fix(net): cap random origin id at 53 bits in JS client

[kixelated]

Summary

The JS client (@moq/net) generated a 62-bit random origin id, while the Rust client (rs/moq-net) already caps its generated id at 53 bits. This brings the two into sync.

Older @moq/lite JS clients decode AnnounceInterest.exclude_hop as a u53 (a JS number) and throw on any value > 2^53-1. A 62-bit origin generated by a fresh peer would crash those deployed bundles. Capping the generated value at 53 bits keeps them alive against fresh peers.

This is the JS half of the same TEMPORARY workaround already present in Origin::random (rs/moq-net). The wire format and OriginSchema still permit the full 62 bits. Only the value we generate is capped. Both should be restored to 62 bits once the u62 fix has propagated to deployed bundles.

Changes

• js/net/src/lite/origin.ts: mask randomOrigin() to 53 bits (0x1f_ffff_ffff_ffffn) instead of 62 bits, with a comment mirroring the Rust rationale.

Test plan

• biome check passes on the changed file
• Non-zero guard and OriginSchema validation unchanged

(Written by Claude)

[coderabbitai]

Walkthrough

In js/net/src/lite/origin.ts, the randomOrigin function's bitmask for generated origin IDs is changed from 0x3fff_ffff_ffff_ffffn (62 bits) to 0x1f_ffff_ffff_ffffn (53 bits). The inline documentation is updated to note this is a temporary constraint imposed by older @moq/lite JS clients that misinterpret on-wire values exceeding 53 bits. The rest of the function—zero-draw avoidance and validation via OriginSchema.parse—is unchanged. No exported signatures are affected.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the primary change: capping random origin ID generation at 53 bits in the JavaScript client.
Description check	✅ Passed	The description is well-related to the changeset, explaining the compatibility issue, the fix rationale, specific changes made, and testing confirmation.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch claude/unruffled-burnell-5cdfff

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

🧹 Nitpick comments (1)

js/net/src/lite/origin.ts (1)

34-34: ⚡ Quick win

Extract the bitmask to a named constant.

The bitmask value 0x1f_ffff_ffff_ffffn should be extracted to a named constant to follow coding guidelines. While the inline comment explains the value, a constant would make the intent clearer, simplify the future reversion to 62 bits, and be self-documenting.

As per coding guidelines, avoid using magic numbers; use named constants instead.

♻️ Proposed refactor

+/** Temporary 53-bit mask for compatibility with older `@moq/lite` clients. */
+const ORIGIN_BITMASK_53 = 0x1f_ffff_ffff_ffffn;
+
 export function randomOrigin(): Origin {
 	const buf = new BigUint64Array(1);
 	crypto.getRandomValues(buf);
-	// Mask to 53 bits.
-	const raw = buf[0] & 0x1f_ffff_ffff_ffffn;
+	const raw = buf[0] & ORIGIN_BITMASK_53;
 	// Guard against the (astronomically unlikely) zero draw.
 	return OriginSchema.parse(raw === 0n ? 1n : raw);
 }

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@js/net/src/lite/origin.ts` at line 34, The bitmask value 0x1f_ffff_ffff_ffffn
is hardcoded inline in the bitwise AND operation with buf[0], violating the
principle of avoiding magic numbers. Extract this bitmask to a named constant at
the module level with a descriptive name that reflects its purpose (such as
indicating it represents a mask for extractable bits), then replace the inline
bitmask in the expression with this constant reference.

Source: Coding guidelines

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@js/net/src/lite/origin.ts`:
- Line 34: The bitmask value 0x1f_ffff_ffff_ffffn is hardcoded inline in the
bitwise AND operation with buf[0], violating the principle of avoiding magic
numbers. Extract this bitmask to a named constant at the module level with a
descriptive name that reflects its purpose (such as indicating it represents a
mask for extractable bits), then replace the inline bitmask in the expression
with this constant reference.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: f87f0fc3-229e-4374-a679-e4b391585aa4

📥 Commits

Reviewing files that changed from the base of the PR and between 4209d7a and 7b6b0fe.

📒 Files selected for processing (1)

• js/net/src/lite/origin.ts