@livedesk/hub 0.1.36 → 0.1.38

package/src/transport/udp-rendezvous.js

@@ -1,574 +1,408 @@
-import dgram from 'node:dgram';
-import crypto from 'node:crypto';
-import {
-    decodeRendezvousMessage,
-    encodeRendezvousMessage,
-    UDP_MAX_DATAGRAM_BYTES,
-    UDP_P2P_PROTOCOL
-} from './udp-protocol.js';
-
-const DEFAULT_LIMITS = Object.freeze({
-    roomTtlMs: 60_000,
-    sourceTtlMs: 120_000,
-    sweepIntervalMs: 10_000,
-    statusIntervalMs: 60_000,
-    maxRooms: 4_096,
-    maxSources: 8_192,
-    maxRoomsPerSource: 128,
-    perSourceRate: 20,
-    perSourceBurst: 40,
-    globalRate: 1_000,
-    globalBurst: 2_000
-});
-
-function safeText(value, max = 160) {
-    return String(value || '').replace(/[\r\n\t]/g, ' ').trim().slice(0, max);
-}
-
-function normalizePort(value, fallback) {
-    const port = Number(value);
-    return Number.isInteger(port) && port >= 0 && port <= 65535 ? port : fallback;
-}
-
-function normalizeInteger(value, fallback, min = 1, max = Number.MAX_SAFE_INTEGER) {
-    const number = Number(value);
-    return Number.isInteger(number) && number >= min && number <= max ? number : fallback;
-}
-
-function normalizeRate(value, fallback) {
-    const number = Number(value);
-    return Number.isFinite(number) && number > 0 ? number : fallback;
-}
-
-function createTokenBucket(capacity, now) {
-    return { tokens: capacity, updatedAt: now };
-}
-
-function consumeToken(bucket, rate, capacity, now) {
-    const elapsedMs = Math.max(0, now - bucket.updatedAt);
-    bucket.tokens = Math.min(capacity, bucket.tokens + (elapsedMs / 1_000) * rate);
-    bucket.updatedAt = Math.max(bucket.updatedAt, now);
-    if (bucket.tokens < 1) return false;
-    bucket.tokens -= 1;
-    return true;
-}
-
-function decodeCanonicalBase64Url(value, minimum, maximum = minimum) {
-    const text = String(value || '');
-    if (!/^[A-Za-z0-9_-]+$/u.test(text)) return null;
-    const bytes = Buffer.from(text, 'base64url');
-    return bytes.length >= minimum && bytes.length <= maximum && bytes.toString('base64url') === text
-        ? bytes
-        : null;
-}
-
-function trustedIssuerMap(values) {
-    const entries = Array.isArray(values)
-        ? values
-        : String(values || '').split(/[\s,]+/u).filter(Boolean);
-    if (entries.length > 10_000) throw new Error('udp-rendezvous-trusted-issuer-capacity');
-    const issuers = new Map();
-    for (const entry of entries) {
-        const publicKeyBytes = decodeCanonicalBase64Url(entry, 80, 160);
-        if (!publicKeyBytes) throw new Error('udp-rendezvous-trusted-issuer-invalid');
-        let publicKey;
-        try {
-            publicKey = crypto.createPublicKey({ key: publicKeyBytes, format: 'der', type: 'spki' });
-        } catch {
-            throw new Error('udp-rendezvous-trusted-issuer-invalid');
-        }
-        if (publicKey.asymmetricKeyType !== 'ec'
-            || publicKey.asymmetricKeyDetails?.namedCurve !== 'prime256v1') {
-            throw new Error('udp-rendezvous-trusted-issuer-invalid');
-        }
-        const keyId = crypto.createHash('sha256').update(publicKeyBytes).digest('base64url');
-        issuers.set(keyId, publicKey);
-    }
-    return issuers;
-}
-
-function exactSafeText(value, maximum) {
-    return typeof value === 'string' && value.length > 0 && safeText(value, maximum) === value;
-}
-
-function verifyRendezvousProof(proof, roomId, role, current, trustedIssuers) {
-    try {
-        const parts = String(proof || '').split('.');
-        if (parts.length !== 2) return { ok: false, reason: 'invalid-proof' };
-        const payloadBytes = decodeCanonicalBase64Url(parts[0], 64, 1536);
-        const signature = decodeCanonicalBase64Url(parts[1], 64, 64);
-        if (!payloadBytes || !signature) return { ok: false, reason: 'invalid-proof' };
-        const payload = JSON.parse(payloadBytes.toString('utf8'));
-        if (!payload || payload.version !== 2
-            || payload.protocol !== 'livedesk.udp.rendezvous-proof.v2'
-            || payload.roomId !== roomId
-            || !exactSafeText(payload.issuerKeyId, 64)
-            || !exactSafeText(payload.roomId, 160)
-            || !exactSafeText(payload.role, 16)
-            || !exactSafeText(payload.accountId, 128)
-            || !exactSafeText(payload.hubId, 128)
-            || !exactSafeText(payload.deviceId, 128)
-            || !Number.isSafeInteger(payload.issuedAt)
-            || !Number.isSafeInteger(payload.expiresAt)
-            || payload.issuedAt > current + 30_000
-            || payload.expiresAt <= current
-            || payload.expiresAt <= payload.issuedAt
-            || payload.expiresAt - payload.issuedAt > 120_000
-            || !decodeCanonicalBase64Url(payload.nonce, 16, 32)) {
-            return { ok: false, reason: 'invalid-proof' };
-        }
-        if (payload.role !== role) return { ok: false, reason: 'role-mismatch' };
-        const issuerKeyIdBytes = decodeCanonicalBase64Url(payload.issuerKeyId, 32, 32);
-        if (!issuerKeyIdBytes) return { ok: false, reason: 'invalid-proof' };
-        const issuerKey = trustedIssuers.get(payload.issuerKeyId);
-        if (!issuerKey) return { ok: false, reason: 'untrusted-issuer' };
-        const valid = crypto.verify('sha256', Buffer.from(parts[0], 'utf8'), {
-                key: issuerKey,
-                dsaEncoding: 'ieee-p1363'
-            }, signature);
-        if (!valid) return { ok: false, reason: 'invalid-signature' };
-        return {
-            ok: true,
-            payload,
-            proofKey: `${payload.issuerKeyId}:${payload.nonce}:${payload.roomId}:${payload.role}`,
-            proofHash: crypto.createHash('sha256').update(String(proof), 'utf8').digest('base64url')
-        };
-    } catch {
-        return { ok: false, reason: 'invalid-proof' };
-    }
-}
-
-export function createUdpRendezvousServer({
-    host = '0.0.0.0',
-    port = 5199,
-    log = () => {},
-    version = 'dev',
-    now = () => Date.now(),
-    roomTtlMs = DEFAULT_LIMITS.roomTtlMs,
-    sourceTtlMs = DEFAULT_LIMITS.sourceTtlMs,
-    sweepIntervalMs = DEFAULT_LIMITS.sweepIntervalMs,
-    statusIntervalMs = DEFAULT_LIMITS.statusIntervalMs,
-    maxRooms = DEFAULT_LIMITS.maxRooms,
-    maxSources = DEFAULT_LIMITS.maxSources,
-    maxRoomsPerSource = DEFAULT_LIMITS.maxRoomsPerSource,
-    perSourceRate = DEFAULT_LIMITS.perSourceRate,
-    perSourceBurst = DEFAULT_LIMITS.perSourceBurst,
-    globalRate = DEFAULT_LIMITS.globalRate,
-    globalBurst = DEFAULT_LIMITS.globalBurst,
-    trustedIssuerPublicKeys = [],
-    allowLegacyTokens = false
-} = {}) {
-    const socket = dgram.createSocket('udp4');
-    const rooms = new Map();
-    const unpairedRooms = new Map();
-    const sources = new Map();
-    const evictableSources = new Map();
-    const consumedProofs = new Map();
-    const trustedIssuers = trustedIssuerMap(trustedIssuerPublicKeys);
-    const limits = Object.freeze({
-        roomTtlMs: normalizeInteger(roomTtlMs, DEFAULT_LIMITS.roomTtlMs),
-        sourceTtlMs: normalizeInteger(sourceTtlMs, DEFAULT_LIMITS.sourceTtlMs),
-        sweepIntervalMs: normalizeInteger(sweepIntervalMs, DEFAULT_LIMITS.sweepIntervalMs),
-        statusIntervalMs: normalizeInteger(statusIntervalMs, DEFAULT_LIMITS.statusIntervalMs, 0),
-        maxRooms: normalizeInteger(maxRooms, DEFAULT_LIMITS.maxRooms),
-        maxConsumedProofs: Math.min(200_000, normalizeInteger(maxRooms, DEFAULT_LIMITS.maxRooms) * 2),
-        maxSources: normalizeInteger(maxSources, DEFAULT_LIMITS.maxSources),
-        maxRoomsPerSource: normalizeInteger(maxRoomsPerSource, DEFAULT_LIMITS.maxRoomsPerSource),
-        perSourceRate: normalizeRate(perSourceRate, DEFAULT_LIMITS.perSourceRate),
-        perSourceBurst: normalizeRate(perSourceBurst, DEFAULT_LIMITS.perSourceBurst),
-        globalRate: normalizeRate(globalRate, DEFAULT_LIMITS.globalRate),
-        globalBurst: normalizeRate(globalBurst, DEFAULT_LIMITS.globalBurst)
-    });
-    const counters = {
-        receivedDatagrams: 0,
-        receivedBytes: 0,
-        acceptedRegistrations: 0,
-        peerNotifications: 0,
-        sentBytes: 0,
-        sendErrors: 0,
-        invalidDatagrams: 0,
-        oversizeDatagrams: 0,
-        globalRateDrops: 0,
-        sourceRateDrops: 0,
-        sourceCapacityDrops: 0,
-        sourceRoomLimitDrops: 0,
-        roomCapacityDrops: 0,
-        tokenMismatchDrops: 0,
-        untrustedIssuerDrops: 0,
-        roleMismatchDrops: 0,
-        bindingMismatchDrops: 0,
-        proofReplayDrops: 0,
-        endpointOverwriteDrops: 0,
-        idempotentRefreshes: 0,
-        proofCapacityDrops: 0,
-        expiredRooms: 0,
-        evictedRooms: 0,
-        expiredSources: 0,
-        evictedSources: 0,
-        sweeps: 0,
-        socketErrors: 0
-    };
-    const globalBucket = createTokenBucket(limits.globalBurst, now());
-    const serviceVersion = safeText(version, 64) || 'dev';
-    let started = false;
-    let closing = false;
-    let startedAt = 0;
-    let boundPort = normalizePort(port, 5199);
-    let sweepTimer = null;
-    let statusTimer = null;
-    let lastError = '';
-
-    function sourceKey(rinfo) {
-        return safeText(rinfo?.address, 128);
-    }
-
-    function deleteRoom(roomId, reason = '') {
-        const room = rooms.get(roomId);
-        if (!room) return false;
-        rooms.delete(roomId);
-        unpairedRooms.delete(roomId);
-        const owner = sources.get(room.ownerSource);
-        if (owner) {
-            owner.activeRooms = Math.max(0, owner.activeRooms - 1);
-            if (owner.activeRooms === 0) {
-                evictableSources.delete(owner.key);
-                evictableSources.set(owner.key, owner);
-            }
-        }
-        if (reason === 'expired') counters.expiredRooms += 1;
-        if (reason === 'capacity') counters.evictedRooms += 1;
-        return true;
-    }
-
-    function sweep(at = now()) {
-        for (const [roomId, room] of rooms) {
-            if (at - room.updatedAt >= limits.roomTtlMs) deleteRoom(roomId, 'expired');
-        }
-        for (const [proofKey, consumed] of consumedProofs) {
-            if (consumed.expiresAt <= at) consumedProofs.delete(proofKey);
-        }
-        for (const [key, source] of sources) {
-            if (source.activeRooms === 0 && at - source.lastSeenAt >= limits.sourceTtlMs) {
-                sources.delete(key);
-                evictableSources.delete(key);
-                counters.expiredSources += 1;
-            }
-        }
-        counters.sweeps += 1;
-        return getStatus();
-    }
-
-    function getOrCreateSource(rinfo, at) {
-        const key = sourceKey(rinfo);
-        if (!key) return null;
-        let source = sources.get(key);
-        if (!source) {
-            if (sources.size >= limits.maxSources) {
-                const oldestEvictableSource = evictableSources.keys().next().value;
-                if (!oldestEvictableSource) {
-                    counters.sourceCapacityDrops += 1;
-                    return null;
-                }
-                evictableSources.delete(oldestEvictableSource);
-                sources.delete(oldestEvictableSource);
-                counters.evictedSources += 1;
-            }
-            source = {
-                key,
-                bucket: createTokenBucket(limits.perSourceBurst, at),
-                lastSeenAt: at,
-                activeRooms: 0
-            };
-            sources.set(key, source);
-            evictableSources.set(key, source);
-        }
-        source.lastSeenAt = at;
-        if (source.activeRooms === 0) {
-            evictableSources.delete(key);
-            evictableSources.set(key, source);
-        }
-        if (!consumeToken(source.bucket, limits.perSourceRate, limits.perSourceBurst, at)) {
-            counters.sourceRateDrops += 1;
-            return null;
-        }
-        return source;
-    }
-
-    function send(message, address, targetPort) {
-        let payload;
-        try {
-            payload = encodeRendezvousMessage(message);
-        } catch (error) {
-            counters.sendErrors += 1;
-            lastError = safeText(error?.message || error, 240);
-            return;
-        }
-        counters.peerNotifications += 1;
-        counters.sentBytes += payload.length;
-        socket.send(payload, targetPort, address, error => {
-            if (!error) return;
-            counters.sendErrors += 1;
-            lastError = safeText(error?.message || error, 240);
-        });
-    }
-
-    function createRoom(roomId, binding, source, at, legacyToken = '') {
-        if (source.activeRooms >= limits.maxRoomsPerSource) {
-            counters.sourceRoomLimitDrops += 1;
-            return null;
-        }
-        if (rooms.size >= limits.maxRooms) {
-            const oldestUnpairedRoomId = unpairedRooms.keys().next().value;
-            if (oldestUnpairedRoomId) {
-                deleteRoom(oldestUnpairedRoomId, 'capacity');
-            } else {
-                counters.roomCapacityDrops += 1;
-                return null;
-            }
-        }
-        const room = {
-            legacyToken,
-            binding,
-            ownerSource: source.key,
-            peers: new Map(),
-            createdAt: at,
-            updatedAt: at
-        };
-        rooms.set(roomId, room);
-        unpairedRooms.set(roomId, room);
-        source.activeRooms += 1;
-        evictableSources.delete(source.key);
-        return room;
-    }
-
-    function onMessage(payload, rinfo) {
-        const at = now();
-        counters.receivedDatagrams += 1;
-        counters.receivedBytes += Buffer.isBuffer(payload) ? payload.length : 0;
-        if (!Buffer.isBuffer(payload)) {
-            counters.invalidDatagrams += 1;
-            return;
-        }
-        if (payload.length > UDP_MAX_DATAGRAM_BYTES) {
-            counters.oversizeDatagrams += 1;
-            return;
-        }
-        if (!consumeToken(globalBucket, limits.globalRate, limits.globalBurst, at)) {
-            counters.globalRateDrops += 1;
-            return;
-        }
-        const source = getOrCreateSource(rinfo, at);
-        if (!source) return;
-        const message = decodeRendezvousMessage(payload);
-        if (message?.type !== 'rendezvous.register') {
-            counters.invalidDatagrams += 1;
-            return;
-        }
-        const roomId = safeText(message.roomId, 160);
-        const role = safeText(message.role, 16).toLowerCase();
-        const token = safeText(message.token, 2048);
-        if (!roomId || !token || !['hub', 'client'].includes(role)) {
-            counters.invalidDatagrams += 1;
-            return;
-        }
-        const verification = allowLegacyTokens
-            ? { ok: true, legacy: true, token }
-            : verifyRendezvousProof(token, roomId, role, at, trustedIssuers);
-        if (!verification.ok) {
-            counters.invalidDatagrams += 1;
-            if (verification.reason === 'untrusted-issuer') counters.untrustedIssuerDrops += 1;
-            if (verification.reason === 'role-mismatch') counters.roleMismatchDrops += 1;
-            return;
-        }
-        let room = rooms.get(roomId);
-        if (room && at - room.updatedAt >= limits.roomTtlMs) {
-            deleteRoom(roomId, 'expired');
-            room = null;
-        }
-        if (verification.legacy) {
-            if (room && room.legacyToken !== token) {
-                counters.tokenMismatchDrops += 1;
-                return;
-            }
-            if (!room) {
-                room = createRoom(roomId, null, source, at, token);
-                if (!room) return;
-            }
-            room.updatedAt = at;
-            room.peers.set(role, { address: rinfo.address, port: rinfo.port });
-        } else {
-            const binding = {
-                issuerKeyId: verification.payload.issuerKeyId,
-                accountId: verification.payload.accountId,
-                hubId: verification.payload.hubId,
-                deviceId: verification.payload.deviceId
-            };
-            if (room && JSON.stringify(room.binding) !== JSON.stringify(binding)) {
-                counters.bindingMismatchDrops += 1;
-                return;
-            }
-            const endpoint = { address: rinfo.address, port: rinfo.port };
-            const consumed = consumedProofs.get(verification.proofKey);
-            const existingPeer = room?.peers.get(role);
-            if (consumed) {
-                const sameEndpoint = consumed.address === endpoint.address && consumed.port === endpoint.port;
-                const sameOwner = existingPeer?.proofKey === verification.proofKey
-                    && existingPeer.address === endpoint.address
-                    && existingPeer.port === endpoint.port;
-                if (sameEndpoint && sameOwner) {
-                    room.updatedAt = at;
-                    counters.idempotentRefreshes += 1;
-                    return;
-                }
-                counters.proofReplayDrops += 1;
-                if (existingPeer && !sameEndpoint) counters.endpointOverwriteDrops += 1;
-                return;
-            }
-            if (consumedProofs.size >= limits.maxConsumedProofs) {
-                counters.proofCapacityDrops += 1;
-                return;
-            }
-            if (existingPeer) {
-                counters.endpointOverwriteDrops += 1;
-                return;
-            }
-            if (!room) {
-                room = createRoom(roomId, binding, source, at);
-                if (!room) return;
-            }
-            room.updatedAt = at;
-            room.peers.set(role, { ...endpoint, proofKey: verification.proofKey, proofHash: verification.proofHash });
-            consumedProofs.set(verification.proofKey, {
-                ...endpoint,
-                expiresAt: verification.payload.expiresAt
-            });
-        }
-        counters.acceptedRegistrations += 1;
-        if (room.peers.size < 2) {
-            unpairedRooms.delete(roomId);
-            unpairedRooms.set(roomId, room);
-            return;
-        }
-        unpairedRooms.delete(roomId);
-        const hub = room.peers.get('hub');
-        const client = room.peers.get('client');
-        if (!hub || !client) return;
-        send({
-            type: 'rendezvous.peer',
-            protocol: UDP_P2P_PROTOCOL,
-            roomId,
-            role: 'client',
-            host: client.address,
-            port: client.port,
-            observedHost: hub.address,
-            observedPort: hub.port
-        }, hub.address, hub.port);
-        send({
-            type: 'rendezvous.peer',
-            protocol: UDP_P2P_PROTOCOL,
-            roomId,
-            role: 'hub',
-            host: hub.address,
-            port: hub.port,
-            observedHost: client.address,
-            observedPort: client.port
-        }, client.address, client.port);
-    }
-
-    socket.on('message', onMessage);
-    socket.on('error', error => {
-        counters.socketErrors += 1;
-        lastError = safeText(error?.message || error, 240);
-        log(`UDP rendezvous error: ${lastError}`);
-    });
-
-    function getStatus() {
-        const current = now();
-        return {
-            service: 'livedesk-udp-rendezvous',
-            version: serviceVersion,
-            protocol: UDP_P2P_PROTOCOL,
-            healthy: started && !closing,
-            started,
-            host,
-            port: boundPort,
-            uptimeMs: startedAt ? Math.max(0, current - startedAt) : 0,
-            rooms: rooms.size,
-            pairedRooms: rooms.size - unpairedRooms.size,
-            unpairedRooms: unpairedRooms.size,
-            sources: sources.size,
-            evictableSources: evictableSources.size,
-            consumedProofs: consumedProofs.size,
-            trustedIssuerCount: trustedIssuers.size,
-            securityReady: allowLegacyTokens || trustedIssuers.size > 0,
-            limits: { ...limits },
-            counters: { ...counters },
-            lastError
-        };
-    }
-
-    function logStatus(reason) {
-        log(`UDP rendezvous status ${JSON.stringify({ reason, ...getStatus() })}`);
-    }
-
-    function startTimers() {
-        sweepTimer = setInterval(() => sweep(), limits.sweepIntervalMs);
-        sweepTimer.unref?.();
-        if (limits.statusIntervalMs > 0) {
-            statusTimer = setInterval(() => logStatus('periodic'), limits.statusIntervalMs);
-            statusTimer.unref?.();
-        }
-    }
-
-    function stopTimers() {
-        if (sweepTimer) clearInterval(sweepTimer);
-        if (statusTimer) clearInterval(statusTimer);
-        sweepTimer = null;
-        statusTimer = null;
-    }
-
-    async function start() {
-        if (started) return { host, port: boundPort };
-        if (!allowLegacyTokens && trustedIssuers.size === 0) {
-            throw new Error('udp-rendezvous-trusted-issuer-required');
-        }
-        await new Promise((resolve, reject) => {
-            const onError = error => { socket.off('listening', onListening); reject(error); };
-            const onListening = () => { socket.off('error', onError); resolve(); };
-            socket.once('error', onError);
-            socket.once('listening', onListening);
-            socket.bind(boundPort, host);
-        });
-        started = true;
-        closing = false;
-        startedAt = now();
-        boundPort = socket.address().port;
-        startTimers();
-        log(`UDP rendezvous listening on udp://${host}:${boundPort} version=${serviceVersion}`);
-        log(`UDP rendezvous limits ${JSON.stringify(limits)}`);
-        return { host, port: boundPort };
-    }
-
-    async function close() {
-        closing = true;
-        stopTimers();
-        rooms.clear();
-        unpairedRooms.clear();
-        sources.clear();
-        evictableSources.clear();
-        consumedProofs.clear();
-        if (started) {
-            await new Promise(resolve => socket.close(() => resolve()));
-            started = false;
-        }
-        closing = false;
-    }
-
-    return {
-        start,
-        close,
-        getStatus,
-        sweepNow: () => sweep(),
-        logStatus: (reason = 'requested') => logStatus(safeText(reason, 48) || 'requested')
-    };
-}
+import dgram from 'node:dgram';
+import {
+    decodeRendezvousMessage,
+    encodeRendezvousMessage,
+    UDP_MAX_DATAGRAM_BYTES,
+    UDP_P2P_PROTOCOL
+} from './udp-protocol.js';
+
+const DEFAULT_LIMITS = Object.freeze({
+    roomTtlMs: 60_000,
+    sourceTtlMs: 120_000,
+    sweepIntervalMs: 10_000,
+    statusIntervalMs: 60_000,
+    maxRooms: 4_096,
+    maxSources: 8_192,
+    maxRoomsPerSource: 128,
+    perSourceRate: 20,
+    perSourceBurst: 40,
+    globalRate: 1_000,
+    globalBurst: 2_000
+});
+
+function safeText(value, max = 160) {
+    return String(value || '').replace(/[\r\n\t]/g, ' ').trim().slice(0, max);
+}
+
+function normalizePort(value, fallback) {
+    const port = Number(value);
+    return Number.isInteger(port) && port >= 0 && port <= 65535 ? port : fallback;
+}
+
+function normalizeInteger(value, fallback, min = 1, max = Number.MAX_SAFE_INTEGER) {
+    const number = Number(value);
+    return Number.isInteger(number) && number >= min && number <= max ? number : fallback;
+}
+
+function normalizeRate(value, fallback) {
+    const number = Number(value);
+    return Number.isFinite(number) && number > 0 ? number : fallback;
+}
+
+function createTokenBucket(capacity, now) {
+    return { tokens: capacity, updatedAt: now };
+}
+
+function consumeToken(bucket, rate, capacity, now) {
+    const elapsedMs = Math.max(0, now - bucket.updatedAt);
+    bucket.tokens = Math.min(capacity, bucket.tokens + (elapsedMs / 1_000) * rate);
+    bucket.updatedAt = Math.max(bucket.updatedAt, now);
+    if (bucket.tokens < 1) return false;
+    bucket.tokens -= 1;
+    return true;
+}
+
+export function createUdpRendezvousServer({
+    host = '0.0.0.0',
+    port = 5199,
+    log = () => {},
+    version = 'dev',
+    now = () => Date.now(),
+    roomTtlMs = DEFAULT_LIMITS.roomTtlMs,
+    sourceTtlMs = DEFAULT_LIMITS.sourceTtlMs,
+    sweepIntervalMs = DEFAULT_LIMITS.sweepIntervalMs,
+    statusIntervalMs = DEFAULT_LIMITS.statusIntervalMs,
+    maxRooms = DEFAULT_LIMITS.maxRooms,
+    maxSources = DEFAULT_LIMITS.maxSources,
+    maxRoomsPerSource = DEFAULT_LIMITS.maxRoomsPerSource,
+    perSourceRate = DEFAULT_LIMITS.perSourceRate,
+    perSourceBurst = DEFAULT_LIMITS.perSourceBurst,
+    globalRate = DEFAULT_LIMITS.globalRate,
+    globalBurst = DEFAULT_LIMITS.globalBurst
+} = {}) {
+    const socket = dgram.createSocket('udp4');
+    const rooms = new Map();
+    const unpairedRooms = new Map();
+    const sources = new Map();
+    const evictableSources = new Map();
+    const limits = Object.freeze({
+        roomTtlMs: normalizeInteger(roomTtlMs, DEFAULT_LIMITS.roomTtlMs),
+        sourceTtlMs: normalizeInteger(sourceTtlMs, DEFAULT_LIMITS.sourceTtlMs),
+        sweepIntervalMs: normalizeInteger(sweepIntervalMs, DEFAULT_LIMITS.sweepIntervalMs),
+        statusIntervalMs: normalizeInteger(statusIntervalMs, DEFAULT_LIMITS.statusIntervalMs, 0),
+        maxRooms: normalizeInteger(maxRooms, DEFAULT_LIMITS.maxRooms),
+        maxSources: normalizeInteger(maxSources, DEFAULT_LIMITS.maxSources),
+        maxRoomsPerSource: normalizeInteger(maxRoomsPerSource, DEFAULT_LIMITS.maxRoomsPerSource),
+        perSourceRate: normalizeRate(perSourceRate, DEFAULT_LIMITS.perSourceRate),
+        perSourceBurst: normalizeRate(perSourceBurst, DEFAULT_LIMITS.perSourceBurst),
+        globalRate: normalizeRate(globalRate, DEFAULT_LIMITS.globalRate),
+        globalBurst: normalizeRate(globalBurst, DEFAULT_LIMITS.globalBurst)
+    });
+    const counters = {
+        receivedDatagrams: 0,
+        receivedBytes: 0,
+        acceptedRegistrations: 0,
+        peerNotifications: 0,
+        sentBytes: 0,
+        sendErrors: 0,
+        invalidDatagrams: 0,
+        oversizeDatagrams: 0,
+        globalRateDrops: 0,
+        sourceRateDrops: 0,
+        sourceCapacityDrops: 0,
+        sourceRoomLimitDrops: 0,
+        roomCapacityDrops: 0,
+        tokenMismatchDrops: 0,
+        expiredRooms: 0,
+        evictedRooms: 0,
+        expiredSources: 0,
+        evictedSources: 0,
+        sweeps: 0,
+        socketErrors: 0
+    };
+    const globalBucket = createTokenBucket(limits.globalBurst, now());
+    const serviceVersion = safeText(version, 64) || 'dev';
+    let started = false;
+    let closing = false;
+    let startedAt = 0;
+    let boundPort = normalizePort(port, 5199);
+    let sweepTimer = null;
+    let statusTimer = null;
+    let lastError = '';
+
+    function sourceKey(rinfo) {
+        return safeText(rinfo?.address, 128);
+    }
+
+    function deleteRoom(roomId, reason = '') {
+        const room = rooms.get(roomId);
+        if (!room) return false;
+        rooms.delete(roomId);
+        unpairedRooms.delete(roomId);
+        const owner = sources.get(room.ownerSource);
+        if (owner) {
+            owner.activeRooms = Math.max(0, owner.activeRooms - 1);
+            if (owner.activeRooms === 0) {
+                evictableSources.delete(owner.key);
+                evictableSources.set(owner.key, owner);
+            }
+        }
+        if (reason === 'expired') counters.expiredRooms += 1;
+        if (reason === 'capacity') counters.evictedRooms += 1;
+        return true;
+    }
+
+    function sweep(at = now()) {
+        for (const [roomId, room] of rooms) {
+            if (at - room.updatedAt >= limits.roomTtlMs) deleteRoom(roomId, 'expired');
+        }
+        for (const [key, source] of sources) {
+            if (source.activeRooms === 0 && at - source.lastSeenAt >= limits.sourceTtlMs) {
+                sources.delete(key);
+                evictableSources.delete(key);
+                counters.expiredSources += 1;
+            }
+        }
+        counters.sweeps += 1;
+        return getStatus();
+    }
+
+    function getOrCreateSource(rinfo, at) {
+        const key = sourceKey(rinfo);
+        if (!key) return null;
+        let source = sources.get(key);
+        if (!source) {
+            if (sources.size >= limits.maxSources) {
+                const oldestEvictableSource = evictableSources.keys().next().value;
+                if (!oldestEvictableSource) {
+                    counters.sourceCapacityDrops += 1;
+                    return null;
+                }
+                evictableSources.delete(oldestEvictableSource);
+                sources.delete(oldestEvictableSource);
+                counters.evictedSources += 1;
+            }
+            source = {
+                key,
+                bucket: createTokenBucket(limits.perSourceBurst, at),
+                lastSeenAt: at,
+                activeRooms: 0
+            };
+            sources.set(key, source);
+            evictableSources.set(key, source);
+        }
+        source.lastSeenAt = at;
+        if (source.activeRooms === 0) {
+            evictableSources.delete(key);
+            evictableSources.set(key, source);
+        }
+        if (!consumeToken(source.bucket, limits.perSourceRate, limits.perSourceBurst, at)) {
+            counters.sourceRateDrops += 1;
+            return null;
+        }
+        return source;
+    }
+
+    function send(message, address, targetPort) {
+        let payload;
+        try {
+            payload = encodeRendezvousMessage(message);
+        } catch (error) {
+            counters.sendErrors += 1;
+            lastError = safeText(error?.message || error, 240);
+            return;
+        }
+        counters.peerNotifications += 1;
+        counters.sentBytes += payload.length;
+        socket.send(payload, targetPort, address, error => {
+            if (!error) return;
+            counters.sendErrors += 1;
+            lastError = safeText(error?.message || error, 240);
+        });
+    }
+
+    function createRoom(roomId, token, source, at) {
+        if (source.activeRooms >= limits.maxRoomsPerSource) {
+            counters.sourceRoomLimitDrops += 1;
+            return null;
+        }
+        if (rooms.size >= limits.maxRooms) {
+            const oldestUnpairedRoomId = unpairedRooms.keys().next().value;
+            if (oldestUnpairedRoomId) {
+                deleteRoom(oldestUnpairedRoomId, 'capacity');
+            } else {
+                counters.roomCapacityDrops += 1;
+                return null;
+            }
+        }
+        const room = {
+            token,
+            ownerSource: source.key,
+            peers: new Map(),
+            createdAt: at,
+            updatedAt: at
+        };
+        rooms.set(roomId, room);
+        unpairedRooms.set(roomId, room);
+        source.activeRooms += 1;
+        evictableSources.delete(source.key);
+        return room;
+    }
+
+    function onMessage(payload, rinfo) {
+        const at = now();
+        counters.receivedDatagrams += 1;
+        counters.receivedBytes += Buffer.isBuffer(payload) ? payload.length : 0;
+        if (!Buffer.isBuffer(payload)) {
+            counters.invalidDatagrams += 1;
+            return;
+        }
+        if (payload.length > UDP_MAX_DATAGRAM_BYTES) {
+            counters.oversizeDatagrams += 1;
+            return;
+        }
+        if (!consumeToken(globalBucket, limits.globalRate, limits.globalBurst, at)) {
+            counters.globalRateDrops += 1;
+            return;
+        }
+        const source = getOrCreateSource(rinfo, at);
+        if (!source) return;
+        const message = decodeRendezvousMessage(payload);
+        if (message?.type !== 'rendezvous.register') {
+            counters.invalidDatagrams += 1;
+            return;
+        }
+        const roomId = safeText(message.roomId, 160);
+        const role = safeText(message.role, 16).toLowerCase();
+        const token = safeText(message.token, 256);
+        if (!roomId || !token || !['hub', 'client'].includes(role)) {
+            counters.invalidDatagrams += 1;
+            return;
+        }
+        let room = rooms.get(roomId);
+        if (room && at - room.updatedAt >= limits.roomTtlMs) {
+            deleteRoom(roomId, 'expired');
+            room = null;
+        }
+        if (room && room.token !== token) {
+            counters.tokenMismatchDrops += 1;
+            return;
+        }
+        if (!room) {
+            room = createRoom(roomId, token, source, at);
+            if (!room) return;
+        }
+        room.updatedAt = at;
+        room.peers.set(role, { address: rinfo.address, port: rinfo.port });
+        counters.acceptedRegistrations += 1;
+        if (room.peers.size < 2) {
+            unpairedRooms.delete(roomId);
+            unpairedRooms.set(roomId, room);
+            return;
+        }
+        unpairedRooms.delete(roomId);
+        const hub = room.peers.get('hub');
+        const client = room.peers.get('client');
+        if (!hub || !client) return;
+        send({
+            type: 'rendezvous.peer',
+            protocol: UDP_P2P_PROTOCOL,
+            roomId,
+            role: 'client',
+            host: client.address,
+            port: client.port,
+            observedHost: hub.address,
+            observedPort: hub.port
+        }, hub.address, hub.port);
+        send({
+            type: 'rendezvous.peer',
+            protocol: UDP_P2P_PROTOCOL,
+            roomId,
+            role: 'hub',
+            host: hub.address,
+            port: hub.port,
+            observedHost: client.address,
+            observedPort: client.port
+        }, client.address, client.port);
+    }
+
+    socket.on('message', onMessage);
+    socket.on('error', error => {
+        counters.socketErrors += 1;
+        lastError = safeText(error?.message || error, 240);
+        log(`UDP rendezvous error: ${lastError}`);
+    });
+
+    function getStatus() {
+        const current = now();
+        return {
+            service: 'livedesk-udp-rendezvous',
+            version: serviceVersion,
+            protocol: UDP_P2P_PROTOCOL,
+            healthy: started && !closing,
+            started,
+            host,
+            port: boundPort,
+            uptimeMs: startedAt ? Math.max(0, current - startedAt) : 0,
+            rooms: rooms.size,
+            pairedRooms: rooms.size - unpairedRooms.size,
+            unpairedRooms: unpairedRooms.size,
+            sources: sources.size,
+            evictableSources: evictableSources.size,
+            limits: { ...limits },
+            counters: { ...counters },
+            lastError
+        };
+    }
+
+    function logStatus(reason) {
+        log(`UDP rendezvous status ${JSON.stringify({ reason, ...getStatus() })}`);
+    }
+
+    function startTimers() {
+        sweepTimer = setInterval(() => sweep(), limits.sweepIntervalMs);
+        sweepTimer.unref?.();
+        if (limits.statusIntervalMs > 0) {
+            statusTimer = setInterval(() => logStatus('periodic'), limits.statusIntervalMs);
+            statusTimer.unref?.();
+        }
+    }
+
+    function stopTimers() {
+        if (sweepTimer) clearInterval(sweepTimer);
+        if (statusTimer) clearInterval(statusTimer);
+        sweepTimer = null;
+        statusTimer = null;
+    }
+
+    async function start() {
+        if (started) return { host, port: boundPort };
+        await new Promise((resolve, reject) => {
+            const onError = error => { socket.off('listening', onListening); reject(error); };
+            const onListening = () => { socket.off('error', onError); resolve(); };
+            socket.once('error', onError);
+            socket.once('listening', onListening);
+            socket.bind(boundPort, host);
+        });
+        started = true;
+        closing = false;
+        startedAt = now();
+        boundPort = socket.address().port;
+        startTimers();
+        log(`UDP rendezvous listening on udp://${host}:${boundPort} version=${serviceVersion}`);
+        log(`UDP rendezvous limits ${JSON.stringify(limits)}`);
+        return { host, port: boundPort };
+    }
+
+    async function close() {
+        closing = true;
+        stopTimers();
+        rooms.clear();
+        unpairedRooms.clear();
+        sources.clear();
+        evictableSources.clear();
+        if (started) {
+            await new Promise(resolve => socket.close(() => resolve()));
+            started = false;
+        }
+        closing = false;
+    }
+
+    return {
+        start,
+        close,
+        getStatus,
+        sweepNow: () => sweep(),
+        logStatus: (reason = 'requested') => logStatus(safeText(reason, 48) || 'requested')
+    };
+}