@statewalker/webrun-biscuit 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2022-2026 statewalker
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,262 @@
+# @statewalker/webrun-biscuit
+
+[Biscuit](https://biscuitsec.org) authorization tokens in pure TypeScript: the protobuf codec, the
+signature chain, the Datalog engine, the text parser, the authorizer and the token builder. No WASM,
+no Node built-ins in `src/`, two runtime dependencies. It runs wherever the rest of the wire runs —
+Node, browsers, Workers and Durable Objects.
+
+## Why this package exists
+
+There is no other pure JS/TS Biscuit implementation. npm carries `@biscuit-auth/biscuit-wasm` — the
+Rust crate compiled to WebAssembly — and a web-components package built on it. Nothing else.
+
+For a browser-first or Durable-Object context a WASM blob is a real cost, not a stylistic objection:
+bundle size, an instantiation step, and a platform surface that is not available everywhere. A token
+format whose whole point is that the holder can attenuate it locally should not require half a
+megabyte of WebAssembly to do so.
+
+So this is a reimplementation, and the entire testing strategy below exists because a reimplementation
+of a security primitive is only worth having if you can show it agrees with the original.
+
+## Installing and calling it
+
+```sh
+npm install @statewalker/webrun-biscuit
+```
+
+Two runtime dependencies, both external to the published bundle:
+[`@noble/curves`](https://www.npmjs.com/package/@noble/curves) and
+[`@noble/hashes`](https://www.npmjs.com/package/@noble/hashes). ESM only.
+
+Mint a token, attenuate it, seal it, then verify and authorize:
+
+```ts
+import { Biscuit, generateKeypair } from "@statewalker/webrun-biscuit";
+
+const root = generateKeypair();
+
+const token = Biscuit.build(root.secretKey, 'user("alice"); right("file1", "read");')
+  .attenuate('check if operation("read");')
+  .seal()
+  .toBase64();
+
+const verified = Biscuit.fromBase64(token).verify(root.publicKey);
+const result = verified.authorize('operation("read"); allow if user("alice");');
+// { kind: 'ok', policy: 0 }
+```
+
+`verify()` throws on an inauthentic token and returns a `VerifiedBiscuit`. That is deliberate: the
+type system then prevents authorizing a token whose signature chain was never checked, which is the
+mistake worth designing against.
+
+### Examples
+
+secp256r1 works the same way, with the algorithm passed at both ends:
+
+```ts
+const root = generateKeypair(1);
+const token = Biscuit.build(root.secretKey, 'user("alice");', { algorithm: 1 });
+const verified = Biscuit.fromBase64(token.toBase64()).verify(root.publicKey, 1);
+```
+
+For key rotation, read the issuer's key id before choosing a root key. The token is unverified at
+that point, so treat the id as a hint rather than a claim:
+
+```ts
+import { peekRootKeyId } from "@statewalker/webrun-biscuit";
+
+const key = roots[peekRootKeyId(bytes) ?? 0];
+```
+
+A third party can sign a block without ever holding the token:
+
+```ts
+const request = Biscuit.fromBase64(token).thirdPartyRequest();
+const response = thirdPartyBlock(request, externalSecret, 'group("admin");');
+const extended = Biscuit.fromBase64(token).appendThirdParty(response);
+```
+
+## Internals
+
+### How the modules stack up
+
+Each module depends only on the ones above it.
+
+| path | what it does |
+| --- | --- |
+| `src/proto.ts` | strict proto2 codec — BigInt int64, presence tracking, UTF-8 validation, unknown-field rejection |
+| `src/crypto.ts` | Ed25519 + secp256r1 chain, payload v0/v1, sealing, external signatures |
+| `src/datalog.ts` | term model, canonical keys, origin-tracked fixpoint engine, expression VM |
+| `src/parser.ts` | Datalog text syntax to the runtime model |
+| `src/print.ts` | pretty-printer for error messages and world snapshots |
+| `src/version.ts` | block version bounds and Datalog feature gates |
+| `src/authorizer.ts` | symbol resolution, block loading, authorization, world snapshots |
+| `src/builder.ts` | minting, attenuation, sealing, third-party blocks |
+| `src/base64.ts` | URL-safe base64, runtime-agnostic |
+| `src/index.ts` | the public API — `Biscuit`, `VerifiedBiscuit` |
+
+The one awkward edge is that `builder` imports `parseAuthorizer` and `DEFAULT_SYMBOLS` from
+`authorizer`. Both are block-level concerns that happen to live there; it is a naming artefact rather
+than a layering problem, and it would move to a `symbols.ts` if the file grew.
+
+### Decisions that would otherwise get undone
+
+**Terms are compared through canonical string keys.** JS `Map` and `Set` are reference-keyed, while
+the Rust implementation leans on derived `Hash`/`Ord` over a `BTreeSet`. Every structural comparison
+and every de-duplication in the engine therefore goes through `termKey()`. Bypassing it gives you a
+set that silently holds duplicates.
+
+**Symbols are resolved to strings at load time** rather than kept as indices. Simpler, and
+semantically equivalent — the only observable difference is that set ordering follows string order
+instead of symbol-index order, which shows up in printing and not in results.
+
+**Facts are indexed by `name/arity`**, cached per trusted-origin set and invalidated by a generation
+counter, so a join never scans unrelated predicates.
+
+**`Uint8Array` everywhere, never `Buffer`**, in `src/`. That is what makes the package runtime-
+agnostic; tests may use Node APIs, the library may not.
+
+**Default run limits are looser than the reference.** The reference defaults `max_time` to 1
+millisecond, which is unreachably tight for a cold JS engine; this one defaults to 1 second. A caller
+exposed to untrusted tokens should lower it deliberately rather than treat the default as a
+denial-of-service bound.
+
+### The corpus is fetched, not vendored
+
+`scripts/fetch-samples.mjs` downloads the official corpus into `samples/` (gitignored), pinned to
+commit `b3d3fe2` of the **specification repository**,
+[`eclipse-biscuit/biscuit`](https://github.com/eclipse-biscuit/biscuit). The samples belong to the
+biscuit project, so they are not copied into this repo.
+
+The canonical corpus lives in `samples/current` there, **not** in any single implementation: the copy
+shipped inside `biscuit-rust` has drifted, and differs in `samples.json` and `test034_array_map.bc`
+by one check.
+
+The deprecated `v1` and `v2` corpora are fetched too, as negative fixtures. A current implementation
+must reject them: every block declares a Datalog version, and versions outside 3 to 6 are invalid.
+Without that check a v2 token verifies cleanly, which is a vulnerability rather than a compatibility
+nicety.
+
+Beyond the final authorization result, `09-world-snapshot` compares the entire post-run world against
+the corpus — every derived fact, with its origin set. That catches rule-evaluation errors that happen
+not to change the verdict.
+
+### A green suite is not the claim; a suite that can fail is
+
+```sh
+pnpm test          # the main suite, 156 tests
+pnpm test:cross    # against the reference implementation, 55 tests
+pnpm test:all      # both
+pnpm mutate        # inject 10 known defects, require the suite to catch each
+pnpm build         # dist/ plus declarations
+```
+
+| file | covers |
+| --- | --- |
+| `01-proto` | byte-exact round-trip of all 38 sample tokens, i64 extremes, strict rejection |
+| `02-crypto` | signature chain outcomes and revocation ids for all samples |
+| `03-datalog` | engine unit tests ported from the Rust `datalog` module |
+| `04-parser` | terms, precedence, closures, scopes, predicate/expression disambiguation |
+| `05-conformance` | the official `samples.json` corpus — 38 tokens, 50 validations |
+| `06-builder` | write path, corpus rebuilt from source, forged seals, deny policies |
+| `07-api` | base64 and the public facade |
+| `08-hardening` | property round-trips, mutation/truncation fuzzing, join scaling |
+| `09-world-snapshot` | the post-run world per origin, against the official snapshots |
+| `10-versions` | version bounds, feature gates, rejection of the deprecated v1/v2 corpora |
+
+`scripts/mutate.mjs` is the check on all of it. It injects ten defects — a lenient protobuf decoder,
+wrapping i64 arithmetic, `check all` degraded to `check if`, a universally trusting authorizer, `deny`
+treated as `allow`, unchecked seal signatures, missing version bounds, and more — and requires each to
+break at least one test. A surviving mutation is a hole in the tests, not a success. All ten are
+caught. Two of them were **not** caught when the harness was first written: nothing verified a forged
+seal signature, and nothing exercised a matching `deny` policy.
+
+Each mutation's `find` string is a literal excerpt of the source, and must match exactly once. That is
+why a reformat of `src/` makes the harness fail loudly rather than quietly stop testing anything.
+
+### Cross-reference tests run against the reference itself
+
+`tests/cross/` checks interoperability against the Rust `biscuit-auth` crate compiled to WebAssembly
+and published as `@biscuit-auth/biscuit-wasm`. These tests are only meaningful because the other side
+is genuinely upstream, not a second reading of the same spec.
+
+| file | direction |
+| --- | --- |
+| `01-native-to-ts` | the reference mints, we read — including a differential check on verdict, policy index and revocation ids |
+| `02-ts-to-native` | we mint, the reference reads |
+| `03-interop-chains` | blocks appended alternately by both, sealing honoured across the boundary, base64 interop, agreement on the stamped Datalog version |
+| `04-random-differential` | generated programs, both directions, both algorithms — the reference is the oracle |
+
+Nothing in `04` hard-codes the expected answer: each generated program is authorized by both
+implementations and the verdicts compared, so a disagreement is a finding either way. Programs are
+built around a (resource, operation, user) scenario and then perturbed rather than sampled uniformly,
+because uniform sampling produces mostly `noMatchingPolicy`, where the engine barely runs.
+
+That suite is kept out of `pnpm test` on purpose, and it skips gracefully when the reference is not
+installed, so it never becomes a hard dependency of the main suite.
+
+## What will surprise you
+
+**The reference build's first `authorize` call reports a timeout that is not real.** Every fresh
+Authorizer reports a `RunLimit` timeout on its first call even with a 60-second budget; later calls on
+the same object return in under a millisecond. `referenceOutcome` retries, so a genuine timeout still
+fails. The same defect shows up under CPU contention on any call, which is why `pnpm test:cross` is a
+separate script: a flaky reference must never be able to redden the main suite.
+
+**The reference's run limits are a serde `Duration`.** `max_time` must be `{ secs, nanos }`. Passing a
+plain number of nanoseconds does **not** error — deserialization fails quietly and the *default* 1 ms
+limit applies, which then times out. It looks exactly like a slow engine.
+
+**`PublicKey.toBytes()` throws** in that build. `toString()` returns `"<algorithm>/<hex>"` and is the
+reliable accessor.
+
+**The reference package cannot be imported in Node.** Its entry point does
+`import * as wasm from "./biscuit_bg.wasm"`, which Node will not resolve, and its `exports` map has no
+`require` condition, so `require.resolve` fails too. `tests/cross/reference.ts` finds the package by
+walking up to `node_modules`, reads the `.wasm`, and supplies its imports by hand. Running Node with
+`--experimental-wasm-modules` does work, but needing a flag for `pnpm test` is worse.
+
+**A failed corpus download used to poison `samples/` permanently.** `samples.json` was written before
+the tokens it names while the "already fetched" guard checked only `samples.json`, so an interrupted
+fetch left a directory that every later run skipped as complete — and the tests then failed on missing
+files forever. The manifest is now written last, and the guard checks every file it names. Downloads
+are also pooled at six with retries, because `raw.githubusercontent.com` resets connections when
+several dozen requests arrive at once and surfaces it as a bare `TypeError: fetch failed`.
+
+**`pnpm test` fetches the corpus explicitly, not through `pretest`.** pnpm does not run `pre`/`post`
+scripts by default, so a `pretest` hook would silently never fire and the suite would fail on a clean
+checkout with missing samples.
+
+## Known deviations from the reference
+
+**Regex uses JS `RegExp`, not RE2.** Every corpus pattern matches, but backreferences and lookaround
+are accepted where Rust would reject them. Documented, not enforced.
+
+**New blocks are signed with signature payload version 1** unconditionally. Datalog block versions, by
+contrast, are computed from content: a block declares the lowest version that can legally carry it.
+
+**Arrays and maps do not trigger the v3.3 feature gate.** The reference's `contains_v3_3_term` flags
+only `null` and sets containing `null`, so a block using arrays may legally declare v3.1. This looks
+like an upstream oversight and is mirrored deliberately, because matching the reference matters more
+than being right here. `03-interop-chains` confirms it empirically.
+
+**Not implemented:** authorizer snapshots (`AuthorizerSnapshot` / `SnapshotBlock`); a `query(rule)` API
+for pulling facts out of an evaluated world, where `authorizeDetailed` exposes the whole world more
+coarsely; a revocation-checking helper, since revocation ids are exposed but comparing them against a
+list is left to the caller; and wire-compatible third-party blocks — `thirdPartyRequest()` returns a
+plain object rather than the `ThirdPartyBlockRequest` protobuf message, so our own end-to-end
+third-party flow works and is tested, but the cross-implementation one does not.
+
+Semi-naive evaluation is not implemented either. The fixpoint re-derives every fact each round; the
+index makes that cheap at token scale, but not at request scale with large fact sets.
+
+## Design notes
+
+`docs/webrun-biscuit/` in this repository carries the working documents from the implementation
+sessions: how the reference actually works, why `mapbox/pbf` was rejected for the protobuf layer, what
+the red-green cycle caught, the corpus findings, and what it took to make random differential testing
+actually detect a defect.
+
+## License
+
+MIT — see the repository `LICENSE`.

package/dist/authorizer.d.ts

@@ -0,0 +1,112 @@
+/**
+ * Turns a serialized token plus authorizer code into an authorization result,
+ * mirroring the evaluation order of the reference implementation.
+ */
+import { type Check, type ExternFn, type Fact, type Rule, type RunLimits, type Scope } from "./datalog.js";
+export declare const DEFAULT_SYMBOLS: string[];
+export declare class TokenError extends Error {
+    readonly kind: "Format" | "Symbol";
+    constructor(kind: "Format" | "Symbol", message: string);
+}
+export interface RuntimeBlock {
+    facts: Fact[];
+    rules: Rule[];
+    checks: Check[];
+    scopes: Scope[];
+    externalKey?: string;
+    /** variable id -> name, for printing rules in error messages */
+    varNames: Map<number, string>;
+}
+export interface LoadedToken {
+    blocks: RuntimeBlock[];
+    publicKeyToBlockIds: Map<string, number[]>;
+    revocationIds: string[];
+    /** the issuer's key identifier, when the token carries one — callers use it
+     *  to pick the right root key during rotation */
+    rootKeyId?: number;
+}
+export declare function loadToken(bytes: Uint8Array, rootPublicKey: Uint8Array, 
+/** the root key's algorithm: 0 = Ed25519, 1 = secp256r1 */
+rootAlgorithm?: 0 | 1): LoadedToken;
+/**
+ * Reads the key identifier from a token **without verifying it**, so a caller
+ * can choose which root key to verify against. The token is untrusted at this
+ * point: the id is a hint, not a claim.
+ */
+export declare function peekRootKeyId(bytes: Uint8Array): number | undefined;
+export type FailedCheck = {
+    source: "authorizer";
+    checkId: number;
+} | {
+    source: "block";
+    blockId: number;
+    checkId: number;
+};
+export type AuthorizationResult = {
+    kind: "ok";
+    policy: number;
+} | {
+    kind: "unauthorized";
+    policy: {
+        allow: number;
+    } | {
+        deny: number;
+    };
+    checks: FailedCheck[];
+} | {
+    kind: "noMatchingPolicy";
+    checks: FailedCheck[];
+} | {
+    kind: "execution";
+    error: string;
+} | {
+    kind: "invalidBlockRule";
+    blockId: number;
+    rule: string;
+} | {
+    kind: "format";
+    error: string;
+};
+/** the shape of the `world` snapshot in the official sample corpus */
+export interface WorldSnapshot {
+    facts: {
+        origin: (number | null)[];
+        facts: string[];
+    }[];
+    rules: {
+        origin: number;
+        rules: string[];
+    }[];
+    checks: {
+        origin: number;
+        checks: string[];
+    }[];
+    policies: string[];
+}
+export interface AuthorizeDetails {
+    result: AuthorizationResult;
+    world: WorldSnapshot;
+}
+interface AuthorizerCode {
+    facts: Fact[];
+    rules: Rule[];
+    checks: Check[];
+    policies: {
+        kind: "allow" | "deny";
+        queries: Rule[];
+    }[];
+    scopes: Scope[];
+    varNames: Map<number, string>;
+}
+export declare function parseAuthorizer(src: string): AuthorizerCode;
+export interface AuthorizeOptions {
+    limits?: RunLimits;
+    /** extern functions callable as `.extern::name(...)` */
+    externs?: Map<string, ExternFn>;
+}
+export declare function authorize(token: LoadedToken, authorizerSrc: string, options?: AuthorizeOptions): AuthorizationResult;
+/** Same as `authorize`, and also returns the post-run world, in the shape the
+ *  official sample corpus records it. */
+export declare function authorizeDetailed(token: LoadedToken, authorizerSrc: string, options?: AuthorizeOptions): AuthorizeDetails;
+export {};
+//# sourceMappingURL=authorizer.d.ts.map

package/dist/authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorizer.d.ts","sourceRoot":"","sources":["../src/authorizer.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAEL,KAAK,KAAK,EAGV,KAAK,QAAQ,EACb,KAAK,IAAI,EAMT,KAAK,IAAI,EACT,KAAK,SAAS,EACd,KAAK,KAAK,EAKX,MAAM,cAAc,CAAC;AAiBtB,eAAO,MAAM,eAAe,UA6B3B,CAAC;AAGF,qBAAa,UAAW,SAAQ,KAAK;IAEjC,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,QAAQ;IADpC,YACW,IAAI,EAAE,QAAQ,GAAG,QAAQ,EAClC,OAAO,EAAE,MAAM,EAGhB;CACF;AA+GD,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gEAAgE;IAChE,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AA2CD,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,YAAY,EAAE,CAAC;IACvB,mBAAmB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3C,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB;qDACiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,SAAS,CACvB,KAAK,EAAE,UAAU,EACjB,aAAa,EAAE,UAAU;AACzB,2DAA2D;AAC3D,aAAa,GAAE,CAAC,GAAG,CAAK,GACvB,WAAW,CAmDb;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,GAAG,SAAS,CAEnE;AAWD,MAAM,MAAM,WAAW,GACnB;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACzC;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1D,MAAM,MAAM,mBAAmB,GAC3B;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAAC,MAAM,EAAE,WAAW,EAAE,CAAA;CAAE,GAC7F;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,MAAM,EAAE,WAAW,EAAE,CAAA;CAAE,GACnD;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC3D;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtC,sEAAsE;AACtE,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE;QAAE,MAAM,EAAE,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE,EAAE,CAAC;IACxD,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE,EAAE,CAAC;IAC7C,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,EAAE,CAAC;IAC/C,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,mBAAmB,CAAC;IAC5B,KAAK,EAAE,aAAa,CAAC;CACtB;AAED,UAAU,cAAc;IACtB,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,QAAQ,EAAE;QAAE,IAAI,EAAE,OAAO,GAAG,MAAM,CAAC;QAAC,OAAO,EAAE,IAAI,EAAE,CAAA;KAAE,EAAE,CAAC;IACxD,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,CAoB3D;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB,wDAAwD;IACxD,OAAO,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;CACjC;AAED,wBAAgB,SAAS,CACvB,KAAK,EAAE,WAAW,EAClB,aAAa,EAAE,MAAM,EACrB,OAAO,GAAE,gBAAqB,GAC7B,mBAAmB,CAErB;AAID;yCACyC;AACzC,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,WAAW,EAClB,aAAa,EAAE,MAAM,EACrB,OAAO,GAAE,gBAAqB,GAC7B,gBAAgB,CAqKlB"}

package/dist/base64.d.ts

@@ -0,0 +1,3 @@
+export declare function toBase64(bytes: Uint8Array): string;
+export declare function fromBase64(text: string): Uint8Array;
+//# sourceMappingURL=base64.d.ts.map

package/dist/base64.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base64.d.ts","sourceRoot":"","sources":["../src/base64.ts"],"names":[],"mappings":"AAQA,wBAAgB,QAAQ,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAclD;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAiBnD"}

package/dist/builder.d.ts

@@ -0,0 +1,52 @@
+/**
+ * The write path: minting tokens, attenuating them with extra blocks, and
+ * sealing them. New blocks are signed with signature payload version 1, and
+ * declare the lowest Datalog version their content legally requires.
+ */
+import { generateKeypair } from "./crypto.js";
+import type { Check, Predicate, Rule, Scope } from "./datalog.js";
+import { type BlockMsg, type PublicKeyMsg } from "./proto.js";
+export declare class BuilderError extends Error {
+}
+export interface Keypair {
+    secretKey: Uint8Array;
+    publicKey: Uint8Array;
+}
+export { generateKeypair };
+export interface BlockContent {
+    facts: {
+        predicate: Predicate;
+    }[];
+    rules: Rule[];
+    checks: Check[];
+    scopes: Scope[];
+}
+export declare function buildBlockMsg(content: BlockContent, knownSymbols?: string[], knownKeys?: string[], minVersion?: number): BlockMsg;
+export interface BuildOptions {
+    rootKeyId?: number;
+    /** supply a next keypair instead of generating one (tests, determinism) */
+    nextKeypair?: Keypair;
+    algorithm?: 0 | 1;
+}
+/** Mint a new token whose authority block holds `code`. */
+export declare function buildToken(rootSecret: Uint8Array, code: string | BlockContent, options?: BuildOptions): Uint8Array;
+/** Append an attenuation block. Uses the token's own proof secret to sign. */
+export declare function attenuate(tokenBytes: Uint8Array, code: string | BlockContent, options?: BuildOptions): Uint8Array;
+/** Seal a token so no further block can be appended. */
+export declare function sealToken(tokenBytes: Uint8Array): Uint8Array;
+export interface ThirdPartyRequest {
+    /** signature of the block this attenuation will follow */
+    previousSignature: Uint8Array;
+}
+/** What a token holder sends to a third party that will sign a block. */
+export declare function thirdPartyRequest(tokenBytes: Uint8Array): ThirdPartyRequest;
+export interface ThirdPartyResponse {
+    block: Uint8Array;
+    signature: Uint8Array;
+    publicKey: PublicKeyMsg;
+}
+/** The third party builds and signs a block without holding the token. */
+export declare function thirdPartyBlock(request: ThirdPartyRequest, externalSecret: Uint8Array, code: string | BlockContent, algorithm?: 0 | 1): ThirdPartyResponse;
+/** The token holder appends a block signed by a third party. */
+export declare function appendThirdParty(tokenBytes: Uint8Array, response: ThirdPartyResponse, options?: BuildOptions): Uint8Array;
+//# sourceMappingURL=builder.d.ts.map

package/dist/builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"builder.d.ts","sourceRoot":"","sources":["../src/builder.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAIL,eAAe,EAIhB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,KAAK,EAAM,SAAS,EAAE,IAAI,EAAE,KAAK,EAAQ,MAAM,cAAc,CAAC;AAC5E,OAAO,EAEL,KAAK,QAAQ,EAQb,KAAK,YAAY,EAIlB,MAAM,YAAY,CAAC;AAMpB,qBAAa,YAAa,SAAQ,KAAK;CAAG;AAE1C,MAAM,WAAW,OAAO;IACtB,SAAS,EAAE,UAAU,CAAC;IACtB,SAAS,EAAE,UAAU,CAAC;CACvB;AACD,OAAO,EAAE,eAAe,EAAE,CAAC;AAgH3B,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE;QAAE,SAAS,EAAE,SAAS,CAAA;KAAE,EAAE,CAAC;IAClC,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,MAAM,EAAE,KAAK,EAAE,CAAC;CACjB;AAED,wBAAgB,aAAa,CAC3B,OAAO,EAAE,YAAY,EACrB,YAAY,GAAE,MAAM,EAAO,EAC3B,SAAS,GAAE,MAAM,EAAO,EACxB,UAAU,SAAI,GACb,QAAQ,CAkBV;AA4BD,MAAM,WAAW,YAAY;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,SAAS,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;CACnB;AAED,2DAA2D;AAC3D,wBAAgB,UAAU,CACxB,UAAU,EAAE,UAAU,EACtB,IAAI,EAAE,MAAM,GAAG,YAAY,EAC3B,OAAO,GAAE,YAAiB,GACzB,UAAU,CAgBZ;AAED,8EAA8E;AAC9E,wBAAgB,SAAS,CACvB,UAAU,EAAE,UAAU,EACtB,IAAI,EAAE,MAAM,GAAG,YAAY,EAC3B,OAAO,GAAE,YAAiB,GACzB,UAAU,CA4BZ;AAED,wDAAwD;AACxD,wBAAgB,SAAS,CAAC,UAAU,EAAE,UAAU,GAAG,UAAU,CAO5D;AAID,MAAM,WAAW,iBAAiB;IAChC,0DAA0D;IAC1D,iBAAiB,EAAE,UAAU,CAAC;CAC/B;AAED,yEAAyE;AACzE,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,UAAU,GAAG,iBAAiB,CAI3E;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,UAAU,CAAC;IAClB,SAAS,EAAE,UAAU,CAAC;IACtB,SAAS,EAAE,YAAY,CAAC;CACzB;AAED,0EAA0E;AAC1E,wBAAgB,eAAe,CAC7B,OAAO,EAAE,iBAAiB,EAC1B,cAAc,EAAE,UAAU,EAC1B,IAAI,EAAE,MAAM,GAAG,YAAY,EAC3B,SAAS,GAAE,CAAC,GAAG,CAAK,GACnB,kBAAkB,CAWpB;AAED,gEAAgE;AAChE,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,UAAU,EACtB,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,GAAE,YAAiB,GACzB,UAAU,CA2BZ"}

package/dist/crypto.d.ts

@@ -0,0 +1,22 @@
+import type { BiscuitMsg, PublicKeyMsg, SignedBlock } from "./proto.js";
+export declare class SignatureError extends Error {
+}
+declare const bytesEqual: (a: Uint8Array, b: Uint8Array) => boolean;
+export declare function publicKeyFromSecret(secret: Uint8Array, algorithm: number): Uint8Array;
+export declare function blockPayloadV0(data: Uint8Array, nextKey: PublicKeyMsg, externalSig?: Uint8Array): Uint8Array;
+export declare function authorityPayloadV1(data: Uint8Array, nextKey: PublicKeyMsg, version: number): Uint8Array;
+export declare function blockPayloadV1(data: Uint8Array, nextKey: PublicKeyMsg, externalSig: Uint8Array | undefined, previousSignature: Uint8Array, version: number): Uint8Array;
+export declare function externalPayloadV1(data: Uint8Array, previousSignature: Uint8Array, version: number): Uint8Array;
+export declare function sealPayloadV0(block: SignedBlock): Uint8Array;
+export declare function sign(payload: Uint8Array, secret: Uint8Array, algorithm: number): Uint8Array;
+/** a fresh keypair for the given algorithm */
+export declare function generateKeypair(algorithm?: 0 | 1): {
+    secretKey: Uint8Array;
+    publicKey: Uint8Array;
+};
+export { bytesEqual };
+/** Verifies the full signature chain and the proof. Throws on failure. */
+export declare function verifyToken(token: BiscuitMsg, rootPublicKey: Uint8Array, rootAlgorithm?: number): void;
+/** Revocation identifier of each block: its signature bytes. */
+export declare function revocationIds(token: BiscuitMsg): Uint8Array[];
+//# sourceMappingURL=crypto.d.ts.map

package/dist/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAExE,qBAAa,cAAe,SAAQ,KAAK;CAAG;AAkB5C,QAAA,MAAM,UAAU,MAAO,UAAU,KAAK,UAAU,KAAG,OACK,CAAC;AAwBzD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,GAAG,UAAU,CAIrF;AAID,wBAAgB,cAAc,CAC5B,IAAI,EAAE,UAAU,EAChB,OAAO,EAAE,YAAY,EACrB,WAAW,CAAC,EAAE,UAAU,GACvB,UAAU,CAEZ;AAED,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,UAAU,EAChB,OAAO,EAAE,YAAY,EACrB,OAAO,EAAE,MAAM,GACd,UAAU,CAWZ;AAED,wBAAgB,cAAc,CAC5B,IAAI,EAAE,UAAU,EAChB,OAAO,EAAE,YAAY,EACrB,WAAW,EAAE,UAAU,GAAG,SAAS,EACnC,iBAAiB,EAAE,UAAU,EAC7B,OAAO,EAAE,MAAM,GACd,UAAU,CAcZ;AAED,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,UAAU,EAChB,iBAAiB,EAAE,UAAU,EAC7B,OAAO,EAAE,MAAM,GACd,UAAU,CASZ;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,WAAW,GAAG,UAAU,CAE5D;AAED,wBAAgB,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,GAAG,UAAU,CAK3F;AAED,8CAA8C;AAC9C,wBAAgB,eAAe,CAAC,SAAS,GAAE,CAAC,GAAG,CAAK,GAAG;IACrD,SAAS,EAAE,UAAU,CAAC;IACtB,SAAS,EAAE,UAAU,CAAC;CACvB,CAIA;AAED,OAAO,EAAE,UAAU,EAAE,CAAC;AAItB,0EAA0E;AAC1E,wBAAgB,WAAW,CAAC,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,UAAU,EAAE,aAAa,SAAI,GAAG,IAAI,CAuDjG;AAED,gEAAgE;AAChE,wBAAgB,aAAa,CAAC,KAAK,EAAE,UAAU,GAAG,UAAU,EAAE,CAE7D"}