@statewalker/webrun-biscuit 0.1.0 → 0.2.0

package/README.md

@@ -49,6 +49,59 @@ const result = verified.authorize('operation("read"); allow if user("alice");');
 type system then prevents authorizing a token whose signature chain was never checked, which is the
 mistake worth designing against.
 
+### Parameters: never splice a value into Datalog
+
+Anything that did not come from you — a user id, a request path, a role name —
+goes in as a `{name}` parameter. It is bound as a **term**, so no string can
+change the shape of the program:
+
+```ts
+const token = Biscuit.build(root.secretKey, "user({id});", { params: { id: userId } });
+verified.authorize("resource({path});\nallow if user($u), owner($u, {path});", {
+  params: { path: url.pathname },
+});
+```
+
+Strings, safe-integer numbers, `bigint`, booleans, `null`, `Date`, `Uint8Array`,
+arrays and `Set`s are accepted. An unbound parameter and an unused one are both a
+`ParseError`, as in the reference; `{true}`, `{false}` and `{null}` remain one-element
+sets.
+
+### Querying the evaluated world
+
+`evaluate` is `authorize` that keeps the world, so facts can be read back — the
+reference's `Authorizer::query`. A query sees what the authorizer sees (authority
+block and authorizer facts) unless it says `trusting`, so an attenuation block cannot
+inject what it reads:
+
+```ts
+const ev = verified.evaluate("allow if true;");
+ev.result;                                   // { kind: "ok", policy: 0 }
+ev.query("claim($s) <- subject($s)");        // [{ name: "claim", terms: [{ t: "str", v: "alice" }] }]
+```
+
+Pass `null` instead of a token to decide from the authorizer's own facts and rules:
+
+```ts
+import { evaluate } from "@statewalker/webrun-biscuit";
+evaluate(null, 'role("admin");\ncapability("x") <- role("admin");').query("c($c) <- capability($c)");
+```
+
+A failed check carries its rule text, printed exactly as the reference prints it:
+`{ source: "block", blockId: 0, checkId: 0, rule: "check if bound($k), connection_peer($k)" }`.
+
+### Faster verification: `verifyAsync`
+
+`verify` is synchronous and pure JS. `verifyAsync` checks Ed25519 signatures with the
+platform's WebCrypto where it has it — Node, current browsers, Workers — which is about
+eight times faster (0.25 ms against 1.9 ms per token in Node 24). secp256r1, and any
+runtime without WebCrypto Ed25519, fall back to the same pure-JS code, and both paths
+consume one list of signature checks, so neither can skip a check the other makes.
+
+```ts
+const verified = await Biscuit.fromBase64(token).verifyAsync(root.publicKey);
+```
+
 ### Examples
 
 secp256r1 works the same way, with the algorithm passed at both ends:
@@ -144,10 +197,10 @@ not to change the verdict.
 ### A green suite is not the claim; a suite that can fail is
 
 ```sh
-pnpm test          # the main suite, 156 tests
-pnpm test:cross    # against the reference implementation, 55 tests
+pnpm test          # the main suite, 180 tests
+pnpm test:cross    # against the reference implementation, 56 tests
 pnpm test:all      # both
-pnpm mutate        # inject 10 known defects, require the suite to catch each
+pnpm mutate        # inject 13 known defects, require the suite to catch each
 pnpm build         # dist/ plus declarations
 ```
 
@@ -163,12 +216,15 @@ pnpm build         # dist/ plus declarations
 | `08-hardening` | property round-trips, mutation/truncation fuzzing, join scaling |
 | `09-world-snapshot` | the post-run world per origin, against the official snapshots |
 | `10-versions` | version bounds, feature gates, rejection of the deprecated v1/v2 corpora |
+| `11-parameters` | `{name}` binding, hostile strings, unbound and unused parameters |
+| `12-evaluate` | queries, their scope, token-less evaluation, failed-check rule text |
 
-`scripts/mutate.mjs` is the check on all of it. It injects ten defects — a lenient protobuf decoder,
+`scripts/mutate.mjs` is the check on all of it. It injects thirteen defects — a lenient protobuf decoder,
 wrapping i64 arithmetic, `check all` degraded to `check if`, a universally trusting authorizer, `deny`
-treated as `allow`, unchecked seal signatures, missing version bounds, and more — and requires each to
-break at least one test. A surviving mutation is a hole in the tests, not a success. All ten are
-caught. Two of them were **not** caught when the harness was first written: nothing verified a forged
+treated as `allow`, unchecked seal signatures, an async verifier that ignores WebCrypto's verdict, a
+query that can read an attenuation block's facts, silently ignored parameters, missing version bounds,
+and more — and requires each to break at least one test. A surviving mutation is a hole in the tests,
+not a success. All thirteen are caught. Two of them were **not** caught when the harness was first written: nothing verified a forged
 seal signature, and nothing exercised a matching `deny` policy.
 
 Each mutation's `find` string is a literal excerpt of the source, and must match exactly once. That is
@@ -240,9 +296,12 @@ only `null` and sets containing `null`, so a block using arrays may legally decl
 like an upstream oversight and is mirrored deliberately, because matching the reference matters more
 than being right here. `03-interop-chains` confirms it empirically.
 
-**Not implemented:** authorizer snapshots (`AuthorizerSnapshot` / `SnapshotBlock`); a `query(rule)` API
-for pulling facts out of an evaluated world, where `authorizeDetailed` exposes the whole world more
-coarsely; a revocation-checking helper, since revocation ids are exposed but comparing them against a
+**WebCrypto Ed25519 is not ZIP-215.** `verifyAsync` inherits the platform's verification rules, and
+`verify` those of `@noble/curves`. They agree on every honestly produced signature and on the whole
+corpus; they may differ only on deliberately malformed encodings, which neither accepts as a forgery.
+
+**Not implemented:** authorizer snapshots (`AuthorizerSnapshot` / `SnapshotBlock`); run limits on
+`query` (the evaluation it reads from is bounded, the query itself is not); a revocation-checking helper, since revocation ids are exposed but comparing them against a
 list is left to the caller; and wire-compatible third-party blocks — `thirdPartyRequest()` returns a
 plain object rather than the `ThirdPartyBlockRequest` protobuf message, so our own end-to-end
 third-party flow works and is tested, but the cross-implementation one does not.

package/dist/authorizer.d.ts

@@ -2,7 +2,8 @@
  * Turns a serialized token plus authorizer code into an authorization result,
  * mirroring the evaluation order of the reference implementation.
  */
-import { type Check, type ExternFn, type Fact, type Rule, type RunLimits, type Scope } from "./datalog.js";
+import { type Check, type ExternFn, type Fact, type Predicate, type Rule, type RunLimits, type Scope } from "./datalog.js";
+import { type Params } from "./parser.js";
 export declare const DEFAULT_SYMBOLS: string[];
 export declare class TokenError extends Error {
     readonly kind: "Format" | "Symbol";
@@ -28,6 +29,11 @@ export interface LoadedToken {
 export declare function loadToken(bytes: Uint8Array, rootPublicKey: Uint8Array, 
 /** the root key's algorithm: 0 = Ed25519, 1 = secp256r1 */
 rootAlgorithm?: 0 | 1): LoadedToken;
+/**
+ * `loadToken`, verifying signatures with the platform's WebCrypto Ed25519 where
+ * available — see `verifyTokenAsync`. Same result, same errors.
+ */
+export declare function loadTokenAsync(bytes: Uint8Array, rootPublicKey: Uint8Array, rootAlgorithm?: 0 | 1): Promise<LoadedToken>;
 /**
  * Reads the key identifier from a token **without verifying it**, so a caller
  * can choose which root key to verify against. The token is untrusted at this
@@ -37,10 +43,12 @@ export declare function peekRootKeyId(bytes: Uint8Array): number | undefined;
 export type FailedCheck = {
     source: "authorizer";
     checkId: number;
+    rule: string;
 } | {
     source: "block";
     blockId: number;
     checkId: number;
+    rule: string;
 };
 export type AuthorizationResult = {
     kind: "ok";
@@ -98,15 +106,44 @@ interface AuthorizerCode {
     scopes: Scope[];
     varNames: Map<number, string>;
 }
-export declare function parseAuthorizer(src: string): AuthorizerCode;
+/**
+ * Parse authorizer (or block) source. `{name}` parameters are bound from
+ * `params` as terms; an unbound or an unused parameter is a `ParseError`, as it
+ * is in the reference.
+ */
+export declare function parseAuthorizer(src: string, params?: Params): AuthorizerCode;
 export interface AuthorizeOptions {
     limits?: RunLimits;
     /** extern functions callable as `.extern::name(...)` */
     externs?: Map<string, ExternFn>;
+    /** values for `{name}` parameters in the authorizer code */
+    params?: Params;
+}
+export interface QueryOptions {
+    /** values for `{name}` parameters in the query rule */
+    params?: Params;
+}
+/** One authorizer run: its result, plus read access to the world it produced. */
+export interface Evaluation {
+    readonly result: AuthorizationResult;
+    /**
+     * Every distinct fact `rule` derives from the evaluated world — the
+     * reference's `Authorizer::query`. The rule sees what the authorizer sees
+     * (authority block and authorizer facts) unless it says `trusting ...`.
+     * Throws when the evaluation itself did not complete.
+     */
+    query(rule: string, options?: QueryOptions): Predicate[];
+    /** The post-run world, in the shape the official sample corpus records it. */
+    snapshot(): WorldSnapshot;
 }
-export declare function authorize(token: LoadedToken, authorizerSrc: string, options?: AuthorizeOptions): AuthorizationResult;
+export declare function authorize(token: LoadedToken | null, authorizerSrc: string, options?: AuthorizeOptions): AuthorizationResult;
 /** Same as `authorize`, and also returns the post-run world, in the shape the
  *  official sample corpus records it. */
-export declare function authorizeDetailed(token: LoadedToken, authorizerSrc: string, options?: AuthorizeOptions): AuthorizeDetails;
+export declare function authorizeDetailed(token: LoadedToken | null, authorizerSrc: string, options?: AuthorizeOptions): AuthorizeDetails;
+/**
+ * Run the authorizer against a verified token — or against no token at all,
+ * for a decision made from the authorizer's own facts and rules.
+ */
+export declare function evaluate(loadedToken: LoadedToken | null, authorizerSrc: string, options?: AuthorizeOptions): Evaluation;
 export {};
 //# sourceMappingURL=authorizer.d.ts.map

package/dist/authorizer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorizer.d.ts","sourceRoot":"","sources":["../src/authorizer.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAEL,KAAK,KAAK,EAGV,KAAK,QAAQ,EACb,KAAK,IAAI,EAMT,KAAK,IAAI,EACT,KAAK,SAAS,EACd,KAAK,KAAK,EAKX,MAAM,cAAc,CAAC;AAiBtB,eAAO,MAAM,eAAe,UA6B3B,CAAC;AAGF,qBAAa,UAAW,SAAQ,KAAK;IAEjC,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,QAAQ;IADpC,YACW,IAAI,EAAE,QAAQ,GAAG,QAAQ,EAClC,OAAO,EAAE,MAAM,EAGhB;CACF;AA+GD,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gEAAgE;IAChE,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AA2CD,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,YAAY,EAAE,CAAC;IACvB,mBAAmB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3C,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB;qDACiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,SAAS,CACvB,KAAK,EAAE,UAAU,EACjB,aAAa,EAAE,UAAU;AACzB,2DAA2D;AAC3D,aAAa,GAAE,CAAC,GAAG,CAAK,GACvB,WAAW,CAmDb;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,GAAG,SAAS,CAEnE;AAWD,MAAM,MAAM,WAAW,GACnB;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACzC;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1D,MAAM,MAAM,mBAAmB,GAC3B;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAAC,MAAM,EAAE,WAAW,EAAE,CAAA;CAAE,GAC7F;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,MAAM,EAAE,WAAW,EAAE,CAAA;CAAE,GACnD;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC3D;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtC,sEAAsE;AACtE,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE;QAAE,MAAM,EAAE,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE,EAAE,CAAC;IACxD,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE,EAAE,CAAC;IAC7C,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,EAAE,CAAC;IAC/C,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,mBAAmB,CAAC;IAC5B,KAAK,EAAE,aAAa,CAAC;CACtB;AAED,UAAU,cAAc;IACtB,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,QAAQ,EAAE;QAAE,IAAI,EAAE,OAAO,GAAG,MAAM,CAAC;QAAC,OAAO,EAAE,IAAI,EAAE,CAAA;KAAE,EAAE,CAAC;IACxD,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,CAoB3D;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB,wDAAwD;IACxD,OAAO,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;CACjC;AAED,wBAAgB,SAAS,CACvB,KAAK,EAAE,WAAW,EAClB,aAAa,EAAE,MAAM,EACrB,OAAO,GAAE,gBAAqB,GAC7B,mBAAmB,CAErB;AAID;yCACyC;AACzC,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,WAAW,EAClB,aAAa,EAAE,MAAM,EACrB,OAAO,GAAE,gBAAqB,GAC7B,gBAAgB,CAqKlB"}
+{"version":3,"file":"authorizer.d.ts","sourceRoot":"","sources":["../src/authorizer.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAEL,KAAK,KAAK,EAGV,KAAK,QAAQ,EACb,KAAK,IAAI,EAKT,KAAK,SAAS,EACd,KAAK,IAAI,EACT,KAAK,SAAS,EACd,KAAK,KAAK,EAKX,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,KAAK,MAAM,EAAsC,MAAM,aAAa,CAAC;AAiB9E,eAAO,MAAM,eAAe,UA6B3B,CAAC;AAGF,qBAAa,UAAW,SAAQ,KAAK;IAEjC,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,QAAQ;IADpC,YACW,IAAI,EAAE,QAAQ,GAAG,QAAQ,EAClC,OAAO,EAAE,MAAM,EAGhB;CACF;AA+GD,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gEAAgE;IAChE,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AA2CD,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,YAAY,EAAE,CAAC;IACvB,mBAAmB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3C,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB;qDACiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,SAAS,CACvB,KAAK,EAAE,UAAU,EACjB,aAAa,EAAE,UAAU;AACzB,2DAA2D;AAC3D,aAAa,GAAE,CAAC,GAAG,CAAK,GACvB,WAAW,CAIb;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,UAAU,EACjB,aAAa,EAAE,UAAU,EACzB,aAAa,GAAE,CAAC,GAAG,CAAK,GACvB,OAAO,CAAC,WAAW,CAAC,CAItB;AAoDD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,GAAG,SAAS,CAEnE;AAWD,MAAM,MAAM,WAAW,GACnB;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACvD;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAExE,MAAM,MAAM,mBAAmB,GAC3B;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAAC,MAAM,EAAE,WAAW,EAAE,CAAA;CAAE,GAC7F;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,MAAM,EAAE,WAAW,EAAE,CAAA;CAAE,GACnD;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC3D;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtC,sEAAsE;AACtE,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE;QAAE,MAAM,EAAE,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE,EAAE,CAAC;IACxD,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE,EAAE,CAAC;IAC7C,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,EAAE,CAAC;IAC/C,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,mBAAmB,CAAC;IAC5B,KAAK,EAAE,aAAa,CAAC;CACtB;AAED,UAAU,cAAc;IACtB,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,QAAQ,EAAE;QAAE,IAAI,EAAE,OAAO,GAAG,MAAM,CAAC;QAAC,OAAO,EAAE,IAAI,EAAE,CAAA;KAAE,EAAE,CAAC;IACxD,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,cAAc,CAuB5E;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB,wDAAwD;IACxD,OAAO,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAChC,4DAA4D;IAC5D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,uDAAuD;IACvD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,iFAAiF;AACjF,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;IACrC;;;;;OAKG;IACH,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,SAAS,EAAE,CAAC;IACzD,8EAA8E;IAC9E,QAAQ,IAAI,aAAa,CAAC;CAC3B;AAED,wBAAgB,SAAS,CACvB,KAAK,EAAE,WAAW,GAAG,IAAI,EACzB,aAAa,EAAE,MAAM,EACrB,OAAO,GAAE,gBAAqB,GAC7B,mBAAmB,CAErB;AAID;yCACyC;AACzC,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,WAAW,GAAG,IAAI,EACzB,aAAa,EAAE,MAAM,EACrB,OAAO,GAAE,gBAAqB,GAC7B,gBAAgB,CAGlB;AAID;;;GAGG;AACH,wBAAgB,QAAQ,CACtB,WAAW,EAAE,WAAW,GAAG,IAAI,EAC/B,aAAa,EAAE,MAAM,EACrB,OAAO,GAAE,gBAAqB,GAC7B,UAAU,CA4LZ"}

package/dist/builder.d.ts

@@ -6,6 +6,7 @@
 import { generateKeypair } from "./crypto.js";
 import type { Check, Predicate, Rule, Scope } from "./datalog.js";
 import { type BlockMsg, type PublicKeyMsg } from "./proto.js";
+import type { Params } from "./parser.js";
 export declare class BuilderError extends Error {
 }
 export interface Keypair {
@@ -20,6 +21,8 @@ export interface BlockContent {
     rules: Rule[];
     checks: Check[];
     scopes: Scope[];
+    /** variable id -> name; ids without a name are written as their decimal id */
+    varNames?: ReadonlyMap<number, string>;
 }
 export declare function buildBlockMsg(content: BlockContent, knownSymbols?: string[], knownKeys?: string[], minVersion?: number): BlockMsg;
 export interface BuildOptions {
@@ -27,6 +30,8 @@ export interface BuildOptions {
     /** supply a next keypair instead of generating one (tests, determinism) */
     nextKeypair?: Keypair;
     algorithm?: 0 | 1;
+    /** values for `{name}` parameters in the block code */
+    params?: Params;
 }
 /** Mint a new token whose authority block holds `code`. */
 export declare function buildToken(rootSecret: Uint8Array, code: string | BlockContent, options?: BuildOptions): Uint8Array;
@@ -46,7 +51,7 @@ export interface ThirdPartyResponse {
     publicKey: PublicKeyMsg;
 }
 /** The third party builds and signs a block without holding the token. */
-export declare function thirdPartyBlock(request: ThirdPartyRequest, externalSecret: Uint8Array, code: string | BlockContent, algorithm?: 0 | 1): ThirdPartyResponse;
+export declare function thirdPartyBlock(request: ThirdPartyRequest, externalSecret: Uint8Array, code: string | BlockContent, algorithm?: 0 | 1, params?: Params): ThirdPartyResponse;
 /** The token holder appends a block signed by a third party. */
 export declare function appendThirdParty(tokenBytes: Uint8Array, response: ThirdPartyResponse, options?: BuildOptions): Uint8Array;
 //# sourceMappingURL=builder.d.ts.map

package/dist/builder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"builder.d.ts","sourceRoot":"","sources":["../src/builder.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAIL,eAAe,EAIhB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,KAAK,EAAM,SAAS,EAAE,IAAI,EAAE,KAAK,EAAQ,MAAM,cAAc,CAAC;AAC5E,OAAO,EAEL,KAAK,QAAQ,EAQb,KAAK,YAAY,EAIlB,MAAM,YAAY,CAAC;AAMpB,qBAAa,YAAa,SAAQ,KAAK;CAAG;AAE1C,MAAM,WAAW,OAAO;IACtB,SAAS,EAAE,UAAU,CAAC;IACtB,SAAS,EAAE,UAAU,CAAC;CACvB;AACD,OAAO,EAAE,eAAe,EAAE,CAAC;AAgH3B,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE;QAAE,SAAS,EAAE,SAAS,CAAA;KAAE,EAAE,CAAC;IAClC,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,MAAM,EAAE,KAAK,EAAE,CAAC;CACjB;AAED,wBAAgB,aAAa,CAC3B,OAAO,EAAE,YAAY,EACrB,YAAY,GAAE,MAAM,EAAO,EAC3B,SAAS,GAAE,MAAM,EAAO,EACxB,UAAU,SAAI,GACb,QAAQ,CAkBV;AA4BD,MAAM,WAAW,YAAY;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,SAAS,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;CACnB;AAED,2DAA2D;AAC3D,wBAAgB,UAAU,CACxB,UAAU,EAAE,UAAU,EACtB,IAAI,EAAE,MAAM,GAAG,YAAY,EAC3B,OAAO,GAAE,YAAiB,GACzB,UAAU,CAgBZ;AAED,8EAA8E;AAC9E,wBAAgB,SAAS,CACvB,UAAU,EAAE,UAAU,EACtB,IAAI,EAAE,MAAM,GAAG,YAAY,EAC3B,OAAO,GAAE,YAAiB,GACzB,UAAU,CA4BZ;AAED,wDAAwD;AACxD,wBAAgB,SAAS,CAAC,UAAU,EAAE,UAAU,GAAG,UAAU,CAO5D;AAID,MAAM,WAAW,iBAAiB;IAChC,0DAA0D;IAC1D,iBAAiB,EAAE,UAAU,CAAC;CAC/B;AAED,yEAAyE;AACzE,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,UAAU,GAAG,iBAAiB,CAI3E;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,UAAU,CAAC;IAClB,SAAS,EAAE,UAAU,CAAC;IACtB,SAAS,EAAE,YAAY,CAAC;CACzB;AAED,0EAA0E;AAC1E,wBAAgB,eAAe,CAC7B,OAAO,EAAE,iBAAiB,EAC1B,cAAc,EAAE,UAAU,EAC1B,IAAI,EAAE,MAAM,GAAG,YAAY,EAC3B,SAAS,GAAE,CAAC,GAAG,CAAK,GACnB,kBAAkB,CAWpB;AAED,gEAAgE;AAChE,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,UAAU,EACtB,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,GAAE,YAAiB,GACzB,UAAU,CA2BZ"}
+{"version":3,"file":"builder.d.ts","sourceRoot":"","sources":["../src/builder.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAIL,eAAe,EAIhB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,KAAK,EAAM,SAAS,EAAE,IAAI,EAAE,KAAK,EAAQ,MAAM,cAAc,CAAC;AAC5E,OAAO,EAEL,KAAK,QAAQ,EAQb,KAAK,YAAY,EAIlB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAM1C,qBAAa,YAAa,SAAQ,KAAK;CAAG;AAE1C,MAAM,WAAW,OAAO;IACtB,SAAS,EAAE,UAAU,CAAC;IACtB,SAAS,EAAE,UAAU,CAAC;CACvB;AACD,OAAO,EAAE,eAAe,EAAE,CAAC;AA0H3B,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE;QAAE,SAAS,EAAE,SAAS,CAAA;KAAE,EAAE,CAAC;IAClC,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACxC;AAED,wBAAgB,aAAa,CAC3B,OAAO,EAAE,YAAY,EACrB,YAAY,GAAE,MAAM,EAAO,EAC3B,SAAS,GAAE,MAAM,EAAO,EACxB,UAAU,SAAI,GACb,QAAQ,CAkBV;AAkCD,MAAM,WAAW,YAAY;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,SAAS,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;IAClB,uDAAuD;IACvD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,2DAA2D;AAC3D,wBAAgB,UAAU,CACxB,UAAU,EAAE,UAAU,EACtB,IAAI,EAAE,MAAM,GAAG,YAAY,EAC3B,OAAO,GAAE,YAAiB,GACzB,UAAU,CAgBZ;AAED,8EAA8E;AAC9E,wBAAgB,SAAS,CACvB,UAAU,EAAE,UAAU,EACtB,IAAI,EAAE,MAAM,GAAG,YAAY,EAC3B,OAAO,GAAE,YAAiB,GACzB,UAAU,CA4BZ;AAED,wDAAwD;AACxD,wBAAgB,SAAS,CAAC,UAAU,EAAE,UAAU,GAAG,UAAU,CAO5D;AAID,MAAM,WAAW,iBAAiB;IAChC,0DAA0D;IAC1D,iBAAiB,EAAE,UAAU,CAAC;CAC/B;AAED,yEAAyE;AACzE,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,UAAU,GAAG,iBAAiB,CAI3E;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,UAAU,CAAC;IAClB,SAAS,EAAE,UAAU,CAAC;IACtB,SAAS,EAAE,YAAY,CAAC;CACzB;AAED,0EAA0E;AAC1E,wBAAgB,eAAe,CAC7B,OAAO,EAAE,iBAAiB,EAC1B,cAAc,EAAE,UAAU,EAC1B,IAAI,EAAE,MAAM,GAAG,YAAY,EAC3B,SAAS,GAAE,CAAC,GAAG,CAAK,EACpB,MAAM,CAAC,EAAE,MAAM,GACd,kBAAkB,CAWpB;AAED,gEAAgE;AAChE,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,UAAU,EACtB,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,GAAE,YAAiB,GACzB,UAAU,CA2BZ"}

package/dist/crypto.d.ts

@@ -17,6 +17,13 @@ export declare function generateKeypair(algorithm?: 0 | 1): {
 export { bytesEqual };
 /** Verifies the full signature chain and the proof. Throws on failure. */
 export declare function verifyToken(token: BiscuitMsg, rootPublicKey: Uint8Array, rootAlgorithm?: number): void;
+/**
+ * `verifyToken`, using the platform's WebCrypto for Ed25519 where it offers it
+ * — about ten times faster than the pure-JS path in Node and current browsers.
+ * secp256r1, and any runtime without WebCrypto Ed25519, fall back to
+ * `@noble/curves`, so the result never depends on where it runs.
+ */
+export declare function verifyTokenAsync(token: BiscuitMsg, rootPublicKey: Uint8Array, rootAlgorithm?: number): Promise<void>;
 /** Revocation identifier of each block: its signature bytes. */
 export declare function revocationIds(token: BiscuitMsg): Uint8Array[];
 //# sourceMappingURL=crypto.d.ts.map

package/dist/crypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAExE,qBAAa,cAAe,SAAQ,KAAK;CAAG;AAkB5C,QAAA,MAAM,UAAU,MAAO,UAAU,KAAK,UAAU,KAAG,OACK,CAAC;AAwBzD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,GAAG,UAAU,CAIrF;AAID,wBAAgB,cAAc,CAC5B,IAAI,EAAE,UAAU,EAChB,OAAO,EAAE,YAAY,EACrB,WAAW,CAAC,EAAE,UAAU,GACvB,UAAU,CAEZ;AAED,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,UAAU,EAChB,OAAO,EAAE,YAAY,EACrB,OAAO,EAAE,MAAM,GACd,UAAU,CAWZ;AAED,wBAAgB,cAAc,CAC5B,IAAI,EAAE,UAAU,EAChB,OAAO,EAAE,YAAY,EACrB,WAAW,EAAE,UAAU,GAAG,SAAS,EACnC,iBAAiB,EAAE,UAAU,EAC7B,OAAO,EAAE,MAAM,GACd,UAAU,CAcZ;AAED,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,UAAU,EAChB,iBAAiB,EAAE,UAAU,EAC7B,OAAO,EAAE,MAAM,GACd,UAAU,CASZ;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,WAAW,GAAG,UAAU,CAE5D;AAED,wBAAgB,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,GAAG,UAAU,CAK3F;AAED,8CAA8C;AAC9C,wBAAgB,eAAe,CAAC,SAAS,GAAE,CAAC,GAAG,CAAK,GAAG;IACrD,SAAS,EAAE,UAAU,CAAC;IACtB,SAAS,EAAE,UAAU,CAAC;CACvB,CAIA;AAED,OAAO,EAAE,UAAU,EAAE,CAAC;AAItB,0EAA0E;AAC1E,wBAAgB,WAAW,CAAC,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,UAAU,EAAE,aAAa,SAAI,GAAG,IAAI,CAuDjG;AAED,gEAAgE;AAChE,wBAAgB,aAAa,CAAC,KAAK,EAAE,UAAU,GAAG,UAAU,EAAE,CAE7D"}
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAExE,qBAAa,cAAe,SAAQ,KAAK;CAAG;AAkB5C,QAAA,MAAM,UAAU,MAAO,UAAU,KAAK,UAAU,KAAG,OACK,CAAC;AAwBzD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,GAAG,UAAU,CAIrF;AAID,wBAAgB,cAAc,CAC5B,IAAI,EAAE,UAAU,EAChB,OAAO,EAAE,YAAY,EACrB,WAAW,CAAC,EAAE,UAAU,GACvB,UAAU,CAEZ;AAED,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,UAAU,EAChB,OAAO,EAAE,YAAY,EACrB,OAAO,EAAE,MAAM,GACd,UAAU,CAWZ;AAED,wBAAgB,cAAc,CAC5B,IAAI,EAAE,UAAU,EAChB,OAAO,EAAE,YAAY,EACrB,WAAW,EAAE,UAAU,GAAG,SAAS,EACnC,iBAAiB,EAAE,UAAU,EAC7B,OAAO,EAAE,MAAM,GACd,UAAU,CAcZ;AAED,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,UAAU,EAChB,iBAAiB,EAAE,UAAU,EAC7B,OAAO,EAAE,MAAM,GACd,UAAU,CASZ;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,WAAW,GAAG,UAAU,CAE5D;AAED,wBAAgB,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,GAAG,UAAU,CAK3F;AAED,8CAA8C;AAC9C,wBAAgB,eAAe,CAAC,SAAS,GAAE,CAAC,GAAG,CAAK,GAAG;IACrD,SAAS,EAAE,UAAU,CAAC;IACtB,SAAS,EAAE,UAAU,CAAC;CACvB,CAIA;AAED,OAAO,EAAE,UAAU,EAAE,CAAC;AA2FtB,0EAA0E;AAC1E,wBAAgB,WAAW,CAAC,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,UAAU,EAAE,aAAa,SAAI,GAAG,IAAI,CAOjG;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,UAAU,EACjB,aAAa,EAAE,UAAU,EACzB,aAAa,SAAI,GAChB,OAAO,CAAC,IAAI,CAAC,CAWf;AAqFD,gEAAgE;AAChE,wBAAgB,aAAa,CAAC,KAAK,EAAE,UAAU,GAAG,UAAU,EAAE,CAE7D"}

package/dist/datalog.d.ts

@@ -194,6 +194,8 @@ export declare class World {
     /** naive fixpoint: apply every rule until no new fact appears */
     run(limits?: RunLimits): void;
     apply(rule: Rule, facts: FactIndex, ruleOrigin: number): Generator<[Origin, Fact]>;
+    /** every distinct fact `rule` derives from the facts `trusted` can see */
+    query(rule: Rule, trusted: TrustedOrigins): Predicate[];
     /** `check if` / policies: does at least one combination match? */
     queryMatch(rule: Rule, origin: number, trusted: TrustedOrigins): boolean;
     /** `check all`: every matching combination must satisfy the expressions */

package/dist/datalog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"datalog.d.ts","sourceRoot":"","sources":["../src/datalog.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,eAAO,MAAM,UAAU,aAAa,CAAC;AAIrC,MAAM,MAAM,MAAM,GAAG;IAAE,CAAC,EAAE,KAAK,CAAC;IAAC,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,CAAC,EAAE,KAAK,CAAC;IAAC,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvE,MAAM,MAAM,IAAI,GACZ;IAAE,CAAC,EAAE,KAAK,CAAC;IAAC,CAAC,EAAE,MAAM,CAAA;CAAE,GACvB;IAAE,CAAC,EAAE,KAAK,CAAC;IAAC,CAAC,EAAE,MAAM,CAAA;CAAE,GACvB;IAAE,CAAC,EAAE,KAAK,CAAC;IAAC,CAAC,EAAE,MAAM,CAAA;CAAE,GACvB;IAAE,CAAC,EAAE,MAAM,CAAC;IAAC,CAAC,EAAE,MAAM,CAAA;CAAE,GACxB;IAAE,CAAC,EAAE,OAAO,CAAC;IAAC,CAAC,EAAE,UAAU,CAAA;CAAE,GAC7B;IAAE,CAAC,EAAE,MAAM,CAAC;IAAC,CAAC,EAAE,OAAO,CAAA;CAAE,GACzB;IAAE,CAAC,EAAE,KAAK,CAAC;IAAC,CAAC,EAAE,IAAI,EAAE,CAAA;CAAE,GACvB;IAAE,CAAC,EAAE,MAAM,CAAA;CAAE,GACb;IAAE,CAAC,EAAE,OAAO,CAAC;IAAC,CAAC,EAAE,IAAI,EAAE,CAAA;CAAE,GACzB;IAAE,CAAC,EAAE,KAAK,CAAC;IAAC,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAA;CAAE,CAAC;AAKtC;2EAC2E;AAC3E,wBAAgB,OAAO,CAAC,CAAC,EAAE,IAAI,GAAG,MAAM,CA0BvC;AAED,eAAO,MAAM,SAAS,MAAO,MAAM,KAAG,MACe,CAAC;AACtD,eAAO,MAAM,MAAM,MAAO,IAAI,KAAK,IAAI,KAAG,OAAoC,CAAC;AAE/E,4DAA4D;AAC5D,wBAAgB,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,CAMlD;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,IAAI,EAAE,CAAC;CACf;AACD,MAAM,WAAW,IAAI;IACnB,SAAS,EAAE,SAAS,CAAC;CACtB;AACD,MAAM,MAAM,EAAE,GACV;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,IAAI,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAC5C;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAAC,GAAG,EAAE,EAAE,EAAE,CAAA;CAAE,CAAC;AAErD,MAAM,MAAM,KAAK,GACb;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GACrB;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,GACpB;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvC,MAAM,WAAW,IAAI;IACnB,IAAI,EAAE,SAAS,CAAC;IAChB,IAAI,EAAE,SAAS,EAAE,CAAC;IAClB,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC;IACpB,MAAM,EAAE,KAAK,EAAE,CAAC;CACjB;AACD,MAAM,MAAM,SAAS,GAAG,KAAK,GAAG,KAAK,GAAG,QAAQ,CAAC;AACjD,MAAM,WAAW,KAAK;IACpB,OAAO,EAAE,IAAI,EAAE,CAAC;IAChB,IAAI,EAAE,SAAS,CAAC;CACjB;AAED,eAAO,MAAM,OAAO,MAAO,IAAI,KAAG,MAC8D,CAAC;AAIjG,qBAAa,MAAM;IACL,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE;IAAlC,YAAqB,GAAG,GAAE,MAAM,EAAO,EAAI;IAC3C,MAAM,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,CAElC;IACD,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE3B;IACD,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAEvB;IACD,IAAI,GAAG,IAAI,MAAM,CAEhB;CACF;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAc;IAClC,YAAY,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,EAEhC;IACD,MAAM,CAAC,OAAO,IAAI,cAAc,CAE/B;IACD,yDAAyD;IACzD,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAGhC;IACD,IAAI,GAAG,IAAI,MAAM,CAEhB;IACD,kEAAkE;IAClE,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAEtB;CACF;AAED,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,KAAK,EAAE,EACnB,QAAQ,EAAE,cAAc,EACxB,YAAY,EAAE,MAAM,EACpB,mBAAmB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GACzC,cAAc,CAehB;AAID,MAAM,MAAM,kBAAkB,GAC1B,UAAU,GACV,cAAc,GACd,aAAa,GACb,iBAAiB,GACjB,kBAAkB,GAClB,cAAc,GACd,iBAAiB,GACjB,cAAc,GACd,mBAAmB,GACnB,SAAS,CAAC;AAEd,qBAAa,cAAe,SAAQ,KAAK;IAErC,QAAQ,CAAC,IAAI,EAAE,kBAAkB;IADnC,YACW,IAAI,EAAE,kBAAkB,EACjC,OAAO,CAAC,EAAE,MAAM,EAGjB;CACF;AAqCD,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAAI,CAAC;AAC1B,eAAO,MAAM,OAAO;;;;;;CAAI,CAAC;AAWzB,MAAM,MAAM,QAAQ,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,IAAI,KAAK,IAAI,CAAC;AAE1D,KAAK,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AAkMlC,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,EAAE,EAAE,EACT,MAAM,EAAE,QAAQ,EAChB,OAAO,GAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAa,GACzC,IAAI,CA6CN;AAmDD,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;CACnB;AACD;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,EAAE,SAAmE,CAAC;AAoBjG,KAAK,UAAU,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AACjC,gFAAgF;AAChF,KAAK,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;AAmC3C,qBAAa,KAAK;IAChB,kCAAkC;IAClC,QAAQ,CAAC,KAAK;gBAA6B,MAAM;eAAS,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC;OAAM;IACjF,QAAQ,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,cAAc,CAAC;QAAC,IAAI,EAAE,IAAI,CAAA;KAAE,EAAE,CAAM;IAC/E,OAAO,wBAA+B;IACtC,UAAU,SAAK;IACf,OAAO,CAAC,UAAU,CAAK;IACvB,OAAO,CAAC,UAAU,CAA+D;IAEjF,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAWxC;IAED,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAEjE;IAED,SAAS,IAAI,MAAM,CAIlB;IAED,OAAO,CAAC,OAAO;IAkBf,iEAAiE;IACjE,GAAG,CAAC,MAAM,GAAE,SAA0B,GAAG,IAAI,CAmB5C;IAEA,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CA4BlF;IAED,kEAAkE;IAClE,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAGvE;IAED,2EAA2E;IAC3E,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAY1D;CACF"}
+{"version":3,"file":"datalog.d.ts","sourceRoot":"","sources":["../src/datalog.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,eAAO,MAAM,UAAU,aAAa,CAAC;AAIrC,MAAM,MAAM,MAAM,GAAG;IAAE,CAAC,EAAE,KAAK,CAAC;IAAC,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,CAAC,EAAE,KAAK,CAAC;IAAC,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvE,MAAM,MAAM,IAAI,GACZ;IAAE,CAAC,EAAE,KAAK,CAAC;IAAC,CAAC,EAAE,MAAM,CAAA;CAAE,GACvB;IAAE,CAAC,EAAE,KAAK,CAAC;IAAC,CAAC,EAAE,MAAM,CAAA;CAAE,GACvB;IAAE,CAAC,EAAE,KAAK,CAAC;IAAC,CAAC,EAAE,MAAM,CAAA;CAAE,GACvB;IAAE,CAAC,EAAE,MAAM,CAAC;IAAC,CAAC,EAAE,MAAM,CAAA;CAAE,GACxB;IAAE,CAAC,EAAE,OAAO,CAAC;IAAC,CAAC,EAAE,UAAU,CAAA;CAAE,GAC7B;IAAE,CAAC,EAAE,MAAM,CAAC;IAAC,CAAC,EAAE,OAAO,CAAA;CAAE,GACzB;IAAE,CAAC,EAAE,KAAK,CAAC;IAAC,CAAC,EAAE,IAAI,EAAE,CAAA;CAAE,GACvB;IAAE,CAAC,EAAE,MAAM,CAAA;CAAE,GACb;IAAE,CAAC,EAAE,OAAO,CAAC;IAAC,CAAC,EAAE,IAAI,EAAE,CAAA;CAAE,GACzB;IAAE,CAAC,EAAE,KAAK,CAAC;IAAC,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAA;CAAE,CAAC;AAKtC;2EAC2E;AAC3E,wBAAgB,OAAO,CAAC,CAAC,EAAE,IAAI,GAAG,MAAM,CA0BvC;AAED,eAAO,MAAM,SAAS,MAAO,MAAM,KAAG,MACe,CAAC;AACtD,eAAO,MAAM,MAAM,MAAO,IAAI,KAAK,IAAI,KAAG,OAAoC,CAAC;AAE/E,4DAA4D;AAC5D,wBAAgB,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,CAMlD;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,IAAI,EAAE,CAAC;CACf;AACD,MAAM,WAAW,IAAI;IACnB,SAAS,EAAE,SAAS,CAAC;CACtB;AACD,MAAM,MAAM,EAAE,GACV;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,IAAI,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAC5C;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAAC,GAAG,EAAE,EAAE,EAAE,CAAA;CAAE,CAAC;AAErD,MAAM,MAAM,KAAK,GACb;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GACrB;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,GACpB;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvC,MAAM,WAAW,IAAI;IACnB,IAAI,EAAE,SAAS,CAAC;IAChB,IAAI,EAAE,SAAS,EAAE,CAAC;IAClB,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC;IACpB,MAAM,EAAE,KAAK,EAAE,CAAC;CACjB;AACD,MAAM,MAAM,SAAS,GAAG,KAAK,GAAG,KAAK,GAAG,QAAQ,CAAC;AACjD,MAAM,WAAW,KAAK;IACpB,OAAO,EAAE,IAAI,EAAE,CAAC;IAChB,IAAI,EAAE,SAAS,CAAC;CACjB;AAED,eAAO,MAAM,OAAO,MAAO,IAAI,KAAG,MAC8D,CAAC;AAIjG,qBAAa,MAAM;IACL,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE;IAAlC,YAAqB,GAAG,GAAE,MAAM,EAAO,EAAI;IAC3C,MAAM,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,CAElC;IACD,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE3B;IACD,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAEvB;IACD,IAAI,GAAG,IAAI,MAAM,CAEhB;CACF;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAc;IAClC,YAAY,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,EAEhC;IACD,MAAM,CAAC,OAAO,IAAI,cAAc,CAE/B;IACD,yDAAyD;IACzD,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAGhC;IACD,IAAI,GAAG,IAAI,MAAM,CAEhB;IACD,kEAAkE;IAClE,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAEtB;CACF;AAED,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,KAAK,EAAE,EACnB,QAAQ,EAAE,cAAc,EACxB,YAAY,EAAE,MAAM,EACpB,mBAAmB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GACzC,cAAc,CAehB;AAID,MAAM,MAAM,kBAAkB,GAC1B,UAAU,GACV,cAAc,GACd,aAAa,GACb,iBAAiB,GACjB,kBAAkB,GAClB,cAAc,GACd,iBAAiB,GACjB,cAAc,GACd,mBAAmB,GACnB,SAAS,CAAC;AAEd,qBAAa,cAAe,SAAQ,KAAK;IAErC,QAAQ,CAAC,IAAI,EAAE,kBAAkB;IADnC,YACW,IAAI,EAAE,kBAAkB,EACjC,OAAO,CAAC,EAAE,MAAM,EAGjB;CACF;AAqCD,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAAI,CAAC;AAC1B,eAAO,MAAM,OAAO;;;;;;CAAI,CAAC;AAWzB,MAAM,MAAM,QAAQ,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,IAAI,KAAK,IAAI,CAAC;AAE1D,KAAK,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AAkMlC,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,EAAE,EAAE,EACT,MAAM,EAAE,QAAQ,EAChB,OAAO,GAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAa,GACzC,IAAI,CA6CN;AAmDD,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;CACnB;AACD;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,EAAE,SAAmE,CAAC;AAoBjG,KAAK,UAAU,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AACjC,gFAAgF;AAChF,KAAK,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;AAmC3C,qBAAa,KAAK;IAChB,kCAAkC;IAClC,QAAQ,CAAC,KAAK;gBAA6B,MAAM;eAAS,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC;OAAM;IACjF,QAAQ,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,cAAc,CAAC;QAAC,IAAI,EAAE,IAAI,CAAA;KAAE,EAAE,CAAM;IAC/E,OAAO,wBAA+B;IACtC,UAAU,SAAK;IACf,OAAO,CAAC,UAAU,CAAK;IACvB,OAAO,CAAC,UAAU,CAA+D;IAEjF,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAWxC;IAED,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAEjE;IAED,SAAS,IAAI,MAAM,CAIlB;IAED,OAAO,CAAC,OAAO;IAkBf,iEAAiE;IACjE,GAAG,CAAC,MAAM,GAAE,SAA0B,GAAG,IAAI,CAmB5C;IAEA,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CA4BlF;IAED,0EAA0E;IAC1E,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,GAAG,SAAS,EAAE,CAOtD;IAED,kEAAkE;IAClE,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAGvE;IAED,2EAA2E;IAC3E,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAY1D;CACF"}

package/dist/index.d.ts

@@ -6,14 +6,14 @@
  *   const text  = token.toBase64();
  *   const ok    = Biscuit.fromBase64(text).verify(root.publicKey).authorize('allow if user("alice");');
  */
-import { type AuthorizationResult, type AuthorizeOptions, type LoadedToken } from "./authorizer.js";
+import { type AuthorizationResult, type AuthorizeOptions, type Evaluation, type LoadedToken } from "./authorizer.js";
 import { type BuildOptions, generateKeypair, type ThirdPartyResponse, thirdPartyBlock } from "./builder.js";
 export * from "./authorizer.js";
 export * from "./base64.js";
 export * from "./builder.js";
 export { SignatureError } from "./crypto.js";
-export { ExecutionError, type ExternFn, type Term } from "./datalog.js";
-export { ParseError } from "./parser.js";
+export { ExecutionError, type ExternFn, type Predicate, type RunLimits, type Term, } from "./datalog.js";
+export { type ParamValue, type Params, ParseError } from "./parser.js";
 export { ProtoError } from "./proto.js";
 export * from "./version.js";
 /** An unverified token: it can be attenuated and re-serialized. */
@@ -30,6 +30,11 @@ export declare class Biscuit {
     toBase64(): string;
     /** Verify the signature chain. Throws if the token is not authentic. */
     verify(rootPublicKey: Uint8Array, rootAlgorithm?: 0 | 1): VerifiedBiscuit;
+    /**
+     * `verify`, using WebCrypto Ed25519 where the platform has it — roughly ten
+     * times faster than the pure-JS path. Rejects exactly where `verify` throws.
+     */
+    verifyAsync(rootPublicKey: Uint8Array, rootAlgorithm?: 0 | 1): Promise<VerifiedBiscuit>;
 }
 /** A token whose signature chain has been checked against a root key. */
 export declare class VerifiedBiscuit {
@@ -40,6 +45,8 @@ export declare class VerifiedBiscuit {
     /** the issuer's key identifier, when the token carries one */
     get rootKeyId(): number | undefined;
     authorize(authorizerCode: string, options?: AuthorizeOptions): AuthorizationResult;
+    /** Authorize, keeping the evaluated world available to `query`. */
+    evaluate(authorizerCode: string, options?: AuthorizeOptions): Evaluation;
 }
 export { generateKeypair, thirdPartyBlock };
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EAErB,KAAK,WAAW,EAEjB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAGL,KAAK,YAAY,EAEjB,eAAe,EAEf,KAAK,kBAAkB,EACvB,eAAe,EAEhB,MAAM,cAAc,CAAC;AAEtB,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,EAAE,KAAK,IAAI,EAAE,MAAM,cAAc,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,cAAc,cAAc,CAAC;AAE7B,mEAAmE;AACnE,qBAAa,OAAO;IACE,QAAQ,CAAC,KAAK,EAAE,UAAU;IAA9C,OAAO,eAA2C;IAElD,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAElF;IACD,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAE3C;IACD,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEvC;IAED,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAEvD;IACD,gBAAgB,CAAC,QAAQ,EAAE,kBAAkB,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAE9E;IACD,iBAAiB,6CAEhB;IACD,IAAI,IAAI,OAAO,CAEd;IACD,QAAQ,IAAI,MAAM,CAEjB;IAED,wEAAwE;IACxE,MAAM,CAAC,aAAa,EAAE,UAAU,EAAE,aAAa,GAAE,CAAC,GAAG,CAAK,GAAG,eAAe,CAE3E;CACF;AAED,yEAAyE;AACzE,qBAAa,eAAe;IAExB,QAAQ,CAAC,KAAK,EAAE,WAAW;IAC3B,QAAQ,CAAC,KAAK,EAAE,UAAU;IAF5B,YACW,KAAK,EAAE,WAAW,EAClB,KAAK,EAAE,UAAU,EACxB;IACJ,IAAI,aAAa,IAAI,MAAM,EAAE,CAE5B;IACD,8DAA8D;IAC9D,IAAI,SAAS,IAAI,MAAM,GAAG,SAAS,CAElC;IACD,SAAS,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,mBAAmB,CAEjF;CACF;AAED,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EAErB,KAAK,UAAU,EAEf,KAAK,WAAW,EAGjB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAGL,KAAK,YAAY,EAEjB,eAAe,EAEf,KAAK,kBAAkB,EACvB,eAAe,EAEhB,MAAM,cAAc,CAAC;AAEtB,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EACL,cAAc,EACd,KAAK,QAAQ,EACb,KAAK,SAAS,EACd,KAAK,SAAS,EACd,KAAK,IAAI,GACV,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,KAAK,UAAU,EAAE,KAAK,MAAM,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,cAAc,cAAc,CAAC;AAE7B,mEAAmE;AACnE,qBAAa,OAAO;IACE,QAAQ,CAAC,KAAK,EAAE,UAAU;IAA9C,OAAO,eAA2C;IAElD,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAElF;IACD,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAE3C;IACD,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEvC;IAED,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAEvD;IACD,gBAAgB,CAAC,QAAQ,EAAE,kBAAkB,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAE9E;IACD,iBAAiB,6CAEhB;IACD,IAAI,IAAI,OAAO,CAEd;IACD,QAAQ,IAAI,MAAM,CAEjB;IAED,wEAAwE;IACxE,MAAM,CAAC,aAAa,EAAE,UAAU,EAAE,aAAa,GAAE,CAAC,GAAG,CAAK,GAAG,eAAe,CAE3E;IAED;;;OAGG;IACG,WAAW,CAAC,aAAa,EAAE,UAAU,EAAE,aAAa,GAAE,CAAC,GAAG,CAAK,GAAG,OAAO,CAAC,eAAe,CAAC,CAK/F;CACF;AAED,yEAAyE;AACzE,qBAAa,eAAe;IAExB,QAAQ,CAAC,KAAK,EAAE,WAAW;IAC3B,QAAQ,CAAC,KAAK,EAAE,UAAU;IAF5B,YACW,KAAK,EAAE,WAAW,EAClB,KAAK,EAAE,UAAU,EACxB;IACJ,IAAI,aAAa,IAAI,MAAM,EAAE,CAE5B;IACD,8DAA8D;IAC9D,IAAI,SAAS,IAAI,MAAM,GAAG,SAAS,CAElC;IACD,SAAS,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,mBAAmB,CAEjF;IACD,mEAAmE;IACnE,QAAQ,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,UAAU,CAEvE;CACF;AAED,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,CAAC"}