attenu-guard 0.1.0 → 0.2.0

package/dist/esm/canonical.d.ts

@@ -1,30 +1,19 @@
-/**
- * canonical.ts — byte-exact interoperability with the Python implementation.
- *
- * Every hash, seal and signature in Attenu is taken over a canonical JSON
- * serialisation. The Python library produces those bytes with
- * `json.dumps(obj, sort_keys=True, separators=(",", ":"))`, whose defaults
- * include `ensure_ascii=True`. `JSON.stringify` differs from that in three
- * ways that would each silently break cross-language verification:
- *
- *   1. key order — `JSON.stringify` preserves insertion order, Python sorts;
- *   2. non-ASCII — Python escapes every code point above U+007E as `\uXXXX`
- *      (astral characters as a surrogate pair), `JSON.stringify` emits them raw;
- *   3. numbers — Python distinguishes `int` from `float` (`100` vs `100.0`) and
- *      switches to exponential notation at different magnitudes than JavaScript
- *      (`1e-05` where `String()` gives `0.00001`).
- *
- * (1) and (2) are handled by `canonicalJson` below. (3) cannot be solved by a
- * serialiser alone, because a JavaScript `number` has forgotten whether the
- * document said `100` or `100.0`. So a document that is going to be re-hashed —
- * a ledger or a bundle produced elsewhere — is read with `parseJson`, which
- * keeps each number's original literal alongside its value as a `RawNumber`.
- * `canonicalJson` re-emits that literal verbatim, so a Python-written entry
- * hashes to the byte-identical digest here. Values created in this library are
- * plain numbers, and `pyNumber` formats them the way Python's `json` would, so
- * the reverse direction round-trips too.
- */
-/** A number as it was written in the source document, plus its parsed value. */
+/** RFC 8785 JSON Canonicalization Scheme (JCS), with no runtime dependencies. */
+export declare class CanonicalizationError extends Error {
+    constructor(message: string);
+}
+export declare class NonFiniteNumberError extends CanonicalizationError {
+}
+export declare class LoneSurrogateError extends CanonicalizationError {
+}
+export declare class UnsupportedTypeError extends CanonicalizationError {
+}
+/** Raised while parsing when an object repeats a member name. */
+export declare class DuplicateMemberError extends SyntaxError {
+    readonly member: string;
+    constructor(member: string);
+}
+/** A parsed JSON number, retaining its source spelling for syntax-sensitive checks. */
 export declare class RawNumber {
     readonly raw: string;
     readonly value: number;
@@ -32,60 +21,23 @@ export declare class RawNumber {
     valueOf(): number;
     toJSON(): number;
 }
-/** A JSON value that may still carry original number literals. */
 export type CJson = null | boolean | number | string | RawNumber | CJson[] | {
     [key: string]: CJson;
 };
-/** A plain JSON value — what the rest of the library works with. */
 export type Json = null | boolean | number | string | Json[] | {
     [key: string]: Json;
 };
-/** Compare two strings by Unicode code point, as Python's `sorted` does. */
+/** Compare by Unicode code point for semantic lists that mirror Python `sorted`. */
 export declare function compareCodePoints(a: string, b: string): number;
-/** Sort strings by code point (Python's `sorted(list_of_str)`). */
 export declare function sortedStrings(values: Iterable<string>): string[];
-/**
- * Format a number the way Python's `json.dumps` would.
- *
- * Integral values are emitted without a decimal point, matching a Python `int`.
- * A TypeScript number cannot record that it was meant to be the float `100.0`,
- * so such a value serialises as `100`; Python reads that back as an `int` and
- * re-emits `100`, which keeps the chain verifiable in both directions. Values
- * with a fractional part follow CPython's `repr`: shortest round-tripping
- * digits, exponential notation when the decimal exponent is below -4 or at
- * least 16, a two-digit signed exponent, and always a decimal point otherwise.
- */
+/** Python-style numeric display used only in human-readable ceiling descriptions. */
 export declare function pyNumber(n: number): string;
-/** Escape a string the way Python's `json.dumps(ensure_ascii=True)` does. */
-export declare function pyString(s: string): string;
-/**
- * Serialise to the exact bytes Python's
- * `json.dumps(obj, sort_keys=True, separators=(",", ":"))` produces:
- * sorted keys, no incidental whitespace, ASCII-escaped strings.
- *
- * Object entries whose value is `undefined` are omitted, matching a Python dict
- * that simply never held the key. `null` is kept — it is a value.
- */
+/** Return an RFC 8785 canonical JSON string. */
 export declare function canonicalJson(value: CJson | undefined): string;
-/**
- * Serialise with sorted keys and ASCII escaping, choosing the separators.
- *
- * `canonicalJson` uses the compact `(",", ":")` pair every hash is taken over.
- * The `.jsonl` ledger on disk is written with Python's DEFAULT separators
- * (`", "` and `": "`), so a line read back by either language re-serialises to
- * the same bytes its writer produced.
- */
-export declare function pyJsonDumps(value: CJson | undefined, itemSeparator?: string, keySeparator?: string): string;
-/** The canonical bytes — what every hash, seal and signature is taken over. */
+/** The canonical UTF-8 bytes used by every hash, seal, and signature. */
 export declare function canonicalBytes(value: CJson | undefined): Buffer;
 /** Strip `RawNumber` wrappers, yielding ordinary JavaScript values. */
 export declare function toPlain<T = Json>(value: CJson | undefined): T;
-/**
- * Parse JSON, keeping every number's original literal.
- *
- * `JSON.parse` is not used: it discards the literal, and with it the ability to
- * reproduce the bytes the writer hashed. Objects preserve their key order for
- * readability; canonical serialisation sorts them anyway.
- */
+/** Parse JSON without losing number spellings, while rejecting duplicates. */
 export declare function parseJson(text: string): CJson;
 //# sourceMappingURL=canonical.d.ts.map

package/dist/esm/canonical.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"canonical.d.ts","sourceRoot":"","sources":["../../src/canonical.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,gFAAgF;AAChF,qBAAa,SAAS;IAElB,QAAQ,CAAC,GAAG,EAAE,MAAM;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM;gBADb,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM;IAExB,OAAO,IAAI,MAAM;IAGjB,MAAM,IAAI,MAAM;CAGjB;AAED,kEAAkE;AAClE,MAAM,MAAM,KAAK,GACb,IAAI,GACJ,OAAO,GACP,MAAM,GACN,MAAM,GACN,SAAS,GACT,KAAK,EAAE,GACP;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,KAAK,CAAA;CAAE,CAAC;AAE7B,oEAAoE;AACpE,MAAM,MAAM,IAAI,GAAG,IAAI,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,EAAE,GAAG;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;AAEvF,4EAA4E;AAC5E,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAU9D;AAED,mEAAmE;AACnE,wBAAgB,aAAa,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAEhE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,QAAQ,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAM1C;AA2BD,6EAA6E;AAC7E,wBAAgB,QAAQ,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAgB1C;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,KAAK,GAAG,SAAS,GAAG,MAAM,CAE9D;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,CACzB,KAAK,EAAE,KAAK,GAAG,SAAS,EACxB,aAAa,SAAO,EACpB,YAAY,SAAO,GAClB,MAAM,CAwBR;AAED,+EAA+E;AAC/E,wBAAgB,cAAc,CAAC,KAAK,EAAE,KAAK,GAAG,SAAS,GAAG,MAAM,CAE/D;AAED,uEAAuE;AACvE,wBAAgB,OAAO,CAAC,CAAC,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,SAAS,GAAG,CAAC,CAS7D;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,CAO7C"}
+{"version":3,"file":"canonical.d.ts","sourceRoot":"","sources":["../../src/canonical.ts"],"names":[],"mappings":"AAAA,iFAAiF;AAEjF,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,oBAAqB,SAAQ,qBAAqB;CAAG;AAClE,qBAAa,kBAAmB,SAAQ,qBAAqB;CAAG;AAChE,qBAAa,oBAAqB,SAAQ,qBAAqB;CAAG;AAElE,iEAAiE;AACjE,qBAAa,oBAAqB,SAAQ,WAAW;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM;gBAAd,MAAM,EAAE,MAAM;CAIpC;AAED,uFAAuF;AACvF,qBAAa,SAAS;IAElB,QAAQ,CAAC,GAAG,EAAE,MAAM;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM;gBADb,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM;IAExB,OAAO,IAAI,MAAM;IAGjB,MAAM,IAAI,MAAM;CAGjB;AAED,MAAM,MAAM,KAAK,GACb,IAAI,GACJ,OAAO,GACP,MAAM,GACN,MAAM,GACN,SAAS,GACT,KAAK,EAAE,GACP;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,KAAK,CAAA;CAAE,CAAC;AAE7B,MAAM,MAAM,IAAI,GAAG,IAAI,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,EAAE,GAAG;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;AAEvF,oFAAoF;AACpF,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAU9D;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAEhE;AAED,qFAAqF;AACrF,wBAAgB,QAAQ,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAsB1C;AAuGD,gDAAgD;AAChD,wBAAgB,aAAa,CAAC,KAAK,EAAE,KAAK,GAAG,SAAS,GAAG,MAAM,CAE9D;AAED,yEAAyE;AACzE,wBAAgB,cAAc,CAAC,KAAK,EAAE,KAAK,GAAG,SAAS,GAAG,MAAM,CAE/D;AAED,uEAAuE;AACvE,wBAAgB,OAAO,CAAC,CAAC,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,SAAS,GAAG,CAAC,CAgB7D;AAED,8EAA8E;AAC9E,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,CAO7C"}

package/dist/esm/canonical.js

@@ -1,30 +1,26 @@
-/**
- * canonical.ts — byte-exact interoperability with the Python implementation.
- *
- * Every hash, seal and signature in Attenu is taken over a canonical JSON
- * serialisation. The Python library produces those bytes with
- * `json.dumps(obj, sort_keys=True, separators=(",", ":"))`, whose defaults
- * include `ensure_ascii=True`. `JSON.stringify` differs from that in three
- * ways that would each silently break cross-language verification:
- *
- *   1. key order — `JSON.stringify` preserves insertion order, Python sorts;
- *   2. non-ASCII — Python escapes every code point above U+007E as `\uXXXX`
- *      (astral characters as a surrogate pair), `JSON.stringify` emits them raw;
- *   3. numbers — Python distinguishes `int` from `float` (`100` vs `100.0`) and
- *      switches to exponential notation at different magnitudes than JavaScript
- *      (`1e-05` where `String()` gives `0.00001`).
- *
- * (1) and (2) are handled by `canonicalJson` below. (3) cannot be solved by a
- * serialiser alone, because a JavaScript `number` has forgotten whether the
- * document said `100` or `100.0`. So a document that is going to be re-hashed —
- * a ledger or a bundle produced elsewhere — is read with `parseJson`, which
- * keeps each number's original literal alongside its value as a `RawNumber`.
- * `canonicalJson` re-emits that literal verbatim, so a Python-written entry
- * hashes to the byte-identical digest here. Values created in this library are
- * plain numbers, and `pyNumber` formats them the way Python's `json` would, so
- * the reverse direction round-trips too.
- */
-/** A number as it was written in the source document, plus its parsed value. */
+/** RFC 8785 JSON Canonicalization Scheme (JCS), with no runtime dependencies. */
+export class CanonicalizationError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = new.target.name;
+    }
+}
+export class NonFiniteNumberError extends CanonicalizationError {
+}
+export class LoneSurrogateError extends CanonicalizationError {
+}
+export class UnsupportedTypeError extends CanonicalizationError {
+}
+/** Raised while parsing when an object repeats a member name. */
+export class DuplicateMemberError extends SyntaxError {
+    member;
+    constructor(member) {
+        super(`duplicate JSON object member ${JSON.stringify(member)}`);
+        this.member = member;
+        this.name = "DuplicateMemberError";
+    }
+}
+/** A parsed JSON number, retaining its source spelling for syntax-sensitive checks. */
 export class RawNumber {
     raw;
     value;
@@ -39,7 +35,7 @@ export class RawNumber {
         return this.value;
     }
 }
-/** Compare two strings by Unicode code point, as Python's `sorted` does. */
+/** Compare by Unicode code point for semantic lists that mirror Python `sorted`. */
 export function compareCodePoints(a, b) {
     const ca = Array.from(a);
     const cb = Array.from(b);
@@ -52,21 +48,10 @@ export function compareCodePoints(a, b) {
     }
     return ca.length - cb.length;
 }
-/** Sort strings by code point (Python's `sorted(list_of_str)`). */
 export function sortedStrings(values) {
     return Array.from(values).sort(compareCodePoints);
 }
-/**
- * Format a number the way Python's `json.dumps` would.
- *
- * Integral values are emitted without a decimal point, matching a Python `int`.
- * A TypeScript number cannot record that it was meant to be the float `100.0`,
- * so such a value serialises as `100`; Python reads that back as an `int` and
- * re-emits `100`, which keeps the chain verifiable in both directions. Values
- * with a fractional part follow CPython's `repr`: shortest round-tripping
- * digits, exponential notation when the decimal exponent is below -4 or at
- * least 16, a two-digit signed exponent, and always a decimal point otherwise.
- */
+/** Python-style numeric display used only in human-readable ceiling descriptions. */
 export function pyNumber(n) {
     if (Number.isNaN(n))
         return "NaN";
@@ -76,22 +61,15 @@ export function pyNumber(n) {
         return "-0.0";
     if (Number.isInteger(n) && Math.abs(n) < 1e21)
         return n.toFixed(0);
-    return pyFloatRepr(n);
-}
-function pyFloatRepr(n) {
-    // `toExponential()` with no argument yields the shortest digit string that
-    // uniquely identifies the value — the same "shortest round-trip" digits
-    // CPython's repr produces. Only the layout around them differs.
     const parsed = /^(-?)(\d)(?:\.(\d+))?e([+-]\d+)$/.exec(n.toExponential());
     if (!parsed)
-        return String(n); // unreachable for a finite double
+        return String(n);
     const sign = parsed[1];
     const digits = parsed[2] + (parsed[3] ?? "");
     const exp = parseInt(parsed[4], 10);
     if (exp < -4 || exp >= 16) {
         const mantissa = digits.length > 1 ? `${digits[0]}.${digits.slice(1)}` : digits;
-        const expSign = exp < 0 ? "-" : "+";
-        return `${sign}${mantissa}e${expSign}${String(Math.abs(exp)).padStart(2, "0")}`;
+        return `${sign}${mantissa}e${exp < 0 ? "-" : "+"}${String(Math.abs(exp)).padStart(2, "0")}`;
     }
     if (exp >= 0) {
         const body = digits.length > exp + 1
@@ -101,76 +79,112 @@ function pyFloatRepr(n) {
     }
     return `${sign}0.${"0".repeat(-exp - 1)}${digits}`;
 }
-/** Escape a string the way Python's `json.dumps(ensure_ascii=True)` does. */
-export function pyString(s) {
-    let out = '"';
-    for (let i = 0; i < s.length; i++) {
-        const ch = s[i];
-        const code = s.charCodeAt(i);
-        if (ch === '"')
-            out += '\\"';
-        else if (ch === "\\")
-            out += "\\\\";
-        else if (code === 0x08)
-            out += "\\b";
-        else if (code === 0x09)
-            out += "\\t";
-        else if (code === 0x0a)
-            out += "\\n";
-        else if (code === 0x0c)
-            out += "\\f";
-        else if (code === 0x0d)
-            out += "\\r";
-        else if (code < 0x20 || code > 0x7e)
-            out += "\\u" + code.toString(16).padStart(4, "0");
-        else
-            out += ch;
+function validateUnicode(value) {
+    for (let i = 0; i < value.length; i++) {
+        const unit = value.charCodeAt(i);
+        if (unit >= 0xd800 && unit <= 0xdbff) {
+            const next = value.charCodeAt(i + 1);
+            if (!(next >= 0xdc00 && next <= 0xdfff)) {
+                throw new LoneSurrogateError("lone UTF-16 surrogates are not permitted");
+            }
+            i += 1;
+        }
+        else if (unit >= 0xdc00 && unit <= 0xdfff) {
+            throw new LoneSurrogateError("lone UTF-16 surrogates are not permitted");
+        }
     }
-    return out + '"';
 }
-/**
- * Serialise to the exact bytes Python's
- * `json.dumps(obj, sort_keys=True, separators=(",", ":"))` produces:
- * sorted keys, no incidental whitespace, ASCII-escaped strings.
- *
- * Object entries whose value is `undefined` are omitted, matching a Python dict
- * that simply never held the key. `null` is kept — it is a value.
- */
-export function canonicalJson(value) {
-    return pyJsonDumps(value, ",", ":");
+function jcsString(value) {
+    validateUnicode(value);
+    return JSON.stringify(value);
+}
+function jcsNumber(value) {
+    if (!Number.isFinite(value)) {
+        throw new NonFiniteNumberError("non-finite numbers are not permitted");
+    }
+    return JSON.stringify(value);
+}
+function unsupported(value) {
+    const kind = value === null ? "null" : typeof value;
+    throw new UnsupportedTypeError(`not a supported JSON value: ${kind}`);
 }
-/**
- * Serialise with sorted keys and ASCII escaping, choosing the separators.
- *
- * `canonicalJson` uses the compact `(",", ":")` pair every hash is taken over.
- * The `.jsonl` ledger on disk is written with Python's DEFAULT separators
- * (`", "` and `": "`), so a line read back by either language re-serialises to
- * the same bytes its writer produced.
- */
-export function pyJsonDumps(value, itemSeparator = ", ", keySeparator = ": ") {
-    if (value === null || value === undefined)
+function serialize(value, active) {
+    if (value === null)
         return "null";
     if (value instanceof RawNumber)
-        return value.raw;
+        return jcsNumber(value.value);
     switch (typeof value) {
         case "boolean":
             return value ? "true" : "false";
         case "number":
-            return pyNumber(value);
+            return jcsNumber(value);
         case "string":
-            return pyString(value);
+            return jcsString(value);
+        case "undefined":
+        case "bigint":
+        case "symbol":
+        case "function":
+            return unsupported(value);
     }
-    if (Array.isArray(value)) {
-        return ("[" + value.map((v) => pyJsonDumps(v, itemSeparator, keySeparator)).join(itemSeparator) + "]");
+    if (active.has(value))
+        throw new UnsupportedTypeError("cyclic JSON values are not permitted");
+    active.add(value);
+    try {
+        if (Array.isArray(value)) {
+            const own = Reflect.ownKeys(value);
+            for (const key of own) {
+                if (key === "length")
+                    continue;
+                if (typeof key !== "string" || !/^(?:0|[1-9]\d*)$/.test(key) || Number(key) >= value.length) {
+                    throw new UnsupportedTypeError("JSON arrays may not carry extra properties");
+                }
+            }
+            const items = [];
+            for (let i = 0; i < value.length; i++) {
+                if (!Object.prototype.hasOwnProperty.call(value, i)) {
+                    throw new UnsupportedTypeError("sparse JSON arrays are not permitted");
+                }
+                const descriptor = Object.getOwnPropertyDescriptor(value, String(i));
+                if (!descriptor.enumerable || !("value" in descriptor)) {
+                    throw new UnsupportedTypeError("JSON arrays may contain only enumerable data elements");
+                }
+                items.push(serialize(descriptor.value, active));
+            }
+            return `[${items.join(",")}]`;
+        }
+        const prototype = Object.getPrototypeOf(value);
+        if (prototype !== Object.prototype && prototype !== null) {
+            throw new UnsupportedTypeError("only plain JSON objects are permitted");
+        }
+        const symbols = Object.getOwnPropertySymbols(value);
+        if (symbols.length > 0)
+            throw new UnsupportedTypeError("JSON object member names must be strings");
+        const keys = Object.getOwnPropertyNames(value);
+        const members = new Map();
+        for (const key of keys) {
+            validateUnicode(key);
+            const descriptor = Object.getOwnPropertyDescriptor(value, key);
+            if (!descriptor.enumerable || !("value" in descriptor)) {
+                throw new UnsupportedTypeError("JSON objects may contain only enumerable data properties");
+            }
+            members.set(key, descriptor.value);
+        }
+        // RFC 8785 sorts property names by their raw UTF-16 code units. JavaScript's
+        // default string ordering is exactly that ordering.
+        keys.sort();
+        return `{${keys
+            .map((key) => `${jcsString(key)}:${serialize(members.get(key), active)}`)
+            .join(",")}}`;
     }
-    const keys = sortedStrings(Object.keys(value).filter((k) => value[k] !== undefined));
-    return ("{" +
-        keys
-            .map((k) => `${pyString(k)}${keySeparator}${pyJsonDumps(value[k], itemSeparator, keySeparator)}`)
-            .join(itemSeparator) +
-        "}");
+    finally {
+        active.delete(value);
+    }
+}
+/** Return an RFC 8785 canonical JSON string. */
+export function canonicalJson(value) {
+    return serialize(value, new WeakSet());
 }
-/** The canonical bytes — what every hash, seal and signature is taken over. */
+/** The canonical UTF-8 bytes used by every hash, seal, and signature. */
 export function canonicalBytes(value) {
     return Buffer.from(canonicalJson(value), "utf8");
 }
@@ -179,137 +193,144 @@ export function toPlain(value) {
     if (value instanceof RawNumber)
         return value.value;
     if (Array.isArray(value))
-        return value.map((v) => toPlain(v));
+        return value.map((item) => toPlain(item));
     if (value !== null && typeof value === "object") {
         const out = {};
-        for (const [k, v] of Object.entries(value))
-            out[k] = toPlain(v);
+        for (const [key, item] of Object.entries(value)) {
+            Object.defineProperty(out, key, {
+                value: toPlain(item),
+                enumerable: true,
+                configurable: true,
+                writable: true,
+            });
+        }
         return out;
     }
     return value;
 }
-/**
- * Parse JSON, keeping every number's original literal.
- *
- * `JSON.parse` is not used: it discards the literal, and with it the ability to
- * reproduce the bytes the writer hashed. Objects preserve their key order for
- * readability; canonical serialisation sorts them anyway.
- */
+/** Parse JSON without losing number spellings, while rejecting duplicates. */
 export function parseJson(text) {
-    const p = new Parser(text);
-    p.skipWhitespace();
-    const value = p.parseValue();
-    p.skipWhitespace();
-    if (!p.atEnd())
-        p.fail("unexpected trailing data");
+    const parser = new Parser(text);
+    parser.skipWhitespace();
+    const value = parser.parseValue();
+    parser.skipWhitespace();
+    if (!parser.atEnd())
+        parser.fail("unexpected trailing data");
     return value;
 }
 const NUMBER_RE = /^-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?/;
 class Parser {
-    s;
+    source;
     i = 0;
-    constructor(s) {
-        this.s = s;
+    constructor(source) {
+        this.source = source;
     }
     atEnd() {
-        return this.i >= this.s.length;
+        return this.i >= this.source.length;
     }
     fail(message) {
         throw new SyntaxError(`${message} at position ${this.i}`);
     }
     skipWhitespace() {
-        while (this.i < this.s.length) {
-            const c = this.s[this.i];
-            if (c === " " || c === "\t" || c === "\n" || c === "\r")
-                this.i++;
-            else
-                break;
-        }
+        while (this.i < this.source.length && /[\t\n\r ]/.test(this.source[this.i]))
+            this.i++;
     }
     parseValue() {
         if (this.atEnd())
             this.fail("unexpected end of input");
-        const c = this.s[this.i];
-        if (c === "{")
+        const char = this.source[this.i];
+        if (char === "{")
             return this.parseObject();
-        if (c === "[")
+        if (char === "[")
             return this.parseArray();
-        if (c === '"')
+        if (char === '"')
             return this.parseString();
-        if (this.s.startsWith("true", this.i))
+        if (this.source.startsWith("true", this.i))
             return (this.i += 4), true;
-        if (this.s.startsWith("false", this.i))
+        if (this.source.startsWith("false", this.i))
             return (this.i += 5), false;
-        if (this.s.startsWith("null", this.i))
+        if (this.source.startsWith("null", this.i))
             return (this.i += 4), null;
+        if (this.source.startsWith("NaN", this.i) ||
+            this.source.startsWith("Infinity", this.i) ||
+            this.source.startsWith("-Infinity", this.i)) {
+            throw new NonFiniteNumberError("non-finite numbers are not permitted");
+        }
         return this.parseNumber();
     }
     parseObject() {
-        this.i++; // {
-        const out = {};
+        this.i++;
+        const out = Object.create(null);
         this.skipWhitespace();
-        if (this.s[this.i] === "}")
+        if (this.source[this.i] === "}")
             return this.i++, out;
         for (;;) {
             this.skipWhitespace();
-            if (this.s[this.i] !== '"')
+            if (this.source[this.i] !== '"')
                 this.fail("expected an object key");
             const key = this.parseString();
+            if (Object.prototype.hasOwnProperty.call(out, key))
+                throw new DuplicateMemberError(key);
             this.skipWhitespace();
-            if (this.s[this.i] !== ":")
+            if (this.source[this.i] !== ":")
                 this.fail("expected ':'");
             this.i++;
             this.skipWhitespace();
             out[key] = this.parseValue();
             this.skipWhitespace();
-            const c = this.s[this.i];
-            if (c === ",") {
+            const char = this.source[this.i];
+            if (char === ",") {
                 this.i++;
                 continue;
             }
-            if (c === "}")
+            if (char === "}")
                 return this.i++, out;
             this.fail("expected ',' or '}'");
         }
     }
     parseArray() {
-        this.i++; // [
+        this.i++;
         const out = [];
         this.skipWhitespace();
-        if (this.s[this.i] === "]")
+        if (this.source[this.i] === "]")
             return this.i++, out;
         for (;;) {
             this.skipWhitespace();
             out.push(this.parseValue());
             this.skipWhitespace();
-            const c = this.s[this.i];
-            if (c === ",") {
+            const char = this.source[this.i];
+            if (char === ",") {
                 this.i++;
                 continue;
             }
-            if (c === "]")
+            if (char === "]")
                 return this.i++, out;
             this.fail("expected ',' or ']'");
         }
     }
     parseString() {
-        this.i++; // opening quote
+        this.i++;
         let out = "";
         for (;;) {
             if (this.atEnd())
                 this.fail("unterminated string");
-            const c = this.s[this.i];
-            if (c === '"')
-                return this.i++, out;
-            if (c !== "\\") {
-                out += c;
+            const char = this.source[this.i];
+            if (char === '"') {
+                this.i++;
+                validateUnicode(out);
+                return out;
+            }
+            if (char.charCodeAt(0) < 0x20)
+                this.fail("unescaped control character");
+            if (char !== "\\") {
+                out += char;
                 this.i++;
                 continue;
             }
             this.i++;
-            const esc = this.s[this.i];
+            const escape = this.source[this.i];
             this.i++;
-            switch (esc) {
+            switch (escape) {
                 case '"':
                     out += '"';
                     break;
@@ -335,25 +356,28 @@ class Parser {
                     out += "\t";
                     break;
                 case "u": {
-                    const hex = this.s.slice(this.i, this.i + 4);
+                    const hex = this.source.slice(this.i, this.i + 4);
                     if (!/^[0-9a-fA-F]{4}$/.test(hex))
                         this.fail("bad \\u escape");
                     out += String.fromCharCode(parseInt(hex, 16));
                     this.i += 4;
                     break;
                 }
-                default:
-                    this.fail("bad escape");
+                default: this.fail("bad escape");
             }
         }
     }
     parseNumber() {
-        const m = NUMBER_RE.exec(this.s.slice(this.i));
-        if (!m)
+        const match = NUMBER_RE.exec(this.source.slice(this.i));
+        if (!match)
             this.fail("expected a value");
-        const raw = m[0];
+        const raw = match[0];
         this.i += raw.length;
-        return new RawNumber(raw, Number(raw));
+        const value = Number(raw);
+        if (!Number.isFinite(value)) {
+            throw new NonFiniteNumberError("non-finite numbers are not permitted");
+        }
+        return new RawNumber(raw, value);
     }
 }
 //# sourceMappingURL=canonical.js.map