@atlasauth/pca-ratchet 0.0.0-stage → 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Atlas Authorization
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,57 @@
-# Temporary Holding Version
+# @atlasauth/pca-ratchet
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+The PCA Capability Ratchet: two cryptographic primitives that replace bookkeeping in Proof-Carrying Authority with math.
+
+1. **Puncturable forward-secure capability keys.** A GGM puncturable-PRF tree of one-time Ed25519 leaf keys under a Merkle-root commitment. Signing at a leaf permanently punctures it, so a spent action can never be re-signed (cryptographic one-time-use instead of a server-side counter check).
+2. **Homomorphic risk accumulator.** Pedersen commitments on ristretto255 plus a zero-knowledge range proof that the committed total risk stays at or under a budget ceiling, without revealing individual risks.
+
+Small adapters map a PCActn `counter` to a leaf index and core risk scores to accumulator units.
+
+## Install
+
+```sh
+npm i @atlasauth/pca-ratchet @atlasauth/pca
+```
+
+## Usage
+
+```ts
+import {
+  deriveRatchetRoot, signAtLeaf, verifyLeafSignature, isLeafAvailable,
+  commitRisk, addCommitments, proveBudget, verifyBudget,
+  counterToLeafIndex, riskToUnits,
+} from '@atlasauth/pca-ratchet';
+
+// 1. One-time-use keys: 2^4 = 16 leaves under one root commitment.
+const seed = crypto.getRandomValues(new Uint8Array(32));
+const { rootCommitment, state } = deriveRatchetRoot(seed, 4);
+
+const msg = new TextEncoder().encode('transfer 10 USDC');
+const leaf = counterToLeafIndex(3, 4);
+const { signature, newState } = signAtLeaf(state, leaf, msg); // state is immutable; keep newState
+verifyLeafSignature(rootCommitment, leaf, msg, signature);    // true (offline, root only)
+isLeafAvailable(newState, leaf);                              // false
+signAtLeaf(newState, leaf, msg);                              // throws RatchetError code 'leaf_punctured'
+
+// 2. Budget proof: total risk <= 1000 units, individual risks hidden.
+const risks = [riskToUnits(0.2), riskToUnits(0.35)];
+const commits = risks.map((r) => commitRisk(r));
+const sum = addCommitments(commits.map((c) => c.commitment));
+const proof = proveBudget(risks, commits.map((c) => c.blinding), 1000);
+verifyBudget(sum, 1000, proof); // true
+verifyBudget(sum, 500, proof);  // false
+```
+
+## API
+
+- Ratchet: `deriveRatchetRoot`, `signAtLeaf`, `verifyLeafSignature`, `availableLeaves`, `isLeafAvailable`, `RatchetError`, `MAX_RATCHET_DEPTH`.
+- Accumulator: `commitRisk`, `addCommitments`, `openCommitment`, `proveBudget`, `verifyBudget`, `AccumulatorError`, `N_BITS`.
+- Adapters: `counterToLeafIndex`, `leafIndexToCounter`, `leafIndexForAction`, `riskToUnits`, `budgetCeilingUnits`, `RISK_SCALE`.
+
+## Status
+
+Experimental. The cryptography here (GGM tree, Pedersen commitments, bit-decomposition range proof) is original and has **not** been independently audited; do not rely on it as the sole control for high-value actions. One-time-use holds only for the holder of the `RatchetState`: if a state is copied or restored from an old backup, spent leaves are available again, so persist the latest state atomically.
+
+## License
+
+MIT - see LICENSE

package/dist/accumulator.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Mechanism 2 — Homomorphic risk accumulator with a zero-knowledge spend ceiling.
+ *
+ * Risk is carried as a Pedersen commitment on ristretto255:
+ *
+ *   C = risk·G + blinding·H
+ *
+ * Commitments add homomorphically, so Σ commitments commits to (Σrisk, Σblinding). A compact
+ * bit-decomposition range proof then shows the aggregate satisfies the control-theoretic budget
+ * bound Σrisk ≤ bMax WITHOUT revealing the individual risks: it proves the slack
+ * (bMax − Σrisk) lies in [0, 2^N) using a Fiat-Shamir OR Sigma-protocol per bit plus a Schnorr
+ * proof that the bit-commitments aggregate to the slack commitment.
+ *
+ * Soundness rests on the hardness of discrete log between G and H (standard Pedersen binding):
+ * a prover who could pass the aggregation check for an over-budget aggregate, or open a bit to a
+ * value outside {0,1}, would have computed dlog_H(G).
+ */
+/** Range-proof bit length: the slack (bMax − Σrisk) must lie in [0, 2^32). */
+export declare const N_BITS = 32;
+export type RiskUnits = number | bigint;
+export type AccumulatorErrorCode = 'invalid_value' | 'length_mismatch' | 'invalid_proof_shape';
+export declare class AccumulatorError extends Error {
+    readonly code: AccumulatorErrorCode;
+    constructor(code: AccumulatorErrorCode, message: string);
+}
+export interface RiskCommitment {
+    /** b64u ristretto255 point C = risk·G + blinding·H. */
+    commitment: string;
+    /** The blinding scalar (needed to open the commitment or to build a budget proof). */
+    blinding: bigint;
+}
+/** A Fiat-Shamir OR proof that one bit commitment opens to 0 or 1 (challenges/responses per branch). */
+export interface BitOrProof {
+    e0: string;
+    e1: string;
+    z0: string;
+    z1: string;
+}
+/** A Schnorr proof of knowledge of a discrete log w.r.t. H. */
+export interface SchnorrProof {
+    a: string;
+    z: string;
+}
+export interface BudgetProof {
+    /** Bit length of the range (= N_BITS). */
+    n: number;
+    /** b64u commitments to each bit of the slack value. */
+    bitCommitments: string[];
+    /** Per-bit OR proofs that each bit commitment opens to 0 or 1. */
+    or: BitOrProof[];
+    /** Schnorr proof that Σ 2^i·bitCommitment_i equals the slack commitment (bits aggregate correctly). */
+    agg: SchnorrProof;
+}
+/** Commit to a non-negative integer `risk` in units, with a given or fresh random `blinding`. */
+export declare function commitRisk(risk: RiskUnits, blinding?: bigint): RiskCommitment;
+/** Homomorphic sum: a commitment to (Σrisk, Σblinding). Empty input commits to (0, 0) = identity. */
+export declare function addCommitments(commitments: readonly string[]): string;
+/** Check that `commitment` opens to (`risk`, `blinding`). Never throws; malformed input is false. */
+export declare function openCommitment(commitment: string, risk: RiskUnits, blinding: bigint): boolean;
+/**
+ * Prove that the committed aggregate satisfies Σrisk ≤ bMax, in zero knowledge over the individual
+ * risks. `risks`/`blindings` are the same per-action values used to build the commitments whose sum
+ * is passed to {@link verifyBudget}. If the aggregate is over budget (or the slack does not fit in
+ * N_BITS), the returned proof is well-formed but will be REJECTED by the verifier — soundness lives
+ * in verification, not in the prover trusting its own inputs.
+ */
+export declare function proveBudget(risks: readonly RiskUnits[], blindings: readonly bigint[], bMax: RiskUnits): BudgetProof;
+/**
+ * Verify a budget proof against the commitment sum and ceiling. Returns true only if every bit
+ * commitment opens to 0/1 and they aggregate to the slack commitment bMax·G − commitmentSum — i.e.
+ * Σrisk ≤ bMax. Learns nothing about the individual risks. Never throws; malformed input is false.
+ */
+export declare function verifyBudget(commitmentSum: string, bMax: RiskUnits, proof: BudgetProof): boolean;

package/dist/accumulator.js

@@ -0,0 +1,231 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AccumulatorError = exports.N_BITS = void 0;
+exports.commitRisk = commitRisk;
+exports.addCommitments = addCommitments;
+exports.openCommitment = openCommitment;
+exports.proveBudget = proveBudget;
+exports.verifyBudget = verifyBudget;
+const group_1 = require("./group");
+/**
+ * Mechanism 2 — Homomorphic risk accumulator with a zero-knowledge spend ceiling.
+ *
+ * Risk is carried as a Pedersen commitment on ristretto255:
+ *
+ *   C = risk·G + blinding·H
+ *
+ * Commitments add homomorphically, so Σ commitments commits to (Σrisk, Σblinding). A compact
+ * bit-decomposition range proof then shows the aggregate satisfies the control-theoretic budget
+ * bound Σrisk ≤ bMax WITHOUT revealing the individual risks: it proves the slack
+ * (bMax − Σrisk) lies in [0, 2^N) using a Fiat-Shamir OR Sigma-protocol per bit plus a Schnorr
+ * proof that the bit-commitments aggregate to the slack commitment.
+ *
+ * Soundness rests on the hardness of discrete log between G and H (standard Pedersen binding):
+ * a prover who could pass the aggregation check for an over-budget aggregate, or open a bit to a
+ * value outside {0,1}, would have computed dlog_H(G).
+ */
+/** Range-proof bit length: the slack (bMax − Σrisk) must lie in [0, 2^32). */
+exports.N_BITS = 32;
+class AccumulatorError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = 'AccumulatorError';
+        this.code = code;
+    }
+}
+exports.AccumulatorError = AccumulatorError;
+function asUnits(x) {
+    if (typeof x === 'bigint') {
+        if (x < 0n)
+            throw new AccumulatorError('invalid_value', 'risk/budget must be >= 0');
+        return x;
+    }
+    if (!Number.isInteger(x) || x < 0) {
+        throw new AccumulatorError('invalid_value', 'risk/budget must be a non-negative integer');
+    }
+    return BigInt(x);
+}
+/** Commit to a non-negative integer `risk` in units, with a given or fresh random `blinding`. */
+function commitRisk(risk, blinding) {
+    const v = asUnits(risk);
+    const b = blinding === undefined ? (0, group_1.randScalar)() : (0, group_1.mod)(blinding);
+    const C = (0, group_1.add)((0, group_1.mul)(group_1.G, v), (0, group_1.mul)(group_1.H, b));
+    return { commitment: (0, group_1.encodePoint)(C), blinding: b };
+}
+/** Homomorphic sum: a commitment to (Σrisk, Σblinding). Empty input commits to (0, 0) = identity. */
+function addCommitments(commitments) {
+    let acc = (0, group_1.mul)(group_1.G, 0n); // identity
+    for (const c of commitments)
+        acc = (0, group_1.add)(acc, (0, group_1.decodePoint)(c));
+    return (0, group_1.encodePoint)(acc);
+}
+/** Check that `commitment` opens to (`risk`, `blinding`). Never throws; malformed input is false. */
+function openCommitment(commitment, risk, blinding) {
+    try {
+        const v = asUnits(risk);
+        const expected = (0, group_1.add)((0, group_1.mul)(group_1.G, v), (0, group_1.mul)(group_1.H, (0, group_1.mod)(blinding)));
+        return (0, group_1.decodePoint)(commitment).equals(expected);
+    }
+    catch {
+        return false;
+    }
+}
+// ---- range proof ----------------------------------------------------------------------
+const CTX_DOMAIN = (0, group_1.utf8)('atlas-pca-ratchet/budget/ctx/v1');
+const OR_DOMAIN = (0, group_1.utf8)('atlas-pca-ratchet/budget/bit-or/v1');
+const AGG_DOMAIN = (0, group_1.utf8)('atlas-pca-ratchet/budget/agg/v1');
+/** The transcript context that binds every challenge to the exact public statement. */
+function contextHash(n, bMaxUnits, commitmentSum, bitCommitments) {
+    const parts = [
+        CTX_DOMAIN,
+        Uint8Array.of(n & 0xff),
+        (0, group_1.numberToBytesLE)((0, group_1.mod)(bMaxUnits), 32),
+        commitmentSum.toRawBytes(),
+    ];
+    for (const B of bitCommitments)
+        parts.push(B.toRawBytes());
+    // Reuse hashToScalar's length-prefixed framing, then serialize the scalar back to 32 bytes.
+    return (0, group_1.numberToBytesLE)((0, group_1.hashToScalar)(parts), 32);
+}
+/** Prove bit commitment `B` (= b·G + s·H) opens to 0 or 1, knowing bit `b` and blinding `s`. */
+function proveBit(ctx, index, B, b, s) {
+    const P0 = B; // commitment to 0 under H  => B = s·H
+    const P1 = (0, group_1.sub)(B, group_1.G); // commitment to 1 => B − G = s·H
+    const real = b === 1n ? 1 : 0;
+    // Simulate the false branch with a random challenge/response.
+    const eFake = (0, group_1.randScalar)();
+    const zFake = (0, group_1.randScalar)();
+    const Pfake = real === 1 ? P0 : P1;
+    const aFake = (0, group_1.sub)((0, group_1.mul)(group_1.H, zFake), (0, group_1.mul)(Pfake, eFake));
+    // Real branch: honest Schnorr commitment on H.
+    const k = (0, group_1.randScalar)();
+    const aReal = (0, group_1.mul)(group_1.H, k);
+    const a0 = real === 0 ? aReal : aFake;
+    const a1 = real === 1 ? aReal : aFake;
+    const e = (0, group_1.hashToScalar)([OR_DOMAIN, ctx, Uint8Array.of(index & 0xff), a0.toRawBytes(), a1.toRawBytes()]);
+    const eReal = (0, group_1.scalarSub)(e, eFake);
+    const zReal = (0, group_1.scalarAdd)(k, (0, group_1.scalarMul)(eReal, s));
+    const e0 = real === 0 ? eReal : eFake;
+    const e1 = real === 1 ? eReal : eFake;
+    const z0 = real === 0 ? zReal : zFake;
+    const z1 = real === 1 ? zReal : zFake;
+    return { e0: (0, group_1.encodeScalar)(e0), e1: (0, group_1.encodeScalar)(e1), z0: (0, group_1.encodeScalar)(z0), z1: (0, group_1.encodeScalar)(z1) };
+}
+function verifyBit(ctx, index, B, proof) {
+    const e0 = (0, group_1.decodeScalar)(proof.e0);
+    const e1 = (0, group_1.decodeScalar)(proof.e1);
+    const z0 = (0, group_1.decodeScalar)(proof.z0);
+    const z1 = (0, group_1.decodeScalar)(proof.z1);
+    const P0 = B;
+    const P1 = (0, group_1.sub)(B, group_1.G);
+    const a0 = (0, group_1.sub)((0, group_1.mul)(group_1.H, z0), (0, group_1.mul)(P0, e0));
+    const a1 = (0, group_1.sub)((0, group_1.mul)(group_1.H, z1), (0, group_1.mul)(P1, e1));
+    const e = (0, group_1.hashToScalar)([OR_DOMAIN, ctx, Uint8Array.of(index & 0xff), a0.toRawBytes(), a1.toRawBytes()]);
+    return (0, group_1.scalarAdd)(e0, e1) === e;
+}
+/** Schnorr proof of knowledge of `w` with `D = w·H`. */
+function proveSchnorr(ctx, D, w) {
+    const k = (0, group_1.randScalar)();
+    const a = (0, group_1.mul)(group_1.H, k);
+    const e = (0, group_1.hashToScalar)([AGG_DOMAIN, ctx, D.toRawBytes(), a.toRawBytes()]);
+    const z = (0, group_1.scalarAdd)(k, (0, group_1.scalarMul)(e, w));
+    return { a: (0, group_1.encodePoint)(a), z: (0, group_1.encodeScalar)(z) };
+}
+function verifySchnorr(ctx, D, proof) {
+    const a = (0, group_1.decodePoint)(proof.a);
+    const z = (0, group_1.decodeScalar)(proof.z);
+    const e = (0, group_1.hashToScalar)([AGG_DOMAIN, ctx, D.toRawBytes(), a.toRawBytes()]);
+    return (0, group_1.mul)(group_1.H, z).equals((0, group_1.add)(a, (0, group_1.mul)(D, e)));
+}
+/**
+ * Prove that the committed aggregate satisfies Σrisk ≤ bMax, in zero knowledge over the individual
+ * risks. `risks`/`blindings` are the same per-action values used to build the commitments whose sum
+ * is passed to {@link verifyBudget}. If the aggregate is over budget (or the slack does not fit in
+ * N_BITS), the returned proof is well-formed but will be REJECTED by the verifier — soundness lives
+ * in verification, not in the prover trusting its own inputs.
+ */
+function proveBudget(risks, blindings, bMax) {
+    if (risks.length !== blindings.length) {
+        throw new AccumulatorError('length_mismatch', 'risks and blindings must have equal length');
+    }
+    const bMaxUnits = asUnits(bMax);
+    let sumRisk = 0n;
+    let sumBlind = 0n;
+    for (let i = 0; i < risks.length; i++) {
+        sumRisk += asUnits(risks[i] ?? 0n);
+        sumBlind = (0, group_1.scalarAdd)(sumBlind, blindings[i] ?? 0n);
+    }
+    // Commitment sum (= what the verifier is given) and the slack commitment V = bMax·G − C_sum.
+    const cSum = (0, group_1.add)((0, group_1.mul)(group_1.G, (0, group_1.mod)(sumRisk)), (0, group_1.mul)(group_1.H, sumBlind));
+    const gamma = (0, group_1.mod)(-sumBlind); // blinding of V
+    const v = bMaxUnits - sumRisk; // slack (may be negative if over budget)
+    const mask = (1n << BigInt(exports.N_BITS)) - 1n;
+    const vMasked = v & mask; // low N_BITS bits (correct two's-complement low bits even if v < 0)
+    const bitCommitments = [];
+    const bitBlindings = [];
+    const bits = [];
+    for (let i = 0; i < exports.N_BITS; i++) {
+        const bit = (vMasked >> BigInt(i)) & 1n;
+        const s = (0, group_1.randScalar)();
+        bits.push(bit);
+        bitBlindings.push(s);
+        bitCommitments.push((0, group_1.add)((0, group_1.mul)(group_1.G, bit), (0, group_1.mul)(group_1.H, s)));
+    }
+    const ctx = contextHash(exports.N_BITS, bMaxUnits, cSum, bitCommitments);
+    const or = [];
+    for (let i = 0; i < exports.N_BITS; i++) {
+        or.push(proveBit(ctx, i, bitCommitments[i], bits[i], bitBlindings[i]));
+    }
+    // Aggregation: Σ 2^i·B_i = (Σ 2^i·b_i)·G + (Σ 2^i·s_i)·H = v'·G + sStar·H. When v' = v (in range),
+    // D = Σ2^i·B_i − V = (sStar − gamma)·H, a pure H-multiple whose dlog the prover knows.
+    let sStar = 0n;
+    let aggPoint = (0, group_1.mul)(group_1.G, 0n);
+    for (let i = 0; i < exports.N_BITS; i++) {
+        const w = 1n << BigInt(i);
+        sStar = (0, group_1.scalarAdd)(sStar, (0, group_1.scalarMul)(w, bitBlindings[i]));
+        aggPoint = (0, group_1.add)(aggPoint, (0, group_1.mul)(bitCommitments[i], w));
+    }
+    const V = (0, group_1.sub)((0, group_1.mul)(group_1.G, (0, group_1.mod)(bMaxUnits)), cSum);
+    const D = (0, group_1.sub)(aggPoint, V);
+    const delta = (0, group_1.scalarSub)(sStar, gamma);
+    const agg = proveSchnorr(ctx, D, delta);
+    return { n: exports.N_BITS, bitCommitments: bitCommitments.map(group_1.encodePoint), or, agg };
+}
+/**
+ * Verify a budget proof against the commitment sum and ceiling. Returns true only if every bit
+ * commitment opens to 0/1 and they aggregate to the slack commitment bMax·G − commitmentSum — i.e.
+ * Σrisk ≤ bMax. Learns nothing about the individual risks. Never throws; malformed input is false.
+ */
+function verifyBudget(commitmentSum, bMax, proof) {
+    try {
+        if (proof === null || typeof proof !== 'object')
+            return false;
+        const { n, bitCommitments, or, agg } = proof;
+        if (n !== exports.N_BITS || !Array.isArray(bitCommitments) || !Array.isArray(or))
+            return false;
+        if (bitCommitments.length !== exports.N_BITS || or.length !== exports.N_BITS)
+            return false;
+        if (agg === null || typeof agg !== 'object')
+            return false;
+        const bMaxUnits = asUnits(bMax);
+        const cSum = (0, group_1.decodePoint)(commitmentSum);
+        const B = bitCommitments.map(group_1.decodePoint);
+        const ctx = contextHash(exports.N_BITS, bMaxUnits, cSum, B);
+        for (let i = 0; i < exports.N_BITS; i++) {
+            if (!verifyBit(ctx, i, B[i], or[i]))
+                return false;
+        }
+        let aggPoint = (0, group_1.mul)(group_1.G, 0n);
+        for (let i = 0; i < exports.N_BITS; i++) {
+            aggPoint = (0, group_1.add)(aggPoint, (0, group_1.mul)(B[i], 1n << BigInt(i)));
+        }
+        const V = (0, group_1.sub)((0, group_1.mul)(group_1.G, (0, group_1.mod)(bMaxUnits)), cSum);
+        const D = (0, group_1.sub)(aggPoint, V);
+        return verifySchnorr(ctx, D, agg);
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=accumulator.js.map

package/dist/accumulator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"accumulator.js","sourceRoot":"","sources":["../src/accumulator.ts"],"names":[],"mappings":";;;AAmGA,gCAKC;AAGD,wCAIC;AAGD,wCAQC;AAsFD,kCAoDC;AAOD,oCA2BC;AAtSD,mCAmBiB;AAEjB;;;;;;;;;;;;;;;;GAgBG;AAEH,8EAA8E;AACjE,QAAA,MAAM,GAAG,EAAE,CAAC;AAMzB,MAAa,gBAAiB,SAAQ,KAAK;IAChC,IAAI,CAAuB;IACpC,YAAY,IAA0B,EAAE,OAAe;QACrD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAPD,4CAOC;AAkCD,SAAS,OAAO,CAAC,CAAY;IAC3B,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC1B,IAAI,CAAC,GAAG,EAAE;YAAE,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,0BAA0B,CAAC,CAAC;QACpF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,4CAA4C,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;AACnB,CAAC;AAED,iGAAiG;AACjG,SAAgB,UAAU,CAAC,IAAe,EAAE,QAAiB;IAC3D,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,MAAM,CAAC,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAA,kBAAU,GAAE,CAAC,CAAC,CAAC,IAAA,WAAG,EAAC,QAAQ,CAAC,CAAC;IAChE,MAAM,CAAC,GAAG,IAAA,WAAG,EAAC,IAAA,WAAG,EAAC,SAAC,EAAE,CAAC,CAAC,EAAE,IAAA,WAAG,EAAC,SAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACpC,OAAO,EAAE,UAAU,EAAE,IAAA,mBAAW,EAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;AACrD,CAAC;AAED,qGAAqG;AACrG,SAAgB,cAAc,CAAC,WAA8B;IAC3D,IAAI,GAAG,GAAG,IAAA,WAAG,EAAC,SAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW;IACjC,KAAK,MAAM,CAAC,IAAI,WAAW;QAAE,GAAG,GAAG,IAAA,WAAG,EAAC,GAAG,EAAE,IAAA,mBAAW,EAAC,CAAC,CAAC,CAAC,CAAC;IAC5D,OAAO,IAAA,mBAAW,EAAC,GAAG,CAAC,CAAC;AAC1B,CAAC;AAED,qGAAqG;AACrG,SAAgB,cAAc,CAAC,UAAkB,EAAE,IAAe,EAAE,QAAgB;IAClF,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QACxB,MAAM,QAAQ,GAAG,IAAA,WAAG,EAAC,IAAA,WAAG,EAAC,SAAC,EAAE,CAAC,CAAC,EAAE,IAAA,WAAG,EAAC,SAAC,EAAE,IAAA,WAAG,EAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QACvD,OAAO,IAAA,mBAAW,EAAC,UAAU,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,0FAA0F;AAE1F,MAAM,UAAU,GAAG,IAAA,YAAI,EAAC,iCAAiC,CAAC,CAAC;AAC3D,MAAM,SAAS,GAAG,IAAA,YAAI,EAAC,oCAAoC,CAAC,CAAC;AAC7D,MAAM,UAAU,GAAG,IAAA,YAAI,EAAC,iCAAiC,CAAC,CAAC;AAE3D,uFAAuF;AACvF,SAAS,WAAW,CAAC,CAAS,EAAE,SAAiB,EAAE,aAAoB,EAAE,cAAuB;IAC9F,MAAM,KAAK,GAAiB;QAC1B,UAAU;QACV,UAAU,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;QACvB,IAAA,uBAAe,EAAC,IAAA,WAAG,EAAC,SAAS,CAAC,EAAE,EAAE,CAAC;QACnC,aAAa,CAAC,UAAU,EAAE;KAC3B,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,cAAc;QAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;IAC3D,4FAA4F;IAC5F,OAAO,IAAA,uBAAe,EAAC,IAAA,oBAAY,EAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;AAClD,CAAC;AAED,gGAAgG;AAChG,SAAS,QAAQ,CAAC,GAAe,EAAE,KAAa,EAAE,CAAQ,EAAE,CAAS,EAAE,CAAS;IAC9E,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,sCAAsC;IACpD,MAAM,EAAE,GAAG,IAAA,WAAG,EAAC,CAAC,EAAE,SAAC,CAAC,CAAC,CAAC,iCAAiC;IACvD,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAE9B,8DAA8D;IAC9D,MAAM,KAAK,GAAG,IAAA,kBAAU,GAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,IAAA,kBAAU,GAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,IAAA,WAAG,EAAC,IAAA,WAAG,EAAC,SAAC,EAAE,KAAK,CAAC,EAAE,IAAA,WAAG,EAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IAEpD,+CAA+C;IAC/C,MAAM,CAAC,GAAG,IAAA,kBAAU,GAAE,CAAC;IACvB,MAAM,KAAK,GAAG,IAAA,WAAG,EAAC,SAAC,EAAE,CAAC,CAAC,CAAC;IAExB,MAAM,EAAE,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IACtC,MAAM,EAAE,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IACtC,MAAM,CAAC,GAAG,IAAA,oBAAY,EAAC,CAAC,SAAS,EAAE,GAAG,EAAE,UAAU,CAAC,EAAE,CAAC,KAAK,GAAG,IAAI,CAAC,EAAE,EAAE,CAAC,UAAU,EAAE,EAAE,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IACxG,MAAM,KAAK,GAAG,IAAA,iBAAS,EAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,IAAA,iBAAS,EAAC,CAAC,EAAE,IAAA,iBAAS,EAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IAEhD,MAAM,EAAE,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IACtC,MAAM,EAAE,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IACtC,MAAM,EAAE,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IACtC,MAAM,EAAE,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IACtC,OAAO,EAAE,EAAE,EAAE,IAAA,oBAAY,EAAC,EAAE,CAAC,EAAE,EAAE,EAAE,IAAA,oBAAY,EAAC,EAAE,CAAC,EAAE,EAAE,EAAE,IAAA,oBAAY,EAAC,EAAE,CAAC,EAAE,EAAE,EAAE,IAAA,oBAAY,EAAC,EAAE,CAAC,EAAE,CAAC;AACpG,CAAC;AAED,SAAS,SAAS,CAAC,GAAe,EAAE,KAAa,EAAE,CAAQ,EAAE,KAAiB;IAC5E,MAAM,EAAE,GAAG,IAAA,oBAAY,EAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClC,MAAM,EAAE,GAAG,IAAA,oBAAY,EAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClC,MAAM,EAAE,GAAG,IAAA,oBAAY,EAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClC,MAAM,EAAE,GAAG,IAAA,oBAAY,EAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClC,MAAM,EAAE,GAAG,CAAC,CAAC;IACb,MAAM,EAAE,GAAG,IAAA,WAAG,EAAC,CAAC,EAAE,SAAC,CAAC,CAAC;IACrB,MAAM,EAAE,GAAG,IAAA,WAAG,EAAC,IAAA,WAAG,EAAC,SAAC,EAAE,EAAE,CAAC,EAAE,IAAA,WAAG,EAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACxC,MAAM,EAAE,GAAG,IAAA,WAAG,EAAC,IAAA,WAAG,EAAC,SAAC,EAAE,EAAE,CAAC,EAAE,IAAA,WAAG,EAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACxC,MAAM,CAAC,GAAG,IAAA,oBAAY,EAAC,CAAC,SAAS,EAAE,GAAG,EAAE,UAAU,CAAC,EAAE,CAAC,KAAK,GAAG,IAAI,CAAC,EAAE,EAAE,CAAC,UAAU,EAAE,EAAE,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IACxG,OAAO,IAAA,iBAAS,EAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;AACjC,CAAC;AAED,wDAAwD;AACxD,SAAS,YAAY,CAAC,GAAe,EAAE,CAAQ,EAAE,CAAS;IACxD,MAAM,CAAC,GAAG,IAAA,kBAAU,GAAE,CAAC;IACvB,MAAM,CAAC,GAAG,IAAA,WAAG,EAAC,SAAC,EAAE,CAAC,CAAC,CAAC;IACpB,MAAM,CAAC,GAAG,IAAA,oBAAY,EAAC,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IAC1E,MAAM,CAAC,GAAG,IAAA,iBAAS,EAAC,CAAC,EAAE,IAAA,iBAAS,EAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACxC,OAAO,EAAE,CAAC,EAAE,IAAA,mBAAW,EAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAA,oBAAY,EAAC,CAAC,CAAC,EAAE,CAAC;AACnD,CAAC;AAED,SAAS,aAAa,CAAC,GAAe,EAAE,CAAQ,EAAE,KAAmB;IACnE,MAAM,CAAC,GAAG,IAAA,mBAAW,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC/B,MAAM,CAAC,GAAG,IAAA,oBAAY,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAChC,MAAM,CAAC,GAAG,IAAA,oBAAY,EAAC,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IAC1E,OAAO,IAAA,WAAG,EAAC,SAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAA,WAAG,EAAC,CAAC,EAAE,IAAA,WAAG,EAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,WAAW,CAAC,KAA2B,EAAE,SAA4B,EAAE,IAAe;IACpG,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,EAAE,CAAC;QACtC,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,4CAA4C,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,OAAO,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACnC,QAAQ,GAAG,IAAA,iBAAS,EAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACrD,CAAC;IACD,6FAA6F;IAC7F,MAAM,IAAI,GAAG,IAAA,WAAG,EAAC,IAAA,WAAG,EAAC,SAAC,EAAE,IAAA,WAAG,EAAC,OAAO,CAAC,CAAC,EAAE,IAAA,WAAG,EAAC,SAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,IAAA,WAAG,EAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,gBAAgB;IAE9C,MAAM,CAAC,GAAG,SAAS,GAAG,OAAO,CAAC,CAAC,yCAAyC;IACxE,MAAM,IAAI,GAAG,CAAC,EAAE,IAAI,MAAM,CAAC,cAAM,CAAC,CAAC,GAAG,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,oEAAoE;IAE9F,MAAM,cAAc,GAAY,EAAE,CAAC;IACnC,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,cAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,IAAA,kBAAU,GAAE,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACf,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrB,cAAc,CAAC,IAAI,CAAC,IAAA,WAAG,EAAC,IAAA,WAAG,EAAC,SAAC,EAAE,GAAG,CAAC,EAAE,IAAA,WAAG,EAAC,SAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,GAAG,GAAG,WAAW,CAAC,cAAM,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;IAEjE,MAAM,EAAE,GAAiB,EAAE,CAAC;IAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,cAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAChC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,EAAE,cAAc,CAAC,CAAC,CAAE,EAAE,IAAI,CAAC,CAAC,CAAE,EAAE,YAAY,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC;IAC5E,CAAC;IAED,mGAAmG;IACnG,uFAAuF;IACvF,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,IAAI,QAAQ,GAAU,IAAA,WAAG,EAAC,SAAC,EAAE,EAAE,CAAC,CAAC;IACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,cAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAChC,MAAM,CAAC,GAAG,EAAE,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC;QAC1B,KAAK,GAAG,IAAA,iBAAS,EAAC,KAAK,EAAE,IAAA,iBAAS,EAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC;QACzD,QAAQ,GAAG,IAAA,WAAG,EAAC,QAAQ,EAAE,IAAA,WAAG,EAAC,cAAc,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,CAAC,GAAG,IAAA,WAAG,EAAC,IAAA,WAAG,EAAC,SAAC,EAAE,IAAA,WAAG,EAAC,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAC5C,MAAM,CAAC,GAAG,IAAA,WAAG,EAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IAC3B,MAAM,KAAK,GAAG,IAAA,iBAAS,EAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;IAExC,OAAO,EAAE,CAAC,EAAE,cAAM,EAAE,cAAc,EAAE,cAAc,CAAC,GAAG,CAAC,mBAAW,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC;AACjF,CAAC;AAED;;;;GAIG;AACH,SAAgB,YAAY,CAAC,aAAqB,EAAE,IAAe,EAAE,KAAkB;IACrF,IAAI,CAAC;QACH,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC9D,MAAM,EAAE,CAAC,EAAE,cAAc,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;QAC7C,IAAI,CAAC,KAAK,cAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YAAE,OAAO,KAAK,CAAC;QACvF,IAAI,cAAc,CAAC,MAAM,KAAK,cAAM,IAAI,EAAE,CAAC,MAAM,KAAK,cAAM;YAAE,OAAO,KAAK,CAAC;QAC3E,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAE1D,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,IAAI,GAAG,IAAA,mBAAW,EAAC,aAAa,CAAC,CAAC;QACxC,MAAM,CAAC,GAAG,cAAc,CAAC,GAAG,CAAC,mBAAW,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,WAAW,CAAC,cAAM,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAEpD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,cAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAChC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC,CAAE,CAAC;gBAAE,OAAO,KAAK,CAAC;QACtD,CAAC;QAED,IAAI,QAAQ,GAAU,IAAA,WAAG,EAAC,SAAC,EAAE,EAAE,CAAC,CAAC;QACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,cAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAChC,QAAQ,GAAG,IAAA,WAAG,EAAC,QAAQ,EAAE,IAAA,WAAG,EAAC,CAAC,CAAC,CAAC,CAAE,EAAE,EAAE,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,CAAC,GAAG,IAAA,WAAG,EAAC,IAAA,WAAG,EAAC,SAAC,EAAE,IAAA,WAAG,EAAC,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAC5C,MAAM,CAAC,GAAG,IAAA,WAAG,EAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC3B,OAAO,aAAa,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/adapters.d.ts

@@ -0,0 +1,34 @@
+import { type PCActn, type RiskPolicy } from '@atlasauth/pca';
+import { type RiskUnits } from './accumulator';
+/**
+ * Thin adapters that bind the two cryptographic mechanisms to the existing PCA bookkeeping they
+ * replace. These map values only — they do NOT modify any @atlasauth/pca core type.
+ *
+ *  - Mechanism 1 (ratchet)  ↔ the PCActn spend-once `counter`.
+ *  - Mechanism 2 (accumulator) ↔ the control-theoretic risk budget (RiskPolicy.bMax / kappa,
+ *    whose cumulative bound is `safetyBound` = bMax/κ, i.e. Σrisk ≤ bMax/κ).
+ */
+/**
+ * Map a PCActn's spend-once `counter` to a ratchet leaf index. The ratchet replaces the resource
+ * server's monotonic-counter check: spending counter `c` signs (and punctures) leaf `c`, so the
+ * same counter can never be re-used — "already spent" is enforced by the key no longer existing.
+ */
+export declare function counterToLeafIndex(counter: number, depth: number): number;
+/** Inverse of {@link counterToLeafIndex}: a leaf index is the spend-once counter it realizes. */
+export declare function leafIndexToCounter(leafIndex: number): number;
+/** Convenience: the ratchet leaf index for a PCActn, read straight off its `counter` field. */
+export declare function leafIndexForAction(actn: Pick<PCActn, 'counter'>, depth: number): number;
+/**
+ * Fixed-point scale for quantizing the core's continuous risk scores (r ∈ [0,1]) and budget into
+ * the integer units the Pedersen accumulator commits to. 1000 = millirisk resolution.
+ */
+export declare const RISK_SCALE = 1000;
+/** Quantize a core risk score (any finite r ≥ 0) to non-negative integer accumulator units. */
+export declare function riskToUnits(r: number): RiskUnits;
+/**
+ * The accumulator's budget ceiling in integer units, derived from a RiskPolicy. This is exactly the
+ * core cumulative-risk safety bound Σrisk ≤ bMax/κ (`safetyBound`), quantized — so the zero-knowledge
+ * `verifyBudget(..., budgetCeilingUnits(policy), ...)` proves the SAME inequality the control plane
+ * enforces, without revealing the per-action risks.
+ */
+export declare function budgetCeilingUnits(policy: Pick<RiskPolicy, 'bMax' | 'kappa'>): RiskUnits;

package/dist/adapters.js

@@ -0,0 +1,76 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RISK_SCALE = void 0;
+exports.counterToLeafIndex = counterToLeafIndex;
+exports.leafIndexToCounter = leafIndexToCounter;
+exports.leafIndexForAction = leafIndexForAction;
+exports.riskToUnits = riskToUnits;
+exports.budgetCeilingUnits = budgetCeilingUnits;
+const pca_1 = require("@atlasauth/pca");
+const ggm_1 = require("./ggm");
+const ratchet_1 = require("./ratchet");
+const accumulator_1 = require("./accumulator");
+/**
+ * Thin adapters that bind the two cryptographic mechanisms to the existing PCA bookkeeping they
+ * replace. These map values only — they do NOT modify any @atlasauth/pca core type.
+ *
+ *  - Mechanism 1 (ratchet)  ↔ the PCActn spend-once `counter`.
+ *  - Mechanism 2 (accumulator) ↔ the control-theoretic risk budget (RiskPolicy.bMax / kappa,
+ *    whose cumulative bound is `safetyBound` = bMax/κ, i.e. Σrisk ≤ bMax/κ).
+ */
+// ---- Mechanism 1: ratchet leaf index ↔ PCActn.counter --------------------------------
+/**
+ * Map a PCActn's spend-once `counter` to a ratchet leaf index. The ratchet replaces the resource
+ * server's monotonic-counter check: spending counter `c` signs (and punctures) leaf `c`, so the
+ * same counter can never be re-used — "already spent" is enforced by the key no longer existing.
+ */
+function counterToLeafIndex(counter, depth) {
+    if (!Number.isInteger(depth) || depth < 1 || depth > ggm_1.MAX_RATCHET_DEPTH) {
+        throw new ratchet_1.RatchetError('invalid_depth', `depth must be an integer in [1, ${ggm_1.MAX_RATCHET_DEPTH}]`);
+    }
+    if (!Number.isSafeInteger(counter) || counter < 0) {
+        throw new ratchet_1.RatchetError('leaf_out_of_range', 'counter must be a non-negative safe integer');
+    }
+    if (counter >= 2 ** depth) {
+        throw new ratchet_1.RatchetError('leaf_out_of_range', `counter ${counter} exceeds the ratchet capacity 2^${depth}`);
+    }
+    return counter;
+}
+/** Inverse of {@link counterToLeafIndex}: a leaf index is the spend-once counter it realizes. */
+function leafIndexToCounter(leafIndex) {
+    if (!Number.isSafeInteger(leafIndex) || leafIndex < 0) {
+        throw new ratchet_1.RatchetError('leaf_out_of_range', 'leafIndex must be a non-negative safe integer');
+    }
+    return leafIndex;
+}
+/** Convenience: the ratchet leaf index for a PCActn, read straight off its `counter` field. */
+function leafIndexForAction(actn, depth) {
+    return counterToLeafIndex(actn.counter, depth);
+}
+// ---- Mechanism 2: accumulator units ↔ RiskPolicy budget ------------------------------
+/**
+ * Fixed-point scale for quantizing the core's continuous risk scores (r ∈ [0,1]) and budget into
+ * the integer units the Pedersen accumulator commits to. 1000 = millirisk resolution.
+ */
+exports.RISK_SCALE = 1000;
+/** Quantize a core risk score (any finite r ≥ 0) to non-negative integer accumulator units. */
+function riskToUnits(r) {
+    if (!Number.isFinite(r) || r < 0) {
+        throw new accumulator_1.AccumulatorError('invalid_value', 'risk must be a finite number >= 0');
+    }
+    return BigInt(Math.round(r * exports.RISK_SCALE));
+}
+/**
+ * The accumulator's budget ceiling in integer units, derived from a RiskPolicy. This is exactly the
+ * core cumulative-risk safety bound Σrisk ≤ bMax/κ (`safetyBound`), quantized — so the zero-knowledge
+ * `verifyBudget(..., budgetCeilingUnits(policy), ...)` proves the SAME inequality the control plane
+ * enforces, without revealing the per-action risks.
+ */
+function budgetCeilingUnits(policy) {
+    const bound = (0, pca_1.safetyBound)(policy);
+    if (!Number.isFinite(bound) || bound < 0) {
+        throw new accumulator_1.AccumulatorError('invalid_value', 'safety bound (bMax/kappa) must be finite and >= 0');
+    }
+    return BigInt(Math.floor(bound * exports.RISK_SCALE));
+}
+//# sourceMappingURL=adapters.js.map

package/dist/adapters.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapters.js","sourceRoot":"","sources":["../src/adapters.ts"],"names":[],"mappings":";;;AAqBA,gDAWC;AAGD,gDAKC;AAGD,gDAEC;AAWD,kCAKC;AAQD,gDAMC;AA3ED,wCAA2E;AAC3E,+BAA0C;AAC1C,uCAAyC;AACzC,+CAAiE;AAEjE;;;;;;;GAOG;AAEH,yFAAyF;AAEzF;;;;GAIG;AACH,SAAgB,kBAAkB,CAAC,OAAe,EAAE,KAAa;IAC/D,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,uBAAiB,EAAE,CAAC;QACvE,MAAM,IAAI,sBAAY,CAAC,eAAe,EAAE,mCAAmC,uBAAiB,GAAG,CAAC,CAAC;IACnG,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,sBAAY,CAAC,mBAAmB,EAAE,6CAA6C,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,IAAI,sBAAY,CAAC,mBAAmB,EAAE,WAAW,OAAO,mCAAmC,KAAK,EAAE,CAAC,CAAC;IAC5G,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,iGAAiG;AACjG,SAAgB,kBAAkB,CAAC,SAAiB;IAClD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,sBAAY,CAAC,mBAAmB,EAAE,+CAA+C,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,+FAA+F;AAC/F,SAAgB,kBAAkB,CAAC,IAA6B,EAAE,KAAa;IAC7E,OAAO,kBAAkB,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AACjD,CAAC;AAED,yFAAyF;AAEzF;;;GAGG;AACU,QAAA,UAAU,GAAG,IAAI,CAAC;AAE/B,+FAA+F;AAC/F,SAAgB,WAAW,CAAC,CAAS;IACnC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,8BAAgB,CAAC,eAAe,EAAE,mCAAmC,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,kBAAU,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;GAKG;AACH,SAAgB,kBAAkB,CAAC,MAA0C;IAC3E,MAAM,KAAK,GAAG,IAAA,iBAAW,EAAC,MAAM,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,8BAAgB,CAAC,eAAe,EAAE,mDAAmD,CAAC,CAAC;IACnG,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,kBAAU,CAAC,CAAC,CAAC;AAChD,CAAC"}

package/dist/ggm.d.ts

@@ -0,0 +1,29 @@
+/** Longest tree accepted. Setup derives all 2^depth leaf public keys, so this bounds that cost. */
+export declare const MAX_RATCHET_DEPTH = 20;
+export interface CoverNode {
+    /** Distance from the root (0 = root, `depth` = leaf). */
+    level: number;
+    /** Index of the node within its level, 0 .. 2^level − 1. */
+    nodeIndex: number;
+    /** The node's GGM seed (secret). */
+    seed: Uint8Array;
+}
+/** The GGM root seed, normalized/domain-separated from caller-supplied entropy. */
+export declare function rootSeed(seed: Uint8Array): Uint8Array;
+/** Ed25519 32-byte signing seed for a leaf, derived from that leaf's GGM seed. */
+export declare function leafSigningSeed(leafSeed: Uint8Array): Uint8Array;
+/** b64u Ed25519 public key for a leaf's GGM seed. */
+export declare function leafPublicKey(leafSeed: Uint8Array): string;
+/** Does the subtree of node (level, nodeIndex) contain `leafIndex`? */
+export declare function covers(level: number, nodeIndex: number, leafIndex: number, depth: number): boolean;
+/** Derive the leaf GGM seed for `leafIndex` from a covering node that contains it. */
+export declare function deriveLeafSeed(node: CoverNode, leafIndex: number, depth: number): Uint8Array;
+/**
+ * Puncture `leafIndex` out of `node`'s subtree: return the off-path sibling covering nodes that
+ * together cover every leaf under `node` EXCEPT `leafIndex`. The on-path seeds (and the leaf seed
+ * itself) are never returned — they are dropped, which is what makes the puncture irreversible.
+ */
+export declare function punctureSiblings(node: CoverNode, leafIndex: number, depth: number): CoverNode[];
+/** Derive every leaf's public key from the root seed (used once, at setup, for the commitment). */
+export declare function allLeafPublicKeys(root: Uint8Array, depth: number): string[];
+export declare function coverKey(level: number, nodeIndex: number): string;

package/dist/ggm.js

@@ -0,0 +1,123 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAX_RATCHET_DEPTH = void 0;
+exports.rootSeed = rootSeed;
+exports.leafSigningSeed = leafSigningSeed;
+exports.leafPublicKey = leafPublicKey;
+exports.covers = covers;
+exports.deriveLeafSeed = deriveLeafSeed;
+exports.punctureSiblings = punctureSiblings;
+exports.allLeafPublicKeys = allLeafPublicKeys;
+exports.coverKey = coverKey;
+const hmac_1 = require("@noble/hashes/hmac");
+const sha2_1 = require("@noble/hashes/sha2");
+const ed25519_1 = require("@noble/curves/ed25519");
+const pca_1 = require("@atlasauth/pca");
+const group_1 = require("./group");
+/**
+ * GGM binary-tree puncturable PRF (Mechanism 1 internals).
+ *
+ * A depth-`d` complete binary tree. The root holds a 32-byte seed; every internal node derives
+ * its two children with a length-doubling PRG built from HMAC-SHA256 (a PRF):
+ *
+ *   PRG(seed) = ( HMAC(seed, DOMAIN‖0x00), HMAC(seed, DOMAIN‖0x01) )
+ *
+ * Each of the 2^d leaves derives a one-time Ed25519 signing seed from its own leaf seed
+ * (domain-separated again, so a leaf seed and its signing key are not the same bytes).
+ *
+ * PUNCTURING (forward security). The secret state is NOT the root seed; it is a *co-path*: a
+ * set of disjoint "covering" node seeds whose subtrees are exactly the still-available leaves.
+ * To puncture leaf i, the covering node above it is expanded down to i, each OFF-PATH sibling
+ * seed is retained as a new covering node, and every ON-PATH seed (including leaf i's own) is
+ * dropped. Because the PRG is one-way, a dropped seed can never be recovered from the retained
+ * siblings — leaf i's signing key is gone forever. See `ratchet.ts` for the public API.
+ */
+const PRG_DOMAIN = (0, group_1.utf8)('atlas-pca-ratchet/ggm-prg/v1');
+const LEAFKEY_DOMAIN = (0, group_1.utf8)('atlas-pca-ratchet/ggm-leafkey/v1');
+const ROOT_DOMAIN = (0, group_1.utf8)('atlas-pca-ratchet/ggm-root/v1');
+/** Longest tree accepted. Setup derives all 2^depth leaf public keys, so this bounds that cost. */
+exports.MAX_RATCHET_DEPTH = 20;
+function prgLeft(seed) {
+    const m = new Uint8Array(PRG_DOMAIN.length + 1);
+    m.set(PRG_DOMAIN);
+    m[PRG_DOMAIN.length] = 0x00;
+    return (0, hmac_1.hmac)(sha2_1.sha256, seed, m);
+}
+function prgRight(seed) {
+    const m = new Uint8Array(PRG_DOMAIN.length + 1);
+    m.set(PRG_DOMAIN);
+    m[PRG_DOMAIN.length] = 0x01;
+    return (0, hmac_1.hmac)(sha2_1.sha256, seed, m);
+}
+/** The GGM root seed, normalized/domain-separated from caller-supplied entropy. */
+function rootSeed(seed) {
+    return (0, hmac_1.hmac)(sha2_1.sha256, seed, ROOT_DOMAIN);
+}
+/** Ed25519 32-byte signing seed for a leaf, derived from that leaf's GGM seed. */
+function leafSigningSeed(leafSeed) {
+    return (0, hmac_1.hmac)(sha2_1.sha256, leafSeed, LEAFKEY_DOMAIN);
+}
+/** b64u Ed25519 public key for a leaf's GGM seed. */
+function leafPublicKey(leafSeed) {
+    return (0, pca_1.b64u)(ed25519_1.ed25519.getPublicKey(leafSigningSeed(leafSeed)));
+}
+/** Does the subtree of node (level, nodeIndex) contain `leafIndex`? */
+function covers(level, nodeIndex, leafIndex, depth) {
+    return Math.floor(leafIndex / 2 ** (depth - level)) === nodeIndex;
+}
+/** The bit chosen when descending from `level` towards `leafIndex` (0 = left, 1 = right). */
+function descendBit(level, leafIndex, depth) {
+    return Math.floor(leafIndex / 2 ** (depth - level - 1)) % 2;
+}
+/** Derive the leaf GGM seed for `leafIndex` from a covering node that contains it. */
+function deriveLeafSeed(node, leafIndex, depth) {
+    let seed = node.seed;
+    for (let level = node.level; level < depth; level++) {
+        seed = descendBit(level, leafIndex, depth) === 0 ? prgLeft(seed) : prgRight(seed);
+    }
+    return seed;
+}
+/**
+ * Puncture `leafIndex` out of `node`'s subtree: return the off-path sibling covering nodes that
+ * together cover every leaf under `node` EXCEPT `leafIndex`. The on-path seeds (and the leaf seed
+ * itself) are never returned — they are dropped, which is what makes the puncture irreversible.
+ */
+function punctureSiblings(node, leafIndex, depth) {
+    const out = [];
+    let seed = node.seed;
+    let nodeIndex = node.nodeIndex;
+    for (let level = node.level; level < depth; level++) {
+        const bit = descendBit(level, leafIndex, depth);
+        const left = prgLeft(seed);
+        const right = prgRight(seed);
+        const childBase = nodeIndex * 2;
+        out.push({
+            level: level + 1,
+            nodeIndex: childBase + (1 - bit),
+            seed: bit === 0 ? right : left,
+        });
+        seed = bit === 0 ? left : right;
+        nodeIndex = childBase + bit;
+    }
+    // (level === depth, nodeIndex === leafIndex, seed === leaf seed) is DROPPED.
+    return out;
+}
+/** Derive every leaf's public key from the root seed (used once, at setup, for the commitment). */
+function allLeafPublicKeys(root, depth) {
+    const out = new Array(2 ** depth);
+    const recurse = (seed, level, base) => {
+        if (level === depth) {
+            out[base] = leafPublicKey(seed);
+            return;
+        }
+        const half = 2 ** (depth - level - 1);
+        recurse(prgLeft(seed), level + 1, base);
+        recurse(prgRight(seed), level + 1, base + half);
+    };
+    recurse(root, 0, 0);
+    return out;
+}
+function coverKey(level, nodeIndex) {
+    return `${level}:${nodeIndex}`;
+}
+//# sourceMappingURL=ggm.js.map

package/dist/ggm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ggm.js","sourceRoot":"","sources":["../src/ggm.ts"],"names":[],"mappings":";;;AAwDA,4BAEC;AAGD,0CAEC;AAGD,sCAEC;AAGD,wBAEC;AAQD,wCAMC;AAOD,4CAmBC;AAGD,8CAaC;AAED,4BAEC;AArID,6CAA0C;AAC1C,6CAA4C;AAC5C,mDAAgD;AAChD,wCAAsC;AACtC,mCAA+B;AAE/B;;;;;;;;;;;;;;;;;GAiBG;AAEH,MAAM,UAAU,GAAG,IAAA,YAAI,EAAC,8BAA8B,CAAC,CAAC;AACxD,MAAM,cAAc,GAAG,IAAA,YAAI,EAAC,kCAAkC,CAAC,CAAC;AAChE,MAAM,WAAW,GAAG,IAAA,YAAI,EAAC,+BAA+B,CAAC,CAAC;AAE1D,mGAAmG;AACtF,QAAA,iBAAiB,GAAG,EAAE,CAAC;AAWpC,SAAS,OAAO,CAAC,IAAgB;IAC/B,MAAM,CAAC,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAChD,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAClB,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;IAC5B,OAAO,IAAA,WAAI,EAAC,aAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,QAAQ,CAAC,IAAgB;IAChC,MAAM,CAAC,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAChD,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAClB,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;IAC5B,OAAO,IAAA,WAAI,EAAC,aAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED,mFAAmF;AACnF,SAAgB,QAAQ,CAAC,IAAgB;IACvC,OAAO,IAAA,WAAI,EAAC,aAAM,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;AACzC,CAAC;AAED,kFAAkF;AAClF,SAAgB,eAAe,CAAC,QAAoB;IAClD,OAAO,IAAA,WAAI,EAAC,aAAM,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;AAChD,CAAC;AAED,qDAAqD;AACrD,SAAgB,aAAa,CAAC,QAAoB;IAChD,OAAO,IAAA,UAAI,EAAC,iBAAO,CAAC,YAAY,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,uEAAuE;AACvE,SAAgB,MAAM,CAAC,KAAa,EAAE,SAAiB,EAAE,SAAiB,EAAE,KAAa;IACvF,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,KAAK,SAAS,CAAC;AACpE,CAAC;AAED,6FAA6F;AAC7F,SAAS,UAAU,CAAC,KAAa,EAAE,SAAiB,EAAE,KAAa;IACjE,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,IAAI,CAAC,KAAK,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AAC9D,CAAC;AAED,sFAAsF;AACtF,SAAgB,cAAc,CAAC,IAAe,EAAE,SAAiB,EAAE,KAAa;IAC9E,IAAI,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACrB,KAAK,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,KAAK,GAAG,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC;QACpD,IAAI,GAAG,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,SAAgB,gBAAgB,CAAC,IAAe,EAAE,SAAiB,EAAE,KAAa;IAChF,MAAM,GAAG,GAAgB,EAAE,CAAC;IAC5B,IAAI,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACrB,IAAI,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IAC/B,KAAK,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,KAAK,GAAG,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC;QACpD,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3B,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,SAAS,GAAG,SAAS,GAAG,CAAC,CAAC;QAChC,GAAG,CAAC,IAAI,CAAC;YACP,KAAK,EAAE,KAAK,GAAG,CAAC;YAChB,SAAS,EAAE,SAAS,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC;YAChC,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;SAC/B,CAAC,CAAC;QACH,IAAI,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;QAChC,SAAS,GAAG,SAAS,GAAG,GAAG,CAAC;IAC9B,CAAC;IACD,6EAA6E;IAC7E,OAAO,GAAG,CAAC;AACb,CAAC;AAED,mGAAmG;AACnG,SAAgB,iBAAiB,CAAC,IAAgB,EAAE,KAAa;IAC/D,MAAM,GAAG,GAAG,IAAI,KAAK,CAAS,CAAC,IAAI,KAAK,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,CAAC,IAAgB,EAAE,KAAa,EAAE,IAAY,EAAQ,EAAE;QACtE,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;YACpB,GAAG,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;YAChC,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC;QACtC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;QACxC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC,CAAC;IAClD,CAAC,CAAC;IACF,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IACpB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAgB,QAAQ,CAAC,KAAa,EAAE,SAAiB;IACvD,OAAO,GAAG,KAAK,IAAI,SAAS,EAAE,CAAC;AACjC,CAAC"}

package/dist/group.d.ts

@@ -0,0 +1,57 @@
+import { RistrettoPoint } from '@noble/curves/ed25519';
+/**
+ * Prime-order group layer for the homomorphic risk accumulator (Mechanism 2).
+ *
+ * Group: ristretto255 (RFC 9496) via @noble/curves. It is a prime-order group of order
+ * `L` (the ed25519 subgroup order), which is exactly what a Pedersen commitment / Schnorr
+ * Sigma-protocol needs: no cofactor, every non-identity point generates the whole group,
+ * and binding rests on the hardness of discrete log between the two independent generators.
+ *
+ *   G = RistrettoPoint.BASE                         (the standard generator)
+ *   H = RistrettoPoint.hashToCurve(sha512(label))   ("nothing-up-my-sleeve": nobody knows
+ *                                                     dlog_G(H), which is what makes the
+ *                                                     commitment binding)
+ *
+ * All Pedersen/Schnorr arithmetic is done on bigint scalars reduced mod L.
+ */
+export type Point = InstanceType<typeof RistrettoPoint>;
+/** Prime order of ristretto255 (= ed25519 subgroup order L). */
+export declare const L: bigint;
+/** The standard generator G. */
+export declare const G: Point;
+/** The identity element (commitment to 0 with blinding 0). */
+export declare const ZERO: Point;
+/**
+ * The second Pedersen generator H, derived by hash-to-group of a constant domain-separation
+ * label — independent of G, and with an unknown discrete log relative to G (nobody chose it
+ * with a known offset). Deterministic: the same label always yields the same H.
+ */
+export declare const H: Point;
+/** Reduce an integer into the scalar field [0, L). */
+export declare function mod(x: bigint): bigint;
+export declare function scalarAdd(a: bigint, b: bigint): bigint;
+export declare function scalarSub(a: bigint, b: bigint): bigint;
+export declare function scalarMul(a: bigint, b: bigint): bigint;
+/**
+ * Scalar multiplication `k·P` that tolerates k ≡ 0 (mod L) by returning the identity —
+ * @noble's `multiply` rejects 0 and values ≥ L, so we reduce first and special-case 0.
+ */
+export declare function mul(P: Point, k: bigint): Point;
+export declare function add(a: Point, b: Point): Point;
+export declare function sub(a: Point, b: Point): Point;
+/** A uniformly random non-zero scalar in [1, L). */
+export declare function randScalar(): bigint;
+export declare function numberToBytesLE(n: bigint, len: number): Uint8Array;
+export declare function bytesToNumberLE(b: Uint8Array): bigint;
+export declare function encodePoint(P: Point): string;
+/** Decode a wire point; throws on a non-canonical / invalid ristretto encoding. */
+export declare function decodePoint(s: string): Point;
+export declare function encodeScalar(k: bigint): string;
+export declare function decodeScalar(s: string): bigint;
+/**
+ * Length-prefixed concatenation so distinct part sequences can never collide (each part is
+ * prefixed with its 4-byte big-endian length). The transcript is hashed with SHA-512 and the
+ * digest reduced mod L to yield a challenge scalar.
+ */
+export declare function hashToScalar(parts: Uint8Array[]): bigint;
+export declare function utf8(s: string): Uint8Array;

package/dist/group.js

@@ -0,0 +1,134 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.H = exports.ZERO = exports.G = exports.L = void 0;
+exports.mod = mod;
+exports.scalarAdd = scalarAdd;
+exports.scalarSub = scalarSub;
+exports.scalarMul = scalarMul;
+exports.mul = mul;
+exports.add = add;
+exports.sub = sub;
+exports.randScalar = randScalar;
+exports.numberToBytesLE = numberToBytesLE;
+exports.bytesToNumberLE = bytesToNumberLE;
+exports.encodePoint = encodePoint;
+exports.decodePoint = decodePoint;
+exports.encodeScalar = encodeScalar;
+exports.decodeScalar = decodeScalar;
+exports.hashToScalar = hashToScalar;
+exports.utf8 = utf8;
+const ed25519_1 = require("@noble/curves/ed25519");
+const sha2_1 = require("@noble/hashes/sha2");
+const utils_1 = require("@noble/hashes/utils");
+const pca_1 = require("@atlasauth/pca");
+/** Prime order of ristretto255 (= ed25519 subgroup order L). */
+exports.L = ed25519_1.ed25519.CURVE.n;
+/** The standard generator G. */
+exports.G = ed25519_1.RistrettoPoint.BASE;
+/** The identity element (commitment to 0 with blinding 0). */
+exports.ZERO = ed25519_1.RistrettoPoint.ZERO;
+const H_LABEL = 'atlas-pca-ratchet/pedersen-generator-H/v1';
+/**
+ * The second Pedersen generator H, derived by hash-to-group of a constant domain-separation
+ * label — independent of G, and with an unknown discrete log relative to G (nobody chose it
+ * with a known offset). Deterministic: the same label always yields the same H.
+ */
+exports.H = ed25519_1.RistrettoPoint.hashToCurve((0, sha2_1.sha512)(new TextEncoder().encode(H_LABEL)));
+/** Reduce an integer into the scalar field [0, L). */
+function mod(x) {
+    const r = x % exports.L;
+    return r < 0n ? r + exports.L : r;
+}
+function scalarAdd(a, b) {
+    return mod(a + b);
+}
+function scalarSub(a, b) {
+    return mod(a - b);
+}
+function scalarMul(a, b) {
+    return mod(a * b);
+}
+/**
+ * Scalar multiplication `k·P` that tolerates k ≡ 0 (mod L) by returning the identity —
+ * @noble's `multiply` rejects 0 and values ≥ L, so we reduce first and special-case 0.
+ */
+function mul(P, k) {
+    const s = mod(k);
+    return s === 0n ? exports.ZERO : P.multiply(s);
+}
+function add(a, b) {
+    return a.add(b);
+}
+function sub(a, b) {
+    return a.subtract(b);
+}
+/** A uniformly random non-zero scalar in [1, L). */
+function randScalar() {
+    for (;;) {
+        const s = mod(bytesToNumberLE((0, utils_1.randomBytes)(64)));
+        if (s !== 0n)
+            return s;
+    }
+}
+// ---- little-endian scalar <-> bytes ---------------------------------------------------
+function numberToBytesLE(n, len) {
+    if (n < 0n)
+        throw new RangeError('numberToBytesLE: negative');
+    const out = new Uint8Array(len);
+    let x = n;
+    for (let i = 0; i < len; i++) {
+        out[i] = Number(x & 0xffn);
+        x >>= 8n;
+    }
+    if (x !== 0n)
+        throw new RangeError('numberToBytesLE: overflow');
+    return out;
+}
+function bytesToNumberLE(b) {
+    let x = 0n;
+    for (let i = b.length - 1; i >= 0; i--) {
+        x = (x << 8n) | BigInt(b[i] ?? 0);
+    }
+    return x;
+}
+// ---- wire encoding (base64url, shared with @atlasauth/pca) ----------------------------
+function encodePoint(P) {
+    return (0, pca_1.b64u)(P.toRawBytes());
+}
+/** Decode a wire point; throws on a non-canonical / invalid ristretto encoding. */
+function decodePoint(s) {
+    return ed25519_1.RistrettoPoint.fromHex((0, pca_1.unb64u)(s));
+}
+function encodeScalar(k) {
+    return (0, pca_1.b64u)(numberToBytesLE(mod(k), 32));
+}
+function decodeScalar(s) {
+    return mod(bytesToNumberLE((0, pca_1.unb64u)(s)));
+}
+// ---- Fiat-Shamir transcript -----------------------------------------------------------
+/**
+ * Length-prefixed concatenation so distinct part sequences can never collide (each part is
+ * prefixed with its 4-byte big-endian length). The transcript is hashed with SHA-512 and the
+ * digest reduced mod L to yield a challenge scalar.
+ */
+function hashToScalar(parts) {
+    let total = 0;
+    for (const p of parts)
+        total += 4 + p.length;
+    const buf = new Uint8Array(total);
+    let o = 0;
+    for (const p of parts) {
+        buf[o] = (p.length >>> 24) & 0xff;
+        buf[o + 1] = (p.length >>> 16) & 0xff;
+        buf[o + 2] = (p.length >>> 8) & 0xff;
+        buf[o + 3] = p.length & 0xff;
+        o += 4;
+        buf.set(p, o);
+        o += p.length;
+    }
+    return mod(bytesToNumberLE((0, sha2_1.sha512)(buf)));
+}
+function utf8(s) {
+    return new TextEncoder().encode(s);
+}
+//# sourceMappingURL=group.js.map

package/dist/group.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"group.js","sourceRoot":"","sources":["../src/group.ts"],"names":[],"mappings":";;;AA0CA,kBAGC;AAED,8BAEC;AAED,8BAEC;AAED,8BAEC;AAMD,kBAGC;AAED,kBAEC;AAED,kBAEC;AAGD,gCAKC;AAID,0CAUC;AAED,0CAMC;AAID,kCAEC;AAGD,kCAEC;AAED,oCAEC;AAED,oCAEC;AASD,oCAeC;AAED,oBAEC;AAvJD,mDAAgE;AAChE,6CAA4C;AAC5C,+CAAkD;AAClD,wCAA8C;AAoB9C,gEAAgE;AACnD,QAAA,CAAC,GAAW,iBAAO,CAAC,KAAK,CAAC,CAAC,CAAC;AAEzC,gCAAgC;AACnB,QAAA,CAAC,GAAU,wBAAc,CAAC,IAAI,CAAC;AAE5C,8DAA8D;AACjD,QAAA,IAAI,GAAU,wBAAc,CAAC,IAAI,CAAC;AAE/C,MAAM,OAAO,GAAG,2CAA2C,CAAC;AAE5D;;;;GAIG;AACU,QAAA,CAAC,GAAU,wBAAc,CAAC,WAAW,CAAC,IAAA,aAAM,EAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAE9F,sDAAsD;AACtD,SAAgB,GAAG,CAAC,CAAS;IAC3B,MAAM,CAAC,GAAG,CAAC,GAAG,SAAC,CAAC;IAChB,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,SAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5B,CAAC;AAED,SAAgB,SAAS,CAAC,CAAS,EAAE,CAAS;IAC5C,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AACpB,CAAC;AAED,SAAgB,SAAS,CAAC,CAAS,EAAE,CAAS;IAC5C,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AACpB,CAAC;AAED,SAAgB,SAAS,CAAC,CAAS,EAAE,CAAS;IAC5C,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AACpB,CAAC;AAED;;;GAGG;AACH,SAAgB,GAAG,CAAC,CAAQ,EAAE,CAAS;IACrC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;IACjB,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,YAAI,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,SAAgB,GAAG,CAAC,CAAQ,EAAE,CAAQ;IACpC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,SAAgB,GAAG,CAAC,CAAQ,EAAE,CAAQ;IACpC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AACvB,CAAC;AAED,oDAAoD;AACpD,SAAgB,UAAU;IACxB,SAAS,CAAC;QACR,MAAM,CAAC,GAAG,GAAG,CAAC,eAAe,CAAC,IAAA,mBAAW,EAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK,EAAE;YAAE,OAAO,CAAC,CAAC;IACzB,CAAC;AACH,CAAC;AAED,0FAA0F;AAE1F,SAAgB,eAAe,CAAC,CAAS,EAAE,GAAW;IACpD,IAAI,CAAC,GAAG,EAAE;QAAE,MAAM,IAAI,UAAU,CAAC,2BAA2B,CAAC,CAAC;IAC9D,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;QAC3B,CAAC,KAAK,EAAE,CAAC;IACX,CAAC;IACD,IAAI,CAAC,KAAK,EAAE;QAAE,MAAM,IAAI,UAAU,CAAC,2BAA2B,CAAC,CAAC;IAChE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAgB,eAAe,CAAC,CAAa;IAC3C,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,0FAA0F;AAE1F,SAAgB,WAAW,CAAC,CAAQ;IAClC,OAAO,IAAA,UAAI,EAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;AAC9B,CAAC;AAED,mFAAmF;AACnF,SAAgB,WAAW,CAAC,CAAS;IACnC,OAAO,wBAAc,CAAC,OAAO,CAAC,IAAA,YAAM,EAAC,CAAC,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,SAAgB,YAAY,CAAC,CAAS;IACpC,OAAO,IAAA,UAAI,EAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,SAAgB,YAAY,CAAC,CAAS;IACpC,OAAO,GAAG,CAAC,eAAe,CAAC,IAAA,YAAM,EAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,0FAA0F;AAE1F;;;;GAIG;AACH,SAAgB,YAAY,CAAC,KAAmB;IAC9C,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,KAAK,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;QAClC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;QACtC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC;QACrC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,IAAI,CAAC;QAC7B,CAAC,IAAI,CAAC,CAAC;QACP,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACd,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,GAAG,CAAC,eAAe,CAAC,IAAA,aAAM,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,SAAgB,IAAI,CAAC,CAAS;IAC5B,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACrC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,20 @@
+/**
+ * @atlasauth/pca-ratchet — the PCA Capability Ratchet.
+ *
+ * Two original cryptographic primitives that replace PCA bookkeeping with cryptography:
+ *
+ *  1. Puncturable forward-secure capability keys (ratchet.ts): a GGM puncturable-PRF tree of
+ *     one-time Ed25519 keys under a Merkle-root commitment. Signing a leaf permanently punctures
+ *     it — cryptographic one-time-use for the PCActn spend-once counter.
+ *
+ *  2. Homomorphic risk accumulator (accumulator.ts): Pedersen commitments on ristretto255 with a
+ *     zero-knowledge range proof that the committed aggregate stays under the control-theoretic
+ *     budget ceiling (Σrisk ≤ bMax/κ) without revealing individual risks.
+ *
+ * adapters.ts binds both to the @atlasauth/pca core (PCActn.counter, RiskPolicy budget) without
+ * modifying it.
+ */
+export { type RatchetErrorCode, type RatchetSignature, type RatchetState, RatchetError, deriveRatchetRoot, signAtLeaf, verifyLeafSignature, availableLeaves, isLeafAvailable, } from './ratchet';
+export { MAX_RATCHET_DEPTH } from './ggm';
+export { type AccumulatorErrorCode, type RiskUnits, type RiskCommitment, type BitOrProof, type SchnorrProof, type BudgetProof, N_BITS, AccumulatorError, commitRisk, addCommitments, openCommitment, proveBudget, verifyBudget, } from './accumulator';
+export { RISK_SCALE, counterToLeafIndex, leafIndexToCounter, leafIndexForAction, riskToUnits, budgetCeilingUnits, } from './adapters';

package/dist/index.js

@@ -0,0 +1,44 @@
+"use strict";
+/**
+ * @atlasauth/pca-ratchet — the PCA Capability Ratchet.
+ *
+ * Two original cryptographic primitives that replace PCA bookkeeping with cryptography:
+ *
+ *  1. Puncturable forward-secure capability keys (ratchet.ts): a GGM puncturable-PRF tree of
+ *     one-time Ed25519 keys under a Merkle-root commitment. Signing a leaf permanently punctures
+ *     it — cryptographic one-time-use for the PCActn spend-once counter.
+ *
+ *  2. Homomorphic risk accumulator (accumulator.ts): Pedersen commitments on ristretto255 with a
+ *     zero-knowledge range proof that the committed aggregate stays under the control-theoretic
+ *     budget ceiling (Σrisk ≤ bMax/κ) without revealing individual risks.
+ *
+ * adapters.ts binds both to the @atlasauth/pca core (PCActn.counter, RiskPolicy budget) without
+ * modifying it.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.budgetCeilingUnits = exports.riskToUnits = exports.leafIndexForAction = exports.leafIndexToCounter = exports.counterToLeafIndex = exports.RISK_SCALE = exports.verifyBudget = exports.proveBudget = exports.openCommitment = exports.addCommitments = exports.commitRisk = exports.AccumulatorError = exports.N_BITS = exports.MAX_RATCHET_DEPTH = exports.isLeafAvailable = exports.availableLeaves = exports.verifyLeafSignature = exports.signAtLeaf = exports.deriveRatchetRoot = exports.RatchetError = void 0;
+var ratchet_1 = require("./ratchet");
+Object.defineProperty(exports, "RatchetError", { enumerable: true, get: function () { return ratchet_1.RatchetError; } });
+Object.defineProperty(exports, "deriveRatchetRoot", { enumerable: true, get: function () { return ratchet_1.deriveRatchetRoot; } });
+Object.defineProperty(exports, "signAtLeaf", { enumerable: true, get: function () { return ratchet_1.signAtLeaf; } });
+Object.defineProperty(exports, "verifyLeafSignature", { enumerable: true, get: function () { return ratchet_1.verifyLeafSignature; } });
+Object.defineProperty(exports, "availableLeaves", { enumerable: true, get: function () { return ratchet_1.availableLeaves; } });
+Object.defineProperty(exports, "isLeafAvailable", { enumerable: true, get: function () { return ratchet_1.isLeafAvailable; } });
+var ggm_1 = require("./ggm");
+Object.defineProperty(exports, "MAX_RATCHET_DEPTH", { enumerable: true, get: function () { return ggm_1.MAX_RATCHET_DEPTH; } });
+var accumulator_1 = require("./accumulator");
+Object.defineProperty(exports, "N_BITS", { enumerable: true, get: function () { return accumulator_1.N_BITS; } });
+Object.defineProperty(exports, "AccumulatorError", { enumerable: true, get: function () { return accumulator_1.AccumulatorError; } });
+Object.defineProperty(exports, "commitRisk", { enumerable: true, get: function () { return accumulator_1.commitRisk; } });
+Object.defineProperty(exports, "addCommitments", { enumerable: true, get: function () { return accumulator_1.addCommitments; } });
+Object.defineProperty(exports, "openCommitment", { enumerable: true, get: function () { return accumulator_1.openCommitment; } });
+Object.defineProperty(exports, "proveBudget", { enumerable: true, get: function () { return accumulator_1.proveBudget; } });
+Object.defineProperty(exports, "verifyBudget", { enumerable: true, get: function () { return accumulator_1.verifyBudget; } });
+var adapters_1 = require("./adapters");
+Object.defineProperty(exports, "RISK_SCALE", { enumerable: true, get: function () { return adapters_1.RISK_SCALE; } });
+Object.defineProperty(exports, "counterToLeafIndex", { enumerable: true, get: function () { return adapters_1.counterToLeafIndex; } });
+Object.defineProperty(exports, "leafIndexToCounter", { enumerable: true, get: function () { return adapters_1.leafIndexToCounter; } });
+Object.defineProperty(exports, "leafIndexForAction", { enumerable: true, get: function () { return adapters_1.leafIndexForAction; } });
+Object.defineProperty(exports, "riskToUnits", { enumerable: true, get: function () { return adapters_1.riskToUnits; } });
+Object.defineProperty(exports, "budgetCeilingUnits", { enumerable: true, get: function () { return adapters_1.budgetCeilingUnits; } });
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;;AAEH,qCAUmB;AANjB,uGAAA,YAAY,OAAA;AACZ,4GAAA,iBAAiB,OAAA;AACjB,qGAAA,UAAU,OAAA;AACV,8GAAA,mBAAmB,OAAA;AACnB,0GAAA,eAAe,OAAA;AACf,0GAAA,eAAe,OAAA;AAGjB,6BAA0C;AAAjC,wGAAA,iBAAiB,OAAA;AAE1B,6CAcuB;AAPrB,qGAAA,MAAM,OAAA;AACN,+GAAA,gBAAgB,OAAA;AAChB,yGAAA,UAAU,OAAA;AACV,6GAAA,cAAc,OAAA;AACd,6GAAA,cAAc,OAAA;AACd,0GAAA,WAAW,OAAA;AACX,2GAAA,YAAY,OAAA;AAGd,uCAOoB;AANlB,sGAAA,UAAU,OAAA;AACV,8GAAA,kBAAkB,OAAA;AAClB,8GAAA,kBAAkB,OAAA;AAClB,8GAAA,kBAAkB,OAAA;AAClB,uGAAA,WAAW,OAAA;AACX,8GAAA,kBAAkB,OAAA"}

package/dist/ratchet.d.ts

@@ -0,0 +1,65 @@
+import { type InclusionProof } from '@atlasauth/pca';
+import { type CoverNode } from './ggm';
+/**
+ * Mechanism 1 — Puncturable forward-secure capability keys (cryptographic one-time-use).
+ *
+ * A capability holder commits, up front, to a Merkle root over 2^depth one-time Ed25519 leaf
+ * keys (a GGM puncturable PRF tree; see ggm.ts). Signing at leaf `i` produces an offline-verifiable
+ * signature AND returns a new state in which leaf `i` is PUNCTURED: its key material is dropped and
+ * can never be re-derived, so the same leaf can never sign twice. This replaces the resource
+ * server's spend-once counter bookkeeping with cryptography — "already spent" becomes "key no
+ * longer exists", provable without shared state.
+ */
+export type RatchetErrorCode = 'invalid_depth' | 'invalid_seed' | 'leaf_out_of_range' | 'leaf_punctured';
+export declare class RatchetError extends Error {
+    readonly code: RatchetErrorCode;
+    constructor(code: RatchetErrorCode, message: string);
+}
+/** An offline-verifiable one-time signature at a ratchet leaf. */
+export interface RatchetSignature {
+    /** b64u Ed25519 signature (64 bytes) under the leaf's one-time key. */
+    edSig: string;
+    /** b64u Ed25519 public key (32 bytes) of the signing leaf. */
+    leafPubKey: string;
+    /** Merkle inclusion proof that `leafPubKey` is the leaf at this index under the root commitment. */
+    merklePath: InclusionProof;
+}
+/**
+ * The live ratchet. `leafPubKeys` are public (safe to retain; needed to build Merkle proofs).
+ * `covering` is the SECRET co-path: disjoint GGM seeds whose subtrees are exactly the leaves that
+ * can still sign. Punctured leaves are absent from every covering subtree.
+ */
+export interface RatchetState {
+    readonly depth: number;
+    readonly leafCount: number;
+    readonly rootCommitment: string;
+    readonly leafPubKeys: readonly string[];
+    readonly covering: ReadonlyMap<string, CoverNode>;
+}
+/**
+ * Build a ratchet from a root `seed` (≥ 32 bytes of entropy) and tree `depth`. Returns the public
+ * `rootCommitment` (a Merkle root over all 2^depth leaf public keys) and the live `state`.
+ */
+export declare function deriveRatchetRoot(seed: Uint8Array, depth: number): {
+    rootCommitment: string;
+    state: RatchetState;
+};
+/**
+ * Sign `message` at leaf `leafIndex`, then puncture that leaf. Returns the signature and a new
+ * state with the leaf's key permanently dropped. Throws {@link RatchetError} if the leaf is out of
+ * range or already punctured (cryptographic one-time-use: a spent leaf can never sign again).
+ */
+export declare function signAtLeaf(state: RatchetState, leafIndex: number, message: Uint8Array): {
+    signature: RatchetSignature;
+    newState: RatchetState;
+};
+/**
+ * Verify a ratchet signature offline against the root commitment, with no shared state: the
+ * Ed25519 signature must be valid under `leafPubKey`, and `merklePath` must prove `leafPubKey` is
+ * the leaf at `leafIndex` under `rootCommitment`. Never throws; any malformed input returns false.
+ */
+export declare function verifyLeafSignature(rootCommitment: string, leafIndex: number, message: Uint8Array, signature: RatchetSignature): boolean;
+/** Indices of leaves that can still sign (not yet punctured), sorted ascending. */
+export declare function availableLeaves(state: RatchetState): number[];
+/** Whether leaf `leafIndex` can still sign. */
+export declare function isLeafAvailable(state: RatchetState, leafIndex: number): boolean;

package/dist/ratchet.js

@@ -0,0 +1,132 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RatchetError = void 0;
+exports.deriveRatchetRoot = deriveRatchetRoot;
+exports.signAtLeaf = signAtLeaf;
+exports.verifyLeafSignature = verifyLeafSignature;
+exports.availableLeaves = availableLeaves;
+exports.isLeafAvailable = isLeafAvailable;
+const ed25519_1 = require("@noble/curves/ed25519");
+const pca_1 = require("@atlasauth/pca");
+const ggm_1 = require("./ggm");
+const group_1 = require("./group");
+class RatchetError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = 'RatchetError';
+        this.code = code;
+    }
+}
+exports.RatchetError = RatchetError;
+const SIG_DOMAIN = (0, group_1.utf8)('atlas-pca-ratchet/leaf-sig/v1\0');
+/** Domain-separated signed message: binds the leaf index so a signature cannot be lifted elsewhere. */
+function leafSigMessage(leafIndex, message) {
+    const idx = new Uint8Array(8);
+    let x = BigInt(leafIndex);
+    for (let i = 7; i >= 0; i--) {
+        idx[i] = Number(x & 0xffn);
+        x >>= 8n;
+    }
+    const out = new Uint8Array(SIG_DOMAIN.length + 8 + message.length);
+    out.set(SIG_DOMAIN, 0);
+    out.set(idx, SIG_DOMAIN.length);
+    out.set(message, SIG_DOMAIN.length + 8);
+    return out;
+}
+/**
+ * Build a ratchet from a root `seed` (≥ 32 bytes of entropy) and tree `depth`. Returns the public
+ * `rootCommitment` (a Merkle root over all 2^depth leaf public keys) and the live `state`.
+ */
+function deriveRatchetRoot(seed, depth) {
+    if (!Number.isInteger(depth) || depth < 1 || depth > ggm_1.MAX_RATCHET_DEPTH) {
+        throw new RatchetError('invalid_depth', `depth must be an integer in [1, ${ggm_1.MAX_RATCHET_DEPTH}]`);
+    }
+    if (!(seed instanceof Uint8Array) || seed.length < 32) {
+        throw new RatchetError('invalid_seed', 'seed must be a Uint8Array of at least 32 bytes');
+    }
+    const root = (0, ggm_1.rootSeed)(seed);
+    const leafPubKeys = (0, ggm_1.allLeafPublicKeys)(root, depth);
+    const rootCommitment = (0, pca_1.merkleRoot)(leafPubKeys.slice());
+    const covering = new Map([[(0, ggm_1.coverKey)(0, 0), { level: 0, nodeIndex: 0, seed: root }]]);
+    return {
+        rootCommitment,
+        state: { depth, leafCount: 2 ** depth, rootCommitment, leafPubKeys, covering },
+    };
+}
+/** Find the (unique) covering node whose subtree contains `leafIndex`, or undefined if punctured. */
+function findCovering(state, leafIndex) {
+    for (const node of state.covering.values()) {
+        if ((0, ggm_1.covers)(node.level, node.nodeIndex, leafIndex, state.depth))
+            return node;
+    }
+    return undefined;
+}
+/**
+ * Sign `message` at leaf `leafIndex`, then puncture that leaf. Returns the signature and a new
+ * state with the leaf's key permanently dropped. Throws {@link RatchetError} if the leaf is out of
+ * range or already punctured (cryptographic one-time-use: a spent leaf can never sign again).
+ */
+function signAtLeaf(state, leafIndex, message) {
+    if (!Number.isInteger(leafIndex) || leafIndex < 0 || leafIndex >= state.leafCount) {
+        throw new RatchetError('leaf_out_of_range', `leaf ${leafIndex} is out of range [0, ${state.leafCount})`);
+    }
+    const node = findCovering(state, leafIndex);
+    if (node === undefined) {
+        throw new RatchetError('leaf_punctured', `leaf ${leafIndex} is already punctured (spent) and cannot sign`);
+    }
+    const leafSeed = (0, ggm_1.deriveLeafSeed)(node, leafIndex, state.depth);
+    const signingSeed = (0, ggm_1.leafSigningSeed)(leafSeed);
+    const edSig = (0, pca_1.b64u)(ed25519_1.ed25519.sign(leafSigMessage(leafIndex, message), signingSeed));
+    const leafPubKey = (0, ggm_1.leafPublicKey)(leafSeed);
+    const merklePath = (0, pca_1.merkleProof)(state.leafPubKeys.slice(), leafIndex);
+    // Puncture: replace the covering node with its off-path siblings; the on-path (and leaf) seeds vanish.
+    const covering = new Map(state.covering);
+    covering.delete((0, ggm_1.coverKey)(node.level, node.nodeIndex));
+    for (const sib of (0, ggm_1.punctureSiblings)(node, leafIndex, state.depth)) {
+        covering.set((0, ggm_1.coverKey)(sib.level, sib.nodeIndex), sib);
+    }
+    return {
+        signature: { edSig, leafPubKey, merklePath },
+        newState: { ...state, covering },
+    };
+}
+/**
+ * Verify a ratchet signature offline against the root commitment, with no shared state: the
+ * Ed25519 signature must be valid under `leafPubKey`, and `merklePath` must prove `leafPubKey` is
+ * the leaf at `leafIndex` under `rootCommitment`. Never throws; any malformed input returns false.
+ */
+function verifyLeafSignature(rootCommitment, leafIndex, message, signature) {
+    try {
+        if (signature === null || typeof signature !== 'object')
+            return false;
+        const { edSig, leafPubKey, merklePath } = signature;
+        if (typeof edSig !== 'string' || typeof leafPubKey !== 'string' || merklePath === null || typeof merklePath !== 'object') {
+            return false;
+        }
+        if (merklePath.index !== leafIndex)
+            return false;
+        if (!(0, pca_1.verifyB64u)(leafPubKey, leafSigMessage(leafIndex, message), edSig))
+            return false;
+        return (0, pca_1.verifyInclusion)(rootCommitment, merklePath, leafPubKey);
+    }
+    catch {
+        return false;
+    }
+}
+/** Indices of leaves that can still sign (not yet punctured), sorted ascending. */
+function availableLeaves(state) {
+    const out = [];
+    for (const node of state.covering.values()) {
+        const span = 2 ** (state.depth - node.level);
+        const base = node.nodeIndex * span;
+        for (let i = 0; i < span; i++)
+            out.push(base + i);
+    }
+    return out.sort((a, b) => a - b);
+}
+/** Whether leaf `leafIndex` can still sign. */
+function isLeafAvailable(state, leafIndex) {
+    return findCovering(state, leafIndex) !== undefined;
+}
+//# sourceMappingURL=ratchet.js.map

package/dist/ratchet.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ratchet.js","sourceRoot":"","sources":["../src/ratchet.ts"],"names":[],"mappings":";;;AA6FA,8CAeC;AAeD,gCA6BC;AAOD,kDAkBC;AAGD,0CAQC;AAGD,0CAEC;AAjMD,mDAAgD;AAChD,wCAOwB;AACxB,+BAWe;AACf,mCAA+B;AAmB/B,MAAa,YAAa,SAAQ,KAAK;IAC5B,IAAI,CAAmB;IAChC,YAAY,IAAsB,EAAE,OAAe;QACjD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;QAC3B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAPD,oCAOC;AAyBD,MAAM,UAAU,GAAG,IAAA,YAAI,EAAC,iCAAiC,CAAC,CAAC;AAE3D,uGAAuG;AACvG,SAAS,cAAc,CAAC,SAAiB,EAAE,OAAmB;IAC5D,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;QAC3B,CAAC,KAAK,EAAE,CAAC;IACX,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACnE,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IACvB,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IAChC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACxC,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,SAAgB,iBAAiB,CAAC,IAAgB,EAAE,KAAa;IAC/D,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,uBAAiB,EAAE,CAAC;QACvE,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,mCAAmC,uBAAiB,GAAG,CAAC,CAAC;IACnG,CAAC;IACD,IAAI,CAAC,CAAC,IAAI,YAAY,UAAU,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACtD,MAAM,IAAI,YAAY,CAAC,cAAc,EAAE,gDAAgD,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,IAAI,GAAG,IAAA,cAAQ,EAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,WAAW,GAAG,IAAA,uBAAiB,EAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACnD,MAAM,cAAc,GAAG,IAAA,gBAAU,EAAC,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAoB,CAAC,CAAC,IAAA,cAAQ,EAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACxG,OAAO;QACL,cAAc;QACd,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,IAAI,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,QAAQ,EAAE;KAC/E,CAAC;AACJ,CAAC;AAED,qGAAqG;AACrG,SAAS,YAAY,CAAC,KAAmB,EAAE,SAAiB;IAC1D,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QAC3C,IAAI,IAAA,YAAM,EAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;IAC9E,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,SAAgB,UAAU,CACxB,KAAmB,EACnB,SAAiB,EACjB,OAAmB;IAEnB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,IAAI,SAAS,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QAClF,MAAM,IAAI,YAAY,CAAC,mBAAmB,EAAE,QAAQ,SAAS,wBAAwB,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;IAC3G,CAAC;IACD,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAC5C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,YAAY,CAAC,gBAAgB,EAAE,QAAQ,SAAS,+CAA+C,CAAC,CAAC;IAC7G,CAAC;IACD,MAAM,QAAQ,GAAG,IAAA,oBAAc,EAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC9D,MAAM,WAAW,GAAG,IAAA,qBAAe,EAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,IAAA,UAAI,EAAC,iBAAO,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC;IAClF,MAAM,UAAU,GAAG,IAAA,mBAAa,EAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAG,IAAA,iBAAW,EAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAErE,uGAAuG;IACvG,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACzC,QAAQ,CAAC,MAAM,CAAC,IAAA,cAAQ,EAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IACtD,KAAK,MAAM,GAAG,IAAI,IAAA,sBAAgB,EAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACjE,QAAQ,CAAC,GAAG,CAAC,IAAA,cAAQ,EAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC;IACxD,CAAC;IAED,OAAO;QACL,SAAS,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE;QAC5C,QAAQ,EAAE,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE;KACjC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAgB,mBAAmB,CACjC,cAAsB,EACtB,SAAiB,EACjB,OAAmB,EACnB,SAA2B;IAE3B,IAAI,CAAC;QACH,IAAI,SAAS,KAAK,IAAI,IAAI,OAAO,SAAS,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QACtE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,SAAS,CAAC;QACpD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,IAAI,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;YACzH,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,UAAU,CAAC,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACjD,IAAI,CAAC,IAAA,gBAAU,EAAC,UAAU,EAAE,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACrF,OAAO,IAAA,qBAAe,EAAC,cAAc,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,SAAgB,eAAe,CAAC,KAAmB;IACjD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE;YAAE,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AACnC,CAAC;AAED,+CAA+C;AAC/C,SAAgB,eAAe,CAAC,KAAmB,EAAE,SAAiB;IACpE,OAAO,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC,KAAK,SAAS,CAAC;AACtD,CAAC"}

package/package.json

@@ -1,6 +1,59 @@
 {
   "name": "@atlasauth/pca-ratchet",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.2.0",
+  "description": "PCA Capability Ratchet: puncturable forward-secure capability keys (cryptographic one-time-use — a spent action can never be re-signed) plus a homomorphic Pedersen risk accumulator for zero-knowledge proof of the Sigma-risk <= budget ceiling across a delegation chain.",
+  "keywords": [
+    "forward secrecy",
+    "puncturable keys",
+    "pedersen commitments",
+    "one-time use",
+    "agent authorization",
+    "proof-carrying authority",
+    "pca",
+    "ai agents"
+  ],
+  "license": "MIT",
+  "homepage": "https://github.com/Atlas-Authorization/pca#readme",
+  "bugs": {
+    "url": "https://github.com/Atlas-Authorization/pca/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Atlas-Authorization/pca.git",
+    "directory": "packages/pca-ratchet"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "dependencies": {
+    "@noble/curves": "^1.6.0",
+    "@noble/hashes": "^1.5.0",
+    "@atlasauth/pca": "0.2.0"
+  },
+  "devDependencies": {
+    "typescript": "^5.6.3",
+    "vitest": "^2.1.4"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run"
+  }
 }