@abelxiaoxing/cadence 1.3.0 → 1.4.0

package/prompts/abel-implement.md

@@ -6,13 +6,21 @@ tags: [abel, implement, openspec, TDD, recovery]
 argument-hint: "<change_name>"
 ---
 
-Load the bundled `abel-workflow` Skill and read the complete value inside `<abel-request>` without tokenizing it a second time.
+This procedure applies only when the user explicitly invokes `/abel-implement`.
+Reading this file, mentioning the command, or finding OpenSpec artifacts does not activate it.
+Read the complete value inside `<abel-request>` without tokenizing it a second time.
 
 <abel-request>
 $ARGUMENTS
 </abel-request>
 
 <!-- ABEL:PROMPT:abel-implement -->
+
+This stage is scoped to the invoked task.
+Direct answers and same-task continuations stay in this stage.
+If the user ends the workflow or requests an unrelated task, first send `{"action":"finish"}` to `abel_dispatch`, then handle the new task normally with the restored tools.
+Exit preserves resumable work and never means completion or discard.
+Never start another stage automatically.
 <!-- ABEL:START -->
 
 # Implement outcome
@@ -22,14 +30,22 @@ If it is missing, absent, or ambiguous, stop before execution and ask for the un
 
 Implement is a durable, resumable execution stage.
 The private control plane owns task scheduling, Red-Green-Refactor progression, candidate application, verification attribution, repair, task checkbox updates, AGENTS checkpoints, and the final transaction.
-The parent interprets state and makes product decisions; it must not reproduce those mechanics manually.
+The parent interprets state, owns implementation decisions, and follows automatic continuations; it must not reproduce those mechanics manually.
+Design has already established the goal, main choices, and explicit constraints.
+Invoking Implement delegates remaining implementation choices to the parent model's recommended solution.
+Choose the best supported option, record the concise decision and rationale in the same change, and continue without asking the user to select an option or confirm it again.
+Respect explicit Design constraints and non-goals; when a proposed option conflicts, choose a compliant alternative.
+A Worker request is evidence for the parent, not permission for the Worker to widen its own authority.
+Do not end the turn merely because a control call returns a nonterminal state.
+Follow its parent-owned continuation until verified completion or a concrete blocker that cannot be resolved within available capabilities and budgets.
+Keep routine decisions and repairs internal; give brief progress updates during sustained work and include material implementation choices in the final result.
 
 ## Trusted admission
 
-Before the first Worker launch, load the current `ready.yaml` and referenced canonical `implement-plan.json`; verify the Gate A binding, raw and canonical hashes, OpenSpec strict/planning status, Requirement → Scenario → Verification → Task traceability, capability closure, exact path/output contracts, repair policy, tracking contract, and sealed AGENTS operations.
+Before the first Worker launch, load the current `ready.yaml` and referenced canonical `implement-plan.json`; verify both current owner-private Gate proofs and the finalization fact binding the exact delivery revision, receipt hash, and canonical plan hash, plus the Gate A binding, raw and canonical hashes, OpenSpec strict/planning status, Requirement → Scenario → Verification → Task traceability, capability closure, exact path/output contracts, repair policy, tracking contract, and sealed AGENTS operations.
 
 An invalid or incomplete delivery is one aggregated `delivery-invalid` admission result.
-Report every safe diagnostic together.
+Inspect every safe diagnostic together and use the returned parent-owned amendment continuation to repair an executable delivery before resuming.
 Do not launch a Worker, consume a retry, mutate the main workspace, or infer a missing contract.
 
 Gate approval is not tool permission.
@@ -37,7 +53,7 @@ A fresh context validates existing approval facts and does not ask the user to a
 
 ## Closed control surface
 
-Use `abel_dispatch` only with the change commands below; never send `version`; never send `action: "run"`; and never send `admit-graph`, `task-attempt`, caller-owned snapshots, completed/blocked arrays, or apply identities.
+For durable run operations, use `abel_dispatch` only with the change commands below; never send `version`; never send `action: "run"`; and never send `admit-graph`, `task-attempt`, caller-owned snapshots, completed/blocked arrays, or apply identities.
 
 ```json
 {"command":"start","stage":"abel-implement","change":"<change>","operationId":"<unique-operation>"}
@@ -48,16 +64,17 @@ Use `abel_dispatch` only with the change commands below; never send `version`; n
 {"command":"discard","stage":"abel-implement","change":"<change>","operationId":"<unique-operation>"}
 ```
 
-When the user approves a revised delivery boundary, resume the same run with both `deliveryRevision` and `receiptHash`.
+When a revised delivery is ready, resume the same run; the engine discovers and validates its `deliveryRevision` and `receiptHash` locally.
 The engine revalidates retained phase/repair facts, invalidates only incompatible tasks, rebuilds tracking, and preserves compatible work.
 
 `status` is local and must remain useful when every Worker endpoint is unavailable.
+`discard` is an explicit destructive request; leaving the workflow uses `{"action":"finish"}` and preserves the run instead.
 Repeating the same operation id returns its committed outcome.
 Use a new operation id for a new attempt.
 
 For an approval-needed retained run, a later explicit Implement invocation must inspect local `status`.
 When a newer owner-private-proof-bound receipt is present, status exposes its exact pair in `availableDelivery`, adds `resume` to `legalCommands`, and fills the matching `conditionalCommands` arguments.
-Resume with that discovered pair; do not require the user to copy revision or hash data from a prior Design conversation.
+Ordinary resume resolves that pair locally; do not require the user to copy revision or hash data from a prior conversation.
 Discovery never admits the delivery: `resume` still performs the full artifact, traceability, capability, and currentness validation before any Worker starts.
 
 ## Execution and verification
@@ -65,7 +82,7 @@ Discovery never admits the delivery: `resume` still performs the full artifact,
 Before any candidate, the engine records target-contract, task-affected, and full-suite baselines with normalized failure identities.
 A pre-existing failure remains separate and never satisfies Red or becomes evidence that this change caused it.
 
-For each ready task the engine runs:
+For each ready behavior task the engine runs:
 
 1. Red in a disposable child revision; the declared target must fail with the approved identity.
 2. Green with the minimum approved implementation; the declared target and task-affected contract must pass relative to baseline.
@@ -86,32 +103,93 @@ The main workspace stays unchanged before that transaction.
 Ordinary failures stay inside this Implement run:
 
 - `artifact`, wrong-Red identity, invalid/incomplete patch operation, stale candidate, or transport failure: use the bounded automatic attempt policy; after exhaustion pause with the last safe code and retain the last committed revision.
-- Artifact correction alone consumes the sealed `artifactCorrection.maxAttempts` of 2-3 total candidate launches per task phase and operation, including the initial launch; a later `resume` starts a fresh operation budget.
-- `environment` or `verification-adapter`: pause without speculative edits.
-  Resume after the capability is restored; baseline facts and completed phases are reused.
+- Artifact, stale-candidate, and verification correction share the sealed `artifactCorrection.maxAttempts` of 2-3 attempts per verification obligation and phase, including the initial attempt.
+  Automatic retries carry the safe failure code, strategy, and available failure identities to the next Worker.
+  Exhaustion survives process restart and `resume`.
+  Operation ids, route binding, rollback revisions, task renaming, and contract rewording never clear it.
+  Dedicated private incident records own the budget; displayed attempt diagnostics are not authority.
+  A run shares one cumulative work budget: 24 plus three units per largest admitted phase count, bounded by the host limit captured at run start (default 512).
+  Recompiling, renaming or returning to a previous plan size never adds credit; a genuinely larger admitted decomposition may increase capacity without refunding consumption.
+  Execution reserves work durably before launch, including nested repair proposals; restart and post-launch cancellation do not refund consumed work.
+- `environment` or `verification-adapter`: the executor pauses without speculative edits.
+  The parent inspects local diagnostics and restores available prerequisites using existing authorized capabilities, then resumes; baseline facts and completed phases are reused.
+  Do not request user input for a prerequisite the parent can restore.
+  Missing external credentials or unavailable services are reported only after local alternatives have been checked.
 - `pre-existing`: keep as baseline evidence.
   It does not authorize a code change and does not fail completion unless the change worsens it.
 - `introduced` in a task-affected contract: reopen the owning task as `repairable`, perform the minimum bounded repair inside its approved paths, record `repair-verified`, and re-run attribution automatically.
 - `unresolved` full-suite attribution: pause with failure identities and retained cumulative state; resume after evidence resolves ownership.
 - `workspace-revision-stale`, conflict, cancellation, process interruption, or apply recovery: preserve user edits and resume from the last durable checkpoint.
-  Cancellation is budget-neutral.
+  Cancellation before execution is budget-neutral; cancellation after launch does not count as a product failure and does not refund consumed work.
   During a partially visible final apply, recovery must settle before pause or discard.
-- `result-limit`: pause as `needs-task-split`; never accept a partial patch.
+- `result-limit` or a task-splitting request inside existing authority: automatically try a compact complete patch using exact replacements under the same bounded policy.
+  If it still cannot fit, the executor pauses as `needs-task-split` or `task-split-needed` and supplies an amendment continuation.
+  The parent recommends a smaller task decomposition, compiles the revised DAG, and resumes; never accept a partial patch or bypass compilation of the task DAG.
 
 No item above carries stage-routing metadata or asks the user to restart the approved workflow.
 
+Treat ordinary recovery as internal work.
+Workers may request additional ordinary regular-file reads within sealed task roots.
+The parent grants exact paths, retains their content dependencies across phases and restart, and binds them to merge and final currentness; hidden files, private-key files, out-of-root paths, and writes do not receive this discovery permission.
+Do not ask permission to correct approved code/tests, use task-wide approved read context, or retry within the sealed policy.
+Use local status and read-only diagnostics to identify environmental prerequisites before asking the user; resume once a concrete capability has been restored, and reuse baseline facts and completed phases.
+When status reports `recovery.exhausted`, do not issue unchanged `resume` calls.
+Inspect retained evidence.
+If status supplies a parent-owned amendment continuation, use it for a concrete plan correction; otherwise explain the specific missing capability or exhausted budget once.
+Rewriting prose or renaming tasks is not a correction and never replenishes execution budgets.
+A rebind may repair endpoint configuration but does not grant a new incident budget; do not repeatedly rebind and resume the same failure.
+If a revised delivery already exists, local status also discovers its exact revision/hash for an exhausted run; resume with `availableDelivery` without asking the user to copy receipt data.
+When `recovery.additionalAttempt` is present, the parent may make a concrete decision to retry once within remaining work capacity.
+Copy that object into an ordinary resume request's optional `recovery` field; do not invent incident keys or failure sequences.
+The default reason is `parent-directed-retry`; `route-changed` and `context-extended` additionally require control-plane evidence.
+This consumes one launch without resetting automatic correction history; another failure pauses again.
+Do not turn the availability of this option into an unconditional retry loop or another user approval round.
+Environment, resource and report protocol failures are unavailable verification, not product failures; restore prerequisites and reverify retained candidates.
+An unavailable endpoint, missing external credential, or irreducibly oversized task is not proof that product Design must restart.
+
 ## The only approval-needed boundary
 
-Use `approval-needed` only when continuing requires authority not present in the sealed delivery: new observable behavior, architecture or policy; a new/changed dependency; an undeclared write/delete/read target; expanded conflict/resource authority; a changed verification contract; an AGENTS target/impact/managed block change; or another irreversible scope decision.
+Use `approval-needed` only when continuing requires authority not present in the sealed delivery: new observable behavior, architecture or policy; a new/changed dependency; an undeclared write/delete target or a read outside sealed discovery roots; expanded conflict/resource authority; a changed verification contract; an AGENTS target/impact/managed block change; or another irreversible scope decision.
 
 Classify only codes in the closed authority table.
 An unknown Worker, verifier, or internal approval code is an `approval-code-invalid` integrity pause; never guess a category or Gate from keywords.
 
-Report the exact missing authority and retained run state.
-Do not discard compatible work.
-Expose `approval.category`, `approval.requiredGates`, safe `approval.refs`, and `approval.designRequest` as `/abel-design --change <change>` user guidance only; never invoke Design automatically.
-Bare `resume` is not immediately executable progress while approval is missing, so keep it out of `legalCommands` and expose it only in `conditionalCommands` with a `deliveryRevision` greater than the retained revision and the matching `receiptHash` precondition.
-If the user supplies that newly approved receipt revision, resume the same run with the revision/hash pair.
+Report all known missing authority together using `blockers` and `decisionBatch.items`; merge related choices and reuse accepted same-task decisions.
+The parent resolves new implementation choices with its recommended option under the accepted Design; do not ask the user for another decision round.
+`approval-needed` is an internal requirement to compile updated authority before a Worker continues, not a request for user input.
+`decisionBatch.resolution` identifies the parent as decision owner and `continuation` identifies the automatic next action.
+Follow it in this turn.
+`owner` and `automatic` are status metadata, not tool arguments.
+For amendment use the exact `decisionBatch.continuation` envelope plus `request`; for resume send the closed command envelope with a new operationId.
+A changed batch must cite the new evidence; never ask separately for each task's copy of the same decision.
+Retain the Implement stage and original run.
+`decisionBatch.continuation` supplies the exact `action: "amend"`, change, and batchId for the narrow private artifact revision channel.
+After selecting the recommended solution, use that envelope with a `request` containing the existing closed Design artifact operations: start the same change, retain inherited decisions, record the parent-selected changes, write the required change artifacts, compile, and finalize.
+This is implementation delegation from the accepted Design, not a fabricated new user answer.
+The same channel is available for the allowlisted `delivery-invalid`, `needs-task-split`, and `task-split-needed` technical pauses; these do not need a user decision or a fabricated approval-needed classification.
+Each run permits 64 mutating amendment attempts in a dedicated persistent budget.
+Failed writes/compilations consume that budget, successful operation replay is free, and restart or a new batch does not replenish it.
+Read-only status/preflight does not consume it.
+Fix the exact structured diagnostic before retrying compilation.
+Do not repeatedly submit unchanged invalid artifacts; once `amendmentBudget.exhausted` is true, stop mutation and report the retained result truthfully.
+For example, begin the revision with the returned change and batchId:
+
+```json
+{"action":"amend","change":"<same-change>","batchId":"<current-batch-id>","request":{"operation":"start","change":"<same-change>","operationId":"<unique-operation>"}}
+```
+
+Use the returned private revision runId on subsequent amendment requests.
+This channel does not activate Design, admit evidence packets, allow a different change, or grant product/AGENTS file writes.
+Keep the approved goal and explicit constraints stable.
+Automatic amendments retain Gate A and the structured ChangeContract.
+They cannot renew Gate A, replace behavior decisions, or rewrite proposal/spec artifacts.
+Resolve implementation gaps within the accepted goal, constraints and policy; when no conforming solution exists, report that concrete contract blocker and preserve progress rather than repeatedly attempting an invalid amendment.
+Never weaken acceptance criteria just to obtain a passing result.
+The compiler supplies Gate B automatically.
+Finish all known items in the batch before finalizing, then issue ordinary resume.
+Local delivery discovery supplies the newer verified revision/hash; do not ask the user to copy receipts or switch commands.
+An unchanged resume cannot bypass a pending decision, and stale batch ids or unrelated revision runIds are rejected.
+The user may explicitly choose a full Design discussion, but it is not the recovery instruction for an Implement blocker.
 A generated artifact defect, endpoint outage, stale snapshot, environment failure, pre-existing failure, introduced in-boundary repair, approved documentation/test edit, or approved AGENTS checkpoint is never `approval-needed`.
 
 ## AGENTS and tracking
@@ -120,9 +198,14 @@ Design-time AGENTS read-only authority does not carry into Implement.
 Gate B seals `none | update-existing | create-index | remove-index`, exact targets, owning task ids, verification, and the complete managed block.
 The parent control plane applies those operations only in the private cumulative revision, preserves all human text outside `<!-- ABEL:AGENTS-INDEX:START -->` and `<!-- ABEL:AGENTS-INDEX:END -->`, and never gives an AGENTS write path to a Worker.
 
+`remove-index` deletes a file only if no human content remains.
+Runtime/session ids, credentials, approval state, and dirty-state ledgers never enter an index.
+
 Task checkboxes are parent-owned progress facts.
 The loader may normalize only `[x]`/`[X]` to `[ ]` for the sealed task ids when checking the delivery hash; every other byte remains integrity-bound.
 
+When an approved browser E2E check requires `dev-browser` and it is unavailable, pause only that check; continue independent work when safe.
+
 ## Truthful completion
 
 Treat `queued`, `connecting`, `waiting-first-response`, `running`, `validating`, `retrying`, `verifying`, `paused`, `approval-needed`, `applying`, and `recovering` as nonterminal activity states.
@@ -131,9 +214,24 @@ Tool-call settlement is not success.
 Report success only when the durable state is `completed`, final application and post-apply verification committed, and private run content was cleaned.
 Terminal `completed`, `discarded`, or `rejected` settlement deactivates private dispatch; a nonterminal pause or approval wait keeps it active for direct follow-up.
 
-On a nonterminal result, report the safe code, affected task/scope when present, retained progress, and the exact legal command that continues or inspects the same run.
+On a nonterminal result with an automatic parent continuation, execute it and continue working; do not present internal Gate names, batch ids, receipts, or resume commands as user tasks.
+If automatic recovery is unavailable after investigation or its budget is exhausted, report the concrete blocker, retained progress, and only the external input needed to proceed.
+Respect explicit cancellation and never resume it automatically.
 Never hide an incomplete run behind a success checkmark.
 
 Do not archive, publish, release, stage, or commit implicitly.
 
 <!-- ABEL:END -->
+
+## Evidence modes and environment identity
+
+Follow the compiled task `verificationMode`.
+The default `behavior` mode retains Red/Green.
+Explicitly approved `mechanical` and `refactor` modes start execution at Green after baseline capture; do not invent a failing test or request a Red Worker.
+The compiler checks mode authority, path suitability and protected verifier inputs.
+All modes retain cumulative verification, output checks and transactional apply.
+
+`verification-environment-changed` is an unavailable environment, not a product regression.
+Installed dependency and runner content is bound to evidence; resume in a changed environment rebuilds baseline and revalidates retained phases.
+Reuse compatible sealed candidates.
+Do not edit product code to compensate for missing or drifting tools.

package/prompts/abel-init.md

@@ -3,14 +3,16 @@ description: Initialize or safely repair an Abel OpenSpec project
 argument-hint: "[project-path]"
 ---
 
-Load the bundled `abel-workflow` Skill before inspecting or writing the target.
-If it is unavailable, stop before writes and report one executable package restore or reinstall command.
+This procedure applies only when the user explicitly invokes `/abel-init`.
+Reading this file, mentioning the command, or finding OpenSpec artifacts does not activate it.
 Read the complete value inside `<abel-request>` without tokenizing it a second time.
 
 <abel-request>
 $ARGUMENTS
 </abel-request>
 
+<!-- ABEL:PROMPT:abel-init -->
+
 The request is an optional project path; when absent, use the current working directory.
 Resolve and report the canonical target root before action.
 
@@ -34,6 +36,8 @@ Resolve and report the canonical target root before action.
 5. Resolve and validate the selected schema and templates before claiming readiness.
 6. Create or repair only verified `<!-- ABEL:AGENTS-INDEX:START -->` … `<!-- ABEL:AGENTS-INDEX:END -->` managed regions.
    Preserve every byte of human content outside those markers and do not cross nested repositories.
+   Keep the index descriptive: file locations and ordinary project commands only; never instruct ordinary tasks to enter an Abel workflow.
+   Never record runtime/session ids, credentials, approval state, or dirty-state ledgers.
 7. Re-run all probes after writes.
    A second identical Init must produce no additional changes.
 
@@ -43,3 +47,6 @@ Do not probe `git-commit`, external `dev-browser`, or a dedicated time Skill; no
 
 Report one final result with the root, selected toolchain, actions actually taken, OpenSpec capability/schema/template evidence, AGENTS files changed or unchanged, research-Skill paths or remediation, and `ready | partial | paused`.
 Never report success from the initial probe when the post-write recheck did not pass.
+
+Init ends with that report; later ordinary tasks use normal engineering behavior.
+Never start another Abel stage, archive, publish, release, stage, or commit implicitly.

package/src/apply-transaction.ts

@@ -20,10 +20,12 @@ import {
 import { tmpdir } from "node:os";
 import path from "node:path";
 import { DatabaseSync } from "node:sqlite";
-
 import type { ArtifactStore } from "./artifact-store.ts";
+import { compareCanonicalStrings } from "./canonical.ts";
 import { isValidRelativePath } from "./contracts.ts";
 import { observeSafePath } from "./safe-path.ts";
+import { configureSqlite, ensureSqliteSchema } from "./sqlite-schema.ts";
+import { APPLY_SCHEMA } from "./storage-schema.ts";
 import type {
   WorkspaceEntry,
   WorkspaceRevision,
@@ -548,7 +550,11 @@ export async function verifyCumulativeRevision(
   );
   chmodSync(temporary, 0o700);
   try {
-    input.workspaceStore.materialize(revision.revisionId, temporary);
+    await input.workspaceStore.materializeAsync(
+      revision.revisionId,
+      temporary,
+      input.signal,
+    );
     if (input.signal?.aborted) {
       return {
         ok: false,
@@ -629,16 +635,8 @@ export class ApplyTransaction {
       throw new Error("transaction-database-path-invalid");
     }
     this.#database = new DatabaseSync(databasePath);
-    this.#database.exec(
-      "PRAGMA journal_mode = WAL; PRAGMA synchronous = FULL;",
-    );
-    this.#database.exec(`
-      CREATE TABLE IF NOT EXISTS apply_transaction_journal (
-        transaction_id TEXT PRIMARY KEY,
-        journal_json TEXT NOT NULL,
-        journal_hash TEXT NOT NULL
-      ) STRICT;
-    `);
+    configureSqlite(this.#database);
+    ensureSqliteSchema(this.#database, APPLY_SCHEMA);
     chmodSync(databasePath, 0o600);
   }
 
@@ -986,7 +984,7 @@ export class ApplyTransaction {
     const deepestFirst = [...journal.createdDirectories].sort(
       (left, right) =>
         right.split("/").length - left.split("/").length ||
-        right.localeCompare(left),
+        compareCanonicalStrings(right, left),
     );
     for (const relative of deepestFirst) {
       const observation = observeSafePath(journal.consumerRoot, relative);
@@ -1244,7 +1242,11 @@ export class ApplyTransaction {
           path.join(this.root, "post-apply-verification-"),
         );
         try {
-          this.#workspaces.materialize(journal.finalRevisionId, isolatedRoot);
+          await this.#workspaces.materializeAsync(
+            journal.finalRevisionId,
+            isolatedRoot,
+            signal,
+          );
           const execution = Promise.resolve(
             this.#hooks.postApply({
               transactionId,

package/src/artifact-store.ts

@@ -3,6 +3,7 @@ import {
   chmodSync,
   closeSync,
   constants,
+  copyFileSync,
   fsyncSync,
   lstatSync,
   mkdirSync,
@@ -160,6 +161,22 @@ export class ArtifactStore {
     return Buffer.from(bytes);
   }
 
+  /** Clone when supported; always use a distinct inode and verify the copied bytes. */
+  copyVerified(hash: string, destination: string): number {
+    const source = this.#blobPath(hash);
+    const stat = lstatSync(source, { throwIfNoEntry: false });
+    if (!stat?.isFile() || stat.isSymbolicLink())
+      throw new Error("artifact-unavailable");
+    copyFileSync(
+      source,
+      destination,
+      constants.COPYFILE_EXCL | constants.COPYFILE_FICLONE,
+    );
+    const bytes = readFileSync(destination);
+    if (digest(bytes) !== hash) throw new Error("artifact-integrity-invalid");
+    return bytes.byteLength;
+  }
+
   referenceCount(hash: string): number {
     requireHash(hash);
     const referencePath = this.#referencePath(hash);

package/src/candidate-patch.ts

@@ -1,6 +1,7 @@
 import { lstatSync, readFileSync } from "node:fs";
 import path from "node:path";
 import { generateUnifiedPatch } from "@earendil-works/pi-coding-agent";
+import { compareCanonicalStrings } from "./canonical.ts";
 
 import { isValidRelativePath } from "./contracts.ts";
 import { observeSafePath } from "./safe-path.ts";
@@ -242,7 +243,7 @@ export function compileCandidatePatch(input: {
 
   const diff = [...states.values()]
     .filter((state) => state.base !== state.current)
-    .sort((left, right) => left.path.localeCompare(right.path))
+    .sort((left, right) => compareCanonicalStrings(left.path, right.path))
     .map(renderFileDiff)
     .join("");
   if (diff.length === 0) throw new Error("candidate-patch-empty");

package/src/canonical.ts

@@ -0,0 +1,16 @@
+/** Canonical identity ordering is UTF-16 code-unit order, never host collation. */
+export function compareCanonicalStrings(left: string, right: string): number {
+  return left < right ? -1 : left > right ? 1 : 0;
+}
+
+export function canonicalJson(value: unknown): string {
+  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
+  if (value && typeof value === "object") {
+    return `{${Object.entries(value as Record<string, unknown>)
+      .filter(([, entry]) => entry !== undefined)
+      .sort(([left], [right]) => compareCanonicalStrings(left, right))
+      .map(([key, entry]) => `${JSON.stringify(key)}:${canonicalJson(entry)}`)
+      .join(",")}}`;
+  }
+  return JSON.stringify(value) ?? "null";
+}