@quantakrypto/sieve 0.1.0

package/dist/runner.js

@@ -0,0 +1,305 @@
+/**
+ * The SUT runner: spawns a user-provided implementation as a child process and
+ * exchanges newline-delimited JSON requests/responses over stdin/stdout.
+ *
+ * Responsibilities:
+ *   - spawn the command, wire up a readline interface on its stdout,
+ *   - correlate responses to requests by `id`,
+ *   - enforce a per-request timeout,
+ *   - surface SUT crashes / stderr,
+ *   - tear the process down cleanly.
+ *
+ * Uses only node:child_process and node:readline. No cryptography here.
+ */
+import { spawn } from "node:child_process";
+import { createInterface } from "node:readline";
+import { decodeResponse, encodeRequest, } from "./protocol.js";
+/**
+ * Minimal environment variables a child process generally needs to locate its
+ * interpreter, resolve its home directory, and produce sane text output. This
+ * is the default base env handed to the SUT — secrets in the parent env
+ * (tokens, credentials) are NOT forwarded. Extend via
+ * {@link RunnerOptions.envAllowlist} or pass explicit {@link RunnerOptions.env}.
+ */
+export const DEFAULT_ENV_ALLOWLIST = [
+    "PATH",
+    "HOME",
+    "LANG",
+    "LC_ALL",
+    "LC_CTYPE",
+    "TMPDIR",
+    "TMP",
+    "TEMP",
+    // Windows process-spawn essentials (harmless / empty on POSIX).
+    "SystemRoot",
+    "SystemDrive",
+    "windir",
+    "PATHEXT",
+    "COMSPEC",
+];
+/**
+ * Build the environment handed to the spawned SUT.
+ *
+ * By default this is a SCRUBBED, minimal env: only the names in
+ * {@link DEFAULT_ENV_ALLOWLIST} (plus any in `opts.envAllowlist`) are copied
+ * from the parent `process.env`, then `opts.env` is layered on top. This keeps
+ * harness secrets out of untrusted SUT code (security.md Q-17). When
+ * `opts.inheritEnv` is set, the full parent env is used instead (legacy /
+ * trusted-local behavior).
+ *
+ * Exported for testing; the returned object never aliases `process.env`.
+ */
+export function buildSutEnv(opts, parentEnv = process.env) {
+    const out = {};
+    if (opts.inheritEnv === true) {
+        for (const [k, v] of Object.entries(parentEnv)) {
+            if (typeof v === "string")
+                out[k] = v;
+        }
+    }
+    else {
+        const names = new Set([...DEFAULT_ENV_ALLOWLIST, ...(opts.envAllowlist ?? [])]);
+        for (const name of names) {
+            const v = parentEnv[name];
+            if (typeof v === "string")
+                out[name] = v;
+        }
+    }
+    // Explicit extra env always wins, even over an inherited value.
+    if (opts.env) {
+        for (const [k, v] of Object.entries(opts.env))
+            out[k] = v;
+    }
+    return out;
+}
+/** Thrown when a request exceeds its timeout. */
+export class TimeoutError extends Error {
+    request;
+    timeoutMs;
+    constructor(request, timeoutMs) {
+        super(`SUT did not respond to id=${request.id} (${request.op}) within ${timeoutMs}ms`);
+        this.request = request;
+        this.timeoutMs = timeoutMs;
+        this.name = "TimeoutError";
+    }
+}
+/** Thrown when the SUT process dies before/while a request is in flight. */
+export class SutCrashError extends Error {
+    stderr;
+    constructor(message, stderr) {
+        super(message);
+        this.stderr = stderr;
+        this.name = "SutCrashError";
+    }
+}
+const DEFAULT_TIMEOUT_MS = 10_000;
+/**
+ * A long-lived handle to a spawned SUT. Construct once per test run, issue many
+ * requests, then `close()`. Requests are matched to responses by `id`, so the
+ * SUT MAY answer out of order, though in practice it answers serially.
+ */
+export class Runner {
+    child;
+    rl;
+    pending = new Map();
+    timeoutMs;
+    nextId = 1;
+    stderrBuf = "";
+    closed = false;
+    fatal;
+    constructor(opts) {
+        if (opts.command.length === 0) {
+            throw new Error("Runner: command must have at least one element");
+        }
+        this.timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+        const [bin, ...args] = opts.command;
+        this.child = spawn(bin, args, {
+            cwd: opts.cwd,
+            // Scrubbed, minimal env by default — see buildSutEnv / security.md Q-17.
+            env: buildSutEnv(opts),
+            stdio: ["pipe", "pipe", "pipe"],
+        });
+        this.child.on("error", (err) => {
+            this.failAll(new SutCrashError(`failed to spawn SUT: ${err.message}`, this.stderrBuf));
+        });
+        this.child.on("exit", (code, signal) => {
+            if (this.closed)
+                return;
+            const why = signal !== null ? `SUT exited via signal ${signal}` : `SUT exited with code ${code}`;
+            this.failAll(new SutCrashError(why, this.stderrBuf));
+        });
+        this.child.stderr.setEncoding("utf8");
+        this.child.stderr.on("data", (chunk) => {
+            this.stderrBuf += chunk;
+            if (this.stderrBuf.length > 1 << 16) {
+                this.stderrBuf = this.stderrBuf.slice(-(1 << 16));
+            }
+            if (opts.onStderr) {
+                for (const line of chunk.split("\n")) {
+                    if (line.length > 0)
+                        opts.onStderr(line);
+                }
+            }
+        });
+        this.rl = createInterface({ input: this.child.stdout });
+        this.rl.on("line", (line) => this.onLine(line));
+    }
+    /** Stderr captured from the SUT so far (most recent 64 KiB). */
+    get stderr() {
+        return this.stderrBuf;
+    }
+    onLine(line) {
+        if (line.trim().length === 0)
+            return;
+        let resp;
+        try {
+            resp = decodeResponse(line);
+        }
+        catch (err) {
+            // A protocol violation on a line we can't correlate is fatal; if we can
+            // extract an id, fail just that request, else fail everything.
+            const pe = err;
+            this.failAll(pe);
+            return;
+        }
+        const entry = this.pending.get(resp.id);
+        if (entry === undefined) {
+            // Unsolicited / duplicate id — record but do not crash the run.
+            return;
+        }
+        clearTimeout(entry.timer);
+        this.pending.delete(resp.id);
+        entry.resolve(resp);
+    }
+    failAll(err) {
+        if (this.fatal === undefined)
+            this.fatal = err;
+        for (const [, p] of this.pending) {
+            clearTimeout(p.timer);
+            p.reject(err);
+        }
+        this.pending.clear();
+    }
+    /**
+     * Send one request and await its response. The `id` field is assigned by the
+     * runner; any `id` on the passed object is overwritten.
+     */
+    send(req) {
+        if (this.closed) {
+            return Promise.reject(new Error("Runner is closed"));
+        }
+        if (this.fatal !== undefined) {
+            return Promise.reject(this.fatal);
+        }
+        const id = this.nextId++;
+        const full = { ...req, id };
+        return new Promise((resolve, reject) => {
+            const timer = setTimeout(() => {
+                this.pending.delete(id);
+                reject(new TimeoutError(full, this.timeoutMs));
+            }, this.timeoutMs);
+            // Do not keep the event loop alive solely for this timer.
+            if (typeof timer.unref === "function")
+                timer.unref();
+            this.pending.set(id, { resolve, reject, timer });
+            this.child.stdin.write(encodeRequest(full), (err) => {
+                if (err) {
+                    clearTimeout(timer);
+                    this.pending.delete(id);
+                    reject(new SutCrashError(`write to SUT failed: ${err.message}`, this.stderrBuf));
+                }
+            });
+        });
+    }
+    /**
+     * Issue many INDEPENDENT requests with bounded concurrency (pipelining).
+     *
+     * The protocol is id-correlated (each response carries the request's `id`),
+     * so multiple requests may be in flight against the SUT at once. This writes
+     * up to `maxInFlight` requests before awaiting any response, refilling as each
+     * completes, and returns results in the SAME ORDER as `reqs` (independent of
+     * the order the SUT answers).
+     *
+     * CORRECTNESS CONSTRAINT: every request in `reqs` MUST be independent of the
+     * others — no request may depend on another's response, and the SUT must not
+     * carry cross-request state that ordering would expose. Dependent or
+     * order-sensitive sequences (e.g. keygen→encaps→decaps for a single key, or
+     * the timing category's isolated measurements) MUST use serial `send()`
+     * instead. See docs/audits/performance.md §7.1.
+     *
+     * Setting `maxInFlight <= 1` degrades to strictly serial behavior.
+     */
+    async sendMany(reqs, maxInFlight = 16) {
+        const limit = Math.max(1, Math.floor(maxInFlight));
+        const results = new Array(reqs.length);
+        let next = 0;
+        let firstError;
+        const worker = async () => {
+            while (firstError === undefined) {
+                const i = next++;
+                if (i >= reqs.length)
+                    return;
+                try {
+                    results[i] = await this.send(reqs[i]);
+                }
+                catch (err) {
+                    // Capture the first failure and stop launching new work; in-flight
+                    // siblings settle on their own (their results are discarded).
+                    if (firstError === undefined)
+                        firstError = err;
+                    return;
+                }
+            }
+        };
+        const workers = [];
+        for (let w = 0; w < Math.min(limit, reqs.length); w++) {
+            workers.push(worker());
+        }
+        await Promise.all(workers);
+        if (firstError !== undefined)
+            throw firstError;
+        return results;
+    }
+    /**
+     * Gracefully shut the SUT down: end stdin, wait briefly for a clean exit,
+     * then SIGTERM, then SIGKILL. Idempotent.
+     */
+    async close(graceMs = 500) {
+        if (this.closed)
+            return;
+        this.closed = true;
+        this.rl.close();
+        try {
+            this.child.stdin.end();
+        }
+        catch {
+            /* already closed */
+        }
+        const exited = new Promise((resolve) => {
+            if (this.child.exitCode !== null || this.child.signalCode !== null) {
+                resolve();
+                return;
+            }
+            this.child.once("exit", () => resolve());
+        });
+        const timed = await Promise.race([exited.then(() => true), delay(graceMs).then(() => false)]);
+        if (!timed && this.child.exitCode === null) {
+            this.child.kill("SIGTERM");
+            const killed = await Promise.race([
+                exited.then(() => true),
+                delay(graceMs).then(() => false),
+            ]);
+            if (!killed && this.child.exitCode === null) {
+                this.child.kill("SIGKILL");
+            }
+        }
+    }
+}
+function delay(ms) {
+    return new Promise((resolve) => {
+        const t = setTimeout(resolve, ms);
+        if (typeof t.unref === "function")
+            t.unref();
+    });
+}
+//# sourceMappingURL=runner.js.map

package/dist/runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner.js","sourceRoot":"","sources":["../src/runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,KAAK,EAAuC,MAAM,oBAAoB,CAAC;AAChF,OAAO,EAAE,eAAe,EAAkB,MAAM,eAAe,CAAC;AAEhE,OAAO,EACL,cAAc,EACd,aAAa,GAKd,MAAM,eAAe,CAAC;AAoCvB;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAsB;IACtD,MAAM;IACN,MAAM;IACN,MAAM;IACN,QAAQ;IACR,UAAU;IACV,QAAQ;IACR,KAAK;IACL,MAAM;IACN,gEAAgE;IAChE,YAAY;IACZ,aAAa;IACb,QAAQ;IACR,SAAS;IACT,SAAS;CACV,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,WAAW,CACzB,IAAgE,EAChE,YAA+B,OAAO,CAAC,GAAG;IAE1C,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QAC7B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC/C,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,KAAK,GAAG,IAAI,GAAG,CAAS,CAAC,GAAG,qBAAqB,EAAE,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACxF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;YAC1B,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IACD,gEAAgE;IAChE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iDAAiD;AACjD,MAAM,OAAO,YAAa,SAAQ,KAAK;IAEnB;IACA;IAFlB,YACkB,OAAgB,EAChB,SAAiB;QAEjC,KAAK,CAAC,6BAA6B,OAAO,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,YAAY,SAAS,IAAI,CAAC,CAAC;QAHvE,YAAO,GAAP,OAAO,CAAS;QAChB,cAAS,GAAT,SAAS,CAAQ;QAGjC,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IAC7B,CAAC;CACF;AAED,4EAA4E;AAC5E,MAAM,OAAO,aAAc,SAAQ,KAAK;IAGpB;IAFlB,YACE,OAAe,EACC,MAAc;QAE9B,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,WAAM,GAAN,MAAM,CAAQ;QAG9B,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;IAC9B,CAAC;CACF;AAQD,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC;;;;GAIG;AACH,MAAM,OAAO,MAAM;IACA,KAAK,CAAiC;IACtC,EAAE,CAAY;IACd,OAAO,GAAG,IAAI,GAAG,EAAmB,CAAC;IACrC,SAAS,CAAS;IAC3B,MAAM,GAAG,CAAC,CAAC;IACX,SAAS,GAAG,EAAE,CAAC;IACf,MAAM,GAAG,KAAK,CAAC;IACf,KAAK,CAAoB;IAEjC,YAAY,IAAmB;QAC7B,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;QAEtD,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC;QACpC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,GAAa,EAAE,IAAI,EAAE;YACtC,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,yEAAyE;YACzE,GAAG,EAAE,WAAW,CAAC,IAAI,CAAC;YACtB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAmC,CAAC;QAErC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YAC7B,IAAI,CAAC,OAAO,CAAC,IAAI,aAAa,CAAC,wBAAwB,GAAG,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;QACzF,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YACrC,IAAI,IAAI,CAAC,MAAM;gBAAE,OAAO;YACxB,MAAM,GAAG,GACP,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,yBAAyB,MAAM,EAAE,CAAC,CAAC,CAAC,wBAAwB,IAAI,EAAE,CAAC;YACvF,IAAI,CAAC,OAAO,CAAC,IAAI,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAC7C,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;YACxB,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;gBACpC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YACpD,CAAC;YACD,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAClB,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;oBACrC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;wBAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAC3C,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACxD,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,gEAAgE;IAChE,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAEO,MAAM,CAAC,IAAY;QACzB,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACrC,IAAI,IAAc,CAAC;QACnB,IAAI,CAAC;YACH,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,wEAAwE;YACxE,+DAA+D;YAC/D,MAAM,EAAE,GAAG,GAAoB,CAAC;YAChC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACjB,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,gEAAgE;YAChE,OAAO;QACT,CAAC;QACD,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC7B,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;IAEO,OAAO,CAAC,GAAU;QACxB,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;YAAE,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC;QAC/C,KAAK,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YACtB,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChB,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAED;;;OAGG;IACH,IAAI,CAAC,GAAiB;QACpB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,EAAE,GAAG,GAAG,EAAE,EAAE,EAAa,CAAC;QAEvC,OAAO,IAAI,OAAO,CAAW,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC/C,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACxB,MAAM,CAAC,IAAI,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;YACjD,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YACnB,0DAA0D;YAC1D,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,UAAU;gBAAE,KAAK,CAAC,KAAK,EAAE,CAAC;YAErD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAEjD,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE;gBAClD,IAAI,GAAG,EAAE,CAAC;oBACR,YAAY,CAAC,KAAK,CAAC,CAAC;oBACpB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;oBACxB,MAAM,CAAC,IAAI,aAAa,CAAC,wBAAwB,GAAG,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;gBACnF,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,KAAK,CAAC,QAAQ,CAAC,IAA6B,EAAE,WAAW,GAAG,EAAE;QAC5D,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;QACnD,MAAM,OAAO,GAAe,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnD,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,IAAI,UAA6B,CAAC;QAElC,MAAM,MAAM,GAAG,KAAK,IAAmB,EAAE;YACvC,OAAO,UAAU,KAAK,SAAS,EAAE,CAAC;gBAChC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;gBACjB,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM;oBAAE,OAAO;gBAC7B,IAAI,CAAC;oBACH,OAAO,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAiB,CAAC,CAAC;gBACxD,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,mEAAmE;oBACnE,8DAA8D;oBAC9D,IAAI,UAAU,KAAK,SAAS;wBAAE,UAAU,GAAG,GAAY,CAAC;oBACxD,OAAO;gBACT,CAAC;YACH,CAAC;QACH,CAAC,CAAC;QAEF,MAAM,OAAO,GAAoB,EAAE,CAAC;QACpC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YACtD,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACzB,CAAC;QACD,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3B,IAAI,UAAU,KAAK,SAAS;YAAE,MAAM,UAAU,CAAC;QAC/C,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,GAAG;QACvB,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QACxB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QAEnB,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,oBAAoB;QACtB,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAC3C,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;gBACnE,OAAO,EAAE,CAAC;gBACV,OAAO;YACT,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAE9F,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC3C,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC3B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;gBAChC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;gBACvB,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC;aACjC,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;gBAC5C,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,CAAC,GAAG,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAClC,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,UAAU;YAAE,CAAC,CAAC,KAAK,EAAE,CAAC;IAC/C,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/sizes.d.ts

@@ -0,0 +1,84 @@
+/**
+ * Public parameter-size tables for ML-KEM (FIPS 203), ML-DSA (FIPS 204), and
+ * SLH-DSA (FIPS 205).
+ *
+ * These are the ONLY hard-coded cryptographic constants in Sieve. They are
+ * public, standardized byte lengths — not secret Known-Answer-Test values.
+ * Sieve uses them purely to check that a system-under-test (SUT) emits
+ * artifacts of the correct shape; it never derives or fabricates the bytes
+ * themselves.
+ *
+ * Sources:
+ *   - ML-KEM:   NIST FIPS 203, Table 3 (sizes of key/ciphertext byte strings).
+ *   - ML-DSA:   NIST FIPS 204, Table 2 (sizes of key/signature byte strings).
+ *   - SLH-DSA:  NIST FIPS 205, Table 2 (parameter sets) — pk = 2n, sk = 4n,
+ *               signature lengths per set. The 12 standardized sets pair each of
+ *               six (security level × s/f) combinations with a SHA2 or SHAKE
+ *               hash; the public sizes depend only on the level×s/f, so the
+ *               SHA2 and SHAKE variants share sizes.
+ */
+/** Algorithm families Sieve knows how to drive. */
+export type Family = "ml-kem" | "ml-dsa" | "slh-dsa";
+/** Canonical parameter-set identifiers accepted on the CLI / API. */
+export type ParamSet = "ml-kem-512" | "ml-kem-768" | "ml-kem-1024" | "ml-dsa-44" | "ml-dsa-65" | "ml-dsa-87" | "slh-dsa-sha2-128s" | "slh-dsa-shake-128s" | "slh-dsa-sha2-128f" | "slh-dsa-shake-128f" | "slh-dsa-sha2-192s" | "slh-dsa-shake-192s" | "slh-dsa-sha2-192f" | "slh-dsa-shake-192f" | "slh-dsa-sha2-256s" | "slh-dsa-shake-256s" | "slh-dsa-sha2-256f" | "slh-dsa-shake-256f";
+/** Byte sizes for an ML-KEM parameter set (FIPS 203, Table 3). */
+export interface KemSizes {
+    readonly family: "ml-kem";
+    readonly id: ParamSet;
+    /** Encapsulation (public) key length in bytes. */
+    readonly publicKey: number;
+    /** Decapsulation (secret) key length in bytes. */
+    readonly secretKey: number;
+    /** Ciphertext length in bytes. */
+    readonly ciphertext: number;
+    /** Shared secret length in bytes (32 for every ML-KEM set). */
+    readonly sharedSecret: number;
+}
+/** Byte sizes for an ML-DSA parameter set (FIPS 204, Table 2). */
+export interface DsaSizes {
+    readonly family: "ml-dsa";
+    readonly id: ParamSet;
+    /** Verification (public) key length in bytes. */
+    readonly publicKey: number;
+    /** Signing (secret) key length in bytes. */
+    readonly secretKey: number;
+    /** Signature length in bytes (fixed-length encoding). */
+    readonly signature: number;
+}
+/** Byte sizes for an SLH-DSA parameter set (FIPS 205, Table 2). */
+export interface SlhDsaSizes {
+    readonly family: "slh-dsa";
+    readonly id: ParamSet;
+    /** Verification (public) key length in bytes (= 2·n). */
+    readonly publicKey: number;
+    /** Signing (secret) key length in bytes (= 4·n). */
+    readonly secretKey: number;
+    /** Signature length in bytes. */
+    readonly signature: number;
+}
+/** Union of the size shapes. */
+export type Sizes = KemSizes | DsaSizes | SlhDsaSizes;
+/** A signature-family size record (ML-DSA or SLH-DSA). */
+export type SignatureSizes = DsaSizes | SlhDsaSizes;
+/** All known parameter-set identifiers, in canonical order. */
+export declare const PARAM_SETS: readonly ParamSet[];
+/** Type guard: is `s` a recognized parameter-set identifier? */
+export declare function isParamSet(s: string): s is ParamSet;
+/**
+ * Look up the size record for a parameter set.
+ *
+ * @throws {RangeError} if `id` is not a recognized parameter set.
+ */
+export declare function sizesFor(id: ParamSet): Sizes;
+/** Narrowing helper: KEM size record or `undefined`. */
+export declare function asKemSizes(s: Sizes): KemSizes | undefined;
+/** Narrowing helper: DSA size record or `undefined`. */
+export declare function asDsaSizes(s: Sizes): DsaSizes | undefined;
+/** Narrowing helper: SLH-DSA size record or `undefined`. */
+export declare function asSlhDsaSizes(s: Sizes): SlhDsaSizes | undefined;
+/**
+ * Narrowing helper: any signature-family size record (ML-DSA or SLH-DSA) or
+ * `undefined`. Both expose `publicKey`, `secretKey`, and `signature`.
+ */
+export declare function asSignatureSizes(s: Sizes): SignatureSizes | undefined;
+//# sourceMappingURL=sizes.d.ts.map

package/dist/sizes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sizes.d.ts","sourceRoot":"","sources":["../src/sizes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,mDAAmD;AACnD,MAAM,MAAM,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;AAErD,qEAAqE;AACrE,MAAM,MAAM,QAAQ,GAChB,YAAY,GACZ,YAAY,GACZ,aAAa,GACb,WAAW,GACX,WAAW,GACX,WAAW,GACX,mBAAmB,GACnB,oBAAoB,GACpB,mBAAmB,GACnB,oBAAoB,GACpB,mBAAmB,GACnB,oBAAoB,GACpB,mBAAmB,GACnB,oBAAoB,GACpB,mBAAmB,GACnB,oBAAoB,GACpB,mBAAmB,GACnB,oBAAoB,CAAC;AAEzB,kEAAkE;AAClE,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC1B,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC;IACtB,kDAAkD;IAClD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,kDAAkD;IAClD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,kCAAkC;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,+DAA+D;IAC/D,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,kEAAkE;AAClE,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC1B,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC;IACtB,iDAAiD;IACjD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,4CAA4C;IAC5C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,yDAAyD;IACzD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,mEAAmE;AACnE,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC;IACtB,yDAAyD;IACzD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,oDAAoD;IACpD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,iCAAiC;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,gCAAgC;AAChC,MAAM,MAAM,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,WAAW,CAAC;AAEtD,0DAA0D;AAC1D,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,WAAW,CAAC;AAiKpD,+DAA+D;AAC/D,eAAO,MAAM,UAAU,EAAE,SAAS,QAAQ,EAAqC,CAAC;AAEhF,gEAAgE;AAChE,wBAAgB,UAAU,CAAC,CAAC,EAAE,MAAM,GAAG,CAAC,IAAI,QAAQ,CAEnD;AAED;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,EAAE,EAAE,QAAQ,GAAG,KAAK,CAM5C;AAED,wDAAwD;AACxD,wBAAgB,UAAU,CAAC,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,SAAS,CAEzD;AAED,wDAAwD;AACxD,wBAAgB,UAAU,CAAC,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,SAAS,CAEzD;AAED,4DAA4D;AAC5D,wBAAgB,aAAa,CAAC,CAAC,EAAE,KAAK,GAAG,WAAW,GAAG,SAAS,CAE/D;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,KAAK,GAAG,cAAc,GAAG,SAAS,CAErE"}

package/dist/sizes.js

@@ -0,0 +1,214 @@
+/**
+ * Public parameter-size tables for ML-KEM (FIPS 203), ML-DSA (FIPS 204), and
+ * SLH-DSA (FIPS 205).
+ *
+ * These are the ONLY hard-coded cryptographic constants in Sieve. They are
+ * public, standardized byte lengths — not secret Known-Answer-Test values.
+ * Sieve uses them purely to check that a system-under-test (SUT) emits
+ * artifacts of the correct shape; it never derives or fabricates the bytes
+ * themselves.
+ *
+ * Sources:
+ *   - ML-KEM:   NIST FIPS 203, Table 3 (sizes of key/ciphertext byte strings).
+ *   - ML-DSA:   NIST FIPS 204, Table 2 (sizes of key/signature byte strings).
+ *   - SLH-DSA:  NIST FIPS 205, Table 2 (parameter sets) — pk = 2n, sk = 4n,
+ *               signature lengths per set. The 12 standardized sets pair each of
+ *               six (security level × s/f) combinations with a SHA2 or SHAKE
+ *               hash; the public sizes depend only on the level×s/f, so the
+ *               SHA2 and SHAKE variants share sizes.
+ */
+/**
+ * The size table. Values are public, standardized constants.
+ *
+ * ML-KEM (FIPS 203, Table 3):
+ *   set        pk     sk     ct     ss
+ *   512        800    1632   768    32
+ *   768        1184   2400   1088   32
+ *   1024       1568   3168   1568   32
+ *
+ * ML-DSA (FIPS 204, Table 2):
+ *   set        pk     sk     sig
+ *   44         1312   2560   2420
+ *   65         1952   4032   3309
+ *   87         2592   4896   4627
+ *
+ * SLH-DSA (FIPS 205, Table 2): pk = 2n, sk = 4n; signature length per set.
+ *   level/var  n    pk    sk     sig
+ *   128s       16   32    64     7856
+ *   128f       16   32    64     17088
+ *   192s       24   48    96     16224
+ *   192f       24   48    96     35664
+ *   256s       32   64    128    29792
+ *   256f       32   64    128    49856
+ * (SHA2 and SHAKE variants of a given level/var share these public sizes.)
+ */
+const TABLE = {
+    "ml-kem-512": {
+        family: "ml-kem",
+        id: "ml-kem-512",
+        publicKey: 800,
+        secretKey: 1632,
+        ciphertext: 768,
+        sharedSecret: 32,
+    },
+    "ml-kem-768": {
+        family: "ml-kem",
+        id: "ml-kem-768",
+        publicKey: 1184,
+        secretKey: 2400,
+        ciphertext: 1088,
+        sharedSecret: 32,
+    },
+    "ml-kem-1024": {
+        family: "ml-kem",
+        id: "ml-kem-1024",
+        publicKey: 1568,
+        secretKey: 3168,
+        ciphertext: 1568,
+        sharedSecret: 32,
+    },
+    "ml-dsa-44": {
+        family: "ml-dsa",
+        id: "ml-dsa-44",
+        publicKey: 1312,
+        secretKey: 2560,
+        signature: 2420,
+    },
+    "ml-dsa-65": {
+        family: "ml-dsa",
+        id: "ml-dsa-65",
+        publicKey: 1952,
+        secretKey: 4032,
+        signature: 3309,
+    },
+    "ml-dsa-87": {
+        family: "ml-dsa",
+        id: "ml-dsa-87",
+        publicKey: 2592,
+        secretKey: 4896,
+        signature: 4627,
+    },
+    // SLH-DSA (FIPS 205, Table 2). SHA2 and SHAKE share sizes per level/variant.
+    "slh-dsa-sha2-128s": {
+        family: "slh-dsa",
+        id: "slh-dsa-sha2-128s",
+        publicKey: 32,
+        secretKey: 64,
+        signature: 7856,
+    },
+    "slh-dsa-shake-128s": {
+        family: "slh-dsa",
+        id: "slh-dsa-shake-128s",
+        publicKey: 32,
+        secretKey: 64,
+        signature: 7856,
+    },
+    "slh-dsa-sha2-128f": {
+        family: "slh-dsa",
+        id: "slh-dsa-sha2-128f",
+        publicKey: 32,
+        secretKey: 64,
+        signature: 17088,
+    },
+    "slh-dsa-shake-128f": {
+        family: "slh-dsa",
+        id: "slh-dsa-shake-128f",
+        publicKey: 32,
+        secretKey: 64,
+        signature: 17088,
+    },
+    "slh-dsa-sha2-192s": {
+        family: "slh-dsa",
+        id: "slh-dsa-sha2-192s",
+        publicKey: 48,
+        secretKey: 96,
+        signature: 16224,
+    },
+    "slh-dsa-shake-192s": {
+        family: "slh-dsa",
+        id: "slh-dsa-shake-192s",
+        publicKey: 48,
+        secretKey: 96,
+        signature: 16224,
+    },
+    "slh-dsa-sha2-192f": {
+        family: "slh-dsa",
+        id: "slh-dsa-sha2-192f",
+        publicKey: 48,
+        secretKey: 96,
+        signature: 35664,
+    },
+    "slh-dsa-shake-192f": {
+        family: "slh-dsa",
+        id: "slh-dsa-shake-192f",
+        publicKey: 48,
+        secretKey: 96,
+        signature: 35664,
+    },
+    "slh-dsa-sha2-256s": {
+        family: "slh-dsa",
+        id: "slh-dsa-sha2-256s",
+        publicKey: 64,
+        secretKey: 128,
+        signature: 29792,
+    },
+    "slh-dsa-shake-256s": {
+        family: "slh-dsa",
+        id: "slh-dsa-shake-256s",
+        publicKey: 64,
+        secretKey: 128,
+        signature: 29792,
+    },
+    "slh-dsa-sha2-256f": {
+        family: "slh-dsa",
+        id: "slh-dsa-sha2-256f",
+        publicKey: 64,
+        secretKey: 128,
+        signature: 49856,
+    },
+    "slh-dsa-shake-256f": {
+        family: "slh-dsa",
+        id: "slh-dsa-shake-256f",
+        publicKey: 64,
+        secretKey: 128,
+        signature: 49856,
+    },
+};
+/** All known parameter-set identifiers, in canonical order. */
+export const PARAM_SETS = Object.keys(TABLE);
+/** Type guard: is `s` a recognized parameter-set identifier? */
+export function isParamSet(s) {
+    return Object.prototype.hasOwnProperty.call(TABLE, s);
+}
+/**
+ * Look up the size record for a parameter set.
+ *
+ * @throws {RangeError} if `id` is not a recognized parameter set.
+ */
+export function sizesFor(id) {
+    const entry = TABLE[id];
+    if (entry === undefined) {
+        throw new RangeError(`unknown parameter set: ${id}`);
+    }
+    return entry;
+}
+/** Narrowing helper: KEM size record or `undefined`. */
+export function asKemSizes(s) {
+    return s.family === "ml-kem" ? s : undefined;
+}
+/** Narrowing helper: DSA size record or `undefined`. */
+export function asDsaSizes(s) {
+    return s.family === "ml-dsa" ? s : undefined;
+}
+/** Narrowing helper: SLH-DSA size record or `undefined`. */
+export function asSlhDsaSizes(s) {
+    return s.family === "slh-dsa" ? s : undefined;
+}
+/**
+ * Narrowing helper: any signature-family size record (ML-DSA or SLH-DSA) or
+ * `undefined`. Both expose `publicKey`, `secretKey`, and `signature`.
+ */
+export function asSignatureSizes(s) {
+    return s.family === "ml-dsa" || s.family === "slh-dsa" ? s : undefined;
+}
+//# sourceMappingURL=sizes.js.map

package/dist/sizes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sizes.js","sourceRoot":"","sources":["../src/sizes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAsEH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,KAAK,GAAsC;IAC/C,YAAY,EAAE;QACZ,MAAM,EAAE,QAAQ;QAChB,EAAE,EAAE,YAAY;QAChB,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,GAAG;QACf,YAAY,EAAE,EAAE;KACjB;IACD,YAAY,EAAE;QACZ,MAAM,EAAE,QAAQ;QAChB,EAAE,EAAE,YAAY;QAChB,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,IAAI;QAChB,YAAY,EAAE,EAAE;KACjB;IACD,aAAa,EAAE;QACb,MAAM,EAAE,QAAQ;QAChB,EAAE,EAAE,aAAa;QACjB,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,IAAI;QAChB,YAAY,EAAE,EAAE;KACjB;IACD,WAAW,EAAE;QACX,MAAM,EAAE,QAAQ;QAChB,EAAE,EAAE,WAAW;QACf,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,IAAI;KAChB;IACD,WAAW,EAAE;QACX,MAAM,EAAE,QAAQ;QAChB,EAAE,EAAE,WAAW;QACf,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,IAAI;KAChB;IACD,WAAW,EAAE;QACX,MAAM,EAAE,QAAQ;QAChB,EAAE,EAAE,WAAW;QACf,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,IAAI;KAChB;IAED,6EAA6E;IAC7E,mBAAmB,EAAE;QACnB,MAAM,EAAE,SAAS;QACjB,EAAE,EAAE,mBAAmB;QACvB,SAAS,EAAE,EAAE;QACb,SAAS,EAAE,EAAE;QACb,SAAS,EAAE,IAAI;KAChB;IACD,oBAAoB,EAAE;QACpB,MAAM,EAAE,SAAS;QACjB,EAAE,EAAE,oBAAoB;QACxB,SAAS,EAAE,EAAE;QACb,SAAS,EAAE,EAAE;QACb,SAAS,EAAE,IAAI;KAChB;IACD,mBAAmB,EAAE;QACnB,MAAM,EAAE,SAAS;QACjB,EAAE,EAAE,mBAAmB;QACvB,SAAS,EAAE,EAAE;QACb,SAAS,EAAE,EAAE;QACb,SAAS,EAAE,KAAK;KACjB;IACD,oBAAoB,EAAE;QACpB,MAAM,EAAE,SAAS;QACjB,EAAE,EAAE,oBAAoB;QACxB,SAAS,EAAE,EAAE;QACb,SAAS,EAAE,EAAE;QACb,SAAS,EAAE,KAAK;KACjB;IACD,mBAAmB,EAAE;QACnB,MAAM,EAAE,SAAS;QACjB,EAAE,EAAE,mBAAmB;QACvB,SAAS,EAAE,EAAE;QACb,SAAS,EAAE,EAAE;QACb,SAAS,EAAE,KAAK;KACjB;IACD,oBAAoB,EAAE;QACpB,MAAM,EAAE,SAAS;QACjB,EAAE,EAAE,oBAAoB;QACxB,SAAS,EAAE,EAAE;QACb,SAAS,EAAE,EAAE;QACb,SAAS,EAAE,KAAK;KACjB;IACD,mBAAmB,EAAE;QACnB,MAAM,EAAE,SAAS;QACjB,EAAE,EAAE,mBAAmB;QACvB,SAAS,EAAE,EAAE;QACb,SAAS,EAAE,EAAE;QACb,SAAS,EAAE,KAAK;KACjB;IACD,oBAAoB,EAAE;QACpB,MAAM,EAAE,SAAS;QACjB,EAAE,EAAE,oBAAoB;QACxB,SAAS,EAAE,EAAE;QACb,SAAS,EAAE,EAAE;QACb,SAAS,EAAE,KAAK;KACjB;IACD,mBAAmB,EAAE;QACnB,MAAM,EAAE,SAAS;QACjB,EAAE,EAAE,mBAAmB;QACvB,SAAS,EAAE,EAAE;QACb,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,KAAK;KACjB;IACD,oBAAoB,EAAE;QACpB,MAAM,EAAE,SAAS;QACjB,EAAE,EAAE,oBAAoB;QACxB,SAAS,EAAE,EAAE;QACb,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,KAAK;KACjB;IACD,mBAAmB,EAAE;QACnB,MAAM,EAAE,SAAS;QACjB,EAAE,EAAE,mBAAmB;QACvB,SAAS,EAAE,EAAE;QACb,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,KAAK;KACjB;IACD,oBAAoB,EAAE;QACpB,MAAM,EAAE,SAAS;QACjB,EAAE,EAAE,oBAAoB;QACxB,SAAS,EAAE,EAAE;QACb,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,KAAK;KACjB;CACF,CAAC;AAEF,+DAA+D;AAC/D,MAAM,CAAC,MAAM,UAAU,GAAwB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAe,CAAC;AAEhF,gEAAgE;AAChE,MAAM,UAAU,UAAU,CAAC,CAAS;IAClC,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CAAC,EAAY;IACnC,MAAM,KAAK,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC;IACxB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,UAAU,CAAC,0BAA0B,EAAE,EAAE,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,UAAU,CAAC,CAAQ;IACjC,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/C,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,UAAU,CAAC,CAAQ;IACjC,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/C,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,aAAa,CAAC,CAAQ;IACpC,OAAO,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAChD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,CAAQ;IACvC,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACzE,CAAC"}