[EauDoon]

Problem

Canonicalization checked its byte limit only after constructing the entire output. A small array sharing a 10,000-character string 20,000 times exhausted a constrained Node heap instead of returning the configured 1 MiB limit error.

Change

Account for UTF-8 string/key bytes, escapes, scalar values and structural punctuation incrementally. Reject oversized output before accumulation and preflight strings before allocating their escaped representation. Accepted canonical bytes and digest pins remain unchanged.

Verification

• 407 full-suite tests passed, including constrained-heap and exact-boundary regressions.
• Coverage: 96.18% lines, 91.48% branches, 97.05% functions (local concurrency limited to two).
• Static version/lint/license/dependency/type checks passed.
• 163-file package check and downstream consumer/offline replay checks passed.
• Independent review rebuilt TypeScript and reran 404 top-level test cases.

No policy outcomes, schema versions, releases, deployment settings, credentials or transactions change.