@uuaid/pillar 2.2.0 → 2.3.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@uuaid/pillar",
-  "version": "2.2.0",
+  "version": "2.3.0",
   "description": "Pillar (Protocol for Inter-agent Linked Ledger And Relay) — the secure delivery layer of UACP, the Universal Agent Communication Protocol. UACP = UUAID (identity) + Envelope (signed, encrypted container) + Pillar (relay, mailbox, routing, store-and-forward). Reference implementation of the UACP delivery layer; includes VDA-1 (IAASO-3901, in ballot) delivery attestation and a blind escrow for the Zilligon ZGN / EVM rails.",
   "license": "Apache-2.0",
   "type": "module",

package/src/crypto/e2e.mjs

@@ -24,7 +24,7 @@
  */
 import { createHash, createCipheriv, createDecipheriv, hkdfSync, randomBytes } from "node:crypto";
 import { ed25519, x25519 } from "@noble/curves/ed25519.js";
-import { jcs } from "../identity/jcs.mjs";
+import { jcsRfc8785 } from "../identity/jcs.mjs";
 
 export const E2E_ALG = "x25519-hkdf-sha256-aes256gcm";
 const HKDF_INFO = "uuaid-pillar-e2e/1";
@@ -58,7 +58,8 @@ export function sealPayload(recipientEdPubHex, payload, { aad }) {
   const iv = randomBytes(12);
   const cipher = createCipheriv("aes-256-gcm", key, iv);
   cipher.setAAD(Buffer.from(aad, "utf-8"));
-  const plaintext = Buffer.from(jcs(payload), "utf-8");
+  // Sealed payloads carry full RFC 8785 numbers (2026-10-24); see identity/jcs.mjs.
+  const plaintext = Buffer.from(jcsRfc8785(payload), "utf-8");
   const ct = Buffer.concat([cipher.update(plaintext), cipher.final()]);
   const tag = cipher.getAuthTag();
   return {

package/src/identity/jcs.mjs

@@ -2,16 +2,27 @@
  * RFC 8785 JCS canonicalization.  Same implementation as the pillar-core reference,
  * kept independent so the pillar-node package has no upward dependency.
  *
- * Numbers: integers only (safe for the wire we design; enforce it).  Floats
- * throw because deterministic ECMA-262 number serialization requires more code
- * than we want in a reference impl and this package's message payloads never
- * legitimately contain non-integer numbers.
+ * Numbers — two entry points with one byte rule for integers:
+ *   jcs()         INTEGERS ONLY; floats throw. Every transport document (envelopes,
+ *                 delegations, receipts, escrow terms, blobs, VDA) keeps using it, so
+ *                 what the carrier and escrow refuse is unchanged — escrow v1/v2 rely
+ *                 on that throw to reject a hostile offer (src/escrow/terms.mjs).
+ *   jcsRfc8785()  full RFC 8785 §3.2.2.3 numbers (ECMAScript Number::toString, i.e.
+ *                 JSON.stringify(n)); used only for the SEALED PAYLOAD (crypto/e2e.mjs
+ *                 sealPayload) and documents carried inside it (PAM-1, AinFi). Byte-
+ *                 identical to jcs() for every finite integer. Added 2026-10-24 so an
+ *                 agent can send a device a value such as 21.5; byte-matches
+ *                 @uuaid/pillar-client jcsRfc8785.
  */
 export function jcs(value) {
-  return _ser(value);
+  return _ser(value, false);
 }
 
-function _ser(v) {
+export function jcsRfc8785(value) {
+  return _ser(value, true);
+}
+
+function _ser(v, fractions) {
   if (v === null) return "null";
   if (v === true) return "true";
   if (v === false) return "false";
@@ -19,16 +30,17 @@ function _ser(v) {
   if (typeof v === "number") {
     if (!Number.isFinite(v)) throw new Error("JCS: NaN/Infinity not permitted");
     if (Number.isInteger(v)) return String(v);
+    if (fractions) return JSON.stringify(v); // RFC 8785 §3.2.2.3
     throw new Error("JCS: non-integer numbers not permitted; use string decimal encoding");
   }
   if (typeof v === "bigint") return v.toString();
-  if (Array.isArray(v)) return "[" + v.map(_ser).join(",") + "]";
+  if (Array.isArray(v)) return "[" + v.map((x) => _ser(x, fractions)).join(",") + "]";
   if (typeof v === "object") {
     // RFC 8785 §3.2.3: keys sort by their UTF-16 code units, which is exactly
     // JavaScript's default string order. (Comparing UTF-16LE *bytes* is not: it
     // puts "Ā" (U+0100) before "a", and disagreed with @uuaid/pillar-client.)
     const keys = Object.keys(v).sort(); // @rule jcs.code-unit-order
-    return "{" + keys.map(k => JSON.stringify(k) + ":" + _ser(v[k])).join(",") + "}";
+    return "{" + keys.map(k => JSON.stringify(k) + ":" + _ser(v[k], fractions)).join(",") + "}";
   }
   throw new Error("JCS: unsupported type " + typeof v);
 }

package/src/index.mjs

@@ -8,7 +8,7 @@
  * lives at @uuaid/pillar-browser (later).
  */
 export { Keychain, localIdFromKey, SELF_CERTIFYING_NAMESPACES, NEW_IDENTITY_NAMESPACE, SERVICE_IDENTITY_NAMESPACE, mintNamespace, keyDerivedUuaidFor, keyDerivesUuaid } from "./identity/keychain.mjs";
-export { jcs } from "./identity/jcs.mjs";
+export { jcs, jcsRfc8785 } from "./identity/jcs.mjs";
 export { seal, open, decrypt, envelopeSha, keychainSeed, ENVELOPE_VERSION, E2E_ALG } from "./net/envelope.mjs";
 export { DELEGATION_VERSION, verifyDelegationDoc, delegationCoversKind } from "./net/delegation.mjs";
 export { sealPayload, openPayload, edPubToX25519, edSeedToX25519 } from "./crypto/e2e.mjs";