@syncular/core 0.58.0 → 0.59.0

package/dist/blob-ref.d.ts

@@ -9,10 +9,10 @@ export interface BlobRef {
     readonly name?: string;
 }
 /**
- * Parse and validate a raw `blob_ref` string against the §5.9.1 shape. A
- * failure is a row-codec decode error (`sync.invalid_request`), the same
- * class as the tag-5 json parse failure — so codec and §11 rendering can
- * never disagree.
+ * Parse and validate a raw `blob_ref` string (§5.9.1): a valid JSON document
+ * (Conventions JSON validity rule), the pinned shape, and text byte-identical
+ * to `serializeBlobRef` of the parsed fields. A failure is a row-codec decode
+ * error (`sync.invalid_request`) on every decode path.
  */
 export declare function parseBlobRef(raw: string): BlobRef;
 /** Serialize a BlobRef to its canonical string form (§5.9.1 key order). */

package/dist/blob-ref.js

@@ -2,46 +2,31 @@
  * Canonical BlobRef documents (SPEC.md §5.9.1) — the value carried by a
  * `blob_ref` column (§2.4 tag 7).
  *
- * A `blob_ref` value is a `str` holding a JSON document with a pinned shape
- * and pinned key order: `blobId` (content address), `byteLength`, then the
- * optional `mediaType` and `name`. On the wire and in the codec it is
- * byte-for-byte a `str`, validated at decode exactly like `json` (tag 5)
- * plus the shape check below; the raw string is preserved verbatim for
- * re-encoding. Nothing here re-serializes a decoded value — round-trip
- * fidelity is the same rule the `json` tag obeys.
+ * A `blob_ref` value is a `str` holding the canonical serialization of a
+ * pinned shape: `blobId` (content address), `byteLength`, then the optional
+ * `mediaType` and `name`. On the wire and in the codec it is byte-for-byte a
+ * `str`; decode accepts exactly the canonical text, so the raw string a
+ * decoder preserves for re-encoding is the canonical one.
  */
 import { DecodeError } from './errors.js';
+import { parseJsonDocument } from './json-document.js';
 /** The content-address prefix, identical in form to `segmentId` (§5.1). */
 const BLOB_ID_RE = /^sha256:[0-9a-f]{64}$/;
-/** Canonical key order (§5.9.1): blobId, byteLength, mediaType, name. */
-const CANONICAL_KEYS = [
-    'blobId',
-    'byteLength',
-    'mediaType',
-    'name',
-];
 /**
- * Parse and validate a raw `blob_ref` string against the §5.9.1 shape. A
- * failure is a row-codec decode error (`sync.invalid_request`), the same
- * class as the tag-5 json parse failure — so codec and §11 rendering can
- * never disagree.
+ * Parse and validate a raw `blob_ref` string (§5.9.1): a valid JSON document
+ * (Conventions JSON validity rule), the pinned shape, and text byte-identical
+ * to `serializeBlobRef` of the parsed fields. A failure is a row-codec decode
+ * error (`sync.invalid_request`) on every decode path.
  */
 export function parseBlobRef(raw) {
-    let parsed;
-    try {
-        parsed = JSON.parse(raw);
-    }
-    catch {
-        throw new DecodeError('sync.invalid_request', 'blob_ref value does not parse as a JSON document (§5.9.1)');
-    }
+    const parsed = parseJsonDocument(raw, 'blob_ref value');
     if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
         throw new DecodeError('sync.invalid_request', 'blob_ref value must be a JSON object (§5.9.1)');
     }
     const obj = parsed;
-    for (const key of Object.keys(obj)) {
-        if (!CANONICAL_KEYS.includes(key)) {
-            throw new DecodeError('sync.invalid_request', `blob_ref has unknown key ${JSON.stringify(key)} (§5.9.1)`);
-        }
+    const keys = ['blobId', 'byteLength', 'mediaType', 'name'];
+    if (Object.keys(obj).some((key) => !keys.includes(key))) {
+        throw new DecodeError('sync.invalid_request', 'blob_ref has an unknown key (§5.9.1)');
     }
     const { blobId, byteLength, mediaType, name } = obj;
     if (typeof blobId !== 'string' || !BLOB_ID_RE.test(blobId)) {
@@ -58,20 +43,18 @@ export function parseBlobRef(raw) {
     if (name !== undefined && typeof name !== 'string') {
         throw new DecodeError('sync.invalid_request', 'blob_ref.name must be a string when present (§5.9.1)');
     }
-    // Canonical key order: the raw string's keys, in appearance order, must be
-    // a prefix-consistent subsequence of CANONICAL_KEYS (present keys in the
-    // pinned order, absent keys omitted).
-    const presentInOrder = Object.keys(obj);
-    const expectedOrder = CANONICAL_KEYS.filter((k) => Object.hasOwn(obj, k));
-    if (presentInOrder.join(',') !== expectedOrder.join(',')) {
-        throw new DecodeError('sync.invalid_request', 'blob_ref keys are not in canonical order (§5.9.1)');
-    }
-    return {
+    const ref = {
         blobId,
         byteLength,
         ...(mediaType !== undefined ? { mediaType } : {}),
         ...(name !== undefined ? { name } : {}),
     };
+    // Reordered or duplicate keys, whitespace, and a byteLength written as
+    // `1e2`, `3.0` or `-0` all differ from the canonical text.
+    if (serializeBlobRef(ref) !== raw) {
+        throw new DecodeError('sync.invalid_request', 'blob_ref is not in canonical form (§5.9.1)');
+    }
+    return ref;
 }
 /** Serialize a BlobRef to its canonical string form (§5.9.1 key order). */
 export function serializeBlobRef(ref) {

package/dist/crypto.js

@@ -13,6 +13,7 @@
  * is the symmetric core and the envelope both sides agree on byte-for-byte.
  */
 import { ByteReader, ByteWriter } from './bytes.js';
+import { parseJsonDocument } from './json-document.js';
 /** Envelope version byte (SPEC.md §5.11). */
 export const ENVELOPE_VERSION = 0x01;
 /** AES-GCM nonce length (96-bit, the GCM standard). */
@@ -113,7 +114,7 @@ export function deserializePlain(declaredType, bytes) {
             }
             if (declaredType === 'json' || declaredType === 'blob_ref') {
                 try {
-                    JSON.parse(text);
+                    parseJsonDocument(text, `decrypted ${declaredType} value`);
                 }
                 catch {
                     throw new DecryptError(`decrypted ${declaredType} value does not parse`);

package/dist/index.d.ts

@@ -13,6 +13,7 @@ export * from './constants.js';
 export * from './crypto.js';
 export * from './errors.js';
 export * from './frames.js';
+export * from './json-document.js';
 export * from './message.js';
 export * from './realtime.js';
 export * from './rejection-details.js';

package/dist/index.js

@@ -13,6 +13,7 @@ export * from './constants.js';
 export * from './crypto.js';
 export * from './errors.js';
 export * from './frames.js';
+export * from './json-document.js';
 export * from './message.js';
 export * from './realtime.js';
 export * from './rejection-details.js';

package/dist/json-document.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Parse `raw` as a JSON document under the validity rule, which is defined on
+ * the raw text: RFC 8259, at most 64 nested containers anywhere in the text,
+ * every number token a finite binary64, no U+0000 and no unpaired surrogate in
+ * any string token (key or value), written literally or as a `\u` escape.
+ * `JSON.parse` drops values shadowed by a duplicate key, so one lexical pass
+ * over the text checks what the parser cannot see. A violation throws
+ * `DecodeError` (`sync.invalid_request`); `what` names the field in the
+ * message.
+ */
+export declare function parseJsonDocument(raw: string, what: string): unknown;

package/dist/json-document.js

@@ -0,0 +1,50 @@
+/**
+ * The JSON validity rule (SPEC.md Conventions): the one definition of a valid
+ * JSON document for envelope `json` fields, push-payload `json` columns and
+ * `blob_ref` values. The Rust core (`ssp2::primitives::parse_json_document`)
+ * accepts exactly the same documents.
+ */
+import { DecodeError } from './errors.js';
+const MAX_DEPTH = 64;
+/**
+ * Parse `raw` as a JSON document under the validity rule, which is defined on
+ * the raw text: RFC 8259, at most 64 nested containers anywhere in the text,
+ * every number token a finite binary64, no U+0000 and no unpaired surrogate in
+ * any string token (key or value), written literally or as a `\u` escape.
+ * `JSON.parse` drops values shadowed by a duplicate key, so one lexical pass
+ * over the text checks what the parser cannot see. A violation throws
+ * `DecodeError` (`sync.invalid_request`); `what` names the field in the
+ * message.
+ */
+export function parseJsonDocument(raw, what) {
+    let value;
+    try {
+        value = JSON.parse(raw);
+    }
+    catch {
+        throw new DecodeError('sync.invalid_request', `${what} does not parse as a JSON document`);
+    }
+    let depth = 0;
+    for (const [token] of raw.matchAll(/"(?:[^"\\]|\\.)*"|[[{\]}]|-?\d[\d.eE+-]*/g)) {
+        const head = token[0];
+        if (head === '[' || head === '{') {
+            if (++depth > MAX_DEPTH) {
+                throw new DecodeError('sync.invalid_request', `${what} nests deeper than ${MAX_DEPTH} containers`);
+            }
+        }
+        else if (head === ']' || head === '}') {
+            depth--;
+        }
+        else if (head === '"') {
+            // In `u` mode `\p{Cs}` matches only a surrogate outside a pair.
+            const text = token.includes('\\') ? JSON.parse(token) : token;
+            if (text.includes('\u0000') || /\p{Cs}/u.test(text)) {
+                throw new DecodeError('sync.invalid_request', `${what} holds a string with U+0000 or an unpaired surrogate`);
+            }
+        }
+        else if (!Number.isFinite(Number(token))) {
+            throw new DecodeError('sync.invalid_request', `${what} holds a number outside finite binary64`);
+        }
+    }
+    return value;
+}

package/dist/message.d.ts

@@ -4,7 +4,7 @@ export interface ReqHeaderFrame {
     type: 'REQ_HEADER';
     clientId: string;
     schemaVersion: number;
-    /** Wire v2 partition log identity; absent requests epoch acquisition. */
+    /** Partition log identity; absent requests epoch acquisition. */
     logEpoch?: string;
 }
 export interface PushOperation {
@@ -58,10 +58,10 @@ export interface RespHeaderFrame {
     type: 'RESP_HEADER';
     requiredSchemaVersion?: number;
     latestSchemaVersion?: number;
-    /** Required and non-empty on wire v2. */
-    logEpoch?: string;
-    /** Required on wire v2. True produces a header-only reset response. */
-    resetRequired?: boolean;
+    /** Partition log identity, non-empty. */
+    logEpoch: string;
+    /** True produces a header-only reset response. */
+    resetRequired: boolean;
 }
 /** §7.3.2: a server-issued auth lease delivered to the client (opaque). */
 export interface LeaseFrame {

package/dist/message.js

@@ -14,6 +14,7 @@
 import { ByteReader, ByteWriter, readStringListMap, readStringMap, utf8Encode, writeStringListMap, writeStringMap, } from './bytes.js';
 import { isSupportedProtocolWireVersion, SYNC_PACK_MAGIC } from './constants.js';
 import { DecodeError } from './errors.js';
+import { parseJsonDocument } from './json-document.js';
 import { FrameType, KNOWN_FRAME_TYPES, REQUEST_FRAME_TYPES, RESPONSE_FRAME_TYPES, } from './frames.js';
 import { normalizeRejectionDetails, } from './rejection-details.js';
 import { decodeRowsSegment } from './segment.js';
@@ -28,13 +29,10 @@ function definedObject(record) {
 function invalid(message) {
     throw new DecodeError('sync.invalid_request', message);
 }
-function requireJsonDocument(raw, what) {
-    try {
-        JSON.parse(raw);
-    }
-    catch {
-        invalid(`${what} is not a valid JSON document`);
-    }
+/** A `json` field: a valid JSON document (Conventions), kept as raw text. */
+function readJson(r, what) {
+    const raw = r.str();
+    parseJsonDocument(raw, what);
     return raw;
 }
 /** §1.5: a `ROUND_FAILURE` code is a lowercase dotted catalog code. */
@@ -53,21 +51,19 @@ function validateRoundFailureCode(code, fail) {
 // ---------------------------------------------------------------------------
 // Frame payload decoders (each consumes exactly the frame payload)
 // ---------------------------------------------------------------------------
-function decodeReqHeader(r, wireVersion) {
+function decodeReqHeader(r) {
     const clientId = r.str();
     if (clientId.length === 0)
         invalid('REQ_HEADER.clientId must be non-empty');
     const schemaVersion = r.i32();
     if (schemaVersion < 1)
         invalid('REQ_HEADER.schemaVersion must be >= 1');
-    const logEpoch = wireVersion >= 2
-        ? r.opt(() => {
-            const value = r.str();
-            if (value.length === 0)
-                invalid('REQ_HEADER.logEpoch must be non-empty');
-            return value;
-        })
-        : undefined;
+    const logEpoch = r.opt(() => {
+        const value = r.str();
+        if (value.length === 0)
+            invalid('REQ_HEADER.logEpoch must be non-empty');
+        return value;
+    });
     return definedObject({
         type: 'REQ_HEADER',
         clientId,
@@ -139,9 +135,9 @@ function decodeSubscription(r) {
     const id = r.str();
     const table = r.str();
     const scopes = readStringListMap(r);
-    const params = r.opt(() => requireJsonDocument(r.str(), 'SUBSCRIPTION.params'));
+    const params = r.opt(() => readJson(r, 'SUBSCRIPTION.params'));
     const cursor = r.i64();
-    const bootstrapState = r.opt(() => requireJsonDocument(r.str(), 'SUBSCRIPTION.bootstrapState'));
+    const bootstrapState = r.opt(() => readJson(r, 'SUBSCRIPTION.bootstrapState'));
     return definedObject({
         type: 'SUBSCRIPTION',
         id,
@@ -152,20 +148,20 @@ function decodeSubscription(r) {
         bootstrapState: bootstrapState,
     });
 }
-function decodeRespHeader(r, wireVersion) {
+function decodeRespHeader(r) {
     const requiredSchemaVersion = r.opt(() => r.i32());
     const latestSchemaVersion = r.opt(() => r.i32());
-    const logEpoch = wireVersion >= 2 ? r.str() : undefined;
-    if (logEpoch !== undefined && logEpoch.length === 0) {
+    const logEpoch = r.str();
+    if (logEpoch.length === 0) {
         invalid('RESP_HEADER.logEpoch must be non-empty');
     }
-    const resetRequired = wireVersion >= 2 ? r.bool() : undefined;
+    const resetRequired = r.bool();
     return definedObject({
         type: 'RESP_HEADER',
         requiredSchemaVersion: requiredSchemaVersion,
         latestSchemaVersion: latestSchemaVersion,
-        logEpoch: logEpoch,
-        resetRequired: resetRequired,
+        logEpoch,
+        resetRequired,
     });
 }
 function decodeLease(r) {
@@ -250,9 +246,10 @@ function decodePushResultDetails(r) {
             invalid('PUSH_RESULT_DETAILS opIndex values must be unique and non-negative');
         }
         seen.add(opIndex);
+        const parsed = parseJsonDocument(r.str(), 'PUSH_RESULT_DETAILS.details');
         let details;
         try {
-            details = normalizeRejectionDetails(JSON.parse(r.str()));
+            details = normalizeRejectionDetails(parsed);
         }
         catch (error) {
             invalid(`invalid PUSH_RESULT_DETAILS.details: ${error instanceof Error ? error.message : String(error)}`);
@@ -375,7 +372,7 @@ function decodeSegmentInline(r) {
 }
 function decodeSubEnd(r) {
     const nextCursor = r.i64();
-    const bootstrapState = r.opt(() => requireJsonDocument(r.str(), 'SUB_END.bootstrapState'));
+    const bootstrapState = r.opt(() => readJson(r, 'SUB_END.bootstrapState'));
     return definedObject({
         type: 'SUB_END',
         nextCursor,
@@ -388,7 +385,7 @@ function decodeErrorFrame(r) {
     const category = r.str();
     const retryable = r.bool();
     const recommendedAction = r.str();
-    const details = r.opt(() => requireJsonDocument(r.str(), 'ERROR.details'));
+    const details = r.opt(() => readJson(r, 'ERROR.details'));
     return definedObject({
         type: 'ERROR',
         code,
@@ -399,12 +396,12 @@ function decodeErrorFrame(r) {
         details: details,
     });
 }
-function decodeRequestFrame(frameType, payload, wireVersion) {
+function decodeRequestFrame(frameType, payload) {
     const r = new ByteReader(payload);
     let frame;
     switch (frameType) {
         case FrameType.REQ_HEADER:
-            frame = decodeReqHeader(r, wireVersion);
+            frame = decodeReqHeader(r);
             break;
         case FrameType.ROUND_FAILURE:
             frame = decodeRoundFailure(r);
@@ -427,12 +424,12 @@ function decodeRequestFrame(frameType, payload, wireVersion) {
     r.expectFullyConsumed(`${frame.type} frame payload`);
     return frame;
 }
-function decodeResponseFrame(frameType, payload, wireVersion) {
+function decodeResponseFrame(frameType, payload) {
     const r = new ByteReader(payload);
     let frame;
     switch (frameType) {
         case FrameType.RESP_HEADER:
-            frame = decodeRespHeader(r, wireVersion);
+            frame = decodeRespHeader(r);
             break;
         case FrameType.LEASE:
             frame = decodeLease(r);
@@ -641,7 +638,7 @@ const MEDIA_TYPE_BYTES = { rows: 1, sqlite: 2 };
 function encodeInvalid(message) {
     throw new Error(message);
 }
-function encodeFrame(frame, wireVersion) {
+function encodeFrame(frame) {
     const w = new ByteWriter();
     switch (frame.type) {
         case 'REQ_HEADER': {
@@ -653,15 +650,10 @@ function encodeFrame(frame, wireVersion) {
             }
             w.str(frame.clientId);
             w.i32(frame.schemaVersion);
-            if (wireVersion >= 2) {
-                if (frame.logEpoch === '') {
-                    encodeInvalid('REQ_HEADER.logEpoch must be non-empty');
-                }
-                w.opt(frame.logEpoch, (v) => w.str(v));
-            }
-            else if (frame.logEpoch !== undefined) {
-                encodeInvalid('REQ_HEADER.logEpoch requires wireVersion 2');
+            if (frame.logEpoch === '') {
+                encodeInvalid('REQ_HEADER.logEpoch must be non-empty');
             }
+            w.opt(frame.logEpoch, (v) => w.str(v));
             break;
         }
         case 'ROUND_FAILURE': {
@@ -715,20 +707,11 @@ function encodeFrame(frame, wireVersion) {
         case 'RESP_HEADER': {
             w.opt(frame.requiredSchemaVersion, (v) => w.i32(v));
             w.opt(frame.latestSchemaVersion, (v) => w.i32(v));
-            if (wireVersion >= 2) {
-                if (frame.logEpoch === undefined || frame.logEpoch.length === 0) {
-                    encodeInvalid('RESP_HEADER.logEpoch is required and non-empty');
-                }
-                if (frame.resetRequired === undefined) {
-                    encodeInvalid('RESP_HEADER.resetRequired is required');
-                }
-                w.str(frame.logEpoch);
-                w.bool(frame.resetRequired);
-            }
-            else if (frame.logEpoch !== undefined ||
-                frame.resetRequired !== undefined) {
-                encodeInvalid('RESP_HEADER epoch fields require wireVersion 2');
+            if (frame.logEpoch.length === 0) {
+                encodeInvalid('RESP_HEADER.logEpoch must be non-empty');
             }
+            w.str(frame.logEpoch);
+            w.bool(frame.resetRequired);
             break;
         }
         case 'LEASE': {
@@ -892,7 +875,7 @@ export function encodeMessage(message) {
     w.u8(message.msgKind === 'request' ? 0x01 : 0x02);
     w.u8(0x00);
     for (const frame of message.frames) {
-        const { frameType, payload } = encodeFrame(frame, message.wireVersion);
+        const { frameType, payload } = encodeFrame(frame);
         w.u8(frameType);
         w.u32(payload.length);
         w.raw(payload);
@@ -948,7 +931,7 @@ export function decodeMessage(bytes) {
         const message = {
             wireVersion,
             msgKind: 'request',
-            frames: readFrames(r, (frameType, payload) => decodeRequestFrame(frameType, payload, wireVersion)),
+            frames: readFrames(r, (frameType, payload) => decodeRequestFrame(frameType, payload)),
         };
         validateRequestSequence(message.frames);
         return message;
@@ -956,7 +939,7 @@ export function decodeMessage(bytes) {
     const message = {
         wireVersion,
         msgKind: 'response',
-        frames: readFrames(r, (frameType, payload) => decodeResponseFrame(frameType, payload, wireVersion)),
+        frames: readFrames(r, (frameType, payload) => decodeResponseFrame(frameType, payload)),
     };
     validateResponseSequence(message.frames);
     return message;

package/dist/realtime.d.ts

@@ -34,6 +34,8 @@ export interface RealtimeHeartbeatEvent {
 }
 /** §8.6.2 presence fanout kind — a closed set of three. */
 export type PresenceKind = 'join' | 'update' | 'leave';
+/** §8.6.2 publisher-directed presence rejection code — a closed set of two. */
+export type PresenceErrorCode = 'presence.too_large' | 'presence.forbidden';
 /**
  * Server → client presence fanout (§8.6.2): a scope-mate's presence for a
  * key the receiver holds changed. `doc` is the peer's document for
@@ -49,7 +51,7 @@ export interface RealtimePresenceEvent {
         actorId?: string;
         clientId?: string;
         doc?: Record<string, unknown> | null;
-        error?: string;
+        error?: PresenceErrorCode;
         timestamp?: number;
     };
 }
@@ -59,14 +61,6 @@ export interface RealtimeAck {
     type: 'ack';
     cursor: number;
 }
-/** Client → server presence publish/leave (§8.6.2). `doc: null` = leave. */
-export interface RealtimePresencePublish {
-    event: 'presence';
-    data: {
-        scopeKey: string;
-        doc: Record<string, unknown> | null;
-    };
-}
 export type ParsedRealtimeEvent = {
     known: true;
     event: RealtimeServerEvent;
@@ -82,11 +76,3 @@ export declare function encodePresenceFanout(scopeKey: string, kind: PresenceKin
  * (§8.6.2 `presence.too_large` / `presence.forbidden`). */
 export declare function encodePresenceError(scopeKey: string, error: string, timestamp: number): string;
 export declare function parseRealtimeServerEvent(text: string): ParsedRealtimeEvent;
-/**
- * Parse a client → server presence publish/leave (§8.6.2). Used by the
- * server to validate inbound `presence` control messages. A malformed
- * message (missing/empty `scopeKey`, or a `doc` that is neither an object
- * nor `null`) throws a `DecodeError` — a known event with wrong-shape data
- * is never a tolerated variant (§8.1).
- */
-export declare function parseRealtimePresencePublish(text: string): RealtimePresencePublish;

package/dist/realtime.js

@@ -9,6 +9,7 @@
  * `known: false` for unrecognized event names instead of failing.
  */
 import { DecodeError } from './errors.js';
+import { parseJsonDocument } from './json-document.js';
 /** §8.7 channel tag: a standalone SSP2 response message — a delta. */
 export const REALTIME_TAG_DELTA = 0x00;
 /** §8.7 channel tag: one chunk of the in-flight sync round's byte
@@ -67,14 +68,7 @@ const WAKE_REASONS = [
     'reset-required',
 ];
 export function parseRealtimeServerEvent(text) {
-    let value;
-    try {
-        value = JSON.parse(text);
-    }
-    catch {
-        malformed('not valid JSON');
-    }
-    const root = requireObject(value, 'control message');
+    const root = requireObject(parseJsonDocument(text, 'control message'), 'control message');
     const event = requireString(root.event, 'event');
     if (event === 'hello') {
         const data = requireObject(root.data, 'hello.data');
@@ -194,32 +188,3 @@ function requirePresenceDocObject(value) {
         malformed('presence.data.doc must be a JSON object');
     }
 }
-/**
- * Parse a client → server presence publish/leave (§8.6.2). Used by the
- * server to validate inbound `presence` control messages. A malformed
- * message (missing/empty `scopeKey`, or a `doc` that is neither an object
- * nor `null`) throws a `DecodeError` — a known event with wrong-shape data
- * is never a tolerated variant (§8.1).
- */
-export function parseRealtimePresencePublish(text) {
-    let value;
-    try {
-        value = JSON.parse(text);
-    }
-    catch {
-        malformed('not valid JSON');
-    }
-    const root = requireObject(value, 'control message');
-    if (root.event !== 'presence') {
-        malformed('not a presence control message');
-    }
-    const data = requireObject(root.data, 'presence.data');
-    const scopeKey = validatePresenceScopeKey(data.scopeKey);
-    const doc = data.doc;
-    if (doc !== null)
-        requirePresenceDocObject(doc);
-    return {
-        event: 'presence',
-        data: { scopeKey, doc: doc },
-    };
-}

package/dist/row-codec.d.ts

@@ -49,7 +49,10 @@ export declare function encodeSparseRow(columns: readonly RowColumn[], primaryKe
  *
  * Decode checks, in order (each a decode error, RFC §6.1): a set presence
  * padding bit, an absent primary-key column, a set null-bitmap padding bit
- * (a null for an absent column), a null bit for a non-nullable column.
+ * (a null for an absent column), a null bit for a non-nullable column. Each
+ * present value must also be a push admission value (SPEC.md §2.4): no
+ * U+0000 in a `string`, a `json` value under the JSON validity rule, a finite
+ * `float`, a canonical `blob_ref`.
  */
 export declare function decodeSparseRow(columns: readonly RowColumn[], primaryKeyIndex: number, bytes: Uint8Array): SparseRowValue[];
 export declare function writeRow(writer: ByteWriter, columns: readonly RowColumn[], values: readonly RowValue[]): void;

package/dist/row-codec.js

@@ -15,6 +15,7 @@
 import { parseBlobRef } from './blob-ref.js';
 import { ByteReader, ByteWriter } from './bytes.js';
 import { DecodeError, EncodeError } from './errors.js';
+import { parseJsonDocument } from './json-document.js';
 /** Wire tags, unchanged from v1's binary-table-v1 assignment (SPEC.md §2.4). */
 const TYPE_TO_TAG = {
     string: 1,
@@ -82,9 +83,10 @@ function readValue(reader, column) {
         case 'string':
             return reader.str();
         case 'json': {
-            // Conventions `json` MUST, applied at row-codec decode (SPEC.md §2.4
-            // tag 5): the value must parse as a JSON document; the raw string is
-            // preserved verbatim for round-trip fidelity.
+            // SPEC.md §2.4 tag 5: the value must parse as a JSON document; the raw
+            // string is preserved verbatim for round-trip fidelity. Full rows stay
+            // this permissive so stored rows keep decoding; `decodeSparseRow`
+            // applies the JSON validity rule on top.
             const raw = reader.str();
             try {
                 JSON.parse(raw);
@@ -96,8 +98,8 @@ function readValue(reader, column) {
         }
         case 'blob_ref': {
             // §2.4 tag 7: the value is a canonical BlobRef JSON document
-            // (§5.9.1). Validated at decode, same class as tag-5 json; the raw
-            // string is preserved verbatim for re-encoding.
+            // (§5.9.1), checked on every decode path; the raw string is preserved
+            // verbatim for re-encoding.
             const raw = reader.str();
             parseBlobRef(raw);
             return raw;
@@ -176,7 +178,10 @@ export function encodeSparseRow(columns, primaryKeyIndex, values) {
  *
  * Decode checks, in order (each a decode error, RFC §6.1): a set presence
  * padding bit, an absent primary-key column, a set null-bitmap padding bit
- * (a null for an absent column), a null bit for a non-nullable column.
+ * (a null for an absent column), a null bit for a non-nullable column. Each
+ * present value must also be a push admission value (SPEC.md §2.4): no
+ * U+0000 in a `string`, a `json` value under the JSON validity rule, a finite
+ * `float`, a canonical `blob_ref`.
  */
 export function decodeSparseRow(columns, primaryKeyIndex, bytes) {
     const reader = new ByteReader(bytes);
@@ -217,7 +222,24 @@ export function decodeSparseRow(columns, primaryKeyIndex, bytes) {
         const isNull = bitmapBit(nulls, present);
         present++;
         if (!isNull) {
-            values.push(readValue(reader, column));
+            const value = readValue(reader, column);
+            // Push admission values (SPEC.md §2.4): one value set every storage
+            // backend and core accepts. `blob_ref` canonicality is already checked
+            // by `readValue` on every path.
+            if (column.type === 'string' &&
+                typeof value === 'string' &&
+                value.includes('\u0000')) {
+                throw new DecodeError('sync.invalid_request', `string column ${column.name} holds U+0000`);
+            }
+            if (column.type === 'json' && typeof value === 'string') {
+                parseJsonDocument(value, `json column ${column.name}`);
+            }
+            if (column.type === 'float' &&
+                typeof value === 'number' &&
+                !Number.isFinite(value)) {
+                throw new DecodeError('sync.invalid_request', `float column ${column.name} holds NaN or an infinity`);
+            }
+            values.push(value);
             continue;
         }
         if (!column.nullable) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@syncular/core",
-  "version": "0.58.0",
+  "version": "0.59.0",
   "description": "Core protocol types and shared utilities for the Syncular sync framework",
   "license": "Apache-2.0",
   "author": "Benjamin Kniffler",

package/src/blob-ref.ts

@@ -2,15 +2,14 @@
  * Canonical BlobRef documents (SPEC.md §5.9.1) — the value carried by a
  * `blob_ref` column (§2.4 tag 7).
  *
- * A `blob_ref` value is a `str` holding a JSON document with a pinned shape
- * and pinned key order: `blobId` (content address), `byteLength`, then the
- * optional `mediaType` and `name`. On the wire and in the codec it is
- * byte-for-byte a `str`, validated at decode exactly like `json` (tag 5)
- * plus the shape check below; the raw string is preserved verbatim for
- * re-encoding. Nothing here re-serializes a decoded value — round-trip
- * fidelity is the same rule the `json` tag obeys.
+ * A `blob_ref` value is a `str` holding the canonical serialization of a
+ * pinned shape: `blobId` (content address), `byteLength`, then the optional
+ * `mediaType` and `name`. On the wire and in the codec it is byte-for-byte a
+ * `str`; decode accepts exactly the canonical text, so the raw string a
+ * decoder preserves for re-encoding is the canonical one.
  */
 import { DecodeError } from './errors';
+import { parseJsonDocument } from './json-document';
 
 /** The content-address prefix, identical in form to `segmentId` (§5.1). */
 const BLOB_ID_RE = /^sha256:[0-9a-f]{64}$/;
@@ -26,30 +25,14 @@ export interface BlobRef {
   readonly name?: string;
 }
 
-/** Canonical key order (§5.9.1): blobId, byteLength, mediaType, name. */
-const CANONICAL_KEYS: readonly string[] = [
-  'blobId',
-  'byteLength',
-  'mediaType',
-  'name',
-];
-
 /**
- * Parse and validate a raw `blob_ref` string against the §5.9.1 shape. A
- * failure is a row-codec decode error (`sync.invalid_request`), the same
- * class as the tag-5 json parse failure — so codec and §11 rendering can
- * never disagree.
+ * Parse and validate a raw `blob_ref` string (§5.9.1): a valid JSON document
+ * (Conventions JSON validity rule), the pinned shape, and text byte-identical
+ * to `serializeBlobRef` of the parsed fields. A failure is a row-codec decode
+ * error (`sync.invalid_request`) on every decode path.
  */
 export function parseBlobRef(raw: string): BlobRef {
-  let parsed: unknown;
-  try {
-    parsed = JSON.parse(raw);
-  } catch {
-    throw new DecodeError(
-      'sync.invalid_request',
-      'blob_ref value does not parse as a JSON document (§5.9.1)',
-    );
-  }
+  const parsed = parseJsonDocument(raw, 'blob_ref value');
   if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
     throw new DecodeError(
       'sync.invalid_request',
@@ -57,13 +40,12 @@ export function parseBlobRef(raw: string): BlobRef {
     );
   }
   const obj = parsed as Record<string, unknown>;
-  for (const key of Object.keys(obj)) {
-    if (!CANONICAL_KEYS.includes(key)) {
-      throw new DecodeError(
-        'sync.invalid_request',
-        `blob_ref has unknown key ${JSON.stringify(key)} (§5.9.1)`,
-      );
-    }
+  const keys = ['blobId', 'byteLength', 'mediaType', 'name'];
+  if (Object.keys(obj).some((key) => !keys.includes(key))) {
+    throw new DecodeError(
+      'sync.invalid_request',
+      'blob_ref has an unknown key (§5.9.1)',
+    );
   }
   const { blobId, byteLength, mediaType, name } = obj;
   if (typeof blobId !== 'string' || !BLOB_ID_RE.test(blobId)) {
@@ -94,23 +76,21 @@ export function parseBlobRef(raw: string): BlobRef {
       'blob_ref.name must be a string when present (§5.9.1)',
     );
   }
-  // Canonical key order: the raw string's keys, in appearance order, must be
-  // a prefix-consistent subsequence of CANONICAL_KEYS (present keys in the
-  // pinned order, absent keys omitted).
-  const presentInOrder = Object.keys(obj);
-  const expectedOrder = CANONICAL_KEYS.filter((k) => Object.hasOwn(obj, k));
-  if (presentInOrder.join(',') !== expectedOrder.join(',')) {
-    throw new DecodeError(
-      'sync.invalid_request',
-      'blob_ref keys are not in canonical order (§5.9.1)',
-    );
-  }
-  return {
+  const ref: BlobRef = {
     blobId,
     byteLength,
     ...(mediaType !== undefined ? { mediaType } : {}),
     ...(name !== undefined ? { name } : {}),
   };
+  // Reordered or duplicate keys, whitespace, and a byteLength written as
+  // `1e2`, `3.0` or `-0` all differ from the canonical text.
+  if (serializeBlobRef(ref) !== raw) {
+    throw new DecodeError(
+      'sync.invalid_request',
+      'blob_ref is not in canonical form (§5.9.1)',
+    );
+  }
+  return ref;
 }
 
 /** Serialize a BlobRef to its canonical string form (§5.9.1 key order). */

package/src/crypto.ts

@@ -13,6 +13,7 @@
  * is the symmetric core and the envelope both sides agree on byte-for-byte.
  */
 import { ByteReader, ByteWriter } from './bytes';
+import { parseJsonDocument } from './json-document';
 
 /** The pre-flip application type of an encrypted column (SPEC.md §5.11). */
 export type DeclaredType =
@@ -150,7 +151,7 @@ export function deserializePlain(
       }
       if (declaredType === 'json' || declaredType === 'blob_ref') {
         try {
-          JSON.parse(text);
+          parseJsonDocument(text, `decrypted ${declaredType} value`);
         } catch {
           throw new DecryptError(
             `decrypted ${declaredType} value does not parse`,

package/src/index.ts

@@ -13,6 +13,7 @@ export * from './constants';
 export * from './crypto';
 export * from './errors';
 export * from './frames';
+export * from './json-document';
 export * from './message';
 export * from './realtime';
 export * from './rejection-details';

package/src/json-document.ts

@@ -0,0 +1,62 @@
+/**
+ * The JSON validity rule (SPEC.md Conventions): the one definition of a valid
+ * JSON document for envelope `json` fields, push-payload `json` columns and
+ * `blob_ref` values. The Rust core (`ssp2::primitives::parse_json_document`)
+ * accepts exactly the same documents.
+ */
+import { DecodeError } from './errors';
+
+const MAX_DEPTH = 64;
+
+/**
+ * Parse `raw` as a JSON document under the validity rule, which is defined on
+ * the raw text: RFC 8259, at most 64 nested containers anywhere in the text,
+ * every number token a finite binary64, no U+0000 and no unpaired surrogate in
+ * any string token (key or value), written literally or as a `\u` escape.
+ * `JSON.parse` drops values shadowed by a duplicate key, so one lexical pass
+ * over the text checks what the parser cannot see. A violation throws
+ * `DecodeError` (`sync.invalid_request`); `what` names the field in the
+ * message.
+ */
+export function parseJsonDocument(raw: string, what: string): unknown {
+  let value: unknown;
+  try {
+    value = JSON.parse(raw);
+  } catch {
+    throw new DecodeError(
+      'sync.invalid_request',
+      `${what} does not parse as a JSON document`,
+    );
+  }
+  let depth = 0;
+  for (const [token] of raw.matchAll(
+    /"(?:[^"\\]|\\.)*"|[[{\]}]|-?\d[\d.eE+-]*/g,
+  )) {
+    const head = token[0];
+    if (head === '[' || head === '{') {
+      if (++depth > MAX_DEPTH) {
+        throw new DecodeError(
+          'sync.invalid_request',
+          `${what} nests deeper than ${MAX_DEPTH} containers`,
+        );
+      }
+    } else if (head === ']' || head === '}') {
+      depth--;
+    } else if (head === '"') {
+      // In `u` mode `\p{Cs}` matches only a surrogate outside a pair.
+      const text: string = token.includes('\\') ? JSON.parse(token) : token;
+      if (text.includes('\u0000') || /\p{Cs}/u.test(text)) {
+        throw new DecodeError(
+          'sync.invalid_request',
+          `${what} holds a string with U+0000 or an unpaired surrogate`,
+        );
+      }
+    } else if (!Number.isFinite(Number(token))) {
+      throw new DecodeError(
+        'sync.invalid_request',
+        `${what} holds a number outside finite binary64`,
+      );
+    }
+  }
+  return value;
+}

package/src/message.ts

@@ -22,6 +22,7 @@ import {
 } from './bytes';
 import { isSupportedProtocolWireVersion, SYNC_PACK_MAGIC } from './constants';
 import { DecodeError } from './errors';
+import { parseJsonDocument } from './json-document';
 import {
   FrameType,
   KNOWN_FRAME_TYPES,
@@ -42,7 +43,7 @@ export interface ReqHeaderFrame {
   type: 'REQ_HEADER';
   clientId: string;
   schemaVersion: number;
-  /** Wire v2 partition log identity; absent requests epoch acquisition. */
+  /** Partition log identity; absent requests epoch acquisition. */
   logEpoch?: string;
 }
 
@@ -110,10 +111,10 @@ export interface RespHeaderFrame {
   type: 'RESP_HEADER';
   requiredSchemaVersion?: number;
   latestSchemaVersion?: number;
-  /** Required and non-empty on wire v2. */
-  logEpoch?: string;
-  /** Required on wire v2. True produces a header-only reset response. */
-  resetRequired?: boolean;
+  /** Partition log identity, non-empty. */
+  logEpoch: string;
+  /** True produces a header-only reset response. */
+  resetRequired: boolean;
 }
 
 /** §7.3.2: a server-issued auth lease delivered to the client (opaque). */
@@ -286,12 +287,10 @@ function invalid(message: string): never {
   throw new DecodeError('sync.invalid_request', message);
 }
 
-function requireJsonDocument(raw: string, what: string): string {
-  try {
-    JSON.parse(raw);
-  } catch {
-    invalid(`${what} is not a valid JSON document`);
-  }
+/** A `json` field: a valid JSON document (Conventions), kept as raw text. */
+function readJson(r: ByteReader, what: string): string {
+  const raw = r.str();
+  parseJsonDocument(raw, what);
   return raw;
 }
 
@@ -320,20 +319,16 @@ function validateRoundFailureCode(
 // Frame payload decoders (each consumes exactly the frame payload)
 // ---------------------------------------------------------------------------
 
-function decodeReqHeader(r: ByteReader, wireVersion: number): ReqHeaderFrame {
+function decodeReqHeader(r: ByteReader): ReqHeaderFrame {
   const clientId = r.str();
   if (clientId.length === 0) invalid('REQ_HEADER.clientId must be non-empty');
   const schemaVersion = r.i32();
   if (schemaVersion < 1) invalid('REQ_HEADER.schemaVersion must be >= 1');
-  const logEpoch =
-    wireVersion >= 2
-      ? r.opt(() => {
-          const value = r.str();
-          if (value.length === 0)
-            invalid('REQ_HEADER.logEpoch must be non-empty');
-          return value;
-        })
-      : undefined;
+  const logEpoch = r.opt(() => {
+    const value = r.str();
+    if (value.length === 0) invalid('REQ_HEADER.logEpoch must be non-empty');
+    return value;
+  });
   return definedObject({
     type: 'REQ_HEADER',
     clientId,
@@ -411,12 +406,10 @@ function decodeSubscription(r: ByteReader): SubscriptionFrame {
   const id = r.str();
   const table = r.str();
   const scopes = readStringListMap(r);
-  const params = r.opt(() =>
-    requireJsonDocument(r.str(), 'SUBSCRIPTION.params'),
-  );
+  const params = r.opt(() => readJson(r, 'SUBSCRIPTION.params'));
   const cursor = r.i64();
   const bootstrapState = r.opt(() =>
-    requireJsonDocument(r.str(), 'SUBSCRIPTION.bootstrapState'),
+    readJson(r, 'SUBSCRIPTION.bootstrapState'),
   );
   return definedObject({
     type: 'SUBSCRIPTION',
@@ -429,20 +422,20 @@ function decodeSubscription(r: ByteReader): SubscriptionFrame {
   });
 }
 
-function decodeRespHeader(r: ByteReader, wireVersion: number): RespHeaderFrame {
+function decodeRespHeader(r: ByteReader): RespHeaderFrame {
   const requiredSchemaVersion = r.opt(() => r.i32());
   const latestSchemaVersion = r.opt(() => r.i32());
-  const logEpoch = wireVersion >= 2 ? r.str() : undefined;
-  if (logEpoch !== undefined && logEpoch.length === 0) {
+  const logEpoch = r.str();
+  if (logEpoch.length === 0) {
     invalid('RESP_HEADER.logEpoch must be non-empty');
   }
-  const resetRequired = wireVersion >= 2 ? r.bool() : undefined;
+  const resetRequired = r.bool();
   return definedObject({
     type: 'RESP_HEADER',
     requiredSchemaVersion: requiredSchemaVersion,
     latestSchemaVersion: latestSchemaVersion,
-    logEpoch: logEpoch,
-    resetRequired: resetRequired,
+    logEpoch,
+    resetRequired,
   });
 }
 
@@ -523,9 +516,10 @@ function decodePushResultDetails(r: ByteReader): PushResultDetailsFrame {
       );
     }
     seen.add(opIndex);
+    const parsed = parseJsonDocument(r.str(), 'PUSH_RESULT_DETAILS.details');
     let details: RejectionDetails;
     try {
-      details = normalizeRejectionDetails(JSON.parse(r.str()) as unknown);
+      details = normalizeRejectionDetails(parsed);
     } catch (error) {
       invalid(
         `invalid PUSH_RESULT_DETAILS.details: ${error instanceof Error ? error.message : String(error)}`,
@@ -647,9 +641,7 @@ function decodeSegmentInline(r: ByteReader): SegmentInlineFrame {
 
 function decodeSubEnd(r: ByteReader): SubEndFrame {
   const nextCursor = r.i64();
-  const bootstrapState = r.opt(() =>
-    requireJsonDocument(r.str(), 'SUB_END.bootstrapState'),
-  );
+  const bootstrapState = r.opt(() => readJson(r, 'SUB_END.bootstrapState'));
   return definedObject({
     type: 'SUB_END',
     nextCursor,
@@ -663,7 +655,7 @@ function decodeErrorFrame(r: ByteReader): ErrorFrame {
   const category = r.str();
   const retryable = r.bool();
   const recommendedAction = r.str();
-  const details = r.opt(() => requireJsonDocument(r.str(), 'ERROR.details'));
+  const details = r.opt(() => readJson(r, 'ERROR.details'));
   return definedObject({
     type: 'ERROR',
     code,
@@ -678,13 +670,12 @@ function decodeErrorFrame(r: ByteReader): ErrorFrame {
 function decodeRequestFrame(
   frameType: number,
   payload: Uint8Array,
-  wireVersion: number,
 ): RequestFrame {
   const r = new ByteReader(payload);
   let frame: RequestFrame;
   switch (frameType) {
     case FrameType.REQ_HEADER:
-      frame = decodeReqHeader(r, wireVersion);
+      frame = decodeReqHeader(r);
       break;
     case FrameType.ROUND_FAILURE:
       frame = decodeRoundFailure(r);
@@ -713,13 +704,12 @@ function decodeRequestFrame(
 function decodeResponseFrame(
   frameType: number,
   payload: Uint8Array,
-  wireVersion: number,
 ): ResponseFrame {
   const r = new ByteReader(payload);
   let frame: ResponseFrame;
   switch (frameType) {
     case FrameType.RESP_HEADER:
-      frame = decodeRespHeader(r, wireVersion);
+      frame = decodeRespHeader(r);
       break;
     case FrameType.LEASE:
       frame = decodeLease(r);
@@ -936,10 +926,7 @@ function encodeInvalid(message: string): never {
   throw new Error(message);
 }
 
-function encodeFrame(
-  frame: RequestFrame | ResponseFrame,
-  wireVersion: number,
-): {
+function encodeFrame(frame: RequestFrame | ResponseFrame): {
   frameType: number;
   payload: Uint8Array;
 } {
@@ -954,14 +941,10 @@ function encodeFrame(
       }
       w.str(frame.clientId);
       w.i32(frame.schemaVersion);
-      if (wireVersion >= 2) {
-        if (frame.logEpoch === '') {
-          encodeInvalid('REQ_HEADER.logEpoch must be non-empty');
-        }
-        w.opt(frame.logEpoch, (v) => w.str(v));
-      } else if (frame.logEpoch !== undefined) {
-        encodeInvalid('REQ_HEADER.logEpoch requires wireVersion 2');
+      if (frame.logEpoch === '') {
+        encodeInvalid('REQ_HEADER.logEpoch must be non-empty');
       }
+      w.opt(frame.logEpoch, (v) => w.str(v));
       break;
     }
     case 'ROUND_FAILURE': {
@@ -1015,21 +998,11 @@ function encodeFrame(
     case 'RESP_HEADER': {
       w.opt(frame.requiredSchemaVersion, (v) => w.i32(v));
       w.opt(frame.latestSchemaVersion, (v) => w.i32(v));
-      if (wireVersion >= 2) {
-        if (frame.logEpoch === undefined || frame.logEpoch.length === 0) {
-          encodeInvalid('RESP_HEADER.logEpoch is required and non-empty');
-        }
-        if (frame.resetRequired === undefined) {
-          encodeInvalid('RESP_HEADER.resetRequired is required');
-        }
-        w.str(frame.logEpoch);
-        w.bool(frame.resetRequired);
-      } else if (
-        frame.logEpoch !== undefined ||
-        frame.resetRequired !== undefined
-      ) {
-        encodeInvalid('RESP_HEADER epoch fields require wireVersion 2');
+      if (frame.logEpoch.length === 0) {
+        encodeInvalid('RESP_HEADER.logEpoch must be non-empty');
       }
+      w.str(frame.logEpoch);
+      w.bool(frame.resetRequired);
       break;
     }
     case 'LEASE': {
@@ -1200,7 +1173,7 @@ export function encodeMessage(message: SyncMessage): Uint8Array {
   w.u8(message.msgKind === 'request' ? 0x01 : 0x02);
   w.u8(0x00);
   for (const frame of message.frames) {
-    const { frameType, payload } = encodeFrame(frame, message.wireVersion);
+    const { frameType, payload } = encodeFrame(frame);
     w.u8(frameType);
     w.u32(payload.length);
     w.raw(payload);
@@ -1263,7 +1236,7 @@ export function decodeMessage(bytes: Uint8Array): SyncMessage {
       wireVersion,
       msgKind: 'request',
       frames: readFrames(r, (frameType, payload) =>
-        decodeRequestFrame(frameType, payload, wireVersion),
+        decodeRequestFrame(frameType, payload),
       ),
     };
     validateRequestSequence(message.frames);
@@ -1273,7 +1246,7 @@ export function decodeMessage(bytes: Uint8Array): SyncMessage {
     wireVersion,
     msgKind: 'response',
     frames: readFrames(r, (frameType, payload) =>
-      decodeResponseFrame(frameType, payload, wireVersion),
+      decodeResponseFrame(frameType, payload),
     ),
   };
   validateResponseSequence(message.frames);

package/src/realtime.ts

@@ -9,6 +9,7 @@
  * `known: false` for unrecognized event names instead of failing.
  */
 import { DecodeError } from './errors';
+import { parseJsonDocument } from './json-document';
 
 /** §8.7 channel tag: a standalone SSP2 response message — a delta. */
 export const REALTIME_TAG_DELTA = 0x00;
@@ -55,6 +56,9 @@ export type PresenceKind = 'join' | 'update' | 'leave';
 
 const PRESENCE_KINDS: readonly PresenceKind[] = ['join', 'update', 'leave'];
 
+/** §8.6.2 publisher-directed presence rejection code — a closed set of two. */
+export type PresenceErrorCode = 'presence.too_large' | 'presence.forbidden';
+
 /**
  * Server → client presence fanout (§8.6.2): a scope-mate's presence for a
  * key the receiver holds changed. `doc` is the peer's document for
@@ -70,7 +74,7 @@ export interface RealtimePresenceEvent {
     actorId?: string;
     clientId?: string;
     doc?: Record<string, unknown> | null;
-    error?: string;
+    error?: PresenceErrorCode;
     timestamp?: number;
   };
 }
@@ -87,15 +91,6 @@ export interface RealtimeAck {
   cursor: number;
 }
 
-/** Client → server presence publish/leave (§8.6.2). `doc: null` = leave. */
-export interface RealtimePresencePublish {
-  event: 'presence';
-  data: {
-    scopeKey: string;
-    doc: Record<string, unknown> | null;
-  };
-}
-
 export type ParsedRealtimeEvent =
   | { known: true; event: RealtimeServerEvent }
   | { known: false; eventName: string };
@@ -176,13 +171,10 @@ const WAKE_REASONS: readonly WakeReason[] = [
 ];
 
 export function parseRealtimeServerEvent(text: string): ParsedRealtimeEvent {
-  let value: unknown;
-  try {
-    value = JSON.parse(text);
-  } catch {
-    malformed('not valid JSON');
-  }
-  const root = requireObject(value, 'control message');
+  const root = requireObject(
+    parseJsonDocument(text, 'control message'),
+    'control message',
+  );
   const event = requireString(root.event, 'event');
   if (event === 'hello') {
     const data = requireObject(root.data, 'hello.data');
@@ -311,33 +303,3 @@ function requirePresenceDocObject(value: unknown): void {
     malformed('presence.data.doc must be a JSON object');
   }
 }
-
-/**
- * Parse a client → server presence publish/leave (§8.6.2). Used by the
- * server to validate inbound `presence` control messages. A malformed
- * message (missing/empty `scopeKey`, or a `doc` that is neither an object
- * nor `null`) throws a `DecodeError` — a known event with wrong-shape data
- * is never a tolerated variant (§8.1).
- */
-export function parseRealtimePresencePublish(
-  text: string,
-): RealtimePresencePublish {
-  let value: unknown;
-  try {
-    value = JSON.parse(text);
-  } catch {
-    malformed('not valid JSON');
-  }
-  const root = requireObject(value, 'control message');
-  if (root.event !== 'presence') {
-    malformed('not a presence control message');
-  }
-  const data = requireObject(root.data, 'presence.data');
-  const scopeKey = validatePresenceScopeKey(data.scopeKey);
-  const doc = data.doc;
-  if (doc !== null) requirePresenceDocObject(doc);
-  return {
-    event: 'presence',
-    data: { scopeKey, doc: doc as Record<string, unknown> | null },
-  };
-}

package/src/row-codec.ts

@@ -15,6 +15,7 @@
 import { parseBlobRef } from './blob-ref';
 import { ByteReader, ByteWriter } from './bytes';
 import { DecodeError, EncodeError } from './errors';
+import { parseJsonDocument } from './json-document';
 
 export type ColumnType =
   | 'string'
@@ -148,9 +149,10 @@ function readValue(reader: ByteReader, column: RowColumn): RowValue {
     case 'string':
       return reader.str();
     case 'json': {
-      // Conventions `json` MUST, applied at row-codec decode (SPEC.md §2.4
-      // tag 5): the value must parse as a JSON document; the raw string is
-      // preserved verbatim for round-trip fidelity.
+      // SPEC.md §2.4 tag 5: the value must parse as a JSON document; the raw
+      // string is preserved verbatim for round-trip fidelity. Full rows stay
+      // this permissive so stored rows keep decoding; `decodeSparseRow`
+      // applies the JSON validity rule on top.
       const raw = reader.str();
       try {
         JSON.parse(raw);
@@ -164,8 +166,8 @@ function readValue(reader: ByteReader, column: RowColumn): RowValue {
     }
     case 'blob_ref': {
       // §2.4 tag 7: the value is a canonical BlobRef JSON document
-      // (§5.9.1). Validated at decode, same class as tag-5 json; the raw
-      // string is preserved verbatim for re-encoding.
+      // (§5.9.1), checked on every decode path; the raw string is preserved
+      // verbatim for re-encoding.
       const raw = reader.str();
       parseBlobRef(raw);
       return raw;
@@ -262,7 +264,10 @@ export function encodeSparseRow(
  *
  * Decode checks, in order (each a decode error, RFC §6.1): a set presence
  * padding bit, an absent primary-key column, a set null-bitmap padding bit
- * (a null for an absent column), a null bit for a non-nullable column.
+ * (a null for an absent column), a null bit for a non-nullable column. Each
+ * present value must also be a push admission value (SPEC.md §2.4): no
+ * U+0000 in a `string`, a `json` value under the JSON validity rule, a finite
+ * `float`, a canonical `blob_ref`.
  */
 export function decodeSparseRow(
   columns: readonly RowColumn[],
@@ -318,7 +323,34 @@ export function decodeSparseRow(
     const isNull = bitmapBit(nulls, present);
     present++;
     if (!isNull) {
-      values.push(readValue(reader, column));
+      const value = readValue(reader, column);
+      // Push admission values (SPEC.md §2.4): one value set every storage
+      // backend and core accepts. `blob_ref` canonicality is already checked
+      // by `readValue` on every path.
+      if (
+        column.type === 'string' &&
+        typeof value === 'string' &&
+        value.includes('\u0000')
+      ) {
+        throw new DecodeError(
+          'sync.invalid_request',
+          `string column ${column.name} holds U+0000`,
+        );
+      }
+      if (column.type === 'json' && typeof value === 'string') {
+        parseJsonDocument(value, `json column ${column.name}`);
+      }
+      if (
+        column.type === 'float' &&
+        typeof value === 'number' &&
+        !Number.isFinite(value)
+      ) {
+        throw new DecodeError(
+          'sync.invalid_request',
+          `float column ${column.name} holds NaN or an infinity`,
+        );
+      }
+      values.push(value);
       continue;
     }
     if (!column.nullable) {