v0.5.13

@truealter/sdk@0.5.13 is staged on npm and reaches installers when a maintainer approves it with 2FA.

npm install @truealter/sdk

Fixed

• signJson and the floor-signing path canonicalise through JCS, RFC 8785.
  The canonical form is now pinned to a vector suite both this package and the
  Python runtime read, vectors/canonical-jcs-v1.json, rather than to either
  side's word for it. Two implementations that disagree about an action's
  canonical form disagree about every binding computed over it, and do so
  silently. The signatures verify on each side and match on neither.

  Reported from outside, by Iman Schrock of EMILIA Protocol against the
  published package on 2026-09-17, after running this package's own tests
  against EMILIA. He found two classes, small decimal values and non-BMP object
  keys hashing differently across the two runtimes. Sweeping the rest of the
  class found four more, and the worst of those was not one of his: an unpaired
  surrogate raised an unhandled encoding error inside the verifier and reached
  the caller as a server fault rather than as a refused signature.

Added

• vectors/canonical-jcs-v1.json, 16 accept cases and 5 required refusals.
  Ships in the package so the suite is runnable from a clean install. Three of
  the five refusals are exercised on both sides; the other two are unreachable
  in JavaScript, because a parsed value cannot carry a duplicate member name
  and an integer past 2^53 is outside the range RFC 8785 specifies. The Python
  side runs the same file, which is the point of it.

• toolTier() and toolPrice(), which resolve a tool name the way the
  server does. GENERATED_TOOL_TIERS carried only the tools the server's
  own tier dict names, so 21 of the 47 publicly advertised tools were absent
  from it and a raw index of the map returned undefined where the server
  returns free. The map now covers the whole advertised set, and these two
  lookups default an unknown name to free and to no charge, which is what the
  server does at every call site. Indexing the maps directly still works and
  still carries the old hazard for a name neither side knows; read through the
  lookups.