You're Invited:Meet the Socket Team at RSAC and BSidesSF 2026, March 23–26.RSVP
Socket
Book a DemoSign in
Socket

@smithery/biscuit

Package Overview
Dependencies
Maintainers
1
Versions
2
Alerts
File Explorer

Advanced tools

Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

@smithery/biscuit - npm Package Compare versions

Comparing version
1.0.0
to
1.0.1
+2
dist/start.d.ts
export declare function runWasmStart(start: () => void): void;
//# sourceMappingURL=start.d.ts.map
{"version":3,"file":"start.d.ts","sourceRoot":"","sources":["../src/start.ts"],"names":[],"mappings":"AAEA,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,IAAI,QAgB7C"}
const BISCUIT_WASM_INIT_LOG = "biscuit-wasm loading";
export function runWasmStart(start) {
const originalLog = console.log;
console.log = (...args) => {
if (args.length === 1 && args[0] === BISCUIT_WASM_INIT_LOG) {
return;
}
originalLog.apply(console, args);
};
try {
start();
}
finally {
console.log = originalLog;
}
}
+1
-1

@@ -1,1 +0,1 @@

{"version":3,"file":"shim-node.d.ts","sourceRoot":"","sources":["../src/shim-node.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAuDH,OAAO,EACN,iBAAiB,EACjB,OAAO,EACP,cAAc,EACd,YAAY,EACZ,KAAK,EACL,IAAI,EACJ,OAAO,EACP,MAAM,EACN,UAAU,EACV,SAAS,EACT,IAAI,EACJ,kBAAkB,GAClB,MAAM,iDAAiD,CAAA;AA8DxD,wBAAgB,OAAO,CAAC,OAAO,EAAE,oBAAoB,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,OAG1E;AAED,wBAAgB,KAAK,CAAC,OAAO,EAAE,oBAAoB,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,OAGxE;AAED,wBAAgB,UAAU,CACzB,OAAO,EAAE,oBAAoB,EAC7B,GAAG,MAAM,EAAE,OAAO,EAAE,OAIpB"}
{"version":3,"file":"shim-node.d.ts","sourceRoot":"","sources":["../src/shim-node.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAwDH,OAAO,EACN,iBAAiB,EACjB,OAAO,EACP,cAAc,EACd,YAAY,EACZ,KAAK,EACL,IAAI,EACJ,OAAO,EACP,MAAM,EACN,UAAU,EACV,SAAS,EACT,IAAI,EACJ,kBAAkB,GAClB,MAAM,iDAAiD,CAAA;AA8DxD,wBAAgB,OAAO,CAAC,OAAO,EAAE,oBAAoB,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,OAG1E;AAED,wBAAgB,KAAK,CAAC,OAAO,EAAE,oBAAoB,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,OAGxE;AAED,wBAAgB,UAAU,CACzB,OAAO,EAAE,oBAAoB,EAC7B,GAAG,MAAM,EAAE,OAAO,EAAE,OAIpB"}

@@ -13,2 +13,3 @@ /**

import { createRequire } from "node:module";
import { runWasmStart } from "./start.js";
// Node.js: read the WASM binary from the npm package on disk

@@ -51,3 +52,3 @@ const _require = createRequire(import.meta.url);

const start = instance.exports.__wbindgen_start;
start();
runWasmStart(start);
// Re-export everything from the JS glue (Biscuit, KeyPair, PublicKey, etc.)

@@ -54,0 +55,0 @@ export { AuthorizerBuilder, Biscuit, BiscuitBuilder, BlockBuilder, Check, Fact, KeyPair, Policy, PrivateKey, PublicKey, Rule, SignatureAlgorithm, } from "@biscuit-auth/biscuit-wasm/module/biscuit_bg.js";

@@ -16,2 +16,3 @@ /**

import wasmModule from "@biscuit-auth/biscuit-wasm/module/biscuit_bg.wasm";
import { runWasmStart } from "./start.js";
// Collect all __wbg_* and __wbindgen_* functions as WASM imports.

@@ -49,3 +50,3 @@ // wasm-bindgen uses "./biscuit_bg.js" as the import module name.

const start = instance.exports.__wbindgen_start;
start();
runWasmStart(start);
// Re-export everything from the JS glue (Biscuit, KeyPair, PublicKey, etc.)

@@ -52,0 +53,0 @@ export { AuthorizerBuilder, Biscuit, BiscuitBuilder, BlockBuilder, Check, Fact, KeyPair, Policy, PrivateKey, PublicKey, Rule, SignatureAlgorithm, } from "@biscuit-auth/biscuit-wasm/module/biscuit_bg.js";

{
"name": "@smithery/biscuit",
"version": "1.0.0",
"type": "module",
"description": "Cloudflare Workers adapter for @biscuit-auth/biscuit-wasm",
"license": "MIT",
"repository": {
"type": "git",
"url": "https://github.com/smithery-ai/workers-biscuit.git"
},
"scripts": {
"dev": "tsc --watch",
"build": "tsc",
"check-types": "tsc --noEmit",
"test": "vitest run",
"check": "biome check",
"fmt": "biome check --write --unsafe",
"prepublishOnly": "pnpm build"
},
"exports": {
".": {
"types": "./dist/index.d.ts",
"workerd": "./dist/index.js",
"default": "./dist/index-node.js"
},
"./shim": {
"types": "./dist/shim.d.ts",
"workerd": "./dist/shim.js",
"default": "./dist/shim-node.js"
}
},
"files": [
"dist"
],
"dependencies": {
"@biscuit-auth/biscuit-wasm": "0.6.0"
},
"devDependencies": {
"@biomejs/biome": "2.3.3",
"@types/node": "^20.11.19",
"typescript": "latest",
"vite-plugin-wasm": "^3.5.0",
"vitest": "^3.2.4"
},
"pnpm": {
"patchedDependencies": {
"@biscuit-auth/biscuit-wasm@0.6.0": "patches/@biscuit-auth__biscuit-wasm@0.6.0.patch"
}
}
}
"name": "@smithery/biscuit",
"version": "1.0.1",
"type": "module",
"description": "Cloudflare Workers adapter for @biscuit-auth/biscuit-wasm",
"license": "MIT",
"repository": {
"type": "git",
"url": "https://github.com/smithery-ai/workers-biscuit.git"
},
"exports": {
".": {
"types": "./dist/index.d.ts",
"workerd": "./dist/index.js",
"default": "./dist/index-node.js"
},
"./shim": {
"types": "./dist/shim.d.ts",
"workerd": "./dist/shim.js",
"default": "./dist/shim-node.js"
}
},
"files": [
"dist"
],
"dependencies": {
"@biscuit-auth/biscuit-wasm": "0.6.0"
},
"devDependencies": {
"@biomejs/biome": "2.3.3",
"@types/node": "^20.11.19",
"typescript": "latest",
"vite-plugin-wasm": "^3.5.0",
"vitest": "^3.2.4"
},
"scripts": {
"dev": "tsc --watch",
"build": "tsc",
"check-types": "tsc --noEmit",
"test": "vitest run",
"check": "biome check",
"fmt": "biome check --write --unsafe"
}
}
+32
-14
# @smithery/biscuit
Cloudflare Workers adapter for [`@biscuit-auth/biscuit-wasm`](https://github.com/biscuit-auth/biscuit-wasm).
[![npm version](https://img.shields.io/npm/v/@smithery/biscuit.svg)](https://www.npmjs.com/package/@smithery/biscuit)
The upstream package targets bundlers (`wasm-pack --target bundler`), which expect the bundler to handle WASM instantiation. Cloudflare Workers import `.wasm` files as pre-compiled `WebAssembly.Module` objects, so this package manually instantiates the module and wires it to the JS glue code.
[Biscuit](https://www.biscuitsec.org/) authorization tokens for Cloudflare Workers and Node.js.
This package wraps [`@biscuit-auth/biscuit-wasm`](https://github.com/biscuit-auth/biscuit-wasm) with runtime-specific WASM shims so you can use Biscuit tokens in Cloudflare Workers (which require synchronous `WebAssembly.Module` instantiation) and Node.js without any extra configuration.
## Install
```bash
pnpm add @smithery/biscuit
```
## Usage

@@ -11,5 +19,2 @@

import {
Biscuit,
KeyPair,
AuthorizerBuilder,
biscuit,

@@ -24,7 +29,9 @@ block,

// Mint a token using the tagged template helper
const builder = biscuit`user("alice"); check if time($t), $t <= ${new Date(Date.now() + 3600_000)};`
const token = builder.build(privateKey)
// Mint a token with Datalog using tagged template helpers
const token = biscuit`
user("alice");
check if time($t), $t <= ${new Date(Date.now() + 3600_000)};
`.build(privateKey)
// Attenuate with a restriction block
// Attenuate — restrictions can only narrow, never widen
const restricted = token.appendBlock(

@@ -35,7 +42,12 @@ block`check if operation($op), ["read"].contains($op);`

// Verify
const auth = authorizer`time(${new Date()}); operation("read"); allow if true;`
const verifier = auth.buildAuthenticated(restricted)
verifier.authorize() // throws if checks fail
const auth = authorizer`
time(${new Date()});
operation("read");
allow if true;
`
auth.buildAuthenticated(restricted).authorize() // throws if checks fail
```
The tagged template helpers (`biscuit`, `block`, `authorizer`) automatically convert JS values into Datalog terms — `Date` becomes a timestamp, `Uint8Array` becomes hex bytes, `Set` and `Map` are supported, and any object with a `toDatalogParameter()` method works as a custom term.
## Exports

@@ -48,4 +60,8 @@

The package uses conditional exports: the `workerd` condition resolves to the Cloudflare Workers shim, and `default` resolves to the Node.js shim.
## How it works
The upstream package targets bundlers (`wasm-pack --target bundler`), which expect the bundler to handle WASM instantiation. Cloudflare Workers import `.wasm` files as pre-compiled `WebAssembly.Module` objects instead, so this package manually instantiates the module and wires it to the JS glue code.
The shim (`src/shim.ts`) does three things:

@@ -57,4 +73,2 @@

This is ~60 lines of code. Everything else is re-exported from `@biscuit-auth/biscuit-wasm`.
## Upstream patch

@@ -65,1 +79,5 @@

A pnpm patch at `patches/@biscuit-auth__biscuit-wasm@0.6.0.patch` adds the missing subpath exports. If you upgrade `@biscuit-auth/biscuit-wasm`, regenerate the patch with `pnpm patch` and verify the shim still bundles under `wrangler dev`.
## License
MIT