Encode canonical documents

python -m pip install https://docs.soterias.io/downloads/api-preview/soterias_local-0.1.0rc5%2Bapi2-cp311-abi3-win_amd64.whl

npm install https://docs.soterias.io/downloads/api-preview/soterias-core-0.1.0-rc.5-api.2.tgz
npm install --save-dev typescript@5.8.3 @types/node@24

import json
from soterias import canonicalize, canonical_digest, InputError

import assert from 'node:assert/strict';
import { canonicalize } from '@soterias/core';

# %% Produce stable bytes using Rust canonical JSON
# Property order and insignificant whitespace do not change the encoding.
first = b'{ "invoice": 42, "currency": "CHF" }'
second = b'{"currency":"CHF","invoice":42}'
encoded = canonicalize(first)
assert encoded == canonicalize(second)
assert canonical_digest(first) == canonical_digest(second)

// %% Produce stable bytes using Rust canonical JSON
// Property order and insignificant whitespace do not change the encoding.
const first = Buffer.from('{ "invoice": 42, "currency": "CHF" }');
const second = Buffer.from('{"currency":"CHF","invoice":42}');
const encoded = canonicalize(first);
const same = canonicalize(second);
assert.deepEqual(encoded.canonical, same.canonical);
assert.equal(encoded.sha256, same.sha256);

# %% Reject ambiguous input at the boundary
# Never accept duplicate JSON keys by silently choosing one value.
try:
    canonicalize(b'{"invoice":42,"invoice":99}')
except InputError:
    pass
else:
    raise AssertionError("Duplicate keys must be rejected")

// %% Reject ambiguous input at the boundary
// Never accept duplicate JSON keys by silently choosing one value.
assert.throws(() => canonicalize(Buffer.from('{"invoice":42,"invoice":99}')));

# %% Pass the stable bytes to your application
# A digest identifies data. It does not establish who signed it.
print(json.dumps({"status": "PASS", "canonical": encoded.decode(),
                  "digest": canonical_digest(first)}))

// %% Pass the stable bytes to your application
// A digest identifies data. It does not establish who signed it.
console.log(JSON.stringify({ status: 'PASS', canonical: encoded.canonical.toString(),
  digest: encoded.sha256 }));

import { Soterias, observe, canonicalize, Metrics, audit, HistoricalPolicyInputs } from '@soterias/core';
import fs from 'node:fs';
import os from 'node:os';
import path from 'node:path';
import { McpServer } from '@modelcontextprotocol/server';
import { serveStdio } from '@modelcontextprotocol/server/stdio';
import * as z from 'zod/v4';

// Trusted startup: paths, trust and credentials are fixed by the host.
const root = fs.mkdtempSync(path.join(os.tmpdir(), 'soterias-mcp-'));
const sdk = new Soterias({workflow: 'invoice-tools', directory: path.join(root, 'metrics')});
const sum = input => input.cents.reduce((a, b) => a + b, 0);

// Agent input is bounded data. It cannot replace host configuration or trust.
const handle = serveStdio(() => {
  const server = new McpServer({name: 'soterias-canonical', version: '1.0.0'});
  server.registerTool('canonical_json', {
    description: 'Use canonical through the host-selected native SDK.',
    inputSchema: z.object({json: z.string().min(1).max(65536)}).strict(),
  }, async input => {
    try {
      const result = await (async () => {
        const result = canonicalize(Buffer.from(input.json));
return {canonical: result.canonical.toString(), sha256: result.sha256};

      })();
      return {content: [{type: 'text', text: JSON.stringify(result, (_key, value) => typeof value === 'bigint' ? value.toString() : value)}]};
    } catch {
      return {isError: true, content: [{type: 'text', text: 'feature_request_refused'}]};
    }
  });
  return server;
}, {maxSubscriptions: 0});
process.stdin.once('end', () => {
  void (async () => { await handle.close(); await sdk.closeAsync(); })();
});

import { Client } from '@modelcontextprotocol/client';
import { StdioClientTransport } from '@modelcontextprotocol/client/stdio';
import { fileURLToPath } from 'node:url';

const client = new Client({name: 'feature-example', version: '1.0.0'});
try {
  await client.connect(new StdioClientTransport({
    command: process.execPath,
    args: [fileURLToPath(new URL('./mcp.mjs', import.meta.url))],
    env: Object.fromEntries(Object.entries(process.env).filter(([, value]) => value !== undefined)),
  }));
  const result = await client.callTool({name: 'canonical_json', arguments: {json: '{"invoice":42,"currency":"CHF"}'}});
  if (result.isError) throw new Error('Feature request refused');
  console.log(JSON.stringify(result));
} finally { await client.close(); }