consiliency-canon-core 0.1.0__tar.gz

consiliency_canon_core-0.1.0/.gitignore

@@ -0,0 +1,5 @@
+# PKG build artifacts
+canon-vectors.json
+/dist/
+/pkg/
+/target/

consiliency_canon_core-0.1.0/Cargo.lock

@@ -0,0 +1,408 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "autocfg"
+version = "1.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
+
+[[package]]
+name = "base64"
+version = "0.22.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
+
+[[package]]
+name = "block-buffer"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "bumpalo"
+version = "3.20.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
+
+[[package]]
+name = "canon-core"
+version = "0.1.0"
+dependencies = [
+ "base64",
+ "hex",
+ "num-bigint",
+ "pyo3",
+ "serde_json",
+ "sha2",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+
+[[package]]
+name = "cpufeatures"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "crypto-common"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
+dependencies = [
+ "generic-array",
+ "typenum",
+]
+
+[[package]]
+name = "digest"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
+dependencies = [
+ "block-buffer",
+ "crypto-common",
+]
+
+[[package]]
+name = "generic-array"
+version = "0.14.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
+dependencies = [
+ "typenum",
+ "version_check",
+]
+
+[[package]]
+name = "heck"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
+
+[[package]]
+name = "hex"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
+
+[[package]]
+name = "indoc"
+version = "2.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "79cf5c93f93228cf8efb3ba362535fb11199ac548a09ce117c9b1adc3030d706"
+dependencies = [
+ "rustversion",
+]
+
+[[package]]
+name = "itoa"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
+
+[[package]]
+name = "libc"
+version = "0.2.186"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
+
+[[package]]
+name = "memchr"
+version = "2.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "88904434abc2901f197fe8cc55f0445e7ded921dba5911dad2e2b39b48e663c4"
+
+[[package]]
+name = "memoffset"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "488016bfae457b036d996092f6cb448677611ce4449e970ceaf42695203f218a"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "num-bigint"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a5e44f723f1133c9deac646763579fdb3ac745e418f2a7af9cd0c431da1f20b9"
+dependencies = [
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-integer"
+version = "0.1.46"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7969661fd2958a5cb096e56c8e1ad0444ac2bbcd0061bd28660485a44879858f"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "num-traits"
+version = "0.2.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.21.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
+
+[[package]]
+name = "portable-atomic"
+version = "1.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c33a9471896f1c69cecef8d20cbe2f7accd12527ce60845ff44c153bb2a21b49"
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.106"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "pyo3"
+version = "0.23.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7778bffd85cf38175ac1f545509665d0b9b92a198ca7941f131f85f7a4f9a872"
+dependencies = [
+ "cfg-if",
+ "indoc",
+ "libc",
+ "memoffset",
+ "once_cell",
+ "portable-atomic",
+ "pyo3-build-config",
+ "pyo3-ffi",
+ "pyo3-macros",
+ "unindent",
+]
+
+[[package]]
+name = "pyo3-build-config"
+version = "0.23.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94f6cbe86ef3bf18998d9df6e0f3fc1050a8c5efa409bf712e661a4366e010fb"
+dependencies = [
+ "once_cell",
+ "target-lexicon",
+]
+
+[[package]]
+name = "pyo3-ffi"
+version = "0.23.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e9f1b4c431c0bb1c8fb0a338709859eed0d030ff6daa34368d3b152a63dfdd8d"
+dependencies = [
+ "libc",
+ "pyo3-build-config",
+]
+
+[[package]]
+name = "pyo3-macros"
+version = "0.23.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fbc2201328f63c4710f68abdf653c89d8dbc2858b88c5d88b0ff38a75288a9da"
+dependencies = [
+ "proc-macro2",
+ "pyo3-macros-backend",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "pyo3-macros-backend"
+version = "0.23.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fca6726ad0f3da9c9de093d6f116a93c1a38e417ed73bf138472cf4064f72028"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "pyo3-build-config",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.46"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dfbc457d0c7a0759a614551b11a6409e5951f6c7537be1f1b7682b9ae9230368"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "rustversion"
+version = "1.0.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
+
+[[package]]
+name = "serde"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.150"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e8014e44b4736ed0538adeecded0fce2a272f22dc9578a7eb6b2d9993c74cfb9"
+dependencies = [
+ "itoa",
+ "memchr",
+ "serde",
+ "serde_core",
+ "zmij",
+]
+
+[[package]]
+name = "sha2"
+version = "0.10.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
+[[package]]
+name = "syn"
+version = "2.0.118"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b9ae57f904213ebb649ce6895b8a66c66f0203b9319718f69a5612a065b1422"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "target-lexicon"
+version = "0.12.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "61c41af27dd6d1e27b1b16b489db798443478cef1f06a660c96db617ba5de3b1"
+
+[[package]]
+name = "typenum"
+version = "1.20.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
+
+[[package]]
+name = "unindent"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7264e107f553ccae879d21fbea1d6724ac785e8c3bfc762137959b5802826ef3"
+
+[[package]]
+name = "version_check"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
+
+[[package]]
+name = "wasm-bindgen"
+version = "0.2.126"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4b067c0c11094aef6b7a801c1e34a26affafdf3d051dba08456b868789aaf9a4"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+ "rustversion",
+ "wasm-bindgen-macro",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-macro"
+version = "0.2.126"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "167ce5e579f6bcf889c4f7175a8a5a585de84e8ff93976ce393efa5f2837aab1"
+dependencies = [
+ "quote",
+ "wasm-bindgen-macro-support",
+]
+
+[[package]]
+name = "wasm-bindgen-macro-support"
+version = "0.2.126"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3997c7839262f4ef12cf90b818d6340c18e80f263f1a94bf157d0ec4420380e"
+dependencies = [
+ "bumpalo",
+ "proc-macro2",
+ "quote",
+ "syn",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-shared"
+version = "0.2.126"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc1b4cb0cc549fcf58d7dfc081778139b3d283a081644e833e84682ad71cea24"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "zmij"
+version = "1.0.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8848ee67ecc8aedbaf3e4122217aff892639231befc6a1b58d29fff4c2cabaa"

consiliency_canon_core-0.1.0/Cargo.toml

@@ -0,0 +1,23 @@
+[package]
+name = "canon-core"
+version = "0.1.0"
+edition = "2021"
+license = "MIT"
+
+[lib]
+name = "canon_core"
+crate-type = ["rlib", "cdylib"]
+
+[features]
+default = []
+pyo3-binding = ["dep:pyo3"]
+wasm-binding = ["dep:wasm-bindgen"]
+
+[dependencies]
+base64 = "0.22"
+hex = "0.4"
+num-bigint = "0.4"
+serde_json = "1"
+sha2 = "0.10"
+pyo3 = { version = "0.23", features = ["extension-module"], optional = true }
+wasm-bindgen = { version = "0.2", optional = true }

consiliency_canon_core-0.1.0/Makefile.packaging

@@ -0,0 +1,38 @@
+# PKG (GP-canon chapter): dual-build canon-core for PyPI (maturin) + npm (wasm-pack).
+# The shared conformance corpus is staged into the crate dir so both artifacts ship it.
+#
+# Prereqs: rustup, maturin (pipx install maturin), wasm-pack (cargo install wasm-pack).
+# Publish is done by CI (publish-canon-core.yml) via OIDC — these targets are for local
+# build + verification.
+
+SCOPE      := consiliency
+NPM_NAME   := @$(SCOPE)/canon-core
+CORPUS_SRC := ../vectors/canon-vectors.json
+CORPUS     := canon-vectors.json
+
+.PHONY: all stage-corpus wheel wasm verify clean
+
+all: wheel wasm
+
+# Stage the shared corpus into the crate dir so maturin `include` + wasm pkg can ship it.
+stage-corpus:
+	cp $(CORPUS_SRC) $(CORPUS)
+
+# PyPI wheel (pyo3 extension module `canon_core`).
+wheel: stage-corpus
+	maturin build --release --features pyo3-binding --manifest-path Cargo.toml --out dist
+
+# npm package @consiliency/canon-core, Node target (gp consumes this), wasm-binding feature.
+# Corpus copied into the generated pkg/ so `@consiliency/canon-core/canon-vectors.json` resolves.
+wasm: stage-corpus
+	wasm-pack build --release --scope $(SCOPE) --target nodejs --out-dir pkg -- --features wasm-binding
+	cp $(CORPUS) pkg/$(CORPUS)
+
+# Local parity smoke: the built wheel + wasm pkg must reproduce the corpus bytes/digests.
+# (Full cross-engine gate is GATE phase: conformance/check_xg4_canon_core.sh extended to run
+# the BUILT artifacts, not cargo check.)
+verify:
+	@echo "run: python -c 'import canon_core; ...'  and  node -e 'require(\"./pkg\")...'  against $(CORPUS)"
+
+clean:
+	rm -rf dist pkg target $(CORPUS)

consiliency_canon_core-0.1.0/PACKAGING.md

@@ -0,0 +1,23 @@
+# canon-core packaging (PKG)
+
+Dual-published canonicalization engine — the shared byte/digest truth every Consiliency
+certificate hashes. Same Rust engine (`src/lib.rs`), two distributions:
+
+| Distribution | Tool | Name | Consumer | Entry points |
+|---|---|---|---|---|
+| PyPI | maturin (`pyproject.toml`) | `consiliency-canon-core` (imports as `canon_core`) | Python | `canonical_bytes_from_json(tagged_json)`, `digest_from_json(tagged_json, profile)` |
+| npm | wasm-pack (`Makefile.packaging`) | `@consiliency/canon-core` (Node target) | governed-pipeline (JS) | `canonicalBytesFromJson(taggedJson)`, `digestFromJson(taggedJson, profile)` |
+
+**Surface is tagged-JSON *text*, not a raw value** — this is load-bearing for byte-identity:
+a lone surrogate serializes to the ASCII escape `\ud800`, survives UTF-8 marshalling, and
+`serde_json` rejects it at parse (SPEC §5.0). Consumers MUST feed tagged-JSON text produced
+by a validating encoder, never a raw host string (see the GP-canon design doc). Both packages
+ship the shared `canon-vectors.json` corpus so consumers can self-verify parity.
+
+## Local build
+    make -f Makefile.packaging all      # needs: maturin, wasm-pack, wasm32 target
+
+## Publish
+Push a `canon-core-v<version>` tag → `.github/workflows/publish-canon-core.yml` builds +
+publishes both via OIDC. One-time registry setup (see the workflow header) is a USER action:
+claim the PyPI project + the npm `@consiliency` scope and register the trusted publishers.

consiliency_canon_core-0.1.0/PKG-INFO

@@ -0,0 +1,43 @@
+Metadata-Version: 2.4
+Name: consiliency-canon-core
+Version: 0.1.0
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Rust
+Classifier: Intended Audience :: Developers
+Classifier: Topic :: Security :: Cryptography
+Summary: Canon v2 canonicalization engine — the shared byte/digest truth for Consiliency certificates
+Keywords: canonicalization,consiliency,canon,digest
+Author: Consiliency
+License-Expression: MIT
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown; charset=UTF-8; variant=GFM
+Project-URL: Homepage, https://github.com/Consiliency/spec
+Project-URL: Repository, https://github.com/Consiliency/spec
+
+# canon-core packaging (PKG)
+
+Dual-published canonicalization engine — the shared byte/digest truth every Consiliency
+certificate hashes. Same Rust engine (`src/lib.rs`), two distributions:
+
+| Distribution | Tool | Name | Consumer | Entry points |
+|---|---|---|---|---|
+| PyPI | maturin (`pyproject.toml`) | `consiliency-canon-core` (imports as `canon_core`) | Python | `canonical_bytes_from_json(tagged_json)`, `digest_from_json(tagged_json, profile)` |
+| npm | wasm-pack (`Makefile.packaging`) | `@consiliency/canon-core` (Node target) | governed-pipeline (JS) | `canonicalBytesFromJson(taggedJson)`, `digestFromJson(taggedJson, profile)` |
+
+**Surface is tagged-JSON *text*, not a raw value** — this is load-bearing for byte-identity:
+a lone surrogate serializes to the ASCII escape `\ud800`, survives UTF-8 marshalling, and
+`serde_json` rejects it at parse (SPEC §5.0). Consumers MUST feed tagged-JSON text produced
+by a validating encoder, never a raw host string (see the GP-canon design doc). Both packages
+ship the shared `canon-vectors.json` corpus so consumers can self-verify parity.
+
+## Local build
+    make -f Makefile.packaging all      # needs: maturin, wasm-pack, wasm32 target
+
+## Publish
+Push a `canon-core-v<version>` tag → `.github/workflows/publish-canon-core.yml` builds +
+publishes both via OIDC. One-time registry setup (see the workflow header) is a USER action:
+claim the PyPI project + the npm `@consiliency` scope and register the trusted publishers.
+

consiliency_canon_core-0.1.0/pyproject.toml

@@ -0,0 +1,41 @@
+# PKG (GP-canon chapter): maturin build for the PyPI distribution of canon-core.
+# Builds the pyo3-binding feature into an importable extension module `canon_core`
+# exposing canonical_bytes_from_json(tagged_json) + digest_from_json(tagged_json, profile).
+# The npm/WASM sibling is built by wasm-pack (see Makefile.packaging); both are published
+# by .github/workflows/publish-canon-core.yml via OIDC trusted publishing.
+[build-system]
+requires = ["maturin>=1.5,<2"]
+build-backend = "maturin"
+
+[project]
+name = "consiliency-canon-core"
+version = "0.1.0"
+description = "Canon v2 canonicalization engine — the shared byte/digest truth for Consiliency certificates"
+readme = "PACKAGING.md"
+requires-python = ">=3.10"
+license = "MIT"
+authors = [{ name = "Consiliency" }]
+keywords = ["canonicalization", "consiliency", "canon", "digest"]
+classifiers = [
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Rust",
+    "Intended Audience :: Developers",
+    "Topic :: Security :: Cryptography",
+]
+
+[project.urls]
+Homepage = "https://github.com/Consiliency/spec"
+Repository = "https://github.com/Consiliency/spec"
+
+[tool.maturin]
+# The Rust pymodule is `canon_core` (src/lib.rs #[pymodule] fn canon_core); the PyPI
+# dist name is consiliency-canon-core, so pin the import module-name explicitly.
+module-name = "canon_core"
+features = ["pyo3-binding"]
+manifest-path = "Cargo.toml"
+# Ship the shared conformance corpus INSIDE the wheel so a pinned install can self-verify
+# byte/digest parity against the same 36 vectors the Rust/TS/Python engines share.
+include = [{ path = "canon-vectors.json", format = "wheel" }]

consiliency_canon_core-0.1.0/src/bin/canon_core_emit.rs

@@ -0,0 +1,36 @@
+use base64::engine::general_purpose::STANDARD;
+use base64::Engine;
+use canon_core::{canonical_bytes, decode_input, digest, parse_vector_corpus};
+use serde_json::Value;
+use std::env;
+use std::fs;
+
+fn main() -> Result<(), Box<dyn std::error::Error>> {
+    let vector_path = env::args()
+        .nth(1)
+        .unwrap_or_else(|| "../../vectors/canon-vectors.json".to_string());
+    let raw = fs::read_to_string(vector_path)?;
+    let vectors: Vec<Value> = parse_vector_corpus(&raw)?;
+    let mut lines = Vec::with_capacity(vectors.len());
+    for vector in vectors {
+        let name = vector["name"].as_str().ok_or("vector missing name")?;
+        let value = decode_input(&vector["input"])?;
+        if vector.get("expect_error").and_then(Value::as_bool).unwrap_or(false) {
+            match canonical_bytes(&value) {
+                Ok(bytes) => {
+                    return Err(format!("expected CanonError but encoding succeeded for {name}: {bytes:?}").into());
+                }
+                Err(_) => lines.push(format!("{name}\tERROR\tERROR")),
+            }
+            continue;
+        }
+        let profile = vector["profile"].as_str().ok_or("vector missing profile")?;
+        let bytes = canonical_bytes(&value)?;
+        let bytes_b64 = STANDARD.encode(bytes);
+        let digest_hex = digest(&value, profile)?;
+        lines.push(format!("{name}\t{bytes_b64}\t{digest_hex}"));
+    }
+    lines.sort();
+    println!("{}", lines.join("\n"));
+    Ok(())
+}

consiliency_canon_core-0.1.0/src/lib.rs

@@ -0,0 +1,275 @@
+use num_bigint::BigInt;
+use serde_json::Value;
+use sha2::{Digest, Sha256};
+use std::cmp::Ordering;
+use std::fmt;
+
+pub const DOMAIN_PREFIX: &str = "spec-canon:v2:";
+pub const PROFILES: [&str; 4] = ["semantic-content", "run", "artifact-byte", "certificate"];
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum CanonValue {
+    Null,
+    Bool(bool),
+    Int(BigInt),
+    String(String),
+    Array(Vec<CanonValue>),
+    Object(Vec<(String, CanonValue)>),
+    FloatMarker,
+    NanMarker,
+    InfMarker,
+    SurrogateMarker,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct CanonError {
+    message: String,
+}
+
+impl CanonError {
+    fn new(message: impl Into<String>) -> Self {
+        Self { message: message.into() }
+    }
+}
+
+impl fmt::Display for CanonError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str(&self.message)
+    }
+}
+
+impl std::error::Error for CanonError {}
+
+pub type CanonResult<T> = Result<T, CanonError>;
+
+fn compare_code_points(a: &str, b: &str) -> Ordering {
+    let mut ai = a.chars();
+    let mut bi = b.chars();
+    loop {
+        match (ai.next(), bi.next()) {
+            (None, None) => return Ordering::Equal,
+            (None, Some(_)) => return Ordering::Less,
+            (Some(_), None) => return Ordering::Greater,
+            (Some(ac), Some(bc)) => match (ac as u32).cmp(&(bc as u32)) {
+                Ordering::Equal => {}
+                other => return other,
+            },
+        }
+    }
+}
+
+fn encode_string(value: &str) -> CanonResult<String> {
+    let mut out = String::from("\"");
+    for ch in value.chars() {
+        let cp = ch as u32;
+        match ch {
+            '"' => out.push_str("\\\""),
+            '\\' => out.push_str("\\\\"),
+            _ if cp <= 0x1f => out.push_str(&format!("\\u{cp:04x}")),
+            _ => out.push(ch),
+        }
+    }
+    out.push('"');
+    Ok(out)
+}
+
+fn encode_value(value: &CanonValue) -> CanonResult<String> {
+    match value {
+        CanonValue::FloatMarker => Err(CanonError::new(
+            "floats are forbidden in canonical content; pre-represent as int or string",
+        )),
+        CanonValue::NanMarker => Err(CanonError::new("NaN is forbidden in canonical content")),
+        CanonValue::InfMarker => Err(CanonError::new("Infinity is forbidden in canonical content")),
+        CanonValue::SurrogateMarker => Err(CanonError::new(
+            "unpaired surrogate U+D800 is not allowed in canonical content",
+        )),
+        CanonValue::Null => Ok("null".to_string()),
+        CanonValue::Bool(v) => Ok(if *v { "true" } else { "false" }.to_string()),
+        CanonValue::Int(v) => Ok(v.to_string()),
+        CanonValue::String(v) => encode_string(v),
+        CanonValue::Array(items) => {
+            let mut parts = Vec::with_capacity(items.len());
+            for item in items {
+                parts.push(encode_value(item)?);
+            }
+            Ok(format!("[{}]", parts.join(",")))
+        }
+        CanonValue::Object(entries) => {
+            let mut sorted = entries.clone();
+            sorted.sort_by(|(ak, _), (bk, _)| compare_code_points(ak, bk));
+            let mut parts = Vec::with_capacity(sorted.len());
+            for (key, item) in sorted {
+                parts.push(format!("{}:{}", encode_string(&key)?, encode_value(&item)?));
+            }
+            Ok(format!("{{{}}}", parts.join(",")))
+        }
+    }
+}
+
+pub fn canonical_bytes(value: &CanonValue) -> CanonResult<Vec<u8>> {
+    Ok(encode_value(value)?.into_bytes())
+}
+
+fn strip_top_level_digest(value: &CanonValue) -> CanonValue {
+    match value {
+        CanonValue::Object(entries) => CanonValue::Object(
+            entries
+                .iter()
+                .filter(|(key, _)| key != "digest")
+                .cloned()
+                .collect(),
+        ),
+        _ => value.clone(),
+    }
+}
+
+pub fn digest(value: &CanonValue, profile: &str) -> CanonResult<String> {
+    if !PROFILES.contains(&profile) {
+        return Err(CanonError::new(format!("unknown digest profile: {profile}")));
+    }
+    let mut hasher = Sha256::new();
+    hasher.update(format!("{DOMAIN_PREFIX}{profile}\n").as_bytes());
+    hasher.update(canonical_bytes(&strip_top_level_digest(value))?);
+    Ok(hex::encode(hasher.finalize()))
+}
+
+fn json_truthy(value: &Value) -> bool {
+    match value {
+        Value::Null => false,
+        Value::Bool(v) => *v,
+        Value::Number(n) => n.as_i64().map_or(true, |v| v != 0),
+        Value::String(s) => !s.is_empty(),
+        Value::Array(_) | Value::Object(_) => true,
+    }
+}
+
+fn parse_int_payload(payload: &Value) -> CanonResult<BigInt> {
+    let raw = payload
+        .as_str()
+        .ok_or_else(|| CanonError::new("$int payload must be a decimal string"))?;
+    raw.parse::<BigInt>()
+        .map_err(|_| CanonError::new(format!("invalid integer payload: {raw}")))
+}
+
+pub fn decode_input(node: &Value) -> CanonResult<CanonValue> {
+    match node {
+        Value::Null => Ok(CanonValue::Null),
+        Value::Bool(v) => Ok(CanonValue::Bool(*v)),
+        Value::Number(n) => {
+            if let Some(v) = n.as_i64() {
+                Ok(CanonValue::Int(BigInt::from(v)))
+            } else if let Some(v) = n.as_u64() {
+                Ok(CanonValue::Int(BigInt::from(v)))
+            } else {
+                Ok(CanonValue::FloatMarker)
+            }
+        }
+        Value::String(v) => Ok(CanonValue::String(v.clone())),
+        Value::Array(items) => items.iter().map(decode_input).collect::<CanonResult<Vec<_>>>().map(CanonValue::Array),
+        Value::Object(map) => {
+            if map.len() == 1 {
+                let (tag, payload) = map.iter().next().expect("single object entry");
+                match tag.as_str() {
+                    "$int" => return Ok(CanonValue::Int(parse_int_payload(payload)?)),
+                    "$float" => return Ok(CanonValue::FloatMarker),
+                    "$nan" => return Ok(CanonValue::NanMarker),
+                    "$inf" => return Ok(CanonValue::InfMarker),
+                    "$surrogate" => return Ok(CanonValue::SurrogateMarker),
+                    "$str" => {
+                        return payload
+                            .as_str()
+                            .map(|s| CanonValue::String(s.to_string()))
+                            .ok_or_else(|| CanonError::new("$str payload must be a string"));
+                    }
+                    "$bool" => return Ok(CanonValue::Bool(json_truthy(payload))),
+                    "$null" => return Ok(CanonValue::Null),
+                    "$obj" => {
+                        let obj = payload
+                            .as_object()
+                            .ok_or_else(|| CanonError::new("$obj payload must be an object"))?;
+                        let mut entries = Vec::with_capacity(obj.len());
+                        for (key, item) in obj {
+                            entries.push((key.clone(), decode_input(item)?));
+                        }
+                        return Ok(CanonValue::Object(entries));
+                    }
+                    "$arr" => {
+                        let arr = payload
+                            .as_array()
+                            .ok_or_else(|| CanonError::new("$arr payload must be an array"))?;
+                        return arr.iter().map(decode_input).collect::<CanonResult<Vec<_>>>().map(CanonValue::Array);
+                    }
+                    _ => {}
+                }
+            }
+            let mut entries = Vec::with_capacity(map.len());
+            for (key, item) in map {
+                entries.push((key.clone(), decode_input(item)?));
+            }
+            Ok(CanonValue::Object(entries))
+        }
+    }
+}
+
+pub fn decode_input_json(tagged_json: &str) -> CanonResult<CanonValue> {
+    let value: Value = serde_json::from_str(tagged_json)
+        .map_err(|error| CanonError::new(format!("invalid JSON: {error}")))?;
+    decode_input(&value)
+}
+
+pub fn parse_vector_corpus(raw: &str) -> CanonResult<Vec<Value>> {
+    let rust_parseable = raw.replace("\"$str\": \"\\ud800\"", "\"$surrogate\": \"d800\"");
+    serde_json::from_str(&rust_parseable)
+        .map_err(|error| CanonError::new(format!("invalid vector corpus: {error}")))
+}
+
+pub fn canonical_bytes_from_json(tagged_json: &str) -> CanonResult<Vec<u8>> {
+    canonical_bytes(&decode_input_json(tagged_json)?)
+}
+
+pub fn digest_from_json(tagged_json: &str, profile: &str) -> CanonResult<String> {
+    digest(&decode_input_json(tagged_json)?, profile)
+}
+
+#[cfg(feature = "wasm-binding")]
+use wasm_bindgen::prelude::*;
+
+#[cfg(feature = "wasm-binding")]
+#[wasm_bindgen(js_name = canonicalBytesFromJson)]
+pub fn wasm_canonical_bytes_from_json(tagged_json: &str) -> Result<Vec<u8>, JsValue> {
+    canonical_bytes_from_json(tagged_json).map_err(|error| JsValue::from_str(&error.to_string()))
+}
+
+#[cfg(feature = "wasm-binding")]
+#[wasm_bindgen(js_name = digestFromJson)]
+pub fn wasm_digest_from_json(tagged_json: &str, profile: &str) -> Result<String, JsValue> {
+    digest_from_json(tagged_json, profile).map_err(|error| JsValue::from_str(&error.to_string()))
+}
+
+#[cfg(feature = "pyo3-binding")]
+use pyo3::prelude::*;
+
+#[cfg(feature = "pyo3-binding")]
+fn py_error(error: CanonError) -> PyErr {
+    pyo3::exceptions::PyValueError::new_err(error.to_string())
+}
+
+#[cfg(feature = "pyo3-binding")]
+#[pyfunction(name = "canonical_bytes_from_json")]
+fn py_canonical_bytes_from_json(tagged_json: &str) -> PyResult<Vec<u8>> {
+    canonical_bytes_from_json(tagged_json).map_err(py_error)
+}
+
+#[cfg(feature = "pyo3-binding")]
+#[pyfunction(name = "digest_from_json")]
+fn py_digest_from_json(tagged_json: &str, profile: &str) -> PyResult<String> {
+    digest_from_json(tagged_json, profile).map_err(py_error)
+}
+
+#[cfg(feature = "pyo3-binding")]
+#[pymodule]
+fn canon_core(module: &Bound<'_, PyModule>) -> PyResult<()> {
+    module.add_function(wrap_pyfunction!(py_canonical_bytes_from_json, module)?)?;
+    module.add_function(wrap_pyfunction!(py_digest_from_json, module)?)?;
+    Ok(())
+}

consiliency_canon_core-0.1.0/tests/parity.rs

@@ -0,0 +1,39 @@
+use base64::engine::general_purpose::STANDARD;
+use base64::Engine;
+use canon_core::{canonical_bytes, decode_input, digest, parse_vector_corpus};
+use serde_json::Value;
+use std::fs;
+use std::path::PathBuf;
+
+fn vectors_path() -> PathBuf {
+    PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../vectors/canon-vectors.json")
+}
+
+#[test]
+fn rust_core_matches_pinned_vectors() {
+    let raw = fs::read_to_string(vectors_path()).expect("read canon vectors");
+    let vectors: Vec<Value> = parse_vector_corpus(&raw).expect("parse canon vectors");
+    assert!(!vectors.is_empty(), "canon vector corpus must be non-empty");
+    for vector in vectors {
+        let name = vector["name"].as_str().expect("name");
+        let value = decode_input(&vector["input"]).unwrap_or_else(|error| panic!("{name}: decode failed: {error}"));
+        if vector.get("expect_error").and_then(Value::as_bool).unwrap_or(false) {
+            assert!(canonical_bytes(&value).is_err(), "{name}: expected canonical_bytes to reject");
+            continue;
+        }
+        let profile = vector["profile"].as_str().expect("profile");
+        let bytes = canonical_bytes(&value).unwrap_or_else(|error| panic!("{name}: encode failed: {error}"));
+        let bytes_b64 = STANDARD.encode(bytes);
+        assert_eq!(
+            bytes_b64,
+            vector["expected_canonical_bytes_b64"].as_str().expect("expected bytes"),
+            "{name}: bytes mismatch",
+        );
+        let digest_hex = digest(&value, profile).unwrap_or_else(|error| panic!("{name}: digest failed: {error}"));
+        assert_eq!(
+            digest_hex,
+            vector["expected_digest_hex"].as_str().expect("expected digest"),
+            "{name}: digest mismatch",
+        );
+    }
+}