@atlasauth/pca-ratchet 0.3.0 → 0.4.1

package/README.md

@@ -2,7 +2,7 @@
 
 The PCA Capability Ratchet: two cryptographic primitives that replace bookkeeping in Proof-Carrying Authority with math.
 
-1. **Puncturable forward-secure capability keys.** A GGM puncturable-PRF tree of one-time Ed25519 leaf keys under a Merkle-root commitment. Signing at a leaf permanently punctures it, so a spent action can never be re-signed (cryptographic one-time-use instead of a server-side counter check).
+1. **Puncturable forward-secure capability keys.** A GGM puncturable-PRF tree of one-time Ed25519 leaf keys under a Merkle-root commitment. Signing at a leaf punctures it, so once the state has been erased a spent action cannot be re-signed by an adversary who obtains only the new state. A copy of the state taken BEFORE the signing can sign the same leaf again (nothing in a stateless verifier marks the second signature invalid): use `verifyLeafSignatureOnce` with a spent-leaf store for one-time use at the verifier. Adapters round risk up, so a nonzero risk never costs zero units.
 2. **Homomorphic risk accumulator.** Pedersen commitments on ristretto255 plus a zero-knowledge range proof that the committed total risk stays at or under a budget ceiling, without revealing individual risks.
 
 Small adapters map a PCActn `counter` to a leaf index and core risk scores to accumulator units.
@@ -46,11 +46,12 @@ verifyBudget(sum, 500, proof);  // false
 
 - Ratchet: `deriveRatchetRoot`, `signAtLeaf`, `verifyLeafSignature`, `availableLeaves`, `isLeafAvailable`, `RatchetError`, `MAX_RATCHET_DEPTH`.
 - Accumulator: `commitRisk`, `addCommitments`, `openCommitment`, `proveBudget`, `verifyBudget`, `AccumulatorError`, `N_BITS`.
-- Adapters: `counterToLeafIndex`, `leafIndexToCounter`, `leafIndexForAction`, `riskToUnits`, `budgetCeilingUnits`, `RISK_SCALE`.
+- Adapters: `counterToLeafIndex`, `leafIndexToCounter`, `leafIndexForAction`, `riskToUnits` (rounds UP: a nonzero risk is never 0 units), `RiskQuantizer` (carries the sub-unit remainder so the running total is `ceil(true sum)`), `budgetCeilingUnits` (floors), `RISK_SCALE`.
+- Verifier-side bindings (red-team RT-11): `leafNullifier`, `verifyLeafSignatureOnce` with a `SpentLeafStore` (`memorySpentLeafStore`, or implement over a shared store) returns `ok` / `replay` / `equivocation` (same leaf, different message: evidence of a holder that kept an old state) / `invalid` / `store-error`. `issueRiskCommitment`, `verifyRiskAttestation`, `verifyAttestedBudget`: the party that computes the risk commits to it and signs `(actionDigest, commitment)`, so a prover cannot commit 0 for a 1.0-risk action or move a commitment to another action.
 
 ## Status
 
-Experimental. The cryptography here (GGM tree, Pedersen commitments, bit-decomposition range proof) is original and has **not** been independently audited; do not rely on it as the sole control for high-value actions. One-time-use holds only for the holder of the `RatchetState`: if a state is copied or restored from an old backup, spent leaves are available again, so persist the latest state atomically.
+Experimental. The cryptography here (GGM tree, Pedersen commitments, bit-decomposition range proof) is original and has been self-audited in tests (see the security audit in the PCA docs) but **not** independently audited; do not rely on it as the sole control for high-value actions. One-time-use is enforced by the key material only for an honest holder of the `RatchetState`; a verifier that wants it against a dishonest holder must use `verifyLeafSignatureOnce` with a spent-leaf store (Ed25519 here is deterministic, so a second signature does NOT reveal the key: reuse is detected by the verifier, not punished cryptographically, and the store must be shared and durable across the verifier fleet). Without a store, if a state is copied or restored from an old backup, spent leaves are available again, so persist the latest state atomically. `RatchetSignature` now carries a `nullifier` and `verifyLeafSignature` requires it (breaking: signatures made by earlier versions no longer verify). Commitments are only bound to the real action when issued through the attestation helpers; `verifyBoundedBudget` alone proves a property of whatever the prover committed. `verifyBudget` alone constrains only the SUM: use `proveRiskRange` per commitment and `verifyBoundedBudget` so a "negative" risk cannot cancel real risk.
 
 ## License
 

package/dist/accumulator.d.ts

@@ -57,17 +57,41 @@ export declare function commitRisk(risk: RiskUnits, blinding?: bigint): RiskComm
 export declare function addCommitments(commitments: readonly string[]): string;
 /** Check that `commitment` opens to (`risk`, `blinding`). Never throws; malformed input is false. */
 export declare function openCommitment(commitment: string, risk: RiskUnits, blinding: bigint): boolean;
+/** Largest ceiling the N_BITS range proof can express: a slack is proven in [0, 2^N_BITS). */
+export declare const MAX_PROVABLE_CEILING: bigint;
 /**
  * Prove that the committed aggregate satisfies Σrisk ≤ bMax, in zero knowledge over the individual
  * risks. `risks`/`blindings` are the same per-action values used to build the commitments whose sum
  * is passed to {@link verifyBudget}. If the aggregate is over budget (or the slack does not fit in
  * N_BITS), the returned proof is well-formed but will be REJECTED by the verifier — soundness lives
  * in verification, not in the prover trusting its own inputs.
+ *
+ * SCOPE: the proof is about the committed VALUE of the sum. It does not by itself show that each addend was a
+ * non-negative amount: pair it with {@link proveRiskRange} / {@link verifyBoundedBudget}, otherwise a prover can
+ * offset real risk with a commitment to a "negative" value (a field element near L).
  */
 export declare function proveBudget(risks: readonly RiskUnits[], blindings: readonly bigint[], bMax: RiskUnits): BudgetProof;
 /**
  * Verify a budget proof against the commitment sum and ceiling. Returns true only if every bit
  * commitment opens to 0/1 and they aggregate to the slack commitment bMax·G − commitmentSum — i.e.
  * Σrisk ≤ bMax. Learns nothing about the individual risks. Never throws; malformed input is false.
+ * Scalars and points must be canonical (a proof is not malleable). Ceilings above 2^N_BITS - 1 are clamped.
  */
 export declare function verifyBudget(commitmentSum: string, bMax: RiskUnits, proof: BudgetProof): boolean;
+/** A proof that a single risk commitment opens to a value in [0, 2^N_BITS). Same shape as a {@link BudgetProof}. */
+export type RiskRangeProof = BudgetProof;
+/**
+ * Prove that the commitment `commitRisk(risk, blinding)` holds a value in [0, 2^N_BITS). Each action's
+ * commitment needs one of these: the budget proof alone only constrains the SUM, and since a commitment is just a
+ * group element, a prover could otherwise include one that commits to a value near the group order (a
+ * "negative" risk) to cancel real risk. With every addend range-proved, the integers add without wrapping.
+ */
+export declare function proveRiskRange(risk: RiskUnits, blinding: bigint): RiskRangeProof;
+/** Verify {@link proveRiskRange} for `commitment`. Never throws; malformed input is false. */
+export declare function verifyRiskRange(commitment: string, proof: RiskRangeProof): boolean;
+/**
+ * The sound end-to-end check for a budget over a set of per-action commitments: every commitment must carry a
+ * valid range proof, and the budget proof must verify for their homomorphic sum. Accepting implies
+ * Σ(committed risks), as integers, ≤ min(bMax, 2^N_BITS − 1). Never throws.
+ */
+export declare function verifyBoundedBudget(commitments: readonly string[], rangeProofs: readonly RiskRangeProof[], bMax: RiskUnits, budgetProof: BudgetProof): boolean;

package/dist/accumulator.js

@@ -1,11 +1,14 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AccumulatorError = exports.N_BITS = void 0;
+exports.MAX_PROVABLE_CEILING = exports.AccumulatorError = exports.N_BITS = void 0;
 exports.commitRisk = commitRisk;
 exports.addCommitments = addCommitments;
 exports.openCommitment = openCommitment;
 exports.proveBudget = proveBudget;
 exports.verifyBudget = verifyBudget;
+exports.proveRiskRange = proveRiskRange;
+exports.verifyRiskRange = verifyRiskRange;
+exports.verifyBoundedBudget = verifyBoundedBudget;
 const group_1 = require("./group");
 /**
  * Mechanism 2 — Homomorphic risk accumulator with a zero-knowledge spend ceiling.
@@ -73,8 +76,20 @@ function openCommitment(commitment, risk, blinding) {
 }
 // ---- range proof ----------------------------------------------------------------------
 const CTX_DOMAIN = (0, group_1.utf8)('atlas-pca-ratchet/budget/ctx/v1');
+const RISK_CTX_DOMAIN = (0, group_1.utf8)('atlas-pca-ratchet/risk-range/ctx/v1');
 const OR_DOMAIN = (0, group_1.utf8)('atlas-pca-ratchet/budget/bit-or/v1');
 const AGG_DOMAIN = (0, group_1.utf8)('atlas-pca-ratchet/budget/agg/v1');
+/** Largest ceiling the N_BITS range proof can express: a slack is proven in [0, 2^N_BITS). */
+exports.MAX_PROVABLE_CEILING = (1n << BigInt(exports.N_BITS)) - 1n;
+/**
+ * The ceiling actually proven. A ceiling above 2^N_BITS - 1 is clamped to it: "sum <= 2^N_BITS - 1" is a
+ * strictly stronger statement than "sum <= bMax", so a verifier is never weakened, and an honest prover whose
+ * total fits in N_BITS is never refused (before the clamp, a ceiling >= 2^N_BITS made every small total
+ * unprovable because the slack no longer fit the range).
+ */
+function effectiveCeiling(bMaxUnits) {
+    return bMaxUnits > exports.MAX_PROVABLE_CEILING ? exports.MAX_PROVABLE_CEILING : bMaxUnits;
+}
 /** The transcript context that binds every challenge to the exact public statement. */
 function contextHash(n, bMaxUnits, commitmentSum, bitCommitments) {
     const parts = [
@@ -88,6 +103,13 @@ function contextHash(n, bMaxUnits, commitmentSum, bitCommitments) {
     // Reuse hashToScalar's length-prefixed framing, then serialize the scalar back to 32 bytes.
     return (0, group_1.numberToBytesLE)((0, group_1.hashToScalar)(parts), 32);
 }
+/** Context for the per-commitment range proof (a different domain, so it cannot be replayed as a budget proof). */
+function riskContextHash(n, commitment, bitCommitments) {
+    const parts = [RISK_CTX_DOMAIN, Uint8Array.of(n & 0xff), commitment.toRawBytes()];
+    for (const B of bitCommitments)
+        parts.push(B.toRawBytes());
+    return (0, group_1.numberToBytesLE)((0, group_1.hashToScalar)(parts), 32);
+}
 /** Prove bit commitment `B` (= b·G + s·H) opens to 0 or 1, knowing bit `b` and blinding `s`. */
 function proveBit(ctx, index, B, b, s) {
     const P0 = B; // commitment to 0 under H  => B = s·H
@@ -139,29 +161,14 @@ function verifySchnorr(ctx, D, proof) {
     return (0, group_1.mul)(group_1.H, z).equals((0, group_1.add)(a, (0, group_1.mul)(D, e)));
 }
 /**
- * Prove that the committed aggregate satisfies Σrisk ≤ bMax, in zero knowledge over the individual
- * risks. `risks`/`blindings` are the same per-action values used to build the commitments whose sum
- * is passed to {@link verifyBudget}. If the aggregate is over budget (or the slack does not fit in
- * N_BITS), the returned proof is well-formed but will be REJECTED by the verifier — soundness lives
- * in verification, not in the prover trusting its own inputs.
+ * Shared range-proof core. Proves that the point `V = value·G + gamma·H` (known to both sides) commits to a
+ * value in [0, 2^N_BITS): bit-decompose, commit to each bit, prove each is 0/1 (OR-proof), and prove by a
+ * Schnorr proof that Σ 2^i·B_i − V is a pure multiple of H (so the bits aggregate to the committed value).
+ * `value` is taken modulo 2^N_BITS: an out-of-range value yields a well-formed proof that the verifier rejects.
  */
-function proveBudget(risks, blindings, bMax) {
-    if (risks.length !== blindings.length) {
-        throw new AccumulatorError('length_mismatch', 'risks and blindings must have equal length');
-    }
-    const bMaxUnits = asUnits(bMax);
-    let sumRisk = 0n;
-    let sumBlind = 0n;
-    for (let i = 0; i < risks.length; i++) {
-        sumRisk += asUnits(risks[i] ?? 0n);
-        sumBlind = (0, group_1.scalarAdd)(sumBlind, blindings[i] ?? 0n);
-    }
-    // Commitment sum (= what the verifier is given) and the slack commitment V = bMax·G − C_sum.
-    const cSum = (0, group_1.add)((0, group_1.mul)(group_1.G, (0, group_1.mod)(sumRisk)), (0, group_1.mul)(group_1.H, sumBlind));
-    const gamma = (0, group_1.mod)(-sumBlind); // blinding of V
-    const v = bMaxUnits - sumRisk; // slack (may be negative if over budget)
+function rangeProve(makeCtx, V, value, gamma) {
     const mask = (1n << BigInt(exports.N_BITS)) - 1n;
-    const vMasked = v & mask; // low N_BITS bits (correct two's-complement low bits even if v < 0)
+    const vMasked = value & mask; // low N_BITS bits (correct two's-complement low bits even if value < 0)
     const bitCommitments = [];
     const bitBlindings = [];
     const bits = [];
@@ -172,13 +179,13 @@ function proveBudget(risks, blindings, bMax) {
         bitBlindings.push(s);
         bitCommitments.push((0, group_1.add)((0, group_1.mul)(group_1.G, bit), (0, group_1.mul)(group_1.H, s)));
     }
-    const ctx = contextHash(exports.N_BITS, bMaxUnits, cSum, bitCommitments);
+    const ctx = makeCtx(bitCommitments);
     const or = [];
     for (let i = 0; i < exports.N_BITS; i++) {
         or.push(proveBit(ctx, i, bitCommitments[i], bits[i], bitBlindings[i]));
     }
-    // Aggregation: Σ 2^i·B_i = (Σ 2^i·b_i)·G + (Σ 2^i·s_i)·H = v'·G + sStar·H. When v' = v (in range),
-    // D = Σ2^i·B_i − V = (sStar − gamma)·H, a pure H-multiple whose dlog the prover knows.
+    // Aggregation: Σ 2^i·B_i = v'·G + sStar·H. When v' = value (in range), D = Σ2^i·B_i − V = (sStar − gamma)·H,
+    // a pure H-multiple whose dlog the prover knows.
     let sStar = 0n;
     let aggPoint = (0, group_1.mul)(group_1.G, 0n);
     for (let i = 0; i < exports.N_BITS; i++) {
@@ -186,43 +193,114 @@ function proveBudget(risks, blindings, bMax) {
         sStar = (0, group_1.scalarAdd)(sStar, (0, group_1.scalarMul)(w, bitBlindings[i]));
         aggPoint = (0, group_1.add)(aggPoint, (0, group_1.mul)(bitCommitments[i], w));
     }
-    const V = (0, group_1.sub)((0, group_1.mul)(group_1.G, (0, group_1.mod)(bMaxUnits)), cSum);
     const D = (0, group_1.sub)(aggPoint, V);
-    const delta = (0, group_1.scalarSub)(sStar, gamma);
-    const agg = proveSchnorr(ctx, D, delta);
-    return { n: exports.N_BITS, bitCommitments: bitCommitments.map(group_1.encodePoint), or, agg };
+    const agg = proveSchnorr(ctx, D, (0, group_1.scalarSub)(sStar, gamma));
+    return { bitCommitments, or, agg };
+}
+function rangeVerify(makeCtx, V, proof) {
+    if (proof === null || typeof proof !== 'object')
+        return false;
+    const { n, bitCommitments, or, agg } = proof;
+    if (n !== exports.N_BITS || !Array.isArray(bitCommitments) || !Array.isArray(or))
+        return false;
+    if (bitCommitments.length !== exports.N_BITS || or.length !== exports.N_BITS)
+        return false;
+    if (agg === null || typeof agg !== 'object')
+        return false;
+    const B = bitCommitments.map(group_1.decodePoint);
+    const ctx = makeCtx(B);
+    for (let i = 0; i < exports.N_BITS; i++) {
+        if (!verifyBit(ctx, i, B[i], or[i]))
+            return false;
+    }
+    let aggPoint = (0, group_1.mul)(group_1.G, 0n);
+    for (let i = 0; i < exports.N_BITS; i++)
+        aggPoint = (0, group_1.add)(aggPoint, (0, group_1.mul)(B[i], 1n << BigInt(i)));
+    return verifySchnorr(ctx, (0, group_1.sub)(aggPoint, V), agg);
+}
+/**
+ * Prove that the committed aggregate satisfies Σrisk ≤ bMax, in zero knowledge over the individual
+ * risks. `risks`/`blindings` are the same per-action values used to build the commitments whose sum
+ * is passed to {@link verifyBudget}. If the aggregate is over budget (or the slack does not fit in
+ * N_BITS), the returned proof is well-formed but will be REJECTED by the verifier — soundness lives
+ * in verification, not in the prover trusting its own inputs.
+ *
+ * SCOPE: the proof is about the committed VALUE of the sum. It does not by itself show that each addend was a
+ * non-negative amount: pair it with {@link proveRiskRange} / {@link verifyBoundedBudget}, otherwise a prover can
+ * offset real risk with a commitment to a "negative" value (a field element near L).
+ */
+function proveBudget(risks, blindings, bMax) {
+    if (risks.length !== blindings.length) {
+        throw new AccumulatorError('length_mismatch', 'risks and blindings must have equal length');
+    }
+    const ceiling = effectiveCeiling(asUnits(bMax));
+    let sumRisk = 0n;
+    let sumBlind = 0n;
+    for (let i = 0; i < risks.length; i++) {
+        sumRisk += asUnits(risks[i] ?? 0n);
+        sumBlind = (0, group_1.scalarAdd)(sumBlind, blindings[i] ?? 0n);
+    }
+    // Commitment sum (= what the verifier is given) and the slack commitment V = bMax·G − C_sum.
+    const cSum = (0, group_1.add)((0, group_1.mul)(group_1.G, (0, group_1.mod)(sumRisk)), (0, group_1.mul)(group_1.H, sumBlind));
+    const V = (0, group_1.sub)((0, group_1.mul)(group_1.G, (0, group_1.mod)(ceiling)), cSum);
+    const slack = ceiling - sumRisk; // may be negative if over budget
+    const r = rangeProve((bits) => contextHash(exports.N_BITS, ceiling, cSum, bits), V, slack, (0, group_1.mod)(-sumBlind));
+    return { n: exports.N_BITS, bitCommitments: r.bitCommitments.map(group_1.encodePoint), or: r.or, agg: r.agg };
 }
 /**
  * Verify a budget proof against the commitment sum and ceiling. Returns true only if every bit
  * commitment opens to 0/1 and they aggregate to the slack commitment bMax·G − commitmentSum — i.e.
  * Σrisk ≤ bMax. Learns nothing about the individual risks. Never throws; malformed input is false.
+ * Scalars and points must be canonical (a proof is not malleable). Ceilings above 2^N_BITS - 1 are clamped.
  */
 function verifyBudget(commitmentSum, bMax, proof) {
     try {
-        if (proof === null || typeof proof !== 'object')
-            return false;
-        const { n, bitCommitments, or, agg } = proof;
-        if (n !== exports.N_BITS || !Array.isArray(bitCommitments) || !Array.isArray(or))
-            return false;
-        if (bitCommitments.length !== exports.N_BITS || or.length !== exports.N_BITS)
-            return false;
-        if (agg === null || typeof agg !== 'object')
-            return false;
-        const bMaxUnits = asUnits(bMax);
+        const ceiling = effectiveCeiling(asUnits(bMax));
         const cSum = (0, group_1.decodePoint)(commitmentSum);
-        const B = bitCommitments.map(group_1.decodePoint);
-        const ctx = contextHash(exports.N_BITS, bMaxUnits, cSum, B);
-        for (let i = 0; i < exports.N_BITS; i++) {
-            if (!verifyBit(ctx, i, B[i], or[i]))
+        const V = (0, group_1.sub)((0, group_1.mul)(group_1.G, (0, group_1.mod)(ceiling)), cSum);
+        return rangeVerify((bits) => contextHash(exports.N_BITS, ceiling, cSum, bits), V, proof);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Prove that the commitment `commitRisk(risk, blinding)` holds a value in [0, 2^N_BITS). Each action's
+ * commitment needs one of these: the budget proof alone only constrains the SUM, and since a commitment is just a
+ * group element, a prover could otherwise include one that commits to a value near the group order (a
+ * "negative" risk) to cancel real risk. With every addend range-proved, the integers add without wrapping.
+ */
+function proveRiskRange(risk, blinding) {
+    const v = asUnits(risk);
+    const b = (0, group_1.mod)(blinding);
+    const C = (0, group_1.add)((0, group_1.mul)(group_1.G, (0, group_1.mod)(v)), (0, group_1.mul)(group_1.H, b));
+    const r = rangeProve((bits) => riskContextHash(exports.N_BITS, C, bits), C, v, b);
+    return { n: exports.N_BITS, bitCommitments: r.bitCommitments.map(group_1.encodePoint), or: r.or, agg: r.agg };
+}
+/** Verify {@link proveRiskRange} for `commitment`. Never throws; malformed input is false. */
+function verifyRiskRange(commitment, proof) {
+    try {
+        const C = (0, group_1.decodePoint)(commitment);
+        return rangeVerify((bits) => riskContextHash(exports.N_BITS, C, bits), C, proof);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * The sound end-to-end check for a budget over a set of per-action commitments: every commitment must carry a
+ * valid range proof, and the budget proof must verify for their homomorphic sum. Accepting implies
+ * Σ(committed risks), as integers, ≤ min(bMax, 2^N_BITS − 1). Never throws.
+ */
+function verifyBoundedBudget(commitments, rangeProofs, bMax, budgetProof) {
+    try {
+        if (!Array.isArray(commitments) || !Array.isArray(rangeProofs) || commitments.length !== rangeProofs.length)
+            return false;
+        for (let i = 0; i < commitments.length; i++) {
+            if (!verifyRiskRange(commitments[i], rangeProofs[i]))
                 return false;
         }
-        let aggPoint = (0, group_1.mul)(group_1.G, 0n);
-        for (let i = 0; i < exports.N_BITS; i++) {
-            aggPoint = (0, group_1.add)(aggPoint, (0, group_1.mul)(B[i], 1n << BigInt(i)));
-        }
-        const V = (0, group_1.sub)((0, group_1.mul)(group_1.G, (0, group_1.mod)(bMaxUnits)), cSum);
-        const D = (0, group_1.sub)(aggPoint, V);
-        return verifySchnorr(ctx, D, agg);
+        return verifyBudget(addCommitments(commitments), bMax, budgetProof);
     }
     catch {
         return false;

package/dist/accumulator.js.map

@@ -1 +1 @@
-{"version":3,"file":"accumulator.js","sourceRoot":"","sources":["../src/accumulator.ts"],"names":[],"mappings":";;;AAmGA,gCAKC;AAGD,wCAIC;AAGD,wCAQC;AAsFD,kCAoDC;AAOD,oCA2BC;AAtSD,mCAmBiB;AAEjB;;;;;;;;;;;;;;;;GAgBG;AAEH,8EAA8E;AACjE,QAAA,MAAM,GAAG,EAAE,CAAC;AAMzB,MAAa,gBAAiB,SAAQ,KAAK;IAChC,IAAI,CAAuB;IACpC,YAAY,IAA0B,EAAE,OAAe;QACrD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAPD,4CAOC;AAkCD,SAAS,OAAO,CAAC,CAAY;IAC3B,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC1B,IAAI,CAAC,GAAG,EAAE;YAAE,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,0BAA0B,CAAC,CAAC;QACpF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,4CAA4C,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;AACnB,CAAC;AAED,iGAAiG;AACjG,SAAgB,UAAU,CAAC,IAAe,EAAE,QAAiB;IAC3D,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,MAAM,CAAC,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAA,kBAAU,GAAE,CAAC,CAAC,CAAC,IAAA,WAAG,EAAC,QAAQ,CAAC,CAAC;IAChE,MAAM,CAAC,GAAG,IAAA,WAAG,EAAC,IAAA,WAAG,EAAC,SAAC,EAAE,CAAC,CAAC,EAAE,IAAA,WAAG,EAAC,SAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACpC,OAAO,EAAE,UAAU,EAAE,IAAA,mBAAW,EAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;AACrD,CAAC;AAED,qGAAqG;AACrG,SAAgB,cAAc,CAAC,WAA8B;IAC3D,IAAI,GAAG,GAAG,IAAA,WAAG,EAAC,SAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW;IACjC,KAAK,MAAM,CAAC,IAAI,WAAW;QAAE,GAAG,GAAG,IAAA,WAAG,EAAC,GAAG,EAAE,IAAA,mBAAW,EAAC,CAAC,CAAC,CAAC,CAAC;IAC5D,OAAO,IAAA,mBAAW,EAAC,GAAG,CAAC,CAAC;AAC1B,CAAC;AAED,qGAAqG;AACrG,SAAgB,cAAc,CAAC,UAAkB,EAAE,IAAe,EAAE,QAAgB;IAClF,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QACxB,MAAM,QAAQ,GAAG,IAAA,WAAG,EAAC,IAAA,WAAG,EAAC,SAAC,EAAE,CAAC,CAAC,EAAE,IAAA,WAAG,EAAC,SAAC,EAAE,IAAA,WAAG,EAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QACvD,OAAO,IAAA,mBAAW,EAAC,UAAU,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,0FAA0F;AAE1F,MAAM,UAAU,GAAG,IAAA,YAAI,EAAC,iCAAiC,CAAC,CAAC;AAC3D,MAAM,SAAS,GAAG,IAAA,YAAI,EAAC,oCAAoC,CAAC,CAAC;AAC7D,MAAM,UAAU,GAAG,IAAA,YAAI,EAAC,iCAAiC,CAAC,CAAC;AAE3D,uFAAuF;AACvF,SAAS,WAAW,CAAC,CAAS,EAAE,SAAiB,EAAE,aAAoB,EAAE,cAAuB;IAC9F,MAAM,KAAK,GAAiB;QAC1B,UAAU;QACV,UAAU,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;QACvB,IAAA,uBAAe,EAAC,IAAA,WAAG,EAAC,SAAS,CAAC,EAAE,EAAE,CAAC;QACnC,aAAa,CAAC,UAAU,EAAE;KAC3B,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,cAAc;QAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;IAC3D,4FAA4F;IAC5F,OAAO,IAAA,uBAAe,EAAC,IAAA,oBAAY,EAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;AAClD,CAAC;AAED,gGAAgG;AAChG,SAAS,QAAQ,CAAC,GAAe,EAAE,KAAa,EAAE,CAAQ,EAAE,CAAS,EAAE,CAAS;IAC9E,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,sCAAsC;IACpD,MAAM,EAAE,GAAG,IAAA,WAAG,EAAC,CAAC,EAAE,SAAC,CAAC,CAAC,CAAC,iCAAiC;IACvD,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAE9B,8DAA8D;IAC9D,MAAM,KAAK,GAAG,IAAA,kBAAU,GAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,IAAA,kBAAU,GAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,IAAA,WAAG,EAAC,IAAA,WAAG,EAAC,SAAC,EAAE,KAAK,CAAC,EAAE,IAAA,WAAG,EAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IAEpD,+CAA+C;IAC/C,MAAM,CAAC,GAAG,IAAA,kBAAU,GAAE,CAAC;IACvB,MAAM,KAAK,GAAG,IAAA,WAAG,EAAC,SAAC,EAAE,CAAC,CAAC,CAAC;IAExB,MAAM,EAAE,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IACtC,MAAM,EAAE,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IACtC,MAAM,CAAC,GAAG,IAAA,oBAAY,EAAC,CAAC,SAAS,EAAE,GAAG,EAAE,UAAU,CAAC,EAAE,CAAC,KAAK,GAAG,IAAI,CAAC,EAAE,EAAE,CAAC,UAAU,EAAE,EAAE,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IACxG,MAAM,KAAK,GAAG,IAAA,iBAAS,EAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,IAAA,iBAAS,EAAC,CAAC,EAAE,IAAA,iBAAS,EAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IAEhD,MAAM,EAAE,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IACtC,MAAM,EAAE,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IACtC,MAAM,EAAE,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IACtC,MAAM,EAAE,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IACtC,OAAO,EAAE,EAAE,EAAE,IAAA,oBAAY,EAAC,EAAE,CAAC,EAAE,EAAE,EAAE,IAAA,oBAAY,EAAC,EAAE,CAAC,EAAE,EAAE,EAAE,IAAA,oBAAY,EAAC,EAAE,CAAC,EAAE,EAAE,EAAE,IAAA,oBAAY,EAAC,EAAE,CAAC,EAAE,CAAC;AACpG,CAAC;AAED,SAAS,SAAS,CAAC,GAAe,EAAE,KAAa,EAAE,CAAQ,EAAE,KAAiB;IAC5E,MAAM,EAAE,GAAG,IAAA,oBAAY,EAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClC,MAAM,EAAE,GAAG,IAAA,oBAAY,EAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClC,MAAM,EAAE,GAAG,IAAA,oBAAY,EAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClC,MAAM,EAAE,GAAG,IAAA,oBAAY,EAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClC,MAAM,EAAE,GAAG,CAAC,CAAC;IACb,MAAM,EAAE,GAAG,IAAA,WAAG,EAAC,CAAC,EAAE,SAAC,CAAC,CAAC;IACrB,MAAM,EAAE,GAAG,IAAA,WAAG,EAAC,IAAA,WAAG,EAAC,SAAC,EAAE,EAAE,CAAC,EAAE,IAAA,WAAG,EAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACxC,MAAM,EAAE,GAAG,IAAA,WAAG,EAAC,IAAA,WAAG,EAAC,SAAC,EAAE,EAAE,CAAC,EAAE,IAAA,WAAG,EAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACxC,MAAM,CAAC,GAAG,IAAA,oBAAY,EAAC,CAAC,SAAS,EAAE,GAAG,EAAE,UAAU,CAAC,EAAE,CAAC,KAAK,GAAG,IAAI,CAAC,EAAE,EAAE,CAAC,UAAU,EAAE,EAAE,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IACxG,OAAO,IAAA,iBAAS,EAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;AACjC,CAAC;AAED,wDAAwD;AACxD,SAAS,YAAY,CAAC,GAAe,EAAE,CAAQ,EAAE,CAAS;IACxD,MAAM,CAAC,GAAG,IAAA,kBAAU,GAAE,CAAC;IACvB,MAAM,CAAC,GAAG,IAAA,WAAG,EAAC,SAAC,EAAE,CAAC,CAAC,CAAC;IACpB,MAAM,CAAC,GAAG,IAAA,oBAAY,EAAC,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IAC1E,MAAM,CAAC,GAAG,IAAA,iBAAS,EAAC,CAAC,EAAE,IAAA,iBAAS,EAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACxC,OAAO,EAAE,CAAC,EAAE,IAAA,mBAAW,EAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAA,oBAAY,EAAC,CAAC,CAAC,EAAE,CAAC;AACnD,CAAC;AAED,SAAS,aAAa,CAAC,GAAe,EAAE,CAAQ,EAAE,KAAmB;IACnE,MAAM,CAAC,GAAG,IAAA,mBAAW,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC/B,MAAM,CAAC,GAAG,IAAA,oBAAY,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAChC,MAAM,CAAC,GAAG,IAAA,oBAAY,EAAC,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IAC1E,OAAO,IAAA,WAAG,EAAC,SAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAA,WAAG,EAAC,CAAC,EAAE,IAAA,WAAG,EAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,WAAW,CAAC,KAA2B,EAAE,SAA4B,EAAE,IAAe;IACpG,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,EAAE,CAAC;QACtC,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,4CAA4C,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,OAAO,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACnC,QAAQ,GAAG,IAAA,iBAAS,EAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACrD,CAAC;IACD,6FAA6F;IAC7F,MAAM,IAAI,GAAG,IAAA,WAAG,EAAC,IAAA,WAAG,EAAC,SAAC,EAAE,IAAA,WAAG,EAAC,OAAO,CAAC,CAAC,EAAE,IAAA,WAAG,EAAC,SAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,IAAA,WAAG,EAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,gBAAgB;IAE9C,MAAM,CAAC,GAAG,SAAS,GAAG,OAAO,CAAC,CAAC,yCAAyC;IACxE,MAAM,IAAI,GAAG,CAAC,EAAE,IAAI,MAAM,CAAC,cAAM,CAAC,CAAC,GAAG,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,oEAAoE;IAE9F,MAAM,cAAc,GAAY,EAAE,CAAC;IACnC,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,cAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,IAAA,kBAAU,GAAE,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACf,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrB,cAAc,CAAC,IAAI,CAAC,IAAA,WAAG,EAAC,IAAA,WAAG,EAAC,SAAC,EAAE,GAAG,CAAC,EAAE,IAAA,WAAG,EAAC,SAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,GAAG,GAAG,WAAW,CAAC,cAAM,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;IAEjE,MAAM,EAAE,GAAiB,EAAE,CAAC;IAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,cAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAChC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,EAAE,cAAc,CAAC,CAAC,CAAE,EAAE,IAAI,CAAC,CAAC,CAAE,EAAE,YAAY,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC;IAC5E,CAAC;IAED,mGAAmG;IACnG,uFAAuF;IACvF,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,IAAI,QAAQ,GAAU,IAAA,WAAG,EAAC,SAAC,EAAE,EAAE,CAAC,CAAC;IACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,cAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAChC,MAAM,CAAC,GAAG,EAAE,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC;QAC1B,KAAK,GAAG,IAAA,iBAAS,EAAC,KAAK,EAAE,IAAA,iBAAS,EAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC;QACzD,QAAQ,GAAG,IAAA,WAAG,EAAC,QAAQ,EAAE,IAAA,WAAG,EAAC,cAAc,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,CAAC,GAAG,IAAA,WAAG,EAAC,IAAA,WAAG,EAAC,SAAC,EAAE,IAAA,WAAG,EAAC,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAC5C,MAAM,CAAC,GAAG,IAAA,WAAG,EAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IAC3B,MAAM,KAAK,GAAG,IAAA,iBAAS,EAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;IAExC,OAAO,EAAE,CAAC,EAAE,cAAM,EAAE,cAAc,EAAE,cAAc,CAAC,GAAG,CAAC,mBAAW,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC;AACjF,CAAC;AAED;;;;GAIG;AACH,SAAgB,YAAY,CAAC,aAAqB,EAAE,IAAe,EAAE,KAAkB;IACrF,IAAI,CAAC;QACH,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC9D,MAAM,EAAE,CAAC,EAAE,cAAc,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;QAC7C,IAAI,CAAC,KAAK,cAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YAAE,OAAO,KAAK,CAAC;QACvF,IAAI,cAAc,CAAC,MAAM,KAAK,cAAM,IAAI,EAAE,CAAC,MAAM,KAAK,cAAM;YAAE,OAAO,KAAK,CAAC;QAC3E,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAE1D,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,IAAI,GAAG,IAAA,mBAAW,EAAC,aAAa,CAAC,CAAC;QACxC,MAAM,CAAC,GAAG,cAAc,CAAC,GAAG,CAAC,mBAAW,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,WAAW,CAAC,cAAM,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAEpD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,cAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAChC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC,CAAE,CAAC;gBAAE,OAAO,KAAK,CAAC;QACtD,CAAC;QAED,IAAI,QAAQ,GAAU,IAAA,WAAG,EAAC,SAAC,EAAE,EAAE,CAAC,CAAC;QACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,cAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAChC,QAAQ,GAAG,IAAA,WAAG,EAAC,QAAQ,EAAE,IAAA,WAAG,EAAC,CAAC,CAAC,CAAC,CAAE,EAAE,EAAE,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,CAAC,GAAG,IAAA,WAAG,EAAC,IAAA,WAAG,EAAC,SAAC,EAAE,IAAA,WAAG,EAAC,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAC5C,MAAM,CAAC,GAAG,IAAA,WAAG,EAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC3B,OAAO,aAAa,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}
+{"version":3,"file":"accumulator.js","sourceRoot":"","sources":["../src/accumulator.ts"],"names":[],"mappings":";;;AAmGA,gCAKC;AAGD,wCAIC;AAGD,wCAQC;AAmLD,kCAiBC;AAQD,oCASC;AAaD,wCAMC;AAGD,0CAOC;AAOD,kDAeC;AAlYD,mCAmBiB;AAEjB;;;;;;;;;;;;;;;;GAgBG;AAEH,8EAA8E;AACjE,QAAA,MAAM,GAAG,EAAE,CAAC;AAMzB,MAAa,gBAAiB,SAAQ,KAAK;IAChC,IAAI,CAAuB;IACpC,YAAY,IAA0B,EAAE,OAAe;QACrD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAPD,4CAOC;AAkCD,SAAS,OAAO,CAAC,CAAY;IAC3B,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC1B,IAAI,CAAC,GAAG,EAAE;YAAE,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,0BAA0B,CAAC,CAAC;QACpF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,4CAA4C,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;AACnB,CAAC;AAED,iGAAiG;AACjG,SAAgB,UAAU,CAAC,IAAe,EAAE,QAAiB;IAC3D,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,MAAM,CAAC,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAA,kBAAU,GAAE,CAAC,CAAC,CAAC,IAAA,WAAG,EAAC,QAAQ,CAAC,CAAC;IAChE,MAAM,CAAC,GAAG,IAAA,WAAG,EAAC,IAAA,WAAG,EAAC,SAAC,EAAE,CAAC,CAAC,EAAE,IAAA,WAAG,EAAC,SAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACpC,OAAO,EAAE,UAAU,EAAE,IAAA,mBAAW,EAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;AACrD,CAAC;AAED,qGAAqG;AACrG,SAAgB,cAAc,CAAC,WAA8B;IAC3D,IAAI,GAAG,GAAG,IAAA,WAAG,EAAC,SAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW;IACjC,KAAK,MAAM,CAAC,IAAI,WAAW;QAAE,GAAG,GAAG,IAAA,WAAG,EAAC,GAAG,EAAE,IAAA,mBAAW,EAAC,CAAC,CAAC,CAAC,CAAC;IAC5D,OAAO,IAAA,mBAAW,EAAC,GAAG,CAAC,CAAC;AAC1B,CAAC;AAED,qGAAqG;AACrG,SAAgB,cAAc,CAAC,UAAkB,EAAE,IAAe,EAAE,QAAgB;IAClF,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QACxB,MAAM,QAAQ,GAAG,IAAA,WAAG,EAAC,IAAA,WAAG,EAAC,SAAC,EAAE,CAAC,CAAC,EAAE,IAAA,WAAG,EAAC,SAAC,EAAE,IAAA,WAAG,EAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QACvD,OAAO,IAAA,mBAAW,EAAC,UAAU,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,0FAA0F;AAE1F,MAAM,UAAU,GAAG,IAAA,YAAI,EAAC,iCAAiC,CAAC,CAAC;AAC3D,MAAM,eAAe,GAAG,IAAA,YAAI,EAAC,qCAAqC,CAAC,CAAC;AACpE,MAAM,SAAS,GAAG,IAAA,YAAI,EAAC,oCAAoC,CAAC,CAAC;AAC7D,MAAM,UAAU,GAAG,IAAA,YAAI,EAAC,iCAAiC,CAAC,CAAC;AAE3D,8FAA8F;AACjF,QAAA,oBAAoB,GAAW,CAAC,EAAE,IAAI,MAAM,CAAC,cAAM,CAAC,CAAC,GAAG,EAAE,CAAC;AAExE;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,SAAiB;IACzC,OAAO,SAAS,GAAG,4BAAoB,CAAC,CAAC,CAAC,4BAAoB,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7E,CAAC;AAED,uFAAuF;AACvF,SAAS,WAAW,CAAC,CAAS,EAAE,SAAiB,EAAE,aAAoB,EAAE,cAAuB;IAC9F,MAAM,KAAK,GAAiB;QAC1B,UAAU;QACV,UAAU,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;QACvB,IAAA,uBAAe,EAAC,IAAA,WAAG,EAAC,SAAS,CAAC,EAAE,EAAE,CAAC;QACnC,aAAa,CAAC,UAAU,EAAE;KAC3B,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,cAAc;QAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;IAC3D,4FAA4F;IAC5F,OAAO,IAAA,uBAAe,EAAC,IAAA,oBAAY,EAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;AAClD,CAAC;AAED,mHAAmH;AACnH,SAAS,eAAe,CAAC,CAAS,EAAE,UAAiB,EAAE,cAAuB;IAC5E,MAAM,KAAK,GAAiB,CAAC,eAAe,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,EAAE,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC;IAChG,KAAK,MAAM,CAAC,IAAI,cAAc;QAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;IAC3D,OAAO,IAAA,uBAAe,EAAC,IAAA,oBAAY,EAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;AAClD,CAAC;AAED,gGAAgG;AAChG,SAAS,QAAQ,CAAC,GAAe,EAAE,KAAa,EAAE,CAAQ,EAAE,CAAS,EAAE,CAAS;IAC9E,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,sCAAsC;IACpD,MAAM,EAAE,GAAG,IAAA,WAAG,EAAC,CAAC,EAAE,SAAC,CAAC,CAAC,CAAC,iCAAiC;IACvD,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAE9B,8DAA8D;IAC9D,MAAM,KAAK,GAAG,IAAA,kBAAU,GAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,IAAA,kBAAU,GAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,IAAA,WAAG,EAAC,IAAA,WAAG,EAAC,SAAC,EAAE,KAAK,CAAC,EAAE,IAAA,WAAG,EAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IAEpD,+CAA+C;IAC/C,MAAM,CAAC,GAAG,IAAA,kBAAU,GAAE,CAAC;IACvB,MAAM,KAAK,GAAG,IAAA,WAAG,EAAC,SAAC,EAAE,CAAC,CAAC,CAAC;IAExB,MAAM,EAAE,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IACtC,MAAM,EAAE,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IACtC,MAAM,CAAC,GAAG,IAAA,oBAAY,EAAC,CAAC,SAAS,EAAE,GAAG,EAAE,UAAU,CAAC,EAAE,CAAC,KAAK,GAAG,IAAI,CAAC,EAAE,EAAE,CAAC,UAAU,EAAE,EAAE,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IACxG,MAAM,KAAK,GAAG,IAAA,iBAAS,EAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,IAAA,iBAAS,EAAC,CAAC,EAAE,IAAA,iBAAS,EAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IAEhD,MAAM,EAAE,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IACtC,MAAM,EAAE,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IACtC,MAAM,EAAE,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IACtC,MAAM,EAAE,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IACtC,OAAO,EAAE,EAAE,EAAE,IAAA,oBAAY,EAAC,EAAE,CAAC,EAAE,EAAE,EAAE,IAAA,oBAAY,EAAC,EAAE,CAAC,EAAE,EAAE,EAAE,IAAA,oBAAY,EAAC,EAAE,CAAC,EAAE,EAAE,EAAE,IAAA,oBAAY,EAAC,EAAE,CAAC,EAAE,CAAC;AACpG,CAAC;AAED,SAAS,SAAS,CAAC,GAAe,EAAE,KAAa,EAAE,CAAQ,EAAE,KAAiB;IAC5E,MAAM,EAAE,GAAG,IAAA,oBAAY,EAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClC,MAAM,EAAE,GAAG,IAAA,oBAAY,EAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClC,MAAM,EAAE,GAAG,IAAA,oBAAY,EAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClC,MAAM,EAAE,GAAG,IAAA,oBAAY,EAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClC,MAAM,EAAE,GAAG,CAAC,CAAC;IACb,MAAM,EAAE,GAAG,IAAA,WAAG,EAAC,CAAC,EAAE,SAAC,CAAC,CAAC;IACrB,MAAM,EAAE,GAAG,IAAA,WAAG,EAAC,IAAA,WAAG,EAAC,SAAC,EAAE,EAAE,CAAC,EAAE,IAAA,WAAG,EAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACxC,MAAM,EAAE,GAAG,IAAA,WAAG,EAAC,IAAA,WAAG,EAAC,SAAC,EAAE,EAAE,CAAC,EAAE,IAAA,WAAG,EAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACxC,MAAM,CAAC,GAAG,IAAA,oBAAY,EAAC,CAAC,SAAS,EAAE,GAAG,EAAE,UAAU,CAAC,EAAE,CAAC,KAAK,GAAG,IAAI,CAAC,EAAE,EAAE,CAAC,UAAU,EAAE,EAAE,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IACxG,OAAO,IAAA,iBAAS,EAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;AACjC,CAAC;AAED,wDAAwD;AACxD,SAAS,YAAY,CAAC,GAAe,EAAE,CAAQ,EAAE,CAAS;IACxD,MAAM,CAAC,GAAG,IAAA,kBAAU,GAAE,CAAC;IACvB,MAAM,CAAC,GAAG,IAAA,WAAG,EAAC,SAAC,EAAE,CAAC,CAAC,CAAC;IACpB,MAAM,CAAC,GAAG,IAAA,oBAAY,EAAC,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IAC1E,MAAM,CAAC,GAAG,IAAA,iBAAS,EAAC,CAAC,EAAE,IAAA,iBAAS,EAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACxC,OAAO,EAAE,CAAC,EAAE,IAAA,mBAAW,EAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAA,oBAAY,EAAC,CAAC,CAAC,EAAE,CAAC;AACnD,CAAC;AAED,SAAS,aAAa,CAAC,GAAe,EAAE,CAAQ,EAAE,KAAmB;IACnE,MAAM,CAAC,GAAG,IAAA,mBAAW,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC/B,MAAM,CAAC,GAAG,IAAA,oBAAY,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAChC,MAAM,CAAC,GAAG,IAAA,oBAAY,EAAC,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IAC1E,OAAO,IAAA,WAAG,EAAC,SAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAA,WAAG,EAAC,CAAC,EAAE,IAAA,WAAG,EAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;GAKG;AACH,SAAS,UAAU,CACjB,OAAsC,EACtC,CAAQ,EACR,KAAa,EACb,KAAa;IAEb,MAAM,IAAI,GAAG,CAAC,EAAE,IAAI,MAAM,CAAC,cAAM,CAAC,CAAC,GAAG,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,KAAK,GAAG,IAAI,CAAC,CAAC,wEAAwE;IAEtG,MAAM,cAAc,GAAY,EAAE,CAAC;IACnC,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,cAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,IAAA,kBAAU,GAAE,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACf,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrB,cAAc,CAAC,IAAI,CAAC,IAAA,WAAG,EAAC,IAAA,WAAG,EAAC,SAAC,EAAE,GAAG,CAAC,EAAE,IAAA,WAAG,EAAC,SAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAEpC,MAAM,EAAE,GAAiB,EAAE,CAAC;IAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,cAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAChC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,EAAE,cAAc,CAAC,CAAC,CAAE,EAAE,IAAI,CAAC,CAAC,CAAE,EAAE,YAAY,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC;IAC5E,CAAC;IAED,6GAA6G;IAC7G,iDAAiD;IACjD,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,IAAI,QAAQ,GAAU,IAAA,WAAG,EAAC,SAAC,EAAE,EAAE,CAAC,CAAC;IACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,cAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAChC,MAAM,CAAC,GAAG,EAAE,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC;QAC1B,KAAK,GAAG,IAAA,iBAAS,EAAC,KAAK,EAAE,IAAA,iBAAS,EAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC;QACzD,QAAQ,GAAG,IAAA,WAAG,EAAC,QAAQ,EAAE,IAAA,WAAG,EAAC,cAAc,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,CAAC,GAAG,IAAA,WAAG,EAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IAC3B,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,EAAE,CAAC,EAAE,IAAA,iBAAS,EAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IAC1D,OAAO,EAAE,cAAc,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC;AACrC,CAAC;AAED,SAAS,WAAW,CAClB,OAAsC,EACtC,CAAQ,EACR,KAAmF;IAEnF,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,EAAE,CAAC,EAAE,cAAc,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;IAC7C,IAAI,CAAC,KAAK,cAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IACvF,IAAI,cAAc,CAAC,MAAM,KAAK,cAAM,IAAI,EAAE,CAAC,MAAM,KAAK,cAAM;QAAE,OAAO,KAAK,CAAC;IAC3E,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAE1D,MAAM,CAAC,GAAG,cAAc,CAAC,GAAG,CAAC,mBAAW,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACvB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,cAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAChC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC,CAAE,CAAC;YAAE,OAAO,KAAK,CAAC;IACtD,CAAC;IACD,IAAI,QAAQ,GAAU,IAAA,WAAG,EAAC,SAAC,EAAE,EAAE,CAAC,CAAC;IACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,cAAM,EAAE,CAAC,EAAE;QAAE,QAAQ,GAAG,IAAA,WAAG,EAAC,QAAQ,EAAE,IAAA,WAAG,EAAC,CAAC,CAAC,CAAC,CAAE,EAAE,EAAE,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvF,OAAO,aAAa,CAAC,GAAG,EAAE,IAAA,WAAG,EAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,WAAW,CAAC,KAA2B,EAAE,SAA4B,EAAE,IAAe;IACpG,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,EAAE,CAAC;QACtC,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,4CAA4C,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAChD,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,OAAO,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACnC,QAAQ,GAAG,IAAA,iBAAS,EAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACrD,CAAC;IACD,6FAA6F;IAC7F,MAAM,IAAI,GAAG,IAAA,WAAG,EAAC,IAAA,WAAG,EAAC,SAAC,EAAE,IAAA,WAAG,EAAC,OAAO,CAAC,CAAC,EAAE,IAAA,WAAG,EAAC,SAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;IACzD,MAAM,CAAC,GAAG,IAAA,WAAG,EAAC,IAAA,WAAG,EAAC,SAAC,EAAE,IAAA,WAAG,EAAC,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,OAAO,GAAG,OAAO,CAAC,CAAC,iCAAiC;IAClE,MAAM,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,cAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,IAAA,WAAG,EAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IACnG,OAAO,EAAE,CAAC,EAAE,cAAM,EAAE,cAAc,EAAE,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,mBAAW,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;AAChG,CAAC;AAED;;;;;GAKG;AACH,SAAgB,YAAY,CAAC,aAAqB,EAAE,IAAe,EAAE,KAAkB;IACrF,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,IAAA,mBAAW,EAAC,aAAa,CAAC,CAAC;QACxC,MAAM,CAAC,GAAG,IAAA,WAAG,EAAC,IAAA,WAAG,EAAC,SAAC,EAAE,IAAA,WAAG,EAAC,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAC1C,OAAO,WAAW,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,cAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;IACnF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAOD;;;;;GAKG;AACH,SAAgB,cAAc,CAAC,IAAe,EAAE,QAAgB;IAC9D,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,MAAM,CAAC,GAAG,IAAA,WAAG,EAAC,QAAQ,CAAC,CAAC;IACxB,MAAM,CAAC,GAAG,IAAA,WAAG,EAAC,IAAA,WAAG,EAAC,SAAC,EAAE,IAAA,WAAG,EAAC,CAAC,CAAC,CAAC,EAAE,IAAA,WAAG,EAAC,SAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACzC,MAAM,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,cAAM,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1E,OAAO,EAAE,CAAC,EAAE,cAAM,EAAE,cAAc,EAAE,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,mBAAW,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;AAChG,CAAC;AAED,8FAA8F;AAC9F,SAAgB,eAAe,CAAC,UAAkB,EAAE,KAAqB;IACvE,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAA,mBAAW,EAAC,UAAU,CAAC,CAAC;QAClC,OAAO,WAAW,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,cAAM,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAgB,mBAAmB,CACjC,WAA8B,EAC9B,WAAsC,EACtC,IAAe,EACf,WAAwB;IAExB,IAAI,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,WAAW,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1H,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5C,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC,CAAW,EAAE,WAAW,CAAC,CAAC,CAAmB,CAAC;gBAAE,OAAO,KAAK,CAAC;QACjG,CAAC;QACD,OAAO,YAAY,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/adapters.d.ts

@@ -23,8 +23,24 @@ export declare function leafIndexForAction(actn: Pick<PCActn, 'counter'>, depth:
  * the integer units the Pedersen accumulator commits to. 1000 = millirisk resolution.
  */
 export declare const RISK_SCALE = 1000;
-/** Quantize a core risk score (any finite r ≥ 0) to non-negative integer accumulator units. */
+/**
+ * Quantize a core risk score (any finite r ≥ 0) to non-negative integer accumulator units, ROUNDING UP
+ * (a nonzero risk is never 0 units; a sum of quantized risks never under-counts the true sum — RT-11).
+ * A value within float noise of an exact unit (e.g. 0.3 * 1000) keeps that unit. Each action may
+ * over-count by < 1 unit; use {@link RiskQuantizer} to carry the remainder instead.
+ */
 export declare function riskToUnits(r: number): RiskUnits;
+/**
+ * Carry-forward quantizer: emits per-action integer units such that the running total of emitted
+ * units is ALWAYS `ceil(Σ true risk * SCALE)` (never below the true cumulative sum, over by < 1 unit
+ * in total instead of per action). Stateful; one instance per budget stream.
+ */
+export declare class RiskQuantizer {
+    private nano;
+    private emitted;
+    next(r: number): bigint;
+    get totalUnits(): bigint;
+}
 /**
  * The accumulator's budget ceiling in integer units, derived from a RiskPolicy. This is exactly the
  * core cumulative-risk safety bound Σrisk ≤ bMax/κ (`safetyBound`), quantized — so the zero-knowledge

package/dist/adapters.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.RISK_SCALE = void 0;
+exports.RiskQuantizer = exports.RISK_SCALE = void 0;
 exports.counterToLeafIndex = counterToLeafIndex;
 exports.leafIndexToCounter = leafIndexToCounter;
 exports.leafIndexForAction = leafIndexForAction;
@@ -53,13 +53,47 @@ function leafIndexForAction(actn, depth) {
  * the integer units the Pedersen accumulator commits to. 1000 = millirisk resolution.
  */
 exports.RISK_SCALE = 1000;
-/** Quantize a core risk score (any finite r ≥ 0) to non-negative integer accumulator units. */
+/**
+ * Quantize a core risk score (any finite r ≥ 0) to non-negative integer accumulator units, ROUNDING UP
+ * (a nonzero risk is never 0 units; a sum of quantized risks never under-counts the true sum — RT-11).
+ * A value within float noise of an exact unit (e.g. 0.3 * 1000) keeps that unit. Each action may
+ * over-count by < 1 unit; use {@link RiskQuantizer} to carry the remainder instead.
+ */
 function riskToUnits(r) {
     if (!Number.isFinite(r) || r < 0) {
         throw new accumulator_1.AccumulatorError('invalid_value', 'risk must be a finite number >= 0');
     }
-    return BigInt(Math.round(r * exports.RISK_SCALE));
+    const v = r * exports.RISK_SCALE;
+    const nearest = Math.round(v);
+    if (Math.abs(v - nearest) <= 1e-9 * Math.max(1, v))
+        return BigInt(nearest);
+    return BigInt(Math.ceil(v));
+}
+const NANO = 1000000n;
+/**
+ * Carry-forward quantizer: emits per-action integer units such that the running total of emitted
+ * units is ALWAYS `ceil(Σ true risk * SCALE)` (never below the true cumulative sum, over by < 1 unit
+ * in total instead of per action). Stateful; one instance per budget stream.
+ */
+class RiskQuantizer {
+    nano = 0n;
+    emitted = 0n;
+    next(r) {
+        if (!Number.isFinite(r) || r < 0) {
+            throw new accumulator_1.AccumulatorError('invalid_value', 'risk must be a finite number >= 0');
+        }
+        // r * SCALE in millionths of a unit, rounded UP so the total can only over-approximate.
+        this.nano += BigInt(Math.ceil(r * exports.RISK_SCALE * 1e6 - 1e-3));
+        const total = (this.nano + NANO - 1n) / NANO;
+        const out = total - this.emitted;
+        this.emitted = total;
+        return out;
+    }
+    get totalUnits() {
+        return this.emitted;
+    }
 }
+exports.RiskQuantizer = RiskQuantizer;
 /**
  * The accumulator's budget ceiling in integer units, derived from a RiskPolicy. This is exactly the
  * core cumulative-risk safety bound Σrisk ≤ bMax/κ (`safetyBound`), quantized — so the zero-knowledge

package/dist/adapters.js.map

@@ -1 +1 @@
-{"version":3,"file":"adapters.js","sourceRoot":"","sources":["../src/adapters.ts"],"names":[],"mappings":";;;AAqBA,gDAWC;AAGD,gDAKC;AAGD,gDAEC;AAWD,kCAKC;AAQD,gDAMC;AA3ED,wCAA2E;AAC3E,+BAA0C;AAC1C,uCAAyC;AACzC,+CAAiE;AAEjE;;;;;;;GAOG;AAEH,yFAAyF;AAEzF;;;;GAIG;AACH,SAAgB,kBAAkB,CAAC,OAAe,EAAE,KAAa;IAC/D,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,uBAAiB,EAAE,CAAC;QACvE,MAAM,IAAI,sBAAY,CAAC,eAAe,EAAE,mCAAmC,uBAAiB,GAAG,CAAC,CAAC;IACnG,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,sBAAY,CAAC,mBAAmB,EAAE,6CAA6C,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,IAAI,sBAAY,CAAC,mBAAmB,EAAE,WAAW,OAAO,mCAAmC,KAAK,EAAE,CAAC,CAAC;IAC5G,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,iGAAiG;AACjG,SAAgB,kBAAkB,CAAC,SAAiB;IAClD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,sBAAY,CAAC,mBAAmB,EAAE,+CAA+C,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,+FAA+F;AAC/F,SAAgB,kBAAkB,CAAC,IAA6B,EAAE,KAAa;IAC7E,OAAO,kBAAkB,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AACjD,CAAC;AAED,yFAAyF;AAEzF;;;GAGG;AACU,QAAA,UAAU,GAAG,IAAI,CAAC;AAE/B,+FAA+F;AAC/F,SAAgB,WAAW,CAAC,CAAS;IACnC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,8BAAgB,CAAC,eAAe,EAAE,mCAAmC,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,kBAAU,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;GAKG;AACH,SAAgB,kBAAkB,CAAC,MAA0C;IAC3E,MAAM,KAAK,GAAG,IAAA,iBAAW,EAAC,MAAM,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,8BAAgB,CAAC,eAAe,EAAE,mDAAmD,CAAC,CAAC;IACnG,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,kBAAU,CAAC,CAAC,CAAC;AAChD,CAAC"}
+{"version":3,"file":"adapters.js","sourceRoot":"","sources":["../src/adapters.ts"],"names":[],"mappings":";;;AAqBA,gDAWC;AAGD,gDAKC;AAGD,gDAEC;AAgBD,kCAQC;AAkCD,gDAMC;AA7GD,wCAA2E;AAC3E,+BAA0C;AAC1C,uCAAyC;AACzC,+CAAiE;AAEjE;;;;;;;GAOG;AAEH,yFAAyF;AAEzF;;;;GAIG;AACH,SAAgB,kBAAkB,CAAC,OAAe,EAAE,KAAa;IAC/D,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,uBAAiB,EAAE,CAAC;QACvE,MAAM,IAAI,sBAAY,CAAC,eAAe,EAAE,mCAAmC,uBAAiB,GAAG,CAAC,CAAC;IACnG,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,sBAAY,CAAC,mBAAmB,EAAE,6CAA6C,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,IAAI,sBAAY,CAAC,mBAAmB,EAAE,WAAW,OAAO,mCAAmC,KAAK,EAAE,CAAC,CAAC;IAC5G,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,iGAAiG;AACjG,SAAgB,kBAAkB,CAAC,SAAiB;IAClD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,sBAAY,CAAC,mBAAmB,EAAE,+CAA+C,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,+FAA+F;AAC/F,SAAgB,kBAAkB,CAAC,IAA6B,EAAE,KAAa;IAC7E,OAAO,kBAAkB,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AACjD,CAAC;AAED,yFAAyF;AAEzF;;;GAGG;AACU,QAAA,UAAU,GAAG,IAAI,CAAC;AAE/B;;;;;GAKG;AACH,SAAgB,WAAW,CAAC,CAAS;IACnC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,8BAAgB,CAAC,eAAe,EAAE,mCAAmC,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,CAAC,GAAG,CAAC,GAAG,kBAAU,CAAC;IACzB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC;IAC3E,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,IAAI,GAAG,QAAU,CAAC;AAExB;;;;GAIG;AACH,MAAa,aAAa;IAChB,IAAI,GAAG,EAAE,CAAC;IACV,OAAO,GAAG,EAAE,CAAC;IACrB,IAAI,CAAC,CAAS;QACZ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,8BAAgB,CAAC,eAAe,EAAE,mCAAmC,CAAC,CAAC;QACnF,CAAC;QACD,wFAAwF;QACxF,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,kBAAU,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC;QAC5D,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC;QAC7C,MAAM,GAAG,GAAG,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC;QACjC,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACrB,OAAO,GAAG,CAAC;IACb,CAAC;IACD,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;CACF;AAjBD,sCAiBC;AAED;;;;;GAKG;AACH,SAAgB,kBAAkB,CAAC,MAA0C;IAC3E,MAAM,KAAK,GAAG,IAAA,iBAAW,EAAC,MAAM,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,8BAAgB,CAAC,eAAe,EAAE,mDAAmD,CAAC,CAAC;IACnG,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,kBAAU,CAAC,CAAC,CAAC;AAChD,CAAC"}

package/dist/binding.d.ts

@@ -0,0 +1,87 @@
+import { type BudgetProof, type RiskRangeProof, type RiskUnits } from './accumulator';
+import { type RatchetSignature } from './ratchet';
+/**
+ * Verifier-side bindings that the stateless primitives cannot give on their own (red-team RT-11):
+ *
+ *  1. {@link verifyLeafSignatureOnce}: a spent-leaf store so a SECOND signature at the same leaf is
+ *     detected (replay) and a different message at the same leaf is flagged as equivocation, with
+ *     both signed digests as evidence. Ed25519 is deterministic and the ratchet holds no
+ *     verifier-extractable secret, so this is DETECTION by the verifier, not key extraction.
+ *  2. {@link issueRiskCommitment} / {@link verifyAttestedBudget}: the risk commitment is created
+ *     by the party that COMPUTES the risk (a risk authority) and signed together with the action
+ *     digest, so a prover cannot commit 0 for a 1.0-risk action or move a commitment between actions.
+ */
+type MaybePromise<T> = T | Promise<T>;
+/** Atomic first-claim store keyed by leaf nullifier. */
+export interface SpentLeafStore {
+    /**
+     * Atomically record `record` under `nullifier` if absent. Resolve `{ first: true }` on first claim,
+     * else `{ first: false, record }` with the record stored earlier.
+     */
+    claim(nullifier: string, record: string): MaybePromise<{
+        first: true;
+    } | {
+        first: false;
+        record: string;
+    }>;
+}
+/** In-process {@link SpentLeafStore}. Per process: use a shared store for a verifier fleet. */
+export declare function memorySpentLeafStore(): SpentLeafStore;
+export type LeafUseResult = {
+    ok: true;
+} | {
+    ok: false;
+    reason: 'invalid';
+} | {
+    ok: false;
+    reason: 'replay';
+    nullifier: string;
+} | {
+    ok: false;
+    reason: 'equivocation';
+    nullifier: string;
+    firstMessageDigest: string;
+    secondMessageDigest: string;
+} | {
+    ok: false;
+    reason: 'store-error';
+};
+/**
+ * Verify a leaf signature AND enforce one-time use at the verifier: the first valid signature at a
+ * leaf is accepted and its message digest recorded; any later signature at that leaf is refused as
+ * `replay` (same message) or `equivocation` (different message, the evidence of a holder that kept an
+ * old state). Fail closed: a store that throws denies.
+ */
+export declare function verifyLeafSignatureOnce(rootCommitment: string, leafIndex: number, message: Uint8Array, signature: RatchetSignature, store: SpentLeafStore): Promise<LeafUseResult>;
+/** A risk authority's signature binding a commitment to one action. */
+export interface RiskAttestation {
+    /** The action (e.g. `pcactnDigest`) this commitment is for. */
+    actionDigest: string;
+    /** b64u Ed25519 signature by the risk authority over (domain, actionDigest, commitment). */
+    sig: string;
+}
+/**
+ * RISK AUTHORITY side: commit to the risk it computed for `actionDigest`, prove the range, and sign
+ * (actionDigest, commitment). Hand `blinding` privately to the prover (needed for the budget proof);
+ * publish `commitment`, `rangeProof`, `attestation`.
+ */
+export declare function issueRiskCommitment(risk: RiskUnits, actionDigest: string, authoritySecretKey: Uint8Array): {
+    commitment: string;
+    blinding: bigint;
+    rangeProof: RiskRangeProof;
+    attestation: RiskAttestation;
+};
+/** Verify one attestation against the risk authority's public key (b64u). Never throws. */
+export declare function verifyRiskAttestation(commitment: string, attestation: RiskAttestation, authorityPublicKey: string): boolean;
+/**
+ * Sound end-to-end budget check over ATTESTED commitments. For the verifier's own list of action
+ * digests (in order), every item must carry a valid authority attestation for exactly that digest and
+ * commitment, then {@link verifyBoundedBudget} must hold. Accepting implies the authority-computed
+ * risks of exactly these actions sum, as integers, to at most `bMax`. Never throws.
+ */
+export declare function verifyAttestedBudget(items: readonly {
+    commitment: string;
+    rangeProof: RiskRangeProof;
+    attestation: RiskAttestation;
+}[], expectedActionDigests: readonly string[], authorityPublicKey: string, bMax: RiskUnits, budgetProof: BudgetProof): boolean;
+export {};

package/dist/binding.js

@@ -0,0 +1,115 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.memorySpentLeafStore = memorySpentLeafStore;
+exports.verifyLeafSignatureOnce = verifyLeafSignatureOnce;
+exports.issueRiskCommitment = issueRiskCommitment;
+exports.verifyRiskAttestation = verifyRiskAttestation;
+exports.verifyAttestedBudget = verifyAttestedBudget;
+const ed25519_1 = require("@noble/curves/ed25519");
+const pca_1 = require("@atlasauth/pca");
+const accumulator_1 = require("./accumulator");
+const ratchet_1 = require("./ratchet");
+const group_1 = require("./group");
+/** In-process {@link SpentLeafStore}. Per process: use a shared store for a verifier fleet. */
+function memorySpentLeafStore() {
+    const seen = new Map();
+    return {
+        claim(nullifier, record) {
+            const prev = seen.get(nullifier);
+            if (prev !== undefined)
+                return { first: false, record: prev };
+            seen.set(nullifier, record);
+            return { first: true };
+        },
+    };
+}
+function messageDigest(leafIndex, message) {
+    return (0, pca_1.b64u)((0, pca_1.sha256)(message)) + '@' + String(leafIndex);
+}
+/**
+ * Verify a leaf signature AND enforce one-time use at the verifier: the first valid signature at a
+ * leaf is accepted and its message digest recorded; any later signature at that leaf is refused as
+ * `replay` (same message) or `equivocation` (different message, the evidence of a holder that kept an
+ * old state). Fail closed: a store that throws denies.
+ */
+async function verifyLeafSignatureOnce(rootCommitment, leafIndex, message, signature, store) {
+    if (!(0, ratchet_1.verifyLeafSignature)(rootCommitment, leafIndex, message, signature))
+        return { ok: false, reason: 'invalid' };
+    const nullifier = (0, ratchet_1.leafNullifier)(rootCommitment, leafIndex);
+    const mine = messageDigest(leafIndex, message);
+    try {
+        const r = await store.claim(nullifier, mine);
+        if (r.first)
+            return { ok: true };
+        if (r.record === mine)
+            return { ok: false, reason: 'replay', nullifier };
+        return { ok: false, reason: 'equivocation', nullifier, firstMessageDigest: r.record, secondMessageDigest: mine };
+    }
+    catch {
+        return { ok: false, reason: 'store-error' };
+    }
+}
+// ---- (2) action-bound risk commitments -------------------------------------------------
+const ATTEST_DOMAIN = (0, group_1.utf8)('atlas-pca-ratchet/risk-attestation/v1\0');
+function attestMessage(actionDigest, commitment) {
+    const a = (0, group_1.utf8)(actionDigest);
+    const c = (0, group_1.utf8)(commitment);
+    const out = new Uint8Array(ATTEST_DOMAIN.length + 4 + a.length + 4 + c.length);
+    const dv = new DataView(out.buffer);
+    out.set(ATTEST_DOMAIN, 0);
+    let o = ATTEST_DOMAIN.length;
+    dv.setUint32(o, a.length, false);
+    out.set(a, o + 4);
+    o += 4 + a.length;
+    dv.setUint32(o, c.length, false);
+    out.set(c, o + 4);
+    return out;
+}
+/**
+ * RISK AUTHORITY side: commit to the risk it computed for `actionDigest`, prove the range, and sign
+ * (actionDigest, commitment). Hand `blinding` privately to the prover (needed for the budget proof);
+ * publish `commitment`, `rangeProof`, `attestation`.
+ */
+function issueRiskCommitment(risk, actionDigest, authoritySecretKey) {
+    const { commitment, blinding } = (0, accumulator_1.commitRisk)(risk);
+    const rangeProof = (0, accumulator_1.proveRiskRange)(risk, blinding);
+    const sig = (0, pca_1.b64u)(ed25519_1.ed25519.sign(attestMessage(actionDigest, commitment), authoritySecretKey));
+    return { commitment, blinding, rangeProof, attestation: { actionDigest, sig } };
+}
+/** Verify one attestation against the risk authority's public key (b64u). Never throws. */
+function verifyRiskAttestation(commitment, attestation, authorityPublicKey) {
+    try {
+        if (attestation === null || typeof attestation !== 'object')
+            return false;
+        if (typeof attestation.actionDigest !== 'string' || typeof attestation.sig !== 'string')
+            return false;
+        return (0, pca_1.verifyB64u)(authorityPublicKey, attestMessage(attestation.actionDigest, commitment), attestation.sig);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Sound end-to-end budget check over ATTESTED commitments. For the verifier's own list of action
+ * digests (in order), every item must carry a valid authority attestation for exactly that digest and
+ * commitment, then {@link verifyBoundedBudget} must hold. Accepting implies the authority-computed
+ * risks of exactly these actions sum, as integers, to at most `bMax`. Never throws.
+ */
+function verifyAttestedBudget(items, expectedActionDigests, authorityPublicKey, bMax, budgetProof) {
+    try {
+        if (!Array.isArray(items) || !Array.isArray(expectedActionDigests) || items.length !== expectedActionDigests.length)
+            return false;
+        for (let i = 0; i < items.length; i++) {
+            const it = items[i];
+            if (it.attestation?.actionDigest !== expectedActionDigests[i])
+                return false;
+            if (!verifyRiskAttestation(it.commitment, it.attestation, authorityPublicKey))
+                return false;
+        }
+        return (0, accumulator_1.verifyBoundedBudget)(items.map((i) => i.commitment), items.map((i) => i.rangeProof), bMax, budgetProof);
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=binding.js.map

package/dist/binding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"binding.js","sourceRoot":"","sources":["../src/binding.ts"],"names":[],"mappings":";;AAuCA,oDAUC;AAmBD,0DAkBC;AAkCD,kDASC;AAGD,sDAQC;AAQD,oDAuBC;AA3KD,mDAAgD;AAChD,wCAA0D;AAC1D,+CAOuB;AACvB,uCAAsF;AACtF,mCAA+B;AA2B/B,+FAA+F;AAC/F,SAAgB,oBAAoB;IAClC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,OAAO;QACL,KAAK,CAAC,SAAS,EAAE,MAAM;YACrB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACjC,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAC9D,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YAC5B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACzB,CAAC;KACF,CAAC;AACJ,CAAC;AASD,SAAS,aAAa,CAAC,SAAiB,EAAE,OAAmB;IAC3D,OAAO,IAAA,UAAI,EAAC,IAAA,YAAM,EAAC,OAAO,CAAC,CAAC,GAAG,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;AACzD,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,uBAAuB,CAC3C,cAAsB,EACtB,SAAiB,EACjB,OAAmB,EACnB,SAA2B,EAC3B,KAAqB;IAErB,IAAI,CAAC,IAAA,6BAAmB,EAAC,cAAc,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACjH,MAAM,SAAS,GAAG,IAAA,uBAAa,EAAC,cAAc,EAAE,SAAS,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,aAAa,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC/C,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,CAAC,KAAK;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACjC,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;QACzE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC;IACnH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC9C,CAAC;AACH,CAAC;AAED,2FAA2F;AAE3F,MAAM,aAAa,GAAG,IAAA,YAAI,EAAC,yCAAyC,CAAC,CAAC;AAUtE,SAAS,aAAa,CAAC,YAAoB,EAAE,UAAkB;IAC7D,MAAM,CAAC,GAAG,IAAA,YAAI,EAAC,YAAY,CAAC,CAAC;IAC7B,MAAM,CAAC,GAAG,IAAA,YAAI,EAAC,UAAU,CAAC,CAAC;IAC3B,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IAC/E,MAAM,EAAE,GAAG,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACpC,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;IAC1B,IAAI,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC;IAC7B,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACjC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IAClB,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACjC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClB,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,SAAgB,mBAAmB,CACjC,IAAe,EACf,YAAoB,EACpB,kBAA8B;IAE9B,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,IAAA,wBAAU,EAAC,IAAI,CAAC,CAAC;IAClD,MAAM,UAAU,GAAG,IAAA,4BAAc,EAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAClD,MAAM,GAAG,GAAG,IAAA,UAAI,EAAC,iBAAO,CAAC,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,UAAU,CAAC,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAC5F,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE,EAAE,CAAC;AAClF,CAAC;AAED,2FAA2F;AAC3F,SAAgB,qBAAqB,CAAC,UAAkB,EAAE,WAA4B,EAAE,kBAA0B;IAChH,IAAI,CAAC;QACH,IAAI,WAAW,KAAK,IAAI,IAAI,OAAO,WAAW,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC1E,IAAI,OAAO,WAAW,CAAC,YAAY,KAAK,QAAQ,IAAI,OAAO,WAAW,CAAC,GAAG,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QACtG,OAAO,IAAA,gBAAU,EAAC,kBAAkB,EAAE,aAAa,CAAC,WAAW,CAAC,YAAY,EAAE,UAAU,CAAC,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC;IAC9G,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAgB,oBAAoB,CAClC,KAAkG,EAClG,qBAAwC,EACxC,kBAA0B,EAC1B,IAAe,EACf,WAAwB;IAExB,IAAI,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,qBAAqB,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,qBAAqB,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAClI,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;YACrB,IAAI,EAAE,CAAC,WAAW,EAAE,YAAY,KAAK,qBAAqB,CAAC,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC5E,IAAI,CAAC,qBAAqB,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,WAAW,EAAE,kBAAkB,CAAC;gBAAE,OAAO,KAAK,CAAC;QAC9F,CAAC;QACD,OAAO,IAAA,iCAAmB,EACxB,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,EAC9B,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,EAC9B,IAAI,EACJ,WAAW,CACZ,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/group.d.ts

@@ -34,7 +34,9 @@ export declare function scalarSub(a: bigint, b: bigint): bigint;
 export declare function scalarMul(a: bigint, b: bigint): bigint;
 /**
  * Scalar multiplication `k·P` that tolerates k ≡ 0 (mod L) by returning the identity —
- * @noble's `multiply` rejects 0 and values ≥ L, so we reduce first and special-case 0.
+ * @noble's `multiply` rejects 0 and values ≥ L, so we reduce first. The multiplication is ALWAYS performed
+ * (by 1 when k ≡ 0) and the identity is selected afterwards, so the cost of the call does not reveal whether a
+ * secret scalar (a risk value, a bit of the slack) is zero.
  */
 export declare function mul(P: Point, k: bigint): Point;
 export declare function add(a: Point, b: Point): Point;
@@ -44,9 +46,13 @@ export declare function randScalar(): bigint;
 export declare function numberToBytesLE(n: bigint, len: number): Uint8Array;
 export declare function bytesToNumberLE(b: Uint8Array): bigint;
 export declare function encodePoint(P: Point): string;
-/** Decode a wire point; throws on a non-canonical / invalid ristretto encoding. */
+/** Decode a wire point; throws on non-canonical base64url, a length other than 32 bytes, or a non-canonical / invalid ristretto encoding. */
 export declare function decodePoint(s: string): Point;
 export declare function encodeScalar(k: bigint): string;
+/**
+ * Decode a wire scalar. Strict: canonical base64url, exactly 32 bytes, value < L. (Reducing instead would make
+ * every proof malleable: s and s + L, ~16 encodings of each scalar, would all verify.) Throws otherwise.
+ */
 export declare function decodeScalar(s: string): bigint;
 /**
  * Length-prefixed concatenation so distinct part sequences can never collide (each part is

package/dist/group.js

@@ -50,11 +50,14 @@ function scalarMul(a, b) {
 }
 /**
  * Scalar multiplication `k·P` that tolerates k ≡ 0 (mod L) by returning the identity —
- * @noble's `multiply` rejects 0 and values ≥ L, so we reduce first and special-case 0.
+ * @noble's `multiply` rejects 0 and values ≥ L, so we reduce first. The multiplication is ALWAYS performed
+ * (by 1 when k ≡ 0) and the identity is selected afterwards, so the cost of the call does not reveal whether a
+ * secret scalar (a risk value, a bit of the slack) is zero.
  */
 function mul(P, k) {
     const s = mod(k);
-    return s === 0n ? exports.ZERO : P.multiply(s);
+    const r = P.multiply(s === 0n ? 1n : s);
+    return s === 0n ? exports.ZERO : r;
 }
 function add(a, b) {
     return a.add(b);
@@ -95,15 +98,28 @@ function bytesToNumberLE(b) {
 function encodePoint(P) {
     return (0, pca_1.b64u)(P.toRawBytes());
 }
-/** Decode a wire point; throws on a non-canonical / invalid ristretto encoding. */
+/** Decode a wire point; throws on non-canonical base64url, a length other than 32 bytes, or a non-canonical / invalid ristretto encoding. */
 function decodePoint(s) {
-    return ed25519_1.RistrettoPoint.fromHex((0, pca_1.unb64u)(s));
+    const bytes = (0, pca_1.decodeB64uStrict)(s, 32);
+    if (bytes === null)
+        throw new RangeError('decodePoint: not a canonical 32-byte base64url string');
+    return ed25519_1.RistrettoPoint.fromHex(bytes);
 }
 function encodeScalar(k) {
     return (0, pca_1.b64u)(numberToBytesLE(mod(k), 32));
 }
+/**
+ * Decode a wire scalar. Strict: canonical base64url, exactly 32 bytes, value < L. (Reducing instead would make
+ * every proof malleable: s and s + L, ~16 encodings of each scalar, would all verify.) Throws otherwise.
+ */
 function decodeScalar(s) {
-    return mod(bytesToNumberLE((0, pca_1.unb64u)(s)));
+    const bytes = (0, pca_1.decodeB64uStrict)(s, 32);
+    if (bytes === null)
+        throw new RangeError('decodeScalar: not a canonical 32-byte base64url string');
+    const v = bytesToNumberLE(bytes);
+    if (v >= exports.L)
+        throw new RangeError('decodeScalar: non-canonical scalar (>= L)');
+    return v;
 }
 // ---- Fiat-Shamir transcript -----------------------------------------------------------
 /**

package/dist/group.js.map

@@ -1 +1 @@
-{"version":3,"file":"group.js","sourceRoot":"","sources":["../src/group.ts"],"names":[],"mappings":";;;AA0CA,kBAGC;AAED,8BAEC;AAED,8BAEC;AAED,8BAEC;AAMD,kBAGC;AAED,kBAEC;AAED,kBAEC;AAGD,gCAKC;AAID,0CAUC;AAED,0CAMC;AAID,kCAEC;AAGD,kCAEC;AAED,oCAEC;AAED,oCAEC;AASD,oCAeC;AAED,oBAEC;AAvJD,mDAAgE;AAChE,6CAA4C;AAC5C,+CAAkD;AAClD,wCAA8C;AAoB9C,gEAAgE;AACnD,QAAA,CAAC,GAAW,iBAAO,CAAC,KAAK,CAAC,CAAC,CAAC;AAEzC,gCAAgC;AACnB,QAAA,CAAC,GAAU,wBAAc,CAAC,IAAI,CAAC;AAE5C,8DAA8D;AACjD,QAAA,IAAI,GAAU,wBAAc,CAAC,IAAI,CAAC;AAE/C,MAAM,OAAO,GAAG,2CAA2C,CAAC;AAE5D;;;;GAIG;AACU,QAAA,CAAC,GAAU,wBAAc,CAAC,WAAW,CAAC,IAAA,aAAM,EAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAE9F,sDAAsD;AACtD,SAAgB,GAAG,CAAC,CAAS;IAC3B,MAAM,CAAC,GAAG,CAAC,GAAG,SAAC,CAAC;IAChB,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,SAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5B,CAAC;AAED,SAAgB,SAAS,CAAC,CAAS,EAAE,CAAS;IAC5C,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AACpB,CAAC;AAED,SAAgB,SAAS,CAAC,CAAS,EAAE,CAAS;IAC5C,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AACpB,CAAC;AAED,SAAgB,SAAS,CAAC,CAAS,EAAE,CAAS;IAC5C,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AACpB,CAAC;AAED;;;GAGG;AACH,SAAgB,GAAG,CAAC,CAAQ,EAAE,CAAS;IACrC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;IACjB,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,YAAI,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,SAAgB,GAAG,CAAC,CAAQ,EAAE,CAAQ;IACpC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,SAAgB,GAAG,CAAC,CAAQ,EAAE,CAAQ;IACpC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AACvB,CAAC;AAED,oDAAoD;AACpD,SAAgB,UAAU;IACxB,SAAS,CAAC;QACR,MAAM,CAAC,GAAG,GAAG,CAAC,eAAe,CAAC,IAAA,mBAAW,EAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK,EAAE;YAAE,OAAO,CAAC,CAAC;IACzB,CAAC;AACH,CAAC;AAED,0FAA0F;AAE1F,SAAgB,eAAe,CAAC,CAAS,EAAE,GAAW;IACpD,IAAI,CAAC,GAAG,EAAE;QAAE,MAAM,IAAI,UAAU,CAAC,2BAA2B,CAAC,CAAC;IAC9D,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;QAC3B,CAAC,KAAK,EAAE,CAAC;IACX,CAAC;IACD,IAAI,CAAC,KAAK,EAAE;QAAE,MAAM,IAAI,UAAU,CAAC,2BAA2B,CAAC,CAAC;IAChE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAgB,eAAe,CAAC,CAAa;IAC3C,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,0FAA0F;AAE1F,SAAgB,WAAW,CAAC,CAAQ;IAClC,OAAO,IAAA,UAAI,EAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;AAC9B,CAAC;AAED,mFAAmF;AACnF,SAAgB,WAAW,CAAC,CAAS;IACnC,OAAO,wBAAc,CAAC,OAAO,CAAC,IAAA,YAAM,EAAC,CAAC,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,SAAgB,YAAY,CAAC,CAAS;IACpC,OAAO,IAAA,UAAI,EAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,SAAgB,YAAY,CAAC,CAAS;IACpC,OAAO,GAAG,CAAC,eAAe,CAAC,IAAA,YAAM,EAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,0FAA0F;AAE1F;;;;GAIG;AACH,SAAgB,YAAY,CAAC,KAAmB;IAC9C,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,KAAK,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;QAClC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;QACtC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC;QACrC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,IAAI,CAAC;QAC7B,CAAC,IAAI,CAAC,CAAC;QACP,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACd,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,GAAG,CAAC,eAAe,CAAC,IAAA,aAAM,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,SAAgB,IAAI,CAAC,CAAS;IAC5B,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACrC,CAAC"}
+{"version":3,"file":"group.js","sourceRoot":"","sources":["../src/group.ts"],"names":[],"mappings":";;;AA0CA,kBAGC;AAED,8BAEC;AAED,8BAEC;AAED,8BAEC;AAQD,kBAIC;AAED,kBAEC;AAED,kBAEC;AAGD,gCAKC;AAID,0CAUC;AAED,0CAMC;AAID,kCAEC;AAGD,kCAIC;AAED,oCAEC;AAMD,oCAMC;AASD,oCAeC;AAED,oBAEC;AApKD,mDAAgE;AAChE,6CAA4C;AAC5C,+CAAkD;AAClD,wCAAwD;AAoBxD,gEAAgE;AACnD,QAAA,CAAC,GAAW,iBAAO,CAAC,KAAK,CAAC,CAAC,CAAC;AAEzC,gCAAgC;AACnB,QAAA,CAAC,GAAU,wBAAc,CAAC,IAAI,CAAC;AAE5C,8DAA8D;AACjD,QAAA,IAAI,GAAU,wBAAc,CAAC,IAAI,CAAC;AAE/C,MAAM,OAAO,GAAG,2CAA2C,CAAC;AAE5D;;;;GAIG;AACU,QAAA,CAAC,GAAU,wBAAc,CAAC,WAAW,CAAC,IAAA,aAAM,EAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAE9F,sDAAsD;AACtD,SAAgB,GAAG,CAAC,CAAS;IAC3B,MAAM,CAAC,GAAG,CAAC,GAAG,SAAC,CAAC;IAChB,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,SAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5B,CAAC;AAED,SAAgB,SAAS,CAAC,CAAS,EAAE,CAAS;IAC5C,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AACpB,CAAC;AAED,SAAgB,SAAS,CAAC,CAAS,EAAE,CAAS;IAC5C,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AACpB,CAAC;AAED,SAAgB,SAAS,CAAC,CAAS,EAAE,CAAS;IAC5C,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AACpB,CAAC;AAED;;;;;GAKG;AACH,SAAgB,GAAG,CAAC,CAAQ,EAAE,CAAS;IACrC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;IACjB,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,YAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED,SAAgB,GAAG,CAAC,CAAQ,EAAE,CAAQ;IACpC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,SAAgB,GAAG,CAAC,CAAQ,EAAE,CAAQ;IACpC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AACvB,CAAC;AAED,oDAAoD;AACpD,SAAgB,UAAU;IACxB,SAAS,CAAC;QACR,MAAM,CAAC,GAAG,GAAG,CAAC,eAAe,CAAC,IAAA,mBAAW,EAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK,EAAE;YAAE,OAAO,CAAC,CAAC;IACzB,CAAC;AACH,CAAC;AAED,0FAA0F;AAE1F,SAAgB,eAAe,CAAC,CAAS,EAAE,GAAW;IACpD,IAAI,CAAC,GAAG,EAAE;QAAE,MAAM,IAAI,UAAU,CAAC,2BAA2B,CAAC,CAAC;IAC9D,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;QAC3B,CAAC,KAAK,EAAE,CAAC;IACX,CAAC;IACD,IAAI,CAAC,KAAK,EAAE;QAAE,MAAM,IAAI,UAAU,CAAC,2BAA2B,CAAC,CAAC;IAChE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAgB,eAAe,CAAC,CAAa;IAC3C,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,0FAA0F;AAE1F,SAAgB,WAAW,CAAC,CAAQ;IAClC,OAAO,IAAA,UAAI,EAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;AAC9B,CAAC;AAED,6IAA6I;AAC7I,SAAgB,WAAW,CAAC,CAAS;IACnC,MAAM,KAAK,GAAG,IAAA,sBAAgB,EAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACtC,IAAI,KAAK,KAAK,IAAI;QAAE,MAAM,IAAI,UAAU,CAAC,uDAAuD,CAAC,CAAC;IAClG,OAAO,wBAAc,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AACvC,CAAC;AAED,SAAgB,YAAY,CAAC,CAAS;IACpC,OAAO,IAAA,UAAI,EAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,SAAgB,YAAY,CAAC,CAAS;IACpC,MAAM,KAAK,GAAG,IAAA,sBAAgB,EAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACtC,IAAI,KAAK,KAAK,IAAI;QAAE,MAAM,IAAI,UAAU,CAAC,wDAAwD,CAAC,CAAC;IACnG,MAAM,CAAC,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,CAAC,IAAI,SAAC;QAAE,MAAM,IAAI,UAAU,CAAC,2CAA2C,CAAC,CAAC;IAC9E,OAAO,CAAC,CAAC;AACX,CAAC;AAED,0FAA0F;AAE1F;;;;GAIG;AACH,SAAgB,YAAY,CAAC,KAAmB;IAC9C,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,KAAK,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;QAClC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;QACtC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC;QACrC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,IAAI,CAAC;QAC7B,CAAC,IAAI,CAAC,CAAC;QACP,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACd,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,GAAG,CAAC,eAAe,CAAC,IAAA,aAAM,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,SAAgB,IAAI,CAAC,CAAS;IAC5B,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACrC,CAAC"}

package/dist/index.d.ts

@@ -14,7 +14,8 @@
  * adapters.ts binds both to the @atlasauth/pca core (PCActn.counter, RiskPolicy budget) without
  * modifying it.
  */
-export { type RatchetErrorCode, type RatchetSignature, type RatchetState, RatchetError, deriveRatchetRoot, signAtLeaf, verifyLeafSignature, availableLeaves, isLeafAvailable, } from './ratchet';
+export { type RatchetErrorCode, type RatchetSignature, type RatchetState, RatchetError, deriveRatchetRoot, signAtLeaf, verifyLeafSignature, leafNullifier, availableLeaves, isLeafAvailable, } from './ratchet';
 export { MAX_RATCHET_DEPTH } from './ggm';
-export { type AccumulatorErrorCode, type RiskUnits, type RiskCommitment, type BitOrProof, type SchnorrProof, type BudgetProof, N_BITS, AccumulatorError, commitRisk, addCommitments, openCommitment, proveBudget, verifyBudget, } from './accumulator';
-export { RISK_SCALE, counterToLeafIndex, leafIndexToCounter, leafIndexForAction, riskToUnits, budgetCeilingUnits, } from './adapters';
+export { type AccumulatorErrorCode, type RiskUnits, type RiskCommitment, type BitOrProof, type SchnorrProof, type BudgetProof, N_BITS, MAX_PROVABLE_CEILING, type RiskRangeProof, AccumulatorError, commitRisk, addCommitments, openCommitment, proveBudget, verifyBudget, proveRiskRange, verifyRiskRange, verifyBoundedBudget, } from './accumulator';
+export { RISK_SCALE, counterToLeafIndex, leafIndexToCounter, leafIndexForAction, riskToUnits, RiskQuantizer, budgetCeilingUnits, } from './adapters';
+export { type SpentLeafStore, type LeafUseResult, type RiskAttestation, memorySpentLeafStore, verifyLeafSignatureOnce, issueRiskCommitment, verifyRiskAttestation, verifyAttestedBudget, } from './binding';

package/dist/index.js

@@ -16,29 +16,41 @@
  * modifying it.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.budgetCeilingUnits = exports.riskToUnits = exports.leafIndexForAction = exports.leafIndexToCounter = exports.counterToLeafIndex = exports.RISK_SCALE = exports.verifyBudget = exports.proveBudget = exports.openCommitment = exports.addCommitments = exports.commitRisk = exports.AccumulatorError = exports.N_BITS = exports.MAX_RATCHET_DEPTH = exports.isLeafAvailable = exports.availableLeaves = exports.verifyLeafSignature = exports.signAtLeaf = exports.deriveRatchetRoot = exports.RatchetError = void 0;
+exports.verifyAttestedBudget = exports.verifyRiskAttestation = exports.issueRiskCommitment = exports.verifyLeafSignatureOnce = exports.memorySpentLeafStore = exports.budgetCeilingUnits = exports.RiskQuantizer = exports.riskToUnits = exports.leafIndexForAction = exports.leafIndexToCounter = exports.counterToLeafIndex = exports.RISK_SCALE = exports.verifyBoundedBudget = exports.verifyRiskRange = exports.proveRiskRange = exports.verifyBudget = exports.proveBudget = exports.openCommitment = exports.addCommitments = exports.commitRisk = exports.AccumulatorError = exports.MAX_PROVABLE_CEILING = exports.N_BITS = exports.MAX_RATCHET_DEPTH = exports.isLeafAvailable = exports.availableLeaves = exports.leafNullifier = exports.verifyLeafSignature = exports.signAtLeaf = exports.deriveRatchetRoot = exports.RatchetError = void 0;
 var ratchet_1 = require("./ratchet");
 Object.defineProperty(exports, "RatchetError", { enumerable: true, get: function () { return ratchet_1.RatchetError; } });
 Object.defineProperty(exports, "deriveRatchetRoot", { enumerable: true, get: function () { return ratchet_1.deriveRatchetRoot; } });
 Object.defineProperty(exports, "signAtLeaf", { enumerable: true, get: function () { return ratchet_1.signAtLeaf; } });
 Object.defineProperty(exports, "verifyLeafSignature", { enumerable: true, get: function () { return ratchet_1.verifyLeafSignature; } });
+Object.defineProperty(exports, "leafNullifier", { enumerable: true, get: function () { return ratchet_1.leafNullifier; } });
 Object.defineProperty(exports, "availableLeaves", { enumerable: true, get: function () { return ratchet_1.availableLeaves; } });
 Object.defineProperty(exports, "isLeafAvailable", { enumerable: true, get: function () { return ratchet_1.isLeafAvailable; } });
 var ggm_1 = require("./ggm");
 Object.defineProperty(exports, "MAX_RATCHET_DEPTH", { enumerable: true, get: function () { return ggm_1.MAX_RATCHET_DEPTH; } });
 var accumulator_1 = require("./accumulator");
 Object.defineProperty(exports, "N_BITS", { enumerable: true, get: function () { return accumulator_1.N_BITS; } });
+Object.defineProperty(exports, "MAX_PROVABLE_CEILING", { enumerable: true, get: function () { return accumulator_1.MAX_PROVABLE_CEILING; } });
 Object.defineProperty(exports, "AccumulatorError", { enumerable: true, get: function () { return accumulator_1.AccumulatorError; } });
 Object.defineProperty(exports, "commitRisk", { enumerable: true, get: function () { return accumulator_1.commitRisk; } });
 Object.defineProperty(exports, "addCommitments", { enumerable: true, get: function () { return accumulator_1.addCommitments; } });
 Object.defineProperty(exports, "openCommitment", { enumerable: true, get: function () { return accumulator_1.openCommitment; } });
 Object.defineProperty(exports, "proveBudget", { enumerable: true, get: function () { return accumulator_1.proveBudget; } });
 Object.defineProperty(exports, "verifyBudget", { enumerable: true, get: function () { return accumulator_1.verifyBudget; } });
+Object.defineProperty(exports, "proveRiskRange", { enumerable: true, get: function () { return accumulator_1.proveRiskRange; } });
+Object.defineProperty(exports, "verifyRiskRange", { enumerable: true, get: function () { return accumulator_1.verifyRiskRange; } });
+Object.defineProperty(exports, "verifyBoundedBudget", { enumerable: true, get: function () { return accumulator_1.verifyBoundedBudget; } });
 var adapters_1 = require("./adapters");
 Object.defineProperty(exports, "RISK_SCALE", { enumerable: true, get: function () { return adapters_1.RISK_SCALE; } });
 Object.defineProperty(exports, "counterToLeafIndex", { enumerable: true, get: function () { return adapters_1.counterToLeafIndex; } });
 Object.defineProperty(exports, "leafIndexToCounter", { enumerable: true, get: function () { return adapters_1.leafIndexToCounter; } });
 Object.defineProperty(exports, "leafIndexForAction", { enumerable: true, get: function () { return adapters_1.leafIndexForAction; } });
 Object.defineProperty(exports, "riskToUnits", { enumerable: true, get: function () { return adapters_1.riskToUnits; } });
+Object.defineProperty(exports, "RiskQuantizer", { enumerable: true, get: function () { return adapters_1.RiskQuantizer; } });
 Object.defineProperty(exports, "budgetCeilingUnits", { enumerable: true, get: function () { return adapters_1.budgetCeilingUnits; } });
+var binding_1 = require("./binding");
+Object.defineProperty(exports, "memorySpentLeafStore", { enumerable: true, get: function () { return binding_1.memorySpentLeafStore; } });
+Object.defineProperty(exports, "verifyLeafSignatureOnce", { enumerable: true, get: function () { return binding_1.verifyLeafSignatureOnce; } });
+Object.defineProperty(exports, "issueRiskCommitment", { enumerable: true, get: function () { return binding_1.issueRiskCommitment; } });
+Object.defineProperty(exports, "verifyRiskAttestation", { enumerable: true, get: function () { return binding_1.verifyRiskAttestation; } });
+Object.defineProperty(exports, "verifyAttestedBudget", { enumerable: true, get: function () { return binding_1.verifyAttestedBudget; } });
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;;AAEH,qCAUmB;AANjB,uGAAA,YAAY,OAAA;AACZ,4GAAA,iBAAiB,OAAA;AACjB,qGAAA,UAAU,OAAA;AACV,8GAAA,mBAAmB,OAAA;AACnB,0GAAA,eAAe,OAAA;AACf,0GAAA,eAAe,OAAA;AAGjB,6BAA0C;AAAjC,wGAAA,iBAAiB,OAAA;AAE1B,6CAcuB;AAPrB,qGAAA,MAAM,OAAA;AACN,+GAAA,gBAAgB,OAAA;AAChB,yGAAA,UAAU,OAAA;AACV,6GAAA,cAAc,OAAA;AACd,6GAAA,cAAc,OAAA;AACd,0GAAA,WAAW,OAAA;AACX,2GAAA,YAAY,OAAA;AAGd,uCAOoB;AANlB,sGAAA,UAAU,OAAA;AACV,8GAAA,kBAAkB,OAAA;AAClB,8GAAA,kBAAkB,OAAA;AAClB,8GAAA,kBAAkB,OAAA;AAClB,uGAAA,WAAW,OAAA;AACX,8GAAA,kBAAkB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;;AAEH,qCAWmB;AAPjB,uGAAA,YAAY,OAAA;AACZ,4GAAA,iBAAiB,OAAA;AACjB,qGAAA,UAAU,OAAA;AACV,8GAAA,mBAAmB,OAAA;AACnB,wGAAA,aAAa,OAAA;AACb,0GAAA,eAAe,OAAA;AACf,0GAAA,eAAe,OAAA;AAGjB,6BAA0C;AAAjC,wGAAA,iBAAiB,OAAA;AAE1B,6CAmBuB;AAZrB,qGAAA,MAAM,OAAA;AACN,mHAAA,oBAAoB,OAAA;AAEpB,+GAAA,gBAAgB,OAAA;AAChB,yGAAA,UAAU,OAAA;AACV,6GAAA,cAAc,OAAA;AACd,6GAAA,cAAc,OAAA;AACd,0GAAA,WAAW,OAAA;AACX,2GAAA,YAAY,OAAA;AACZ,6GAAA,cAAc,OAAA;AACd,8GAAA,eAAe,OAAA;AACf,kHAAA,mBAAmB,OAAA;AAGrB,uCAQoB;AAPlB,sGAAA,UAAU,OAAA;AACV,8GAAA,kBAAkB,OAAA;AAClB,8GAAA,kBAAkB,OAAA;AAClB,8GAAA,kBAAkB,OAAA;AAClB,uGAAA,WAAW,OAAA;AACX,yGAAA,aAAa,OAAA;AACb,8GAAA,kBAAkB,OAAA;AAGpB,qCASmB;AALjB,+GAAA,oBAAoB,OAAA;AACpB,kHAAA,uBAAuB,OAAA;AACvB,8GAAA,mBAAmB,OAAA;AACnB,gHAAA,qBAAqB,OAAA;AACrB,+GAAA,oBAAoB,OAAA"}

package/dist/ratchet.d.ts

@@ -23,6 +23,13 @@ export interface RatchetSignature {
     leafPubKey: string;
     /** Merkle inclusion proof that `leafPubKey` is the leaf at this index under the root commitment. */
     merklePath: InclusionProof;
+    /**
+     * b64u nullifier of the spent leaf: `H(domain ‖ rootCommitment ‖ leafIndex)`. A verifier recomputes it
+     * ({@link leafNullifier}) and records it in a {@link SpentLeafStore} (see `verifyLeafSignatureOnce`)
+     * so a second signature at the same leaf is DETECTED (RT-11). The ratchet alone cannot stop a
+     * holder who kept the old state; only a verifier-side spent set can.
+     */
+    nullifier: string;
 }
 /**
  * The live ratchet. `leafPubKeys` are public (safe to retain; needed to build Merkle proofs).
@@ -36,6 +43,8 @@ export interface RatchetState {
     readonly leafPubKeys: readonly string[];
     readonly covering: ReadonlyMap<string, CoverNode>;
 }
+/** The per-leaf nullifier a verifier records to detect leaf reuse: `b64u(sha256(domain ‖ lp(root) ‖ index))`. */
+export declare function leafNullifier(rootCommitment: string, leafIndex: number): string;
 /**
  * Build a ratchet from a root `seed` (≥ 32 bytes of entropy) and tree `depth`. Returns the public
  * `rootCommitment` (a Merkle root over all 2^depth leaf public keys) and the live `state`.

package/dist/ratchet.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.RatchetError = void 0;
+exports.leafNullifier = leafNullifier;
 exports.deriveRatchetRoot = deriveRatchetRoot;
 exports.signAtLeaf = signAtLeaf;
 exports.verifyLeafSignature = verifyLeafSignature;
@@ -9,6 +10,7 @@ exports.isLeafAvailable = isLeafAvailable;
 const ed25519_1 = require("@noble/curves/ed25519");
 const pca_1 = require("@atlasauth/pca");
 const ggm_1 = require("./ggm");
+const pca_2 = require("@atlasauth/pca");
 const group_1 = require("./group");
 class RatchetError extends Error {
     code;
@@ -19,6 +21,17 @@ class RatchetError extends Error {
     }
 }
 exports.RatchetError = RatchetError;
+const NULLIFIER_DOMAIN = (0, group_1.utf8)('atlas-pca-ratchet/nullifier/v1\0');
+/** The per-leaf nullifier a verifier records to detect leaf reuse: `b64u(sha256(domain ‖ lp(root) ‖ index))`. */
+function leafNullifier(rootCommitment, leafIndex) {
+    const root = (0, group_1.utf8)(rootCommitment);
+    const out = new Uint8Array(NULLIFIER_DOMAIN.length + 4 + root.length + 8);
+    out.set(NULLIFIER_DOMAIN, 0);
+    new DataView(out.buffer).setUint32(NULLIFIER_DOMAIN.length, root.length, false);
+    out.set(root, NULLIFIER_DOMAIN.length + 4);
+    new DataView(out.buffer).setBigUint64(NULLIFIER_DOMAIN.length + 4 + root.length, BigInt(leafIndex), false);
+    return (0, pca_1.b64u)((0, pca_2.sha256)(out));
+}
 const SIG_DOMAIN = (0, group_1.utf8)('atlas-pca-ratchet/leaf-sig/v1\0');
 /** Domain-separated signed message: binds the leaf index so a signature cannot be lifted elsewhere. */
 function leafSigMessage(leafIndex, message) {
@@ -87,7 +100,7 @@ function signAtLeaf(state, leafIndex, message) {
         covering.set((0, ggm_1.coverKey)(sib.level, sib.nodeIndex), sib);
     }
     return {
-        signature: { edSig, leafPubKey, merklePath },
+        signature: { edSig, leafPubKey, merklePath, nullifier: leafNullifier(state.rootCommitment, leafIndex) },
         newState: { ...state, covering },
     };
 }
@@ -100,7 +113,9 @@ function verifyLeafSignature(rootCommitment, leafIndex, message, signature) {
     try {
         if (signature === null || typeof signature !== 'object')
             return false;
-        const { edSig, leafPubKey, merklePath } = signature;
+        const { edSig, leafPubKey, merklePath, nullifier } = signature;
+        if (typeof nullifier !== 'string' || nullifier !== leafNullifier(rootCommitment, leafIndex))
+            return false;
         if (typeof edSig !== 'string' || typeof leafPubKey !== 'string' || merklePath === null || typeof merklePath !== 'object') {
             return false;
         }

package/dist/ratchet.js.map

@@ -1 +1 @@
-{"version":3,"file":"ratchet.js","sourceRoot":"","sources":["../src/ratchet.ts"],"names":[],"mappings":";;;AA6FA,8CAeC;AAeD,gCA6BC;AAOD,kDAkBC;AAGD,0CAQC;AAGD,0CAEC;AAjMD,mDAAgD;AAChD,wCAOwB;AACxB,+BAWe;AACf,mCAA+B;AAmB/B,MAAa,YAAa,SAAQ,KAAK;IAC5B,IAAI,CAAmB;IAChC,YAAY,IAAsB,EAAE,OAAe;QACjD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;QAC3B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAPD,oCAOC;AAyBD,MAAM,UAAU,GAAG,IAAA,YAAI,EAAC,iCAAiC,CAAC,CAAC;AAE3D,uGAAuG;AACvG,SAAS,cAAc,CAAC,SAAiB,EAAE,OAAmB;IAC5D,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;QAC3B,CAAC,KAAK,EAAE,CAAC;IACX,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACnE,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IACvB,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IAChC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACxC,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,SAAgB,iBAAiB,CAAC,IAAgB,EAAE,KAAa;IAC/D,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,uBAAiB,EAAE,CAAC;QACvE,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,mCAAmC,uBAAiB,GAAG,CAAC,CAAC;IACnG,CAAC;IACD,IAAI,CAAC,CAAC,IAAI,YAAY,UAAU,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACtD,MAAM,IAAI,YAAY,CAAC,cAAc,EAAE,gDAAgD,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,IAAI,GAAG,IAAA,cAAQ,EAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,WAAW,GAAG,IAAA,uBAAiB,EAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACnD,MAAM,cAAc,GAAG,IAAA,gBAAU,EAAC,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAoB,CAAC,CAAC,IAAA,cAAQ,EAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACxG,OAAO;QACL,cAAc;QACd,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,IAAI,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,QAAQ,EAAE;KAC/E,CAAC;AACJ,CAAC;AAED,qGAAqG;AACrG,SAAS,YAAY,CAAC,KAAmB,EAAE,SAAiB;IAC1D,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QAC3C,IAAI,IAAA,YAAM,EAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;IAC9E,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,SAAgB,UAAU,CACxB,KAAmB,EACnB,SAAiB,EACjB,OAAmB;IAEnB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,IAAI,SAAS,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QAClF,MAAM,IAAI,YAAY,CAAC,mBAAmB,EAAE,QAAQ,SAAS,wBAAwB,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;IAC3G,CAAC;IACD,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAC5C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,YAAY,CAAC,gBAAgB,EAAE,QAAQ,SAAS,+CAA+C,CAAC,CAAC;IAC7G,CAAC;IACD,MAAM,QAAQ,GAAG,IAAA,oBAAc,EAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC9D,MAAM,WAAW,GAAG,IAAA,qBAAe,EAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,IAAA,UAAI,EAAC,iBAAO,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC;IAClF,MAAM,UAAU,GAAG,IAAA,mBAAa,EAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAG,IAAA,iBAAW,EAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAErE,uGAAuG;IACvG,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACzC,QAAQ,CAAC,MAAM,CAAC,IAAA,cAAQ,EAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IACtD,KAAK,MAAM,GAAG,IAAI,IAAA,sBAAgB,EAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACjE,QAAQ,CAAC,GAAG,CAAC,IAAA,cAAQ,EAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC;IACxD,CAAC;IAED,OAAO;QACL,SAAS,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE;QAC5C,QAAQ,EAAE,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE;KACjC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAgB,mBAAmB,CACjC,cAAsB,EACtB,SAAiB,EACjB,OAAmB,EACnB,SAA2B;IAE3B,IAAI,CAAC;QACH,IAAI,SAAS,KAAK,IAAI,IAAI,OAAO,SAAS,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QACtE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,SAAS,CAAC;QACpD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,IAAI,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;YACzH,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,UAAU,CAAC,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACjD,IAAI,CAAC,IAAA,gBAAU,EAAC,UAAU,EAAE,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACrF,OAAO,IAAA,qBAAe,EAAC,cAAc,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,SAAgB,eAAe,CAAC,KAAmB;IACjD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE;YAAE,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AACnC,CAAC;AAED,+CAA+C;AAC/C,SAAgB,eAAe,CAAC,KAAmB,EAAE,SAAiB;IACpE,OAAO,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC,KAAK,SAAS,CAAC;AACtD,CAAC"}
+{"version":3,"file":"ratchet.js","sourceRoot":"","sources":["../src/ratchet.ts"],"names":[],"mappings":";;;AAmFA,sCAQC;AAuBD,8CAeC;AAeD,gCA6BC;AAOD,kDAmBC;AAGD,0CAQC;AAGD,0CAEC;AAvND,mDAAgD;AAChD,wCAOwB;AACxB,+BAWe;AACf,wCAAwC;AACxC,mCAA+B;AAmB/B,MAAa,YAAa,SAAQ,KAAK;IAC5B,IAAI,CAAmB;IAChC,YAAY,IAAsB,EAAE,OAAe;QACjD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;QAC3B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAPD,oCAOC;AAgCD,MAAM,gBAAgB,GAAG,IAAA,YAAI,EAAC,kCAAkC,CAAC,CAAC;AAElE,iHAAiH;AACjH,SAAgB,aAAa,CAAC,cAAsB,EAAE,SAAiB;IACrE,MAAM,IAAI,GAAG,IAAA,YAAI,EAAC,cAAc,CAAC,CAAC;IAClC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC1E,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC;IAC7B,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAChF,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC3C,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,CAAC;IAC3G,OAAO,IAAA,UAAI,EAAC,IAAA,YAAM,EAAC,GAAG,CAAC,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,GAAG,IAAA,YAAI,EAAC,iCAAiC,CAAC,CAAC;AAE3D,uGAAuG;AACvG,SAAS,cAAc,CAAC,SAAiB,EAAE,OAAmB;IAC5D,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;QAC3B,CAAC,KAAK,EAAE,CAAC;IACX,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACnE,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IACvB,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IAChC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACxC,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,SAAgB,iBAAiB,CAAC,IAAgB,EAAE,KAAa;IAC/D,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,uBAAiB,EAAE,CAAC;QACvE,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,mCAAmC,uBAAiB,GAAG,CAAC,CAAC;IACnG,CAAC;IACD,IAAI,CAAC,CAAC,IAAI,YAAY,UAAU,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACtD,MAAM,IAAI,YAAY,CAAC,cAAc,EAAE,gDAAgD,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,IAAI,GAAG,IAAA,cAAQ,EAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,WAAW,GAAG,IAAA,uBAAiB,EAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACnD,MAAM,cAAc,GAAG,IAAA,gBAAU,EAAC,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAoB,CAAC,CAAC,IAAA,cAAQ,EAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACxG,OAAO;QACL,cAAc;QACd,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,IAAI,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,QAAQ,EAAE;KAC/E,CAAC;AACJ,CAAC;AAED,qGAAqG;AACrG,SAAS,YAAY,CAAC,KAAmB,EAAE,SAAiB;IAC1D,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QAC3C,IAAI,IAAA,YAAM,EAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;IAC9E,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,SAAgB,UAAU,CACxB,KAAmB,EACnB,SAAiB,EACjB,OAAmB;IAEnB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,IAAI,SAAS,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QAClF,MAAM,IAAI,YAAY,CAAC,mBAAmB,EAAE,QAAQ,SAAS,wBAAwB,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;IAC3G,CAAC;IACD,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAC5C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,YAAY,CAAC,gBAAgB,EAAE,QAAQ,SAAS,+CAA+C,CAAC,CAAC;IAC7G,CAAC;IACD,MAAM,QAAQ,GAAG,IAAA,oBAAc,EAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC9D,MAAM,WAAW,GAAG,IAAA,qBAAe,EAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,IAAA,UAAI,EAAC,iBAAO,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC;IAClF,MAAM,UAAU,GAAG,IAAA,mBAAa,EAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAG,IAAA,iBAAW,EAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAErE,uGAAuG;IACvG,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACzC,QAAQ,CAAC,MAAM,CAAC,IAAA,cAAQ,EAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IACtD,KAAK,MAAM,GAAG,IAAI,IAAA,sBAAgB,EAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACjE,QAAQ,CAAC,GAAG,CAAC,IAAA,cAAQ,EAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC;IACxD,CAAC;IAED,OAAO;QACL,SAAS,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,CAAC,KAAK,CAAC,cAAc,EAAE,SAAS,CAAC,EAAE;QACvG,QAAQ,EAAE,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE;KACjC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAgB,mBAAmB,CACjC,cAAsB,EACtB,SAAiB,EACjB,OAAmB,EACnB,SAA2B;IAE3B,IAAI,CAAC;QACH,IAAI,SAAS,KAAK,IAAI,IAAI,OAAO,SAAS,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QACtE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,SAAS,CAAC;QAC/D,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,aAAa,CAAC,cAAc,EAAE,SAAS,CAAC;YAAE,OAAO,KAAK,CAAC;QAC1G,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,IAAI,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;YACzH,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,UAAU,CAAC,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACjD,IAAI,CAAC,IAAA,gBAAU,EAAC,UAAU,EAAE,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACrF,OAAO,IAAA,qBAAe,EAAC,cAAc,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,SAAgB,eAAe,CAAC,KAAmB;IACjD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE;YAAE,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AACnC,CAAC;AAED,+CAA+C;AAC/C,SAAgB,eAAe,CAAC,KAAmB,EAAE,SAAiB;IACpE,OAAO,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC,KAAK,SAAS,CAAC;AACtD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atlasauth/pca-ratchet",
-  "version": "0.3.0",
+  "version": "0.4.1",
   "description": "PCA Capability Ratchet: puncturable forward-secure capability keys (cryptographic one-time-use — a spent action can never be re-signed) plus a homomorphic Pedersen risk accumulator for zero-knowledge proof of the Sigma-risk <= budget ceiling across a delegation chain.",
   "keywords": [
     "forward secrecy",
@@ -34,9 +34,10 @@
   "dependencies": {
     "@noble/curves": "^1.6.0",
     "@noble/hashes": "^1.5.0",
-    "@atlasauth/pca": "0.3.0"
+    "@atlasauth/pca": "0.4.1"
   },
   "devDependencies": {
+    "fast-check": "^3.23.1",
     "typescript": "^5.6.3",
     "vitest": "^2.1.4"
   },