@cello-protocol/crypto 0.0.2

package/dist/merkle.js

@@ -0,0 +1,240 @@
+/**
+ * RFC 6962 Merkle Tree Primitives
+ *
+ * PSEUDOCODE (Phase P)
+ * ====================
+ * References:
+ *   RFC 6962 §2.1   — Merkle Hash Trees: construction
+ *   RFC 6962 §2.1.1 — Merkle Audit Paths (inclusion proofs)
+ *   FIPS 180-4      — SHA-256 specification
+ *
+ * --- build(leaves: Uint8Array[]) ---
+ *   if leaves is empty:
+ *     return SHA-256("")  // RFC 6962 §2.1: D[0] = {}
+ *   level := [leafHash(l) for l in leaves]  // SHA-256(0x00 || l)
+ *   while level.length > 1:
+ *     next := []
+ *     for i in 0..level.length step 2:
+ *       if i+1 < level.length:
+ *         next.push(nodeHash(level[i], level[i+1]))  // SHA-256(0x01 || left || right)
+ *       else:
+ *         next.push(level[i])   // promote odd node — RFC 6962 §2.1: left-balanced
+ *     level := next
+ *   return level[0]  // root
+ *
+ * --- inclusionProof(tree, index) ---
+ *   // RFC 6962 §2.1.1: PATH(m, D[n]) = [] if n=1
+ *   //   otherwise siblings from leaf level up to root
+ *   level := tree.levelHashes[0]  // leaf hashes
+ *   proof := []
+ *   idx := index
+ *   while level.length > 1:
+ *     sibling := idx XOR 1  // flips last bit: 0→1 (right sibling), 1→0 (left sibling)
+ *     if sibling < level.length:
+ *       proof.push(level[sibling])
+ *     // else: odd node was promoted — no sibling hash in proof
+ *     next := ... (pair-and-promote)
+ *     idx := idx >> 1
+ *     level := next
+ *   return proof
+ *
+ * --- verify(leafHash, index, treeSize, proof, expectedRoot) ---
+ *   if treeSize == 0 or index >= treeSize: return false
+ *   if treeSize == 1 and proof.empty: return leafHash == expectedRoot
+ *   cur := leafHash
+ *   idx := index; sz := treeSize; pi := 0
+ *   while sz > 1:
+ *     if idx is last at this level AND idx is even (promoted, no sibling):
+ *       // cur carries up unchanged
+ *     else:
+ *       if pi >= proof.length: return false
+ *       if proof[pi].length != 32: return false  // AC-008: 31-byte sibling
+ *       if idx is odd: cur := nodeHash(proof[pi], cur)   // sibling is on the left
+ *       else:          cur := nodeHash(cur, proof[pi])   // sibling is on the right
+ *       pi++
+ *     idx := idx >> 1
+ *     sz := ceil(sz / 2)
+ *   if pi != proof.length: return false  // wrong proof length (extra elements)
+ *   return cur == expectedRoot
+ *
+ * --- edge cases ---
+ *   index >= treeSize → false, no throw
+ *   wrong proof length → false, no throw
+ *   31-byte sibling hash → false, no throw
+ *   empty tree → SHA-256("") per RFC 6962 §2.1
+ *
+ * --- second-preimage protection (SI-001) ---
+ *   Leaves are hashed as SHA-256(0x00 || data) — the 0x00 prefix ensures a crafted
+ *   leaf payload that begins with 0x01 cannot collide with an internal nodeHash,
+ *   because nodeHash uses 0x01 prefix on the already-hashed children, not the raw data.
+ */
+import { msgLeafHash, ctrlLeafHash, nodeHash, hash } from "./hashing.js";
+/**
+ * Build a left-balanced Merkle tree from an ordered list of leaf inputs.
+ *
+ * Per RFC 6962 §2.1:
+ *   - "msg"  leaves: SHA-256(0x00 || data) using msgLeafHash from hashing.ts
+ *   - "ctrl" leaves: SHA-256(0x02 || data) using ctrlLeafHash from hashing.ts
+ *   - "hash" leaves: data used as-is (caller pre-computed the leaf hash)
+ *   - Internal nodes: SHA-256(0x01 || left || right) using nodeHash from hashing.ts
+ *   - Odd nodes at each level are promoted unchanged (not duplicated)
+ *   - Empty tree root = SHA-256("") (SHA-256 of empty byte string)
+ *
+ * @param leaves - Leaf inputs with explicit kind for correct prefix application.
+ * @returns MerkleTree with all level hashes stored for O(log n) proof generation.
+ */
+export function buildMerkleTree(leaves) {
+    if (leaves.length === 0) {
+        return { size: 0, levelHashes: [] };
+    }
+    const levels = [];
+    let current = leaves.map((l) => {
+        if (l.kind === "ctrl")
+            return ctrlLeafHash(l.data);
+        if (l.kind === "hash")
+            return l.data;
+        return msgLeafHash(l.data);
+    });
+    levels.push(current);
+    while (current.length > 1) {
+        const next = [];
+        for (let i = 0; i < current.length; i += 2) {
+            if (i + 1 < current.length) {
+                next.push(nodeHash(current[i], current[i + 1]));
+            }
+            else {
+                // Promote the odd node unchanged (RFC 6962 §2.1 — left-balanced)
+                next.push(current[i]);
+            }
+        }
+        levels.push(next);
+        current = next;
+    }
+    return { size: leaves.length, levelHashes: levels };
+}
+/**
+ * Return the Merkle root of a built tree.
+ *
+ * Per RFC 6962 §2.1:
+ *   - Empty tree → SHA-256("") (SHA-256 of empty byte string)
+ *   - Otherwise → the single hash at the top level of levelHashes
+ *
+ * @param tree - A MerkleTree returned by buildMerkleTree.
+ * @returns 32-byte root hash.
+ */
+export function merkleRoot(tree) {
+    if (tree.size === 0) {
+        return hash(new Uint8Array(0));
+    }
+    const top = tree.levelHashes[tree.levelHashes.length - 1];
+    return top[0];
+}
+/**
+ * Produce an RFC 6962 §2.1.1 inclusion proof for leaf at index.
+ *
+ * The proof is an ordered list of sibling hashes from the leaf level to the root.
+ * For each level, the sibling of the current node is included. Promoted (odd, last)
+ * nodes have no sibling at their level, so no hash is added.
+ *
+ * @param tree   - A MerkleTree returned by buildMerkleTree.
+ * @param index  - Zero-based index of the target leaf.
+ * @returns      Array of 32-byte sibling hashes (may be empty for a single-leaf tree).
+ * @throws       If index is out of range.
+ */
+export function inclusionProof(tree, index) {
+    if (tree.size === 0 || index >= tree.size) {
+        throw new RangeError(`inclusionProof: index ${index} out of range for tree of size ${tree.size}`);
+    }
+    const proof = [];
+    let idx = index;
+    for (let level = 0; level < tree.levelHashes.length - 1; level++) {
+        const row = tree.levelHashes[level];
+        // Sibling index: XOR with 1 flips last bit (0→1 right sibling, 1→0 left sibling)
+        const siblingIdx = idx ^ 1;
+        if (siblingIdx < row.length) {
+            proof.push(row[siblingIdx]);
+        }
+        // If no sibling exists, this node is promoted (odd last node) — nothing added
+        idx = idx >> 1;
+    }
+    return proof;
+}
+/**
+ * Verify an RFC 6962 §2.1.1 inclusion proof.
+ *
+ * Reconstructs the root by traversing the proof from leaf to root and compares
+ * byte-for-byte to expectedRoot. Returns false (never throws) for all invalid inputs:
+ *   - index out of range
+ *   - wrong proof length
+ *   - any sibling hash not exactly 32 bytes
+ *   - reconstructed root doesn't match expectedRoot
+ *
+ * @param leafHash     - Pre-computed leaf hash (SHA-256(0x00 || data)).
+ * @param index        - Zero-based index of the leaf in the tree.
+ * @param treeSize     - Total number of leaves in the tree.
+ * @param proof        - Ordered sibling hashes from inclusionProof.
+ * @param expectedRoot - The expected 32-byte Merkle root.
+ * @returns true iff the proof is valid for the given leaf and root.
+ */
+export function verifyInclusion(leafHash, index, treeSize, proof, expectedRoot) {
+    // AC-008: malformed leafHash — must be exactly 32 bytes
+    if (leafHash.length !== 32)
+        return false;
+    // AC-008: index out of range
+    if (treeSize === 0 || index >= treeSize)
+        return false;
+    // Single-leaf tree: root IS the leaf hash, proof must be empty
+    if (treeSize === 1) {
+        if (proof.length !== 0)
+            return false;
+        return constantTimeEqual(leafHash, expectedRoot);
+    }
+    // Validate all sibling hashes up front (AC-008: 31-byte sibling)
+    for (const sibling of proof) {
+        if (sibling.length !== 32)
+            return false;
+    }
+    let cur = leafHash;
+    let idx = index;
+    let sz = treeSize;
+    let proofIdx = 0;
+    while (sz > 1) {
+        const isLastAndOdd = idx === sz - 1 && idx % 2 === 0;
+        if (isLastAndOdd) {
+            // This node is promoted (odd last node at this level) — no sibling consumed
+        }
+        else {
+            // Expect a sibling from the proof
+            if (proofIdx >= proof.length)
+                return false;
+            const sibling = proof[proofIdx++];
+            if (idx % 2 === 1) {
+                // Current node is right child — sibling is to the left
+                cur = nodeHash(sibling, cur);
+            }
+            else {
+                // Current node is left child — sibling is to the right
+                cur = nodeHash(cur, sibling);
+            }
+        }
+        idx = idx >> 1;
+        sz = Math.ceil(sz / 2);
+    }
+    // AC-008: wrong proof length (extra elements remaining)
+    if (proofIdx !== proof.length)
+        return false;
+    return constantTimeEqual(cur, expectedRoot);
+}
+/**
+ * Constant-time byte array comparison to prevent timing side-channels.
+ */
+function constantTimeEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i++) {
+        diff |= a[i] ^ b[i];
+    }
+    return diff === 0;
+}
+//# sourceMappingURL=merkle.js.map

package/dist/merkle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"merkle.js","sourceRoot":"","sources":["../src/merkle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqEG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAgCzE;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,eAAe,CAAC,MAAmB;IACjD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IACtC,CAAC;IAED,MAAM,MAAM,GAAmB,EAAE,CAAC;IAClC,IAAI,OAAO,GAAiB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC3C,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM;YAAE,OAAO,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC;QACrC,OAAO,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAErB,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAiB,EAAE,CAAC;QAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3C,IAAI,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;gBAC3B,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAClD,CAAC;iBAAM,CAAC;gBACN,iEAAiE;gBACjE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClB,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;AACtD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,UAAU,CAAC,IAAgB;IACzC,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC1D,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,cAAc,CAAC,IAAgB,EAAE,KAAa;IAC5D,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1C,MAAM,IAAI,UAAU,CAClB,yBAAyB,KAAK,kCAAkC,IAAI,CAAC,IAAI,EAAE,CAC5E,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,IAAI,GAAG,GAAG,KAAK,CAAC;IAEhB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;QACjE,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACpC,iFAAiF;QACjF,MAAM,UAAU,GAAG,GAAG,GAAG,CAAC,CAAC;QAC3B,IAAI,UAAU,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;YAC5B,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;QAC9B,CAAC;QACD,8EAA8E;QAC9E,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC;IACjB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,eAAe,CAC7B,QAAoB,EACpB,KAAa,EACb,QAAgB,EAChB,KAAmB,EACnB,YAAwB;IAExB,wDAAwD;IACxD,IAAI,QAAQ,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IAEzC,6BAA6B;IAC7B,IAAI,QAAQ,KAAK,CAAC,IAAI,KAAK,IAAI,QAAQ;QAAE,OAAO,KAAK,CAAC;IAEtD,+DAA+D;IAC/D,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;QACnB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACrC,OAAO,iBAAiB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IACnD,CAAC;IAED,iEAAiE;IACjE,KAAK,MAAM,OAAO,IAAI,KAAK,EAAE,CAAC;QAC5B,IAAI,OAAO,CAAC,MAAM,KAAK,EAAE;YAAE,OAAO,KAAK,CAAC;IAC1C,CAAC;IAED,IAAI,GAAG,GAAe,QAAQ,CAAC;IAC/B,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,IAAI,EAAE,GAAG,QAAQ,CAAC;IAClB,IAAI,QAAQ,GAAG,CAAC,CAAC;IAEjB,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;QACd,MAAM,YAAY,GAAG,GAAG,KAAK,EAAE,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;QAErD,IAAI,YAAY,EAAE,CAAC;YACjB,4EAA4E;QAC9E,CAAC;aAAM,CAAC;YACN,kCAAkC;YAClC,IAAI,QAAQ,IAAI,KAAK,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAC;YAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;YAElC,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBAClB,uDAAuD;gBACvD,GAAG,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAC/B,CAAC;iBAAM,CAAC;gBACN,uDAAuD;gBACvD,GAAG,GAAG,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;QAED,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC;QACf,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACzB,CAAC;IAED,wDAAwD;IACxD,IAAI,QAAQ,KAAK,KAAK,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAE5C,OAAO,iBAAiB,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;AAC9C,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,CAAa,EAAE,CAAa;IACrD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC"}

package/dist/ml-dsa.d.ts

@@ -0,0 +1,100 @@
+/**
+ * @cello-protocol/crypto — ML-DSA-44 signing primitives (CELLO-CRYPTO-004)
+ *
+ * Phase P — Pseudocode (FIPS 204 / CRYSTALS-Dilithium)
+ * ────────────────────────────────────────────────────
+ * Implements ML-DSA-44 as defined in NIST FIPS 204
+ * (https://csrc.nist.gov/pubs/fips/204/final).
+ * Parameter set ML-DSA-44 (security level 2, 128-bit post-quantum security):
+ *   public key  = 1312 bytes
+ *   secret key  = 2560 bytes
+ *   signature   = 2420 bytes
+ *
+ * Library: @oqs/liboqs-js (WASM bindings to the Open Quantum Safe liboqs C library)
+ * API (note argument order in liboqs-js):
+ *   createMLDSA44()                            → Promise<MLDSA44 instance>
+ *   instance.generateKeyPair()                 → { publicKey: Uint8Array, secretKey: Uint8Array }
+ *   instance.sign(message, secretKey)          → Uint8Array (2420 bytes)
+ *   instance.verify(message, signature, publicKey) → boolean
+ *
+ * Design:
+ *   - A module-level singleton holds the WASM instance (loaded once, reused).
+ *   - mlDsaKeygen() returns an InMemoryMlDsaKeyProvider wrapping the keypair.
+ *   - mlDsaSign(secretKey, message) — free stateless signing function.
+ *   - mlDsaVerify(publicKey, message, signature) — free stateless verification;
+ *     catches LibOQSValidationError for wrong-size inputs and returns false.
+ *   - Secret key never leaves the provider boundary; private fields enforce containment.
+ *   - FileMlDsaKeyProvider persists keypair atomically (write-to-tmp + rename, 0o600).
+ *
+ * SI-003: parameter set is pinned to ML-DSA-44. No runtime selection is possible.
+ */
+/** 1312-byte ML-DSA-44 public key */
+export type MlDsaPublicKey = Uint8Array;
+/** 2420-byte ML-DSA-44 signature */
+export type MlDsaSignature = Uint8Array;
+/** ML-DSA-44 keypair produced by key generation */
+export interface MlDsaKeyPair {
+    publicKey: MlDsaPublicKey;
+    secretKey: Uint8Array;
+}
+/** Provider abstraction: holds secret key in private storage; exposes only public ops */
+export interface MlDsaKeyProvider {
+    getPublicKey(): Promise<MlDsaPublicKey>;
+    sign(message: Uint8Array): Promise<MlDsaSignature>;
+}
+declare const INSPECT: unique symbol;
+export declare class InMemoryMlDsaKeyProvider implements MlDsaKeyProvider {
+    #private;
+    constructor(publicKey: Uint8Array, secretKey: Uint8Array);
+    getPublicKey(): Promise<MlDsaPublicKey>;
+    sign(message: Uint8Array): Promise<MlDsaSignature>;
+    toJSON(): Record<string, string>;
+    toString(): string;
+    [INSPECT](): string;
+}
+export declare class FileMlDsaKeyProvider implements MlDsaKeyProvider {
+    #private;
+    private constructor();
+    /**
+     * Load (or generate) a key file at the given path.
+     *
+     * - No file → generate fresh keypair, write atomically (write-to-tmp + rename), 0o600
+     * - File exists and valid → load and return
+     * - File exists but corrupt → throw { reason: 'ml_dsa_key_file_corrupt' }, never overwrite
+     */
+    static load(path: string): Promise<FileMlDsaKeyProvider>;
+    /** Parse and validate a raw key file buffer. Throws on corrupt data. */
+    private static _parseFile;
+    getPublicKey(): Promise<MlDsaPublicKey>;
+    sign(message: Uint8Array): Promise<MlDsaSignature>;
+    toJSON(): Record<string, string>;
+    toString(): string;
+    [INSPECT](): string;
+}
+/**
+ * Generate a new ML-DSA-44 keypair and return an InMemoryMlDsaKeyProvider.
+ * SI-003: parameter set is pinned to ML-DSA-44 — no selection argument.
+ */
+export declare function mlDsaKeygen(): Promise<InMemoryMlDsaKeyProvider>;
+/**
+ * Sign a message with an ML-DSA-44 secret key.
+ * Returns a 2420-byte signature.
+ *
+ * Note: mlDsaSign is synchronous-looking but uses the cached WASM instance.
+ * In practice the WASM instance must already be loaded (call mlDsaKeygen first).
+ * If not loaded, throws synchronously — callers should prefer provider.sign().
+ */
+export declare function mlDsaSign(secretKey: Uint8Array, message: Uint8Array): Uint8Array;
+/**
+ * Verify an ML-DSA-44 signature.
+ * Returns false (never throws) for any invalid input including wrong-size keys.
+ * SI-003: only ML-DSA-44 is supported.
+ */
+export declare function mlDsaVerify(publicKey: Uint8Array, message: Uint8Array, signature: Uint8Array): boolean;
+/**
+ * Ensure the WASM instance is loaded. Call this before using mlDsaSign/mlDsaVerify
+ * as free functions if you have not called mlDsaKeygen() yet.
+ */
+export declare function mlDsaEnsureLoaded(): Promise<void>;
+export {};
+//# sourceMappingURL=ml-dsa.d.ts.map

package/dist/ml-dsa.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ml-dsa.d.ts","sourceRoot":"","sources":["../src/ml-dsa.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAOH,qCAAqC;AACrC,MAAM,MAAM,cAAc,GAAG,UAAU,CAAC;AAExC,oCAAoC;AACpC,MAAM,MAAM,cAAc,GAAG,UAAU,CAAC;AAExC,mDAAmD;AACnD,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,cAAc,CAAC;IAC1B,SAAS,EAAE,UAAU,CAAC;CACvB;AAED,yFAAyF;AACzF,MAAM,WAAW,gBAAgB;IAC/B,YAAY,IAAI,OAAO,CAAC,cAAc,CAAC,CAAC;IACxC,IAAI,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CACpD;AAgDD,QAAA,MAAM,OAAO,eAA2C,CAAC;AAIzD,qBAAa,wBAAyB,YAAW,gBAAgB;;gBAInD,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU;IAYlD,YAAY,IAAI,OAAO,CAAC,cAAc,CAAC;IAKvC,IAAI,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,cAAc,CAAC;IAUxD,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAOhC,QAAQ,IAAI,MAAM;IAIlB,CAAC,OAAO,CAAC,IAAI,MAAM;CAGpB;AAID,qBAAa,oBAAqB,YAAW,gBAAgB;;IAG3D,OAAO;IAIP;;;;;;OAMG;WACU,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAoD9D,wEAAwE;IACxE,OAAO,CAAC,MAAM,CAAC,UAAU;IA+BnB,YAAY,IAAI,OAAO,CAAC,cAAc,CAAC;IAIvC,IAAI,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,cAAc,CAAC;IAKxD,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAOhC,QAAQ,IAAI,MAAM;IAIlB,CAAC,OAAO,CAAC,IAAI,MAAM;CAGpB;AAID;;;GAGG;AACH,wBAAsB,WAAW,IAAI,OAAO,CAAC,wBAAwB,CAAC,CAIrE;AAED;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,GAAG,UAAU,CAKhF;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CACzB,SAAS,EAAE,UAAU,EACrB,OAAO,EAAE,UAAU,EACnB,SAAS,EAAE,UAAU,GACpB,OAAO,CAUT;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAEvD"}

package/dist/ml-dsa.js

@@ -0,0 +1,257 @@
+/**
+ * @cello-protocol/crypto — ML-DSA-44 signing primitives (CELLO-CRYPTO-004)
+ *
+ * Phase P — Pseudocode (FIPS 204 / CRYSTALS-Dilithium)
+ * ────────────────────────────────────────────────────
+ * Implements ML-DSA-44 as defined in NIST FIPS 204
+ * (https://csrc.nist.gov/pubs/fips/204/final).
+ * Parameter set ML-DSA-44 (security level 2, 128-bit post-quantum security):
+ *   public key  = 1312 bytes
+ *   secret key  = 2560 bytes
+ *   signature   = 2420 bytes
+ *
+ * Library: @oqs/liboqs-js (WASM bindings to the Open Quantum Safe liboqs C library)
+ * API (note argument order in liboqs-js):
+ *   createMLDSA44()                            → Promise<MLDSA44 instance>
+ *   instance.generateKeyPair()                 → { publicKey: Uint8Array, secretKey: Uint8Array }
+ *   instance.sign(message, secretKey)          → Uint8Array (2420 bytes)
+ *   instance.verify(message, signature, publicKey) → boolean
+ *
+ * Design:
+ *   - A module-level singleton holds the WASM instance (loaded once, reused).
+ *   - mlDsaKeygen() returns an InMemoryMlDsaKeyProvider wrapping the keypair.
+ *   - mlDsaSign(secretKey, message) — free stateless signing function.
+ *   - mlDsaVerify(publicKey, message, signature) — free stateless verification;
+ *     catches LibOQSValidationError for wrong-size inputs and returns false.
+ *   - Secret key never leaves the provider boundary; private fields enforce containment.
+ *   - FileMlDsaKeyProvider persists keypair atomically (write-to-tmp + rename, 0o600).
+ *
+ * SI-003: parameter set is pinned to ML-DSA-44. No runtime selection is possible.
+ */
+import { readFile, rename, mkdir, open as fsOpen } from "node:fs/promises";
+import { dirname, join } from "node:path";
+let _wasmPromise = null;
+async function _loadWasm() {
+    // Dynamic import keeps liboqs-js out of the synchronous module graph.
+    // createMLDSA44 initialises and returns an ML-DSA-44 WASM context.
+    const { createMLDSA44 } = await import("@oqs/liboqs-js");
+    return createMLDSA44();
+}
+async function _getWasm() {
+    if (_wasmPromise === null) {
+        _wasmPromise = _loadWasm();
+    }
+    const instance = await _wasmPromise;
+    // Cache the resolved value so the synchronous mlDsaSign/mlDsaVerify free
+    // functions can read it without re-awaiting.
+    _wasmInstance = instance;
+    return instance;
+}
+// Populated after the first _getWasm() resolves. Synchronous free functions
+// (mlDsaSign, mlDsaVerify) read this directly. Callers must ensure _getWasm()
+// has been awaited (via mlDsaKeygen() or mlDsaEnsureLoaded()) before calling
+// the synchronous free functions.
+let _wasmInstance = null;
+// ─── File format constants ───────────────────────────────────────────────────
+// File layout: magic(5) + version(1) + publicKey(1312) + secretKey(2560) = 3878 bytes
+const ML_DSA_FILE_MAGIC = new Uint8Array([0xce, 0x11, 0x0d, 0x53, 0x41]); // "CELLO_MLDSA"
+const ML_DSA_FILE_VERSION = 1;
+const ML_DSA_PK_BYTES = 1312;
+const ML_DSA_SK_BYTES = 2560;
+const ML_DSA_FILE_SIZE = ML_DSA_FILE_MAGIC.length + 1 + ML_DSA_PK_BYTES + ML_DSA_SK_BYTES;
+// ─── Custom inspect symbol ───────────────────────────────────────────────────
+const INSPECT = Symbol.for("nodejs.util.inspect.custom");
+// ─── InMemoryMlDsaKeyProvider ────────────────────────────────────────────────
+export class InMemoryMlDsaKeyProvider {
+    #publicKey;
+    #secretKey;
+    constructor(publicKey, secretKey) {
+        if (publicKey.length !== ML_DSA_PK_BYTES) {
+            throw new Error(`ML-DSA-44 public key must be ${ML_DSA_PK_BYTES} bytes, got ${publicKey.length}`);
+        }
+        if (secretKey.length !== ML_DSA_SK_BYTES) {
+            throw new Error(`ML-DSA-44 secret key must be ${ML_DSA_SK_BYTES} bytes, got ${secretKey.length}`);
+        }
+        // Defensive copies: ensure the internal state is not shared with caller buffers.
+        this.#publicKey = publicKey.slice();
+        this.#secretKey = secretKey.slice();
+    }
+    async getPublicKey() {
+        // Return a copy to prevent external mutation of the internal public key buffer.
+        return this.#publicKey.slice();
+    }
+    async sign(message) {
+        const wasm = await _getWasm();
+        // liboqs-js validates `message.constructor.name === 'Uint8Array'`, which fails for
+        // cross-realm Uint8Arrays (bytes from a compiled dep resolved in a different V8 context).
+        // new Uint8Array(message) copies the bytes into a fresh instance in the current realm.
+        const msg = new Uint8Array(message);
+        return wasm.sign(msg, this.#secretKey);
+    }
+    // SI-001: redacted representations — secret key must never appear in any of these
+    toJSON() {
+        return {
+            type: "InMemoryMlDsaKeyProvider",
+            publicKey: Buffer.from(this.#publicKey).toString("hex"),
+        };
+    }
+    toString() {
+        return `InMemoryMlDsaKeyProvider(pubkey=${Buffer.from(this.#publicKey).toString("hex")})`;
+    }
+    [INSPECT]() {
+        return this.toString();
+    }
+}
+// ─── FileMlDsaKeyProvider ────────────────────────────────────────────────────
+export class FileMlDsaKeyProvider {
+    #inner;
+    constructor(inner) {
+        this.#inner = inner;
+    }
+    /**
+     * Load (or generate) a key file at the given path.
+     *
+     * - No file → generate fresh keypair, write atomically (write-to-tmp + rename), 0o600
+     * - File exists and valid → load and return
+     * - File exists but corrupt → throw { reason: 'ml_dsa_key_file_corrupt' }, never overwrite
+     */
+    static async load(path) {
+        let raw = null;
+        try {
+            raw = await readFile(path);
+        }
+        catch (err) {
+            const code = err.code;
+            if (code !== "ENOENT") {
+                throw {
+                    reason: "ml_dsa_key_file_corrupt",
+                    message: `cannot read ML-DSA key file: ${err.message}`,
+                };
+            }
+            // ENOENT → fall through to generation
+        }
+        if (raw !== null) {
+            return FileMlDsaKeyProvider._parseFile(raw);
+        }
+        // Generate and atomically write a new key file.
+        const wasm = await _getWasm();
+        const { publicKey, secretKey } = wasm.generateKeyPair();
+        const buf = Buffer.alloc(ML_DSA_FILE_SIZE);
+        let offset = 0;
+        ML_DSA_FILE_MAGIC.forEach((b, i) => { buf[i] = b; });
+        offset = ML_DSA_FILE_MAGIC.length;
+        buf[offset++] = ML_DSA_FILE_VERSION;
+        publicKey.forEach((b, i) => { buf[offset + i] = b; });
+        offset += ML_DSA_PK_BYTES;
+        secretKey.forEach((b, i) => { buf[offset + i] = b; });
+        const dir = dirname(path);
+        await mkdir(dir, { recursive: true });
+        const tmp = join(dir, `.cello-mldsa-key-tmp-${Date.now()}-${Math.random().toString(36).slice(2)}`);
+        const fd = await fsOpen(tmp, "wx", 0o600);
+        try {
+            await fd.write(buf);
+            await fd.chmod(0o600);
+        }
+        finally {
+            await fd.close();
+        }
+        await rename(tmp, path);
+        return new FileMlDsaKeyProvider(new InMemoryMlDsaKeyProvider(publicKey, secretKey));
+    }
+    /** Parse and validate a raw key file buffer. Throws on corrupt data. */
+    static _parseFile(raw) {
+        if (raw.length !== ML_DSA_FILE_SIZE) {
+            throw {
+                reason: "ml_dsa_key_file_corrupt",
+                message: `ML-DSA key file has wrong length: expected ${ML_DSA_FILE_SIZE}, got ${raw.length}`,
+            };
+        }
+        for (let i = 0; i < ML_DSA_FILE_MAGIC.length; i++) {
+            if (raw[i] !== ML_DSA_FILE_MAGIC[i]) {
+                throw {
+                    reason: "ml_dsa_key_file_corrupt",
+                    message: "ML-DSA key file has invalid magic bytes",
+                };
+            }
+        }
+        if (raw[ML_DSA_FILE_MAGIC.length] !== ML_DSA_FILE_VERSION) {
+            throw {
+                reason: "ml_dsa_key_file_corrupt",
+                message: `ML-DSA key file has unsupported version: ${raw[ML_DSA_FILE_MAGIC.length]}`,
+            };
+        }
+        let offset = ML_DSA_FILE_MAGIC.length + 1;
+        const publicKey = new Uint8Array(raw.buffer, raw.byteOffset + offset, ML_DSA_PK_BYTES).slice();
+        offset += ML_DSA_PK_BYTES;
+        const secretKey = new Uint8Array(raw.buffer, raw.byteOffset + offset, ML_DSA_SK_BYTES).slice();
+        return new FileMlDsaKeyProvider(new InMemoryMlDsaKeyProvider(publicKey, secretKey));
+    }
+    async getPublicKey() {
+        return this.#inner.getPublicKey();
+    }
+    async sign(message) {
+        return this.#inner.sign(message);
+    }
+    // SI-001: redacted representations
+    toJSON() {
+        return {
+            type: "FileMlDsaKeyProvider",
+            publicKey: this.#inner.toJSON()["publicKey"],
+        };
+    }
+    toString() {
+        return `FileMlDsaKeyProvider(pubkey=${this.#inner.toJSON()["publicKey"]})`;
+    }
+    [INSPECT]() {
+        return this.toString();
+    }
+}
+// ─── Free functions ──────────────────────────────────────────────────────────
+/**
+ * Generate a new ML-DSA-44 keypair and return an InMemoryMlDsaKeyProvider.
+ * SI-003: parameter set is pinned to ML-DSA-44 — no selection argument.
+ */
+export async function mlDsaKeygen() {
+    const wasm = await _getWasm();
+    const { publicKey, secretKey } = wasm.generateKeyPair();
+    return new InMemoryMlDsaKeyProvider(publicKey, secretKey);
+}
+/**
+ * Sign a message with an ML-DSA-44 secret key.
+ * Returns a 2420-byte signature.
+ *
+ * Note: mlDsaSign is synchronous-looking but uses the cached WASM instance.
+ * In practice the WASM instance must already be loaded (call mlDsaKeygen first).
+ * If not loaded, throws synchronously — callers should prefer provider.sign().
+ */
+export function mlDsaSign(secretKey, message) {
+    if (_wasmInstance === null) {
+        throw new Error("ML-DSA WASM not loaded — call mlDsaKeygen() or await mlDsaEnsureLoaded() first");
+    }
+    return _wasmInstance.sign(message, secretKey);
+}
+/**
+ * Verify an ML-DSA-44 signature.
+ * Returns false (never throws) for any invalid input including wrong-size keys.
+ * SI-003: only ML-DSA-44 is supported.
+ */
+export function mlDsaVerify(publicKey, message, signature) {
+    if (_wasmInstance === null) {
+        return false;
+    }
+    try {
+        return _wasmInstance.verify(message, signature, publicKey);
+    }
+    catch {
+        // LibOQSValidationError for wrong-size keys/signatures → return false (AC-005, AC-006)
+        return false;
+    }
+}
+/**
+ * Ensure the WASM instance is loaded. Call this before using mlDsaSign/mlDsaVerify
+ * as free functions if you have not called mlDsaKeygen() yet.
+ */
+export async function mlDsaEnsureLoaded() {
+    await _getWasm();
+}
+//# sourceMappingURL=ml-dsa.js.map

package/dist/ml-dsa.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ml-dsa.js","sourceRoot":"","sources":["../src/ml-dsa.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,IAAI,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AA8B1C,IAAI,YAAY,GAAiC,IAAI,CAAC;AAEtD,KAAK,UAAU,SAAS;IACtB,sEAAsE;IACtE,mEAAmE;IACnE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACzD,OAAO,aAAa,EAAE,CAAC;AACzB,CAAC;AAED,KAAK,UAAU,QAAQ;IACrB,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;QAC1B,YAAY,GAAG,SAAS,EAAE,CAAC;IAC7B,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC;IACpC,yEAAyE;IACzE,6CAA6C;IAC7C,aAAa,GAAG,QAAQ,CAAC;IACzB,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,kCAAkC;AAClC,IAAI,aAAa,GAAwB,IAAI,CAAC;AAE9C,gFAAgF;AAEhF,sFAAsF;AACtF,MAAM,iBAAiB,GAAG,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,gBAAgB;AAC1F,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAC9B,MAAM,eAAe,GAAG,IAAI,CAAC;AAC7B,MAAM,eAAe,GAAG,IAAI,CAAC;AAC7B,MAAM,gBAAgB,GACpB,iBAAiB,CAAC,MAAM,GAAG,CAAC,GAAG,eAAe,GAAG,eAAe,CAAC;AAEnE,gFAAgF;AAEhF,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;AAEzD,gFAAgF;AAEhF,MAAM,OAAO,wBAAwB;IAC1B,UAAU,CAAiB;IAC3B,UAAU,CAAa;IAEhC,YAAY,SAAqB,EAAE,SAAqB;QACtD,IAAI,SAAS,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,gCAAgC,eAAe,eAAe,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;QACpG,CAAC;QACD,IAAI,SAAS,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,gCAAgC,eAAe,eAAe,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;QACpG,CAAC;QACD,iFAAiF;QACjF,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC;QACpC,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,gFAAgF;QAChF,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAAmB;QAC5B,MAAM,IAAI,GAAG,MAAM,QAAQ,EAAE,CAAC;QAC9B,mFAAmF;QACnF,0FAA0F;QAC1F,uFAAuF;QACvF,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC;QACpC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACzC,CAAC;IAED,kFAAkF;IAClF,MAAM;QACJ,OAAO;YACL,IAAI,EAAE,0BAA0B;YAChC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;SACxD,CAAC;IACJ,CAAC;IAED,QAAQ;QACN,OAAO,mCAAmC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC;IAC5F,CAAC;IAED,CAAC,OAAO,CAAC;QACP,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;IACzB,CAAC;CACF;AAED,gFAAgF;AAEhF,MAAM,OAAO,oBAAoB;IACtB,MAAM,CAA2B;IAE1C,YAAoB,KAA+B;QACjD,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;IACtB,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAY;QAC5B,IAAI,GAAG,GAAkB,IAAI,CAAC;QAC9B,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,CAAC;YACjD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtB,MAAM;oBACJ,MAAM,EAAE,yBAAyB;oBACjC,OAAO,EAAE,gCAAiC,GAAa,CAAC,OAAO,EAAE;iBAClE,CAAC;YACJ,CAAC;YACD,sCAAsC;QACxC,CAAC;QAED,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,OAAO,oBAAoB,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAC9C,CAAC;QAED,gDAAgD;QAChD,MAAM,IAAI,GAAG,MAAM,QAAQ,EAAE,CAAC;QAC9B,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QAExD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAC3C,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACrD,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC;QAClC,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,mBAAmB,CAAC;QACpC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtE,MAAM,IAAI,eAAe,CAAC;QAC1B,SAAS,CAAC,OAAO,CAAC,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAEtE,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1B,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtC,MAAM,GAAG,GAAG,IAAI,CACd,GAAG,EACH,wBAAwB,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAC5E,CAAC;QACF,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACpB,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QACnB,CAAC;QACD,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAExB,OAAO,IAAI,oBAAoB,CAC7B,IAAI,wBAAwB,CAAC,SAAS,EAAE,SAAS,CAAC,CACnD,CAAC;IACJ,CAAC;IAED,wEAAwE;IAChE,MAAM,CAAC,UAAU,CAAC,GAAW;QACnC,IAAI,GAAG,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;YACpC,MAAM;gBACJ,MAAM,EAAE,yBAAyB;gBACjC,OAAO,EAAE,8CAA8C,gBAAgB,SAAS,GAAG,CAAC,MAAM,EAAE;aAC7F,CAAC;QACJ,CAAC;QACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,iBAAiB,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAClD,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpC,MAAM;oBACJ,MAAM,EAAE,yBAAyB;oBACjC,OAAO,EAAE,yCAAyC;iBACnD,CAAC;YACJ,CAAC;QACH,CAAC;QACD,IAAI,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC,KAAK,mBAAmB,EAAE,CAAC;YAC1D,MAAM;gBACJ,MAAM,EAAE,yBAAyB;gBACjC,OAAO,EAAE,4CAA4C,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE;aACrF,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,GAAG,iBAAiB,CAAC,MAAM,GAAG,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,UAAU,GAAG,MAAM,EAAE,eAAe,CAAC,CAAC,KAAK,EAAE,CAAC;QAC/F,MAAM,IAAI,eAAe,CAAC;QAC1B,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,UAAU,GAAG,MAAM,EAAE,eAAe,CAAC,CAAC,KAAK,EAAE,CAAC;QAE/F,OAAO,IAAI,oBAAoB,CAC7B,IAAI,wBAAwB,CAAC,SAAS,EAAE,SAAS,CAAC,CACnD,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAAmB;QAC5B,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC;IAED,mCAAmC;IACnC,MAAM;QACJ,OAAO;YACL,IAAI,EAAE,sBAAsB;YAC5B,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,CAAE;SAC9C,CAAC;IACJ,CAAC;IAED,QAAQ;QACN,OAAO,+BAA+B,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC;IAC7E,CAAC;IAED,CAAC,OAAO,CAAC;QACP,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;IACzB,CAAC;CACF;AAED,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,MAAM,IAAI,GAAG,MAAM,QAAQ,EAAE,CAAC;IAC9B,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;IACxD,OAAO,IAAI,wBAAwB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,SAAS,CAAC,SAAqB,EAAE,OAAmB;IAClE,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAC;IACpG,CAAC;IACD,OAAO,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CACzB,SAAqB,EACrB,OAAmB,EACnB,SAAqB;IAErB,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;QAC3B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC;QACH,OAAO,aAAa,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,uFAAuF;QACvF,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,MAAM,QAAQ,EAAE,CAAC;AACnB,CAAC"}