signalk-edge-link 2.2.1 → 2.3.0

package/lib/pipeline-v2-client.js

@@ -19,12 +19,14 @@ exports.createPipelineV2Client = createPipelineV2Client;
 const CircularBuffer_1 = __importDefault(require("./CircularBuffer"));
 const crypto_1 = require("./crypto");
 const pathDictionary_1 = require("./pathDictionary");
+const delta_sanitizer_1 = require("./delta-sanitizer");
 const pipeline_utils_1 = require("./pipeline-utils");
 const packet_1 = require("./packet");
 const retransmit_queue_1 = require("./retransmit-queue");
 const metrics_publisher_1 = require("./metrics-publisher");
 const congestion_1 = require("./congestion");
 const bonding_1 = require("./bonding");
+const metadata_1 = require("./metadata");
 const constants_1 = require("./constants");
 /**
  * Creates the v2 client pipeline
@@ -100,6 +102,35 @@ function createPipelineV2Client(app, state, metricsApi) {
     let lastRetransmissions = 0;
     // Enhanced monitoring hooks (set externally via setMonitoring)
     let monitoringHooks = null;
+    // Callback fired when the receiver asks for a fresh metadata snapshot
+    // (META_REQUEST control packet). Wired up by instance.ts, which is the only
+    // layer that knows how to build a snapshot from `app.signalk.retrieve()`.
+    let metaRequestHandler = null;
+    let metaEnvelopeSeq = 0;
+    // Seed all four meta bandwidth counters so downstream consumers (metrics
+    // publishers, prometheus exporter, tests) always see numeric zeros rather
+    // than undefined on a fresh pipeline. Uses || 0 at write sites elsewhere as
+    // belt-and-braces, but consistent snapshots require consistent seeding.
+    if (metrics.bandwidth) {
+        if (metrics.bandwidth.metaBytesOut === undefined) {
+            metrics.bandwidth.metaBytesOut = 0;
+        }
+        if (metrics.bandwidth.metaPacketsOut === undefined) {
+            metrics.bandwidth.metaPacketsOut = 0;
+        }
+        if (metrics.bandwidth.metaBytesIn === undefined) {
+            metrics.bandwidth.metaBytesIn = 0;
+        }
+        if (metrics.bandwidth.metaPacketsIn === undefined) {
+            metrics.bandwidth.metaPacketsIn = 0;
+        }
+        if (metrics.bandwidth.metaSnapshotsSent === undefined) {
+            metrics.bandwidth.metaSnapshotsSent = 0;
+        }
+        if (metrics.bandwidth.metaDiffsSent === undefined) {
+            metrics.bandwidth.metaDiffsSent = 0;
+        }
+    }
     // RTT tracking for jitter calculation (CircularBuffer gives O(1) push with auto-eviction)
     const rttSamples = new CircularBuffer_1.default(10);
     let lastAckedSeq = null;
@@ -116,12 +147,33 @@ function createPipelineV2Client(app, state, metricsApi) {
         const distance = (seq - reference) >>> 0;
         return distance !== 0 && distance < 0x80000000;
     }
+    function isSingleDeltaPayload(deltaPayload) {
+        return !Array.isArray(deltaPayload) && Array.isArray(deltaPayload.updates);
+    }
+    function deltaPayloadItems(deltaPayload) {
+        if (Array.isArray(deltaPayload)) {
+            return deltaPayload;
+        }
+        if (isSingleDeltaPayload(deltaPayload)) {
+            return [deltaPayload];
+        }
+        return Object.values(deltaPayload);
+    }
+    function encodeDeltaPayload(deltaPayload) {
+        if (Array.isArray(deltaPayload)) {
+            return deltaPayload.map(pathDictionary_1.encodeDelta);
+        }
+        if (isSingleDeltaPayload(deltaPayload)) {
+            return (0, pathDictionary_1.encodeDelta)(deltaPayload);
+        }
+        return Object.fromEntries(Object.entries(deltaPayload).map(([key, value]) => [key, (0, pathDictionary_1.encodeDelta)(value)]));
+    }
     function recordPathLatencies(deltaPayload) {
         if (!monitoringHooks || !monitoringHooks.pathLatencyTracker) {
             return;
         }
         const now = Date.now();
-        const deltas = Array.isArray(deltaPayload) ? deltaPayload : [deltaPayload];
+        const deltas = deltaPayloadItems(deltaPayload);
         for (const delta of deltas) {
             if (!delta || !Array.isArray(delta.updates)) {
                 continue;
@@ -253,22 +305,23 @@ function createPipelineV2Client(app, state, metricsApi) {
                 app.debug("sendDelta called but plugin is stopped, ignoring");
                 return;
             }
+            const sanitizedDelta = (0, delta_sanitizer_1.sanitizeDeltaPayloadForSignalK)(delta);
+            if (sanitizedDelta === null) {
+                app.debug("sendDelta skipped: no valid Signal K values");
+                return;
+            }
             // Apply path dictionary encoding if enabled
             const processedDelta = state.options.usePathDictionary
-                ? Array.isArray(delta)
-                    ? delta.map(pathDictionary_1.encodeDelta)
-                    : (0, pathDictionary_1.encodeDelta)(delta)
-                : delta;
+                ? encodeDeltaPayload(sanitizedDelta)
+                : sanitizedDelta;
             // Serialize to buffer
             const serialized = (0, pipeline_utils_1.deltaBuffer)(processedDelta, state.options.useMsgpack);
             metrics.bandwidth.bytesOutRaw += serialized.length;
-            if (Array.isArray(delta)) {
-                delta.forEach((d) => trackPathStats(d, serialized.length / delta.length));
+            const sanitizedItems = deltaPayloadItems(sanitizedDelta);
+            for (const item of sanitizedItems) {
+                trackPathStats(item, serialized.length / sanitizedItems.length);
             }
-            else {
-                trackPathStats(delta, serialized.length);
-            }
-            recordPathLatencies(delta);
+            recordPathLatencies(sanitizedDelta);
             // Compress
             const compressed = await (0, pipeline_utils_1.compressPayload)(serialized, state.options?.useMsgpack ?? false);
             // Encrypt
@@ -317,7 +370,7 @@ function createPipelineV2Client(app, state, metricsApi) {
             lossWindow.push(false);
             // Update smart batching model
             // Guard against empty array: treat 0 as 1 to avoid Infinity in bytesPerDelta.
-            const deltaCount = Array.isArray(delta) && delta.length > 0 ? delta.length : 1;
+            const deltaCount = Math.max(1, sanitizedItems.length);
             const bytesPerDelta = packet.length / deltaCount;
             state.avgBytesPerDelta =
                 (1 - constants_1.SMART_BATCH_SMOOTHING) * state.avgBytesPerDelta +
@@ -345,6 +398,92 @@ function createPipelineV2Client(app, state, metricsApi) {
             throw error;
         }
     }
+    /**
+     * Send a batch of Signal K metadata entries to the receiver as one or more
+     * METADATA (0x06) packets. Mirrors the compress → encrypt → packet-build
+     * pipeline of `sendDelta` but uses a meta envelope so the receiver can
+     * reconstruct multi-chunk snapshots.
+     *
+     * Snapshots are NOT inserted into the retransmit queue — eventual
+     * consistency is provided by the periodic resend timer in instance.ts, and
+     * the receiver can always request a fresh snapshot via META_REQUEST.
+     */
+    async function sendMetadata(entries, kind, secretKey, udpAddress, udpPort) {
+        try {
+            if (!state.options) {
+                app.debug("sendMetadata called but plugin is stopped, ignoring");
+                return;
+            }
+            if (entries.length === 0) {
+                return;
+            }
+            const maxPerPacket = state.metaConfig?.maxPathsPerPacket ?? 500;
+            const chunks = (0, metadata_1.splitIntoPackets)(entries, maxPerPacket);
+            const usePathDict = !!state.options.usePathDictionary;
+            const useMsgpack = !!state.options.useMsgpack;
+            // Assign one envelope seq per chunk group so the receiver can correlate
+            // `idx/total` inside a single snapshot/diff operation.
+            const envelopeSeq = metaEnvelopeSeq++ >>> 0;
+            for (let i = 0; i < chunks.length; i++) {
+                const chunk = chunks[i];
+                const processedEntries = usePathDict ? chunk.map(pathDictionary_1.encodeMetaEntry) : chunk;
+                const envelope = (0, metadata_1.buildMetaEnvelope)(processedEntries, kind, envelopeSeq, i, chunks.length);
+                const serialized = (0, pipeline_utils_1.deltaBuffer)(envelope, useMsgpack);
+                const compressed = await (0, pipeline_utils_1.compressPayload)(serialized, useMsgpack);
+                const encrypted = (0, crypto_1.encryptBinary)(compressed, secretKey, { stretchAsciiKey });
+                const packet = packetBuilder.buildMetadataPacket(encrypted, {
+                    compressed: true,
+                    encrypted: true,
+                    messagepack: useMsgpack,
+                    pathDictionary: usePathDict
+                });
+                // Mirror sendDelta's MTU guard + monitoring hooks so META traffic is
+                // visible to the same observability surfaces as DATA. Oversized META
+                // packets would otherwise fragment silently, and a user running a
+                // packet capture would see DATA but not META — confusing.
+                if (packet.length > constants_1.MAX_SAFE_UDP_PAYLOAD) {
+                    app.debug(`Warning: v2 meta packet size ${packet.length} bytes exceeds safe MTU (${constants_1.MAX_SAFE_UDP_PAYLOAD}), may fragment.`);
+                    metrics.smartBatching.oversizedPackets++;
+                }
+                await udpSendAsync(packet, udpAddress, udpPort);
+                if (monitoringHooks) {
+                    const rinfo = { address: udpAddress, port: udpPort };
+                    if (monitoringHooks.packetCapture) {
+                        monitoringHooks.packetCapture.capture(packet, "send", rinfo);
+                    }
+                    if (monitoringHooks.packetInspector) {
+                        monitoringHooks.packetInspector.inspect(packet, "send", rinfo);
+                    }
+                }
+                metrics.bandwidth.metaBytesOut = (metrics.bandwidth.metaBytesOut || 0) + packet.length;
+                metrics.bandwidth.metaPacketsOut = (metrics.bandwidth.metaPacketsOut || 0) + 1;
+                metrics.bandwidth.bytesOut += packet.length;
+                metrics.bandwidth.packetsOut++;
+            }
+            // Count one envelope per call (a multi-chunk envelope is logically one
+            // snapshot/diff, even though it shows up in metaPacketsOut as N).
+            if (kind === "snapshot") {
+                metrics.bandwidth.metaSnapshotsSent = (metrics.bandwidth.metaSnapshotsSent || 0) + 1;
+            }
+            else {
+                metrics.bandwidth.metaDiffsSent = (metrics.bandwidth.metaDiffsSent || 0) + 1;
+            }
+            app.debug(`v2 meta sent: kind=${kind}, entries=${entries.length}, chunks=${chunks.length}, envSeq=${envelopeSeq}`);
+        }
+        catch (error) {
+            const msg = error instanceof Error ? error.message : String(error);
+            app.error(`v2 sendMetadata error: ${msg}`);
+            recordError("general", `v2 sendMetadata error: ${msg}`);
+            // Re-throw so callers (e.g., sendMetaEntries in instance.ts) can
+            // distinguish a successful send from a swallowed failure. Without the
+            // rethrow the caller would commit the MetaCache despite nothing
+            // reaching the wire, silently suppressing the next diff.
+            throw error instanceof Error ? error : new Error(msg);
+        }
+    }
+    function setMetaRequestHandler(handler) {
+        metaRequestHandler = handler;
+    }
     /**
      * Handle incoming ACK packet from server.
      * Removes acknowledged packets from the retransmit queue.
@@ -461,6 +600,30 @@ function createPipelineV2Client(app, state, metricsApi) {
             else if (parsed.type === packet_1.PacketType.NAK) {
                 await receiveNAK(parsed, rinfo.address, rinfo.port);
             }
+            else if (parsed.type === packet_1.PacketType.META_REQUEST) {
+                // Receiver asks us to re-send the full meta snapshot. Rate-limited in
+                // the handler (instance.ts) to prevent a malformed receiver from
+                // pinning our CPU/bandwidth on snapshot generation. The handler
+                // itself is synchronous, but if a future implementation returns a
+                // Promise we swallow rejections here so they don't bubble up into
+                // the control-packet parse error path (which increments
+                // metrics.malformedPackets and would mis-classify the failure).
+                if (metaRequestHandler) {
+                    try {
+                        // Wrap in Promise.resolve so any thenable (PromiseLike) returned
+                        // by the handler — not just real Promises with .catch — gets a
+                        // .catch attached. This handles unusual user-supplied thenables
+                        // and is simpler than feature-detecting .catch / .then directly.
+                        Promise.resolve(metaRequestHandler()).catch((err) => {
+                            app.debug(`META_REQUEST handler rejected: ${err instanceof Error ? err.message : String(err)}`);
+                        });
+                    }
+                    catch (err) {
+                        const errMsg = err instanceof Error ? err.message : String(err);
+                        app.debug(`META_REQUEST handler error: ${errMsg}`);
+                    }
+                }
+            }
             // Ignore other packet types on client side
         }
         catch (err) {
@@ -792,6 +955,8 @@ function createPipelineV2Client(app, state, metricsApi) {
     }
     return {
         sendDelta,
+        sendMetadata,
+        setMetaRequestHandler,
         getPacketBuilder,
         getRetransmitQueue,
         getMetricsPublisher,

package/lib/pipeline-v2-server.js

@@ -55,6 +55,7 @@ const node_zlib_1 = __importDefault(require("node:zlib"));
 const msgpack = __importStar(require("@msgpack/msgpack"));
 const crypto_1 = require("./crypto");
 const pathDictionary_1 = require("./pathDictionary");
+const delta_sanitizer_1 = require("./delta-sanitizer");
 const packet_1 = require("./packet");
 const sequence_1 = require("./sequence");
 const metrics_publisher_1 = require("./metrics-publisher");
@@ -95,6 +96,12 @@ function createPipelineV2Server(app, state, metricsApi) {
     // session table (MAX_CLIENT_SESSIONS) by spoofing many source ports from one
     // IP, evicting all legitimate sessions (DoS).
     const MAX_SESSIONS_PER_IP = 5;
+    // Threshold for sender-restart detection on the META envelope sequence.
+    // An incoming envSeq of 0 is treated as a peer restart only once
+    // lastMetaEnvSeq has advanced beyond this value — below it, envSeq=0 is
+    // ambiguous (could be a legitimate first-packet replay) and falls through
+    // to normal dedup. UDP reorders >8 packets backwards are exceedingly rare.
+    const META_RESTART_THRESHOLD = 8;
     let ackTimer = null;
     /**
      * Per-client session map, keyed by "address:port".
@@ -165,7 +172,10 @@ function createPipelineV2Server(app, state, metricsApi) {
                 lastLossExpected: 0,
                 lastLossReceived: 0,
                 rateLimitCount: 0,
-                rateLimitWindowStart: Date.now()
+                rateLimitWindowStart: Date.now(),
+                metaRequested: false,
+                lastMetaEnvSeq: null,
+                seenMetaChunkIdx: new Set()
             };
         }
         const session = {
@@ -191,7 +201,12 @@ function createPipelineV2Server(app, state, metricsApi) {
             lastLossReceived: 0,
             // per-session UDP rate limiting
             rateLimitCount: 0,
-            rateLimitWindowStart: Date.now()
+            rateLimitWindowStart: Date.now(),
+            // META_REQUEST bookkeeping
+            metaRequested: false,
+            // Stale-envelope rejection for METADATA packets
+            lastMetaEnvSeq: null,
+            seenMetaChunkIdx: new Set()
         };
         clientSessions.set(key, session);
         app.debug(`[v2-server] new client session: ${key}`);
@@ -435,6 +450,188 @@ function createPipelineV2Server(app, state, metricsApi) {
             ackTimer = null;
         }
     }
+    /**
+     * Decrypt and dispatch a METADATA (0x06) packet.
+     *
+     * The payload envelope is `{ v, kind, seq, idx, total, entries }` where each
+     * entry is `{ context, path, meta }`. We convert every entry back into a
+     * minimal Signal K delta carrying `updates[].meta[]` so the local Signal K
+     * server picks it up through the normal `app.handleMessage` integration
+     * point — no special receiver API is needed.
+     */
+    async function handleMetadataPacket(parsed, secretKey, session) {
+        try {
+            const decrypted = (0, crypto_1.decryptBinary)(parsed.payload, secretKey, { stretchAsciiKey });
+            const decompressed = (await brotliDecompressAsync(decrypted, {
+                maxOutputLength: constants_1.MAX_DECOMPRESSED_SIZE
+            }));
+            // Count a successful decrypt+decompress as "meta received on the wire"
+            // regardless of whether the envelope parses — this mirrors the DATA
+            // bandwidth accounting and keeps metaBytesIn useful even when a peer
+            // emits malformed envelopes.
+            metrics.bandwidth.metaBytesIn = (metrics.bandwidth.metaBytesIn || 0) + parsed.payload.length;
+            metrics.bandwidth.metaPacketsIn = (metrics.bandwidth.metaPacketsIn || 0) + 1;
+            if (decompressed.length > constants_1.MAX_PARSE_PAYLOAD_SIZE) {
+                metrics.malformedPackets = (metrics.malformedPackets || 0) + 1;
+                app.error(`[v2] META payload too large to parse: ${decompressed.length} bytes (limit ${constants_1.MAX_PARSE_PAYLOAD_SIZE})`);
+                recordError("general", `META payload too large: ${decompressed.length} bytes (limit ${constants_1.MAX_PARSE_PAYLOAD_SIZE})`);
+                return;
+            }
+            let content;
+            if (parsed.flags.messagepack) {
+                try {
+                    content = msgpack.decode(decompressed);
+                }
+                catch {
+                    content = JSON.parse(decompressed.toString());
+                }
+            }
+            else {
+                content = JSON.parse(decompressed.toString());
+            }
+            if (!content || typeof content !== "object" || Array.isArray(content)) {
+                metrics.malformedPackets = (metrics.malformedPackets || 0) + 1;
+                app.debug("v2 META envelope was not an object, dropping");
+                recordError("general", "v2 META envelope was not an object");
+                return;
+            }
+            const env = content;
+            if (!Array.isArray(env.entries) || env.entries.length === 0) {
+                metrics.malformedPackets = (metrics.malformedPackets || 0) + 1;
+                app.debug("v2 META envelope has no entries, dropping");
+                recordError("general", "v2 META envelope has no entries");
+                return;
+            }
+            // Drop stale/duplicate envelopes that UDP reordered or replayed. The
+            // inner envelope `seq` identifies a batch (shared across all chunks of
+            // a multi-chunk snapshot/diff); the inner `idx` identifies a specific
+            // chunk within that batch. Two-level dedup:
+            //   - reject envelopes whose seq is behind in uint32 space ("stale")
+            //   - within the current batch, reject any (seq, idx) pair already
+            //     processed ("exact replay"); other idx values for the same seq
+            //     remain accepted so multi-chunk batches still apply in full.
+            if (session && typeof env.seq === "number" && Number.isFinite(env.seq)) {
+                const envSeq = env.seq >>> 0;
+                const envIdx = typeof env.idx === "number" && Number.isFinite(env.idx) ? env.idx >>> 0 : 0;
+                // Sender-restart detection: the client's meta sequence counter is
+                // initialised to 0 at process start, so an incoming envSeq of 0 with
+                // a sufficiently-advanced lastMetaEnvSeq is a strong signal that the
+                // peer restarted. The "sufficiently advanced" threshold guards
+                // against the first-packet-replay case (lastMetaEnvSeq=0, envSeq=0)
+                // which is indistinguishable from a true restart unless prior
+                // traffic has pushed the seq above a small reorder window. Backwards
+                // reorders of more than META_RESTART_THRESHOLD packets are
+                // exceedingly rare in UDP delivery; treating envSeq=0 as a restart
+                // only above that threshold keeps the dedup-vs-restart decision
+                // unambiguous in the common case.
+                if (session.lastMetaEnvSeq !== null &&
+                    envSeq === 0 &&
+                    session.lastMetaEnvSeq >= META_RESTART_THRESHOLD) {
+                    app.debug(`[v2-server] META sender restart detected for ${session.key} ` +
+                        `(last seq was ${session.lastMetaEnvSeq}); resetting meta state`);
+                    session.lastMetaEnvSeq = null;
+                    session.seenMetaChunkIdx.clear();
+                    session.metaRequested = false;
+                }
+                if (session.lastMetaEnvSeq !== null) {
+                    const distance = (envSeq - session.lastMetaEnvSeq) >>> 0;
+                    if (distance !== 0 && distance >= 0x80000000) {
+                        metrics.duplicatePackets = (metrics.duplicatePackets || 0) + 1;
+                        app.debug(`[v2-server] stale META envelope seq=${envSeq} from ${session.key} (last=${session.lastMetaEnvSeq}), dropping`);
+                        return;
+                    }
+                    if (distance !== 0) {
+                        // New batch: advance and reset the per-batch chunk set.
+                        session.lastMetaEnvSeq = envSeq;
+                        session.seenMetaChunkIdx.clear();
+                    }
+                    else if (session.seenMetaChunkIdx.has(envIdx)) {
+                        // Same batch, exact duplicate chunk — drop.
+                        metrics.duplicatePackets = (metrics.duplicatePackets || 0) + 1;
+                        app.debug(`[v2-server] duplicate META chunk seq=${envSeq} idx=${envIdx} from ${session.key}, dropping`);
+                        return;
+                    }
+                }
+                else {
+                    session.lastMetaEnvSeq = envSeq;
+                    session.seenMetaChunkIdx.clear();
+                }
+                session.seenMetaChunkIdx.add(envIdx);
+            }
+            // Group entries by context so the local Signal K server sees one delta
+            // per context rather than one per path. Reduces app.handleMessage
+            // overhead on big snapshots without changing semantics.
+            const nowIso = new Date().toISOString();
+            const byContext = new Map();
+            for (const rawEntry of env.entries) {
+                if (!rawEntry || typeof rawEntry.meta !== "object" || !rawEntry.meta) {
+                    continue;
+                }
+                // Require a present path before attempting pathDictionary decode;
+                // decodeMetaEntry would otherwise coerce `undefined` into "undefined".
+                if (rawEntry.path === null || rawEntry.path === undefined) {
+                    continue;
+                }
+                if (typeof rawEntry.path !== "string" && typeof rawEntry.path !== "number") {
+                    continue;
+                }
+                const entry = parsed.flags.pathDictionary
+                    ? (0, pathDictionary_1.decodeMetaEntry)(rawEntry)
+                    : rawEntry;
+                const path = typeof entry.path === "string" ? entry.path : String(entry.path ?? "");
+                if (!path) {
+                    continue;
+                }
+                const context = typeof rawEntry.context === "string" ? rawEntry.context : "vessels.self";
+                const bucket = byContext.get(context);
+                const metaItem = { path, value: entry.meta };
+                if (bucket) {
+                    bucket.push(metaItem);
+                }
+                else {
+                    byContext.set(context, [metaItem]);
+                }
+            }
+            for (const [context, metaItems] of byContext) {
+                const deltaMessage = {
+                    context,
+                    updates: [
+                        {
+                            timestamp: nowIso,
+                            values: [],
+                            meta: metaItems
+                        }
+                    ]
+                };
+                app.handleMessage("", deltaMessage);
+            }
+            app.debug(`v2 meta received: kind=${env.kind ?? "?"}, entries=${env.entries.length}, contexts=${byContext.size}, envSeq=${env.v ?? "?"}`);
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            metrics.malformedPackets = (metrics.malformedPackets || 0) + 1;
+            app.error(`v2 handleMetadataPacket error: ${msg}`);
+            recordError("general", `v2 META decode error: ${msg}`);
+        }
+    }
+    /**
+     * Build and send a META_REQUEST (0x07) control packet to a client.
+     * Instructs the client to emit a fresh metadata snapshot — used on first
+     * contact from a new session so the receiver doesn't have to wait for the
+     * client's periodic resend cycle.
+     */
+    async function _sendMetaRequest(session, secretKey) {
+        try {
+            const packet = packetBuilder.buildMetaRequestPacket({ secretKey });
+            await _sendUDP(packet, { address: session.address, port: session.port });
+            app.debug(`[v2-server] META_REQUEST sent to ${session.key}`);
+        }
+        catch (err) {
+            // Re-throw so the caller's .catch() records it once, rather than
+            // double-logging here.
+            throw err;
+        }
+    }
     /**
      * Send UDP packet to a destination
      * @private
@@ -519,6 +716,37 @@ function createPipelineV2Server(app, state, metricsApi) {
                 catch (parseErr) {
                     app.error(`v2 failed to parse HELLO payload: ${parseErr instanceof Error ? parseErr.message : String(parseErr)}`);
                 }
+                // HELLO is the earliest reliable indication of a live peer, so use it
+                // as the trigger to demand a fresh metadata snapshot. The client
+                // self-rate-limits META_REQUEST responses (5 s window), and we only
+                // emit one per session, so this is safe even across rapid reconnects.
+                if (session && !session.metaRequested) {
+                    session.metaRequested = true;
+                    _sendMetaRequest(session, secretKey).catch((err) => {
+                        app.debug(`[v2-server] META_REQUEST send failed: ${err instanceof Error ? err.message : String(err)}`);
+                    });
+                }
+                return;
+            }
+            if (parsed.type === packet_1.PacketType.METADATA) {
+                // Apply the same per-session rate limit used for DATA so a malformed
+                // or hostile peer can't overwhelm the meta decoder path.
+                if (session) {
+                    const now = Date.now();
+                    if (now - session.rateLimitWindowStart >= constants_1.UDP_RATE_LIMIT_WINDOW) {
+                        session.rateLimitCount = 0;
+                        session.rateLimitWindowStart = now;
+                    }
+                    session.rateLimitCount++;
+                    if (session.rateLimitCount > constants_1.UDP_RATE_LIMIT_MAX_PACKETS) {
+                        metrics.rateLimitedPackets = (metrics.rateLimitedPackets || 0) + 1;
+                        metrics.bandwidth.metaRateLimitedPackets =
+                            (metrics.bandwidth.metaRateLimitedPackets || 0) + 1;
+                        app.debug(`[v2-server] rate limited META from ${session.key}`);
+                        return;
+                    }
+                }
+                await handleMetadataPacket(parsed, secretKey, session);
                 return;
             }
             if (parsed.type !== packet_1.PacketType.DATA) {
@@ -645,6 +873,12 @@ function createPipelineV2Server(app, state, metricsApi) {
                     app.debug(`v2 skipping null delta after decoding at index ${i}`);
                     continue;
                 }
+                const sanitizedDelta = (0, delta_sanitizer_1.sanitizeDeltaForSignalK)(deltaMessage);
+                if (sanitizedDelta === null) {
+                    app.debug(`v2 skipping delta with no valid Signal K values at index ${i}`);
+                    continue;
+                }
+                deltaMessage = sanitizedDelta;
                 _ingestRemoteTelemetry(deltaMessage);
                 if (!Array.isArray(deltaMessage.updates) || deltaMessage.updates.length === 0) {
                     continue;