tersign 0.1.5 → 0.1.6

package/dist/canonical.d.ts

@@ -1,4 +1,11 @@
-/** Deterministic JSON: recursively key-sorted, no whitespace. Arrays keep order.
- * undefined properties are dropped (matches JSON.stringify semantics). */
+/** Deterministic JSON — RFC 8785 (JCS) conformant for JSON-domain inputs: keys sorted by
+ * UTF-16 code units, no whitespace, JSON.stringify scalar/escape semantics. Arrays keep
+ * order; undefined properties are dropped (matches JSON.stringify semantics).
+ *
+ * The string is built directly, never via an object rebuild: JS engines hoist integer-like
+ * keys ("1","2","10") into numeric order on insertion, which silently defeats a
+ * sort-then-stringify round-trip (JCS orders them "1","10","2"). Byte-identical to the old
+ * serializer for every shape without integer-like or control-char keys — the genesis receipt
+ * digest and all pinned wire vectors are unchanged. */
 export declare function canonicalStringify(value: unknown): string;
 export declare function digestOf(value: unknown): `0x${string}`;

package/dist/canonical.js

@@ -1,22 +1,34 @@
 import { keccak256, toBytes } from 'viem';
-/** Deterministic JSON: recursively key-sorted, no whitespace. Arrays keep order.
- * undefined properties are dropped (matches JSON.stringify semantics). */
+/** Deterministic JSON — RFC 8785 (JCS) conformant for JSON-domain inputs: keys sorted by
+ * UTF-16 code units, no whitespace, JSON.stringify scalar/escape semantics. Arrays keep
+ * order; undefined properties are dropped (matches JSON.stringify semantics).
+ *
+ * The string is built directly, never via an object rebuild: JS engines hoist integer-like
+ * keys ("1","2","10") into numeric order on insertion, which silently defeats a
+ * sort-then-stringify round-trip (JCS orders them "1","10","2"). Byte-identical to the old
+ * serializer for every shape without integer-like or control-char keys — the genesis receipt
+ * digest and all pinned wire vectors are unchanged. */
 export function canonicalStringify(value) {
-    return JSON.stringify(sortValue(value));
+    return serialize(value);
 }
-function sortValue(value) {
-    if (Array.isArray(value))
-        return value.map(sortValue);
-    if (value !== null && typeof value === 'object') {
-        const out = {};
-        for (const key of Object.keys(value).sort()) {
-            const v = value[key];
-            if (v !== undefined)
-                out[key] = sortValue(v);
+function serialize(value) {
+    if (value === null)
+        return 'null';
+    if (Array.isArray(value)) {
+        return '[' + Array.from(value, (v) => serialize(v) ?? 'null').join(',') + ']';
+    }
+    if (typeof value === 'object') {
+        const obj = value;
+        const parts = [];
+        for (const key of Object.keys(obj).sort()) {
+            const s = serialize(obj[key]);
+            if (s !== undefined)
+                parts.push(JSON.stringify(key) + ':' + s);
         }
-        return out;
+        return '{' + parts.join(',') + '}';
     }
-    return value;
+    // string/number/boolean serialize per JCS; undefined/function/symbol yield undefined (dropped)
+    return JSON.stringify(value);
 }
 export function digestOf(value) {
     return keccak256(toBytes(canonicalStringify(value)));

package/dist/mcp/server.d.ts

@@ -8,6 +8,6 @@ export declare function envDeps(env?: Record<string, string | undefined>): McpDe
  * every client; mcp.test.ts pins it against package.json so a release bump can't drift it. */
 export declare const MCP_SERVER_IDENTITY: {
     readonly name: "tersign";
-    readonly version: "0.1.5";
+    readonly version: "0.1.6";
 };
 export declare function buildServer(deps: McpDeps): McpServer;

package/dist/mcp/server.js

@@ -45,7 +45,7 @@ function json(value) {
 }
 /** MUST match package.json name/version — the MCP handshake self-reports this identity to
  * every client; mcp.test.ts pins it against package.json so a release bump can't drift it. */
-export const MCP_SERVER_IDENTITY = { name: 'tersign', version: '0.1.5' };
+export const MCP_SERVER_IDENTITY = { name: 'tersign', version: '0.1.6' };
 export function buildServer(deps) {
     const server = new McpServer(MCP_SERVER_IDENTITY);
     server.registerTool('issue_receipt', {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tersign",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "description": "Tersign \u2014 the evidence layer for the agent economy. Counter-signed receipts, agent action records, idempotency enforcement, refunds, disputes, and jury-ready evidence envelopes for x402/agent-commerce sellers.",
   "license": "MIT",
   "type": "module",