fix(canonical): ensure_ascii=False in legacy canonicalize for cross-lang parity

The legacy canonicalize() serialized string values and object keys with
json.dumps default ensure_ascii=True, which escapes non-ASCII as \uXXXX.
The TypeScript SDK's canonicalize() uses JSON.stringify, which emits raw
UTF-8. Any payload with a non-ASCII character therefore canonicalized
differently in Python than in TypeScript, breaking cross-language
signatures and content hashes for those payloads. Add ensure_ascii=False
to the string-value, object-key, and fallback json.dumps calls. The
strict canonicalize_jcs already did this, so it is unchanged.

ASCII payloads are byte-identical before and after, so existing signatures
and vectors are unaffected; only non-ASCII output changes, to the correct
TypeScript-matching form. Cross-impl raw-UTF-8 test added. Suite 568 passed.

Author: aeoess

src/agent_passport/canonical.py

@@ -36,7 +36,11 @@ def canonicalize(obj) -> str:
             return str(int(obj))
         return json.dumps(obj)
     if isinstance(obj, str):
-        return json.dumps(obj)
+        # ensure_ascii=False to match the TypeScript SDK's JSON.stringify,
+        # which emits raw UTF-8 and does not \u-escape non-ASCII. Without
+        # this, a non-ASCII string canonicalizes differently in Python than
+        # in TypeScript, breaking cross-language signatures and content hashes.
+        return json.dumps(obj, ensure_ascii=False)
     if isinstance(obj, list):
         return "[" + ",".join(canonicalize(item) for item in obj) + "]"
     if isinstance(obj, dict):
@@ -45,10 +49,10 @@ def canonicalize(obj) -> str:
             val = obj[key]
             if val is None:
                 continue
-            pairs.append(json.dumps(key) + ":" + canonicalize(val))
+            pairs.append(json.dumps(key, ensure_ascii=False) + ":" + canonicalize(val))
         return "{" + ",".join(pairs) + "}"
     # Fallback for other types
-    return json.dumps(obj)
+    return json.dumps(obj, ensure_ascii=False)
 
 
 def canonicalize_jcs(obj) -> str:

tests/test_canonical.py

@@ -32,3 +32,15 @@ def test_empty_array():
 
 def test_quotes_in_strings():
     assert canonicalize({"a": 'quotes "inside"'}) == '{"a":"quotes \\"inside\\""}'
+
+
+def test_non_ascii_is_raw_utf8_matching_typescript():
+    # The TypeScript SDK's canonicalize() uses JSON.stringify, which emits raw
+    # UTF-8 and does NOT \u-escape non-ASCII. Python json.dumps defaults to
+    # ensure_ascii=True (\u-escaped), which would diverge and break
+    # cross-language signatures. These pin the raw-UTF-8 form.
+    assert canonicalize("café") == '"café"'
+    assert canonicalize("🤖") == '"🤖"'
+    # Non-ASCII in values and in keys (keys sorted by code point: 'a' < 'café').
+    assert canonicalize({"name": "café"}) == '{"name":"café"}'
+    assert canonicalize({"café": "x", "a": "y"}) == '{"a":"y","café":"x"}'