json-seal 0.11.2 → 0.12.0

package/README.md

@@ -6,7 +6,6 @@
   <img src="https://img.shields.io/badge/Deterministic%20JSON-RFC%208785%20Compliant-success" alt="Deterministic JSON" />
   <img src="https://img.shields.io/badge/dependencies-0-brightgreen" alt="dependencies" />
   <img src="https://img.shields.io/badge/types-TypeScript-blue" alt="types" />
-  <img src="https://img.shields.io/bundlephobia/minzip/json-seal" alt="bundle size" />
   <img src="https://img.shields.io/github/license/cmyers/json-seal" alt="license" />
 </p>
 

package/dist/canonicalize.js

@@ -24,10 +24,31 @@ export function canonicalize(value) {
 /*  Strings                                                                    */
 /* -------------------------------------------------------------------------- */
 function escapeString(str) {
-    // RFC 8785 uses ECMAScript string escaping rules.
+    // RFC 8785 defines canonicalization in terms of ECMAScript strings (UTF‑16),
+    // but the final canonical form must be encoded as UTF‑8 when serialized.
+    // Therefore we validate UTF‑16 correctness (surrogate pairs) here.
     let out = '"';
     for (let i = 0; i < str.length; i++) {
         const c = str.charCodeAt(i);
+        // Surrogate handling (UTF‑16 correctness)
+        if (c >= 0xd800 && c <= 0xdbff) {
+            // High surrogate: must be followed by a low surrogate
+            if (i + 1 >= str.length) {
+                throw new Error("Invalid UTF‑16: isolated high surrogate");
+            }
+            const d = str.charCodeAt(i + 1);
+            if (d < 0xdc00 || d > 0xdfff) {
+                throw new Error("Invalid UTF‑16: high surrogate not followed by low surrogate");
+            }
+            // Valid surrogate pair → append both as-is
+            out += str[i] + str[i + 1];
+            i++; // skip the low surrogate
+            continue;
+        }
+        else if (c >= 0xdc00 && c <= 0xdfff) {
+            // Low surrogate without preceding high surrogate
+            throw new Error("Invalid UTF‑16: isolated low surrogate");
+        }
         switch (c) {
             case 0x22:
                 out += '\\"';
@@ -75,20 +96,22 @@ function serializeNumber(n) {
     // RFC 8785: -0 must be serialized as 0
     if (Object.is(n, -0))
         return "0";
-    // Use JS number → string, then normalize exponent form
+    // Use JS number → string, then normalize exponent form if present.
+    // JS already produces minimal mantissa/decimal representation.
     let s = n.toString();
-    // Normalize exponent to uppercase E
-    if (s.includes("e")) {
-        const [mantissa, exp] = s.split("e");
-        const sign = exp.startsWith("-") ? "-" : "+";
-        let digits = exp.replace(/^[+-]/, "");
+    // Normalize exponent to RFC 8785 rules
+    const eIndex = s.indexOf("e");
+    if (eIndex !== -1) {
+        const mantissa = s.slice(0, eIndex);
+        let exp = s.slice(eIndex + 1); // after 'e'
+        const negative = exp.startsWith("-");
+        exp = exp.replace(/^[+-]/, "");
         // Remove leading zeros in exponent
-        digits = digits.replace(/^0+/, "");
-        if (digits === "")
-            digits = "0";
+        exp = exp.replace(/^0+/, "");
+        if (exp === "")
+            exp = "0";
         // RFC 8785: exponent must not include "+"
-        const normalized = `${mantissa}E${sign === "-" ? "-" : ""}${digits}`;
-        return normalized;
+        s = `${mantissa}E${negative ? "-" : ""}${exp}`;
     }
     return s;
 }
@@ -106,9 +129,9 @@ function serializeObject(obj) {
     const keys = Object.keys(obj);
     // RFC 8785: duplicate keys MUST be rejected
     detectDuplicateKeys(keys);
-    // Sort by UTF‑16 code units (JS default)
+    // Sort by UTF‑16 code units (JS default), as required by RFC 8785
     keys.sort();
-    const entries = keys.map(k => `${escapeString(k)}:${canonicalize(obj[k])}`);
+    const entries = keys.map((k) => `${escapeString(k)}:${canonicalize(obj[k])}`);
     return `{${entries.join(",")}}`;
 }
 function detectDuplicateKeys(keys) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "json-seal",
-  "version": "0.11.2",
+  "version": "0.12.0",
   "author": "Chris Myers <cmyers2015@outlook.com> (https://www.npmjs.com/~cmyers-dev)",
   "description": "Create cryptographically signed, tamper‑proof JSON backups with zero dependencies.",
   "type": "module",