A browser's JSON.parse and JSON.stringify turn 1.0 into 1, so a receipt over
serde_json's own text could not be checked from JavaScript (the console, or
any JS agent). The digest now covers the canonical text of the request and
the result: keys sorted by UTF-16 code units, no whitespace, every number as
ECMAScript's Number::toString writes the double, ties between equally near
shortest digits going to the even one, as the standard asks. The receipt
names the form ("canon": "rfc8785"); receipts issued before it still
verify. serde_json reads numbers correctly rounded (float_roundtrip), and a
request whose whole numbers a double cannot hold is refused. Checked against
a JavaScript engine: RFC 8785's appendix B and 3,385 vectors in the tests,
and 2 million random doubles in an opt-in test.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
5794be59d1