verfy 0.2.0__tar.gz

verfy-0.2.0/LICENSE

@@ -0,0 +1,9 @@
+MIT License
+
+Copyright (c) 2026 Javohir
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

verfy-0.2.0/PKG-INFO

@@ -0,0 +1,150 @@
+Metadata-Version: 2.4
+Name: verfy
+Version: 0.2.0
+Summary: Verfy: guard coding-agent tool calls, scan and lock MCP tools, and sign a verifiable receipt for every action.
+License-Expression: MIT
+Project-URL: Homepage, https://verfy-tech.vercel.app
+Project-URL: Documentation, https://verfy-tech.vercel.app/docs
+Keywords: mcp,ai-agents,security,model-context-protocol,claude-code,audit,receipts
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Topic :: Security
+Classifier: Operating System :: OS Independent
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Provides-Extra: fast
+Requires-Dist: cryptography>=43; extra == "fast"
+Dynamic: license-file
+
+# Verfy CLI
+
+Guard coding-agent tool calls, scan and lock MCP tools, and sign a verifiable receipt for every action. Plain Python (≥ 3.10), no required dependencies, MIT.
+
+```bash
+pip install verfy                  # Python ≥ 3.10, no dependencies
+pip install "verfy[fast]"          # optional: faster Ed25519 via `cryptography`
+```
+
+## Guard Claude Code
+
+```bash
+verfy init                      # ~/.verfy: signing key (0600), starter policy
+verfy hook install              # shows the change to ~/.claude/settings.json
+verfy hook install --write      # saves it (a backup is kept); --project for ./.claude/settings.json
+```
+
+Claude Code then runs `verfy hook pre-tool-use` before every tool call. Verfy answers **deny** or **ask** with the rule and reason, or stays silent so Claude Code's own permissions decide; it never answers allow itself. Any error becomes `ask` (or `deny` with `"fail_mode": "deny"`). The hook never touches the network.
+
+## Guard MCP servers (gateway)
+
+```bash
+claude mcp add filesystem -- verfy proxy --name filesystem -- npx -y @modelcontextprotocol/server-filesystem@2025.8.21 ~/project
+verfy wrap ~/.cursor/mcp.json --write      # wrap every server in a config (backup kept)
+```
+
+The gateway scans each `tools/list` answer, hides poisoned or drifted tools, checks every `tools/call`, can ask the user through MCP elicitation (`"on_ask": "elicit"`), and writes a receipt for every call.
+
+## Scan
+
+```bash
+verfy scan --discover                 # static check of Claude Code, Cursor, Claude Desktop configs
+verfy scan --discover --live          # also start each stdio server and scan its tools
+verfy scan tools.json --fail-under C  # a saved tools/list answer, for CI
+```
+
+Exit codes: config scan `0` ok, `1` medium, `2` high or worse; tool scan `1` with `--fail-under` when a server grades worse.
+
+## Lock
+
+```bash
+verfy lock status                 # 0 ok · 1 new/removed · 2 drift
+verfy lock diff filesystem        # what changed, invisible characters spelled out
+verfy lock approve filesystem     # review, then accept (--yes after reviewing in CI)
+verfy lock add tools.json --server remote-api
+verfy lock verify                 # verfy.lock is well formed and untampered
+```
+
+A project-level `./verfy.lock` is used when present, otherwise `~/.verfy/verfy.lock`.
+
+### In CI
+
+```bash
+verfy lock check --update         # start the servers in .mcp.json, review every definition, write ./verfy.lock
+verfy lock check                  # 0 ok · 1 new/removed · 2 drift · 3 a server did not answer
+```
+
+Commit `verfy.lock`; a pull request that changes a tool then fails until someone reviews the diff and runs `--update`. Inside GitHub Actions the command also writes annotations and a step summary. The repository root has an `action.yml` that installs this CLI and runs the check:
+
+```yaml
+- uses: actions/setup-python@v7
+  with: { python-version: "3.13" }
+- uses: ./            # or <owner>/verfy@<ref> once the repository is public
+  with: { config: .mcp.json, lock: verfy.lock }
+```
+
+`lock check` starts each stdio server command from the config, as your MCP client would: pin package versions and pass keys as CI secrets. Remote servers are skipped.
+
+## Check and verify
+
+```bash
+verfy check "git push --force"                       # 0 allow · 1 ask · 2 deny
+verfy check --tool send_payment --args '{"amount": 500}'
+verfy ledger show
+verfy verify                                         # your own ledger
+verfy verify --ledger receipts.jsonl --pub <key> --kid <chain> [--start-after <hash>]   # an evidence export
+```
+
+## Verfy Team
+
+```bash
+verfy team enroll --url https://verfy.example.com --code atle_…   # code from Dashboard → Devices
+verfy sync                     # upload new receipts (run from cron/CI, never in the hook)
+verfy team pull                # team policy + team-approved locks
+verfy team propose SERVER TOOL # ask admins to approve a changed tool
+verfy team status
+```
+
+Only the public key is sent at enrollment. The device token is stored in `~/.verfy/team.json` (0600). Receipts are uploaded exactly as signed; they contain only hashes of arguments unless you enabled `receipts.include_args`, in which case `sync` needs `--allow-args`.
+
+## Policy
+
+JSON merged over `src/verfy/data/default_policy.json`. Precedence: `--policy FILE`, `./verfy.policy.json`, `~/.verfy/team/policy.json`, `~/.verfy/policy.json`.
+
+```json
+{
+  "on_ask": "deny",
+  "fail_mode": "ask",
+  "tools": {"deny": ["github/delete_*"], "ask": ["merge_pull_request"]},
+  "network": {"allow": ["github.com", "*.python.org"], "unknown": "ask"},
+  "rules": [{"id": "no-prod-db", "pattern": "prod-db", "verdict": "deny", "message": "Production is off-limits."}],
+  "lock": {"on_new": "ask"},
+  "receipts": {"include_args": false}
+}
+```
+
+## Receipt format (`verfy.receipt/1`)
+
+One JSON object per line in `~/.verfy/ledger.jsonl`: `v, id, seq, prev, issued_at, agent, session, action{server, tool, kind, args_sha256, args?}, decision{verdict, rules, policy_sha256, approved_by?}, outcome{status, result_sha256}, tool_sha256, kid, sig`. `sig` is Ed25519 over the canonical JSON of all other fields; `prev` is the SHA-256 of the previous receipt. Writes are serialized with an OS file lock, so parallel sessions never fork the chain.
+
+### SCITT signed statements
+
+```bash
+verfy scitt export --out statements/ [--issuer URL]     # one COSE_Sign1 per receipt
+verfy scitt verify statements/*.cose --pub signer.json  # COSE signature, CWT subject and the receipt's own signature
+```
+
+Each statement is a COSE_Sign1 (RFC 9052) with alg EdDSA, content type `application/json`, the key id and CWT claims (`iss`, `sub` = the receipt hash) in the protected header, and the canonical receipt as payload: the signed-statement envelope of the IETF SCITT architecture draft. Verfy does not run a transparency service or issue SCITT receipts.
+
+## Tests
+
+```bash
+cd verfy-cli && python -m unittest discover -s tests     # needs Node for the cross-engine tests
+```
+
+## Limits
+
+Rules are pattern matching, not a sandbox. Verfy sees only calls that pass through its hook or gateway. A receipt proves what Verfy decided and that the log was not edited, not what a tool did internally. Keep `~/.verfy/key.json` private.

verfy-0.2.0/README.md

@@ -0,0 +1,128 @@
+# Verfy CLI
+
+Guard coding-agent tool calls, scan and lock MCP tools, and sign a verifiable receipt for every action. Plain Python (≥ 3.10), no required dependencies, MIT.
+
+```bash
+pip install verfy                  # Python ≥ 3.10, no dependencies
+pip install "verfy[fast]"          # optional: faster Ed25519 via `cryptography`
+```
+
+## Guard Claude Code
+
+```bash
+verfy init                      # ~/.verfy: signing key (0600), starter policy
+verfy hook install              # shows the change to ~/.claude/settings.json
+verfy hook install --write      # saves it (a backup is kept); --project for ./.claude/settings.json
+```
+
+Claude Code then runs `verfy hook pre-tool-use` before every tool call. Verfy answers **deny** or **ask** with the rule and reason, or stays silent so Claude Code's own permissions decide; it never answers allow itself. Any error becomes `ask` (or `deny` with `"fail_mode": "deny"`). The hook never touches the network.
+
+## Guard MCP servers (gateway)
+
+```bash
+claude mcp add filesystem -- verfy proxy --name filesystem -- npx -y @modelcontextprotocol/server-filesystem@2025.8.21 ~/project
+verfy wrap ~/.cursor/mcp.json --write      # wrap every server in a config (backup kept)
+```
+
+The gateway scans each `tools/list` answer, hides poisoned or drifted tools, checks every `tools/call`, can ask the user through MCP elicitation (`"on_ask": "elicit"`), and writes a receipt for every call.
+
+## Scan
+
+```bash
+verfy scan --discover                 # static check of Claude Code, Cursor, Claude Desktop configs
+verfy scan --discover --live          # also start each stdio server and scan its tools
+verfy scan tools.json --fail-under C  # a saved tools/list answer, for CI
+```
+
+Exit codes: config scan `0` ok, `1` medium, `2` high or worse; tool scan `1` with `--fail-under` when a server grades worse.
+
+## Lock
+
+```bash
+verfy lock status                 # 0 ok · 1 new/removed · 2 drift
+verfy lock diff filesystem        # what changed, invisible characters spelled out
+verfy lock approve filesystem     # review, then accept (--yes after reviewing in CI)
+verfy lock add tools.json --server remote-api
+verfy lock verify                 # verfy.lock is well formed and untampered
+```
+
+A project-level `./verfy.lock` is used when present, otherwise `~/.verfy/verfy.lock`.
+
+### In CI
+
+```bash
+verfy lock check --update         # start the servers in .mcp.json, review every definition, write ./verfy.lock
+verfy lock check                  # 0 ok · 1 new/removed · 2 drift · 3 a server did not answer
+```
+
+Commit `verfy.lock`; a pull request that changes a tool then fails until someone reviews the diff and runs `--update`. Inside GitHub Actions the command also writes annotations and a step summary. The repository root has an `action.yml` that installs this CLI and runs the check:
+
+```yaml
+- uses: actions/setup-python@v7
+  with: { python-version: "3.13" }
+- uses: ./            # or <owner>/verfy@<ref> once the repository is public
+  with: { config: .mcp.json, lock: verfy.lock }
+```
+
+`lock check` starts each stdio server command from the config, as your MCP client would: pin package versions and pass keys as CI secrets. Remote servers are skipped.
+
+## Check and verify
+
+```bash
+verfy check "git push --force"                       # 0 allow · 1 ask · 2 deny
+verfy check --tool send_payment --args '{"amount": 500}'
+verfy ledger show
+verfy verify                                         # your own ledger
+verfy verify --ledger receipts.jsonl --pub <key> --kid <chain> [--start-after <hash>]   # an evidence export
+```
+
+## Verfy Team
+
+```bash
+verfy team enroll --url https://verfy.example.com --code atle_…   # code from Dashboard → Devices
+verfy sync                     # upload new receipts (run from cron/CI, never in the hook)
+verfy team pull                # team policy + team-approved locks
+verfy team propose SERVER TOOL # ask admins to approve a changed tool
+verfy team status
+```
+
+Only the public key is sent at enrollment. The device token is stored in `~/.verfy/team.json` (0600). Receipts are uploaded exactly as signed; they contain only hashes of arguments unless you enabled `receipts.include_args`, in which case `sync` needs `--allow-args`.
+
+## Policy
+
+JSON merged over `src/verfy/data/default_policy.json`. Precedence: `--policy FILE`, `./verfy.policy.json`, `~/.verfy/team/policy.json`, `~/.verfy/policy.json`.
+
+```json
+{
+  "on_ask": "deny",
+  "fail_mode": "ask",
+  "tools": {"deny": ["github/delete_*"], "ask": ["merge_pull_request"]},
+  "network": {"allow": ["github.com", "*.python.org"], "unknown": "ask"},
+  "rules": [{"id": "no-prod-db", "pattern": "prod-db", "verdict": "deny", "message": "Production is off-limits."}],
+  "lock": {"on_new": "ask"},
+  "receipts": {"include_args": false}
+}
+```
+
+## Receipt format (`verfy.receipt/1`)
+
+One JSON object per line in `~/.verfy/ledger.jsonl`: `v, id, seq, prev, issued_at, agent, session, action{server, tool, kind, args_sha256, args?}, decision{verdict, rules, policy_sha256, approved_by?}, outcome{status, result_sha256}, tool_sha256, kid, sig`. `sig` is Ed25519 over the canonical JSON of all other fields; `prev` is the SHA-256 of the previous receipt. Writes are serialized with an OS file lock, so parallel sessions never fork the chain.
+
+### SCITT signed statements
+
+```bash
+verfy scitt export --out statements/ [--issuer URL]     # one COSE_Sign1 per receipt
+verfy scitt verify statements/*.cose --pub signer.json  # COSE signature, CWT subject and the receipt's own signature
+```
+
+Each statement is a COSE_Sign1 (RFC 9052) with alg EdDSA, content type `application/json`, the key id and CWT claims (`iss`, `sub` = the receipt hash) in the protected header, and the canonical receipt as payload: the signed-statement envelope of the IETF SCITT architecture draft. Verfy does not run a transparency service or issue SCITT receipts.
+
+## Tests
+
+```bash
+cd verfy-cli && python -m unittest discover -s tests     # needs Node for the cross-engine tests
+```
+
+## Limits
+
+Rules are pattern matching, not a sandbox. Verfy sees only calls that pass through its hook or gateway. A receipt proves what Verfy decided and that the log was not edited, not what a tool did internally. Keep `~/.verfy/key.json` private.

verfy-0.2.0/pyproject.toml

@@ -0,0 +1,40 @@
+[build-system]
+requires = ["setuptools>=77"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "verfy"
+version = "0.2.0"
+description = "Verfy: guard coding-agent tool calls, scan and lock MCP tools, and sign a verifiable receipt for every action."
+readme = "README.md"
+requires-python = ">=3.10"
+license = "MIT"
+license-files = ["LICENSE"]
+keywords = ["mcp", "ai-agents", "security", "model-context-protocol", "claude-code", "audit", "receipts"]
+classifiers = [
+  "Development Status :: 3 - Alpha",
+  "Environment :: Console",
+  "Intended Audience :: Developers",
+  "Programming Language :: Python :: 3",
+  "Programming Language :: Python :: 3 :: Only",
+  "Topic :: Security",
+  "Operating System :: OS Independent",
+]
+dependencies = []
+
+[project.urls]
+Homepage = "https://verfy-tech.vercel.app"
+Documentation = "https://verfy-tech.vercel.app/docs"
+
+[project.optional-dependencies]
+fast = ["cryptography>=43"]
+
+[project.scripts]
+verfy = "verfy.cli:main"
+
+[tool.setuptools]
+package-dir = {"" = "src"}
+packages = ["verfy", "verfy.data"]
+
+[tool.setuptools.package-data]
+verfy = ["data/*.json"]

verfy-0.2.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

verfy-0.2.0/src/verfy/__init__.py

@@ -0,0 +1,14 @@
+"""Verfy: security, policy and verifiable evidence for coding agents and MCP tools.
+
+Guard every tool call with deterministic rules, scan and lock MCP tool
+definitions, and sign a tamper-evident receipt for everything that happened.
+"""
+
+from .canonical import canonical, digest
+from .policy import DEFAULT_POLICY, load_policy, policy_digest
+from .precheck import check, classify
+from .scanner import scan, tool_pin
+
+__version__ = "0.2.0"
+
+__all__ = ["canonical", "digest", "DEFAULT_POLICY", "load_policy", "policy_digest", "check", "classify", "scan", "tool_pin", "__version__"]

verfy-0.2.0/src/verfy/__main__.py

@@ -0,0 +1,4 @@
+from .cli import main
+import sys
+
+sys.exit(main())

verfy-0.2.0/src/verfy/_util.py

@@ -0,0 +1,191 @@
+"""Small helpers shared by the scanner and the pre-check.
+
+Every function here has a twin in ``web/verfy-engine.js``. Keep them in step:
+the parity tests run the same fixtures through both.
+"""
+
+from __future__ import annotations
+
+import json
+import math
+import re
+from functools import lru_cache
+from pathlib import Path
+from typing import Any, Iterable
+
+PATTERNS: dict = json.loads((Path(__file__).parent / "data" / "patterns.json").read_text("utf-8"))
+
+SEVERITY_RANK = {"critical": 4, "high": 3, "medium": 2, "low": 1, "info": 0}
+VERDICT_RANK = {"deny": 2, "ask": 1, "allow": 0}
+
+
+@lru_cache(maxsize=None)
+def rx(pattern: str, flags: str = "") -> "re.Pattern[str]":
+    f = 0
+    if "i" in flags:
+        f |= re.IGNORECASE
+    return re.compile(pattern, f)
+
+
+def words(name: str) -> list[str]:
+    """Split ``readFile``, ``read_file`` and ``read-file`` into lowercase words."""
+    s = re.sub(r"([a-z0-9])([A-Z])", r"\1 \2", name or "")
+    return [w for w in re.split(r"[^A-Za-z0-9]+", s.lower()) if w]
+
+
+def is_invisible(cp: int) -> bool:
+    return any(a <= cp <= b for a, b in PATTERNS["invisible_ranges"])
+
+
+def entropy(v: str) -> float:
+    if not v:
+        return 0.0
+    counts: dict[str, int] = {}
+    for ch in v:
+        counts[ch] = counts.get(ch, 0) + 1
+    n = len(v)
+    return -sum(c / n * math.log2(c / n) for c in counts.values())
+
+
+def scan_secrets(text: str) -> list[dict]:
+    out: list[dict] = []
+    if not text or not isinstance(text, str):
+        return out
+    seen = set()
+    for rid, label, pat, flags, sev in PATTERNS["secrets"]:
+        for m in rx(pat, flags).finditer(text):
+            value = m.group(1) if m.groups() and m.group(1) is not None else m.group(0)
+            low = value.lower()
+            if any(h in low for h in PATTERNS["placeholders"]):
+                continue
+            if sev == "medium" and entropy(value) < 3.0:
+                continue
+            if rid in seen:
+                continue
+            seen.add(rid)
+            out.append({"id": rid, "label": label, "severity": sev, "start": m.start(), "end": m.end()})
+    return out
+
+
+def redact(text: str) -> str:
+    hits = scan_secrets(text)
+    for h in sorted(hits, key=lambda h: -h["start"]):
+        text = text[: h["start"]] + "[REDACTED:" + h["id"] + "]" + text[h["end"]:]
+    return text
+
+
+def redact_value(v: Any) -> Any:
+    if isinstance(v, str):
+        return redact(v) if scan_secrets(v) else v
+    if isinstance(v, list):
+        return [redact_value(x) for x in v]
+    if isinstance(v, dict):
+        return {k: redact_value(x) for k, x in v.items()}
+    return v
+
+
+def flatten_strings(v: Any, path: str = "") -> list[tuple[str, str]]:
+    """Every string inside ``v`` with its dotted key path."""
+    out: list[tuple[str, str]] = []
+    if isinstance(v, str):
+        out.append((path, v))
+    elif isinstance(v, list):
+        for i, x in enumerate(v):
+            out.extend(flatten_strings(x, f"{path}[{i}]"))
+    elif isinstance(v, dict):
+        for k, x in v.items():
+            out.extend(flatten_strings(x, f"{path}.{k}" if path else k))
+    return out
+
+
+# ---------------------------------------------------------------- paths
+
+def normpath(p: str) -> str:
+    """POSIX normpath that never touches the real filesystem."""
+    absolute = p.startswith("/")
+    parts: list[str] = []
+    for part in p.split("/"):
+        if part in ("", "."):
+            continue
+        if part == "..":
+            if parts and parts[-1] != "..":
+                parts.pop()
+            elif not absolute:
+                parts.append("..")
+            continue
+        parts.append(part)
+    s = "/".join(parts)
+    return ("/" + s) if absolute else (s or ".")
+
+
+def resolve(p: str, home: str, cwd: str) -> str:
+    p = (p or "").strip()
+    if p == "~" or p.startswith("~/"):
+        p = home + p[1:]
+    elif p.startswith("$HOME") or p.startswith("${HOME}"):
+        p = home + p[(5 if p.startswith("$HOME") else 7):]
+    if not p.startswith("/"):
+        p = cwd.rstrip("/") + "/" + p
+    return normpath(p)
+
+
+def is_within(path: str, root: str) -> bool:
+    root = root.rstrip("/") or "/"
+    return path == root or path.startswith(root + "/") or root == "/"
+
+
+@lru_cache(maxsize=None)
+def _glob_rx(pattern: str) -> "re.Pattern[str]":
+    i, out = 0, ""
+    if pattern.startswith("**/"):
+        out = "(?:.*/)?"
+        i = 3
+    while i < len(pattern):
+        c = pattern[i]
+        if pattern.startswith("/**/", i):
+            out += "/(?:.*/)?"
+            i += 4
+            continue
+        if pattern.startswith("/**", i) and i + 3 == len(pattern):
+            out += "(?:/.*)?"
+            i += 3
+            continue
+        if pattern.startswith("**", i):
+            out += ".*"
+            i += 2
+            continue
+        if c == "*":
+            out += "[^/]*"
+        elif c == "?":
+            out += "[^/]"
+        else:
+            out += re.escape(c)
+        i += 1
+    return re.compile("^" + out + "$")
+
+
+def glob_match(pattern: str, path: str, home: str) -> bool:
+    if pattern == "~" or pattern.startswith("~/"):
+        pattern = home + pattern[1:]
+    if pattern.startswith("**/"):
+        return bool(_glob_rx(pattern).match(path.lstrip("/"))) or bool(_glob_rx(pattern).match(path))
+    return bool(_glob_rx(pattern).match(path))
+
+
+def first_match(patterns: Iterable[str], path: str, home: str) -> str | None:
+    for pat in patterns or []:
+        if glob_match(pat, path, home):
+            return pat
+    return None
+
+
+def name_match(pattern: str, name: str) -> bool:
+    """Glob for tool names (``*`` matches anything, including ``/``)."""
+    return bool(re.match("^" + re.escape(pattern).replace(r"\*", ".*") + "$", name or ""))
+
+
+def host_match(pattern: str, host: str) -> bool:
+    pattern, host = pattern.lower(), host.lower()
+    if pattern.startswith("*."):
+        return host == pattern[2:] or host.endswith(pattern[1:])
+    return host == pattern

verfy-0.2.0/src/verfy/canonical.py

@@ -0,0 +1,85 @@
+"""Canonical JSON: the exact bytes Verfy hashes and signs.
+
+Keys are sorted, there is no whitespace and numbers are written the way
+JavaScript's ``JSON.stringify`` writes them, so the Python and browser
+engines produce identical bytes for identical data.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import math
+from typing import Any
+
+
+def _number(x: float) -> str:
+    if isinstance(x, bool):
+        raise TypeError("bool is not a number")
+    if isinstance(x, int):
+        return str(x)
+    if math.isnan(x) or math.isinf(x):
+        raise ValueError("NaN and Infinity cannot be signed")
+    if x == int(x) and abs(x) < 1e21:
+        return str(int(x))
+    # ECMAScript Number::toString, built from Python's shortest repr digits.
+    r = repr(abs(x))
+    mant, _, exp = r.partition("e")
+    e = int(exp) if exp else 0
+    if "." in mant:
+        ip, fp = mant.split(".")
+    else:
+        ip, fp = mant, ""
+    digits = (ip + fp).lstrip("0")
+    point = len(ip) + e  # position of the decimal point relative to digits start
+    lead = len(ip + fp) - len((ip + fp).lstrip("0"))
+    point -= lead
+    digits = digits.rstrip("0") or "0"
+    k, n = len(digits), point
+    sign = "-" if x < 0 else ""
+    if k <= n <= 21:
+        return sign + digits + "0" * (n - k)
+    if 0 < n <= 21:
+        return sign + digits[:n] + "." + digits[n:]
+    if -6 < n <= 0:
+        return sign + "0." + "0" * (-n) + digits
+    e2 = n - 1
+    es = ("+" if e2 >= 0 else "-") + str(abs(e2))
+    if k == 1:
+        return sign + digits + "e" + es
+    return sign + digits[0] + "." + digits[1:] + "e" + es
+
+
+def canonical(obj: Any) -> str:
+    if obj is None:
+        return "null"
+    if obj is True:
+        return "true"
+    if obj is False:
+        return "false"
+    if isinstance(obj, (int, float)):
+        return _number(obj)
+    if isinstance(obj, str):
+        return json.dumps(obj, ensure_ascii=False)
+    if isinstance(obj, (list, tuple)):
+        return "[" + ",".join(canonical(v) for v in obj) + "]"
+    if isinstance(obj, dict):
+        for k in obj:
+            if not isinstance(k, str):
+                raise TypeError("object keys must be strings")
+        keys = sorted(obj, key=lambda s: s.encode("utf-16-be"))
+        return "{" + ",".join(json.dumps(k, ensure_ascii=False) + ":" + canonical(obj[k]) for k in keys) + "}"
+    raise TypeError(f"cannot canonicalize {type(obj).__name__}")
+
+
+def canonical_bytes(obj: Any) -> bytes:
+    return canonical(obj).encode("utf-8")
+
+
+def sha256_hex(data: bytes) -> str:
+    return hashlib.sha256(data).hexdigest()
+
+
+def digest(obj: Any) -> str:
+    """``sha256:<hex>`` of the canonical form of ``obj``."""
+    return "sha256:" + sha256_hex(canonical_bytes(obj))