@jini-ai/core 0.6.15-rc.1 → 0.6.15-rc.2

package/README.md

@@ -100,6 +100,7 @@ Tool handlers receive required execution context first and optional `{ emitSurfa
 | subpath | what's behind it |
 |---|---|
 | `./fetch` | Framework-neutral query contracts and `FetchQueryCache`; inject transport callbacks, `Clock`, scheduler and connectivity/focus ports. No React, DOM or TanStack dependency. |
+| `./records` | `canonicalJson({ value })`, async WebCrypto `canonicalArgumentDigest({ args }, { crypto? })`, and `CanonicalJsonError`; recursively sorted Unicode code-point keys, strict JSON validation, and lowercase SHA-256 hex. |
 | `.` | The public surface above: tokens, packs, daemon composition, tool registry (descriptors only), principal, redact, auth primitives. |
 | `./composition` | **Not part of the public contract.** Exposes `authorizeToolInvocation` (resolves a registry's tool and runs its authorization gate — a security-sensitive value export, but one that only ever hands back a handler alongside an `'allow'` decision) plus type-only `AnyPack`/`RequiredTokenIds`/`MissingTokenIds` re-derivation helpers. Its sole intended consumers are `@jini-ai/daemon`'s `ToolExecutor` and `@jini-ai/server`'s `createLocalNodeDaemon`. Node's resolver will happily let any consumer import it — the boundary is enforced by `scripts/check-engine-boundaries.ts`, not by the exports map — so external adopters should treat it as off-limits regardless. |
 

package/dist/records.d.ts

@@ -1,4 +1,4 @@
-/** @file Pure object-shape predicates shared by tool input readers and render-time decoders. */
+/** @file Object-shape predicates and canonical JSON shared by tool readers and request digests. */
 /** Accept any non-null object, including arrays; never sanitizes or reads properties.
  * @complexity O(1) time and space.
  * @example isRecord({ value: [] }); // true
@@ -45,14 +45,37 @@ export declare function deleteMapRecord<Key, Row extends object>({ records, key,
     key: Key;
     fields: Partial<Row>;
 }, _optional?: Record<string, never>): void;
+/** Invalid canonical JSON input. Messages never include argument contents. */
+export declare class CanonicalJsonError extends TypeError {
+    constructor(required: {
+        readonly message: string;
+    });
+}
 /**
- * Canonical JSON: object keys sorted, `undefined` members dropped, array order kept, so equal
- * JSON-like values serialize identically regardless of key order (fingerprints, request digests).
- * Objects serialize by own enumerable keys only, so a Date or Map becomes `{}`: pass JSON-like values.
- * @complexity O(n log n) time over n object keys, O(n) space.
+ * Canonical JSON: recursively sort object keys by Unicode code point, omit undefined object
+ * properties, and preserve array order. Uses JSON scalar escaping without invoking toJSON hooks.
+ * @param required.value JSON input; shared references are allowed. Does not mutate input.
+ * @throws CanonicalJsonError for non-JSON values (including array holes) and cycles.
+ * @complexity O(s + sum(k log k * l)) time for s output bytes, k keys per object and key length l;
+ * O(s * d) worst-case space for nesting depth d, including intermediate strings and recursion.
  * @example canonicalJson({ value: { b: 1, a: 2 } }); // '{"a":2,"b":1}'
  */
 export declare function canonicalJson(required: {
     readonly value: unknown;
-}, _optional?: {}): string;
+}, _optional?: Record<string, never>): string;
+/**
+ * SHA-256 lowercase hex over canonical UTF-8 tool arguments, shared by plugins and host gates.
+ * @param required.args JSON arguments; validation completes before hashing starts.
+ * @param optional.crypto Host WebCrypto port; defaults to the runtime's global WebCrypto.
+ * @returns An asynchronous digest, usable in browsers and Node without Node imports.
+ * @throws CanonicalJsonError for invalid arguments; WebCrypto failures propagate.
+ * @complexity Canonical serialization cost plus O(s) hashing time and space for s UTF-8 bytes.
+ */
+export declare function canonicalArgumentDigest(required: {
+    readonly args: unknown;
+}, { crypto }?: {
+    readonly crypto?: {
+        readonly subtle: Pick<typeof globalThis.crypto.subtle, 'digest'>;
+    };
+}): Promise<string>;
 //# sourceMappingURL=records.d.ts.map

package/dist/records.js

@@ -1,4 +1,4 @@
-/** @file Pure object-shape predicates shared by tool input readers and render-time decoders. */
+/** @file Object-shape predicates and canonical JSON shared by tool readers and request digests. */
 /** Accept any non-null object, including arrays; never sanitizes or reads properties.
  * @complexity O(1) time and space.
  * @example isRecord({ value: [] }); // true
@@ -43,23 +43,113 @@ export function deleteMapRecord({ records, key, fields }, _optional = {}) {
     if (record && matchesRecordFields({ record, fields }))
         records.delete(key);
 }
+/** Invalid canonical JSON input. Messages never include argument contents. */
+export class CanonicalJsonError extends TypeError {
+    constructor(required) {
+        super(required.message);
+        this.name = 'CanonicalJsonError';
+    }
+}
+/** Compare Unicode code points, including astral characters; UTF-16 sort differs above U+FFFF.
+ * @complexity O(l) time and space for the combined key length l.
+ */
+function compareJsonKeys(left, right) {
+    const a = Array.from(left);
+    const b = Array.from(right);
+    for (let index = 0; index < Math.min(a.length, b.length); index++) {
+        const difference = a[index].codePointAt(0) - b[index].codePointAt(0);
+        if (difference !== 0)
+            return difference;
+    }
+    return a.length - b.length;
+}
+/** Serialize JSON scalars without JSON.stringify's lossy non-JSON fallbacks.
+ * @throws CanonicalJsonError for unsupported types or non-finite numbers.
+ * @complexity O(s) time and space for s serialized characters.
+ */
+function canonicalScalar(value) {
+    switch (typeof value) {
+        case 'string':
+        case 'boolean':
+            return JSON.stringify(value);
+        case 'number':
+            if (Number.isFinite(value))
+                return JSON.stringify(value);
+            throw new CanonicalJsonError({ message: 'Canonical JSON requires finite numbers.' });
+        default:
+            throw new CanonicalJsonError({ message: 'Canonical JSON requires JSON values.' });
+    }
+}
+/** Serialize own enumerable JSON fields; class instances must not silently collapse to {}.
+ * @throws CanonicalJsonError for non-JSON objects or enumerable symbol keys.
+ * @complexity O(k log k * l + s) time and O(s + k * l) space, plus recursive children.
+ */
+function canonicalObject(value, ancestors) {
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype !== Object.prototype && prototype !== null) {
+        throw new CanonicalJsonError({ message: 'Canonical JSON requires plain objects or arrays.' });
+    }
+    if (Object.getOwnPropertySymbols(value).some(key => Object.prototype.propertyIsEnumerable.call(value, key))) {
+        throw new CanonicalJsonError({ message: 'Canonical JSON requires string object keys.' });
+    }
+    const record = value;
+    // Object keys are unique, so comparing their code points gives a total order here.
+    const members = Object.keys(record).sort(compareJsonKeys).flatMap(key => {
+        const child = record[key];
+        if (child === undefined)
+            return [];
+        return [`${JSON.stringify(key)}:${canonicalValue(child, ancestors)}`];
+    });
+    return `{${members.join(',')}}`;
+}
+/** Track only active ancestors: repeated references are JSON, back-edges are cycles.
+ * @throws CanonicalJsonError for cycles or non-JSON children.
+ * @complexity O(s + sum(k log k * l)) time; O(s * d) worst-case space for depth d.
+ */
+function canonicalValue(value, ancestors) {
+    if (value === null)
+        return 'null';
+    if (typeof value !== 'object')
+        return canonicalScalar(value);
+    if (ancestors.has(value))
+        throw new CanonicalJsonError({ message: 'Canonical JSON does not support cycles.' });
+    ancestors.add(value);
+    try {
+        if (!Array.isArray(value))
+            return canonicalObject(value, ancestors);
+        // Read every index: holes must fail, and a custom iterator must not change the argument order.
+        const children = [];
+        for (let index = 0; index < value.length; index++)
+            children.push(canonicalValue(value[index], ancestors));
+        return `[${children.join(',')}]`;
+    }
+    finally {
+        ancestors.delete(value);
+    }
+}
 /**
- * Canonical JSON: object keys sorted, `undefined` members dropped, array order kept, so equal
- * JSON-like values serialize identically regardless of key order (fingerprints, request digests).
- * Objects serialize by own enumerable keys only, so a Date or Map becomes `{}`: pass JSON-like values.
- * @complexity O(n log n) time over n object keys, O(n) space.
+ * Canonical JSON: recursively sort object keys by Unicode code point, omit undefined object
+ * properties, and preserve array order. Uses JSON scalar escaping without invoking toJSON hooks.
+ * @param required.value JSON input; shared references are allowed. Does not mutate input.
+ * @throws CanonicalJsonError for non-JSON values (including array holes) and cycles.
+ * @complexity O(s + sum(k log k * l)) time for s output bytes, k keys per object and key length l;
+ * O(s * d) worst-case space for nesting depth d, including intermediate strings and recursion.
  * @example canonicalJson({ value: { b: 1, a: 2 } }); // '{"a":2,"b":1}'
  */
 export function canonicalJson(required, _optional = {}) {
-    const { value } = required;
-    if (Array.isArray(value))
-        return `[${value.map(item => canonicalJson({ value: item })).join(',')}]`;
-    if (value !== null && typeof value === 'object') {
-        const record = value;
-        const members = Object.keys(record).filter(key => record[key] !== undefined).sort()
-            .map(key => `${JSON.stringify(key)}:${canonicalJson({ value: record[key] })}`);
-        return `{${members.join(',')}}`;
-    }
-    return JSON.stringify(value) ?? 'null';
+    return canonicalValue(required.value, new Set());
+}
+/**
+ * SHA-256 lowercase hex over canonical UTF-8 tool arguments, shared by plugins and host gates.
+ * @param required.args JSON arguments; validation completes before hashing starts.
+ * @param optional.crypto Host WebCrypto port; defaults to the runtime's global WebCrypto.
+ * @returns An asynchronous digest, usable in browsers and Node without Node imports.
+ * @throws CanonicalJsonError for invalid arguments; WebCrypto failures propagate.
+ * @complexity Canonical serialization cost plus O(s) hashing time and space for s UTF-8 bytes.
+ */
+export async function canonicalArgumentDigest(required, { crypto = globalThis.crypto } = {}) {
+    const json = canonicalJson({ value: required.args });
+    const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(json));
+    return Array.from(new Uint8Array(digest), byte => byte.toString(16).padStart(2, '0')).join('');
 }
 //# sourceMappingURL=records.js.map

package/dist/settings/dictionaries/index.d.ts

@@ -14,28 +14,6 @@
  * IS the key" — `translateSettingsDialog` falls back to the raw key for English and any
  * unrecognized locale.
  */
-import { SETTINGS_DIALOG_ES } from './settings-dialog.es.js';
-import { SETTINGS_DIALOG_ID } from './settings-dialog.id.js';
-import { SETTINGS_DIALOG_DE } from './settings-dialog.de.js';
-import { SETTINGS_DIALOG_ZH_CN } from './settings-dialog.zh-CN.js';
-import { SETTINGS_DIALOG_ZH_TW } from './settings-dialog.zh-TW.js';
-import { SETTINGS_DIALOG_PT_BR } from './settings-dialog.pt-BR.js';
-import { SETTINGS_DIALOG_RU } from './settings-dialog.ru.js';
-import { SETTINGS_DIALOG_FA } from './settings-dialog.fa.js';
-import { SETTINGS_DIALOG_AR } from './settings-dialog.ar.js';
-import { SETTINGS_DIALOG_JA } from './settings-dialog.ja.js';
-import { SETTINGS_DIALOG_KO } from './settings-dialog.ko.js';
-import { SETTINGS_DIALOG_PL } from './settings-dialog.pl.js';
-import { SETTINGS_DIALOG_HU } from './settings-dialog.hu.js';
-import { SETTINGS_DIALOG_FR } from './settings-dialog.fr.js';
-import { SETTINGS_DIALOG_UK } from './settings-dialog.uk.js';
-import { SETTINGS_DIALOG_TR } from './settings-dialog.tr.js';
-import { SETTINGS_DIALOG_TH } from './settings-dialog.th.js';
-import { SETTINGS_DIALOG_IT } from './settings-dialog.it.js';
-import { SETTINGS_DIALOG_HI } from './settings-dialog.hi.js';
-import { SETTINGS_DIALOG_UR } from './settings-dialog.ur.js';
-import { SETTINGS_DIALOG_BN } from './settings-dialog.bn.js';
-export { SETTINGS_DIALOG_ES, SETTINGS_DIALOG_ID, SETTINGS_DIALOG_DE, SETTINGS_DIALOG_ZH_CN, SETTINGS_DIALOG_ZH_TW, SETTINGS_DIALOG_PT_BR, SETTINGS_DIALOG_RU, SETTINGS_DIALOG_FA, SETTINGS_DIALOG_AR, SETTINGS_DIALOG_JA, SETTINGS_DIALOG_KO, SETTINGS_DIALOG_PL, SETTINGS_DIALOG_HU, SETTINGS_DIALOG_FR, SETTINGS_DIALOG_UK, SETTINGS_DIALOG_TR, SETTINGS_DIALOG_TH, SETTINGS_DIALOG_IT, SETTINGS_DIALOG_HI, SETTINGS_DIALOG_UR, SETTINGS_DIALOG_BN, };
 /** Every non-English locale this dictionary covers, keyed the same way `@jini-ai/ui`'s
  *  `SETTINGS_DIALOG_DICTIONARIES` is. */
 export declare const SETTINGS_DIALOG_DICTIONARIES: Readonly<Record<string, Record<string, string>>>;

package/dist/settings/dictionaries/index.js

@@ -35,7 +35,6 @@ import { SETTINGS_DIALOG_IT } from './settings-dialog.it.js';
 import { SETTINGS_DIALOG_HI } from './settings-dialog.hi.js';
 import { SETTINGS_DIALOG_UR } from './settings-dialog.ur.js';
 import { SETTINGS_DIALOG_BN } from './settings-dialog.bn.js';
-export { SETTINGS_DIALOG_ES, SETTINGS_DIALOG_ID, SETTINGS_DIALOG_DE, SETTINGS_DIALOG_ZH_CN, SETTINGS_DIALOG_ZH_TW, SETTINGS_DIALOG_PT_BR, SETTINGS_DIALOG_RU, SETTINGS_DIALOG_FA, SETTINGS_DIALOG_AR, SETTINGS_DIALOG_JA, SETTINGS_DIALOG_KO, SETTINGS_DIALOG_PL, SETTINGS_DIALOG_HU, SETTINGS_DIALOG_FR, SETTINGS_DIALOG_UK, SETTINGS_DIALOG_TR, SETTINGS_DIALOG_TH, SETTINGS_DIALOG_IT, SETTINGS_DIALOG_HI, SETTINGS_DIALOG_UR, SETTINGS_DIALOG_BN, };
 /** Every non-English locale this dictionary covers, keyed the same way `@jini-ai/ui`'s
  *  `SETTINGS_DIALOG_DICTIONARIES` is. */
 export const SETTINGS_DIALOG_DICTIONARIES = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jini-ai/core",
-  "version": "0.6.15-rc.1",
+  "version": "0.6.15-rc.2",
   "description": "The Jini kernel: typed DI tokens, pack composition and lifecycle, the tool registry, redaction, and origin/API-token auth primitives. Zero dependencies.",
   "license": "Apache-2.0",
   "repository": {