AI Protocol Parsing (part 1): Introduce Wuffs based Json parser (#45641)

Design Doc

https://docs.google.com/document/d/1V08HmDIJW6a0QGyqjQQhKW7yLEsT82cmf4an05_yUdk/edit?tab=t.0#heading=h.7r0qptd7eill

Introduces WuffsJsonCursor, a SAX-style JSON parser built on[
Wuffs](https://github.com/google/wuffs). First PR e implements all Wuffs
internals — token buffer management, coroutine suspension/resumption,
escape decoding. and exposes a Handler callback interface

<img width="1848" height="917" alt="image"
src="https://github.com/user-attachments/assets/6d1f9e12-3b0c-4bca-a94f-989ea081b724"
/>


This PR implements the JSON tokenizer and Token Dispatch, the Handler
will be implemented in the next PR

---------

Signed-off-by: tyxia <tyxia@google.com>

Author: tyxia

bazel/deps.yaml

@@ -557,6 +557,16 @@ wasmtime:
   license: "Apache-2.0"
   license_url: "https://github.com/bytecodealliance/wasmtime/blob/v{version}/LICENSE"
 
+wuffs:
+  project_name: "Wuffs"
+  project_desc: "Memory-safe, high-performance JSON (and other format) parser written in a memory-safe subset of C"
+  project_url: "https://github.com/google/wuffs-mirror-release-c"
+  release_date: "2024-09-14"
+  use_category:
+  - dataplane_ext
+  license: "Apache-2.0"
+  license_url: "https://github.com/google/wuffs-mirror-release-c/blob/v{version}/LICENSE"
+
 abseil_cpp:
   project_name: "Abseil"
   project_desc: "Open source collection of C++ libraries drawn from the most fundamental pieces of Google’s internal codebase"

bazel/repositories.bzl

@@ -242,6 +242,7 @@ def envoy_dependencies(skip_targets = []):
 
     _libmaxminddb()
     _thrift()
+    _wuffs()
 
     external_http_archive("rules_license")
     external_http_archive("rules_pkg")
@@ -1072,3 +1073,21 @@ def _libmaxminddb():
         name = "libmaxminddb",
         build_file_content = LIBMAXMINDDB_BUILD_CONTENT,
     )
+
+def _wuffs():
+    external_http_archive(
+        name = "wuffs",
+        build_file_content = """
+cc_library(
+    name = "wuffs",
+    # Wuffs uses an amalgamated single-file distribution: wuffs-v0.4.c acts as
+    # a header (declarations only) when included without WUFFS_IMPLEMENTATION,
+    # and as a full implementation when WUFFS_IMPLEMENTATION is defined (done
+    # in exactly one TU: wuffs_impl.c).  Listed as hdrs so dependent targets
+    # may include it.
+    textual_hdrs = ["release/c/wuffs-v0.4.c"],
+    visibility = ["//visibility:public"],
+    copts = ["-Wno-unused-function"],
+)
+""",
+    )

bazel/repository_locations.bzl

@@ -749,6 +749,15 @@ REPOSITORY_LOCATIONS_SPEC = dict(
         strip_prefix = "cmake-{version}",
         urls = ["https://github.com/Kitware/CMake/releases/download/v{version}/cmake-{version}.tar.gz"],
     ),
+    wuffs = dict(
+        version = "0.4.0-alpha.9",
+        sha256 = "9ca4f5401a76be244362de8b39138f01f2456c444b03584703a9f1db90491ba6",
+        strip_prefix = "wuffs-mirror-release-c-{version}",
+        urls = ["https://github.com/google/wuffs-mirror-release-c/archive/refs/tags/v{version}.tar.gz"],
+        # Wuffs: memory-safe, high-performance JSON (and other format) parser.
+        # The amalgamated C file at release/c/wuffs-v0.4.c is both the header
+        # (declarations) and implementation (when WUFFS_IMPLEMENTATION is defined).
+    ),
 )
 
 def _compiled_protoc_deps(locations, versions):

changelogs/current/new_features/mcp__wuffs-streaming-json-parser.rst

@@ -0,0 +1,5 @@
+Added a Wuffs-backed streaming JSON parser for AI protocol parsing (MCP, A2A, OpenAI, Anthropic, etc.) with the following properties:
+incremental chunk-by-chunk parsing that resumes across arbitrary HTTP body chunk boundaries without buffering the full body;
+token-based processing with no DOM allocation — heap usage is proportional only to fields the handler opts into capturing, not to the total body size;
+AI-native field extraction that inlines scalar fields (e.g. ``model``, ``method``, ``id``, ``params.name``) into small bounded strings and captures large fields (e.g. ``messages[]``, ``params.arguments``) as zero-copy byte-range references into the original body;
+and duplicate-key detection that rejects key-smuggling attacks (e.g. multiple ``"model"`` fields) with early mid-stream termination before the full body is consumed.

source/common/json/wuffs_json/BUILD

@@ -0,0 +1,35 @@
+load("@rules_cc//cc:cc_library.bzl", "cc_library")
+load(
+    "//bazel:envoy_build_system.bzl",
+    "envoy_cc_library",
+    "envoy_package",
+)
+
+licenses(["notice"])  # Apache 2
+
+envoy_package()
+
+# wuffs_impl.c is a pure C translation unit (the Wuffs amalgamation).
+# It must NOT use envoy_cc_library because envoy_copts() adds C++-only flags
+# (-Woverloaded-virtual, -Wold-style-cast) that GCC rejects for C source files.
+cc_library(
+    name = "wuffs_impl",
+    srcs = ["wuffs_impl.c"],
+    copts = ["-Wno-unused-function"],
+    linkstatic = True,
+    deps = ["@wuffs"],
+)
+
+envoy_cc_library(
+    name = "wuffs_json_cursor_lib",
+    srcs = ["wuffs_json_cursor.cc"],
+    hdrs = ["wuffs_json_cursor.h"],
+    deps = [
+        ":wuffs_impl",
+        "@abseil-cpp//absl/base:nullability",
+        "@abseil-cpp//absl/container:flat_hash_set",
+        "@abseil-cpp//absl/status",
+        "@abseil-cpp//absl/strings",
+        "@wuffs",
+    ],
+)

source/common/json/wuffs_json/wuffs_impl.c

@@ -0,0 +1,7 @@
+// This file is the single compilation unit that provides the Wuffs library
+// implementation.  Every other file that uses Wuffs includes wuffs-v0.4.c
+// without WUFFS_IMPLEMENTATION (declarations only).
+//
+// WUFFS_IMPLEMENTATION must be defined in exactly one translation unit.
+#define WUFFS_IMPLEMENTATION
+#include "release/c/wuffs-v0.4.c"