@statewalker/webrun-biscuit 0.1.0 → 0.2.0

package/dist/index.js

@@ -1,5 +1,47 @@
 import { ed25519 } from "@noble/curves/ed25519.js";
 import { p256 } from "@noble/curves/nist.js";
+//#region src/base64.ts
+/** URL-safe base64 without padding, the wire form of a Biscuit token.
+*  Implemented directly so the library stays runtime-agnostic (no Buffer,
+*  no atob/btoa). */
+const ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+const REVERSE = new Map([...ALPHABET].map((c, i) => [c, i]));
+REVERSE.set("+", 62);
+REVERSE.set("/", 63);
+function toBase64(bytes) {
+	let out = "";
+	for (let i = 0; i < bytes.length; i += 3) {
+		const b0 = bytes[i];
+		const b1 = bytes[i + 1];
+		const b2 = bytes[i + 2];
+		out += ALPHABET[b0 >> 2];
+		out += ALPHABET[(b0 & 3) << 4 | (b1 ?? 0) >> 4];
+		if (b1 === void 0) break;
+		out += ALPHABET[(b1 & 15) << 2 | (b2 ?? 0) >> 6];
+		if (b2 === void 0) break;
+		out += ALPHABET[b2 & 63];
+	}
+	return out;
+}
+function fromBase64(text) {
+	const s = text.trim().replace(/=+$/, "");
+	const out = new Uint8Array(Math.floor(s.length * 3 / 4));
+	let o = 0;
+	let acc = 0;
+	let bits = 0;
+	for (const c of s) {
+		const v = REVERSE.get(c);
+		if (v === void 0) throw new Error(`invalid base64 character ${JSON.stringify(c)}`);
+		acc = acc << 6 | v;
+		bits += 6;
+		if (bits >= 8) {
+			bits -= 8;
+			out[o++] = acc >> bits & 255;
+		}
+	}
+	return out.subarray(0, o);
+}
+//#endregion
 //#region src/crypto.ts
 /**
 * Biscuit cryptography: chained block signatures, sealing, third-party
@@ -75,17 +117,30 @@ function generateKeypair(algorithm = 0) {
 		publicKey: publicKeyFromSecret(secretKey, algorithm)
 	};
 }
-/** Verifies the full signature chain and the proof. Throws on failure. */
-function verifyToken(token, rootPublicKey, rootAlgorithm = 0) {
+/**
+* Everything verifying a token requires, as data: the signatures to check, in
+* chain order, and — for an unsealed token — the proof secret whose public key
+* must equal the last block's next key. Structural problems throw here, before
+* any signature is looked at. `verifyToken` and `verifyTokenAsync` both consume
+* this, so neither can skip a check the other makes.
+*/
+function chainChecks(token, rootPublicKey, rootAlgorithm) {
 	const root = {
 		algorithm: rootAlgorithm,
 		key: rootPublicKey
 	};
+	const checks = [];
 	if (token.authority.externalSignature) throw new SignatureError("the authority block must not carry an external signature");
 	const authVersion = token.authority.version ?? 0;
-	if (!verifySignature(root, authVersion === 0 ? blockPayloadV0(token.authority.block, token.authority.nextKey) : authVersion === 1 ? authorityPayloadV1(token.authority.block, token.authority.nextKey, authVersion) : (() => {
+	const authPayload = authVersion === 0 ? blockPayloadV0(token.authority.block, token.authority.nextKey) : authVersion === 1 ? authorityPayloadV1(token.authority.block, token.authority.nextKey, authVersion) : (() => {
 		throw new SignatureError(`unsupported block version ${authVersion}`);
-	})(), token.authority.signature)) throw new SignatureError("invalid authority block signature");
+	})();
+	checks.push({
+		key: root,
+		payload: authPayload,
+		signature: token.authority.signature,
+		error: "invalid authority block signature"
+	});
 	let currentKey = token.authority.nextKey;
 	let previousSignature = token.authority.signature;
 	for (const block of token.blocks) {
@@ -95,21 +150,121 @@ function verifyToken(token, rootPublicKey, rootAlgorithm = 0) {
 		if (version === 0) payload = blockPayloadV0(block.block, block.nextKey, externalSig);
 		else if (version === 1) payload = blockPayloadV1(block.block, block.nextKey, externalSig, previousSignature, version);
 		else throw new SignatureError(`unsupported block version ${version}`);
-		if (!verifySignature(currentKey, payload, block.signature)) throw new SignatureError("invalid block signature");
+		checks.push({
+			key: currentKey,
+			payload,
+			signature: block.signature,
+			error: "invalid block signature"
+		});
 		if (block.externalSignature) {
 			if (version !== 1) throw new SignatureError("unsupported third party block version");
-			const ext = externalPayloadV1(block.block, previousSignature, version);
-			if (!verifySignature(block.externalSignature.publicKey, ext, block.externalSignature.signature)) throw new SignatureError("invalid external signature");
+			checks.push({
+				key: block.externalSignature.publicKey,
+				payload: externalPayloadV1(block.block, previousSignature, version),
+				signature: block.externalSignature.signature,
+				error: "invalid external signature"
+			});
 		}
 		currentKey = block.nextKey;
 		previousSignature = block.signature;
 	}
-	if (token.proof.kind === "nextSecret") {
-		const derived = publicKeyFromSecret(token.proof.value, currentKey.algorithm);
-		if (!bytesEqual(derived, currentKey.key)) throw new SignatureError("the last public key does not match the private key");
-	} else {
-		const last = token.blocks.length ? token.blocks[token.blocks.length - 1] : token.authority;
-		if (!verifySignature(currentKey, sealPayloadV0(last), token.proof.value)) throw new SignatureError("invalid seal signature");
+	if (token.proof.kind === "nextSecret") return {
+		checks,
+		proof: {
+			secret: token.proof.value,
+			key: currentKey
+		}
+	};
+	const last = token.blocks.length ? token.blocks[token.blocks.length - 1] : token.authority;
+	checks.push({
+		key: currentKey,
+		payload: sealPayloadV0(last),
+		signature: token.proof.value,
+		error: "invalid seal signature"
+	});
+	return { checks };
+}
+/** Verifies the full signature chain and the proof. Throws on failure. */
+function verifyToken(token, rootPublicKey, rootAlgorithm = 0) {
+	const { checks, proof } = chainChecks(token, rootPublicKey, rootAlgorithm);
+	for (const check of checks) if (!verifySignature(check.key, check.payload, check.signature)) throw new SignatureError(check.error);
+	if (proof && !bytesEqual(publicKeyFromSecret(proof.secret, proof.key.algorithm), proof.key.key)) throw new SignatureError("the last public key does not match the private key");
+}
+/**
+* `verifyToken`, using the platform's WebCrypto for Ed25519 where it offers it
+* — about ten times faster than the pure-JS path in Node and current browsers.
+* secp256r1, and any runtime without WebCrypto Ed25519, fall back to
+* `@noble/curves`, so the result never depends on where it runs.
+*/
+async function verifyTokenAsync(token, rootPublicKey, rootAlgorithm = 0) {
+	const { checks, proof } = chainChecks(token, rootPublicKey, rootAlgorithm);
+	const [verdicts, derived] = await Promise.all([Promise.all(checks.map((c) => verifySignatureAsync(c.key, c.payload, c.signature))), proof ? publicKeyFromSecretAsync(proof.secret, proof.key.algorithm) : void 0]);
+	verdicts.forEach((ok, i) => {
+		if (!ok) throw new SignatureError(checks[i].error);
+	});
+	if (proof && !bytesEqual(derived, proof.key.key)) throw new SignatureError("the last public key does not match the private key");
+}
+const subtle = globalThis.crypto?.subtle;
+/** PKCS#8 wrapping of a raw 32-byte Ed25519 seed (RFC 8410) */
+const PKCS8_ED25519 = Uint8Array.from([
+	48,
+	46,
+	2,
+	1,
+	0,
+	48,
+	5,
+	6,
+	3,
+	43,
+	101,
+	112,
+	4,
+	34,
+	4,
+	32
+]);
+let ed25519Native;
+/** Whether this runtime's WebCrypto verifies Ed25519, and does so correctly. Probed once. */
+function nativeEd25519() {
+	ed25519Native ??= (async () => {
+		if (!subtle) return false;
+		try {
+			const secret = (/* @__PURE__ */ new Uint8Array(32)).fill(7);
+			const message = ascii("webrun-biscuit");
+			const signature = ed25519.sign(message, secret);
+			const key = await subtle.importKey("raw", ed25519.getPublicKey(secret), { name: "Ed25519" }, false, ["verify"]);
+			const forged = signature.slice();
+			forged[0] ^= 1;
+			return await subtle.verify("Ed25519", key, signature, message) && !await subtle.verify("Ed25519", key, forged, message);
+		} catch {
+			return false;
+		}
+	})();
+	return ed25519Native;
+}
+async function verifySignatureAsync(key, payload, sig) {
+	if (key.algorithm !== ALG_ED25519 || !subtle || !await nativeEd25519()) return verifySignature(key, payload, sig);
+	if (key.key.length !== 32 || sig.length !== 64) return false;
+	try {
+		const imported = await subtle.importKey("raw", key.key, { name: "Ed25519" }, false, ["verify"]);
+		return await subtle.verify("Ed25519", imported, sig, payload);
+	} catch {
+		return false;
+	}
+}
+async function publicKeyFromSecretAsync(secret, algorithm) {
+	if (algorithm !== ALG_ED25519 || secret.length !== 32 || !subtle || !await nativeEd25519()) return publicKeyFromSecret(secret, algorithm);
+	try {
+		const pkcs8 = new Uint8Array(PKCS8_ED25519.length + 32);
+		pkcs8.set(PKCS8_ED25519);
+		pkcs8.set(secret, PKCS8_ED25519.length);
+		const key = await subtle.importKey("pkcs8", pkcs8, { name: "Ed25519" }, true, ["sign"]);
+		const { x } = await subtle.exportKey("jwk", key);
+		if (x === void 0) return publicKeyFromSecret(secret, algorithm);
+		return fromBase64(x);
+	} catch {
+		return publicKeyFromSecret(secret, algorithm);
 	}
 }
 /** Revocation identifier of each block: its signature bytes. */
@@ -250,10 +405,10 @@ const B = {
 };
 const BinaryOp = B;
 const UnaryOp = U;
-const I64_MIN = -(2n ** 63n);
-const I64_MAX = 2n ** 63n - 1n;
+const I64_MIN$1 = -(2n ** 63n);
+const I64_MAX$1 = 2n ** 63n - 1n;
 function checkedI64(v) {
-	if (v < I64_MIN || v > I64_MAX) throw new ExecutionError("Overflow");
+	if (v < I64_MIN$1 || v > I64_MAX$1) throw new ExecutionError("Overflow");
 	return {
 		t: "int",
 		v
@@ -700,6 +855,15 @@ var World = class {
 			} }];
 		}
 	}
+	/** every distinct fact `rule` derives from the facts `trusted` can see */
+	query(rule, trusted) {
+		const seen = /* @__PURE__ */ new Map();
+		for (const [, fact] of this.apply(rule, this.visible(trusted), AUTHORIZER)) {
+			const key = factKey(fact);
+			if (!seen.has(key)) seen.set(key, fact.predicate);
+		}
+		return [...seen.values()];
+	}
 	/** `check if` / policies: does at least one combination match? */
 	queryMatch(rule, origin, trusted) {
 		for (const _ of this.apply(rule, this.visible(trusted), origin)) return true;
@@ -728,16 +892,73 @@ var World = class {
 * compiled straight to the opcode form the VM executes.
 */
 var ParseError = class extends Error {};
+const I64_MIN = -(2n ** 63n);
+const I64_MAX = 2n ** 63n - 1n;
+function paramTerm(name, value) {
+	if (typeof value === "string") return {
+		t: "str",
+		v: value
+	};
+	if (typeof value === "boolean") return {
+		t: "bool",
+		v: value
+	};
+	if (value === null) return { t: "null" };
+	if (typeof value === "number") {
+		if (!Number.isSafeInteger(value)) throw new ParseError(`parameter {${name}}: ${value} is not a safe integer`);
+		return {
+			t: "int",
+			v: BigInt(value)
+		};
+	}
+	if (typeof value === "bigint") {
+		if (value < I64_MIN || value > I64_MAX) throw new ParseError(`parameter {${name}}: ${value} does not fit in i64`);
+		return {
+			t: "int",
+			v: value
+		};
+	}
+	if (value instanceof Date) {
+		const ms = value.getTime();
+		if (Number.isNaN(ms)) throw new ParseError(`parameter {${name}}: invalid date`);
+		return {
+			t: "date",
+			v: BigInt(Math.floor(ms / 1e3))
+		};
+	}
+	if (value instanceof Uint8Array) return {
+		t: "bytes",
+		v: value
+	};
+	if (Array.isArray(value)) return {
+		t: "array",
+		v: value.map((x) => paramTerm(name, x))
+	};
+	if (value instanceof Set) return {
+		t: "set",
+		v: normalizeSet([...value].map((x) => paramTerm(name, x)))
+	};
+	throw new ParseError(`parameter {${name}}: no Datalog term for this value`);
+}
+/** `{name}` in term position; `{true}`, `{false}` and `{null}` stay one-element sets */
+const PARAMETER = /^\{\s*([A-Za-z_][A-Za-z0-9_]*)\s*\}/;
 const NAME_START = /[\p{L}]/u;
 const NAME_CHAR = /[\p{L}\p{N}_:]/u;
 var Parser = class {
 	src;
+	params;
 	i = 0;
 	vars;
-	constructor(src, vars) {
+	usedParams = /* @__PURE__ */ new Set();
+	constructor(src, vars, params = {}) {
 		this.src = src;
+		this.params = params;
 		this.vars = vars ?? /* @__PURE__ */ new Map();
 	}
+	/** names in `params` that the source never referred to */
+	unusedParameters() {
+		return Object.keys(this.params).filter((name) => !this.usedParams.has(name));
+	}
 	/** id -> name, for printing rules back out */
 	variableNames() {
 		const out = /* @__PURE__ */ new Map();
@@ -890,7 +1111,7 @@ var Parser = class {
 			};
 		}
 		if (this.peek("[")) return this.array(allowVariables);
-		if (this.peek("{")) return this.setOrMap(allowVariables);
+		if (this.peek("{")) return this.parameter() ?? this.setOrMap(allowVariables);
 		const m = /^-?\d+/.exec(this.src.slice(this.i));
 		if (m) {
 			this.i += m[0].length;
@@ -901,6 +1122,15 @@ var Parser = class {
 		}
 		throw new ParseError(`unexpected term at offset ${this.i}: ${this.src.slice(this.i, this.i + 20)}`);
 	}
+	parameter() {
+		const m = PARAMETER.exec(this.src.slice(this.i));
+		if (!m || m[1] === "true" || m[1] === "false" || m[1] === "null") return null;
+		const name = m[1];
+		if (!Object.hasOwn(this.params, name)) throw new ParseError(`unbound parameter {${name}}`);
+		this.i += m[0].length;
+		this.usedParams.add(name);
+		return paramTerm(name, this.params[name]);
+	}
 	array(allowVariables) {
 		this.expect("[");
 		const items = [];
@@ -2474,6 +2704,18 @@ function convBlock(b, s, externalKey) {
 function loadToken(bytes, rootPublicKey, rootAlgorithm = 0) {
 	const token = decodeBiscuit(bytes);
 	verifyToken(token, rootPublicKey, rootAlgorithm);
+	return toLoadedToken(token);
+}
+/**
+* `loadToken`, verifying signatures with the platform's WebCrypto Ed25519 where
+* available — see `verifyTokenAsync`. Same result, same errors.
+*/
+async function loadTokenAsync(bytes, rootPublicKey, rootAlgorithm = 0) {
+	const token = decodeBiscuit(bytes);
+	await verifyTokenAsync(token, rootPublicKey, rootAlgorithm);
+	return toLoadedToken(token);
+}
+function toLoadedToken(token) {
 	const signed = [token.authority, ...token.blocks];
 	const decoded = signed.map((sb) => decodeBlock(sb.block));
 	const globalSymbols = [];
@@ -2528,7 +2770,12 @@ function headVariablesAreBound(rule) {
 	for (const p of rule.body) for (const t of p.terms) if (t.t === "var") bound.add(t.v);
 	return rule.head.terms.every((t) => t.t !== "var" || bound.has(t.v));
 }
-function parseAuthorizer(src) {
+/**
+* Parse authorizer (or block) source. `{name}` parameters are bound from
+* `params` as terms; an unbound or an unused parameter is a `ParseError`, as it
+* is in the reference.
+*/
+function parseAuthorizer(src, params) {
 	const out = {
 		facts: [],
 		rules: [],
@@ -2537,8 +2784,10 @@ function parseAuthorizer(src) {
 		scopes: [],
 		varNames: /* @__PURE__ */ new Map()
 	};
-	const parser = new Parser(src);
+	const parser = new Parser(src, void 0, params);
 	const statements = parser.parse();
+	const unused = parser.unusedParameters();
+	if (unused.length > 0) throw new ParseError(`unused parameter${unused.length > 1 ? "s" : ""} {${unused.join("}, {")}}`);
 	out.varNames = parser.variableNames();
 	for (const st of statements) if (st.k === "fact") out.facts.push(st.fact);
 	else if (st.k === "rule") out.rules.push(st.rule);
@@ -2551,7 +2800,7 @@ function parseAuthorizer(src) {
 	return out;
 }
 function authorize(token, authorizerSrc, options = {}) {
-	return authorizeDetailed(token, authorizerSrc, options).result;
+	return evaluate(token, authorizerSrc, options).result;
 }
 const EMPTY_WORLD = {
 	facts: [],
@@ -2562,18 +2811,32 @@ const EMPTY_WORLD = {
 /** Same as `authorize`, and also returns the post-run world, in the shape the
 *  official sample corpus records it. */
 function authorizeDetailed(token, authorizerSrc, options = {}) {
+	const evaluation = evaluate(token, authorizerSrc, options);
+	return {
+		result: evaluation.result,
+		world: evaluation.snapshot()
+	};
+}
+const NO_TOKEN = {
+	blocks: [],
+	publicKeyToBlockIds: /* @__PURE__ */ new Map(),
+	revocationIds: []
+};
+/**
+* Run the authorizer against a verified token — or against no token at all,
+* for a decision made from the authorizer's own facts and rules.
+*/
+function evaluate(loadedToken, authorizerSrc, options = {}) {
+	const token = loadedToken ?? NO_TOKEN;
 	const limits = options.limits ?? DEFAULT_LIMITS;
 	let code;
 	try {
-		code = parseAuthorizer(authorizerSrc);
+		code = parseAuthorizer(authorizerSrc, options.params);
 	} catch (e) {
-		return {
-			result: {
-				kind: "format",
-				error: e.message
-			},
-			world: EMPTY_WORLD
-		};
+		return unusable({
+			kind: "format",
+			error: e.message
+		});
 	}
 	const world = new World();
 	if (options.externs) world.externs = options.externs;
@@ -2586,14 +2849,11 @@ function authorizeDetailed(token, authorizerSrc, options = {}) {
 		const origin = Origin.of(id);
 		for (const f of block.facts) world.addFact(origin, f);
 		for (const r of block.rules) {
-			if (!headVariablesAreBound(r)) return {
-				result: {
-					kind: "invalidBlockRule",
-					blockId: 0,
-					rule: printRule(r, (v) => block.varNames.get(v) ?? String(v))
-				},
-				world: EMPTY_WORLD
-			};
+			if (!headVariablesAreBound(r)) return unusable({
+				kind: "invalidBlockRule",
+				blockId: 0,
+				rule: printRule(r, (v) => block.varNames.get(v) ?? String(v))
+			});
 			world.addRule(id, trustedOriginsFromScopes(r.scopes, trusted, id, keys), r);
 		}
 	}
@@ -2643,16 +2903,29 @@ function authorizeDetailed(token, authorizerSrc, options = {}) {
 			policies: code.policies.map((p) => printPolicy(p.kind, p.queries, name(AUTHORIZER)))
 		};
 	};
+	let failure;
+	const settled = (result) => ({
+		result,
+		snapshot,
+		query(src, queryOptions = {}) {
+			if (failure) throw failure;
+			const parsed = parseAuthorizer(`${src};`, queryOptions.params);
+			if (parsed.facts.length + parsed.rules.length + parsed.checks.length + parsed.policies.length !== 1 || parsed.rules.length !== 1) throw new ParseError("a query must be exactly one rule");
+			const rule = parsed.rules[0];
+			const trusted = trustedOriginsFromScopes(rule.scopes, authorizerTrusted, AUTHORIZER, keys);
+			return world.query(rule, trusted);
+		}
+	});
 	try {
 		world.run(limits);
 	} catch (e) {
-		if (e instanceof ExecutionError) return {
-			result: {
+		if (e instanceof ExecutionError) {
+			failure = e;
+			return settled({
 				kind: "execution",
 				error: e.kind
-			},
-			world: snapshot()
-		};
+			});
+		}
 		throw e;
 	}
 	const errors = [];
@@ -2667,14 +2940,16 @@ function authorizeDetailed(token, authorizerSrc, options = {}) {
 		code.checks.forEach((check, i) => {
 			if (!runCheck(check, 4294967295, authorizerTrusted)) errors.push({
 				source: "authorizer",
-				checkId: i
+				checkId: i,
+				rule: printCheck(check, name(AUTHORIZER))
 			});
 		});
 		token.blocks[0]?.checks.forEach((check, j) => {
 			if (!runCheck(check, 0, blockTrusted[0])) errors.push({
 				source: "block",
 				blockId: 0,
-				checkId: j
+				checkId: j,
+				rule: printCheck(check, name(0))
 			});
 		});
 		let policyResult = null;
@@ -2689,34 +2964,42 @@ function authorizeDetailed(token, authorizerSrc, options = {}) {
 			if (!runCheck(check, id, blockTrusted[id])) errors.push({
 				source: "block",
 				blockId: id,
-				checkId: j
+				checkId: j,
+				rule: printCheck(check, name(id))
 			});
 		});
-		return {
-			result: policyResult === null ? {
-				kind: "noMatchingPolicy",
-				checks: errors
-			} : "allow" in policyResult && errors.length === 0 ? {
-				kind: "ok",
-				policy: policyResult.allow
-			} : {
-				kind: "unauthorized",
-				policy: policyResult,
-				checks: errors
-			},
-			world: snapshot()
-		};
+		return settled(policyResult === null ? {
+			kind: "noMatchingPolicy",
+			checks: errors
+		} : "allow" in policyResult && errors.length === 0 ? {
+			kind: "ok",
+			policy: policyResult.allow
+		} : {
+			kind: "unauthorized",
+			policy: policyResult,
+			checks: errors
+		});
 	} catch (e) {
-		if (e instanceof ExecutionError) return {
-			result: {
+		if (e instanceof ExecutionError) {
+			failure = e;
+			return settled({
 				kind: "execution",
 				error: e.kind
-			},
-			world: snapshot()
-		};
+			});
+		}
 		throw e;
 	}
 }
+/** An evaluation that never produced a world: the result says why, and queries refuse. */
+function unusable(result) {
+	return {
+		result,
+		snapshot: () => EMPTY_WORLD,
+		query() {
+			throw new Error(`cannot query an evaluation that ended in ${result.kind}`);
+		}
+	};
+}
 function compareOrigins(a, b) {
 	for (let i = 0; i < Math.max(a.length, b.length); i++) {
 		const x = a[i] === void 0 ? -Infinity : a[i] ?? -1;
@@ -2726,48 +3009,6 @@ function compareOrigins(a, b) {
 	return 0;
 }
 //#endregion
-//#region src/base64.ts
-/** URL-safe base64 without padding, the wire form of a Biscuit token.
-*  Implemented directly so the library stays runtime-agnostic (no Buffer,
-*  no atob/btoa). */
-const ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
-const REVERSE = new Map([...ALPHABET].map((c, i) => [c, i]));
-REVERSE.set("+", 62);
-REVERSE.set("/", 63);
-function toBase64(bytes) {
-	let out = "";
-	for (let i = 0; i < bytes.length; i += 3) {
-		const b0 = bytes[i];
-		const b1 = bytes[i + 1];
-		const b2 = bytes[i + 2];
-		out += ALPHABET[b0 >> 2];
-		out += ALPHABET[(b0 & 3) << 4 | (b1 ?? 0) >> 4];
-		if (b1 === void 0) break;
-		out += ALPHABET[(b1 & 15) << 2 | (b2 ?? 0) >> 6];
-		if (b2 === void 0) break;
-		out += ALPHABET[b2 & 63];
-	}
-	return out;
-}
-function fromBase64(text) {
-	const s = text.trim().replace(/=+$/, "");
-	const out = new Uint8Array(Math.floor(s.length * 3 / 4));
-	let o = 0;
-	let acc = 0;
-	let bits = 0;
-	for (const c of s) {
-		const v = REVERSE.get(c);
-		if (v === void 0) throw new Error(`invalid base64 character ${JSON.stringify(c)}`);
-		acc = acc << 6 | v;
-		bits += 6;
-		if (bits >= 8) {
-			bits -= 8;
-			out[o++] = acc >> bits & 255;
-		}
-	}
-	return out.subarray(0, o);
-}
-//#endregion
 //#region src/builder.ts
 /**
 * The write path: minting tokens, attenuating them with extra blocks, and
@@ -2780,12 +3021,18 @@ var BuilderError = class extends Error {};
 var SymbolWriter = class {
 	known;
 	knownKeys;
+	varNames;
 	/** symbols added by this block, in insertion order */
 	added = [];
 	addedKeys = [];
-	constructor(known = [], knownKeys = []) {
+	constructor(known = [], knownKeys = [], varNames = /* @__PURE__ */ new Map()) {
 		this.known = known;
 		this.knownKeys = knownKeys;
+		this.varNames = varNames;
+	}
+	/** A variable's wire id is the symbol index of its NAME, not the parser's local id. */
+	variable(id) {
+		return this.insert(this.varNames.get(id) ?? String(id));
 	}
 	insert(s) {
 		const d = DEFAULT_SYMBOLS.indexOf(s);
@@ -2817,7 +3064,7 @@ function toTerm(t, w) {
 	switch (t.t) {
 		case "var": return {
 			kind: "variable",
-			value: t.v
+			value: w.variable(t.v)
 		};
 		case "int": return {
 			kind: "integer",
@@ -2885,7 +3132,7 @@ const toOps = (ops, w) => ops.map((op) => {
 		};
 		case "closure": return {
 			kind: "closure",
-			params: op.params,
+			params: op.params.map((p) => w.variable(p)),
 			ops: toOps(op.ops, w)
 		};
 		default: throw new Error(`unknown expression op kind ${op.kind}`);
@@ -2908,7 +3155,7 @@ const toRule = (r, w) => ({
 	scope: r.scopes.map((s) => toScope(s, w))
 });
 function buildBlockMsg(content, knownSymbols = [], knownKeys = [], minVersion = 0) {
-	const w = new SymbolWriter(knownSymbols, knownKeys);
+	const w = new SymbolWriter(knownSymbols, knownKeys, content.varNames);
 	const facts = content.facts.map((f) => toPredicate(f.predicate, w));
 	const rules = content.rules.map((r) => toRule(r, w));
 	const checks = content.checks.map((c) => ({
@@ -2926,14 +3173,15 @@ function buildBlockMsg(content, knownSymbols = [], knownKeys = [], minVersion =
 		publicKeys: w.addedKeys.map(parseKeyString)
 	};
 }
-const contentFromCode = (code) => {
-	const parsed = parseAuthorizer(code);
+const contentFromCode = (code, params) => {
+	const parsed = parseAuthorizer(code, params);
 	if (parsed.policies.length) throw new BuilderError("allow/deny policies belong to the authorizer, not to a block");
 	return {
 		facts: parsed.facts,
 		rules: parsed.rules,
 		checks: parsed.checks,
-		scopes: parsed.scopes
+		scopes: parsed.scopes,
+		varNames: parsed.varNames
 	};
 };
 function knownTables(token) {
@@ -2956,7 +3204,7 @@ function knownTables(token) {
 /** Mint a new token whose authority block holds `code`. */
 function buildToken(rootSecret, code, options = {}) {
 	const algorithm = options.algorithm ?? 0;
-	const blockBytes = encodeBlock(buildBlockMsg(typeof code === "string" ? contentFromCode(code) : code));
+	const blockBytes = encodeBlock(buildBlockMsg(typeof code === "string" ? contentFromCode(code, options.params) : code));
 	const next = options.nextKeypair ?? generateKeypair(algorithm);
 	const nextKey = {
 		algorithm,
@@ -2987,7 +3235,7 @@ function attenuate(tokenBytes, code, options = {}) {
 	const previous = token.blocks.length ? token.blocks[token.blocks.length - 1] : token.authority;
 	const currentAlgorithm = previous.nextKey.algorithm;
 	const tables = knownTables(token);
-	const blockBytes = encodeBlock(buildBlockMsg(typeof code === "string" ? contentFromCode(code) : code, tables.symbols, tables.keys));
+	const blockBytes = encodeBlock(buildBlockMsg(typeof code === "string" ? contentFromCode(code, options.params) : code, tables.symbols, tables.keys));
 	const next = options.nextKeypair ?? generateKeypair(algorithm);
 	const nextKey = {
 		algorithm,
@@ -3023,8 +3271,8 @@ function thirdPartyRequest(tokenBytes) {
 	return { previousSignature: (token.blocks.length ? token.blocks[token.blocks.length - 1] : token.authority).signature };
 }
 /** The third party builds and signs a block without holding the token. */
-function thirdPartyBlock(request, externalSecret, code, algorithm = 0) {
-	const blockBytes = encodeBlock(buildBlockMsg(typeof code === "string" ? contentFromCode(code) : code, [], [], 5));
+function thirdPartyBlock(request, externalSecret, code, algorithm = 0, params) {
+	const blockBytes = encodeBlock(buildBlockMsg(typeof code === "string" ? contentFromCode(code, params) : code, [], [], 5));
 	return {
 		block: blockBytes,
 		signature: sign(externalPayloadV1(blockBytes, request.previousSignature, SIGNATURE_VERSION), externalSecret, algorithm),
@@ -3106,6 +3354,13 @@ var Biscuit = class Biscuit {
 	verify(rootPublicKey, rootAlgorithm = 0) {
 		return new VerifiedBiscuit(loadToken(this.bytes, rootPublicKey, rootAlgorithm), this.bytes);
 	}
+	/**
+	* `verify`, using WebCrypto Ed25519 where the platform has it — roughly ten
+	* times faster than the pure-JS path. Rejects exactly where `verify` throws.
+	*/
+	async verifyAsync(rootPublicKey, rootAlgorithm = 0) {
+		return new VerifiedBiscuit(await loadTokenAsync(this.bytes, rootPublicKey, rootAlgorithm), this.bytes);
+	}
 };
 /** A token whose signature chain has been checked against a root key. */
 var VerifiedBiscuit = class {
@@ -3125,6 +3380,10 @@ var VerifiedBiscuit = class {
 	authorize(authorizerCode, options) {
 		return authorize(this.token, authorizerCode, options);
 	}
+	/** Authorize, keeping the evaluated world available to `query`. */
+	evaluate(authorizerCode, options) {
+		return evaluate(this.token, authorizerCode, options);
+	}
 };
 //#endregion
-export { Biscuit, BuilderError, DATALOG_3_1, DATALOG_3_2, DATALOG_3_3, DEFAULT_SYMBOLS, ExecutionError, MAX_SCHEMA_VERSION, MIN_SCHEMA_VERSION, ParseError, ProtoError, SignatureError, TokenError, VerifiedBiscuit, VersionError, appendThirdParty, attenuate, authorize, authorizeDetailed, blockFeatures, buildBlockMsg, buildToken, fromBase64, generateKeypair, loadToken, parseAuthorizer, peekRootKeyId, requiredVersion, sealToken, thirdPartyBlock, thirdPartyRequest, toBase64, validateBlockVersion };
+export { Biscuit, BuilderError, DATALOG_3_1, DATALOG_3_2, DATALOG_3_3, DEFAULT_SYMBOLS, ExecutionError, MAX_SCHEMA_VERSION, MIN_SCHEMA_VERSION, ParseError, ProtoError, SignatureError, TokenError, VerifiedBiscuit, VersionError, appendThirdParty, attenuate, authorize, authorizeDetailed, blockFeatures, buildBlockMsg, buildToken, evaluate, fromBase64, generateKeypair, loadToken, loadTokenAsync, parseAuthorizer, peekRootKeyId, requiredVersion, sealToken, thirdPartyBlock, thirdPartyRequest, toBase64, validateBlockVersion };