@bcts/shamir 1.0.0-alpha.5

package/LICENSE

@@ -0,0 +1,48 @@
+Copyright © 2023 Blockchain Commons, LLC
+Copyright © 2025 Leonardo Amoroso Custodio
+
+Redistribution and use in source and binary forms, with or without modification,
+are permitted provided that the following conditions are met:
+
+    1. Redistributions of source code must retain the above copyright notice,
+    this list of conditions and the following disclaimer.
+
+    2. Redistributions in binary form must reproduce the above copyright notice,
+    this list of conditions and the following disclaimer in the documentation
+    and/or other materials provided with the distribution.
+
+Subject to the terms and conditions of this license, each copyright holder and
+contributor hereby grants to those receiving rights under this license a
+perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+(except for failure to satisfy the conditions of this license) patent license to
+make, have made, use, offer to sell, sell, import, and otherwise transfer this
+software, where such license applies only to those patent claims, already
+acquired or hereafter acquired, licensable by such copyright holder or
+contributor that are necessarily infringed by:
+
+    (a) their Contribution(s) (the licensed copyrights of copyright holders and
+    non-copyrightable additions of contributors, in source or binary form)
+    alone; or
+
+    (b) combination of their Contribution(s) with the work of authorship to
+    which such Contribution(s) was added by such copyright holder or
+    contributor, if, at the time the Contribution is added, such addition causes
+    such combination to be necessarily infringed. The patent license shall not
+    apply to any other combinations which include the Contribution.
+
+Except as expressly stated above, no rights or licenses from any copyright
+holder or contributor is granted under this license, whether expressly, by
+implication, estoppel or otherwise.
+
+DISCLAIMER
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
+TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

package/README.md

@@ -0,0 +1,11 @@
+# Blockchain Commons Shamir Secret Sharing for TypeScript
+
+> Disclaimer: This package is under active development and APIs may change.
+
+## Introduction
+
+This is a pure TypeScript implementation of [Shamir's Secret Sharing (SSS)](https://en.wikipedia.org/wiki/Shamir%27s_secret_sharing), a cryptographic technique in which a _secret_ is divided into parts, called _shares_, in such a way that a _threshold_ of several shares are needed to reconstruct the secret. The shares are distributed in a way that makes it impossible for an attacker to know anything about the secret without having a threshold of shares. If the number of shares is less than the threshold, then no information about the secret is revealed.
+
+## Rust Reference Implementation
+
+This TypeScript implementation is based on [bc-shamir-rust](https://github.com/BlockchainCommons/bc-shamir-rust) **v0.13.0** ([commit](https://github.com/BlockchainCommons/bc-shamir-rust/tree/fcf8deb2b0f51566635a7de89ae6d8d6628921c7)).

package/dist/index.cjs

@@ -0,0 +1,506 @@
+let __bcts_crypto = require("@bcts/crypto");
+
+//#region src/error.ts
+/**
+* Error types for Shamir secret sharing operations.
+*/
+let ShamirErrorType = /* @__PURE__ */ function(ShamirErrorType$1) {
+	ShamirErrorType$1["SecretTooLong"] = "SecretTooLong";
+	ShamirErrorType$1["TooManyShares"] = "TooManyShares";
+	ShamirErrorType$1["InterpolationFailure"] = "InterpolationFailure";
+	ShamirErrorType$1["ChecksumFailure"] = "ChecksumFailure";
+	ShamirErrorType$1["SecretTooShort"] = "SecretTooShort";
+	ShamirErrorType$1["SecretNotEvenLen"] = "SecretNotEvenLen";
+	ShamirErrorType$1["InvalidThreshold"] = "InvalidThreshold";
+	ShamirErrorType$1["SharesUnequalLength"] = "SharesUnequalLength";
+	return ShamirErrorType$1;
+}({});
+/**
+* Error class for Shamir secret sharing operations.
+*/
+var ShamirError = class ShamirError extends Error {
+	type;
+	constructor(type, message) {
+		super(message ?? ShamirError.defaultMessage(type));
+		this.type = type;
+		this.name = "ShamirError";
+	}
+	static defaultMessage(type) {
+		switch (type) {
+			case ShamirErrorType.SecretTooLong: return "secret is too long";
+			case ShamirErrorType.TooManyShares: return "too many shares";
+			case ShamirErrorType.InterpolationFailure: return "interpolation failed";
+			case ShamirErrorType.ChecksumFailure: return "checksum failure";
+			case ShamirErrorType.SecretTooShort: return "secret is too short";
+			case ShamirErrorType.SecretNotEvenLen: return "secret is not of even length";
+			case ShamirErrorType.InvalidThreshold: return "invalid threshold";
+			case ShamirErrorType.SharesUnequalLength: return "shares have unequal length";
+		}
+	}
+};
+
+//#endregion
+//#region src/hazmat.ts
+/**
+* Convert an array of bytes into a bitsliced representation.
+* Takes the first 32 bytes from x and produces 8 u32 values.
+*
+* @param r - Output array of 8 u32 values (bitsliced representation)
+* @param x - Input array of at least 32 bytes
+*/
+function bitslice(r, x) {
+	if (x.length < 32) throw new Error("bitslice: input must be at least 32 bytes");
+	if (r.length !== 8) throw new Error("bitslice: output must have 8 elements");
+	(0, __bcts_crypto.memzero)(r);
+	for (let arrIdx = 0; arrIdx < 32; arrIdx++) {
+		const cur = x[arrIdx];
+		for (let bitIdx = 0; bitIdx < 8; bitIdx++) r[bitIdx] |= (cur & 1 << bitIdx) >>> bitIdx << arrIdx;
+	}
+}
+/**
+* Convert a bitsliced representation back to bytes.
+*
+* @param r - Output array of at least 32 bytes
+* @param x - Input array of 8 u32 values (bitsliced representation)
+*/
+function unbitslice(r, x) {
+	if (r.length < 32) throw new Error("unbitslice: output must be at least 32 bytes");
+	if (x.length !== 8) throw new Error("unbitslice: input must have 8 elements");
+	(0, __bcts_crypto.memzero)(r.subarray(0, 32));
+	for (let bitIdx = 0; bitIdx < 8; bitIdx++) {
+		const cur = x[bitIdx];
+		for (let arrIdx = 0; arrIdx < 32; arrIdx++) r[arrIdx] |= (cur & 1 << arrIdx) >>> arrIdx << bitIdx;
+	}
+}
+/**
+* Set all 32 positions in a bitsliced array to the same byte value.
+*
+* @param r - Output array of 8 u32 values
+* @param x - Byte value to set in all positions
+*/
+function bitsliceSetall(r, x) {
+	if (r.length !== 8) throw new Error("bitsliceSetall: output must have 8 elements");
+	for (let idx = 0; idx < 8; idx++) r[idx] = (x >>> idx & 1) === 1 ? 4294967295 : 0;
+}
+/**
+* Add (XOR) r with x and store the result in r.
+* In GF(2^8), addition is XOR.
+*
+* @param r - First operand and result
+* @param x - Second operand
+*/
+function gf256Add(r, x) {
+	if (r.length !== 8 || x.length !== 8) throw new Error("gf256Add: arrays must have 8 elements");
+	for (let i = 0; i < 8; i++) r[i] ^= x[i];
+}
+/**
+* Safely multiply two bitsliced polynomials in GF(2^8) reduced by
+* x^8 + x^4 + x^3 + x + 1. r and a may overlap, but overlapping of r
+* and b will produce an incorrect result! If you need to square a polynomial
+* use gf256Square instead.
+*
+* @param r - Result array (8 u32 values)
+* @param a - First operand (may overlap with r)
+* @param b - Second operand (must NOT overlap with r)
+*/
+function gf256Mul(r, a, b) {
+	if (r.length !== 8 || a.length !== 8 || b.length !== 8) throw new Error("gf256Mul: arrays must have 8 elements");
+	const a2 = new Uint32Array(a);
+	r[0] = a2[0] & b[0];
+	r[1] = a2[1] & b[0];
+	r[2] = a2[2] & b[0];
+	r[3] = a2[3] & b[0];
+	r[4] = a2[4] & b[0];
+	r[5] = a2[5] & b[0];
+	r[6] = a2[6] & b[0];
+	r[7] = a2[7] & b[0];
+	a2[0] ^= a2[7];
+	a2[2] ^= a2[7];
+	a2[3] ^= a2[7];
+	r[0] ^= a2[7] & b[1];
+	r[1] ^= a2[0] & b[1];
+	r[2] ^= a2[1] & b[1];
+	r[3] ^= a2[2] & b[1];
+	r[4] ^= a2[3] & b[1];
+	r[5] ^= a2[4] & b[1];
+	r[6] ^= a2[5] & b[1];
+	r[7] ^= a2[6] & b[1];
+	a2[7] ^= a2[6];
+	a2[1] ^= a2[6];
+	a2[2] ^= a2[6];
+	r[0] ^= a2[6] & b[2];
+	r[1] ^= a2[7] & b[2];
+	r[2] ^= a2[0] & b[2];
+	r[3] ^= a2[1] & b[2];
+	r[4] ^= a2[2] & b[2];
+	r[5] ^= a2[3] & b[2];
+	r[6] ^= a2[4] & b[2];
+	r[7] ^= a2[5] & b[2];
+	a2[6] ^= a2[5];
+	a2[0] ^= a2[5];
+	a2[1] ^= a2[5];
+	r[0] ^= a2[5] & b[3];
+	r[1] ^= a2[6] & b[3];
+	r[2] ^= a2[7] & b[3];
+	r[3] ^= a2[0] & b[3];
+	r[4] ^= a2[1] & b[3];
+	r[5] ^= a2[2] & b[3];
+	r[6] ^= a2[3] & b[3];
+	r[7] ^= a2[4] & b[3];
+	a2[5] ^= a2[4];
+	a2[7] ^= a2[4];
+	a2[0] ^= a2[4];
+	r[0] ^= a2[4] & b[4];
+	r[1] ^= a2[5] & b[4];
+	r[2] ^= a2[6] & b[4];
+	r[3] ^= a2[7] & b[4];
+	r[4] ^= a2[0] & b[4];
+	r[5] ^= a2[1] & b[4];
+	r[6] ^= a2[2] & b[4];
+	r[7] ^= a2[3] & b[4];
+	a2[4] ^= a2[3];
+	a2[6] ^= a2[3];
+	a2[7] ^= a2[3];
+	r[0] ^= a2[3] & b[5];
+	r[1] ^= a2[4] & b[5];
+	r[2] ^= a2[5] & b[5];
+	r[3] ^= a2[6] & b[5];
+	r[4] ^= a2[7] & b[5];
+	r[5] ^= a2[0] & b[5];
+	r[6] ^= a2[1] & b[5];
+	r[7] ^= a2[2] & b[5];
+	a2[3] ^= a2[2];
+	a2[5] ^= a2[2];
+	a2[6] ^= a2[2];
+	r[0] ^= a2[2] & b[6];
+	r[1] ^= a2[3] & b[6];
+	r[2] ^= a2[4] & b[6];
+	r[3] ^= a2[5] & b[6];
+	r[4] ^= a2[6] & b[6];
+	r[5] ^= a2[7] & b[6];
+	r[6] ^= a2[0] & b[6];
+	r[7] ^= a2[1] & b[6];
+	a2[2] ^= a2[1];
+	a2[4] ^= a2[1];
+	a2[5] ^= a2[1];
+	r[0] ^= a2[1] & b[7];
+	r[1] ^= a2[2] & b[7];
+	r[2] ^= a2[3] & b[7];
+	r[3] ^= a2[4] & b[7];
+	r[4] ^= a2[5] & b[7];
+	r[5] ^= a2[6] & b[7];
+	r[6] ^= a2[7] & b[7];
+	r[7] ^= a2[0] & b[7];
+}
+/**
+* Square x in GF(2^8) and write the result to r.
+* r and x may overlap.
+*
+* @param r - Result array (8 u32 values)
+* @param x - Value to square
+*/
+function gf256Square(r, x) {
+	if (r.length !== 8 || x.length !== 8) throw new Error("gf256Square: arrays must have 8 elements");
+	const r14 = x[7];
+	const r12 = x[6];
+	let r10 = x[5];
+	let r8 = x[4];
+	r[6] = x[3];
+	r[4] = x[2];
+	r[2] = x[1];
+	r[0] = x[0];
+	r[7] = r14;
+	r[6] ^= r14;
+	r10 ^= r14;
+	r[4] ^= r12;
+	r[5] = r12;
+	r[7] ^= r12;
+	r8 ^= r12;
+	r[2] ^= r10;
+	r[3] = r10;
+	r[5] ^= r10;
+	r[6] ^= r10;
+	r[1] = r14;
+	r[2] ^= r14;
+	r[4] ^= r14;
+	r[5] ^= r14;
+	r[0] ^= r8;
+	r[1] ^= r8;
+	r[3] ^= r8;
+	r[4] ^= r8;
+}
+/**
+* Invert x in GF(2^8) and write the result to r.
+*
+* @param r - Result array (8 u32 values)
+* @param x - Value to invert (will be modified)
+*/
+function gf256Inv(r, x) {
+	if (r.length !== 8 || x.length !== 8) throw new Error("gf256Inv: arrays must have 8 elements");
+	const y = new Uint32Array(8);
+	const z = new Uint32Array(8);
+	gf256Square(y, x);
+	gf256Square(y, new Uint32Array(y));
+	gf256Square(r, y);
+	gf256Mul(z, r, x);
+	gf256Square(r, new Uint32Array(r));
+	gf256Mul(r, new Uint32Array(r), z);
+	gf256Square(r, new Uint32Array(r));
+	gf256Square(z, r);
+	gf256Square(z, new Uint32Array(z));
+	gf256Mul(r, new Uint32Array(r), z);
+	gf256Mul(r, new Uint32Array(r), y);
+}
+
+//#endregion
+//#region src/interpolate.ts
+/**
+* Calculate the lagrange basis coefficients for the lagrange polynomial
+* defined by the x coordinates xc at the value x.
+*
+* After the function runs, the values array should hold data satisfying:
+*                ---     (x-xc[j])
+*   values[i] =  | |   -------------
+*              j != i  (xc[i]-xc[j])
+*
+* @param values - Output array for the lagrange basis values
+* @param n - Number of points (length of the xc array, 0 < n <= 32)
+* @param xc - Array of x components to use as interpolating points
+* @param x - x coordinate to evaluate lagrange polynomials at
+*/
+function hazmatLagrangeBasis(values, n, xc, x) {
+	const xx = new Uint8Array(48);
+	const xSlice = new Uint32Array(8);
+	const lxi = [];
+	for (let i = 0; i < n; i++) lxi.push(new Uint32Array(8));
+	const numerator = new Uint32Array(8);
+	const denominator = new Uint32Array(8);
+	const temp = new Uint32Array(8);
+	xx.set(xc.subarray(0, n), 0);
+	for (let i = 0; i < n; i++) {
+		bitslice(lxi[i], xx.subarray(i));
+		xx[i + n] = xx[i];
+	}
+	bitsliceSetall(xSlice, x);
+	bitsliceSetall(numerator, 1);
+	bitsliceSetall(denominator, 1);
+	for (let i = 1; i < n; i++) {
+		temp.set(xSlice);
+		gf256Add(temp, lxi[i]);
+		gf256Mul(numerator, new Uint32Array(numerator), temp);
+		temp.set(lxi[0]);
+		gf256Add(temp, lxi[i]);
+		gf256Mul(denominator, new Uint32Array(denominator), temp);
+	}
+	gf256Inv(temp, denominator);
+	gf256Mul(numerator, new Uint32Array(numerator), temp);
+	unbitslice(xx, numerator);
+	values.set(xx.subarray(0, n), 0);
+}
+/**
+* Safely interpolate the polynomial going through
+* the points (x0 [y0_0 y0_1 y0_2 ... y0_31]) , (x1 [y1_0 ...]), ...
+*
+* where
+*   xi points to [x0 x1 ... xn-1 ]
+*   y contains an array of pointers to 32-bit arrays of y values
+*   y contains [y0 y1 y2 ... yn-1]
+*   and each of the yi arrays contain [yi_0 yi_i ... yi_31].
+*
+* @param n - Number of points to interpolate
+* @param xi - x coordinates for points (array of length n)
+* @param yl - Length of y coordinate arrays
+* @param yij - Array of n arrays of length yl
+* @param x - Coordinate to interpolate at
+* @returns The interpolated result of length yl
+*/
+function interpolate(n, xi, yl, yij, x) {
+	const y = [];
+	for (let i = 0; i < n; i++) y.push(new Uint8Array(MAX_SECRET_LEN));
+	const values = new Uint8Array(MAX_SECRET_LEN);
+	for (let i = 0; i < n; i++) y[i].set(yij[i].subarray(0, yl), 0);
+	const lagrange = new Uint8Array(n);
+	const ySlice = new Uint32Array(8);
+	const resultSlice = new Uint32Array(8);
+	const temp = new Uint32Array(8);
+	hazmatLagrangeBasis(lagrange, n, xi, x);
+	bitsliceSetall(resultSlice, 0);
+	for (let i = 0; i < n; i++) {
+		bitslice(ySlice, y[i]);
+		bitsliceSetall(temp, lagrange[i]);
+		gf256Mul(temp, new Uint32Array(temp), ySlice);
+		gf256Add(resultSlice, temp);
+	}
+	unbitslice(values, resultSlice);
+	const result = new Uint8Array(yl);
+	result.set(values.subarray(0, yl), 0);
+	(0, __bcts_crypto.memzero)(lagrange);
+	(0, __bcts_crypto.memzero)(ySlice);
+	(0, __bcts_crypto.memzero)(resultSlice);
+	(0, __bcts_crypto.memzero)(temp);
+	(0, __bcts_crypto.memzeroVecVecU8)(y);
+	(0, __bcts_crypto.memzero)(values);
+	return result;
+}
+
+//#endregion
+//#region src/shamir.ts
+const SECRET_INDEX = 255;
+const DIGEST_INDEX = 254;
+function createDigest(randomData, sharedSecret) {
+	return (0, __bcts_crypto.hmacSha256)(randomData, sharedSecret);
+}
+function validateParameters(threshold, shareCount, secretLength) {
+	if (shareCount > MAX_SHARE_COUNT) throw new ShamirError(ShamirErrorType.TooManyShares);
+	else if (threshold < 1 || threshold > shareCount) throw new ShamirError(ShamirErrorType.InvalidThreshold);
+	else if (secretLength > MAX_SECRET_LEN) throw new ShamirError(ShamirErrorType.SecretTooLong);
+	else if (secretLength < MIN_SECRET_LEN) throw new ShamirError(ShamirErrorType.SecretTooShort);
+	else if ((secretLength & 1) !== 0) throw new ShamirError(ShamirErrorType.SecretNotEvenLen);
+}
+/**
+* Splits a secret into shares using the Shamir secret sharing algorithm.
+*
+* @param threshold - The minimum number of shares required to reconstruct the
+*   secret. Must be greater than or equal to 1 and less than or equal to
+*   shareCount.
+* @param shareCount - The total number of shares to generate. Must be at least
+*   threshold and less than or equal to MAX_SHARE_COUNT.
+* @param secret - A Uint8Array containing the secret to be split. Must be at
+*   least MIN_SECRET_LEN bytes long and at most MAX_SECRET_LEN bytes long.
+*   The length must be an even number.
+* @param randomGenerator - An implementation of the RandomNumberGenerator
+*   interface, used to generate random data.
+* @returns An array of Uint8Array representing the shares of the secret.
+* @throws ShamirError if parameters are invalid
+*
+* @example
+* ```typescript
+* import { splitSecret } from "@bcts/shamir";
+* import { SecureRandomNumberGenerator } from "@bcts/rand";
+*
+* const threshold = 2;
+* const shareCount = 3;
+* const secret = new TextEncoder().encode("my secret belongs to me.");
+* const rng = new SecureRandomNumberGenerator();
+*
+* const shares = splitSecret(threshold, shareCount, secret, rng);
+* console.log(shares.length); // 3
+* ```
+*/
+function splitSecret(threshold, shareCount, secret, randomGenerator) {
+	validateParameters(threshold, shareCount, secret.length);
+	if (threshold === 1) {
+		const result = [];
+		for (let i = 0; i < shareCount; i++) result.push(new Uint8Array(secret));
+		return result;
+	} else {
+		const x = new Uint8Array(shareCount);
+		const y = [];
+		for (let i = 0; i < shareCount; i++) y.push(new Uint8Array(secret.length));
+		let n = 0;
+		const result = [];
+		for (let i = 0; i < shareCount; i++) result.push(new Uint8Array(secret.length));
+		for (let index = 0; index < threshold - 2; index++) {
+			randomGenerator.fillRandomData(result[index]);
+			x[n] = index;
+			y[n].set(result[index]);
+			n++;
+		}
+		const digest = new Uint8Array(secret.length);
+		randomGenerator.fillRandomData(digest.subarray(4));
+		const d = createDigest(digest.subarray(4), secret);
+		digest.set(d.subarray(0, 4), 0);
+		x[n] = DIGEST_INDEX;
+		y[n].set(digest);
+		n++;
+		x[n] = SECRET_INDEX;
+		y[n].set(secret);
+		n++;
+		for (let index = threshold - 2; index < shareCount; index++) {
+			const v = interpolate(n, x, secret.length, y, index);
+			result[index].set(v);
+		}
+		(0, __bcts_crypto.memzero)(digest);
+		(0, __bcts_crypto.memzero)(x);
+		(0, __bcts_crypto.memzeroVecVecU8)(y);
+		return result;
+	}
+}
+/**
+* Recovers the secret from the given shares using the Shamir secret sharing
+* algorithm.
+*
+* @param indexes - An array of indexes of the shares to be used for recovering
+*   the secret. These are the indexes of the shares returned by splitSecret.
+* @param shares - An array of shares of the secret matching the indexes in
+*   indexes. These are the shares returned by splitSecret.
+* @returns A Uint8Array representing the recovered secret.
+* @throws ShamirError if parameters are invalid or checksum verification fails
+*
+* @example
+* ```typescript
+* import { recoverSecret } from "@bcts/shamir";
+*
+* const indexes = [0, 2];
+* const shares = [
+*   new Uint8Array([47, 165, 102, 232, ...]),
+*   new Uint8Array([221, 174, 116, 201, ...]),
+* ];
+*
+* const secret = recoverSecret(indexes, shares);
+* console.log(new TextDecoder().decode(secret)); // "my secret belongs to me."
+* ```
+*/
+function recoverSecret(indexes, shares) {
+	const threshold = shares.length;
+	if (threshold === 0 || indexes.length !== threshold) throw new ShamirError(ShamirErrorType.InvalidThreshold);
+	const shareLength = shares[0].length;
+	validateParameters(threshold, threshold, shareLength);
+	if (!shares.every((share) => share.length === shareLength)) throw new ShamirError(ShamirErrorType.SharesUnequalLength);
+	if (threshold === 1) return new Uint8Array(shares[0]);
+	else {
+		const indexesU8 = new Uint8Array(indexes);
+		const digest = interpolate(threshold, indexesU8, shareLength, shares, DIGEST_INDEX);
+		const secret = interpolate(threshold, indexesU8, shareLength, shares, SECRET_INDEX);
+		const verify = createDigest(digest.subarray(4), secret);
+		let valid = true;
+		for (let i = 0; i < 4; i++) valid = valid && digest[i] === verify[i];
+		(0, __bcts_crypto.memzero)(digest);
+		(0, __bcts_crypto.memzero)(verify);
+		if (!valid) throw new ShamirError(ShamirErrorType.ChecksumFailure);
+		return secret;
+	}
+}
+
+//#endregion
+//#region src/index.ts
+/**
+* The minimum length of a secret.
+*/
+const MIN_SECRET_LEN = 16;
+/**
+* The maximum length of a secret.
+*/
+const MAX_SECRET_LEN = 32;
+/**
+* The maximum number of shares that can be generated from a secret.
+*/
+const MAX_SHARE_COUNT = 16;
+
+//#endregion
+exports.MAX_SECRET_LEN = MAX_SECRET_LEN;
+exports.MAX_SHARE_COUNT = MAX_SHARE_COUNT;
+exports.MIN_SECRET_LEN = MIN_SECRET_LEN;
+exports.ShamirError = ShamirError;
+exports.ShamirErrorType = ShamirErrorType;
+exports.bitslice = bitslice;
+exports.bitsliceSetall = bitsliceSetall;
+exports.gf256Add = gf256Add;
+exports.gf256Inv = gf256Inv;
+exports.gf256Mul = gf256Mul;
+exports.gf256Square = gf256Square;
+exports.interpolate = interpolate;
+exports.recoverSecret = recoverSecret;
+exports.splitSecret = splitSecret;
+exports.unbitslice = unbitslice;
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs","names":["lxi: Uint32Array[]","y: Uint8Array[]","result: Uint8Array[]","y: Uint8Array[]"],"sources":["../src/error.ts","../src/hazmat.ts","../src/interpolate.ts","../src/shamir.ts","../src/index.ts"],"sourcesContent":["// Ported from bc-shamir-rust/src/error.rs\n\n/**\n * Error types for Shamir secret sharing operations.\n */\nexport enum ShamirErrorType {\n  SecretTooLong = \"SecretTooLong\",\n  TooManyShares = \"TooManyShares\",\n  InterpolationFailure = \"InterpolationFailure\",\n  ChecksumFailure = \"ChecksumFailure\",\n  SecretTooShort = \"SecretTooShort\",\n  SecretNotEvenLen = \"SecretNotEvenLen\",\n  InvalidThreshold = \"InvalidThreshold\",\n  SharesUnequalLength = \"SharesUnequalLength\",\n}\n\n/**\n * Error class for Shamir secret sharing operations.\n */\nexport class ShamirError extends Error {\n  readonly type: ShamirErrorType;\n\n  constructor(type: ShamirErrorType, message?: string) {\n    super(message ?? ShamirError.defaultMessage(type));\n    this.type = type;\n    this.name = \"ShamirError\";\n  }\n\n  private static defaultMessage(type: ShamirErrorType): string {\n    switch (type) {\n      case ShamirErrorType.SecretTooLong:\n        return \"secret is too long\";\n      case ShamirErrorType.TooManyShares:\n        return \"too many shares\";\n      case ShamirErrorType.InterpolationFailure:\n        return \"interpolation failed\";\n      case ShamirErrorType.ChecksumFailure:\n        return \"checksum failure\";\n      case ShamirErrorType.SecretTooShort:\n        return \"secret is too short\";\n      case ShamirErrorType.SecretNotEvenLen:\n        return \"secret is not of even length\";\n      case ShamirErrorType.InvalidThreshold:\n        return \"invalid threshold\";\n      case ShamirErrorType.SharesUnequalLength:\n        return \"shares have unequal length\";\n    }\n  }\n}\n\nexport type ShamirResult<T> = T;\n","// Ported from bc-shamir-rust/src/hazmat.rs\n// GF(2^8) bitsliced polynomial operations for Shamir secret sharing\n\nimport { memzero } from \"@bcts/crypto\";\n\n/**\n * Convert an array of bytes into a bitsliced representation.\n * Takes the first 32 bytes from x and produces 8 u32 values.\n *\n * @param r - Output array of 8 u32 values (bitsliced representation)\n * @param x - Input array of at least 32 bytes\n */\nexport function bitslice(r: Uint32Array, x: Uint8Array): void {\n  if (x.length < 32) {\n    throw new Error(\"bitslice: input must be at least 32 bytes\");\n  }\n  if (r.length !== 8) {\n    throw new Error(\"bitslice: output must have 8 elements\");\n  }\n\n  memzero(r);\n\n  for (let arrIdx = 0; arrIdx < 32; arrIdx++) {\n    const cur = x[arrIdx];\n    for (let bitIdx = 0; bitIdx < 8; bitIdx++) {\n      // r[bitIdx] |= ((cur & (1 << bitIdx)) >> bitIdx) << arrIdx\n      r[bitIdx] |= ((cur & (1 << bitIdx)) >>> bitIdx) << arrIdx;\n    }\n  }\n}\n\n/**\n * Convert a bitsliced representation back to bytes.\n *\n * @param r - Output array of at least 32 bytes\n * @param x - Input array of 8 u32 values (bitsliced representation)\n */\nexport function unbitslice(r: Uint8Array, x: Uint32Array): void {\n  if (r.length < 32) {\n    throw new Error(\"unbitslice: output must be at least 32 bytes\");\n  }\n  if (x.length !== 8) {\n    throw new Error(\"unbitslice: input must have 8 elements\");\n  }\n\n  memzero(r.subarray(0, 32));\n\n  for (let bitIdx = 0; bitIdx < 8; bitIdx++) {\n    const cur = x[bitIdx];\n    for (let arrIdx = 0; arrIdx < 32; arrIdx++) {\n      // r[arrIdx] |= ((cur & (1 << arrIdx)) >> arrIdx) << bitIdx\n      r[arrIdx] |= ((cur & (1 << arrIdx)) >>> arrIdx) << bitIdx;\n    }\n  }\n}\n\n/**\n * Set all 32 positions in a bitsliced array to the same byte value.\n *\n * @param r - Output array of 8 u32 values\n * @param x - Byte value to set in all positions\n */\nexport function bitsliceSetall(r: Uint32Array, x: number): void {\n  if (r.length !== 8) {\n    throw new Error(\"bitsliceSetall: output must have 8 elements\");\n  }\n\n  for (let idx = 0; idx < 8; idx++) {\n    // JavaScript needs special handling for the arithmetic right shift\n    // This mirrors: *r = (((((x as u32) & (1u32.wrapping_shl(idx as u32)))\n    //                       .wrapping_shl(31 - idx as u32)) as i32)\n    //                       .wrapping_shr(31)) as u32;\n    const bit = (x >>> idx) & 1;\n    r[idx] = bit === 1 ? 0xffffffff : 0;\n  }\n}\n\n/**\n * Add (XOR) r with x and store the result in r.\n * In GF(2^8), addition is XOR.\n *\n * @param r - First operand and result\n * @param x - Second operand\n */\nexport function gf256Add(r: Uint32Array, x: Uint32Array): void {\n  if (r.length !== 8 || x.length !== 8) {\n    throw new Error(\"gf256Add: arrays must have 8 elements\");\n  }\n\n  for (let i = 0; i < 8; i++) {\n    r[i] ^= x[i];\n  }\n}\n\n/**\n * Safely multiply two bitsliced polynomials in GF(2^8) reduced by\n * x^8 + x^4 + x^3 + x + 1. r and a may overlap, but overlapping of r\n * and b will produce an incorrect result! If you need to square a polynomial\n * use gf256Square instead.\n *\n * @param r - Result array (8 u32 values)\n * @param a - First operand (may overlap with r)\n * @param b - Second operand (must NOT overlap with r)\n */\nexport function gf256Mul(r: Uint32Array, a: Uint32Array, b: Uint32Array): void {\n  if (r.length !== 8 || a.length !== 8 || b.length !== 8) {\n    throw new Error(\"gf256Mul: arrays must have 8 elements\");\n  }\n\n  // Russian Peasant multiplication on two bitsliced polynomials\n  const a2 = new Uint32Array(a);\n\n  r[0] = a2[0] & b[0];\n  r[1] = a2[1] & b[0];\n  r[2] = a2[2] & b[0];\n  r[3] = a2[3] & b[0];\n  r[4] = a2[4] & b[0];\n  r[5] = a2[5] & b[0];\n  r[6] = a2[6] & b[0];\n  r[7] = a2[7] & b[0];\n  a2[0] ^= a2[7]; // reduce\n  a2[2] ^= a2[7];\n  a2[3] ^= a2[7];\n\n  r[0] ^= a2[7] & b[1]; // add\n  r[1] ^= a2[0] & b[1];\n  r[2] ^= a2[1] & b[1];\n  r[3] ^= a2[2] & b[1];\n  r[4] ^= a2[3] & b[1];\n  r[5] ^= a2[4] & b[1];\n  r[6] ^= a2[5] & b[1];\n  r[7] ^= a2[6] & b[1];\n  a2[7] ^= a2[6]; // reduce\n  a2[1] ^= a2[6];\n  a2[2] ^= a2[6];\n\n  r[0] ^= a2[6] & b[2]; // add\n  r[1] ^= a2[7] & b[2];\n  r[2] ^= a2[0] & b[2];\n  r[3] ^= a2[1] & b[2];\n  r[4] ^= a2[2] & b[2];\n  r[5] ^= a2[3] & b[2];\n  r[6] ^= a2[4] & b[2];\n  r[7] ^= a2[5] & b[2];\n  a2[6] ^= a2[5]; // reduce\n  a2[0] ^= a2[5];\n  a2[1] ^= a2[5];\n\n  r[0] ^= a2[5] & b[3]; // add\n  r[1] ^= a2[6] & b[3];\n  r[2] ^= a2[7] & b[3];\n  r[3] ^= a2[0] & b[3];\n  r[4] ^= a2[1] & b[3];\n  r[5] ^= a2[2] & b[3];\n  r[6] ^= a2[3] & b[3];\n  r[7] ^= a2[4] & b[3];\n  a2[5] ^= a2[4]; // reduce\n  a2[7] ^= a2[4];\n  a2[0] ^= a2[4];\n\n  r[0] ^= a2[4] & b[4]; // add\n  r[1] ^= a2[5] & b[4];\n  r[2] ^= a2[6] & b[4];\n  r[3] ^= a2[7] & b[4];\n  r[4] ^= a2[0] & b[4];\n  r[5] ^= a2[1] & b[4];\n  r[6] ^= a2[2] & b[4];\n  r[7] ^= a2[3] & b[4];\n  a2[4] ^= a2[3]; // reduce\n  a2[6] ^= a2[3];\n  a2[7] ^= a2[3];\n\n  r[0] ^= a2[3] & b[5]; // add\n  r[1] ^= a2[4] & b[5];\n  r[2] ^= a2[5] & b[5];\n  r[3] ^= a2[6] & b[5];\n  r[4] ^= a2[7] & b[5];\n  r[5] ^= a2[0] & b[5];\n  r[6] ^= a2[1] & b[5];\n  r[7] ^= a2[2] & b[5];\n  a2[3] ^= a2[2]; // reduce\n  a2[5] ^= a2[2];\n  a2[6] ^= a2[2];\n\n  r[0] ^= a2[2] & b[6]; // add\n  r[1] ^= a2[3] & b[6];\n  r[2] ^= a2[4] & b[6];\n  r[3] ^= a2[5] & b[6];\n  r[4] ^= a2[6] & b[6];\n  r[5] ^= a2[7] & b[6];\n  r[6] ^= a2[0] & b[6];\n  r[7] ^= a2[1] & b[6];\n  a2[2] ^= a2[1]; // reduce\n  a2[4] ^= a2[1];\n  a2[5] ^= a2[1];\n\n  r[0] ^= a2[1] & b[7]; // add\n  r[1] ^= a2[2] & b[7];\n  r[2] ^= a2[3] & b[7];\n  r[3] ^= a2[4] & b[7];\n  r[4] ^= a2[5] & b[7];\n  r[5] ^= a2[6] & b[7];\n  r[6] ^= a2[7] & b[7];\n  r[7] ^= a2[0] & b[7];\n}\n\n/**\n * Square x in GF(2^8) and write the result to r.\n * r and x may overlap.\n *\n * @param r - Result array (8 u32 values)\n * @param x - Value to square\n */\nexport function gf256Square(r: Uint32Array, x: Uint32Array): void {\n  if (r.length !== 8 || x.length !== 8) {\n    throw new Error(\"gf256Square: arrays must have 8 elements\");\n  }\n\n  // Use the Freshman's Dream rule to square the polynomial\n  // Assignments are done from 7 downto 0, because this allows\n  // in-place operation (e.g. gf256Square(r, r))\n  const r14 = x[7];\n  const r12 = x[6];\n  let r10 = x[5];\n  let r8 = x[4];\n  r[6] = x[3];\n  r[4] = x[2];\n  r[2] = x[1];\n  r[0] = x[0];\n\n  // Reduce with x^8 + x^4 + x^3 + x + 1 until order is less than 8\n  r[7] = r14; // r[7] was 0\n  r[6] ^= r14;\n  r10 ^= r14;\n  // Skip, because r13 is always 0\n  r[4] ^= r12;\n  r[5] = r12; // r[5] was 0\n  r[7] ^= r12;\n  r8 ^= r12;\n  // Skip, because r11 is always 0\n  r[2] ^= r10;\n  r[3] = r10; // r[3] was 0\n  r[5] ^= r10;\n  r[6] ^= r10;\n  r[1] = r14; // r[1] was 0\n  r[2] ^= r14; // Substitute r9 by r14 because they will always be equal\n  r[4] ^= r14;\n  r[5] ^= r14;\n  r[0] ^= r8;\n  r[1] ^= r8;\n  r[3] ^= r8;\n  r[4] ^= r8;\n}\n\n/**\n * Invert x in GF(2^8) and write the result to r.\n *\n * @param r - Result array (8 u32 values)\n * @param x - Value to invert (will be modified)\n */\nexport function gf256Inv(r: Uint32Array, x: Uint32Array): void {\n  if (r.length !== 8 || x.length !== 8) {\n    throw new Error(\"gf256Inv: arrays must have 8 elements\");\n  }\n\n  const y = new Uint32Array(8);\n  const z = new Uint32Array(8);\n\n  gf256Square(y, x); // y = x^2\n  const y2 = new Uint32Array(y);\n  gf256Square(y, y2); // y = x^4\n  gf256Square(r, y); // r = x^8\n  gf256Mul(z, r, x); // z = x^9\n  const r2a = new Uint32Array(r);\n  gf256Square(r, r2a); // r = x^16\n  const r2b = new Uint32Array(r);\n  gf256Mul(r, r2b, z); // r = x^25\n  const r2c = new Uint32Array(r);\n  gf256Square(r, r2c); // r = x^50\n  gf256Square(z, r); // z = x^100\n  const z2 = new Uint32Array(z);\n  gf256Square(z, z2); // z = x^200\n  const r2d = new Uint32Array(r);\n  gf256Mul(r, r2d, z); // r = x^250\n  const r2e = new Uint32Array(r);\n  gf256Mul(r, r2e, y); // r = x^254\n}\n","// Ported from bc-shamir-rust/src/interpolate.rs\n\nimport { memzero, memzeroVecVecU8 } from \"@bcts/crypto\";\nimport { MAX_SECRET_LEN } from \"./index.js\";\nimport { bitslice, bitsliceSetall, gf256Add, gf256Inv, gf256Mul, unbitslice } from \"./hazmat.js\";\n\n/**\n * Calculate the lagrange basis coefficients for the lagrange polynomial\n * defined by the x coordinates xc at the value x.\n *\n * After the function runs, the values array should hold data satisfying:\n *                ---     (x-xc[j])\n *   values[i] =  | |   -------------\n *              j != i  (xc[i]-xc[j])\n *\n * @param values - Output array for the lagrange basis values\n * @param n - Number of points (length of the xc array, 0 < n <= 32)\n * @param xc - Array of x components to use as interpolating points\n * @param x - x coordinate to evaluate lagrange polynomials at\n */\nfunction hazmatLagrangeBasis(values: Uint8Array, n: number, xc: Uint8Array, x: number): void {\n  // call the contents of xc [ x0 x1 x2 ... xn-1 ]\n  const xx = new Uint8Array(32 + 16);\n  const xSlice = new Uint32Array(8);\n  const lxi: Uint32Array[] = [];\n  for (let i = 0; i < n; i++) {\n    lxi.push(new Uint32Array(8));\n  }\n  const numerator = new Uint32Array(8);\n  const denominator = new Uint32Array(8);\n  const temp = new Uint32Array(8);\n\n  xx.set(xc.subarray(0, n), 0);\n\n  // xx now contains bitsliced [ x0 x1 x2 ... xn-1 0 0 0 ... ]\n  for (let i = 0; i < n; i++) {\n    // lxi = bitsliced [ xi xi+1 xi+2 ... xi-1 0 0 0 ]\n    bitslice(lxi[i], xx.subarray(i));\n    xx[i + n] = xx[i];\n  }\n\n  bitsliceSetall(xSlice, x);\n  bitsliceSetall(numerator, 1);\n  bitsliceSetall(denominator, 1);\n\n  for (let i = 1; i < n; i++) {\n    temp.set(xSlice);\n    gf256Add(temp, lxi[i]);\n    // temp = [ x-xi+i x-xi+2 x-xi+3 ... x-xi x x x]\n    const numerator2 = new Uint32Array(numerator);\n    gf256Mul(numerator, numerator2, temp);\n\n    temp.set(lxi[0]);\n    gf256Add(temp, lxi[i]);\n    // temp = [x0-xi+1 x1-xi+1 x2-xi+2 ... xn-x0 0 0 0]\n    const denominator2 = new Uint32Array(denominator);\n    gf256Mul(denominator, denominator2, temp);\n  }\n\n  // At this stage the numerator contains\n  // [ num0 num1 num2 ... numn 0 0 0]\n  //\n  // where numi = prod(j, j!=i, x-xj )\n  //\n  // and the denominator contains\n  // [ d0 d1 d2 ... dn 0 0 0]\n  //\n  // where di = prod(j, j!=i, xi-xj)\n\n  gf256Inv(temp, denominator);\n\n  // gf256_inv uses exponentiation to calculate inverse, so the zeros end up\n  // remaining zeros.\n\n  // tmp = [ 1/d0 1/d1 1/d2 ... 1/dn 0 0 0]\n\n  const numerator2 = new Uint32Array(numerator);\n  gf256Mul(numerator, numerator2, temp);\n\n  // numerator now contains [ l_n_0(x) l_n_1(x) ... l_n_n-1(x) 0 0 0]\n  // use the xx array to unpack it\n\n  unbitslice(xx, numerator);\n\n  // copy results to output array\n  values.set(xx.subarray(0, n), 0);\n}\n\n/**\n * Safely interpolate the polynomial going through\n * the points (x0 [y0_0 y0_1 y0_2 ... y0_31]) , (x1 [y1_0 ...]), ...\n *\n * where\n *   xi points to [x0 x1 ... xn-1 ]\n *   y contains an array of pointers to 32-bit arrays of y values\n *   y contains [y0 y1 y2 ... yn-1]\n *   and each of the yi arrays contain [yi_0 yi_i ... yi_31].\n *\n * @param n - Number of points to interpolate\n * @param xi - x coordinates for points (array of length n)\n * @param yl - Length of y coordinate arrays\n * @param yij - Array of n arrays of length yl\n * @param x - Coordinate to interpolate at\n * @returns The interpolated result of length yl\n */\nexport function interpolate(\n  n: number,\n  xi: Uint8Array,\n  yl: number,\n  yij: Uint8Array[],\n  x: number,\n): Uint8Array {\n  // The hazmat gf256 implementation needs the y-coordinate data\n  // to be in 32-byte blocks\n  const y: Uint8Array[] = [];\n  for (let i = 0; i < n; i++) {\n    y.push(new Uint8Array(MAX_SECRET_LEN));\n  }\n  const values = new Uint8Array(MAX_SECRET_LEN);\n\n  for (let i = 0; i < n; i++) {\n    y[i].set(yij[i].subarray(0, yl), 0);\n  }\n\n  const lagrange = new Uint8Array(n);\n  const ySlice = new Uint32Array(8);\n  const resultSlice = new Uint32Array(8);\n  const temp = new Uint32Array(8);\n\n  hazmatLagrangeBasis(lagrange, n, xi, x);\n\n  bitsliceSetall(resultSlice, 0);\n\n  for (let i = 0; i < n; i++) {\n    bitslice(ySlice, y[i]);\n    bitsliceSetall(temp, lagrange[i]);\n    const temp2 = new Uint32Array(temp);\n    gf256Mul(temp, temp2, ySlice);\n    gf256Add(resultSlice, temp);\n  }\n\n  unbitslice(values, resultSlice);\n\n  // the calling code is only expecting yl bytes back\n  const result = new Uint8Array(yl);\n  result.set(values.subarray(0, yl), 0);\n\n  // clean up stack\n  memzero(lagrange);\n  memzero(ySlice);\n  memzero(resultSlice);\n  memzero(temp);\n  memzeroVecVecU8(y);\n  memzero(values);\n\n  return result;\n}\n","// Ported from bc-shamir-rust/src/shamir.rs\n\nimport { hmacSha256, memzero, memzeroVecVecU8 } from \"@bcts/crypto\";\nimport type { RandomNumberGenerator } from \"@bcts/rand\";\n\nimport { ShamirError, ShamirErrorType } from \"./error.js\";\nimport { MAX_SECRET_LEN, MAX_SHARE_COUNT, MIN_SECRET_LEN } from \"./index.js\";\nimport { interpolate } from \"./interpolate.js\";\n\nconst SECRET_INDEX = 255;\nconst DIGEST_INDEX = 254;\n\nfunction createDigest(randomData: Uint8Array, sharedSecret: Uint8Array): Uint8Array {\n  return hmacSha256(randomData, sharedSecret);\n}\n\nfunction validateParameters(threshold: number, shareCount: number, secretLength: number): void {\n  if (shareCount > MAX_SHARE_COUNT) {\n    throw new ShamirError(ShamirErrorType.TooManyShares);\n  } else if (threshold < 1 || threshold > shareCount) {\n    throw new ShamirError(ShamirErrorType.InvalidThreshold);\n  } else if (secretLength > MAX_SECRET_LEN) {\n    throw new ShamirError(ShamirErrorType.SecretTooLong);\n  } else if (secretLength < MIN_SECRET_LEN) {\n    throw new ShamirError(ShamirErrorType.SecretTooShort);\n  } else if ((secretLength & 1) !== 0) {\n    throw new ShamirError(ShamirErrorType.SecretNotEvenLen);\n  }\n}\n\n/**\n * Splits a secret into shares using the Shamir secret sharing algorithm.\n *\n * @param threshold - The minimum number of shares required to reconstruct the\n *   secret. Must be greater than or equal to 1 and less than or equal to\n *   shareCount.\n * @param shareCount - The total number of shares to generate. Must be at least\n *   threshold and less than or equal to MAX_SHARE_COUNT.\n * @param secret - A Uint8Array containing the secret to be split. Must be at\n *   least MIN_SECRET_LEN bytes long and at most MAX_SECRET_LEN bytes long.\n *   The length must be an even number.\n * @param randomGenerator - An implementation of the RandomNumberGenerator\n *   interface, used to generate random data.\n * @returns An array of Uint8Array representing the shares of the secret.\n * @throws ShamirError if parameters are invalid\n *\n * @example\n * ```typescript\n * import { splitSecret } from \"@bcts/shamir\";\n * import { SecureRandomNumberGenerator } from \"@bcts/rand\";\n *\n * const threshold = 2;\n * const shareCount = 3;\n * const secret = new TextEncoder().encode(\"my secret belongs to me.\");\n * const rng = new SecureRandomNumberGenerator();\n *\n * const shares = splitSecret(threshold, shareCount, secret, rng);\n * console.log(shares.length); // 3\n * ```\n */\nexport function splitSecret(\n  threshold: number,\n  shareCount: number,\n  secret: Uint8Array,\n  randomGenerator: RandomNumberGenerator,\n): Uint8Array[] {\n  validateParameters(threshold, shareCount, secret.length);\n\n  if (threshold === 1) {\n    // just return shareCount copies of the secret\n    const result: Uint8Array[] = [];\n    for (let i = 0; i < shareCount; i++) {\n      result.push(new Uint8Array(secret));\n    }\n    return result;\n  } else {\n    const x = new Uint8Array(shareCount);\n    const y: Uint8Array[] = [];\n    for (let i = 0; i < shareCount; i++) {\n      y.push(new Uint8Array(secret.length));\n    }\n    let n = 0;\n    const result: Uint8Array[] = [];\n    for (let i = 0; i < shareCount; i++) {\n      result.push(new Uint8Array(secret.length));\n    }\n\n    for (let index = 0; index < threshold - 2; index++) {\n      randomGenerator.fillRandomData(result[index]);\n      x[n] = index;\n      y[n].set(result[index]);\n      n++;\n    }\n\n    // generate secret_length - 4 bytes worth of random data\n    const digest = new Uint8Array(secret.length);\n    randomGenerator.fillRandomData(digest.subarray(4));\n    // put 4 bytes of digest at the top of the digest array\n    const d = createDigest(digest.subarray(4), secret);\n    digest.set(d.subarray(0, 4), 0);\n    x[n] = DIGEST_INDEX;\n    y[n].set(digest);\n    n++;\n\n    x[n] = SECRET_INDEX;\n    y[n].set(secret);\n    n++;\n\n    for (let index = threshold - 2; index < shareCount; index++) {\n      const v = interpolate(n, x, secret.length, y, index);\n      result[index].set(v);\n    }\n\n    // clean up stack\n    memzero(digest);\n    memzero(x);\n    memzeroVecVecU8(y);\n\n    return result;\n  }\n}\n\n/**\n * Recovers the secret from the given shares using the Shamir secret sharing\n * algorithm.\n *\n * @param indexes - An array of indexes of the shares to be used for recovering\n *   the secret. These are the indexes of the shares returned by splitSecret.\n * @param shares - An array of shares of the secret matching the indexes in\n *   indexes. These are the shares returned by splitSecret.\n * @returns A Uint8Array representing the recovered secret.\n * @throws ShamirError if parameters are invalid or checksum verification fails\n *\n * @example\n * ```typescript\n * import { recoverSecret } from \"@bcts/shamir\";\n *\n * const indexes = [0, 2];\n * const shares = [\n *   new Uint8Array([47, 165, 102, 232, ...]),\n *   new Uint8Array([221, 174, 116, 201, ...]),\n * ];\n *\n * const secret = recoverSecret(indexes, shares);\n * console.log(new TextDecoder().decode(secret)); // \"my secret belongs to me.\"\n * ```\n */\nexport function recoverSecret(indexes: number[], shares: Uint8Array[]): Uint8Array {\n  const threshold = shares.length;\n  if (threshold === 0 || indexes.length !== threshold) {\n    throw new ShamirError(ShamirErrorType.InvalidThreshold);\n  }\n\n  const shareLength = shares[0].length;\n  validateParameters(threshold, threshold, shareLength);\n\n  const allSameLength = shares.every((share) => share.length === shareLength);\n  if (!allSameLength) {\n    throw new ShamirError(ShamirErrorType.SharesUnequalLength);\n  }\n\n  if (threshold === 1) {\n    return new Uint8Array(shares[0]);\n  } else {\n    const indexesU8 = new Uint8Array(indexes);\n\n    const digest = interpolate(threshold, indexesU8, shareLength, shares, DIGEST_INDEX);\n    const secret = interpolate(threshold, indexesU8, shareLength, shares, SECRET_INDEX);\n    const verify = createDigest(digest.subarray(4), secret);\n\n    let valid = true;\n    for (let i = 0; i < 4; i++) {\n      valid = valid && digest[i] === verify[i];\n    }\n\n    memzero(digest);\n    memzero(verify);\n\n    if (!valid) {\n      throw new ShamirError(ShamirErrorType.ChecksumFailure);\n    }\n\n    return secret;\n  }\n}\n","// Blockchain Commons Shamir Secret Sharing\n// Ported from bc-shamir-rust\n//\n// This is a pure TypeScript implementation of Shamir's Secret Sharing (SSS),\n// a cryptographic technique in which a secret is divided into parts, called\n// shares, in such a way that a threshold of several shares are needed to\n// reconstruct the secret. The shares are distributed in a way that makes it\n// impossible for an attacker to know anything about the secret without having\n// a threshold of shares. If the number of shares is less than the threshold,\n// then no information about the secret is revealed.\n\n/**\n * The minimum length of a secret.\n */\nexport const MIN_SECRET_LEN = 16;\n\n/**\n * The maximum length of a secret.\n */\nexport const MAX_SECRET_LEN = 32;\n\n/**\n * The maximum number of shares that can be generated from a secret.\n */\nexport const MAX_SHARE_COUNT = 16;\n\n// Error types\nexport { ShamirError, ShamirErrorType, type ShamirResult } from \"./error.js\";\n\n// Main functions\nexport { splitSecret, recoverSecret } from \"./shamir.js\";\n\n// Low-level operations (hazmat)\nexport {\n  bitslice,\n  unbitslice,\n  bitsliceSetall,\n  gf256Add,\n  gf256Mul,\n  gf256Square,\n  gf256Inv,\n} from \"./hazmat.js\";\n\n// Interpolation\nexport { interpolate } from \"./interpolate.js\";\n"],"mappings":";;;;;;AAKA,IAAY,8DAAL;AACL;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;;;;;AAMF,IAAa,cAAb,MAAa,oBAAoB,MAAM;CACrC,AAAS;CAET,YAAY,MAAuB,SAAkB;AACnD,QAAM,WAAW,YAAY,eAAe,KAAK,CAAC;AAClD,OAAK,OAAO;AACZ,OAAK,OAAO;;CAGd,OAAe,eAAe,MAA+B;AAC3D,UAAQ,MAAR;GACE,KAAK,gBAAgB,cACnB,QAAO;GACT,KAAK,gBAAgB,cACnB,QAAO;GACT,KAAK,gBAAgB,qBACnB,QAAO;GACT,KAAK,gBAAgB,gBACnB,QAAO;GACT,KAAK,gBAAgB,eACnB,QAAO;GACT,KAAK,gBAAgB,iBACnB,QAAO;GACT,KAAK,gBAAgB,iBACnB,QAAO;GACT,KAAK,gBAAgB,oBACnB,QAAO;;;;;;;;;;;;;;ACjCf,SAAgB,SAAS,GAAgB,GAAqB;AAC5D,KAAI,EAAE,SAAS,GACb,OAAM,IAAI,MAAM,4CAA4C;AAE9D,KAAI,EAAE,WAAW,EACf,OAAM,IAAI,MAAM,wCAAwC;AAG1D,4BAAQ,EAAE;AAEV,MAAK,IAAI,SAAS,GAAG,SAAS,IAAI,UAAU;EAC1C,MAAM,MAAM,EAAE;AACd,OAAK,IAAI,SAAS,GAAG,SAAS,GAAG,SAE/B,GAAE,YAAa,MAAO,KAAK,YAAa,UAAW;;;;;;;;;AAWzD,SAAgB,WAAW,GAAe,GAAsB;AAC9D,KAAI,EAAE,SAAS,GACb,OAAM,IAAI,MAAM,+CAA+C;AAEjE,KAAI,EAAE,WAAW,EACf,OAAM,IAAI,MAAM,yCAAyC;AAG3D,4BAAQ,EAAE,SAAS,GAAG,GAAG,CAAC;AAE1B,MAAK,IAAI,SAAS,GAAG,SAAS,GAAG,UAAU;EACzC,MAAM,MAAM,EAAE;AACd,OAAK,IAAI,SAAS,GAAG,SAAS,IAAI,SAEhC,GAAE,YAAa,MAAO,KAAK,YAAa,UAAW;;;;;;;;;AAWzD,SAAgB,eAAe,GAAgB,GAAiB;AAC9D,KAAI,EAAE,WAAW,EACf,OAAM,IAAI,MAAM,8CAA8C;AAGhE,MAAK,IAAI,MAAM,GAAG,MAAM,GAAG,MAMzB,GAAE,QADW,MAAM,MAAO,OACT,IAAI,aAAa;;;;;;;;;AAWtC,SAAgB,SAAS,GAAgB,GAAsB;AAC7D,KAAI,EAAE,WAAW,KAAK,EAAE,WAAW,EACjC,OAAM,IAAI,MAAM,wCAAwC;AAG1D,MAAK,IAAI,IAAI,GAAG,IAAI,GAAG,IACrB,GAAE,MAAM,EAAE;;;;;;;;;;;;AAcd,SAAgB,SAAS,GAAgB,GAAgB,GAAsB;AAC7E,KAAI,EAAE,WAAW,KAAK,EAAE,WAAW,KAAK,EAAE,WAAW,EACnD,OAAM,IAAI,MAAM,wCAAwC;CAI1D,MAAM,KAAK,IAAI,YAAY,EAAE;AAE7B,GAAE,KAAK,GAAG,KAAK,EAAE;AACjB,GAAE,KAAK,GAAG,KAAK,EAAE;AACjB,GAAE,KAAK,GAAG,KAAK,EAAE;AACjB,GAAE,KAAK,GAAG,KAAK,EAAE;AACjB,GAAE,KAAK,GAAG,KAAK,EAAE;AACjB,GAAE,KAAK,GAAG,KAAK,EAAE;AACjB,GAAE,KAAK,GAAG,KAAK,EAAE;AACjB,GAAE,KAAK,GAAG,KAAK,EAAE;AACjB,IAAG,MAAM,GAAG;AACZ,IAAG,MAAM,GAAG;AACZ,IAAG,MAAM,GAAG;AAEZ,GAAE,MAAM,GAAG,KAAK,EAAE;AAClB,GAAE,MAAM,GAAG,KAAK,EAAE;AAClB,GAAE,MAAM,GAAG,KAAK,EAAE;AAClB,GAAE,MAAM,GAAG,KAAK,EAAE;AAClB,GAAE,MAAM,GAAG,KAAK,EAAE;AAClB,GAAE,MAAM,GAAG,KAAK,EAAE;AAClB,GAAE,MAAM,GAAG,KAAK,EAAE;AAClB,GAAE,MAAM,GAAG,KAAK,EAAE;AAClB,IAAG,MAAM,GAAG;AACZ,IAAG,MAAM,GAAG;AACZ,IAAG,MAAM,GAAG;AAEZ,GAAE,MAAM,GAAG,KAAK,EAAE;AAClB,GAAE,MAAM,GAAG,KAAK,EAAE;AAClB,GAAE,MAAM,GAAG,KAAK,EAAE;AAClB,GAAE,MAAM,GAAG,KAAK,EAAE;AAClB,GAAE,MAAM,GAAG,KAAK,EAAE;AAClB,GAAE,MAAM,GAAG,KAAK,EAAE;AAClB,GAAE,MAAM,GAAG,KAAK,EAAE;AAClB,GAAE,MAAM,GAAG,KAAK,EAAE;AAClB,IAAG,MAAM,GAAG;AACZ,IAAG,MAAM,GAAG;AACZ,IAAG,MAAM,GAAG;AAEZ,GAAE,MAAM,GAAG,KAAK,EAAE;AAClB,GAAE,MAAM,GAAG,KAAK,EAAE;AAClB,GAAE,MAAM,GAAG,KAAK,EAAE;AAClB,GAAE,MAAM,GAAG,KAAK,EAAE;AAClB,GAAE,MAAM,GAAG,KAAK,EAAE;AAClB,GAAE,MAAM,GAAG,KAAK,EAAE;AAClB,GAAE,MAAM,GAAG,KAAK,EAAE;AAClB,GAAE,MAAM,GAAG,KAAK,EAAE;AAClB,IAAG,MAAM,GAAG;AACZ,IAAG,MAAM,GAAG;AACZ,IAAG,MAAM,GAAG;AAEZ,GAAE,MAAM,GAAG,KAAK,EAAE;AAClB,GAAE,MAAM,GAAG,KAAK,EAAE;AAClB,GAAE,MAAM,GAAG,KAAK,EAAE;AAClB,GAAE,MAAM,GAAG,KAAK,EAAE;AAClB,GAAE,MAAM,GAAG,KAAK,EAAE;AAClB,GAAE,MAAM,GAAG,KAAK,EAAE;AAClB,GAAE,MAAM,GAAG,KAAK,EAAE;AAClB,GAAE,MAAM,GAAG,KAAK,EAAE;AAClB,IAAG,MAAM,GAAG;AACZ,IAAG,MAAM,GAAG;AACZ,IAAG,MAAM,GAAG;AAEZ,GAAE,MAAM,GAAG,KAAK,EAAE;AAClB,GAAE,MAAM,GAAG,KAAK,EAAE;AAClB,GAAE,MAAM,GAAG,KAAK,EAAE;AAClB,GAAE,MAAM,GAAG,KAAK,EAAE;AAClB,GAAE,MAAM,GAAG,KAAK,EAAE;AAClB,GAAE,MAAM,GAAG,KAAK,EAAE;AAClB,GAAE,MAAM,GAAG,KAAK,EAAE;AAClB,GAAE,MAAM,GAAG,KAAK,EAAE;AAClB,IAAG,MAAM,GAAG;AACZ,IAAG,MAAM,GAAG;AACZ,IAAG,MAAM,GAAG;AAEZ,GAAE,MAAM,GAAG,KAAK,EAAE;AAClB,GAAE,MAAM,GAAG,KAAK,EAAE;AAClB,GAAE,MAAM,GAAG,KAAK,EAAE;AAClB,GAAE,MAAM,GAAG,KAAK,EAAE;AAClB,GAAE,MAAM,GAAG,KAAK,EAAE;AAClB,GAAE,MAAM,GAAG,KAAK,EAAE;AAClB,GAAE,MAAM,GAAG,KAAK,EAAE;AAClB,GAAE,MAAM,GAAG,KAAK,EAAE;AAClB,IAAG,MAAM,GAAG;AACZ,IAAG,MAAM,GAAG;AACZ,IAAG,MAAM,GAAG;AAEZ,GAAE,MAAM,GAAG,KAAK,EAAE;AAClB,GAAE,MAAM,GAAG,KAAK,EAAE;AAClB,GAAE,MAAM,GAAG,KAAK,EAAE;AAClB,GAAE,MAAM,GAAG,KAAK,EAAE;AAClB,GAAE,MAAM,GAAG,KAAK,EAAE;AAClB,GAAE,MAAM,GAAG,KAAK,EAAE;AAClB,GAAE,MAAM,GAAG,KAAK,EAAE;AAClB,GAAE,MAAM,GAAG,KAAK,EAAE;;;;;;;;;AAUpB,SAAgB,YAAY,GAAgB,GAAsB;AAChE,KAAI,EAAE,WAAW,KAAK,EAAE,WAAW,EACjC,OAAM,IAAI,MAAM,2CAA2C;CAM7D,MAAM,MAAM,EAAE;CACd,MAAM,MAAM,EAAE;CACd,IAAI,MAAM,EAAE;CACZ,IAAI,KAAK,EAAE;AACX,GAAE,KAAK,EAAE;AACT,GAAE,KAAK,EAAE;AACT,GAAE,KAAK,EAAE;AACT,GAAE,KAAK,EAAE;AAGT,GAAE,KAAK;AACP,GAAE,MAAM;AACR,QAAO;AAEP,GAAE,MAAM;AACR,GAAE,KAAK;AACP,GAAE,MAAM;AACR,OAAM;AAEN,GAAE,MAAM;AACR,GAAE,KAAK;AACP,GAAE,MAAM;AACR,GAAE,MAAM;AACR,GAAE,KAAK;AACP,GAAE,MAAM;AACR,GAAE,MAAM;AACR,GAAE,MAAM;AACR,GAAE,MAAM;AACR,GAAE,MAAM;AACR,GAAE,MAAM;AACR,GAAE,MAAM;;;;;;;;AASV,SAAgB,SAAS,GAAgB,GAAsB;AAC7D,KAAI,EAAE,WAAW,KAAK,EAAE,WAAW,EACjC,OAAM,IAAI,MAAM,wCAAwC;CAG1D,MAAM,IAAI,IAAI,YAAY,EAAE;CAC5B,MAAM,IAAI,IAAI,YAAY,EAAE;AAE5B,aAAY,GAAG,EAAE;AAEjB,aAAY,GADD,IAAI,YAAY,EAAE,CACX;AAClB,aAAY,GAAG,EAAE;AACjB,UAAS,GAAG,GAAG,EAAE;AAEjB,aAAY,GADA,IAAI,YAAY,EAAE,CACX;AAEnB,UAAS,GADG,IAAI,YAAY,EAAE,EACb,EAAE;AAEnB,aAAY,GADA,IAAI,YAAY,EAAE,CACX;AACnB,aAAY,GAAG,EAAE;AAEjB,aAAY,GADD,IAAI,YAAY,EAAE,CACX;AAElB,UAAS,GADG,IAAI,YAAY,EAAE,EACb,EAAE;AAEnB,UAAS,GADG,IAAI,YAAY,EAAE,EACb,EAAE;;;;;;;;;;;;;;;;;;;ACzQrB,SAAS,oBAAoB,QAAoB,GAAW,IAAgB,GAAiB;CAE3F,MAAM,KAAK,IAAI,WAAW,GAAQ;CAClC,MAAM,SAAS,IAAI,YAAY,EAAE;CACjC,MAAMA,MAAqB,EAAE;AAC7B,MAAK,IAAI,IAAI,GAAG,IAAI,GAAG,IACrB,KAAI,KAAK,IAAI,YAAY,EAAE,CAAC;CAE9B,MAAM,YAAY,IAAI,YAAY,EAAE;CACpC,MAAM,cAAc,IAAI,YAAY,EAAE;CACtC,MAAM,OAAO,IAAI,YAAY,EAAE;AAE/B,IAAG,IAAI,GAAG,SAAS,GAAG,EAAE,EAAE,EAAE;AAG5B,MAAK,IAAI,IAAI,GAAG,IAAI,GAAG,KAAK;AAE1B,WAAS,IAAI,IAAI,GAAG,SAAS,EAAE,CAAC;AAChC,KAAG,IAAI,KAAK,GAAG;;AAGjB,gBAAe,QAAQ,EAAE;AACzB,gBAAe,WAAW,EAAE;AAC5B,gBAAe,aAAa,EAAE;AAE9B,MAAK,IAAI,IAAI,GAAG,IAAI,GAAG,KAAK;AAC1B,OAAK,IAAI,OAAO;AAChB,WAAS,MAAM,IAAI,GAAG;AAGtB,WAAS,WADU,IAAI,YAAY,UAAU,EACb,KAAK;AAErC,OAAK,IAAI,IAAI,GAAG;AAChB,WAAS,MAAM,IAAI,GAAG;AAGtB,WAAS,aADY,IAAI,YAAY,YAAY,EACb,KAAK;;AAa3C,UAAS,MAAM,YAAY;AAQ3B,UAAS,WADU,IAAI,YAAY,UAAU,EACb,KAAK;AAKrC,YAAW,IAAI,UAAU;AAGzB,QAAO,IAAI,GAAG,SAAS,GAAG,EAAE,EAAE,EAAE;;;;;;;;;;;;;;;;;;;AAoBlC,SAAgB,YACd,GACA,IACA,IACA,KACA,GACY;CAGZ,MAAMC,IAAkB,EAAE;AAC1B,MAAK,IAAI,IAAI,GAAG,IAAI,GAAG,IACrB,GAAE,KAAK,IAAI,WAAW,eAAe,CAAC;CAExC,MAAM,SAAS,IAAI,WAAW,eAAe;AAE7C,MAAK,IAAI,IAAI,GAAG,IAAI,GAAG,IACrB,GAAE,GAAG,IAAI,IAAI,GAAG,SAAS,GAAG,GAAG,EAAE,EAAE;CAGrC,MAAM,WAAW,IAAI,WAAW,EAAE;CAClC,MAAM,SAAS,IAAI,YAAY,EAAE;CACjC,MAAM,cAAc,IAAI,YAAY,EAAE;CACtC,MAAM,OAAO,IAAI,YAAY,EAAE;AAE/B,qBAAoB,UAAU,GAAG,IAAI,EAAE;AAEvC,gBAAe,aAAa,EAAE;AAE9B,MAAK,IAAI,IAAI,GAAG,IAAI,GAAG,KAAK;AAC1B,WAAS,QAAQ,EAAE,GAAG;AACtB,iBAAe,MAAM,SAAS,GAAG;AAEjC,WAAS,MADK,IAAI,YAAY,KAAK,EACb,OAAO;AAC7B,WAAS,aAAa,KAAK;;AAG7B,YAAW,QAAQ,YAAY;CAG/B,MAAM,SAAS,IAAI,WAAW,GAAG;AACjC,QAAO,IAAI,OAAO,SAAS,GAAG,GAAG,EAAE,EAAE;AAGrC,4BAAQ,SAAS;AACjB,4BAAQ,OAAO;AACf,4BAAQ,YAAY;AACpB,4BAAQ,KAAK;AACb,oCAAgB,EAAE;AAClB,4BAAQ,OAAO;AAEf,QAAO;;;;;AClJT,MAAM,eAAe;AACrB,MAAM,eAAe;AAErB,SAAS,aAAa,YAAwB,cAAsC;AAClF,sCAAkB,YAAY,aAAa;;AAG7C,SAAS,mBAAmB,WAAmB,YAAoB,cAA4B;AAC7F,KAAI,aAAa,gBACf,OAAM,IAAI,YAAY,gBAAgB,cAAc;UAC3C,YAAY,KAAK,YAAY,WACtC,OAAM,IAAI,YAAY,gBAAgB,iBAAiB;UAC9C,eAAe,eACxB,OAAM,IAAI,YAAY,gBAAgB,cAAc;UAC3C,eAAe,eACxB,OAAM,IAAI,YAAY,gBAAgB,eAAe;WAC3C,eAAe,OAAO,EAChC,OAAM,IAAI,YAAY,gBAAgB,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkC3D,SAAgB,YACd,WACA,YACA,QACA,iBACc;AACd,oBAAmB,WAAW,YAAY,OAAO,OAAO;AAExD,KAAI,cAAc,GAAG;EAEnB,MAAMC,SAAuB,EAAE;AAC/B,OAAK,IAAI,IAAI,GAAG,IAAI,YAAY,IAC9B,QAAO,KAAK,IAAI,WAAW,OAAO,CAAC;AAErC,SAAO;QACF;EACL,MAAM,IAAI,IAAI,WAAW,WAAW;EACpC,MAAMC,IAAkB,EAAE;AAC1B,OAAK,IAAI,IAAI,GAAG,IAAI,YAAY,IAC9B,GAAE,KAAK,IAAI,WAAW,OAAO,OAAO,CAAC;EAEvC,IAAI,IAAI;EACR,MAAMD,SAAuB,EAAE;AAC/B,OAAK,IAAI,IAAI,GAAG,IAAI,YAAY,IAC9B,QAAO,KAAK,IAAI,WAAW,OAAO,OAAO,CAAC;AAG5C,OAAK,IAAI,QAAQ,GAAG,QAAQ,YAAY,GAAG,SAAS;AAClD,mBAAgB,eAAe,OAAO,OAAO;AAC7C,KAAE,KAAK;AACP,KAAE,GAAG,IAAI,OAAO,OAAO;AACvB;;EAIF,MAAM,SAAS,IAAI,WAAW,OAAO,OAAO;AAC5C,kBAAgB,eAAe,OAAO,SAAS,EAAE,CAAC;EAElD,MAAM,IAAI,aAAa,OAAO,SAAS,EAAE,EAAE,OAAO;AAClD,SAAO,IAAI,EAAE,SAAS,GAAG,EAAE,EAAE,EAAE;AAC/B,IAAE,KAAK;AACP,IAAE,GAAG,IAAI,OAAO;AAChB;AAEA,IAAE,KAAK;AACP,IAAE,GAAG,IAAI,OAAO;AAChB;AAEA,OAAK,IAAI,QAAQ,YAAY,GAAG,QAAQ,YAAY,SAAS;GAC3D,MAAM,IAAI,YAAY,GAAG,GAAG,OAAO,QAAQ,GAAG,MAAM;AACpD,UAAO,OAAO,IAAI,EAAE;;AAItB,6BAAQ,OAAO;AACf,6BAAQ,EAAE;AACV,qCAAgB,EAAE;AAElB,SAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6BX,SAAgB,cAAc,SAAmB,QAAkC;CACjF,MAAM,YAAY,OAAO;AACzB,KAAI,cAAc,KAAK,QAAQ,WAAW,UACxC,OAAM,IAAI,YAAY,gBAAgB,iBAAiB;CAGzD,MAAM,cAAc,OAAO,GAAG;AAC9B,oBAAmB,WAAW,WAAW,YAAY;AAGrD,KAAI,CADkB,OAAO,OAAO,UAAU,MAAM,WAAW,YAAY,CAEzE,OAAM,IAAI,YAAY,gBAAgB,oBAAoB;AAG5D,KAAI,cAAc,EAChB,QAAO,IAAI,WAAW,OAAO,GAAG;MAC3B;EACL,MAAM,YAAY,IAAI,WAAW,QAAQ;EAEzC,MAAM,SAAS,YAAY,WAAW,WAAW,aAAa,QAAQ,aAAa;EACnF,MAAM,SAAS,YAAY,WAAW,WAAW,aAAa,QAAQ,aAAa;EACnF,MAAM,SAAS,aAAa,OAAO,SAAS,EAAE,EAAE,OAAO;EAEvD,IAAI,QAAQ;AACZ,OAAK,IAAI,IAAI,GAAG,IAAI,GAAG,IACrB,SAAQ,SAAS,OAAO,OAAO,OAAO;AAGxC,6BAAQ,OAAO;AACf,6BAAQ,OAAO;AAEf,MAAI,CAAC,MACH,OAAM,IAAI,YAAY,gBAAgB,gBAAgB;AAGxD,SAAO;;;;;;;;;ACxKX,MAAa,iBAAiB;;;;AAK9B,MAAa,iBAAiB;;;;AAK9B,MAAa,kBAAkB"}