Skip to content

access: replace biscuit-wasm with @statewalker/webrun-biscuit 0.2.0 - #2

Merged
mkotelnikov merged 7 commits into
mainfrom
biscuit-ts
Sep 15, 2026
Merged

access: replace biscuit-wasm with @statewalker/webrun-biscuit 0.2.0#2
mkotelnikov merged 7 commits into
mainfrom
biscuit-ts

Conversation

@mkotelnikov

@mkotelnikov mkotelnikov commented Sep 15, 2026

Copy link
Copy Markdown
Contributor

Replaces @biscuit-auth/biscuit-wasm with the pure-TypeScript @statewalker/webrun-biscuit@0.2.0 (published to npm, statewalker/webrun-wire#6).

What changes

  • httpeers-access talks to the engine through one small seam, src/biscuit.ts.
    • Values reach Datalog only as {name} parameters (Datalog.add), never as text.
    • Claims are read back with evaluate(...).query.
    • verifyToken uses verifyAsync (WebCrypto Ed25519).
    • The warm-up and the spurious-Timeout retry are gone.
    • warmUpTokens and initBiscuit stay exported as deprecated no-ops, because both are public API.
  • Demo pages no longer need: the wasm loader, ensureBiscuit(), both Vite aliases, the optimizer exclusion, the copied .wasm asset, or the tsconfig path.
  • Browser tests: the seam test becomes an alias-free test that also asserts no .wasm is fetched.
  • biscuit-wasm stays a devDependency of httpeers-access. The existing tests mint attack tokens with it, which makes them cross-implementation checks.

Measured, same assembly, before → after

biscuit-wasm webrun-biscuit 0.2.0
demo page, gzip (hub) ~1,034 KB (197 KB JS + 837 KB wasm) ~205 KB
verifyToken 0.53 ms 0.49 ms
authorize (allow) 0.22 ms 0.12 ms
mintToken (hub only) 0.29 ms 1.1 ms
cold start, Node 71–86 ms ~83 ms

Tests

The 169 original access tests pass unchanged; only the dependency allowlist in boundary.test.ts was edited.

suite before after
httpeers-access 169 185 (+2 boundary, +14 seam/injection)
hub 43 (4 skipped) 43 (4 skipped)
member 101 101
libp2p 56 (4 skipped) 56 (4 skipped)
conformance (real mesh) 44 44
browser, Chromium 10 11
demos 13 13

Not in this PR

pnpm-lock.yaml is not regenerated. main already fails a standalone pnpm install --frozen-lockfile (ERR_PNPM_LOCKFILE_CONFIG_MISMATCH, overrides vs lockfile), and regenerating it would mix unrelated churn into this change.

Nothing is deployed: the demo pages under s3.httpeers.net are unchanged until someone builds and deploys.

🤖 Generated with Claude Code

mkotelnikov and others added 3 commits September 15, 2026 14:47
@mkotelnikov @claude
spike(access): evaluate Biscuit with webrun-biscuit instead of biscui…
158e519 
…t-wasm

httpeers-access speaks to the engine through one seam, src/biscuit.ts, which
supplies what the wasm binding had and webrun-biscuit 0.1.0 lacks: literal
binding for parameters, queries over the world snapshot, token-less
authorization and failed-check text. The warm-up, the spurious-Timeout retry
and the wasm loader go away; initBiscuit stays as a deprecated no-op.

The demo pages lose the loader, both aliases, the optimizer exclusion and the
copied .wasm; the browser suite's seam test becomes an alias-free one.

All 169 existing access tests pass unchanged apart from the dependency
allowlist; biscuit-wasm stays a devDependency because those tests mint attack
tokens with it, which makes them cross-implementation checks.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@mkotelnikov @claude
refactor(access): use webrun-biscuit's parameters, queries and async …
65dfce0 
…verification

The engine seam loses its workarounds now that the engine has the API:
values are bound as `{name}` parameters through `Datalog.add` instead of
being quoted into source, claims are read with `evaluate(...).query`,
token-less decisions pass `null`, failed checks come with their rule text,
and `verifyToken` uses `verifyAsync` (WebCrypto Ed25519).

verifyToken 0.49 ms and authorize 0.12 ms per call in Node, against 0.53 ms
and 0.22 ms on biscuit-wasm; cold start is level.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@mkotelnikov @claude
chore(access): require webrun-biscuit ^0.2.0
97c2b62 
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@mkotelnikov mkotelnikov mentioned this pull request Sep 15, 2026
Merged
3 tasks done
@mkotelnikov @claude
fix(deps): depend on published webrun-wire packages, not workspace:*
f562bb5 
Five references (webrun-http-browser, -http-proxy, -http-streams, -rpc,
-streams) named packages that live in webrun-wire with `workspace:*`. That
resolves only inside an assembly; a standalone checkout — CI — cannot install
at all. Each now has its published range, which is exactly the version checked
out in webrun-wire, so an assembly still links it locally.

Also restores the literal em dash in two descriptions that an earlier commit
on this branch had rewritten as `—`.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@mkotelnikov mkotelnikov mentioned this pull request Sep 15, 2026
Merged
mkotelnikov and others added 2 commits September 15, 2026 16:48
@mkotelnikov @claude
fix(install): make a standalone checkout installable, as CI runs it
fdaf536 
`pnpm install --frozen-lockfile` has failed on every CI run since at least
2026-09-13, so nothing after it had run either:

- The lockfile still recorded `overrides` linking three webrun-wire packages to
  a sibling `../webrun-wire` checkout, which package.json no longer declares:
  ERR_PNPM_LOCKFILE_CONFIG_MISMATCH. Regenerated in a standalone checkout; it
  now has no overrides, no link outside the repo, and every webrun package
  resolved from the registry.
- `@statewalker/webrun-files-mem` was used through `catalog:` with no entry;
  an assembly's generated catalog had been supplying it. Added at ^0.9.0.
- package.json's `pnpm.onlyBuiltDependencies` listed only esbuild, and it won
  over pnpm-workspace.yaml's list, so node-datachannel's install script was
  skipped and no `.node` binary existed — exactly the silent failure that
  yaml's own comment warns about. The package.json copy is removed; the
  documented yaml is now the only allowlist, and the binary builds.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@mkotelnikov @claude
fix(ci): build before typecheck; clear the two lint errors
6915a12 
With install working, the next CI steps failed for reasons older than this
branch:

- typecheck ran before any build. Packages resolve each other through
  `exports` pointing at dist/, so httpeers-ghost could not see
  httpeers-core's types. CI now runs `pnpm run build` first.
- lint:check: a `<button>` without `type` in the demos' reset page, and
  misindented `aliasesIn` in the browser suite's vitest config.

Replayed from a clean checkout with the exact CI sequence (Node 24.8 locally,
CI uses 22): install, lint:check, build, typecheck and test all pass —
sites 83, qr 21, core 57, relay 74, ghost 20, bridge 3, access 185,
hub 43 (+4 skipped), libp2p 56 (+4 skipped), member 101, demos 13,
conformance 44.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@mkotelnikov mkotelnikov mentioned this pull request Sep 15, 2026
Merged
@mkotelnikov @claude
chore(access): require webrun-biscuit ^0.2.1
73f48e5 
0.2.1 enforces the run budget inside an evaluation instead of only between
fixpoint iterations. On 0.2.0, `a token carrying an exploding rule set denies
rather than hanging` took 5,154 ms in CI against its 5 s bound, with a 1 s
budget configured; on 0.2.1 it takes ~1,050 ms (185/185 against the published
package). 0.2.1 also parses the reference's name grammar and ships LICENSE.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@mkotelnikov
mkotelnikov merged commit 56dfcb4 into main Sep 15, 2026
1 check passed
@mkotelnikov
mkotelnikov deleted the biscuit-ts branch September 20, 2026 07:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@mkotelnikov