SAAS,GAAG,IAAA,YAAI,EAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YACjC,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;YACd,IAAI,CAAC,CAAC,CAAC,GAAG,IAAA,YAAI,EAAC,GAAG,EAAE,IAAA,YAAI,EAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;YAClC,UAAU,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;YAC9C,GAAG,GAAG,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,aAAK,CAAC;QAC3B,CAAC;QACD,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACvE,IAAI,WAAW,GAAG,EAAE,CAAC,CAAC,uBAAuB;QAC7C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,EAAE,CAAC,EAAE;YAAE,WAAW,GAAG,IAAA,YAAI,EAAC,WAAW,EAAE,IAAA,WAAG,EAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC;QACxF,kEAAkE;QAClE,OAAO,CAAC,WAAW,EAAE,IAAA,YAAI,EAAC,SAAS,CAAC,CAAC,CAAC;IACxC,CAAC;IAED;;;;OAIG;IACH,eAAe,CAAC,CAAc,EAAE,CAAc;QAC5C,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACjG,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,IAAA,YAAI,EAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,2BAA2B;QACxE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAChC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;gBAChC,IAAI,CAAC,KAAK,CAAC;oBAAE,SAAS;gBACtB,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,qBAAqB;gBACvE,CAAC,CAAC,CAAC,CAAC,GAAG,IAAA,YAAI,EAAC,CAAC,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC;gBACvB,CAAC,CAAC,CAAC,CAAC,GAAG,IAAA,YAAI,EAAC,CAAC,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,qGAAqG;IAC7F,YAAY,CAAC,WAAwB;QAC3C,OAAO,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IAC7D,CAAC;IAED;;;;OAIG;IACK,aAAa,CAAC,CAAc,EAAE,CAAc;QAClD,MAAM,CAAC,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC;QAC3B,IAAI,GAAG,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG;YAAE,CAAC,CAAC,CAAC,CAAC,GAAG,IAAA,YAAI,EAAC,CAAC,CAAC,CAAC,CAAE,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QACjE,OAAO,CAAC,CAAC;IACX,CAAC;IAED,yFAAyF;IACjF,SAAS;QACf,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACtE,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACtE,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACrD,OAAO;YACL,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE;YACtD,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE;YACtD,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE;SACvD,CAAC;IACJ,CAAC;IAED,yGAAyG;IACjG,cAAc,CAAC,CAAS;QAC9B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACtE,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QACrD,OAAO;YACL,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE;YACtD,CAAC;YACD,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE;SACvD,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACK,SAAS,CAAC,IAAgB,EAAE,GAAe;QACjD,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC;QAC5B,MAAM,MAAM,GAAG,IAAI,iBAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACvC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,KAAK,EAAE;YAAE,CAAC,GAAG,EAAE,CAAC,CAAC,oCAAoC;QAC1D,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAA,cAAO,EAAC,IAAA,gBAAS,EAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;QAC/E,IAAI,GAAG,GAAG,IAAA,cAAO,EAAC,IAAA,gBAAS,EAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QAC/C,GAAG,GAAG,IAAA,cAAO,EAAC,GAAG,EAAE,IAAA,gBAAS,EAAC,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;QACnD,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,8EAA8E;QACzG,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;YACpB,MAAM,IAAI,oBAAa,CACrB,uCAAuC,QAAQ,iHAAiH,CACjK,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,aAAa;QACX,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC;QAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,+FAA+F;IAC/F,cAAc,CAAC,KAAa;QAC1B,MAAM,GAAG,GAAiB,EAAE,CAAC;QAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE;YAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;QAC/D,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;OAKG;IACH,SAAS,CAAC,KAAa,EAAE,KAAa;QACpC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACnF,MAAM,WAAW,GAAG,IAAA,eAAK,EAAC,IAAA,WAAG,EAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QACxD,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,EAAE,CAAC;IACrE,CAAC;IAED;;;;;;;;;;;OAWG;IACH,qBAAqB,CAAC,MAA6B;QACjD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAChC,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;YACzB,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,EAAE,CAAC;gBAC7D,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC;QAC5B,MAAM,MAAM,GAAG,IAAI,iBAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACvC,kFAAkF;QAClF,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACtE,IAAI,CAAC,GAAW,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;QACpE,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;YACzB,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,4BAA4B;YACrD,IAAI,CAAC,KAAK,EAAE;gBAAE,CAAC,GAAG,EAAE,CAAC,CAAC,uEAAuE;YAC7F,CAAC,GAAG,YAAY,CAAC,CAAC,EAAE,IAAA,gBAAS,EAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QACzC,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;QAChC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,yEAAyE;IACtG,CAAC;CACF;AA7OD,0CA6OC;AAED,+FAA+F;AAC/F,SAAS,YAAY,CAAC,CAAS,EAAE,CAAS;IACxC,OAAO;QACL,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,IAAA,YAAI,EAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;QACpD,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,IAAA,YAAI,EAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,CAAC;KAC/C,CAAC;AACJ,CAAC;AAcD,kGAAkG;AAClG,SAAgB,mBAAmB,CACjC,CAAS,EACT,IAAa,EACb,IAAsB;IAEtB,OAAO,IAAI,eAAe,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAC5C,CAAC"}
+{"version":3,"file":"mascot.js","sourceRoot":"","sources":["../src/mascot.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiEG;;;AAwbH,kDAMC;AA5bD,mCAAgE;AAChE,+BAAiG;AACjG,qCAA0D;AAC1D,uCAAoD;AACpD,iCAWgB;AAChB,6BAAsE;AAEtE;;;;;;;GAOG;AACH,MAAa,oBAAqB,SAAQ,oBAAa;IAC5C,MAAM,CAAoB;IACnC,YAAY,OAAe,EAAE,MAAyB;QACpD,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,OAAO,uCAAuC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACtG,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAPD,oDAOC;AAsDD;;;;;;;GAOG;AACH,MAAa,eAAe;IACjB,CAAC,CAAS;IACnB,gGAAgG;IACvF,WAAW,CAAW;IAC/B,+GAA+G;IAC9F,SAAS,CAAa;IACvC,iGAAiG;IAChF,MAAM,CAAe;IACtC,yEAAyE;IACxD,MAAM,CAAW;IAClC,iDAAiD;IACxC,OAAO,CAAS;IACR,iBAAiB,CAAS;IAC1B,GAAG,CAAW;IACd,IAAI,CAAS;IAC9B,mGAAmG;IAClF,aAAa,CAAU;IACxC,iGAAiG;IAChF,QAAQ,GAAG,IAAI,GAAG,EAAqB,CAAC;IACzD,6FAA6F;IAC5E,WAAW,CAAU;IACtC,kFAAkF;IACjE,SAAS,CAAoB;IAC9C,mGAAmG;IAC3F,eAAe,GAAG,CAAC,CAAC;IAC5B,oGAAoG;IAC5F,GAAG,GAAsB,IAAI,CAAC;IAC9B,MAAM,GAAmB,EAAE,CAAC;IAEpC,YAAY,CAAS,EAAE,IAAa,EAAE,OAAwB,EAAE;QAC9D,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACpG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACX,mGAAmG;QACnG,uGAAuG;QACvG,IAAI,CAAC,aAAa,GAAG,IAAI,KAAK,SAAS,CAAC;QACxC,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,cAAc,CAAC;QACnC,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,gBAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,uBAAc,EAAE,CAAC;QAC/E,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC;QAC1C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAChC,oGAAoG;QACpG,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,IAAI,eAAQ,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QAChI,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,cAAQ,CAAC;QACxC,IAAI,CAAC,MAAM,GAAG,IAAA,gBAAU,EAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,aAAa,KAAK,IAAI,CAAC,CAAC;QAC3F,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,IAAA,eAAS,EAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACpH,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QACnE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAE,CAAC;QACtC,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,iBAAiB,IAAI,yBAAkB,CAAC;QACtE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,IAAI,CAAC,iBAAiB,GAAG,CAAC,IAAI,IAAI,CAAC,iBAAiB,GAAG,CAAC,EAAE,CAAC;YAC1G,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,IAAI,UAAU;QACZ,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;YACzC,IAAI,KAAK,GAAG,EAAE,CAAC;YACf,KAAK,MAAM,EAAE,IAAI,MAAM;gBAAE,KAAK,GAAG,IAAA,YAAI,EAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACjD,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC;QAChD,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,CAAE,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,CAAC;IAEO,OAAO,CAAC,CAAS,EAAE,CAAS;QAClC,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,IAAI,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,iGAAiG;YACjG,MAAM,KAAK,GAAa,IAAI,CAAC,aAAa;gBACxC,CAAC,CAAC,IAAA,aAAQ,EAAC,IAAA,eAAU,EAAC,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC;gBACtG,CAAC,CAAC,IAAA,uBAAc,GAAE,CAAC;YACrB,EAAE,GAAG,IAAI,cAAS,CAAC,KAAK,CAAC,CAAC;YAC1B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED;;;;OAIG;IACK,WAAW,CAAC,KAAa;QAC/B,KAAK,KAAK,CAAC;QACX,OAAO,IAAA,eAAS,EAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1C,CAAC;IAED;;;;;;;;;;;OAWG;IACK,QAAQ,CAAC,IAA4E;QAE3F,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;QACjB,KAAK,MAAM,CAAC,IAAI,IAAI;YAAE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACjH,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC5B,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAoC,EAAE;YAC/C,IAAI,OAAO,EAAE,KAAK,QAAQ;gBAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;YACrG,MAAM,CAAC,GAAG,IAAA,WAAG,EAAC,EAAE,CAAC,CAAC;YAClB,MAAM,CAAC,GAAG,IAAA,eAAS,EAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;YAC3C,MAAM,CAAC,GAAG,IAAA,gBAAU,EAAC,IAAA,YAAI,EAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;YACvC,OAAO;gBACL,KAAK,EAAE,CAAC;gBACR,KAAK,EAAE;oBACL,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE;oBAClC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,kBAAY,EAAE;iBACpC;aACF,CAAC;QACJ,CAAC,CAAC,CACH,CAAC;QACF,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAA,YAAI,EAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,CAAC,2BAA2B;QAC3G,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC3B,IAAI,CAAC,KAAK,CAAC;oBAAE,SAAS;gBACtB,IAAI,IAAI,GAAG,CAAC,CAAC;gBACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE;oBAAE,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC,CAAE,CAAC,KAAK;wBAAE,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;gBACxG,MAAM,IAAI,GAAa,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC;gBACvC,MAAM,IAAI,GAAa,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC;gBACvC,MAAM,IAAI,GAAa,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC;gBACvC,MAAM,IAAI,GAAwE,EAAE,CAAC;gBACrF,IAAI,EAAE,GAAG,CAAC,CAAC;gBACX,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;oBACrC,MAAM,CAAC,GAAG,IAAA,WAAG,EAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;oBAC9B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC,CAAE,CAAC,KAAK,EAAE,CAAC;wBACxC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;wBAC7B,IAAI,SAAS,GAAG,EAAE,CAAC,CAAC,QAAQ;wBAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;4BAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;4BAC5B,SAAS,GAAG,IAAA,YAAI,EAAC,SAAS,EAAE,GAAG,CAAC,CAAC;4BACjC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC;4BAC7B,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC;4BACnB,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,IAAA,YAAI,EAAC,GAAG,EAAE,IAAA,YAAI,EAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,CAAC,CAAC;wBAClD,CAAC;wBACD,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;wBAC5C,EAAE,IAAI,GAAG,CAAC;oBACZ,CAAC;gBACH,CAAC;gBACD,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;gBACjE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;gBACjE,KAAK,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC;oBACtB,IAAI,WAAW,GAAG,EAAE,CAAC,CAAC,uBAAuB;oBAC7C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE;wBAAE,WAAW,GAAG,IAAA,YAAI,EAAC,WAAW,EAAE,IAAA,WAAG,EAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,GAAG,CAAC,CAAE,CAAC,CAAC,CAAC;oBAC/F,oFAAoF;oBACpF,CAAC,CAAC,EAAE,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,GAAG,IAAA,YAAI,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAE,CAAC,CAAC,CAAE,EAAE,WAAW,CAAC,CAAC;oBAC9C,CAAC,CAAC,EAAE,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,GAAG,IAAA,YAAI,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAE,CAAC,CAAC,CAAE,EAAE,IAAA,YAAI,EAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;gBACvD,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,kEAAkE;IAClE,eAAe,CAAC,CAAmC,EAAE,CAAc;QACjE,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC;IACvC,CAAC;IAED,yHAAyH;IACjH,YAAY,CAAC,WAAwB;QAC3C,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/G,CAAC;IAEO,MAAM,CAAC,KAAkB,EAAE,IAAmB;QACpD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3D,CAAC;IAED,sHAAsH;IAC9G,YAAY,CAAC,OAAoB;QACvC,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC;QAC3B,IAAI,GAAG,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG;YAAE,CAAC,CAAC,CAAC,CAAC,GAAG,IAAA,YAAI,EAAC,CAAC,CAAC,CAAC,CAAE,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QACjE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAC1C,OAAO,CAAC,CAAC;IACX,CAAC;IAED;;;;OAIG;IACK,qBAAqB,CAAC,QAAgB;QAC5C,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;QACjB,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;QAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;QACtE,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACjE,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/G,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1D,MAAM,IAAI,GAAmE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QACvG,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,EAAE,CAAC,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAE,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAC3E,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC;QAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAE,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3C,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAE,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;YAC9C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,EAAE,CAAC,EAAE;gBAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAE,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAE,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC,CAAC,CAAC;QAC3F,MAAM,GAAG,GAAG,CAAC,GAAG,QAAQ,CAAC;QACzB,MAAM,KAAK,GAAG,CAAC,GAAW,EAAiB,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,GAAG,CAAC,GAAG,GAAG,GAAG,GAAG,CAAE,CAAC,CAAC;QACjH,MAAM,KAAK,GAAmE,EAAE,CAAC;QACjF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAE,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;YAC/C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,EAAE,CAAC,EAAE;gBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAE,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,IAAI,GAAG,CAAC,GAAG,QAAQ,CAAC;QAC1B,MAAM,MAAM,GAAG,CAAC,GAAW,EAAiB,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,GAAG,GAAG,CAAE,CAAC,CAAC;QACxG,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACzC,MAAM,IAAI,GAAe,EAAE,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnG,MAAM,KAAK,GAAiB,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACtE,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACvC,CAAC;YACD,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAE,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;SAC5C,CAAC,CAAC,CAAC;QACJ,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACnC,CAAC;IAED,8GAA8G;IACtG,SAAS,CAAC,KAAoB;QACpC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;QACjC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC;YAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC3C,MAAM,GAAG,GAAG,IAAA,WAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC;gBAChC,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC3C,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,sDAAsD;oBAC5E,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAC5B,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;gBACzB,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;oBAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,+DAA+D;YACxG,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,oBAAoB,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACpF,CAAC;IAED;;;;;;;;OAQG;IACH,aAAa;QACX,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACjE,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC;QACd,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;QACjB,IAAI,CAAC;YACH,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YAC9E,yGAAyG;YACzG,OAAO,IAAA,sBAAe,EAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;QAC9E,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,oBAAa;gBAAE,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YACxD,MAAM,CAAC,CAAC;QACV,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC;YAChB,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;QACnB,CAAC;IACH,CAAC;IAED,+FAA+F;IAC/F,cAAc,CAAC,KAAa;QAC1B,MAAM,GAAG,GAAiB,EAAE,CAAC;QAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE;YAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;QAC/D,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;OAKG;IACH,SAAS,CAAC,KAAa,EAAE,KAAa;QACpC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACnF,MAAM,WAAW,GAAG,IAAA,eAAK,EAAC,IAAA,WAAG,EAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QACxD,OAAO,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;IACxC,CAAC;IAED;;;;;;;;;;;OAWG;IACH,qBAAqB,CAAC,MAA6B;QACjD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAChC,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;YACzB,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,EAAE,CAAC;gBAC7D,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC;QAC5B,MAAM,MAAM,GAAG,IAAI,iBAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACvC,kFAAkF;QAClF,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACtE,IAAI,CAAC,GAAW,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAC3C,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;YACzB,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,4BAA4B;YACrD,IAAI,CAAC,KAAK,EAAE;gBAAE,CAAC,GAAG,EAAE,CAAC,CAAC,uEAAuE;YAC7F,CAAC,GAAG,IAAA,cAAO,EAAC,CAAC,EAAE,IAAA,gBAAS,EAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;QAChC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,yEAAyE;IACtG,CAAC;CACF;AAxUD,0CAwUC;AAcD,kGAAkG;AAClG,SAAgB,mBAAmB,CACjC,CAAS,EACT,IAAa,EACb,IAAsB;IAEtB,OAAO,IAAI,eAAe,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAC5C,CAAC"}

package/dist/net/certs.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Per-run identity material for the TLS mesh: one fresh P-256 key + self-signed certificate per node,
+ * generated with the vetted `openssl` CLI (no hand-rolled crypto, no X.509 code of our own). The keys
+ * live only on the node that generated them; only the PUBLIC certificates are exchanged and pinned.
+ */
+export interface NodeIdentity {
+    keyPath: string;
+    certPath: string;
+}
+/** Generate `<dir>/key.pem` + `<dir>/cert.pem` for `cn` (valid 2 days: per-run, throw-away). */
+export declare function generateIdentity(dir: string, cn: string, openssl?: string): NodeIdentity;
+/** SHA-256 fingerprint (colon-hex, as Node reports it) of a PEM certificate. */
+export declare function fingerprintOf(certPem: string): string;
+export declare const readPem: (p: string) => string;

package/dist/net/certs.js

@@ -0,0 +1,30 @@
+"use strict";
+/**
+ * Per-run identity material for the TLS mesh: one fresh P-256 key + self-signed certificate per node,
+ * generated with the vetted `openssl` CLI (no hand-rolled crypto, no X.509 code of our own). The keys
+ * live only on the node that generated them; only the PUBLIC certificates are exchanged and pinned.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readPem = void 0;
+exports.generateIdentity = generateIdentity;
+exports.fingerprintOf = fingerprintOf;
+const node_child_process_1 = require("node:child_process");
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+/** Generate `<dir>/key.pem` + `<dir>/cert.pem` for `cn` (valid 2 days: per-run, throw-away). */
+function generateIdentity(dir, cn, openssl = 'openssl') {
+    (0, node_fs_1.mkdirSync)(dir, { recursive: true, mode: 0o700 });
+    const keyPath = (0, node_path_1.join)(dir, 'key.pem');
+    const certPath = (0, node_path_1.join)(dir, 'cert.pem');
+    (0, node_child_process_1.execFileSync)(openssl, ['ecparam', '-name', 'prime256v1', '-genkey', '-noout', '-out', keyPath], { stdio: 'pipe' });
+    (0, node_child_process_1.execFileSync)(openssl, ['req', '-new', '-x509', '-key', keyPath, '-subj', `/CN=${cn}`, '-days', '2', '-out', certPath, '-sha256'], { stdio: 'pipe' });
+    return { keyPath, certPath };
+}
+/** SHA-256 fingerprint (colon-hex, as Node reports it) of a PEM certificate. */
+function fingerprintOf(certPem) {
+    return new node_crypto_1.X509Certificate(certPem).fingerprint256;
+}
+const readPem = (p) => (0, node_fs_1.readFileSync)(p, 'utf8');
+exports.readPem = readPem;
+//# sourceMappingURL=certs.js.map

package/dist/net/certs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"certs.js","sourceRoot":"","sources":["../../src/net/certs.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAaH,4CAWC;AAGD,sCAEC;AA3BD,2DAAkD;AAClD,6CAA8C;AAC9C,qCAAkD;AAClD,yCAAiC;AAOjC,gGAAgG;AAChG,SAAgB,gBAAgB,CAAC,GAAW,EAAE,EAAU,EAAE,OAAO,GAAG,SAAS;IAC3E,IAAA,mBAAS,EAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,IAAA,gBAAI,EAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,IAAA,gBAAI,EAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACvC,IAAA,iCAAY,EAAC,OAAO,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IACnH,IAAA,iCAAY,EACV,OAAO,EACP,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,EAC1G,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AAC/B,CAAC;AAED,gFAAgF;AAChF,SAAgB,aAAa,CAAC,OAAe;IAC3C,OAAO,IAAI,6BAAe,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC;AACrD,CAAC;AAEM,MAAM,OAAO,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,IAAA,sBAAY,EAAC,CAAC,EAAE,MAAM,CAAC,CAAC;AAAzD,QAAA,OAAO,WAAkD"}

package/dist/net/faults.d.ts

@@ -0,0 +1,49 @@
+/**
+ * TEST-ONLY fault injection for the networked MPC.
+ *
+ * Two layers, deliberately separate:
+ *  - `tamperFor(spec)`: a MALICIOUS SENDER rewriting its own outgoing frames at the application layer
+ *    (duplicate, reorder, skipped sequence, garbage, truncation, wrong round/session, oversize length,
+ *    drop, silence). The bytes still travel inside valid TLS, so the receiver's framing checks decide.
+ *  - `FaultProxy`: a NETWORK adversary on the wire (TCP middlebox): drop / delay / truncate / bit-flip /
+ *    duplicate / reorder at the byte level. TLS 1.3 record authentication rejects tampering, so the
+ *    expected outcome is an attributable-to-the-link `disconnect`, never a silently corrupted value.
+ */
+import type { TamperEvent } from './mesh';
+export type FrameFaultKind = 'duplicate' | 'reorder' | 'skip-seq' | 'garbage' | 'truncate' | 'bitflip' | 'wrong-round' | 'wrong-session' | 'oversize' | 'drop' | 'silent-from' | 'extra-field' | 'false-accuse';
+export interface FrameFault {
+    kind: FrameFaultKind;
+    /** Protocol round to attack (e.g. 'mul0'). */
+    round: string;
+    /** Restrict to one recipient; default: all recipients. */
+    to?: number;
+    /** For `false-accuse`: the (honest) party the malicious sender names in its forged abort frame. */
+    accuse?: number;
+}
+export declare function tamperFor(spec: FrameFault): (ev: TamperEvent) => Buffer[];
+export type WireFaultKind = 'none' | 'drop' | 'delay' | 'truncate' | 'bitflip' | 'duplicate' | 'reorder';
+export interface WireFault {
+    kind: WireFaultKind;
+    /** Which direction through the proxy: client->server ('c2s') or server->client ('s2c'). */
+    dir: 'c2s' | 's2c';
+    /** Fault starts after this many bytes have passed in that direction (skips the TLS handshake). */
+    afterBytes: number;
+    /** delay milliseconds (kind=delay). */
+    ms?: number;
+}
+/** A transparent TCP proxy that misbehaves once, after `afterBytes` bytes, in one direction. */
+export declare class FaultProxy {
+    readonly listenPort: number;
+    private readonly target;
+    private readonly fault;
+    private server;
+    readonly log: string[];
+    constructor(listenPort: number, target: {
+        host: string;
+        port: number;
+    }, fault: WireFault);
+    listen(): Promise<void>;
+    close(): void;
+    private onClient;
+    private pipe;
+}