Module json 

Byte-level JSON scanning for the no-materialization body path (ADR-014).

These routines read exactly what a tenancy transform needs, the set of top-level field names (to detect a spoofed reserved field) and a scalar at a path (to find the partition key or build an id), by scanning the raw body bytes, without ever building a parsed JSON tree. Retained memory is bounded by the few small key strings (or the one extracted scalar), never by document size (INV-MEM): every value the scan does not need is skipped without allocating.

It lives in core because it is dependency-free pure computation that both the SPI (partition extraction utilities) and the transform layer (id construction, field-splice injection) build on, the two sides cannot share a helper that lives in either of them.

The scanner is strict: it parses the JSON grammar fully so a malformed body is rejected here rather than mis-located. Key strings are decoded before they are compared, so a client cannot smuggle a reserved field name past a collision check by escaping it (e.g. "_tenant" for _tenant).

Structs

TopLevel

The located top level of a JSON object: where to splice injected fields, whether it already has members, and its decoded top-level key names.

Enums

JsonError

A failure scanning raw JSON bytes.

Functions

object_top_level

Locates the top level of the JSON object in body, validating the whole document as it goes.

scalar_at_path

Follows segments into the object in body and returns the leaf scalar as a string: strings are decoded, numbers and bools use their source text.

validate

Validates that body is a single well-formed JSON document (trailing whitespace allowed), allocating nothing.