@actuallab/rpc 14.3.5 → 14.3.16

package/dist/index.d.cts

@@ -1516,6 +1516,7 @@ declare class RpcStream<T> implements AsyncIterable<T>, IRpcObject {
     private _complete;
     private _failProtocol;
     private _isBeyondAckWindow;
+    private _ackWindowSize;
     private _ackWindowError;
     private _gapError;
     private _notifyConsumer;

package/dist/index.d.ts

@@ -1516,6 +1516,7 @@ declare class RpcStream<T> implements AsyncIterable<T>, IRpcObject {
     private _complete;
     private _failProtocol;
     private _isBeyondAckWindow;
+    private _ackWindowSize;
     private _ackWindowError;
     private _gapError;
     private _notifyConsumer;

package/dist/index.js

@@ -1912,6 +1912,7 @@ function _compactBufferedUnsentSuffix(buffer, firstUnsentIndex, canSkipTo) {
 var { warnLog: warnLog6 } = getLogs("RpcStream");
 var DEFAULT_ACK_PERIOD2 = 30;
 var DEFAULT_ACK_ADVANCE2 = 61;
+var MAX_BATCH_SIZE = 1024;
 function parseStreamRef(value) {
   if (typeof value === "string") {
     const parts = value.split(",");
@@ -2099,6 +2100,10 @@ var RpcStream = class _RpcStream {
       this._failProtocol(`invalid $sys.B index/length: ${String(index)}/${String(items.length)}`);
       return;
     }
+    if (items.length > MAX_BATCH_SIZE) {
+      this._failProtocol(`$sys.B batch is too large: ${items.length} > ${MAX_BATCH_SIZE}`);
+      return;
+    }
     if (index > this._nextExpectedIndex) {
       warnLog6?.log(`batch index gap: localId=${this.id.localId}, expected=${this._nextExpectedIndex}, received=${index}`);
       if (!this.allowReconnect) {
@@ -2233,11 +2238,23 @@ var RpcStream = class _RpcStream {
   // last acknowledged index. The sending side is the only place that window
   // was ever enforced, which left a flooding remote free to grow our buffer
   // without bound (I6) — so we enforce our half of the contract here.
+  //
+  // The window is credited by consumption, never by `_ackSentUpTo`: a reset ack
+  // re-bases to what we've *received*, so crediting it would let a peer ratchet
+  // its own limit up by alternating "fill the window" with a forced gap.
+  // Twice ackAdvance is what a conforming sender can leave buffered (ackAdvance
+  // in steady state, plus ackAdvance more after a reset re-bases it), and
+  // ackPeriod covers the lag of acks behind consumption.
   _isBeyondAckWindow(nextExpectedIndex) {
-    return this.ackAdvance > 0 && nextExpectedIndex > this._ackSentUpTo + this.ackAdvance;
+    if (this.ackAdvance <= 0)
+      return false;
+    return nextExpectedIndex > this._nextConsumedIndex + this._ackWindowSize();
+  }
+  _ackWindowSize() {
+    return 2 * this.ackAdvance + this.ackPeriod;
   }
   _ackWindowError(nextExpectedIndex) {
-    return `Stream ran past its ack window: reached ${nextExpectedIndex}, acked ${this._ackSentUpTo}, ackAdvance ${this.ackAdvance}`;
+    return `Stream ran past its ack window: reached ${nextExpectedIndex}, consumed ${this._nextConsumedIndex}, ackAdvance ${this.ackAdvance}`;
   }
   _gapError(index) {
     return new Error(