@smartledger/bsv 8.1.0 → 8.3.0

package/lib/notaryhash/script.js

@@ -0,0 +1,261 @@
+'use strict'
+
+var Script = require('../script/script')
+var Opcode = require('../opcode')
+var Hash = require('../crypto/hash')
+var $ = require('../util/preconditions')
+
+/**
+ * BRC-220 on-chain record: an `OP_FALSE OP_RETURN` safe data output.
+ *
+ *   full   (mode 0): "NOTARYHASH" | u8(1) | u8(0) | algorithm | hashAlgorithm |
+ *                    payloadHash | proofHash | publicKey | signature
+ *   hybrid (mode 1): as full, but the last two pushes are SHA-256 of each
+ *   batch  (kind 2): "NOTARYHASH" | u8(1) | u8(2) | merkleRoot(32) | u32be(leafCount)
+ *
+ * NOTE the framing differs from the canonical proof bytes on purpose. Those use
+ * `lp(x) = u32be(len(x)) || x` because they are one flat byte string; here each field is
+ * its own SCRIPT PUSH, and the push opcode already carries the length. Applying `lp()`
+ * again would double-encode every field. Both achieve unambiguous boundaries; only one is
+ * correct in each place.
+ */
+
+var NotaryScript = {}
+
+/** Push index 0. Ten ASCII bytes; the spec states no length, the literal is the spec. */
+NotaryScript.PREFIX = 'NOTARYHASH'
+
+/** Push index 1. */
+NotaryScript.VERSION = 1
+
+/** Push index 2 — the byte that discriminates the layout. */
+NotaryScript.MODE = {
+  FULL: 0,
+  HYBRID: 1,
+  BATCH: 2
+}
+
+function u8 (n) { return Buffer.from([n]) }
+
+function u32be (n) {
+  var b = Buffer.alloc(4)
+  b.writeUInt32BE(n, 0)
+  return b
+}
+
+function requireBytes (value, name, length) {
+  if (!Buffer.isBuffer(value)) {
+    throw new Error(name + ' must be a Buffer of raw bytes, not ' + (typeof value) +
+      '. Decode hex with Buffer.from(hex, \'hex\') first.')
+  }
+  if (length != null && value.length !== length) {
+    throw new Error(name + ' must be exactly ' + length + ' bytes, got ' + value.length)
+  }
+  return value
+}
+
+/**
+ * Read a push that carries a single unsigned byte.
+ *
+ * A 1-byte data push is what this library emits and what the spec's `u8(...)` describes.
+ * `OP_0` and `OP_1`–`OP_16` are ALSO accepted, because a builder that minimally encodes
+ * its pushes — which is the default in several Bitcoin libraries — represents the same
+ * values that way, and rejecting those would reject records that are otherwise perfectly
+ * conformant. Being strict here would buy nothing: the mode byte is a routing hint, and
+ * every field that matters is checked on its own terms further down.
+ *
+ * @private
+ */
+function readU8 (chunk, name) {
+  if (chunk.buf && chunk.buf.length === 1) return chunk.buf[0]
+  if (chunk.opcodenum === Opcode.OP_0) return 0
+  if (chunk.opcodenum >= Opcode.OP_1 && chunk.opcodenum <= Opcode.OP_16) {
+    return chunk.opcodenum - Opcode.OP_1 + 1
+  }
+  throw new Error(name + ' must be a single byte at this push')
+}
+
+function readBuf (chunk, name) {
+  if (!chunk || !chunk.buf) throw new Error(name + ' push is missing or carries no data')
+  return chunk.buf
+}
+
+/**
+ * Build the on-chain record.
+ *
+ * `publicKey` and `signature` are always supplied in FULL form, whatever the mode. In
+ * hybrid mode this function hashes them itself rather than accepting pre-hashed values —
+ * a caller who passed an already-hashed blob would produce a record that looks right and
+ * cannot be reconciled with the certificate, and nothing downstream would notice.
+ *
+ * @param {Object} record
+ * @param {Number} record.mode - NotaryScript.MODE.*
+ * @param {String} record.algorithm - full/hybrid
+ * @param {String} record.hashAlgorithm - full/hybrid
+ * @param {Buffer} record.payloadHash - full/hybrid, 32 bytes
+ * @param {Buffer} record.proofHash - full/hybrid, 32 bytes
+ * @param {Buffer} record.publicKey - full/hybrid, raw bytes
+ * @param {Buffer} record.signature - full/hybrid, raw bytes
+ * @param {Buffer} record.merkleRoot - batch, 32 bytes
+ * @param {Number} record.leafCount - batch
+ * @returns {Script}
+ */
+NotaryScript.build = function (record) {
+  $.checkArgument(record && typeof record === 'object', 'record is required')
+
+  var mode = record.mode
+  $.checkArgument(mode === NotaryScript.MODE.FULL ||
+    mode === NotaryScript.MODE.HYBRID ||
+    mode === NotaryScript.MODE.BATCH,
+  'mode must be 0 (full), 1 (hybrid) or 2 (batch)')
+
+  var script = new Script()
+    .add(Opcode.OP_FALSE)
+    .add(Opcode.OP_RETURN)
+    .add(Buffer.from(NotaryScript.PREFIX, 'ascii'))
+    .add(u8(NotaryScript.VERSION))
+    .add(u8(mode))
+
+  if (mode === NotaryScript.MODE.BATCH) {
+    $.checkArgument(typeof record.leafCount === 'number' && Number.isInteger(record.leafCount) &&
+      record.leafCount >= 0, 'leafCount must be a non-negative integer')
+    script.add(requireBytes(record.merkleRoot, 'merkleRoot', 32))
+    script.add(u32be(record.leafCount))
+    return script
+  }
+
+  $.checkArgument(typeof record.algorithm === 'string' && record.algorithm.length > 0,
+    'algorithm must be a non-empty string')
+  $.checkArgument(typeof record.hashAlgorithm === 'string' && record.hashAlgorithm.length > 0,
+    'hashAlgorithm must be a non-empty string')
+
+  script.add(Buffer.from(record.algorithm, 'utf8'))
+  script.add(Buffer.from(record.hashAlgorithm, 'utf8'))
+  script.add(requireBytes(record.payloadHash, 'payloadHash', 32))
+  script.add(requireBytes(record.proofHash, 'proofHash', 32))
+
+  var publicKey = requireBytes(record.publicKey, 'publicKey')
+  var signature = requireBytes(record.signature, 'signature')
+
+  if (mode === NotaryScript.MODE.HYBRID) {
+    script.add(Hash.sha256(publicKey))
+    script.add(Hash.sha256(signature))
+  } else {
+    script.add(publicKey)
+    script.add(signature)
+  }
+
+  return script
+}
+
+/**
+ * Parse an on-chain record.
+ *
+ * Returns a plain object, or throws with a message naming what was wrong. It never
+ * returns a partially-populated result: a caller that cannot distinguish "parsed" from
+ * "parsed some of it" is the shape that produces confident wrong answers.
+ *
+ * In hybrid mode the returned `publicKeyHash` / `signatureHash` are the on-chain digests;
+ * the full blobs live only in the certificate, and reconciling the two is the caller's
+ * job.
+ *
+ * @param {Script|String} script
+ * @returns {Object}
+ */
+NotaryScript.parse = function (script) {
+  if (typeof script === 'string') script = Script.fromHex(script)
+  $.checkArgument(script instanceof Script, 'script must be a Script or hex string')
+
+  var chunks = script.chunks
+
+  if (chunks.length < 5) {
+    throw new Error('not a NotaryHash record: too few pushes')
+  }
+  if (chunks[0].opcodenum !== Opcode.OP_FALSE && chunks[0].opcodenum !== Opcode.OP_0) {
+    throw new Error('not a NotaryHash record: does not start with OP_FALSE')
+  }
+  if (chunks[1].opcodenum !== Opcode.OP_RETURN) {
+    throw new Error('not a NotaryHash record: no OP_RETURN')
+  }
+
+  var prefix = readBuf(chunks[2], 'prefix')
+  if (prefix.toString('ascii') !== NotaryScript.PREFIX) {
+    throw new Error('not a NotaryHash record: prefix is ' + JSON.stringify(prefix.toString('ascii')))
+  }
+
+  var version = readU8(chunks[3], 'version')
+  if (version !== NotaryScript.VERSION) {
+    throw new Error('unsupported NotaryHash version: ' + version)
+  }
+
+  var mode = readU8(chunks[4], 'mode')
+
+  if (mode === NotaryScript.MODE.BATCH) {
+    if (chunks.length !== 7) {
+      throw new Error('batch record must have exactly 7 pushes, got ' + chunks.length)
+    }
+    var leafCountBuf = readBuf(chunks[6], 'leafCount')
+    if (leafCountBuf.length !== 4) {
+      throw new Error('leafCount must be 4 bytes (u32be), got ' + leafCountBuf.length)
+    }
+    return {
+      mode: mode,
+      version: version,
+      merkleRoot: requireBytes(readBuf(chunks[5], 'merkleRoot'), 'merkleRoot', 32),
+      leafCount: leafCountBuf.readUInt32BE(0)
+    }
+  }
+
+  if (mode !== NotaryScript.MODE.FULL && mode !== NotaryScript.MODE.HYBRID) {
+    throw new Error('unknown NotaryHash mode: ' + mode)
+  }
+
+  if (chunks.length !== 11) {
+    throw new Error('full/hybrid record must have exactly 11 pushes, got ' + chunks.length)
+  }
+
+  var parsed = {
+    mode: mode,
+    version: version,
+    algorithm: readBuf(chunks[5], 'algorithm').toString('utf8'),
+    hashAlgorithm: readBuf(chunks[6], 'hashAlgorithm').toString('utf8'),
+    payloadHash: requireBytes(readBuf(chunks[7], 'payloadHash'), 'payloadHash', 32),
+    proofHash: requireBytes(readBuf(chunks[8], 'proofHash'), 'proofHash', 32)
+  }
+
+  if (mode === NotaryScript.MODE.HYBRID) {
+    parsed.publicKeyHash = requireBytes(readBuf(chunks[9], 'publicKeyHash'), 'publicKeyHash', 32)
+    parsed.signatureHash = requireBytes(readBuf(chunks[10], 'signatureHash'), 'signatureHash', 32)
+  } else {
+    parsed.publicKey = readBuf(chunks[9], 'publicKey')
+    parsed.signature = readBuf(chunks[10], 'signature')
+  }
+
+  return parsed
+}
+
+/**
+ * Does this script look like a NotaryHash record?
+ *
+ * Strictly a cheap filter for scanning outputs — a true result means `parse()` is worth
+ * attempting, NOT that the record is well-formed. Anything that acts on the contents must
+ * call `parse()` and handle its errors.
+ *
+ * @param {Script|String} script
+ * @returns {Boolean}
+ */
+NotaryScript.isNotaryHash = function (script) {
+  try {
+    if (typeof script === 'string') script = Script.fromHex(script)
+    var c = script.chunks
+    return c.length >= 5 &&
+      (c[0].opcodenum === Opcode.OP_FALSE || c[0].opcodenum === Opcode.OP_0) &&
+      c[1].opcodenum === Opcode.OP_RETURN &&
+      !!c[2].buf &&
+      c[2].buf.toString('ascii') === NotaryScript.PREFIX
+  } catch (e) {
+    return false
+  }
+}
+
+module.exports = NotaryScript

package/lib/notaryhash/suites.js

@@ -0,0 +1,156 @@
+'use strict'
+
+var BN = require('../crypto/bn')
+var ECDSA = require('../crypto/ecdsa')
+var Signature = require('../crypto/signature')
+var PublicKey = require('../publickey')
+var Point = require('../crypto/point')
+var $ = require('../util/preconditions')
+
+/**
+ * Signature suites, keyed on the `algorithm` string BRC-220 already carries.
+ *
+ * `ECDSA-secp256k1` is registered here and needs nothing new. ML-DSA and SLH-DSA are NOT
+ * built in, and that is deliberate rather than unfinished:
+ *
+ *   @noble/post-quantum is the one Noble package with no independent audit -- its README
+ *   says so -- and it is 0.x, 669 KB, and does not claim constant-time execution. This
+ *   library's other primitives carry a published Cure53 audit, which is what lets
+ *   docs/AUDIT_SCOPE.md tell a vendor not to price the primitive layer. Making an
+ *   unaudited implementation a hard dependency of a transaction-signing library would
+ *   forfeit that for a capability the spec does not require: ECDSA-secp256k1 is a
+ *   first-class algorithm alongside the post-quantum ones, so an ECDSA-only
+ *   implementation is conformant.
+ *
+ * So post-quantum suites are supplied by the caller -- most obviously from
+ * @smartledger/keys, which already wraps @noble/post-quantum -- and callers who do not
+ * need them pay nothing in bundle size or audit surface. See docs/BRC220_PLAN.md §2.
+ */
+
+var Suites = {}
+
+var registry = {}
+
+/**
+ * Register a signature suite.
+ *
+ * `verify` MUST return a strict boolean. A suite returning a truthy object would make
+ * every signature check pass, which is the single defect class this codebase has had to
+ * fix most often -- so the registry enforces it at call time rather than trusting the
+ * suite.
+ *
+ * @param {String} algorithm - e.g. 'ML-DSA-65'
+ * @param {Object} suite
+ * @param {Function} suite.verify - (payloadHash: Buffer, signature: Buffer, publicKey: Buffer) => boolean
+ */
+Suites.register = function (algorithm, suite) {
+  $.checkArgument(typeof algorithm === 'string' && algorithm.length > 0,
+    'algorithm must be a non-empty string')
+  $.checkArgument(suite && typeof suite.verify === 'function',
+    'suite must provide a verify(payloadHash, signature, publicKey) function')
+  registry[algorithm] = suite
+  return Suites
+}
+
+/** @returns {Object|undefined} */
+Suites.get = function (algorithm) {
+  return registry[algorithm]
+}
+
+/** @returns {Array<String>} registered algorithm identifiers */
+Suites.list = function () {
+  return Object.keys(registry).sort()
+}
+
+/** Test seam. */
+Suites.unregister = function (algorithm) {
+  delete registry[algorithm]
+  return Suites
+}
+
+/**
+ * Verify a signature under the named suite.
+ *
+ * An UNREGISTERED algorithm returns false. It does not fall through to a default, and it
+ * does not throw: a certificate naming an algorithm this process cannot check has not
+ * been verified, and `false` is the honest answer. Falling through to ECDSA for an
+ * `ML-DSA-65` certificate would be catastrophic and is exactly what a default invites.
+ *
+ * The suite's own return value is coerced with `=== true`, so a suite that returns a
+ * truthy object cannot smuggle a pass through.
+ *
+ * @param {String} algorithm
+ * @param {Buffer} payloadHash - the 32 bytes that were signed
+ * @param {Buffer} signature
+ * @param {Buffer} publicKey
+ * @returns {Boolean}
+ */
+Suites.verify = function (algorithm, payloadHash, signature, publicKey) {
+  var suite = registry[algorithm]
+  if (!suite) return false
+  if (!Buffer.isBuffer(payloadHash) || !Buffer.isBuffer(signature) || !Buffer.isBuffer(publicKey)) {
+    return false
+  }
+  try {
+    return suite.verify(payloadHash, signature, publicKey) === true
+  } catch (e) {
+    return false
+  }
+}
+
+/**
+ * ECDSA over secp256k1.
+ *
+ * The signer signs the 32-byte `payloadHash` DIRECTLY (spec §Algorithms: "post-quantum
+ * schemes apply their own internal hashing"). There is no second hash, and no Bitcoin
+ * sighash — this is a detached signature over a digest.
+ *
+ * Signatures are 64 raw bytes, `r || s`, each a 32-byte big-endian integer. DER is
+ * accepted as a length-discriminated fallback for Bitcoin-native signers, because the
+ * certificate's `encoding` field may say so; see docs/BRC220_ENCODING_AMENDMENT.md for
+ * why raw is what new implementations should emit.
+ *
+ * Low-S is REQUIRED. A high-S signature is rejected rather than normalised: normalising
+ * changes the signature bytes, and those bytes are inside `proofHash`, so accepting both
+ * forms would mean two valid certificates exist for one signing act.
+ */
+Suites.register('ECDSA-secp256k1', {
+  verify: function (payloadHash, signature, publicKey) {
+    if (payloadHash.length !== 32) return false
+
+    var sig
+    if (signature.length === 64) {
+      sig = new Signature(
+        BN.fromBuffer(signature.slice(0, 32)),
+        BN.fromBuffer(signature.slice(32, 64))
+      )
+    } else {
+      // DER, for the legacy `encoding: "der"` case.
+      try {
+        sig = Signature.fromDER(signature)
+      } catch (e) {
+        return false
+      }
+    }
+
+    // Low-S, enforced rather than normalised.
+    var halfOrder = Point.getN().div(new BN(2))
+    if (sig.s.gt(halfOrder)) return false
+
+    var pubkey
+    try {
+      pubkey = PublicKey.fromBuffer(publicKey)
+    } catch (e) {
+      return false
+    }
+
+    var ecdsa = new ECDSA()
+    ecdsa.hashbuf = payloadHash
+    ecdsa.endian = 'little'
+    ecdsa.pubkey = pubkey
+    ecdsa.sig = sig
+    return ecdsa.verify() === true
+  }
+})
+
+module.exports = Suites

package/lib/util/jcs.js

@@ -0,0 +1,75 @@
+'use strict'
+
+/**
+ * RFC 8785 — JSON Canonicalization Scheme.
+ *
+ * Extracted from lib/gdaf/attestation-signer.js, where it was added in 8.2.0. Two
+ * unrelated things now need it — GDAF credential signatures and BRC-220 certificates —
+ * and a notarization module reaching into the credentials module for it would be the
+ * wrong direction. JCS is a general serialization concern, not a GDAF concept.
+ *
+ * The behaviour is unchanged; `AttestationSigner._canonicalizeJCS` delegates here.
+ *
+ * The point of JCS is that two independent implementations produce identical bytes, so
+ * everything below is fixed by the RFC rather than by local preference:
+ *
+ *   - Object keys sort by UTF-16 code unit, which is what Array.prototype.sort already
+ *     does for strings. The sort is applied DURING serialization rather than by
+ *     rebuilding an object, because V8 orders integer-like own properties numerically
+ *     ahead of string keys and would silently undo it — `{"2":…,"10":…}` where the RFC
+ *     requires `{"10":…,"2":…}`. That was a real defect in this codebase before 8.2.0.
+ *   - JSON.stringify supplies the leaf types deliberately: for finite numbers it produces
+ *     ECMAScript Number::toString, which the RFC mandates, and since ES2019 it emits
+ *     well-formed output for lone surrogates. Both are easy to get subtly wrong by hand.
+ *   - Non-finite numbers throw rather than serializing as `null`, which is what
+ *     JSON.stringify does and which would silently canonicalize a different document than
+ *     the one supplied.
+ */
+
+var JCS = {}
+
+/**
+ * Serialize a value as RFC 8785 canonical JSON.
+ *
+ * @param {*} value
+ * @returns {String}
+ */
+JCS.stringify = function (value) {
+  if (value === null) return 'null'
+
+  var type = typeof value
+
+  if (type === 'boolean') return value ? 'true' : 'false'
+
+  if (type === 'number') {
+    if (!isFinite(value)) {
+      throw new Error('Cannot canonicalize non-finite number: ' + value)
+    }
+    return JSON.stringify(value)
+  }
+
+  if (type === 'string') return JSON.stringify(value)
+
+  if (Array.isArray(value)) {
+    // Arrays are order-significant. `undefined` has no JSON form and becomes null in an
+    // array, matching JSON.stringify.
+    return '[' + value.map(function (item) {
+      return item === undefined ? 'null' : JCS.stringify(item)
+    }).join(',') + ']'
+  }
+
+  if (type === 'object') {
+    // Absent and explicitly-undefined are indistinguishable in JSON, so both are dropped.
+    var keys = Object.keys(value).filter(function (key) {
+      return value[key] !== undefined && typeof value[key] !== 'function'
+    }).sort()
+
+    return '{' + keys.map(function (key) {
+      return JSON.stringify(key) + ':' + JCS.stringify(value[key])
+    }).join(',') + '}'
+  }
+
+  throw new Error('Cannot canonicalize value of type: ' + type)
+}
+
+module.exports = JCS

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smartledger/bsv",
-  "version": "8.1.0",
+  "version": "8.3.0",
   "description": "🚀 Complete Bitcoin SV development framework with legally-recognizable DID:web + W3C VC-JWT toolkit, Legal Token Protocol (LTP), Global Digital Attestation Framework (GDAF), StatusList2021 revocation, and 16 flexible loading options. Standards-based credentials with ES256/ES256K support, on-chain BSV anchoring, and comprehensive Bitcoin SV API. Perfect for legal tokens, verifiable credentials, DeFi, smart contracts, and secure Bitcoin applications.",
   "author": "SmartLedger Technology <hello@smartledger.technology> (https://smartledger.technology)",
   "homepage": "https://github.com/codenlighten/smartledger-bsv#readme",
@@ -39,6 +39,7 @@
     "./lib/ltp": "./lib/ltp/index.js",
     "./lib/message": "./lib/message/index.js",
     "./lib/mnemonic": "./lib/mnemonic/index.js",
+    "./lib/notaryhash": "./lib/notaryhash/index.js",
     "./lib/ordinals": "./lib/ordinals/index.js",
     "./lib/script": "./lib/script/index.js",
     "./lib/smart_contract": "./lib/smart_contract/index.js",
@@ -117,6 +118,7 @@
     "message/",
     "mnemonic/",
     "build/",
+    "tools/",
     "*-entry.js",
     "bsv.min.js",
     "bsv.bundle.js",
@@ -187,7 +189,7 @@
     "preimage",
     "secret-splitting",
     "did-resolution",
-    "zero-knowledge-proofs",
+    "selective-disclosure",
     "blockchain-anchoring",
     "attestation-framework",
     "nchain",
@@ -230,9 +232,9 @@
     "request": "browser-request"
   },
   "dependencies": {
-    "@noble/ciphers": "2.2.0",
-    "@noble/curves": "2.2.0",
-    "@noble/hashes": "2.2.0",
+    "@noble/ciphers": "^2.3.0",
+    "@noble/curves": "^2.3.0",
+    "@noble/hashes": "^2.3.0",
     "bn.js": "=4.12.5",
     "secrets.js-grempe": "^2.0.0"
   },
@@ -276,7 +278,8 @@
       "beforeEach",
       "describe",
       "it",
-      "globalThis"
+      "globalThis",
+      "BigInt"
     ],
     "ignore": [
       "dist/**",

package/test/gdaf/canonicalization.js

@@ -0,0 +1,106 @@
+'use strict'
+
+/* global describe, it */
+
+// GDAF signs a hash of canonical JSON, so the canonicalization IS part of the signature
+// scheme. It was sorted-key JSON that rebuilt the object, which loses the sort: V8 orders
+// integer-like own properties numerically, ahead of string keys, whatever order they were
+// inserted in.
+//
+// Within this library that was deterministic — signing and verification agreed, and no
+// forgery followed. Across implementations it was a verification failure, which for
+// credentials that exist to be checked by other parties is the thing that matters.
+
+require('chai').should()
+var Signer = require('../../lib/gdaf/attestation-signer')
+
+describe('GDAF canonicalization', function () {
+  describe('RFC 8785 conformance', function () {
+    // The concrete divergence. JCS sorts by UTF-16 code unit, where '10' < '2'.
+    it('sorts integer-like keys lexicographically, not numerically', function () {
+      var o = {}
+      o['10'] = 'ten'
+      o['2'] = 'two'
+      Signer._canonicalizeJCS(o).should.equal('{"10":"ten","2":"two"}')
+    })
+
+    it('is what the legacy form got wrong, which is why both exist', function () {
+      var o = {}
+      o['10'] = 'ten'
+      o['2'] = 'two'
+      Signer._canonicalizeJSON(o).should.equal('{"2":"two","10":"ten"}')
+      Signer._canonicalizeJCS(o).should.not.equal(Signer._canonicalizeJSON(o))
+    })
+
+    it('sorts at every depth and leaves arrays in order', function () {
+      Signer._canonicalizeJCS({ z: { b: 1, a: 2 }, a: [3, { d: 1, c: 2 }] })
+        .should.equal('{"a":[3,{"c":2,"d":1}],"z":{"a":2,"b":1}}')
+    })
+
+    it('is insensitive to key insertion order', function () {
+      var x = {}; x.b = 1; x.a = 2
+      var y = {}; y.a = 2; y.b = 1
+      Signer._canonicalizeJCS(x).should.equal(Signer._canonicalizeJCS(y))
+    })
+
+    // These are the same IEEE-754 double, so collapsing them is correct rather than a
+    // weakness — JavaScript has one number type. Pinned so nobody "fixes" it.
+    it('treats 1847, 1847.0 and 1.847e3 as the one number they are', function () {
+      Signer._canonicalizeJCS({ a: 1847 }).should.equal('{"a":1847}')
+      Signer._canonicalizeJCS({ a: 1847.0 }).should.equal('{"a":1847}')
+      Signer._canonicalizeJCS({ a: 1.847e3 }).should.equal('{"a":1847}')
+    })
+
+    it('keeps a number distinct from its string form', function () {
+      Signer._canonicalizeJCS({ a: 1847 }).should.not.equal(Signer._canonicalizeJCS({ a: '1847' }))
+    })
+
+    // JSON.stringify would emit `null` here, silently signing a different document.
+    it('refuses non-finite numbers rather than emitting null', function () {
+      ;(function () { Signer._canonicalizeJCS({ a: NaN }) }).should.throw(/non-finite/)
+      ;(function () { Signer._canonicalizeJCS({ a: Infinity }) }).should.throw(/non-finite/)
+    })
+
+    it('emits unicode and non-BMP characters directly', function () {
+      Signer._canonicalizeJCS({ a: 'é' }).should.equal('{"a":"é"}')
+      Signer._canonicalizeJCS({ a: '😀' }).should.equal('{"a":"😀"}')
+    })
+
+    it('drops undefined members, which JSON cannot represent', function () {
+      Signer._canonicalizeJCS({ a: 1, b: undefined }).should.equal('{"a":1}')
+    })
+
+    it('nulls undefined array elements, as JSON.stringify does', function () {
+      Signer._canonicalizeJCS([1, undefined, 2]).should.equal('[1,null,2]')
+    })
+  })
+
+  describe('hashing and migration', function () {
+    var CRED = { id: 'urn:x', credentialSubject: { name: 'Alice', age: 41 } }
+
+    it('hashes with JCS by default', function () {
+      Signer._hashCredential(CRED).toString('hex')
+        .should.equal(Signer._hashCredential(CRED, Signer.CANONICALIZATION.JCS).toString('hex'))
+    })
+
+    // The migration path. A credential whose keys make the two forms differ must hash
+    // differently, or the legacy fallback in the verifier would be pointless.
+    it('gives a different hash under the legacy form when the forms diverge', function () {
+      var withIntKeys = { '10': 'ten', '2': 'two' }
+      Signer._hashCredential(withIntKeys, Signer.CANONICALIZATION.JCS).toString('hex')
+        .should.not.equal(
+          Signer._hashCredential(withIntKeys, Signer.CANONICALIZATION.LEGACY).toString('hex')
+        )
+    })
+
+    it('agrees between the forms when no integer-like keys are present', function () {
+      Signer._hashCredential(CRED, Signer.CANONICALIZATION.JCS).toString('hex')
+        .should.equal(Signer._hashCredential(CRED, Signer.CANONICALIZATION.LEGACY).toString('hex'))
+    })
+
+    it('exposes both forms by name', function () {
+      Signer.CANONICALIZATION.JCS.should.equal('jcs')
+      Signer.CANONICALIZATION.LEGACY.should.equal('legacy')
+    })
+  })
+})