@plasius/economy 0.3.0 → 0.3.1

package/README.md

@@ -120,7 +120,11 @@ const payloadForApprovedHashAdapter = canonicalTransactionPayload(transaction);
 ```
 
 The package produces canonical bytes but deliberately leaves SHA-256/HSM
-signing to an approved infrastructure adapter.
+signing to an approved infrastructure adapter. Metadata keys and posting IDs
+are ordered with locale-independent UTF-16 code-unit comparison. Their
+validated ASCII alphabet makes that ordering identical to PostgreSQL
+`COLLATE "C"`; adapters must hash the exact UTF-8 bytes returned by
+`canonicalTransactionPayload()`.
 
 ## Source-lot policy and allocations
 

package/dist/index.cjs

@@ -196,6 +196,14 @@ function sumTokenSubunits(values) {
   return total;
 }
 
+// src/canonical-order.ts
+function compareUnicodeCodeUnits(left, right) {
+  if (left === right) {
+    return 0;
+  }
+  return left < right ? -1 : 1;
+}
+
 // src/contracts.ts
 var ECONOMY_CONTRACT_VERSION = "1";
 var IDENTIFIER = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u;
@@ -232,7 +240,9 @@ function parseIsoTimestamp(value) {
 }
 function sortStringRecord(value) {
   return Object.fromEntries(
-    Object.entries(value).sort(([left], [right]) => left.localeCompare(right))
+    Object.entries(value).sort(
+      ([left], [right]) => compareUnicodeCodeUnits(left, right)
+    )
   );
 }
 
@@ -1162,7 +1172,9 @@ function assertEconomicJournalTransaction(transaction) {
 }
 function canonicalTransactionPayload(transaction) {
   assertBalancedTransaction(transaction);
-  const postings = [...transaction.postings].sort((left, right) => left.postingId.localeCompare(right.postingId)).map((posting) => ({
+  const postings = [...transaction.postings].sort(
+    (left, right) => compareUnicodeCodeUnits(left.postingId, right.postingId)
+  ).map((posting) => ({
     schemaVersion: posting.schemaVersion,
     postingId: posting.postingId,
     transactionId: posting.transactionId,