JSON intake: reject ambiguous bytes before checking the resource schema

Prevent loss before inspecting fields

Suppose a response contains the same key twice. If the decoder silently keeps one, a later schema check can no longer see the conflict. An adapter therefore needs an intake boundary before checking required fields. That boundary determines which supplied bytes you will treat as a usable document at all.

RFC 8259 describes UTF-8 for interoperable exchange, recommends unique object names, and excludes NaN from the number grammar.[2] The local agreement below rejects duplicate names instead of selecting a winner. That is deliberately stricter than an optional warning; call it adapter policy, not universal behavior of every JSON parser.

Put the gates in a fixed order

• Check the type and budget of the bytes already received.
• Allow only the agreed media representation.
• Decode as UTF-8 without inventing replacement characters.
• Reject duplicate names and non-JSON constants while parsing.
• Only then apply the resource schema; that last step is not built here.

The executed byte cases

The valid literal input is {"n":1.00,"enabled":true}. Decimal retains the decimal text form 1.00 in this exercise; enabled remains a boolean. The 4096-byte limit and the choice of application/json are local exercise agreements. Other media types are not automatically accepted because their names end in json.

import json
from decimal import Decimal

def unique(pairs):
    result = {}
    for key, value in pairs:
        if key in result:
            raise ValueError("duplicate member")
        result[key] = value
    return result

def no_constant(value):
    raise ValueError("non-JSON constant")

def intake(raw, media_type):
    if type(raw) is not bytes or len(raw) not in range(4097):
        raise ValueError("byte budget or type")
    if media_type.split(";", 1)[0].strip().lower() != "application/json":
        raise ValueError("unsupported representation")
    return json.loads(raw.decode("utf-8"), object_pairs_hook=unique,
                      parse_float=Decimal, parse_constant=no_constant)

# Synthetic wire bytes, not captured provider traffic.
good = intake(b'{"n":1.00,"enabled":true}', "application/json")
assert type(good["n"]) is Decimal and str(good["n"]) == "1.00"
assert type(good["enabled"]) is bool and good["enabled"] is True
bad = [b'{"a":1,"a":2}', b'{"nested":{"x":1,"x":2}}',
       b'{"n":NaN}', b'{"x":"\xff"}', b'{} {}', b' ' * 4097]
for raw in bad:
    try:
        intake(raw, "application/json")
    except (ValueError, UnicodeError):
        pass
    else:
        raise AssertionError("bad wire bytes accepted")
try:
    intake(b'{}', "text/html")
except ValueError:
    pass
else:
    raise AssertionError("HTML representation accepted")
print(json.dumps({"decimal_text": str(good["n"]), "boolean_type": type(good["enabled"]).__name__,
                  "wire_rejections": len(bad), "media_rejections": 1}, sort_keys=True))

{"boolean_type": "bool", "decimal_text": "1.00", "media_rejections": 1, "wire_rejections": 6}

The output counts six rejected byte fixtures: a top-level duplicate name, a nested duplicate name, NaN, an invalid UTF-8 byte, two consecutive documents, and a budget overrun. A separate representation case rejects text/html. These are actually executed local cases, not captured provider responses or API measurements.

Do not give the next layer false certainty

An accepted boolean can still be wrong for a field expecting a count. A syntactically correct object with a missing key can also remain unusable. This exercise performs no expected-payload reconciliation and does not use Python dictionary equality to prove types. The two explicit type assertions cover only the selected valid fixture.

The bytes are already entirely in memory: this is not a tested download limit, decompression defense, or streaming parser. Recursion depth, extremely long numbers, Unicode normalization, and finite Decimal calculations need additional bounds. On failure, prefer a safe error category and contract version over the raw response contents. Source research and offline execution are complete; network behavior, rights, and independent language and factual review remain open.