@vorionsys/security 1.0.0

package/dist/common/canonical-bridge.js

@@ -0,0 +1,231 @@
+/**
+ * Canonical Bridge - Re-exports canonical types from @vorion/contracts
+ *
+ * This module provides a bridge between legacy types in src/common/types.ts
+ * and the canonical types defined in packages/contracts/src/v2/.
+ *
+ * USAGE:
+ * - For NEW code: Import canonical types directly from this module
+ * - For EXISTING code: Continue using legacy types from ./types.ts
+ * - For MIGRATIONS: Use adapter functions to convert between formats
+ *
+ * @packageDocumentation
+ */
+// =============================================================================
+// CANONICAL TYPE RE-EXPORTS
+// =============================================================================
+// Enums - Use these for all new code
+export { TrustBand, ObservationTier, OBSERVATION_CEILINGS, DataSensitivity, Reversibility, ActionType, ProofEventType, ComponentType, ComponentStatus, ApprovalType, } from '@vorionsys/contracts/v2';
+export { DEFAULT_BAND_THRESHOLDS, DEFAULT_BANDING_CONFIG, RiskProfile, RISK_PROFILE_WINDOWS, DEFAULT_TRUST_DYNAMICS, } from '@vorionsys/contracts/v2';
+export { DenialReason } from '@vorionsys/contracts/v2';
+export { GovernanceDenialReason, HIERARCHY_TIERS, HIERARCHY_ORDER, HIERARCHY_LEVELS, getHierarchyTier, getHierarchyLevelConfig, isHigherAuthority, canDelegate, getReportingChain, meetsMinimumTrust, createAllowedResult, createDeniedResult, createGovernanceDeniedResult, isHierarchyLevel, isAuthorityScopeType, 
+// Zod schemas
+governanceDenialReasonSchema, authorizationConstraintsSchema, authorizationResultSchema, governanceRoleSchema, hierarchyLevelSchema, hierarchyLevelConfigSchema, authorityScopeTypeSchema, controlActionSchema, authorityScopeTimeRestrictionSchema, authorityScopeSchema, authorityTypeSchema, permissionSchema, authorityAuditSchema, authoritySchema, authContextSchema, } from '@vorionsys/contracts/canonical';
+import { TrustBand, ActionType } from '@vorionsys/contracts/v2';
+// =============================================================================
+// ADAPTER FUNCTIONS
+// =============================================================================
+/**
+ * Convert legacy TrustLevel (0-5) to canonical TrustBand enum
+ *
+ * @param level - Legacy trust level (0-5)
+ * @returns Canonical TrustBand enum value
+ */
+export function trustLevelToTrustBand(level) {
+    // Map legacy 6-tier system to new 8-tier system
+    switch (level) {
+        case 0:
+            return TrustBand.T0_SANDBOX; // Was T0_UNTRUSTED
+        case 1:
+            return TrustBand.T1_OBSERVED; // Was T1_SUPERVISED
+        case 2:
+            return TrustBand.T2_PROVISIONAL; // Was T2_CONSTRAINED
+        case 3:
+            return TrustBand.T4_STANDARD; // Was T3_TRUSTED (mapped to T4)
+        case 4:
+            return TrustBand.T6_CERTIFIED; // Was T4_AUTONOMOUS (mapped to T6)
+        case 5:
+            return TrustBand.T7_AUTONOMOUS; // Was T5_MISSION_CRITICAL (mapped to T7)
+        default:
+            throw new Error(`Invalid trust level: ${level}`);
+    }
+}
+/**
+ * Convert canonical TrustBand enum to legacy TrustLevel (0-5)
+ *
+ * @param band - Canonical TrustBand enum value
+ * @returns Legacy trust level (0-5)
+ */
+export function trustBandToTrustLevel(band) {
+    // TrustBand enum values are 0-5, which maps directly to TrustLevel
+    return band;
+}
+/**
+ * @deprecated No longer needed - trust-profile.ts now uses 0-1000 scale
+ *
+ * Convert trust score (0-1000) to legacy dimension score (0-100)
+ * This is provided for backwards compatibility with older code that
+ * expected 0-100 scale dimensions.
+ *
+ * @param score - Trust score on 0-1000 scale
+ * @returns Score on 0-100 scale
+ */
+export function trustScoreToDimensionScore(score) {
+    return Math.round(score / 10);
+}
+/**
+ * @deprecated No longer needed - trust-profile.ts now uses 0-1000 scale
+ *
+ * Convert legacy dimension score (0-100) to trust score (0-1000)
+ * This is provided for backwards compatibility with older code that
+ * used 0-100 scale dimensions.
+ *
+ * @param dimensionScore - Score on 0-100 scale
+ * @returns Trust score on 0-1000 scale
+ */
+export function dimensionScoreToTrustScore(dimensionScore) {
+    return Math.round(dimensionScore * 10);
+}
+/**
+ * Calculate TrustBand from a TrustScore (0-1000)
+ *
+ * Band thresholds (0-1000 scale):
+ * - T0: 0-200
+ * - T1: 201-400
+ * - T2: 401-550
+ * - T3: 551-700
+ * - T4: 701-850
+ * - T5: 851-1000
+ *
+ * @param score - Trust score on 0-1000 scale
+ * @returns Corresponding TrustBand
+ */
+export function trustScoreToTrustBand(score) {
+    // 8-tier trust bands per ATSF spec
+    if (score < 200)
+        return TrustBand.T0_SANDBOX;
+    if (score < 350)
+        return TrustBand.T1_OBSERVED;
+    if (score < 500)
+        return TrustBand.T2_PROVISIONAL;
+    if (score < 650)
+        return TrustBand.T3_MONITORED;
+    if (score < 800)
+        return TrustBand.T4_STANDARD;
+    if (score < 876)
+        return TrustBand.T5_TRUSTED;
+    if (score < 951)
+        return TrustBand.T6_CERTIFIED;
+    return TrustBand.T7_AUTONOMOUS;
+}
+/**
+ * Convert legacy TrustSignal to canonical TrustEvidence
+ *
+ * @param signal - Legacy TrustSignal
+ * @param dimension - Which trust dimension this evidence affects
+ * @returns Canonical TrustEvidence
+ */
+export function trustSignalToEvidence(signal, factorCode = 'CT-REL') {
+    return {
+        evidenceId: signal.id,
+        factorCode,
+        impact: signal.value * (signal.weight ?? 1),
+        source: signal.source ?? 'legacy-signal',
+        collectedAt: new Date(signal.timestamp),
+        metadata: signal.metadata,
+    };
+}
+/**
+ * Convert canonical TrustEvidence to legacy TrustSignal
+ *
+ * @param evidence - Canonical TrustEvidence
+ * @param entityId - Entity ID (required for legacy format)
+ * @returns Legacy TrustSignal
+ */
+export function evidenceToTrustSignal(evidence, entityId) {
+    return {
+        id: evidence.evidenceId,
+        entityId,
+        type: evidence.factorCode,
+        value: evidence.impact,
+        weight: 1.0,
+        source: evidence.source,
+        timestamp: evidence.collectedAt.toISOString(),
+        metadata: evidence.metadata,
+    };
+}
+/**
+ * Map string action type to ActionType enum
+ */
+const ACTION_TYPE_MAP = {
+    read: ActionType.READ,
+    write: ActionType.WRITE,
+    delete: ActionType.DELETE,
+    execute: ActionType.EXECUTE,
+    communicate: ActionType.COMMUNICATE,
+    transfer: ActionType.TRANSFER,
+};
+/**
+ * Convert legacy Intent to canonical Intent format
+ *
+ * Note: Some fields may require additional context that isn't available
+ * in the legacy format. These are marked as optional in the canonical type.
+ *
+ * @param intent - Legacy Intent
+ * @param actionType - ActionType (required for canonical, defaults to 'execute')
+ * @returns Partial canonical Intent (missing some required fields)
+ */
+export function legacyIntentToCanonical(intent, actionType = 'execute') {
+    return {
+        intentId: intent.id,
+        agentId: intent.entityId,
+        correlationId: intent.id, // Use intent ID as correlation if not available
+        action: intent.goal,
+        actionType: ACTION_TYPE_MAP[actionType],
+        context: {
+            metadata: intent.metadata,
+            priority: intent.priority,
+            ...intent.context,
+        },
+        createdAt: new Date(intent.createdAt),
+    };
+}
+// =============================================================================
+// BAND THRESHOLD CONSTANTS (0-1000 scale)
+// =============================================================================
+/**
+ * Trust band thresholds on 0-1000 scale
+ *
+ * These are the canonical thresholds that should be used for API responses
+ * and trust calculations. All trust dimensions and composite scores now
+ * use the unified 0-1000 scale.
+ */
+export const TRUST_BAND_THRESHOLDS_1000 = {
+    T0: { min: 0, max: 166 },
+    T1: { min: 167, max: 332 },
+    T2: { min: 333, max: 499 },
+    T3: { min: 500, max: 665 },
+    T4: { min: 666, max: 832 },
+    T5: { min: 833, max: 1000 },
+};
+/**
+ * Get the minimum trust score required for a given TrustBand (0-1000 scale)
+ *
+ * @param band - Target TrustBand
+ * @returns Minimum score required
+ */
+export function getMinScoreForBand(band) {
+    const bandKey = `T${band}`;
+    return TRUST_BAND_THRESHOLDS_1000[bandKey].min;
+}
+/**
+ * Get the maximum trust score for a given TrustBand (0-1000 scale)
+ *
+ * @param band - Target TrustBand
+ * @returns Maximum score for the band
+ */
+export function getMaxScoreForBand(band) {
+    const bandKey = `T${band}`;
+    return TRUST_BAND_THRESHOLDS_1000[bandKey].max;
+}
+//# sourceMappingURL=canonical-bridge.js.map

package/dist/common/canonical-bridge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical-bridge.js","sourceRoot":"","sources":["../../src/common/canonical-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,gFAAgF;AAChF,4BAA4B;AAC5B,gFAAgF;AAEhF,qCAAqC;AACrC,OAAO,EACL,SAAS,EACT,eAAe,EACf,oBAAoB,EACpB,eAAe,EACf,aAAa,EACb,UAAU,EACV,cAAc,EACd,aAAa,EACb,eAAe,EACf,YAAY,GACb,MAAM,yBAAyB,CAAC;AAkBjC,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,WAAW,EACX,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AAqBjC,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAoBvD,OAAO,EACL,sBAAsB,EACtB,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,uBAAuB,EACvB,iBAAiB,EACjB,WAAW,EACX,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,EAClB,4BAA4B,EAC5B,gBAAgB,EAChB,oBAAoB;AACpB,cAAc;AACd,4BAA4B,EAC5B,8BAA8B,EAC9B,yBAAyB,EACzB,oBAAoB,EACpB,oBAAoB,EACpB,0BAA0B,EAC1B,wBAAwB,EACxB,mBAAmB,EACnB,mCAAmC,EACnC,oBAAoB,EACpB,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,EACpB,eAAe,EACf,iBAAiB,GAClB,MAAM,gCAAgC,CAAC;AAOxC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAIhE,gFAAgF;AAChF,oBAAoB;AACpB,gFAAgF;AAEhF;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAiB;IACrD,gDAAgD;IAChD,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,CAAC;YACJ,OAAO,SAAS,CAAC,UAAU,CAAC,CAAM,mBAAmB;QACvD,KAAK,CAAC;YACJ,OAAO,SAAS,CAAC,WAAW,CAAC,CAAK,oBAAoB;QACxD,KAAK,CAAC;YACJ,OAAO,SAAS,CAAC,cAAc,CAAC,CAAE,qBAAqB;QACzD,KAAK,CAAC;YACJ,OAAO,SAAS,CAAC,WAAW,CAAC,CAAK,gCAAgC;QACpE,KAAK,CAAC;YACJ,OAAO,SAAS,CAAC,YAAY,CAAC,CAAI,mCAAmC;QACvE,KAAK,CAAC;YACJ,OAAO,SAAS,CAAC,aAAa,CAAC,CAAG,yCAAyC;QAC7E;YACE,MAAM,IAAI,KAAK,CAAC,wBAAwB,KAAK,EAAE,CAAC,CAAC;IACrD,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAe;IACnD,mEAAmE;IACnE,OAAO,IAAkB,CAAC;AAC5B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAiB;IAC1D,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;AAChC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,0BAA0B,CAAC,cAAsB;IAC/D,OAAO,IAAI,CAAC,KAAK,CAAC,cAAc,GAAG,EAAE,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAiB;IACrD,mCAAmC;IACnC,IAAI,KAAK,GAAG,GAAG;QAAE,OAAO,SAAS,CAAC,UAAU,CAAC;IAC7C,IAAI,KAAK,GAAG,GAAG;QAAE,OAAO,SAAS,CAAC,WAAW,CAAC;IAC9C,IAAI,KAAK,GAAG,GAAG;QAAE,OAAO,SAAS,CAAC,cAAc,CAAC;IACjD,IAAI,KAAK,GAAG,GAAG;QAAE,OAAO,SAAS,CAAC,YAAY,CAAC;IAC/C,IAAI,KAAK,GAAG,GAAG;QAAE,OAAO,SAAS,CAAC,WAAW,CAAC;IAC9C,IAAI,KAAK,GAAG,GAAG;QAAE,OAAO,SAAS,CAAC,UAAU,CAAC;IAC7C,IAAI,KAAK,GAAG,GAAG;QAAE,OAAO,SAAS,CAAC,YAAY,CAAC;IAC/C,OAAO,SAAS,CAAC,aAAa,CAAC;AACjC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAAmB,EACnB,aAAqB,QAAQ;IAE7B,OAAO;QACL,UAAU,EAAE,MAAM,CAAC,EAAE;QACrB,UAAU;QACV,MAAM,EAAE,MAAM,CAAC,KAAK,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;QAC3C,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,eAAe;QACxC,WAAW,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;QACvC,QAAQ,EAAE,MAAM,CAAC,QAAQ;KAC1B,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAAuB,EACvB,QAAY;IAEZ,OAAO;QACL,EAAE,EAAE,QAAQ,CAAC,UAAU;QACvB,QAAQ;QACR,IAAI,EAAE,QAAQ,CAAC,UAAU;QACzB,KAAK,EAAE,QAAQ,CAAC,MAAM;QACtB,MAAM,EAAE,GAAG;QACX,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,SAAS,EAAE,QAAQ,CAAC,WAAW,CAAC,WAAW,EAAe;QAC1D,QAAQ,EAAE,QAAQ,CAAC,QAAQ;KAC5B,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,eAAe,GAA6F;IAChH,IAAI,EAAE,UAAU,CAAC,IAAI;IACrB,KAAK,EAAE,UAAU,CAAC,KAAK;IACvB,MAAM,EAAE,UAAU,CAAC,MAAM;IACzB,OAAO,EAAE,UAAU,CAAC,OAAO;IAC3B,WAAW,EAAE,UAAU,CAAC,WAAW;IACnC,QAAQ,EAAE,UAAU,CAAC,QAAQ;CAC9B,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAc,EACd,aAAmF,SAAS;IAE5F,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,EAAE;QACnB,OAAO,EAAE,MAAM,CAAC,QAAQ;QACxB,aAAa,EAAE,MAAM,CAAC,EAAE,EAAE,gDAAgD;QAC1E,MAAM,EAAE,MAAM,CAAC,IAAI;QACnB,UAAU,EAAE,eAAe,CAAC,UAAU,CAAC;QACvC,OAAO,EAAE;YACP,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,GAAG,MAAM,CAAC,OAAO;SAClB;QACD,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;KACtC,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,0CAA0C;AAC1C,gFAAgF;AAEhF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE;IACxB,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;IAC1B,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;IAC1B,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;IAC1B,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;IAC1B,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE;CACnB,CAAC;AAEX;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAe;IAChD,MAAM,OAAO,GAAG,IAAI,IAAI,EAA6C,CAAC;IACtE,OAAO,0BAA0B,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC;AACjD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAe;IAChD,MAAM,OAAO,GAAG,IAAI,IAAI,EAA6C,CAAC;IACtE,OAAO,0BAA0B,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC;AACjD,CAAC"}

package/dist/common/canonical-json.d.ts

@@ -0,0 +1,64 @@
+/**
+ * Canonical JSON Serialization
+ *
+ * Provides deterministic JSON serialization for cryptographic operations.
+ * Standard JSON.stringify is NOT deterministic - object key order can vary
+ * between environments and runtimes, causing hash mismatches.
+ *
+ * This module ensures:
+ * - Object keys are always sorted alphabetically (recursive)
+ * - Arrays maintain their order (not sorted)
+ * - Consistent handling of special values (null, undefined)
+ * - No whitespace or formatting variations
+ *
+ * @packageDocumentation
+ */
+/**
+ * Convert an object to a canonical (deterministic) JSON string
+ *
+ * This function guarantees that the same logical object will always
+ * produce the exact same string output, regardless of:
+ * - The order in which keys were defined
+ * - The JavaScript runtime or version
+ * - How the object was constructed
+ *
+ * IMPORTANT: Use this for all cryptographic hash calculations
+ * where consistency is required across different systems.
+ *
+ * @param obj - The object to serialize
+ * @returns Deterministic JSON string with sorted keys
+ *
+ * @example
+ * ```typescript
+ * // These produce the same output
+ * canonicalize({ b: 1, a: 2 }); // '{"a":2,"b":1}'
+ * canonicalize({ a: 2, b: 1 }); // '{"a":2,"b":1}'
+ *
+ * // Nested objects are also sorted
+ * canonicalize({ z: { y: 1, x: 2 }, a: 3 });
+ * // '{"a":3,"z":{"x":2,"y":1}}'
+ * ```
+ */
+export declare function canonicalize(obj: unknown): string;
+/**
+ * Compare two objects for canonical equality
+ *
+ * Two objects are canonically equal if their canonical JSON
+ * representations are identical.
+ *
+ * @param a - First object to compare
+ * @param b - Second object to compare
+ * @returns true if objects are canonically equal
+ */
+export declare function canonicalEquals(a: unknown, b: unknown): boolean;
+/**
+ * Compute a hash-ready string from an object
+ *
+ * This is a convenience function that combines canonicalization
+ * with encoding preparation for hash functions.
+ *
+ * @param obj - The object to prepare for hashing
+ * @returns UTF-8 encoded canonical JSON as Uint8Array
+ */
+export declare function canonicalizeForHash(obj: unknown): Uint8Array;
+//# sourceMappingURL=canonical-json.d.ts.map

package/dist/common/canonical-json.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical-json.d.ts","sourceRoot":"","sources":["../../src/common/canonical-json.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AA6BH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAGjD;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,GAAG,OAAO,CAE/D;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,UAAU,CAG5D"}

package/dist/common/canonical-json.js

@@ -0,0 +1,95 @@
+/**
+ * Canonical JSON Serialization
+ *
+ * Provides deterministic JSON serialization for cryptographic operations.
+ * Standard JSON.stringify is NOT deterministic - object key order can vary
+ * between environments and runtimes, causing hash mismatches.
+ *
+ * This module ensures:
+ * - Object keys are always sorted alphabetically (recursive)
+ * - Arrays maintain their order (not sorted)
+ * - Consistent handling of special values (null, undefined)
+ * - No whitespace or formatting variations
+ *
+ * @packageDocumentation
+ */
+/**
+ * Recursively sort object keys and create a canonical representation
+ *
+ * @param obj - The object to canonicalize
+ * @returns A new object with recursively sorted keys
+ */
+function sortObjectKeys(obj) {
+    if (obj === null || obj === undefined) {
+        return obj;
+    }
+    if (Array.isArray(obj)) {
+        return obj.map(sortObjectKeys);
+    }
+    if (typeof obj === 'object' && obj !== null) {
+        const sorted = {};
+        const keys = Object.keys(obj).sort();
+        for (const key of keys) {
+            sorted[key] = sortObjectKeys(obj[key]);
+        }
+        return sorted;
+    }
+    return obj;
+}
+/**
+ * Convert an object to a canonical (deterministic) JSON string
+ *
+ * This function guarantees that the same logical object will always
+ * produce the exact same string output, regardless of:
+ * - The order in which keys were defined
+ * - The JavaScript runtime or version
+ * - How the object was constructed
+ *
+ * IMPORTANT: Use this for all cryptographic hash calculations
+ * where consistency is required across different systems.
+ *
+ * @param obj - The object to serialize
+ * @returns Deterministic JSON string with sorted keys
+ *
+ * @example
+ * ```typescript
+ * // These produce the same output
+ * canonicalize({ b: 1, a: 2 }); // '{"a":2,"b":1}'
+ * canonicalize({ a: 2, b: 1 }); // '{"a":2,"b":1}'
+ *
+ * // Nested objects are also sorted
+ * canonicalize({ z: { y: 1, x: 2 }, a: 3 });
+ * // '{"a":3,"z":{"x":2,"y":1}}'
+ * ```
+ */
+export function canonicalize(obj) {
+    const sorted = sortObjectKeys(obj);
+    return JSON.stringify(sorted);
+}
+/**
+ * Compare two objects for canonical equality
+ *
+ * Two objects are canonically equal if their canonical JSON
+ * representations are identical.
+ *
+ * @param a - First object to compare
+ * @param b - Second object to compare
+ * @returns true if objects are canonically equal
+ */
+export function canonicalEquals(a, b) {
+    return canonicalize(a) === canonicalize(b);
+}
+/**
+ * Compute a hash-ready string from an object
+ *
+ * This is a convenience function that combines canonicalization
+ * with encoding preparation for hash functions.
+ *
+ * @param obj - The object to prepare for hashing
+ * @returns UTF-8 encoded canonical JSON as Uint8Array
+ */
+export function canonicalizeForHash(obj) {
+    const canonical = canonicalize(obj);
+    return new TextEncoder().encode(canonical);
+}
+//# sourceMappingURL=canonical-json.js.map

package/dist/common/canonical-json.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical-json.js","sourceRoot":"","sources":["../../src/common/canonical-json.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;;;;GAKG;AACH,SAAS,cAAc,CAAC,GAAY;IAClC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtC,OAAO,GAAG,CAAC;IACb,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACjC,CAAC;IAED,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QAC5C,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAA8B,CAAC,CAAC,IAAI,EAAE,CAAC;QAChE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,CAAC,GAAG,CAAC,GAAG,cAAc,CAAE,GAA+B,CAAC,GAAG,CAAC,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,YAAY,CAAC,GAAY;IACvC,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACnC,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,CAAU,EAAE,CAAU;IACpD,OAAO,YAAY,CAAC,CAAC,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAY;IAC9C,MAAM,SAAS,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACpC,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AAC7C,CAAC"}