@tldraw/sync-core 5.5.0-next.f9308d324e1c → 5.6.0-canary.5bfc37740468

package/src/lib/TLSyncRoom.ts

@@ -16,6 +16,7 @@ import {
 	objectMapEntriesIterable,
 	Result,
 	throttle,
+	type ThrottledFunction,
 } from '@tldraw/utils'
 import { createNanoEvents } from 'nanoevents'
 import {
@@ -88,6 +89,29 @@ export const DATA_MESSAGE_DEBOUNCE_INTERVAL = 1000 / 60
 
 const timeSince = (time: number) => Date.now() - time
 
+// WebSocket close frames cap the reason at 123 UTF-8 bytes; a longer one makes `close()` throw
+const MAX_CLOSE_REASON_BYTES = 123
+const closeReasonEncoder = new TextEncoder()
+
+const truncatedSuffix = (droppedBytes: number) => `... (+${droppedBytes} bytes)`
+
+function truncateCloseReason(reason: string) {
+	const totalBytes = closeReasonEncoder.encode(reason).length
+	if (totalBytes <= MAX_CLOSE_REASON_BYTES) return reason
+	// the dropped count can't have more digits than the total, so reserving room for it always fits
+	const budget = MAX_CLOSE_REASON_BYTES - truncatedSuffix(totalBytes).length
+	let out = ''
+	let outBytes = 0
+	// step by code point so a multi-byte character is never cut in half
+	for (const char of reason) {
+		const charBytes = closeReasonEncoder.encode(char).length
+		if (outBytes + charBytes > budget) break
+		out += char
+		outBytes += charBytes
+	}
+	return out + truncatedSuffix(totalBytes - outBytes)
+}
+
 /**
  * Snapshot of a room's complete state that can be persisted and restored.
  * Contains all documents, tombstones, and metadata needed to reconstruct the room.
@@ -217,7 +241,7 @@ export class TLSyncRoom<R extends UnknownRecord, SessionMeta> {
 
 	private pruneTimer: ReturnType<typeof setTimeout> | null = null
 
-	pruneSessions = throttle(() => {
+	pruneSessions: ThrottledFunction<() => void> = throttle(() => {
 		if (this.pruneTimer) {
 			clearTimeout(this.pruneTimer)
 			this.pruneTimer = null
@@ -258,7 +282,8 @@ export class TLSyncRoom<R extends UnknownRecord, SessionMeta> {
 	}, 1000)
 
 	private scheduleFollowUpPrune() {
-		if (this.pruneTimer) return
+		// don't leave a stray timer on a room the host has already torn down
+		if (this._isClosed || this.pruneTimer) return
 		this.pruneTimer = setTimeout(this.pruneSessions, SESSION_REMOVAL_WAIT_TIME + 100)
 	}
 
@@ -273,11 +298,27 @@ export class TLSyncRoom<R extends UnknownRecord, SessionMeta> {
 	 * and stops background processes.
 	 */
 	close() {
+		this._isClosed = true
 		this.disposables.forEach((d) => d())
 		this.sessions.forEach((session) => {
-			session.socket.close()
+			this.clearDebounceTimer(session)
+			try {
+				session.socket.close()
+			} catch {
+				// noop, one bad socket must not leave the rest open
+			}
 		})
-		this._isClosed = true
+		// forgetting the sessions is what makes late socket close/error events no-ops, so
+		// nothing can emit session_removed / room_became_empty on a closed room
+		this.sessions.clear()
+	}
+
+	private clearDebounceTimer(session: RoomSession<R, SessionMeta>) {
+		if (session.state === RoomSessionState.Connected && session.debounceTimer !== null) {
+			clearTimeout(session.debounceTimer)
+			session.debounceTimer = null
+			session.outstandingDataMessages = []
+		}
 	}
 
 	/**
@@ -519,6 +560,12 @@ export class TLSyncRoom<R extends UnknownRecord, SessionMeta> {
 			// place, so sockets that defer serialization don't see an emptied array
 			const data = session.outstandingDataMessages
 			session.outstandingDataMessages = []
+			if (!session.socket.isOpen) {
+				// same as the immediate-send path: send() into a closed socket throws on
+				// some runtimes (Cloudflare), and here that would be from inside a timer
+				this.cancelSession(sessionId)
+				return
+			}
 			session.socket.sendMessage({ type: 'data', data })
 		}
 	}
@@ -532,10 +579,12 @@ export class TLSyncRoom<R extends UnknownRecord, SessionMeta> {
 		}
 
 		this.sessions.delete(sessionId)
+		this.clearDebounceTimer(session)
 
 		try {
 			if (fatalReason) {
-				session.socket.close(TLSyncErrorCloseEventCode, fatalReason)
+				// the session is already gone, so a throwing close() would leave its socket open
+				session.socket.close(TLSyncErrorCloseEventCode, truncateCloseReason(fatalReason))
 			} else {
 				session.socket.close()
 			}
@@ -570,6 +619,7 @@ export class TLSyncRoom<R extends UnknownRecord, SessionMeta> {
 			return
 		}
 
+		this.clearDebounceTimer(session)
 		this.sessions.set(sessionId, {
 			state: RoomSessionState.AwaitingRemoval,
 			sessionId,
@@ -607,9 +657,11 @@ export class TLSyncRoom<R extends UnknownRecord, SessionMeta> {
 		networkDiff?: NetworkDiff<R> | null,
 		sourceSessionId?: string
 	) {
-		// Pre-compute network diff if not provided
-		const unmigrated = networkDiff ?? toNetworkDiff(diff)
-		if (!unmigrated) return this
+		// Computed once and shared by every session that needs no down-migration; the push path
+		// hands us the diff it already computed (in legacy append mode when needed), and re-deriving
+		// it per session would both repeat the diffing work and lose that legacy handling.
+		const legacyAppendMode = !this.getCanEmitStringAppend()
+		const unmigrated = networkDiff ?? toNetworkDiff(diff, legacyAppendMode)
 
 		this.sessions.forEach((session) => {
 			if (session.state !== RoomSessionState.Connected) return
@@ -623,7 +675,9 @@ export class TLSyncRoom<R extends UnknownRecord, SessionMeta> {
 				session.sessionId,
 				session.serializedSchema,
 				session.requiresDownMigrations,
-				diff
+				diff,
+				unmigrated,
+				legacyAppendMode
 			)
 			if (!diffResult.ok) return
 
@@ -692,7 +746,13 @@ export class TLSyncRoom<R extends UnknownRecord, SessionMeta> {
 		objectAccess?: TLObjectStoreAccess
 	}) {
 		const { sessionId, socket, meta, isReadonly, objectAccess } = opts
+		// a connect racing close() would otherwise create a session nothing ever prunes
+		if (this._isClosed) {
+			socket.close()
+			return this
+		}
 		const existing = this.sessions.get(sessionId)
+		if (existing) this.clearDebounceTimer(existing)
 		this.sessions.set(sessionId, {
 			state: RoomSessionState.AwaitingConnectMessage,
 			sessionId,
@@ -741,6 +801,11 @@ export class TLSyncRoom<R extends UnknownRecord, SessionMeta> {
 			supportsStringAppend,
 		} = opts
 
+		if (this._isClosed) {
+			socket.close()
+			return
+		}
+
 		const migrations = this.schema.getMigrationsSince(serializedSchema)
 		const requiresDownMigrations = migrations.ok ? migrations.value.length > 0 : false
 
@@ -761,9 +826,22 @@ export class TLSyncRoom<R extends UnknownRecord, SessionMeta> {
 			supportsStringAppend,
 		})
 
+		// Restore presence before the schema checks: other clients still hold it from before the
+		// socket slept, and a rejection only broadcasts its removal if it's in the store
 		if (presenceRecord && presenceId) {
 			this.presenceStore.set(presenceId, presenceRecord as R)
 		}
+
+		// The server may have changed builds while the socket slept, so re-run the handshake's
+		// schema checks (HS3): a schema we can no longer reconcile must not be served raw diffs.
+		if (!migrations.ok) {
+			this.rejectSession(sessionId, this.getVersionMismatchReason(serializedSchema))
+			return
+		}
+		if (migrations.value.some((m) => m.scope !== 'record' || !m.down)) {
+			this.rejectSession(sessionId, TLSyncErrorCloseEventReason.CLIENT_TOO_OLD)
+			return
+		}
 	}
 
 	/**
@@ -798,6 +876,7 @@ export class TLSyncRoom<R extends UnknownRecord, SessionMeta> {
 	 * @param requiresDownMigrations - Whether the client needs down migrations
 	 * @param diff - The TLSyncForwardDiff containing full records to migrate
 	 * @param unmigrated - Optional pre-computed NetworkDiff for when no migration is needed
+	 * @param legacyAppendMode - Emit string appends as puts (SES5); defaults to the room-wide state
 	 * @returns A NetworkDiff with migrated records, or a migration failure
 	 */
 	private migrateDiffOrRejectSession(
@@ -805,10 +884,11 @@ export class TLSyncRoom<R extends UnknownRecord, SessionMeta> {
 		serializedSchema: SerializedSchema,
 		requiresDownMigrations: boolean,
 		diff: TLSyncForwardDiff<R>,
-		unmigrated?: NetworkDiff<R>
+		unmigrated?: NetworkDiff<R>,
+		legacyAppendMode = !this.getCanEmitStringAppend()
 	): Result<NetworkDiff<R>, MigrationFailureReason> {
 		if (!requiresDownMigrations) {
-			return Result.ok(unmigrated ?? toNetworkDiff(diff) ?? {})
+			return Result.ok(unmigrated ?? toNetworkDiff(diff, legacyAppendMode))
 		}
 
 		const result: NetworkDiff<R> = {}
@@ -828,7 +908,7 @@ export class TLSyncRoom<R extends UnknownRecord, SessionMeta> {
 					this.rejectSession(sessionId, TLSyncErrorCloseEventReason.CLIENT_TOO_OLD)
 					return Result.err(toResult.reason)
 				}
-				const patch = diffRecord(fromResult.value, toResult.value)
+				const patch = diffRecord(fromResult.value, toResult.value, legacyAppendMode)
 				if (patch) {
 					result[id] = [RecordOpType.Patch, patch]
 				}
@@ -905,7 +985,8 @@ export class TLSyncRoom<R extends UnknownRecord, SessionMeta> {
 	 * Sends appropriate error messages before closing the connection.
 	 *
 	 * @param sessionId - The session to reject
-	 * @param fatalReason - The reason for rejection (optional)
+	 * @param fatalReason - The reason for rejection (optional). WebSocket close reasons are capped
+	 * at 123 UTF-8 bytes, so a longer reason is truncated and ends with `... (+N bytes)`.
 	 * @example
 	 * ```ts
 	 * // Reject due to version mismatch
@@ -962,6 +1043,10 @@ export class TLSyncRoom<R extends UnknownRecord, SessionMeta> {
 
 	private forceAllReconnect() {
 		for (const session of this.sessions.values()) {
+			// Only connected clients hold state at a clock we can no longer diff from. A session
+			// mid-handshake gets hydrated from its own lastServerClock in the same transaction, so
+			// removing it would close its socket and then re-add it as Connected (resurrected).
+			if (session.state !== RoomSessionState.Connected) continue
 			this.removeSession(session.sessionId)
 		}
 	}
@@ -991,7 +1076,13 @@ export class TLSyncRoom<R extends UnknownRecord, SessionMeta> {
 			return TLSyncErrorCloseEventReason.SERVER_TOO_OLD
 		}
 
-		if (theirSchema.schemaVersion === 2 && ourSchema.schemaVersion === 2) {
+		if (
+			theirSchema.schemaVersion === 2 &&
+			ourSchema.schemaVersion === 2 &&
+			// a malformed client schema must reject the session, not throw
+			typeof theirSchema.sequences === 'object' &&
+			theirSchema.sequences !== null
+		) {
 			for (const [sequenceId, theirVersion] of Object.entries(theirSchema.sequences)) {
 				const ourVersion = ourSchema.sequences[sequenceId]
 				if (ourVersion === undefined || theirVersion > ourVersion) {
@@ -1055,7 +1146,7 @@ export class TLSyncRoom<R extends UnknownRecord, SessionMeta> {
 
 		const requiresDownMigrations = migrations.value.length > 0
 
-		const connect = async (msg: Extract<TLSocketServerSentEvent<R>, { type: 'connect' }>) => {
+		const connect = (msg: Extract<TLSocketServerSentEvent<R>, { type: 'connect' }>) => {
 			this.sessions.set(session.sessionId, {
 				state: RoomSessionState.Connected,
 				sessionId: session.sessionId,
@@ -1196,7 +1287,6 @@ export class TLSyncRoom<R extends UnknownRecord, SessionMeta> {
 			}
 			let { value: state } = res
 
-			// Get the existing document, if any
 			const doc =
 				prevDoc !== undefined ? (prevDoc ?? undefined) : (storage.get(id) as R | undefined)
 
@@ -1212,7 +1302,7 @@ export class TLSyncRoom<R extends UnknownRecord, SessionMeta> {
 				// If there's an existing document, replace it with the new state
 				// but propagate a diff rather than the entire value
 				const recordType = assertExists(getOwnProperty(this.schema.types, doc.typeName))
-				const diff = diffAndValidateRecord(doc, state, recordType)
+				const diff = diffAndValidateRecord(doc, state, recordType, legacyAppendMode)
 				if (diff) {
 					storage.set(id, state)
 					propagateOp(changes, id, [RecordOpType.Patch, diff], doc, state)
@@ -1330,6 +1420,11 @@ export class TLSyncRoom<R extends UnknownRecord, SessionMeta> {
 					!session ||
 					(this.objectTypes.has(typeName) ? session.objectAccess !== 'read' : !session.isReadonly)
 
+				// what authorizers see of the pushing session, shared by every authorized op in this push
+				const authSession = session
+					? { sessionId: session.sessionId, isReadonly: session.isReadonly, meta: session.meta }
+					: null
+
 				if (message.diff) {
 					// The push request was for the document scope.
 					for (const [id, op] of objectMapEntriesIterable(message.diff!)) {
@@ -1380,26 +1475,8 @@ export class TLSyncRoom<R extends UnknownRecord, SessionMeta> {
 										authorize = (prevRec, next) => {
 											const result = authorizePut(
 												prevRec
-													? {
-															session: {
-																sessionId: session.sessionId,
-																isReadonly: session.isReadonly,
-																meta: session.meta,
-															},
-															type: 'update',
-															prev: prevRec,
-															next,
-														}
-													: {
-															session: {
-																sessionId: session.sessionId,
-																isReadonly: session.isReadonly,
-																meta: session.meta,
-															},
-															type: 'create',
-															prev: null,
-															next,
-														}
+													? { session: authSession!, type: 'update', prev: prevRec, next }
+													: { session: authSession!, type: 'create', prev: null, next }
 											)
 											if (!result) {
 												this.log?.warn?.(
@@ -1431,11 +1508,7 @@ export class TLSyncRoom<R extends UnknownRecord, SessionMeta> {
 								const authorize = authorizePatch
 									? (prev: R, next: R) => {
 											const result = authorizePatch({
-												session: {
-													sessionId: session.sessionId,
-													isReadonly: session.isReadonly,
-													meta: session.meta,
-												},
+												session: authSession!,
 												type: 'update',
 												prev,
 												next,
@@ -1469,16 +1542,7 @@ export class TLSyncRoom<R extends UnknownRecord, SessionMeta> {
 								const authorizeRemove = session && this.authorizerFor(doc.typeName)
 								if (
 									authorizeRemove &&
-									!authorizeRemove({
-										session: {
-											sessionId: session.sessionId,
-											isReadonly: session.isReadonly,
-											meta: session.meta,
-										},
-										type: 'delete',
-										prev: doc,
-										next: null,
-									})
+									!authorizeRemove({ session: authSession!, type: 'delete', prev: doc, next: null })
 								) {
 									this.log?.warn?.(
 										'authorizer vetoed delete',
@@ -1510,7 +1574,10 @@ export class TLSyncRoom<R extends UnknownRecord, SessionMeta> {
 		let pushResult: TLSocketServerSentEvent<R> | undefined
 		if (changes && session) {
 			// txn did not apply verbatim so we should broadcast the actual changes
-			result.docChanges.diffs = { networkDiff: toNetworkDiff(changes) ?? {}, diff: changes }
+			result.docChanges.diffs = {
+				networkDiff: toNetworkDiff(changes, legacyAppendMode),
+				diff: changes,
+			}
 		}
 
 		if (isEqual(result.docChanges.diffs?.networkDiff, message.diff)) {
@@ -1535,7 +1602,8 @@ export class TLSyncRoom<R extends UnknownRecord, SessionMeta> {
 				session.serializedSchema,
 				session.requiresDownMigrations,
 				result.docChanges.diffs.diff,
-				result.docChanges.diffs.networkDiff
+				result.docChanges.diffs.networkDiff,
+				legacyAppendMode
 			)
 			if (diff.ok) {
 				pushResult = {

package/src/lib/TLSyncStorage.ts

@@ -146,13 +146,18 @@ export interface TLSyncForwardDiff<R extends UnknownRecord> {
 }
 
 /**
+ * @param legacyAppendMode - When true, string appends are emitted as puts (see `diffRecord`); the
+ * room sets this whenever a connected client predates string-append support.
  * @internal
  */
-export function toNetworkDiff<R extends UnknownRecord>(diff: TLSyncForwardDiff<R>): NetworkDiff<R> {
+export function toNetworkDiff<R extends UnknownRecord>(
+	diff: TLSyncForwardDiff<R>,
+	legacyAppendMode = false
+): NetworkDiff<R> {
 	const networkDiff: NetworkDiff<R> = {}
 	for (const [id, put] of objectMapEntriesIterable(diff.puts)) {
 		if (Array.isArray(put)) {
-			const patch = diffRecord(put[0], put[1])
+			const patch = diffRecord(put[0], put[1], legacyAppendMode)
 			if (patch) {
 				networkDiff[id] = [RecordOpType.Patch, patch]
 			}

package/src/lib/chunk.test.ts

@@ -1,5 +1,11 @@
 import { assert } from 'tldraw'
-import { JsonChunkAssembler, chunk } from './chunk'
+import {
+	JsonChunkAssembler,
+	MAX_ASSEMBLED_MESSAGE_CHARS,
+	MAX_CHUNK_COUNT,
+	MessageTooLargeError,
+	chunk,
+} from './chunk'
 
 describe('chunk (CH1–CH3)', () => {
 	describe('size boundary (CH1)', () => {
@@ -134,6 +140,40 @@ describe('chunk (CH1–CH3)', () => {
 		`)
 		})
 	})
+
+	describe('surrogate pairs (CH9)', () => {
+		it('[CH9] never splits a surrogate pair across two chunks', () => {
+			// WebSocket.send converts each chunk to a USVString, so a lone surrogate would arrive
+			// as U+FFFD and the reassembled message would carry corrupted text
+			const emoji = '\u{1F600}'
+			const isHigh = (code: number) => code >= 0xd800 && code <= 0xdbff
+			const isLow = (code: number) => code >= 0xdc00 && code <= 0xdfff
+			const msgs = [
+				...Array.from(
+					{ length: 8 },
+					(_, padding) => 'x'.repeat(padding) + emoji + 'y'.repeat(6) + emoji
+				),
+				// adjacent pairs: after a nudge the next boundary lands on another pair
+				'x' + emoji.repeat(3),
+			]
+			for (const msg of msgs) {
+				for (const maxSize of [3, 4, 5, 6, 7, 8]) {
+					const chunks = chunk(msg, maxSize)
+					const bodies = chunks.map((c) => c.slice(c.indexOf('_') + 1))
+					expect(bodies.join('')).toBe(msg)
+					for (const [i, body] of bodies.entries()) {
+						expect(body.length).toBeGreaterThan(0)
+						expect(isHigh(body.charCodeAt(body.length - 1))).toBe(false)
+						expect(isLow(body.charCodeAt(0))).toBe(false)
+						// keeping a pair whole may cost one character over the CH3 bound, never more
+						expect(chunks[i].length).toBeLessThanOrEqual(
+							Math.max(maxSize, chunks[i].indexOf('_') + 2) + 1
+						)
+					}
+				}
+			}
+		})
+	})
 })
 
 const testObject = {} as any
@@ -369,4 +409,51 @@ describe('JsonChunkAssembler (CH4–CH8)', () => {
 			})
 		})
 	})
+
+	describe('assembly bounds (CH10)', () => {
+		it('[CH10] rejects a first chunk declaring more than MAX_CHUNK_COUNT chunks', () => {
+			const unchunker = new JsonChunkAssembler()
+
+			const result = unchunker.handleMessage(`${MAX_CHUNK_COUNT}_{"a":`)
+			expect(result).toMatchObject({
+				error: expect.objectContaining({ message: `Too many chunks: ${MAX_CHUNK_COUNT + 1}` }),
+			})
+			expect(unchunker.state).toBe('idle')
+		})
+
+		it('[CH10] accepts a declared count at the limit', () => {
+			const unchunker = new JsonChunkAssembler()
+
+			expect(unchunker.handleMessage(`${MAX_CHUNK_COUNT - 1}_{"a":`)).toBeNull()
+			expect(unchunker.state).not.toBe('idle')
+		})
+
+		it('[CH10] rejects an assembly once its accumulated bodies pass MAX_ASSEMBLED_MESSAGE_CHARS', () => {
+			const unchunker = new JsonChunkAssembler()
+			// A chunk stream that never sends its final chunk. Before CH10 this accumulated
+			// without limit for as long as the sender kept sending.
+			const body = 'x'.repeat(1024 * 1024)
+			const chunksNeeded = Math.ceil(MAX_ASSEMBLED_MESSAGE_CHARS / body.length) + 1
+
+			let result = null
+			for (let i = 0; i < chunksNeeded; i++) {
+				result = unchunker.handleMessage(`${chunksNeeded - i}_${body}`)
+				if (result) break
+			}
+
+			expect(result).toMatchObject({ error: expect.any(MessageTooLargeError) })
+			expect(unchunker.state).toBe('idle')
+		})
+
+		it('[CH10] leaves the assembler usable after rejecting an oversized assembly', () => {
+			const unchunker = new JsonChunkAssembler()
+			const body = 'x'.repeat(1024 * 1024)
+			const chunksNeeded = Math.ceil(MAX_ASSEMBLED_MESSAGE_CHARS / body.length) + 1
+			for (let i = 0; i < chunksNeeded; i++) {
+				if (unchunker.handleMessage(`${chunksNeeded - i}_${body}`)) break
+			}
+
+			expect(unchunker.handleMessage('{"test": true}')).toMatchObject({ data: { test: true } })
+		})
+	})
 })

package/src/lib/chunk.ts

@@ -8,6 +8,35 @@ const MAX_BYTES_PER_CHAR = 4
 // in the (admittedly impossible) worst case, the max size is 1/4 of a megabyte
 const MAX_SAFE_MESSAGE_SIZE = MAX_CLIENT_SENT_MESSAGE_SIZE_BYTES / MAX_BYTES_PER_CHAR
 
+// JsonChunkAssembler holds every chunk of a message until the last one arrives, and the sender
+// decides how many that is — the count is just a prefix on the first chunk. Nothing in the
+// protocol obliges a sender to ever send the last chunk, so without a ceiling a single connection
+// can make the receiver hold an arbitrarily large buffer for as long as the socket stays open.
+//
+// The cap counts UTF-16 code units, which is what a JS string costs in memory: 16M of them is the
+// 32MB of retained string data a room can afford to hold per session and stay inside a Durable
+// Object's 128MB instance limit with room for the document itself. It is far above anything
+// chunk() produces for a real document push. The character cap is the real bound; the chunk-count
+// cap only rejects an absurd declared count on arrival instead of waiting for the characters to
+// accumulate, and is loose enough not to constrain a sender that chunks more finely than the
+// default.
+export const MAX_ASSEMBLED_MESSAGE_CHARS = 16 * 1024 * 1024
+export const MAX_CHUNK_COUNT = 100_000
+
+/**
+ * Thrown when a message would exceed MAX_ASSEMBLED_MESSAGE_CHARS, on either side of the wire.
+ * Distinct from the other assembly errors because it is fatal: retrying sends the same
+ * oversized message, so the session is rejected rather than reset.
+ *
+ * @internal
+ */
+export class MessageTooLargeError extends Error {
+	constructor(chars: number) {
+		super(`Message too large: ${chars} characters, max ${MAX_ASSEMBLED_MESSAGE_CHARS}`)
+		this.name = 'MessageTooLargeError'
+	}
+}
+
 /**
  * Splits a string into smaller chunks suitable for transmission over WebSockets.
  * This function ensures messages don't exceed size limits imposed by platforms like Cloudflare Workers (1MB max).
@@ -38,7 +67,18 @@ export function chunk(msg: string, maxSafeMessageSize = MAX_SAFE_MESSAGE_SIZE) {
 		let offset = msg.length
 		while (offset > 0) {
 			const prefix = `${chunkNumber}_`
-			const chunkSize = Math.max(Math.min(maxSafeMessageSize - prefix.length, offset), 1)
+			let chunkSize = Math.max(Math.min(maxSafeMessageSize - prefix.length, offset), 1)
+			// Never split a surrogate pair across chunks: WebSocket.send converts each chunk to a
+			// USVString, turning a lone surrogate into U+FFFD, so the reassembled JSON silently
+			// carries corrupted text. Shrink by one so the pair moves whole into the preceding
+			// chunk; a single-character chunk grows by one instead (one over the CH3 bound, see CH9).
+			if (
+				chunkSize < offset &&
+				isLowSurrogate(msg.charCodeAt(offset - chunkSize)) &&
+				isHighSurrogate(msg.charCodeAt(offset - chunkSize - 1))
+			) {
+				chunkSize += chunkSize > 1 ? -1 : 1
+			}
 			chunks.unshift(prefix + msg.slice(offset - chunkSize, offset))
 			offset -= chunkSize
 			chunkNumber++
@@ -47,6 +87,14 @@ export function chunk(msg: string, maxSafeMessageSize = MAX_SAFE_MESSAGE_SIZE) {
 	}
 }
 
+function isHighSurrogate(code: number) {
+	return code >= 0xd800 && code <= 0xdbff
+}
+
+function isLowSurrogate(code: number) {
+	return code >= 0xdc00 && code <= 0xdfff
+}
+
 // The 's' flag (dotAll) makes '.' match any character including line terminators
 // like U+2028 and U+2029, which are commonly introduced via copy/paste from Word
 const chunkRe = /^(\d+)_(.*)$/s
@@ -81,6 +129,7 @@ export class JsonChunkAssembler {
 		| {
 				chunksReceived: string[]
 				totalChunks: number
+				charsReceived: number
 		  } = 'idle'
 
 	/**
@@ -91,7 +140,8 @@ export class JsonChunkAssembler {
 	 * @param msg - The message to process, either JSON or chunk format
 	 * @returns Result object with data/stringified on success, error object on failure, or null for incomplete chunks
 	 * 	- `\{ data: object, stringified: string \}` - Successfully parsed complete message
-	 * 	- `\{ error: Error \}` - Parse error or invalid chunk sequence
+	 * 	- `\{ error: Error \}` - Parse error, invalid chunk sequence, or a message exceeding
+	 * 	  MAX_ASSEMBLED_MESSAGE_CHARS / MAX_CHUNK_COUNT
 	 * 	- `null` - Chunk received but more chunks expected
 	 *
 	 * @example
@@ -125,17 +175,30 @@ export class JsonChunkAssembler {
 			const data = match[2]
 
 			if (this.state === 'idle') {
+				const totalChunks = numChunksRemaining + 1
+				if (totalChunks > MAX_CHUNK_COUNT) {
+					// Nothing has been buffered yet, so the state is already idle.
+					return { error: new Error(`Too many chunks: ${totalChunks}`) }
+				}
 				this.state = {
 					chunksReceived: [data],
-					totalChunks: numChunksRemaining + 1,
+					totalChunks,
+					charsReceived: data.length,
 				}
 			} else {
 				this.state.chunksReceived.push(data)
+				this.state.charsReceived += data.length
 				if (numChunksRemaining !== this.state.totalChunks - this.state.chunksReceived.length) {
 					this.state = 'idle'
 					return { error: new Error(`Chunks received in wrong order`) }
 				}
 			}
+			if (this.state.charsReceived > MAX_ASSEMBLED_MESSAGE_CHARS) {
+				// Drop what was buffered rather than keeping it until the socket closes.
+				const charsReceived = this.state.charsReceived
+				this.state = 'idle'
+				return { error: new MessageTooLargeError(charsReceived) }
+			}
 			if (this.state.chunksReceived.length === this.state.totalChunks) {
 				try {
 					const stringified = this.state.chunksReceived.join('')