SyncMessageSerializer

Defined in: packages/core/src/sync-message-serializer.ts:31

SyncMessageSerializer provides serialization/deserialization methods for CRDTSyncMessages.

This is a signed wire boundary. Implementations and callers that accept untrusted serialized messages must ensure deserialization yields a deep-snapshot-compatible graph: primitives, genuine unshared Uint8Arrays, dense arrays, plain records containing only enumerable own data properties, and an optional genuine CryptoKey. They must reject accessors, cycles, symbols, functions, exotic objects, sparse/extended arrays, SAB-backed views, and graphs outside their depth/object/property/byte bounds before authentication or state mutation.

Recognized field insertion order must also survive deserialize/serialize round trips. Existing sync-message signatures cover the serializer’s exact bytes, so rebuilding a decoded object in a different field order makes an otherwise valid signed envelope unverifiable. Implementations may drop unknown wire fields, but must preserve the incoming order of recognized fields.

signatureContext is a recognized field. Implementations must encode it and decode it unchanged in its original field position. Every admission path rejects a decoded message whose tag is missing or differs from the receiving handler’s context, so a serializer that drops the tag rejects all inbound sync, load, invitation, Welcome, and PathUpdate traffic.