@statewalker/webrun-biscuit 0.1.0

package/dist/datalog.d.ts

@@ -0,0 +1,203 @@
+/**
+ * Biscuit Datalog: term model, fact/rule evaluation with origin tracking, and
+ * the stack-based expression virtual machine.
+ */
+export declare const AUTHORIZER = 4294967295;
+export type MapKey = {
+    t: "int";
+    v: bigint;
+} | {
+    t: "str";
+    v: string;
+};
+export type Term = {
+    t: "var";
+    v: number;
+} | {
+    t: "int";
+    v: bigint;
+} | {
+    t: "str";
+    v: string;
+} | {
+    t: "date";
+    v: bigint;
+} | {
+    t: "bytes";
+    v: Uint8Array;
+} | {
+    t: "bool";
+    v: boolean;
+} | {
+    t: "set";
+    v: Term[];
+} | {
+    t: "null";
+} | {
+    t: "array";
+    v: Term[];
+} | {
+    t: "map";
+    v: [MapKey, Term][];
+};
+/** Canonical string key: JS Map/Set are reference-keyed, so every structural
+ *  comparison and every de-duplication in the engine goes through this. */
+export declare function termKey(t: Term): string;
+export declare const mapKeyKey: (k: MapKey) => string;
+export declare const termEq: (a: Term, b: Term) => boolean;
+/** de-duplicated, deterministically ordered set contents */
+export declare function normalizeSet(items: Term[]): Term[];
+export interface Predicate {
+    name: string;
+    terms: Term[];
+}
+export interface Fact {
+    predicate: Predicate;
+}
+export type Op = {
+    kind: "value";
+    value: Term;
+} | {
+    kind: "unary";
+    op: number;
+    ffi?: string;
+} | {
+    kind: "binary";
+    op: number;
+    ffi?: string;
+} | {
+    kind: "closure";
+    params: number[];
+    ops: Op[];
+};
+export type Scope = {
+    kind: "authority";
+} | {
+    kind: "previous";
+} | {
+    kind: "publicKey";
+    key: string;
+};
+export interface Rule {
+    head: Predicate;
+    body: Predicate[];
+    expressions: Op[][];
+    scopes: Scope[];
+}
+export type CheckKind = "one" | "all" | "reject";
+export interface Check {
+    queries: Rule[];
+    kind: CheckKind;
+}
+export declare const factKey: (f: Fact) => string;
+export declare class Origin {
+    readonly ids: number[];
+    constructor(ids?: number[]);
+    static of(...ids: number[]): Origin;
+    union(other: Origin): Origin;
+    with(id: number): Origin;
+    get key(): string;
+}
+export declare class TrustedOrigins {
+    private readonly set;
+    constructor(ids: Iterable<number>);
+    static default(): TrustedOrigins;
+    /** the trusted set is a superset of the fact's origin */
+    contains(origin: Origin): boolean;
+    get key(): string;
+    /** the trusted block ids, for deriving a new set from this one */
+    ids(): Iterable<number>;
+}
+export declare function trustedOriginsFromScopes(ruleScopes: Scope[], defaults: TrustedOrigins, currentBlock: number, publicKeyToBlockIds: Map<string, number[]>): TrustedOrigins;
+export type ExecutionErrorKind = "Overflow" | "DivideByZero" | "InvalidType" | "UnknownVariable" | "ShadowedVariable" | "InvalidStack" | "UndefinedExtern" | "TooManyFacts" | "TooManyIterations" | "Timeout";
+export declare class ExecutionError extends Error {
+    readonly kind: ExecutionErrorKind;
+    constructor(kind: ExecutionErrorKind, message?: string);
+}
+export declare const BinaryOp: {
+    LessThan: number;
+    GreaterThan: number;
+    LessOrEqual: number;
+    GreaterOrEqual: number;
+    Equal: number;
+    Contains: number;
+    Prefix: number;
+    Suffix: number;
+    Regex: number;
+    Add: number;
+    Sub: number;
+    Mul: number;
+    Div: number;
+    And: number;
+    Or: number;
+    Intersection: number;
+    Union: number;
+    BitwiseAnd: number;
+    BitwiseOr: number;
+    BitwiseXor: number;
+    NotEqual: number;
+    HeterogeneousEqual: number;
+    HeterogeneousNotEqual: number;
+    LazyAnd: number;
+    LazyOr: number;
+    All: number;
+    Any: number;
+    Get: number;
+    Ffi: number;
+    TryOr: number;
+};
+export declare const UnaryOp: {
+    Negate: number;
+    Parens: number;
+    Length: number;
+    TypeOf: number;
+    Ffi: number;
+};
+export type ExternFn = (left: Term, right?: Term) => Term;
+type Bindings = Map<number, Term>;
+export declare function evaluateExpression(ops: Op[], values: Bindings, externs?: Map<string, ExternFn>): Term;
+export interface RunLimits {
+    maxFacts: number;
+    maxIterations: number;
+    maxTimeMs: number;
+}
+/**
+ * Note the divergence: the reference defaults `max_time` to **1 millisecond**,
+ * which is unreachably tight for a cold JS engine and would make ordinary
+ * tokens fail non-deterministically. 1 second is generous by comparison, so a
+ * caller exposed to untrusted tokens should lower it deliberately rather than
+ * rely on this default as a denial-of-service bound.
+ */
+export declare const DEFAULT_LIMITS: RunLimits;
+type OriginFact = [Origin, Fact];
+/** facts grouped by `name/arity`, so a join never scans unrelated predicates */
+type FactIndex = Map<string, OriginFact[]>;
+export declare class World {
+    /** facts indexed by origin key */
+    readonly facts: Map<string, {
+        origin: Origin;
+        items: Map<string, Fact>;
+    }>;
+    readonly rules: {
+        origin: number;
+        trusted: TrustedOrigins;
+        rule: Rule;
+    }[];
+    externs: Map<string, ExternFn>;
+    iterations: number;
+    private generation;
+    private indexCache;
+    addFact(origin: Origin, fact: Fact): void;
+    addRule(origin: number, trusted: TrustedOrigins, rule: Rule): void;
+    factCount(): number;
+    private visible;
+    /** naive fixpoint: apply every rule until no new fact appears */
+    run(limits?: RunLimits): void;
+    apply(rule: Rule, facts: FactIndex, ruleOrigin: number): Generator<[Origin, Fact]>;
+    /** `check if` / policies: does at least one combination match? */
+    queryMatch(rule: Rule, origin: number, trusted: TrustedOrigins): boolean;
+    /** `check all`: every matching combination must satisfy the expressions */
+    queryMatchAll(rule: Rule, trusted: TrustedOrigins): boolean;
+}
+export {};
+//# sourceMappingURL=datalog.d.ts.map

package/dist/datalog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"datalog.d.ts","sourceRoot":"","sources":["../src/datalog.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,eAAO,MAAM,UAAU,aAAa,CAAC;AAIrC,MAAM,MAAM,MAAM,GAAG;IAAE,CAAC,EAAE,KAAK,CAAC;IAAC,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,CAAC,EAAE,KAAK,CAAC;IAAC,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvE,MAAM,MAAM,IAAI,GACZ;IAAE,CAAC,EAAE,KAAK,CAAC;IAAC,CAAC,EAAE,MAAM,CAAA;CAAE,GACvB;IAAE,CAAC,EAAE,KAAK,CAAC;IAAC,CAAC,EAAE,MAAM,CAAA;CAAE,GACvB;IAAE,CAAC,EAAE,KAAK,CAAC;IAAC,CAAC,EAAE,MAAM,CAAA;CAAE,GACvB;IAAE,CAAC,EAAE,MAAM,CAAC;IAAC,CAAC,EAAE,MAAM,CAAA;CAAE,GACxB;IAAE,CAAC,EAAE,OAAO,CAAC;IAAC,CAAC,EAAE,UAAU,CAAA;CAAE,GAC7B;IAAE,CAAC,EAAE,MAAM,CAAC;IAAC,CAAC,EAAE,OAAO,CAAA;CAAE,GACzB;IAAE,CAAC,EAAE,KAAK,CAAC;IAAC,CAAC,EAAE,IAAI,EAAE,CAAA;CAAE,GACvB;IAAE,CAAC,EAAE,MAAM,CAAA;CAAE,GACb;IAAE,CAAC,EAAE,OAAO,CAAC;IAAC,CAAC,EAAE,IAAI,EAAE,CAAA;CAAE,GACzB;IAAE,CAAC,EAAE,KAAK,CAAC;IAAC,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAA;CAAE,CAAC;AAKtC;2EAC2E;AAC3E,wBAAgB,OAAO,CAAC,CAAC,EAAE,IAAI,GAAG,MAAM,CA0BvC;AAED,eAAO,MAAM,SAAS,MAAO,MAAM,KAAG,MACe,CAAC;AACtD,eAAO,MAAM,MAAM,MAAO,IAAI,KAAK,IAAI,KAAG,OAAoC,CAAC;AAE/E,4DAA4D;AAC5D,wBAAgB,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,CAMlD;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,IAAI,EAAE,CAAC;CACf;AACD,MAAM,WAAW,IAAI;IACnB,SAAS,EAAE,SAAS,CAAC;CACtB;AACD,MAAM,MAAM,EAAE,GACV;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,IAAI,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAC5C;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAAC,GAAG,EAAE,EAAE,EAAE,CAAA;CAAE,CAAC;AAErD,MAAM,MAAM,KAAK,GACb;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GACrB;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,GACpB;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvC,MAAM,WAAW,IAAI;IACnB,IAAI,EAAE,SAAS,CAAC;IAChB,IAAI,EAAE,SAAS,EAAE,CAAC;IAClB,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC;IACpB,MAAM,EAAE,KAAK,EAAE,CAAC;CACjB;AACD,MAAM,MAAM,SAAS,GAAG,KAAK,GAAG,KAAK,GAAG,QAAQ,CAAC;AACjD,MAAM,WAAW,KAAK;IACpB,OAAO,EAAE,IAAI,EAAE,CAAC;IAChB,IAAI,EAAE,SAAS,CAAC;CACjB;AAED,eAAO,MAAM,OAAO,MAAO,IAAI,KAAG,MAC8D,CAAC;AAIjG,qBAAa,MAAM;IACL,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE;IAAlC,YAAqB,GAAG,GAAE,MAAM,EAAO,EAAI;IAC3C,MAAM,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,CAElC;IACD,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE3B;IACD,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAEvB;IACD,IAAI,GAAG,IAAI,MAAM,CAEhB;CACF;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAc;IAClC,YAAY,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,EAEhC;IACD,MAAM,CAAC,OAAO,IAAI,cAAc,CAE/B;IACD,yDAAyD;IACzD,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAGhC;IACD,IAAI,GAAG,IAAI,MAAM,CAEhB;IACD,kEAAkE;IAClE,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAEtB;CACF;AAED,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,KAAK,EAAE,EACnB,QAAQ,EAAE,cAAc,EACxB,YAAY,EAAE,MAAM,EACpB,mBAAmB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GACzC,cAAc,CAehB;AAID,MAAM,MAAM,kBAAkB,GAC1B,UAAU,GACV,cAAc,GACd,aAAa,GACb,iBAAiB,GACjB,kBAAkB,GAClB,cAAc,GACd,iBAAiB,GACjB,cAAc,GACd,mBAAmB,GACnB,SAAS,CAAC;AAEd,qBAAa,cAAe,SAAQ,KAAK;IAErC,QAAQ,CAAC,IAAI,EAAE,kBAAkB;IADnC,YACW,IAAI,EAAE,kBAAkB,EACjC,OAAO,CAAC,EAAE,MAAM,EAGjB;CACF;AAqCD,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAAI,CAAC;AAC1B,eAAO,MAAM,OAAO;;;;;;CAAI,CAAC;AAWzB,MAAM,MAAM,QAAQ,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,IAAI,KAAK,IAAI,CAAC;AAE1D,KAAK,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AAkMlC,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,EAAE,EAAE,EACT,MAAM,EAAE,QAAQ,EAChB,OAAO,GAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAa,GACzC,IAAI,CA6CN;AAmDD,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;CACnB;AACD;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,EAAE,SAAmE,CAAC;AAoBjG,KAAK,UAAU,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AACjC,gFAAgF;AAChF,KAAK,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;AAmC3C,qBAAa,KAAK;IAChB,kCAAkC;IAClC,QAAQ,CAAC,KAAK;gBAA6B,MAAM;eAAS,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC;OAAM;IACjF,QAAQ,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,cAAc,CAAC;QAAC,IAAI,EAAE,IAAI,CAAA;KAAE,EAAE,CAAM;IAC/E,OAAO,wBAA+B;IACtC,UAAU,SAAK;IACf,OAAO,CAAC,UAAU,CAAK;IACvB,OAAO,CAAC,UAAU,CAA+D;IAEjF,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAWxC;IAED,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAEjE;IAED,SAAS,IAAI,MAAM,CAIlB;IAED,OAAO,CAAC,OAAO;IAkBf,iEAAiE;IACjE,GAAG,CAAC,MAAM,GAAE,SAA0B,GAAG,IAAI,CAmB5C;IAEA,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CA4BlF;IAED,kEAAkE;IAClE,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAGvE;IAED,2EAA2E;IAC3E,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAY1D;CACF"}

package/dist/index.d.ts

@@ -0,0 +1,45 @@
+/**
+ * biscuit-ts — pure TypeScript Biscuit tokens.
+ *
+ *   const root = generateKeypair();
+ *   const token = Biscuit.build(root.secretKey, 'user("alice");');
+ *   const text  = token.toBase64();
+ *   const ok    = Biscuit.fromBase64(text).verify(root.publicKey).authorize('allow if user("alice");');
+ */
+import { type AuthorizationResult, type AuthorizeOptions, type LoadedToken } from "./authorizer.js";
+import { type BuildOptions, generateKeypair, type ThirdPartyResponse, thirdPartyBlock } from "./builder.js";
+export * from "./authorizer.js";
+export * from "./base64.js";
+export * from "./builder.js";
+export { SignatureError } from "./crypto.js";
+export { ExecutionError, type ExternFn, type Term } from "./datalog.js";
+export { ParseError } from "./parser.js";
+export { ProtoError } from "./proto.js";
+export * from "./version.js";
+/** An unverified token: it can be attenuated and re-serialized. */
+export declare class Biscuit {
+    readonly bytes: Uint8Array;
+    private constructor();
+    static build(rootSecret: Uint8Array, code: string, options?: BuildOptions): Biscuit;
+    static fromBytes(bytes: Uint8Array): Biscuit;
+    static fromBase64(text: string): Biscuit;
+    attenuate(code: string, options?: BuildOptions): Biscuit;
+    appendThirdParty(response: ThirdPartyResponse, options?: BuildOptions): Biscuit;
+    thirdPartyRequest(): import("./builder.js").ThirdPartyRequest;
+    seal(): Biscuit;
+    toBase64(): string;
+    /** Verify the signature chain. Throws if the token is not authentic. */
+    verify(rootPublicKey: Uint8Array, rootAlgorithm?: 0 | 1): VerifiedBiscuit;
+}
+/** A token whose signature chain has been checked against a root key. */
+export declare class VerifiedBiscuit {
+    readonly token: LoadedToken;
+    readonly bytes: Uint8Array;
+    constructor(token: LoadedToken, bytes: Uint8Array);
+    get revocationIds(): string[];
+    /** the issuer's key identifier, when the token carries one */
+    get rootKeyId(): number | undefined;
+    authorize(authorizerCode: string, options?: AuthorizeOptions): AuthorizationResult;
+}
+export { generateKeypair, thirdPartyBlock };
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EAErB,KAAK,WAAW,EAEjB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAGL,KAAK,YAAY,EAEjB,eAAe,EAEf,KAAK,kBAAkB,EACvB,eAAe,EAEhB,MAAM,cAAc,CAAC;AAEtB,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,EAAE,KAAK,IAAI,EAAE,MAAM,cAAc,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,cAAc,cAAc,CAAC;AAE7B,mEAAmE;AACnE,qBAAa,OAAO;IACE,QAAQ,CAAC,KAAK,EAAE,UAAU;IAA9C,OAAO,eAA2C;IAElD,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAElF;IACD,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAE3C;IACD,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEvC;IAED,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAEvD;IACD,gBAAgB,CAAC,QAAQ,EAAE,kBAAkB,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAE9E;IACD,iBAAiB,6CAEhB;IACD,IAAI,IAAI,OAAO,CAEd;IACD,QAAQ,IAAI,MAAM,CAEjB;IAED,wEAAwE;IACxE,MAAM,CAAC,aAAa,EAAE,UAAU,EAAE,aAAa,GAAE,CAAC,GAAG,CAAK,GAAG,eAAe,CAE3E;CACF;AAED,yEAAyE;AACzE,qBAAa,eAAe;IAExB,QAAQ,CAAC,KAAK,EAAE,WAAW;IAC3B,QAAQ,CAAC,KAAK,EAAE,UAAU;IAF5B,YACW,KAAK,EAAE,WAAW,EAClB,KAAK,EAAE,UAAU,EACxB;IACJ,IAAI,aAAa,IAAI,MAAM,EAAE,CAE5B;IACD,8DAA8D;IAC9D,IAAI,SAAS,IAAI,MAAM,GAAG,SAAS,CAElC;IACD,SAAS,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,mBAAmB,CAEjF;CACF;AAED,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,CAAC"}