@quantakrypto/sieve 0.1.0

package/dist/protocol.d.ts

@@ -0,0 +1,169 @@
+/**
+ * The Sieve <-> SUT wire protocol.
+ *
+ * Sieve drives a system-under-test (SUT) — any ML-KEM / ML-DSA implementation
+ * the user provides — by spawning it as a child process and exchanging
+ * newline-delimited JSON (NDJSON) over stdin/stdout. One request per line, one
+ * response per line. All byte fields are base64-encoded strings.
+ *
+ * This module defines the request/response TypeScript types and the
+ * (de)serialization + validation logic. It performs NO cryptography. See
+ * PROTOCOL.md for the human-readable specification.
+ */
+import type { Family, ParamSet } from "./sizes.js";
+/** Protocol version. Bumped on any breaking wire change. */
+export declare const PROTOCOL_VERSION: 1;
+/** Operation names, shared across families where the semantics overlap. */
+export type Op = "keygen" | "encaps" | "decaps" | "sign" | "verify";
+/** Families that support the signature operations (sign / verify). */
+export type SignatureFamily = "ml-dsa" | "slh-dsa";
+/** Fields common to every request. */
+interface RequestBase {
+    /** Correlation id; the SUT MUST echo it back on the matching response. */
+    id: number;
+    /** Algorithm family this request targets. */
+    family: Family;
+    /** Parameter-set identifier, e.g. "ml-kem-768". */
+    param: ParamSet;
+    /** Operation to perform. */
+    op: Op;
+}
+/** ML-KEM / ML-DSA key generation. `seed` (base64) makes it deterministic. */
+export interface KeygenRequest extends RequestBase {
+    op: "keygen";
+    /** Optional base64 seed for deterministic keygen (impl-defined length). */
+    seed?: string;
+}
+/** ML-KEM encapsulation against a public key. */
+export interface EncapsRequest extends RequestBase {
+    family: "ml-kem";
+    op: "encaps";
+    /** Base64 public (encapsulation) key. */
+    pk: string;
+    /** Optional base64 coins/randomness for deterministic encapsulation. */
+    coins?: string;
+}
+/** ML-KEM decapsulation of a ciphertext with a secret key. */
+export interface DecapsRequest extends RequestBase {
+    family: "ml-kem";
+    op: "decaps";
+    /** Base64 secret (decapsulation) key. */
+    sk: string;
+    /** Base64 ciphertext. */
+    ct: string;
+}
+/** ML-DSA / SLH-DSA signature generation. */
+export interface SignRequest extends RequestBase {
+    family: SignatureFamily;
+    op: "sign";
+    /** Base64 secret (signing) key. */
+    sk: string;
+    /** Base64 message to sign. */
+    msg: string;
+}
+/** ML-DSA / SLH-DSA signature verification. */
+export interface VerifyRequest extends RequestBase {
+    family: SignatureFamily;
+    op: "verify";
+    /** Base64 public (verification) key. */
+    pk: string;
+    /** Base64 message. */
+    msg: string;
+    /** Base64 signature. */
+    sig: string;
+}
+/** Any request Sieve may send. */
+export type Request = KeygenRequest | EncapsRequest | DecapsRequest | SignRequest | VerifyRequest;
+/**
+ * Omit that distributes over a union, so each variant keeps its own fields
+ * (plain `Omit<Request, "id">` would collapse to only the common keys).
+ */
+type DistributiveOmit<T, K extends keyof T> = T extends unknown ? Omit<T, K> : never;
+/** A request as handed to the runner — the `id` is assigned by the runner. */
+export type RequestInput = DistributiveOmit<Request, "id"> & {
+    id?: number;
+};
+/** Successful keygen result. */
+export interface KeygenResult {
+    id: number;
+    ok: true;
+    /** Base64 public key. */
+    pk: string;
+    /** Base64 secret key. */
+    sk: string;
+}
+/** Successful encapsulation result. */
+export interface EncapsResult {
+    id: number;
+    ok: true;
+    /** Base64 ciphertext. */
+    ct: string;
+    /** Base64 shared secret. */
+    ss: string;
+}
+/** Successful decapsulation result. */
+export interface DecapsResult {
+    id: number;
+    ok: true;
+    /** Base64 shared secret. */
+    ss: string;
+}
+/** Successful signing result. */
+export interface SignResult {
+    id: number;
+    ok: true;
+    /** Base64 signature. */
+    sig: string;
+}
+/** Successful verification result. `valid` is the verification verdict. */
+export interface VerifyResult {
+    id: number;
+    ok: true;
+    /** Whether the signature verified against (pk, msg). */
+    valid: boolean;
+}
+/**
+ * A defined, well-formed error. The SUT MUST return this (not crash, not hang,
+ * not silently produce garbage) when it cannot or will not honor a request —
+ * for example when given a wrong-length key. Sieve treats a clean `error`
+ * response as a *correct* rejection in the size/robustness categories.
+ */
+export interface ErrorResult {
+    id: number;
+    ok: false;
+    /** Short machine-readable code, e.g. "invalid-length", "unsupported". */
+    code: string;
+    /** Human-readable detail. */
+    message: string;
+}
+/** Any response the SUT may emit. */
+export type Response = KeygenResult | EncapsResult | DecapsResult | SignResult | VerifyResult | ErrorResult;
+/** A successful (non-error) response. */
+export type SuccessResponse = Exclude<Response, ErrorResult>;
+/** Serialize a request to a single NDJSON line (including the trailing "\n"). */
+export declare function encodeRequest(req: Request): string;
+/** Raised when a line from the SUT cannot be parsed into a valid Response. */
+export declare class ProtocolError extends Error {
+    /** The offending raw line, truncated for safety. */
+    readonly raw: string;
+    constructor(message: string, raw: string);
+}
+/**
+ * Parse one NDJSON line from the SUT into a validated {@link Response}.
+ *
+ * Validates structural shape only (presence and types of fields); it does NOT
+ * validate cryptographic content or byte lengths — that is the categories'
+ * job. Throws {@link ProtocolError} on malformed input.
+ */
+export declare function decodeResponse(line: string): Response;
+/** Encode raw bytes to a base64 string. */
+export declare function toB64(bytes: Uint8Array): string;
+/**
+ * Decode a base64 string to bytes.
+ *
+ * @throws {ProtocolError} if the input is not valid base64 (i.e. re-encoding
+ *   the decoded bytes does not reproduce the canonical form).
+ */
+export declare function fromB64(b64: string): Uint8Array;
+export {};
+//# sourceMappingURL=protocol.d.ts.map

package/dist/protocol.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol.d.ts","sourceRoot":"","sources":["../src/protocol.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEnD,4DAA4D;AAC5D,eAAO,MAAM,gBAAgB,EAAG,CAAU,CAAC;AAM3C,2EAA2E;AAC3E,MAAM,MAAM,EAAE,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEpE,sEAAsE;AACtE,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEnD,sCAAsC;AACtC,UAAU,WAAW;IACnB,0EAA0E;IAC1E,EAAE,EAAE,MAAM,CAAC;IACX,6CAA6C;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,KAAK,EAAE,QAAQ,CAAC;IAChB,4BAA4B;IAC5B,EAAE,EAAE,EAAE,CAAC;CACR;AAED,8EAA8E;AAC9E,MAAM,WAAW,aAAc,SAAQ,WAAW;IAChD,EAAE,EAAE,QAAQ,CAAC;IACb,2EAA2E;IAC3E,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,iDAAiD;AACjD,MAAM,WAAW,aAAc,SAAQ,WAAW;IAChD,MAAM,EAAE,QAAQ,CAAC;IACjB,EAAE,EAAE,QAAQ,CAAC;IACb,yCAAyC;IACzC,EAAE,EAAE,MAAM,CAAC;IACX,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,8DAA8D;AAC9D,MAAM,WAAW,aAAc,SAAQ,WAAW;IAChD,MAAM,EAAE,QAAQ,CAAC;IACjB,EAAE,EAAE,QAAQ,CAAC;IACb,yCAAyC;IACzC,EAAE,EAAE,MAAM,CAAC;IACX,yBAAyB;IACzB,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,6CAA6C;AAC7C,MAAM,WAAW,WAAY,SAAQ,WAAW;IAC9C,MAAM,EAAE,eAAe,CAAC;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,mCAAmC;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,8BAA8B;IAC9B,GAAG,EAAE,MAAM,CAAC;CACb;AAED,+CAA+C;AAC/C,MAAM,WAAW,aAAc,SAAQ,WAAW;IAChD,MAAM,EAAE,eAAe,CAAC;IACxB,EAAE,EAAE,QAAQ,CAAC;IACb,wCAAwC;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,sBAAsB;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,wBAAwB;IACxB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,kCAAkC;AAClC,MAAM,MAAM,OAAO,GAAG,aAAa,GAAG,aAAa,GAAG,aAAa,GAAG,WAAW,GAAG,aAAa,CAAC;AAElG;;;GAGG;AACH,KAAK,gBAAgB,CAAC,CAAC,EAAE,CAAC,SAAS,MAAM,CAAC,IAAI,CAAC,SAAS,OAAO,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC;AAErF,8EAA8E;AAC9E,MAAM,MAAM,YAAY,GAAG,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG;IAAE,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAM7E,gCAAgC;AAChC,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,EAAE,IAAI,CAAC;IACT,yBAAyB;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,yBAAyB;IACzB,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,uCAAuC;AACvC,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,EAAE,IAAI,CAAC;IACT,yBAAyB;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,4BAA4B;IAC5B,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,uCAAuC;AACvC,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,EAAE,IAAI,CAAC;IACT,4BAA4B;IAC5B,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,iCAAiC;AACjC,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,EAAE,IAAI,CAAC;IACT,wBAAwB;IACxB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,2EAA2E;AAC3E,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,EAAE,IAAI,CAAC;IACT,wDAAwD;IACxD,KAAK,EAAE,OAAO,CAAC;CAChB;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,EAAE,KAAK,CAAC;IACV,yEAAyE;IACzE,IAAI,EAAE,MAAM,CAAC;IACb,6BAA6B;IAC7B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,qCAAqC;AACrC,MAAM,MAAM,QAAQ,GAChB,YAAY,GACZ,YAAY,GACZ,YAAY,GACZ,UAAU,GACV,YAAY,GACZ,WAAW,CAAC;AAEhB,yCAAyC;AACzC,MAAM,MAAM,eAAe,GAAG,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;AAM7D,iFAAiF;AACjF,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAElD;AAED,8EAA8E;AAC9E,qBAAa,aAAc,SAAQ,KAAK;IACtC,oDAAoD;IACpD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;gBACT,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM;CAKzC;AAUD;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,CAyDrD;AAMD,2CAA2C;AAC3C,wBAAgB,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAE/C;AAED;;;;;GAKG;AACH,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAO/C"}

package/dist/protocol.js

@@ -0,0 +1,115 @@
+/**
+ * The Sieve <-> SUT wire protocol.
+ *
+ * Sieve drives a system-under-test (SUT) — any ML-KEM / ML-DSA implementation
+ * the user provides — by spawning it as a child process and exchanging
+ * newline-delimited JSON (NDJSON) over stdin/stdout. One request per line, one
+ * response per line. All byte fields are base64-encoded strings.
+ *
+ * This module defines the request/response TypeScript types and the
+ * (de)serialization + validation logic. It performs NO cryptography. See
+ * PROTOCOL.md for the human-readable specification.
+ */
+/** Protocol version. Bumped on any breaking wire change. */
+export const PROTOCOL_VERSION = 1;
+// ---------------------------------------------------------------------------
+// Serialization
+// ---------------------------------------------------------------------------
+/** Serialize a request to a single NDJSON line (including the trailing "\n"). */
+export function encodeRequest(req) {
+    return JSON.stringify(req) + "\n";
+}
+/** Raised when a line from the SUT cannot be parsed into a valid Response. */
+export class ProtocolError extends Error {
+    /** The offending raw line, truncated for safety. */
+    raw;
+    constructor(message, raw) {
+        super(message);
+        this.name = "ProtocolError";
+        this.raw = raw.length > 512 ? raw.slice(0, 512) + "…" : raw;
+    }
+}
+function isObject(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function isStr(v) {
+    return typeof v === "string";
+}
+/**
+ * Parse one NDJSON line from the SUT into a validated {@link Response}.
+ *
+ * Validates structural shape only (presence and types of fields); it does NOT
+ * validate cryptographic content or byte lengths — that is the categories'
+ * job. Throws {@link ProtocolError} on malformed input.
+ */
+export function decodeResponse(line) {
+    const trimmed = line.trim();
+    if (trimmed.length === 0) {
+        throw new ProtocolError("empty line", line);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(trimmed);
+    }
+    catch (err) {
+        throw new ProtocolError(`not valid JSON: ${err.message}`, line);
+    }
+    if (!isObject(parsed)) {
+        throw new ProtocolError("response is not a JSON object", line);
+    }
+    const id = parsed["id"];
+    if (typeof id !== "number" || !Number.isInteger(id)) {
+        throw new ProtocolError("missing/invalid integer 'id'", line);
+    }
+    const ok = parsed["ok"];
+    if (typeof ok !== "boolean") {
+        throw new ProtocolError("missing/invalid boolean 'ok'", line);
+    }
+    if (ok === false) {
+        const code = parsed["code"];
+        const message = parsed["message"];
+        if (!isStr(code) || !isStr(message)) {
+            throw new ProtocolError("error response must have string 'code' and 'message'", line);
+        }
+        return { id, ok: false, code, message };
+    }
+    // ok === true: discriminate by which payload fields are present.
+    if (isStr(parsed["pk"]) && isStr(parsed["sk"])) {
+        return { id, ok: true, pk: parsed["pk"], sk: parsed["sk"] };
+    }
+    if (isStr(parsed["ct"]) && isStr(parsed["ss"])) {
+        return { id, ok: true, ct: parsed["ct"], ss: parsed["ss"] };
+    }
+    if (isStr(parsed["ss"])) {
+        return { id, ok: true, ss: parsed["ss"] };
+    }
+    if (isStr(parsed["sig"])) {
+        return { id, ok: true, sig: parsed["sig"] };
+    }
+    if (typeof parsed["valid"] === "boolean") {
+        return { id, ok: true, valid: parsed["valid"] };
+    }
+    throw new ProtocolError("ok response has no recognizable payload " + "(expected pk+sk, ct+ss, ss, sig, or valid)", line);
+}
+// ---------------------------------------------------------------------------
+// Base64 helpers (Node built-in Buffer — no external dependency)
+// ---------------------------------------------------------------------------
+/** Encode raw bytes to a base64 string. */
+export function toB64(bytes) {
+    return Buffer.from(bytes).toString("base64");
+}
+/**
+ * Decode a base64 string to bytes.
+ *
+ * @throws {ProtocolError} if the input is not valid base64 (i.e. re-encoding
+ *   the decoded bytes does not reproduce the canonical form).
+ */
+export function fromB64(b64) {
+    const buf = Buffer.from(b64, "base64");
+    // Buffer.from is lenient; sanity-check by re-encoding the canonical form.
+    if (buf.toString("base64").replace(/=+$/, "") !== b64.replace(/\s/g, "").replace(/=+$/, "")) {
+        throw new ProtocolError("invalid base64", b64);
+    }
+    return new Uint8Array(buf);
+}
+//# sourceMappingURL=protocol.js.map

package/dist/protocol.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol.js","sourceRoot":"","sources":["../src/protocol.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,4DAA4D;AAC5D,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAU,CAAC;AAgK3C,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E,iFAAiF;AACjF,MAAM,UAAU,aAAa,CAAC,GAAY;IACxC,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;AACpC,CAAC;AAED,8EAA8E;AAC9E,MAAM,OAAO,aAAc,SAAQ,KAAK;IACtC,oDAAoD;IAC3C,GAAG,CAAS;IACrB,YAAY,OAAe,EAAE,GAAW;QACtC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;QAC5B,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IAC9D,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,KAAK,CAAC,CAAU;IACvB,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC;AAC/B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,aAAa,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;IAC9C,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,aAAa,CAAC,mBAAoB,GAAa,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,CAAC;IAC7E,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,aAAa,CAAC,+BAA+B,EAAE,IAAI,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACxB,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,aAAa,CAAC,8BAA8B,EAAE,IAAI,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACxB,IAAI,OAAO,EAAE,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,aAAa,CAAC,8BAA8B,EAAE,IAAI,CAAC,CAAC;IAChE,CAAC;IAED,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5B,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,aAAa,CAAC,sDAAsD,EAAE,IAAI,CAAC,CAAC;QACxF,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC1C,CAAC;IAED,iEAAiE;IACjE,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAC/C,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;IAC9D,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAC/C,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;IAC9D,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;IAC5C,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IAC9C,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,SAAS,EAAE,CAAC;QACzC,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;IAClD,CAAC;IAED,MAAM,IAAI,aAAa,CACrB,0CAA0C,GAAG,4CAA4C,EACzF,IAAI,CACL,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,iEAAiE;AACjE,8EAA8E;AAE9E,2CAA2C;AAC3C,MAAM,UAAU,KAAK,CAAC,KAAiB;IACrC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,OAAO,CAAC,GAAW;IACjC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACvC,0EAA0E;IAC1E,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC;QAC5F,MAAM,IAAI,aAAa,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC"}

package/dist/report.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Report aggregation and formatting.
+ *
+ * Combines per-category results into a single {@link SieveReport} with an
+ * overall PASS/FAIL verdict, then renders it as JSON or as a human-readable
+ * terminal summary. Advisory categories (timing) never affect the verdict.
+ */
+import type { CategoryResult } from "./categories/types.js";
+import type { ParamSet } from "./sizes.js";
+/** Per-category counts. */
+export interface CategoryCounts {
+    pass: number;
+    fail: number;
+    skip: number;
+}
+/** The full report. */
+export interface SieveReport {
+    tool: "sieve";
+    protocolVersion: number;
+    param: ParamSet;
+    /** Argv of the SUT that was tested. */
+    impl: string[];
+    iterations: number;
+    vectorsDir?: string;
+    startedAt: string;
+    durationMs: number;
+    /** Overall verdict (advisory categories excluded). */
+    overall: "PASS" | "FAIL";
+    categories: CategoryResult[];
+    counts: CategoryCounts;
+}
+/** Compute the overall verdict: FAIL if any non-advisory category failed. */
+export declare function overallVerdict(categories: readonly CategoryResult[]): "PASS" | "FAIL";
+/** Assemble a {@link SieveReport} from category results and run metadata. */
+export declare function buildReport(args: {
+    param: ParamSet;
+    impl: string[];
+    iterations: number;
+    vectorsDir?: string;
+    startedAt: Date;
+    durationMs: number;
+    categories: CategoryResult[];
+}): SieveReport;
+/** Pretty JSON rendering. */
+export declare function formatJson(report: SieveReport): string;
+/** Human-readable terminal rendering (no color codes; CI-friendly). */
+export declare function formatHuman(report: SieveReport): string;
+//# sourceMappingURL=report.d.ts.map

package/dist/report.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.d.ts","sourceRoot":"","sources":["../src/report.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAU,MAAM,uBAAuB,CAAC;AAEpE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAK3C,2BAA2B;AAC3B,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,uBAAuB;AACvB,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,OAAO,CAAC;IACd,eAAe,EAAE,MAAM,CAAC;IACxB,KAAK,EAAE,QAAQ,CAAC;IAChB,uCAAuC;IACvC,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,sDAAsD;IACtD,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;IACzB,UAAU,EAAE,cAAc,EAAE,CAAC;IAC7B,MAAM,EAAE,cAAc,CAAC;CACxB;AAWD,6EAA6E;AAC7E,wBAAgB,cAAc,CAAC,UAAU,EAAE,SAAS,cAAc,EAAE,GAAG,MAAM,GAAG,MAAM,CAMrF;AAED,6EAA6E;AAC7E,wBAAgB,WAAW,CAAC,IAAI,EAAE;IAChC,KAAK,EAAE,QAAQ,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,IAAI,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,cAAc,EAAE,CAAC;CAC9B,GAAG,WAAW,CAcd;AAED,6BAA6B;AAC7B,wBAAgB,UAAU,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAEtD;AAID,uEAAuE;AACvE,wBAAgB,WAAW,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CA4BvD"}

package/dist/report.js

@@ -0,0 +1,79 @@
+/**
+ * Report aggregation and formatting.
+ *
+ * Combines per-category results into a single {@link SieveReport} with an
+ * overall PASS/FAIL verdict, then renders it as JSON or as a human-readable
+ * terminal summary. Advisory categories (timing) never affect the verdict.
+ */
+import { PROTOCOL_VERSION } from "./protocol.js";
+/** Categories that are informational and must not change the overall verdict. */
+const ADVISORY_CATEGORIES = new Set(["timing"]);
+/** Tally check-level pass/fail/skip across all categories. */
+function tally(categories) {
+    const counts = { pass: 0, fail: 0, skip: 0 };
+    for (const c of categories) {
+        for (const chk of c.checks)
+            counts[chk.status]++;
+    }
+    return counts;
+}
+/** Compute the overall verdict: FAIL if any non-advisory category failed. */
+export function overallVerdict(categories) {
+    for (const c of categories) {
+        if (ADVISORY_CATEGORIES.has(c.category))
+            continue;
+        if (c.status === "fail")
+            return "FAIL";
+    }
+    return "PASS";
+}
+/** Assemble a {@link SieveReport} from category results and run metadata. */
+export function buildReport(args) {
+    return {
+        tool: "sieve",
+        protocolVersion: PROTOCOL_VERSION,
+        param: args.param,
+        impl: args.impl,
+        iterations: args.iterations,
+        ...(args.vectorsDir ? { vectorsDir: args.vectorsDir } : {}),
+        startedAt: args.startedAt.toISOString(),
+        durationMs: args.durationMs,
+        overall: overallVerdict(args.categories),
+        categories: args.categories,
+        counts: tally(args.categories),
+    };
+}
+/** Pretty JSON rendering. */
+export function formatJson(report) {
+    return JSON.stringify(report, null, 2);
+}
+const SYMBOL = { pass: "PASS", fail: "FAIL", skip: "SKIP" };
+/** Human-readable terminal rendering (no color codes; CI-friendly). */
+export function formatHuman(report) {
+    const lines = [];
+    lines.push(`sieve — ML-KEM/ML-DSA/SLH-DSA conformance battery`);
+    lines.push(`  param      : ${report.param}`);
+    lines.push(`  impl       : ${report.impl.join(" ")}`);
+    lines.push(`  iterations : ${report.iterations}`);
+    if (report.vectorsDir)
+        lines.push(`  vectors    : ${report.vectorsDir}`);
+    lines.push(`  duration   : ${report.durationMs} ms`);
+    lines.push("");
+    for (const cat of report.categories) {
+        const advisory = ADVISORY_CATEGORIES.has(cat.category) ? " (advisory)" : "";
+        const bug = cat.bugClass ? ` [${cat.bugClass}]` : "";
+        lines.push(`[${SYMBOL[cat.status]}] ${cat.category}${bug}${advisory} — ${cat.summary}`);
+        // Show failing and skipped checks; collapse passes.
+        for (const chk of cat.checks) {
+            if (chk.status === "pass")
+                continue;
+            const cbug = chk.bugClass ? ` [${chk.bugClass}]` : "";
+            lines.push(`      - ${SYMBOL[chk.status]} ${chk.name}${cbug}: ${chk.detail}`);
+        }
+    }
+    lines.push("");
+    lines.push(`checks: ${report.counts.pass} pass, ${report.counts.fail} fail, ${report.counts.skip} skip`);
+    lines.push(`OVERALL: ${report.overall}`);
+    return lines.join("\n");
+}
+//# sourceMappingURL=report.js.map

package/dist/report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.js","sourceRoot":"","sources":["../src/report.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAGjD,iFAAiF;AACjF,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;AA0BxD,8DAA8D;AAC9D,SAAS,KAAK,CAAC,UAAqC;IAClD,MAAM,MAAM,GAAmB,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAC7D,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,MAAM;YAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;IACnD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,cAAc,CAAC,UAAqC;IAClE,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;YAAE,SAAS;QAClD,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM;YAAE,OAAO,MAAM,CAAC;IACzC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,WAAW,CAAC,IAQ3B;IACC,OAAO;QACL,IAAI,EAAE,OAAO;QACb,eAAe,EAAE,gBAAgB;QACjC,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE;QACvC,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,OAAO,EAAE,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC;QACxC,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC;KAC/B,CAAC;AACJ,CAAC;AAED,6BAA6B;AAC7B,MAAM,UAAU,UAAU,CAAC,MAAmB;IAC5C,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,MAAM,GAA2B,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAEpF,uEAAuE;AACvE,MAAM,UAAU,WAAW,CAAC,MAAmB;IAC7C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;IAChE,KAAK,CAAC,IAAI,CAAC,kBAAkB,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IAC7C,KAAK,CAAC,IAAI,CAAC,kBAAkB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACtD,KAAK,CAAC,IAAI,CAAC,kBAAkB,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IAClD,IAAI,MAAM,CAAC,UAAU;QAAE,KAAK,CAAC,IAAI,CAAC,kBAAkB,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IACzE,KAAK,CAAC,IAAI,CAAC,kBAAkB,MAAM,CAAC,UAAU,KAAK,CAAC,CAAC;IACrD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,KAAK,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,QAAQ,GAAG,GAAG,GAAG,QAAQ,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACxF,oDAAoD;QACpD,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;YAC7B,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;gBAAE,SAAS;YACpC,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,KAAK,CAAC,IAAI,CAAC,WAAW,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,GAAG,IAAI,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CACR,WAAW,MAAM,CAAC,MAAM,CAAC,IAAI,UAAU,MAAM,CAAC,MAAM,CAAC,IAAI,UAAU,MAAM,CAAC,MAAM,CAAC,IAAI,OAAO,CAC7F,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,YAAY,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACzC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/runner.d.ts

@@ -0,0 +1,129 @@
+/**
+ * The SUT runner: spawns a user-provided implementation as a child process and
+ * exchanges newline-delimited JSON requests/responses over stdin/stdout.
+ *
+ * Responsibilities:
+ *   - spawn the command, wire up a readline interface on its stdout,
+ *   - correlate responses to requests by `id`,
+ *   - enforce a per-request timeout,
+ *   - surface SUT crashes / stderr,
+ *   - tear the process down cleanly.
+ *
+ * Uses only node:child_process and node:readline. No cryptography here.
+ */
+import { type Request, type RequestInput, type Response } from "./protocol.js";
+/** Options for constructing a {@link Runner}. */
+export interface RunnerOptions {
+    /** Argv of the SUT, e.g. ["node", "./my-impl.js"]. First item is the bin. */
+    command: readonly string[];
+    /** Per-request timeout in milliseconds. */
+    timeoutMs?: number;
+    /** Working directory for the child process. */
+    cwd?: string;
+    /**
+     * Extra environment variables for the SUT. These are layered ON TOP of the
+     * scrubbed base env (see below) — they are the ONLY way to pass arbitrary
+     * variables to a SUT unless {@link RunnerOptions.inheritEnv} is set.
+     */
+    env?: Record<string, string>;
+    /**
+     * Inherit the FULL parent environment (`process.env`) instead of the scrubbed
+     * minimal env. **Default `false`.** The SUT is user-supplied code that Sieve
+     * drives; inheriting the parent env hands it every secret in the harness's
+     * environment (CI tokens, cloud creds, signing keys). Only enable this for
+     * trusted, local implementations you control. See docs/audits/security.md Q-17
+     * (CWE-526 / CWE-200).
+     */
+    inheritEnv?: boolean;
+    /**
+     * Additional environment variable NAMES to copy from `process.env` into the
+     * scrubbed base env (allow-list extension). Has no effect when
+     * {@link RunnerOptions.inheritEnv} is `true`. Values are read from the parent
+     * env at spawn time; names absent from `process.env` are skipped.
+     */
+    envAllowlist?: readonly string[];
+    /** Optional sink for the SUT's stderr lines (for diagnostics). */
+    onStderr?: (line: string) => void;
+}
+/**
+ * Minimal environment variables a child process generally needs to locate its
+ * interpreter, resolve its home directory, and produce sane text output. This
+ * is the default base env handed to the SUT — secrets in the parent env
+ * (tokens, credentials) are NOT forwarded. Extend via
+ * {@link RunnerOptions.envAllowlist} or pass explicit {@link RunnerOptions.env}.
+ */
+export declare const DEFAULT_ENV_ALLOWLIST: readonly string[];
+/**
+ * Build the environment handed to the spawned SUT.
+ *
+ * By default this is a SCRUBBED, minimal env: only the names in
+ * {@link DEFAULT_ENV_ALLOWLIST} (plus any in `opts.envAllowlist`) are copied
+ * from the parent `process.env`, then `opts.env` is layered on top. This keeps
+ * harness secrets out of untrusted SUT code (security.md Q-17). When
+ * `opts.inheritEnv` is set, the full parent env is used instead (legacy /
+ * trusted-local behavior).
+ *
+ * Exported for testing; the returned object never aliases `process.env`.
+ */
+export declare function buildSutEnv(opts: Pick<RunnerOptions, "env" | "inheritEnv" | "envAllowlist">, parentEnv?: NodeJS.ProcessEnv): Record<string, string>;
+/** Thrown when a request exceeds its timeout. */
+export declare class TimeoutError extends Error {
+    readonly request: Request;
+    readonly timeoutMs: number;
+    constructor(request: Request, timeoutMs: number);
+}
+/** Thrown when the SUT process dies before/while a request is in flight. */
+export declare class SutCrashError extends Error {
+    readonly stderr: string;
+    constructor(message: string, stderr: string);
+}
+/**
+ * A long-lived handle to a spawned SUT. Construct once per test run, issue many
+ * requests, then `close()`. Requests are matched to responses by `id`, so the
+ * SUT MAY answer out of order, though in practice it answers serially.
+ */
+export declare class Runner {
+    private readonly child;
+    private readonly rl;
+    private readonly pending;
+    private readonly timeoutMs;
+    private nextId;
+    private stderrBuf;
+    private closed;
+    private fatal;
+    constructor(opts: RunnerOptions);
+    /** Stderr captured from the SUT so far (most recent 64 KiB). */
+    get stderr(): string;
+    private onLine;
+    private failAll;
+    /**
+     * Send one request and await its response. The `id` field is assigned by the
+     * runner; any `id` on the passed object is overwritten.
+     */
+    send(req: RequestInput): Promise<Response>;
+    /**
+     * Issue many INDEPENDENT requests with bounded concurrency (pipelining).
+     *
+     * The protocol is id-correlated (each response carries the request's `id`),
+     * so multiple requests may be in flight against the SUT at once. This writes
+     * up to `maxInFlight` requests before awaiting any response, refilling as each
+     * completes, and returns results in the SAME ORDER as `reqs` (independent of
+     * the order the SUT answers).
+     *
+     * CORRECTNESS CONSTRAINT: every request in `reqs` MUST be independent of the
+     * others — no request may depend on another's response, and the SUT must not
+     * carry cross-request state that ordering would expose. Dependent or
+     * order-sensitive sequences (e.g. keygen→encaps→decaps for a single key, or
+     * the timing category's isolated measurements) MUST use serial `send()`
+     * instead. See docs/audits/performance.md §7.1.
+     *
+     * Setting `maxInFlight <= 1` degrades to strictly serial behavior.
+     */
+    sendMany(reqs: readonly RequestInput[], maxInFlight?: number): Promise<Response[]>;
+    /**
+     * Gracefully shut the SUT down: end stdin, wait briefly for a clean exit,
+     * then SIGTERM, then SIGKILL. Idempotent.
+     */
+    close(graceMs?: number): Promise<void>;
+}
+//# sourceMappingURL=runner.d.ts.map

package/dist/runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../src/runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,OAAO,EAIL,KAAK,OAAO,EACZ,KAAK,YAAY,EACjB,KAAK,QAAQ,EACd,MAAM,eAAe,CAAC;AAEvB,iDAAiD;AACjD,MAAM,WAAW,aAAa;IAC5B,6EAA6E;IAC7E,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,2CAA2C;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+CAA+C;IAC/C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,kEAAkE;IAClE,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACnC;AAED;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAelD,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CACzB,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,KAAK,GAAG,YAAY,GAAG,cAAc,CAAC,EAChE,SAAS,GAAE,MAAM,CAAC,UAAwB,GACzC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAkBxB;AAED,iDAAiD;AACjD,qBAAa,YAAa,SAAQ,KAAK;aAEnB,OAAO,EAAE,OAAO;aAChB,SAAS,EAAE,MAAM;gBADjB,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,MAAM;CAKpC;AAED,4EAA4E;AAC5E,qBAAa,aAAc,SAAQ,KAAK;aAGpB,MAAM,EAAE,MAAM;gBAD9B,OAAO,EAAE,MAAM,EACC,MAAM,EAAE,MAAM;CAKjC;AAUD;;;;GAIG;AACH,qBAAa,MAAM;IACjB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAiC;IACvD,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAY;IAC/B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA8B;IACtD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,MAAM,CAAK;IACnB,OAAO,CAAC,SAAS,CAAM;IACvB,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,KAAK,CAAoB;gBAErB,IAAI,EAAE,aAAa;IA0C/B,gEAAgE;IAChE,IAAI,MAAM,IAAI,MAAM,CAEnB;IAED,OAAO,CAAC,MAAM;IAsBd,OAAO,CAAC,OAAO;IASf;;;OAGG;IACH,IAAI,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC;IA8B1C;;;;;;;;;;;;;;;;;OAiBG;IACG,QAAQ,CAAC,IAAI,EAAE,SAAS,YAAY,EAAE,EAAE,WAAW,SAAK,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IA8BpF;;;OAGG;IACG,KAAK,CAAC,OAAO,SAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAgC1C"}