@bsv/wallet-toolbox 2.12.0 → 2.13.2

package/out/src/storage/remoting/BinaryJson.js

@@ -7,6 +7,7 @@ exports.binaryJsonReviver = binaryJsonReviver;
 exports.decodeBinaryJsonValue = decodeBinaryJsonValue;
 exports.stringifyJsonRpc = stringifyJsonRpc;
 exports.parseJsonRpc = parseJsonRpc;
+exports.validateJsonRpcResponse = validateJsonRpcResponse;
 exports.BINARY_ENCODING_HEADER = 'X-BSV-Binary-Encoding';
 exports.BINARY_REQUEST_ENCODING_HEADER = 'X-BSV-Binary-Request-Encoding';
 exports.BINARY_ENCODING = 'base64';
@@ -178,6 +179,23 @@ function binaryJsonReviver(_key, value) {
         return Object.fromEntries(value.entries);
     return value;
 }
+function collectDecodedChildren(current, replacements, stack) {
+    if (Array.isArray(current)) {
+        // Numeric byte arrays are common in sync responses. Avoid allocating an
+        // entry tuple and invoking a JSON reviver for every byte.
+        for (let index = 0; index < current.length; index++) {
+            const child = current[index];
+            if (child != null && typeof child === 'object') {
+                collectDecodedChild(String(index), child, replacements, stack);
+            }
+        }
+    }
+    else {
+        for (const [key, child] of Object.entries(current)) {
+            collectDecodedChild(key, child, replacements, stack);
+        }
+    }
+}
 function decodeBinaryJsonValue(value) {
     if (isTaggedBinary(value))
         return fromBase64(value.data);
@@ -193,9 +211,7 @@ function decodeBinaryJsonValue(value) {
         if (current == null)
             continue;
         const replacements = [];
-        for (const [key, child] of Object.entries(current)) {
-            collectDecodedChild(key, child, replacements, stack);
-        }
+        collectDecodedChildren(current, replacements, stack);
         if (replacements.length > 0)
             defineOwnValues(current, replacements);
     }
@@ -208,11 +224,81 @@ const JSON_RPC_REPLACERS = new Map([
 function stringifyJsonRpc(value, binary) {
     return JSON.stringify(value, JSON_RPC_REPLACERS.get(binary));
 }
-const JSON_RPC_REVIVERS = new Map([
-    [true, binaryJsonReviver],
-    [false, undefined]
-]);
+function pushJsonChildren(frame, stack) {
+    const push = (key, child) => {
+        if (child != null && typeof child === 'object') {
+            stack.push({ value: child, holder: frame.value, key, visited: false });
+        }
+    };
+    if (Array.isArray(frame.value)) {
+        for (let index = frame.value.length - 1; index >= 0; index--) {
+            const child = frame.value[index];
+            if (child != null && typeof child === 'object')
+                push(String(index), child);
+        }
+    }
+    else {
+        const entries = Object.entries(frame.value);
+        for (let index = entries.length - 1; index >= 0; index--)
+            push(...entries[index]);
+    }
+}
 function parseJsonRpc(text, binary = false) {
-    return JSON.parse(text, JSON_RPC_REVIVERS.get(binary));
+    const value = JSON.parse(text);
+    if (!binary || value == null || typeof value !== 'object')
+        return value;
+    // Match the exported reviver's bottom-up semantics, including escaped
+    // marker collisions and duplicate entry validation, without a callback per
+    // scalar byte or recursion proportional to remote JSON nesting depth.
+    const root = { value };
+    const stack = [{ value, holder: root, key: 'value', visited: false }];
+    while (stack.length > 0) {
+        const frame = stack.pop();
+        if (frame.visited) {
+            const decoded = binaryJsonReviver(frame.key, frame.value);
+            if (decoded !== frame.value)
+                defineOwnValues(frame.holder, [[frame.key, decoded]]);
+            continue;
+        }
+        stack.push({ ...frame, visited: true });
+        pushJsonChildren(frame, stack);
+    }
+    return root.value;
+}
+/** Require one exact response for the request that produced it. */
+function validateJsonRpcResponse(value, expectedId) {
+    if (value == null || typeof value !== 'object' || Array.isArray(value)) {
+        throw new Error('Wallet storage returned an invalid JSON-RPC response');
+    }
+    const prototype = Object.getPrototypeOf(value);
+    const properties = Object.getOwnPropertyDescriptors(value);
+    const keys = Object.keys(properties);
+    if ((prototype !== Object.prototype && prototype !== null) ||
+        Object.getOwnPropertySymbols(value).length !== 0 ||
+        Object.values(properties).some(property => property.get != null || property.set != null) ||
+        keys.some(key => key !== 'jsonrpc' && key !== 'id' && key !== 'result' && key !== 'error') ||
+        keys.length !== 3 ||
+        properties.jsonrpc?.value !== '2.0' ||
+        properties.id?.value !== expectedId ||
+        !Number.isSafeInteger(expectedId) ||
+        expectedId < 1 ||
+        Object.prototype.hasOwnProperty.call(properties, 'result') ===
+            Object.prototype.hasOwnProperty.call(properties, 'error')) {
+        throw new Error('Wallet storage returned an invalid JSON-RPC response');
+    }
+    if (Object.prototype.hasOwnProperty.call(properties, 'error')) {
+        const error = properties.error.value;
+        if (error == null || typeof error !== 'object' || Array.isArray(error)) {
+            throw new Error('Wallet storage returned an invalid JSON-RPC response');
+        }
+        const errorPrototype = Object.getPrototypeOf(error);
+        const errorProperties = Object.getOwnPropertyDescriptors(error);
+        if ((errorPrototype !== Object.prototype && errorPrototype !== null) ||
+            Object.getOwnPropertySymbols(error).length !== 0 ||
+            Object.values(errorProperties).some(property => property.get != null || property.set != null)) {
+            throw new Error('Wallet storage returned an invalid JSON-RPC response');
+        }
+    }
+    return value;
 }
 //# sourceMappingURL=BinaryJson.js.map

package/out/src/storage/remoting/BinaryJson.js.map

@@ -1 +1 @@
-{"version":3,"file":"BinaryJson.js","sourceRoot":"","sources":["../../../../src/storage/remoting/BinaryJson.ts"],"names":[],"mappings":";;;;;;;;;AAAa,QAAA,sBAAsB,GAAG,uBAAuB,CAAA;AAChD,QAAA,8BAA8B,GAAG,+BAA+B,CAAA;AAChE,QAAA,eAAe,GAAG,QAAQ,CAAA;AAEvC,MAAM,GAAG,GAAG,YAAY,CAAA;AACxB,MAAM,OAAO,GAAG,SAAS,CAAA;AACzB,MAAM,MAAM,GAAG,kEAAkE,CAAA;AAEjF,SAAS,aAAa;IACpB,OAAO,OAAO,UAAU,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAE,UAAkB,CAAC,MAAM,CAAA;AACnF,CAAC;AAED,SAAS,QAAQ,CAAC,KAAiB;IACjC,MAAM,UAAU,GAAG,aAAa,EAAE,CAAA;IAClC,IAAI,UAAU,IAAI,IAAI;QAAE,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IACnH,IAAI,OAAO,UAAU,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC1C,IAAI,MAAM,GAAG,EAAE,CAAA;QACf,MAAM,SAAS,GAAG,MAAM,CAAA;QACxB,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,MAAM,IAAI,SAAS,EAAE,CAAC;YAChE,MAAM,IAAI,MAAM,CAAC,aAAa,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;QACvG,CAAC;QACD,OAAO,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAChC,CAAC;IACD,IAAI,OAAO,GAAG,EAAE,CAAA;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACtB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAA;QAChC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAA;QAC/B,OAAO,IAAI,MAAM,CAAC,KAAK,KAAK,CAAC,CAAC,CAAA;QAC9B,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAA;QACtD,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;QACpF,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;IAC5D,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,SAAS,cAAc,CAAC,MAAc;IACpC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,kCAAkC,CAAC,CAAA;IACpF,IAAI,OAAO,GAAG,CAAC,CAAA;IACf,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,OAAO,GAAG,CAAC,CAAA;IACb,CAAC;SAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAChC,OAAO,GAAG,CAAC,CAAA;IACb,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,GAAG,OAAO,CAAA;IAC7C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,aAAa,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,kCAAkC,CAAC,CAAA;IAC1F,CAAC;IACD,KAAK,IAAI,CAAC,GAAG,aAAa,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACnD,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,MAAM,IAAI,SAAS,CAAC,kCAAkC,CAAC,CAAA;IAChF,CAAC;IACD,IACE,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QACxE,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;QAEzE,MAAM,IAAI,SAAS,CAAC,kCAAkC,CAAC,CAAA;IACzD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,SAAS,kCAAkC,CAAC,MAAc,EAAE,OAAe;IACzE,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC,CAAA;IAC3E,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;QACvC,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;QAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;QACvE,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;QACxE,MAAM,KAAK,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,MAAM,CAAA;QACpE,IAAI,MAAM,GAAG,KAAK,CAAC,MAAM;YAAE,KAAK,CAAC,MAAM,EAAE,CAAC,GAAG,KAAK,KAAK,EAAE,CAAA;QACzD,IAAI,MAAM,GAAG,KAAK,CAAC,MAAM;YAAE,KAAK,CAAC,MAAM,EAAE,CAAC,GAAG,KAAK,KAAK,CAAC,CAAA;QACxD,IAAI,MAAM,GAAG,KAAK,CAAC,MAAM;YAAE,KAAK,CAAC,MAAM,EAAE,CAAC,GAAG,KAAK,CAAA;IACpD,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,UAAU,CAAC,MAAc;IAChC,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,CAAA;IACtC,MAAM,UAAU,GAAG,aAAa,EAAE,CAAA;IAClC,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QAChD,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,CAAA;IAC5E,CAAC;IACD,IAAI,OAAO,UAAU,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACtC,mEAAmE;QACnE,qEAAqE;QACrE,OAAO,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC,CAAA;IACxE,CAAC;IACD,OAAO,kCAAkC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAC5D,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,CACL,KAAK,IAAI,IAAI;QACb,OAAO,KAAK,KAAK,QAAQ;QACxB,KAAa,CAAC,GAAG,CAAC,KAAK,QAAA,eAAe;QACvC,OAAQ,KAAa,CAAC,IAAI,KAAK,QAAQ;QACvC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAChC,CAAA;AACH,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,CACL,KAAK,IAAI,IAAI;QACb,OAAO,KAAK,KAAK,QAAQ;QACxB,KAAa,CAAC,IAAI,KAAK,QAAQ;QAChC,KAAK,CAAC,OAAO,CAAE,KAAa,CAAC,IAAI,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAChC,CAAA;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,CACL,KAAK,IAAI,IAAI;QACb,OAAO,KAAK,KAAK,QAAQ;QACxB,KAAa,CAAC,GAAG,CAAC,KAAK,OAAO;QAC/B,KAAK,CAAC,OAAO,CAAE,KAAa,CAAC,OAAO,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC;QAC9B,KAAa,CAAC,OAAO,CAAC,KAAK,CAC1B,CAAC,KAAc,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,CAC/F,CACF,CAAA;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,OAAO,EAAE,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAA;AAC3D,CAAC;AAED,SAAS,eAAe,CAAC,MAAc,EAAE,MAAyC;IAChF,4EAA4E;IAC5E,2EAA2E;IAC3E,8EAA8E;IAC9E,MAAM,CAAC,gBAAgB,CACrB,MAAM,EACN,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;QAC3B,GAAG;QACH;YACE,KAAK;YACL,QAAQ,EAAE,IAAI;YACd,UAAU,EAAE,IAAI;YAChB,YAAY,EAAE,IAAI;SACnB;KACF,CAAC,CACH,CACF,CAAA;AACH,CAAC;AAED,SAAS,mBAAmB,CAC1B,GAAW,EACX,KAAc,EACd,YAA+C,EAC/C,KAAe;IAEf,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,YAAY,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAClD,CAAC;SAAM,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAClD,YAAY,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAA;QAClC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACtB,CAAC;SAAM,IAAI,KAAK,IAAI,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACtD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACnB,CAAC;AACH,CAAC;AAED,4BAAkE,GAAW,EAAE,KAAc;IAC3F,IAAI,KAAK,YAAY,UAAU;QAAE,OAAO,EAAE,CAAC,GAAG,CAAC,EAAE,QAAA,eAAe,EAAE,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAA;IACzF,IAAI,KAAK,IAAI,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IAC5D,2EAA2E;IAC3E,8EAA8E;IAC9E,IAAI,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAA;QAC1B,IAAI,QAAQ,YAAY,UAAU;YAAE,OAAO,EAAE,CAAC,GAAG,CAAC,EAAE,QAAA,eAAe,EAAE,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAA;QAC/F,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAA;IAChC,CAAC;IACD,IAAI,cAAc,CAAC,KAAK,CAAC,IAAI,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAA;IACjF,OAAO,KAAK,CAAA;AACd,CAAC;AAED,kCAAyC,IAAY,EAAE,KAAc;IACnE,IAAI,KAAK,YAAY,UAAU;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACzD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,2BAAkC,IAAY,EAAE,KAAc;IAC5D,IAAI,cAAc,CAAC,KAAK,CAAC;QAAE,OAAO,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACxD,IAAI,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IAClE,OAAO,KAAK,CAAA;AACd,CAAC;AAED,+BAAsC,KAAc;IAClD,IAAI,cAAc,CAAC,KAAK,CAAC;QAAE,OAAO,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACxD,IAAI,KAAK,IAAI,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IAE5D,6EAA6E;IAC7E,0EAA0E;IAC1E,sBAAsB;IACtB,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;IAChF,MAAM,KAAK,GAAa,CAAC,OAAO,CAAC,CAAA;IACjC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,EAAE,CAAA;QAC3B,IAAI,OAAO,IAAI,IAAI;YAAE,SAAQ;QAC7B,MAAM,YAAY,GAAsC,EAAE,CAAA;QAC1D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACnD,mBAAmB,CAAC,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,CAAC,CAAA;QACtD,CAAC;QACD,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC;YAAE,eAAe,CAAC,OAAO,EAAE,YAAY,CAAC,CAAA;IACrE,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAuE;IACvG,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAC1B,CAAC,KAAK,EAAE,wBAAwB,CAAC;CAClC,CAAC,CAAA;AAEF,0BAAiC,KAAc,EAAE,MAAe;IAC9D,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAA;AAC9D,CAAC;AAED,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAgD;IAC/E,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACzB,CAAC,KAAK,EAAE,SAAS,CAAC;CACnB,CAAC,CAAA;AAEF,sBAA6B,IAAY,EAAE,MAAM,GAAY,KAAK;IAChE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAA;AACxD,CAAC"}
+{"version":3,"file":"BinaryJson.js","sourceRoot":"","sources":["../../../../src/storage/remoting/BinaryJson.ts"],"names":[],"mappings":";;;;;;;;;;AAAa,QAAA,sBAAsB,GAAG,uBAAuB,CAAA;AAChD,QAAA,8BAA8B,GAAG,+BAA+B,CAAA;AAChE,QAAA,eAAe,GAAG,QAAQ,CAAA;AAEvC,MAAM,GAAG,GAAG,YAAY,CAAA;AACxB,MAAM,OAAO,GAAG,SAAS,CAAA;AACzB,MAAM,MAAM,GAAG,kEAAkE,CAAA;AAEjF,SAAS,aAAa;IACpB,OAAO,OAAO,UAAU,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAE,UAAkB,CAAC,MAAM,CAAA;AACnF,CAAC;AAED,SAAS,QAAQ,CAAC,KAAiB;IACjC,MAAM,UAAU,GAAG,aAAa,EAAE,CAAA;IAClC,IAAI,UAAU,IAAI,IAAI;QAAE,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IACnH,IAAI,OAAO,UAAU,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC1C,IAAI,MAAM,GAAG,EAAE,CAAA;QACf,MAAM,SAAS,GAAG,MAAM,CAAA;QACxB,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,MAAM,IAAI,SAAS,EAAE,CAAC;YAChE,MAAM,IAAI,MAAM,CAAC,aAAa,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;QACvG,CAAC;QACD,OAAO,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAChC,CAAC;IACD,IAAI,OAAO,GAAG,EAAE,CAAA;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACtB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAA;QAChC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAA;QAC/B,OAAO,IAAI,MAAM,CAAC,KAAK,KAAK,CAAC,CAAC,CAAA;QAC9B,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAA;QACtD,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;QACpF,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;IAC5D,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,SAAS,cAAc,CAAC,MAAc;IACpC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,kCAAkC,CAAC,CAAA;IACpF,IAAI,OAAO,GAAG,CAAC,CAAA;IACf,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,OAAO,GAAG,CAAC,CAAA;IACb,CAAC;SAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAChC,OAAO,GAAG,CAAC,CAAA;IACb,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,GAAG,OAAO,CAAA;IAC7C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,aAAa,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,kCAAkC,CAAC,CAAA;IAC1F,CAAC;IACD,KAAK,IAAI,CAAC,GAAG,aAAa,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACnD,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,MAAM,IAAI,SAAS,CAAC,kCAAkC,CAAC,CAAA;IAChF,CAAC;IACD,IACE,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QACxE,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;QAEzE,MAAM,IAAI,SAAS,CAAC,kCAAkC,CAAC,CAAA;IACzD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,SAAS,kCAAkC,CAAC,MAAc,EAAE,OAAe;IACzE,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC,CAAA;IAC3E,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;QACvC,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;QAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;QACvE,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;QACxE,MAAM,KAAK,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,MAAM,CAAA;QACpE,IAAI,MAAM,GAAG,KAAK,CAAC,MAAM;YAAE,KAAK,CAAC,MAAM,EAAE,CAAC,GAAG,KAAK,KAAK,EAAE,CAAA;QACzD,IAAI,MAAM,GAAG,KAAK,CAAC,MAAM;YAAE,KAAK,CAAC,MAAM,EAAE,CAAC,GAAG,KAAK,KAAK,CAAC,CAAA;QACxD,IAAI,MAAM,GAAG,KAAK,CAAC,MAAM;YAAE,KAAK,CAAC,MAAM,EAAE,CAAC,GAAG,KAAK,CAAA;IACpD,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,UAAU,CAAC,MAAc;IAChC,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,CAAA;IACtC,MAAM,UAAU,GAAG,aAAa,EAAE,CAAA;IAClC,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QAChD,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,CAAA;IAC5E,CAAC;IACD,IAAI,OAAO,UAAU,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACtC,mEAAmE;QACnE,qEAAqE;QACrE,OAAO,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC,CAAA;IACxE,CAAC;IACD,OAAO,kCAAkC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAC5D,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,CACL,KAAK,IAAI,IAAI;QACb,OAAO,KAAK,KAAK,QAAQ;QACxB,KAAa,CAAC,GAAG,CAAC,KAAK,QAAA,eAAe;QACvC,OAAQ,KAAa,CAAC,IAAI,KAAK,QAAQ;QACvC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAChC,CAAA;AACH,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,CACL,KAAK,IAAI,IAAI;QACb,OAAO,KAAK,KAAK,QAAQ;QACxB,KAAa,CAAC,IAAI,KAAK,QAAQ;QAChC,KAAK,CAAC,OAAO,CAAE,KAAa,CAAC,IAAI,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAChC,CAAA;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,CACL,KAAK,IAAI,IAAI;QACb,OAAO,KAAK,KAAK,QAAQ;QACxB,KAAa,CAAC,GAAG,CAAC,KAAK,OAAO;QAC/B,KAAK,CAAC,OAAO,CAAE,KAAa,CAAC,OAAO,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC;QAC9B,KAAa,CAAC,OAAO,CAAC,KAAK,CAC1B,CAAC,KAAc,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,CAC/F,CACF,CAAA;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,OAAO,EAAE,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAA;AAC3D,CAAC;AAED,SAAS,eAAe,CAAC,MAAc,EAAE,MAAyC;IAChF,4EAA4E;IAC5E,2EAA2E;IAC3E,8EAA8E;IAC9E,MAAM,CAAC,gBAAgB,CACrB,MAAM,EACN,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;QAC3B,GAAG;QACH;YACE,KAAK;YACL,QAAQ,EAAE,IAAI;YACd,UAAU,EAAE,IAAI;YAChB,YAAY,EAAE,IAAI;SACnB;KACF,CAAC,CACH,CACF,CAAA;AACH,CAAC;AAED,SAAS,mBAAmB,CAC1B,GAAW,EACX,KAAc,EACd,YAA+C,EAC/C,KAAe;IAEf,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,YAAY,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAClD,CAAC;SAAM,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAClD,YAAY,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAA;QAClC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACtB,CAAC;SAAM,IAAI,KAAK,IAAI,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACtD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACnB,CAAC;AACH,CAAC;AAED,4BAAkE,GAAW,EAAE,KAAc;IAC3F,IAAI,KAAK,YAAY,UAAU;QAAE,OAAO,EAAE,CAAC,GAAG,CAAC,EAAE,QAAA,eAAe,EAAE,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAA;IACzF,IAAI,KAAK,IAAI,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IAC5D,2EAA2E;IAC3E,8EAA8E;IAC9E,IAAI,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAA;QAC1B,IAAI,QAAQ,YAAY,UAAU;YAAE,OAAO,EAAE,CAAC,GAAG,CAAC,EAAE,QAAA,eAAe,EAAE,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAA;QAC/F,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAA;IAChC,CAAC;IACD,IAAI,cAAc,CAAC,KAAK,CAAC,IAAI,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAA;IACjF,OAAO,KAAK,CAAA;AACd,CAAC;AAED,kCAAyC,IAAY,EAAE,KAAc;IACnE,IAAI,KAAK,YAAY,UAAU;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACzD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,2BAAkC,IAAY,EAAE,KAAc;IAC5D,IAAI,cAAc,CAAC,KAAK,CAAC;QAAE,OAAO,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACxD,IAAI,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IAClE,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,sBAAsB,CAC7B,OAAe,EACf,YAA+C,EAC/C,KAAe;IAEf,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,wEAAwE;QACxE,0DAA0D;QAC1D,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;YACpD,MAAM,KAAK,GAAY,OAAO,CAAC,KAAK,CAAC,CAAA;YACrC,IAAI,KAAK,IAAI,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC/C,mBAAmB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,CAAC,CAAA;YAChE,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACnD,mBAAmB,CAAC,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,CAAC,CAAA;QACtD,CAAC;IACH,CAAC;AACH,CAAC;AAED,+BAAsC,KAAc;IAClD,IAAI,cAAc,CAAC,KAAK,CAAC;QAAE,OAAO,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACxD,IAAI,KAAK,IAAI,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IAE5D,6EAA6E;IAC7E,0EAA0E;IAC1E,sBAAsB;IACtB,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;IAChF,MAAM,KAAK,GAAa,CAAC,OAAO,CAAC,CAAA;IACjC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,EAAE,CAAA;QAC3B,IAAI,OAAO,IAAI,IAAI;YAAE,SAAQ;QAC7B,MAAM,YAAY,GAAsC,EAAE,CAAA;QAC1D,sBAAsB,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,CAAC,CAAA;QACpD,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC;YAAE,eAAe,CAAC,OAAO,EAAE,YAAY,CAAC,CAAA;IACrE,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAuE;IACvG,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAC1B,CAAC,KAAK,EAAE,wBAAwB,CAAC;CAClC,CAAC,CAAA;AAEF,0BAAiC,KAAc,EAAE,MAAe;IAC9D,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAA;AAC9D,CAAC;AAID,SAAS,gBAAgB,CAAC,KAAY,EAAE,KAAc;IACpD,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,KAAc,EAAQ,EAAE;QACjD,IAAI,KAAK,IAAI,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC/C,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAA;QACxE,CAAC;IACH,CAAC,CAAA;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,KAAK,IAAI,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;YAC7D,MAAM,KAAK,GAAY,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YACzC,IAAI,KAAK,IAAI,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAA;QAC5E,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QAC3C,KAAK,IAAI,KAAK,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,KAAK,EAAE;YAAE,IAAI,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAA;IACnF,CAAC;AACH,CAAC;AAED,sBAA6B,IAAY,EAAE,MAAM,GAAY,KAAK;IAChE,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACvC,IAAI,CAAC,MAAM,IAAI,KAAK,IAAI,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IAEvE,sEAAsE;IACtE,2EAA2E;IAC3E,sEAAsE;IACtE,MAAM,IAAI,GAAG,EAAE,KAAK,EAAE,CAAA;IACtB,MAAM,KAAK,GAAY,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAA;IAC9E,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAG,CAAA;QAC1B,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,CAAA;YACzD,IAAI,OAAO,KAAK,KAAK,CAAC,KAAK;gBAAE,eAAe,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAA;YAClF,SAAQ;QACV,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;QACvC,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;IAChC,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAA;AACnB,CAAC;AAKD,mEAAmE;AACnE,iCAAwC,KAAc,EAAE,UAAkB;IACxE,IAAI,KAAK,IAAI,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;IACzE,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAA;IAC9C,MAAM,UAAU,GAAG,MAAM,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAA;IAC1D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IACpC,IACE,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI,CAAC;QACtD,MAAM,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC;QAChD,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,IAAI,IAAI,IAAI,QAAQ,CAAC,GAAG,IAAI,IAAI,CAAC;QACxF,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,OAAO,CAAC;QAC1F,IAAI,CAAC,MAAM,KAAK,CAAC;QACjB,UAAU,CAAC,OAAO,EAAE,KAAK,KAAK,KAAK;QACnC,UAAU,CAAC,EAAE,EAAE,KAAK,KAAK,UAAU;QACnC,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC;QACjC,UAAU,GAAG,CAAC;QACd,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC;YACxD,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,EAC3D,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;IACzE,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,CAAC;QAC9D,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,CAAA;QACpC,IAAI,KAAK,IAAI,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACvE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;QACzE,CAAC;QACD,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAA;QACnD,MAAM,eAAe,GAAG,MAAM,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAA;QAC/D,IACE,CAAC,cAAc,KAAK,MAAM,CAAC,SAAS,IAAI,cAAc,KAAK,IAAI,CAAC;YAChE,MAAM,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC;YAChD,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,IAAI,IAAI,IAAI,QAAQ,CAAC,GAAG,IAAI,IAAI,CAAC,EAC7F,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;QACzE,CAAC;IACH,CAAC;IACD,OAAO,KAAiC,CAAA;AAC1C,CAAC"}

package/out/src/storage/remoting/KnexSessionManager.d.ts

@@ -1,8 +1,12 @@
 import { AsyncSessionManager, PeerSession } from '@bsv/sdk';
 import { Knex } from 'knex';
 export declare const AUTH_SESSION_TABLE = "auth_sessions";
+export declare const AUTH_MESSAGE_NONCE_TABLE = "auth_message_nonces";
 export declare const DEFAULT_AUTH_SESSION_TTL_MS: number;
 export declare const DEFAULT_AUTH_SESSION_TOUCH_INTERVAL_MS: number;
+export declare const DEFAULT_MAX_AUTH_MESSAGE_NONCES_PER_SESSION = 100000;
+export declare const DEFAULT_MAX_INITIAL_REQUEST_NONCES = 100000;
+export declare const DEFAULT_MAX_INITIAL_REQUEST_NONCES_PER_IDENTITY = 100000;
 export interface KnexSessionManagerOptions {
     /** Session lifetime since its most recent authenticated use. Default: 24 hours. */
     ttlMs?: number;
@@ -12,6 +16,16 @@ export interface KnexSessionManagerOptions {
      * immediately. Default: 1 minute (or one quarter of ttlMs when shorter).
      */
     touchIntervalMs?: number;
+    /** Maximum one-time signed message nonces retained per active session. */
+    maxMessageNoncesPerSession?: number;
+    /** Maximum unsigned initial-request replay claims retained across all identities. */
+    maxInitialRequestNonces?: number;
+    /**
+     * Maximum unsigned initial-request replay claims retained per identity.
+     * The oldest claim is evicted at capacity so unauthenticated traffic cannot
+     * permanently disable new handshakes. Default: 100,000.
+     */
+    maxInitialRequestNoncesPerIdentity?: number;
     /** Testable clock source. Defaults to `Date.now`. */
     now?: () => number;
 }
@@ -19,14 +33,18 @@ export interface KnexSessionManagerOptions {
  * Shared BRC-103 session storage for horizontally scaled StorageServer nodes.
  *
  * Every instance must use the same Knex database. The wallet-toolbox migration
- * creates the required `auth_sessions` table. Writes are monotonic by
- * `PeerSession.lastUpdate`, preventing a delayed request on one replica from
+ * creates the required `auth_sessions` and `auth_message_nonces` tables. The
+ * nonce table atomically rejects replay across replicas. Writes are monotonic
+ * by `PeerSession.lastUpdate`, preventing a delayed request on one replica from
  * replacing newer session state written by another replica.
  */
 export declare class KnexSessionManager implements AsyncSessionManager {
     private readonly knex;
     private readonly ttlMs;
     private readonly touchIntervalMs;
+    private readonly maxMessageNoncesPerSession;
+    private readonly maxInitialRequestNonces;
+    private readonly maxInitialRequestNoncesPerIdentity;
     private readonly now;
     /** Rows associated with session objects returned by this manager. */
     private readonly persistedRows;
@@ -36,9 +54,14 @@ export declare class KnexSessionManager implements AsyncSessionManager {
     getSession(identifier: string): Promise<PeerSession | undefined>;
     removeSession(session: PeerSession): Promise<void>;
     hasSession(identifier: string): Promise<boolean>;
+    /** Atomically reject reuse of a signed BRC-103 message nonce across replicas. */
+    claimMessageNonce(sessionNonce: string, messageNonce: string): Promise<boolean>;
+    /** Atomically reject replayed unsigned initial requests across replicas. */
+    claimInitialRequestNonce(identityKey: string, initialNonce: string): Promise<boolean>;
     /** Delete expired rows. Call from an operator-controlled maintenance task. */
     pruneExpiredSessions(): Promise<number>;
     private activeSessions;
+    private evictOldestInitialRequestClaims;
     private persistSession;
     private validatePersistentSession;
     /**
@@ -53,5 +76,6 @@ export declare class KnexSessionManager implements AsyncSessionManager {
     private updateIfCurrentOrNewer;
     private mergeNullableBoolean;
     private toTableAuthSession;
+    private currentTime;
 }
 //# sourceMappingURL=KnexSessionManager.d.ts.map

package/out/src/storage/remoting/KnexSessionManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"KnexSessionManager.d.ts","sourceRoot":"","sources":["../../../../src/storage/remoting/KnexSessionManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,UAAU,CAAA;AAC3D,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAG3B,eAAO,MAAM,kBAAkB,kBAAkB,CAAA;AACjD,eAAO,MAAM,2BAA2B,QAAsB,CAAA;AAC9D,eAAO,MAAM,sCAAsC,QAAY,CAAA;AAG/D,MAAM,WAAW,yBAAyB;IACxC,mFAAmF;IACnF,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,qDAAqD;IACrD,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CACnB;AAED;;;;;;;GAOG;AACH,qBAAa,kBAAmB,YAAW,mBAAmB;IAO/C,OAAO,CAAC,QAAQ,CAAC,IAAI;IANlC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;IAC9B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAQ;IACxC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAc;IAClC,qEAAqE;IACrE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA+C;IAE7E,YAA8B,IAAI,EAAE,IAAI,EAAE,OAAO,GAAE,yBAA8B,EAchF;IAEK,UAAU,CAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAErD;IAEK,aAAa,CAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAExD;IAEK,UAAU,CAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAYtE;IAEK,aAAa,CAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAsBxD;IAEK,UAAU,CAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAUtD;IAED,8EAA8E;IACxE,oBAAoB,IAAK,OAAO,CAAC,MAAM,CAAC,CAI7C;IAED,OAAO,CAAC,cAAc;YAKR,cAAc;IAyC5B,OAAO,CAAC,yBAAyB;IASjC;;;;;;OAMG;IACH,OAAO,CAAC,gBAAgB;IAgBxB,OAAO,CAAC,aAAa;YAMP,sBAAsB;IAwBpC,OAAO,CAAC,oBAAoB;IAe5B,OAAO,CAAC,kBAAkB;CAiB3B"}
+{"version":3,"file":"KnexSessionManager.d.ts","sourceRoot":"","sources":["../../../../src/storage/remoting/KnexSessionManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,UAAU,CAAA;AAC3D,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAG3B,eAAO,MAAM,kBAAkB,kBAAkB,CAAA;AACjD,eAAO,MAAM,wBAAwB,wBAAwB,CAAA;AAC7D,eAAO,MAAM,2BAA2B,QAAsB,CAAA;AAC9D,eAAO,MAAM,sCAAsC,QAAY,CAAA;AAC/D,eAAO,MAAM,2CAA2C,SAAU,CAAA;AAClE,eAAO,MAAM,kCAAkC,SAAU,CAAA;AACzD,eAAO,MAAM,+CAA+C,SAAU,CAAA;AAGtE,MAAM,WAAW,yBAAyB;IACxC,mFAAmF;IACnF,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,0EAA0E;IAC1E,0BAA0B,CAAC,EAAE,MAAM,CAAA;IACnC,qFAAqF;IACrF,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC;;;;OAIG;IACH,kCAAkC,CAAC,EAAE,MAAM,CAAA;IAC3C,qDAAqD;IACrD,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CACnB;AAED;;;;;;;;GAQG;AACH,qBAAa,kBAAmB,YAAW,mBAAmB;IAW1D,OAAO,CAAC,QAAQ,CAAC,IAAI;IAVvB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;IAC9B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAQ;IACxC,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAAQ;IACnD,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAQ;IAChD,OAAO,CAAC,QAAQ,CAAC,kCAAkC,CAAQ;IAC3D,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAc;IAClC,qEAAqE;IACrE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA+C;IAE7E,YACmB,IAAI,EAAE,IAAI,EAC3B,OAAO,GAAE,yBAA8B,EA8BxC;IAEK,UAAU,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAEpD;IAEK,aAAa,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAEvD;IAEK,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAoBrE;IAEK,aAAa,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBvD;IAEK,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAMrD;IAED,iFAAiF;IAC3E,iBAAiB,CAAC,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAoCpF;IAED,4EAA4E;IACtE,wBAAwB,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAyD1F;IAED,8EAA8E;IACxE,oBAAoB,IAAI,OAAO,CAAC,MAAM,CAAC,CAsB5C;IAED,OAAO,CAAC,cAAc;YAIR,+BAA+B;YAiC/B,cAAc;IAyC5B,OAAO,CAAC,yBAAyB;IASjC;;;;;;OAMG;IACH,OAAO,CAAC,gBAAgB;IAkBxB,OAAO,CAAC,aAAa;YAMP,sBAAsB;IAwBpC,OAAO,CAAC,oBAAoB;IAiB5B,OAAO,CAAC,kBAAkB;IAkB1B,OAAO,CAAC,WAAW;CAOpB"}

package/out/src/storage/remoting/KnexSessionManager.js

@@ -1,29 +1,43 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.KnexSessionManager = exports.DEFAULT_AUTH_SESSION_TOUCH_INTERVAL_MS = exports.DEFAULT_AUTH_SESSION_TTL_MS = exports.AUTH_SESSION_TABLE = void 0;
+exports.KnexSessionManager = exports.DEFAULT_MAX_INITIAL_REQUEST_NONCES_PER_IDENTITY = exports.DEFAULT_MAX_INITIAL_REQUEST_NONCES = exports.DEFAULT_MAX_AUTH_MESSAGE_NONCES_PER_SESSION = exports.DEFAULT_AUTH_SESSION_TOUCH_INTERVAL_MS = exports.DEFAULT_AUTH_SESSION_TTL_MS = exports.AUTH_MESSAGE_NONCE_TABLE = exports.AUTH_SESSION_TABLE = void 0;
 const TableAuthSession_1 = require("../schema/tables/TableAuthSession");
 exports.AUTH_SESSION_TABLE = 'auth_sessions';
+exports.AUTH_MESSAGE_NONCE_TABLE = 'auth_message_nonces';
 exports.DEFAULT_AUTH_SESSION_TTL_MS = 24 * 60 * 60 * 1000;
 exports.DEFAULT_AUTH_SESSION_TOUCH_INTERVAL_MS = 60 * 1000;
+exports.DEFAULT_MAX_AUTH_MESSAGE_NONCES_PER_SESSION = 100_000;
+exports.DEFAULT_MAX_INITIAL_REQUEST_NONCES = 100_000;
+exports.DEFAULT_MAX_INITIAL_REQUEST_NONCES_PER_IDENTITY = 100_000;
 /**
  * Shared BRC-103 session storage for horizontally scaled StorageServer nodes.
  *
  * Every instance must use the same Knex database. The wallet-toolbox migration
- * creates the required `auth_sessions` table. Writes are monotonic by
- * `PeerSession.lastUpdate`, preventing a delayed request on one replica from
+ * creates the required `auth_sessions` and `auth_message_nonces` tables. The
+ * nonce table atomically rejects replay across replicas. Writes are monotonic
+ * by `PeerSession.lastUpdate`, preventing a delayed request on one replica from
  * replacing newer session state written by another replica.
  */
 class KnexSessionManager {
     knex;
     ttlMs;
     touchIntervalMs;
+    maxMessageNoncesPerSession;
+    maxInitialRequestNonces;
+    maxInitialRequestNoncesPerIdentity;
     now;
     /** Rows associated with session objects returned by this manager. */
     persistedRows = new WeakMap();
     constructor(knex, options = {}) {
         this.knex = knex;
         this.ttlMs = options.ttlMs ?? exports.DEFAULT_AUTH_SESSION_TTL_MS;
-        this.touchIntervalMs = options.touchIntervalMs ?? Math.min(exports.DEFAULT_AUTH_SESSION_TOUCH_INTERVAL_MS, Math.max(1, Math.floor(this.ttlMs / 4)));
+        this.touchIntervalMs =
+            options.touchIntervalMs ??
+                Math.min(exports.DEFAULT_AUTH_SESSION_TOUCH_INTERVAL_MS, Math.max(1, Math.floor(this.ttlMs / 4)));
+        this.maxMessageNoncesPerSession = options.maxMessageNoncesPerSession ?? exports.DEFAULT_MAX_AUTH_MESSAGE_NONCES_PER_SESSION;
+        this.maxInitialRequestNonces = options.maxInitialRequestNonces ?? exports.DEFAULT_MAX_INITIAL_REQUEST_NONCES;
+        this.maxInitialRequestNoncesPerIdentity =
+            options.maxInitialRequestNoncesPerIdentity ?? exports.DEFAULT_MAX_INITIAL_REQUEST_NONCES_PER_IDENTITY;
         this.now = options.now ?? Date.now;
         if (!Number.isSafeInteger(this.ttlMs) || this.ttlMs <= 0) {
             throw new TypeError('KnexSessionManager ttlMs must be a positive safe integer.');
@@ -31,6 +45,18 @@ class KnexSessionManager {
         if (!Number.isSafeInteger(this.touchIntervalMs) || this.touchIntervalMs < 0) {
             throw new TypeError('KnexSessionManager touchIntervalMs must be a non-negative safe integer.');
         }
+        if (!Number.isSafeInteger(this.maxMessageNoncesPerSession) || this.maxMessageNoncesPerSession < 1) {
+            throw new TypeError('KnexSessionManager maxMessageNoncesPerSession must be a positive safe integer.');
+        }
+        if (!Number.isSafeInteger(this.maxInitialRequestNonces) || this.maxInitialRequestNonces < 1) {
+            throw new TypeError('KnexSessionManager maxInitialRequestNonces must be a positive safe integer.');
+        }
+        if (!Number.isSafeInteger(this.maxInitialRequestNoncesPerIdentity) || this.maxInitialRequestNoncesPerIdentity < 1) {
+            throw new TypeError('KnexSessionManager maxInitialRequestNoncesPerIdentity must be a positive safe integer.');
+        }
+        if (typeof this.now !== 'function') {
+            throw new TypeError('KnexSessionManager now must be a function.');
+        }
     }
     async addSession(session) {
         await this.persistSession(session, false);
@@ -39,13 +65,21 @@ class KnexSessionManager {
         await this.persistSession(session, true);
     }
     async getSession(identifier) {
-        const byNonce = await this.activeSessions()
-            .where({ sessionNonce: identifier })
-            .first();
+        const byNonce = await this.activeSessions().where({ sessionNonce: identifier }).first();
         if (byNonce != null)
             return this.sessionForRow(byNonce);
         const byIdentity = await this.activeSessions()
             .where({ peerIdentityKey: identifier })
+            .orderBy('isAuthenticated', 'desc')
+            .orderByRaw('CASE WHEN ?? = ? AND COALESCE(??, ?) <> ? THEN ? ELSE ? END DESC', [
+            'certificatesRequired',
+            true,
+            'certificatesValidated',
+            false,
+            true,
+            0,
+            1
+        ])
             .orderBy('lastUpdate', 'desc')
             .orderBy('sessionNonce', 'desc')
             .first();
@@ -56,17 +90,15 @@ class KnexSessionManager {
             return;
         if (!Number.isSafeInteger(session.lastUpdate) || session.lastUpdate < 0)
             return;
-        await this.knex(exports.AUTH_SESSION_TABLE)
+        const removed = await this.knex(exports.AUTH_SESSION_TABLE)
             .where({ sessionNonce: session.sessionNonce })
             .where(function () {
             // Knex query builders are thenable, but these calls only build the
             // surrounding delete predicate; they do not start standalone queries.
             // eslint-disable-next-line @typescript-eslint/no-floating-promises
-            this.where('lastUpdate', '<', session.lastUpdate)
-                .orWhere(function () {
+            this.where('lastUpdate', '<', session.lastUpdate).orWhere(function () {
                 // eslint-disable-next-line @typescript-eslint/no-floating-promises
-                this.where('lastUpdate', '=', session.lastUpdate)
-                    .where('isAuthenticated', session.isAuthenticated);
+                this.where('lastUpdate', '=', session.lastUpdate).where('isAuthenticated', session.isAuthenticated);
                 applyNullableMatch(this, 'peerNonce', session.peerNonce);
                 applyNullableMatch(this, 'peerIdentityKey', session.peerIdentityKey);
                 applyNullableMatch(this, 'certificatesRequired', session.certificatesRequired);
@@ -74,27 +106,167 @@ class KnexSessionManager {
             });
         })
             .delete();
+        if (removed > 0) {
+            await this.knex(exports.AUTH_MESSAGE_NONCE_TABLE).where({ sessionNonce: session.sessionNonce }).delete();
+        }
     }
     async hasSession(identifier) {
-        const byNonce = await this.activeSessions()
-            .where({ sessionNonce: identifier })
-            .first('sessionNonce');
+        const byNonce = await this.activeSessions().where({ sessionNonce: identifier }).first('sessionNonce');
         if (byNonce != null)
             return true;
-        const byIdentity = await this.activeSessions()
-            .where({ peerIdentityKey: identifier })
-            .first('sessionNonce');
+        const byIdentity = await this.activeSessions().where({ peerIdentityKey: identifier }).first('sessionNonce');
         return byIdentity != null;
     }
+    /** Atomically reject reuse of a signed BRC-103 message nonce across replicas. */
+    async claimMessageNonce(sessionNonce, messageNonce) {
+        validateNonceIdentifier(sessionNonce, 'sessionNonce');
+        validateNonceIdentifier(messageNonce, 'messageNonce');
+        const now = this.currentTime();
+        return await this.knex.transaction(async (trx) => {
+            const session = await trx(exports.AUTH_SESSION_TABLE)
+                .where({ sessionNonce })
+                .where('expiresAt', '>', now)
+                .first('sessionNonce', 'expiresAt');
+            if (session == null)
+                throw new Error(`Session not found for nonce: ${sessionNonce}`);
+            const existing = await trx(exports.AUTH_MESSAGE_NONCE_TABLE).where({ sessionNonce, messageNonce }).first('messageNonce');
+            if (existing != null)
+                return false;
+            const countRow = await trx(exports.AUTH_MESSAGE_NONCE_TABLE)
+                .where({ sessionNonce })
+                .count({ count: '*' })
+                .first();
+            const count = Number(countRow?.count ?? 0);
+            if (!Number.isSafeInteger(count) || count >= this.maxMessageNoncesPerSession) {
+                throw new Error('BRC-103 session message nonce capacity exhausted');
+            }
+            try {
+                await trx(exports.AUTH_MESSAGE_NONCE_TABLE).insert({
+                    sessionNonce,
+                    messageNonce,
+                    expiresAt: Number(session.expiresAt)
+                });
+                return true;
+            }
+            catch (error) {
+                if (isDuplicateKeyError(error))
+                    return false;
+                throw error;
+            }
+        });
+    }
+    /** Atomically reject replayed unsigned initial requests across replicas. */
+    async claimInitialRequestNonce(identityKey, initialNonce) {
+        validateNonceIdentifier(identityKey, 'identityKey', 66);
+        validateNonceIdentifier(initialNonce, 'initialNonce', 64);
+        const claimScope = `initial:${identityKey}`;
+        const now = this.currentTime();
+        const expiresAt = now + this.ttlMs;
+        if (!Number.isSafeInteger(expiresAt)) {
+            throw new TypeError('Initial-request replay expiry must be a safe integer');
+        }
+        return await this.knex.transaction(async (trx) => {
+            // Initial identities are attacker-selected. Prune all expired claims so
+            // cycling through identities cannot leave unbounded dead rows behind.
+            await trx(exports.AUTH_MESSAGE_NONCE_TABLE)
+                .where('sessionNonce', 'like', 'initial:%')
+                .where('expiresAt', '<=', now)
+                .delete();
+            const existing = await trx(exports.AUTH_MESSAGE_NONCE_TABLE)
+                .where({ sessionNonce: claimScope, messageNonce: initialNonce })
+                .first('messageNonce');
+            if (existing != null)
+                return false;
+            const countRow = await trx(exports.AUTH_MESSAGE_NONCE_TABLE)
+                .where({ sessionNonce: claimScope })
+                .count({ count: '*' })
+                .first();
+            const count = Number(countRow?.count ?? 0);
+            if (!Number.isSafeInteger(count) || count < 0) {
+                throw new Error('BRC-103 initial request nonce count is invalid');
+            }
+            const evictionCount = count - this.maxInitialRequestNoncesPerIdentity + 1;
+            if (evictionCount > 0) {
+                await this.evictOldestInitialRequestClaims(trx, evictionCount, claimScope);
+            }
+            const totalRow = await trx(exports.AUTH_MESSAGE_NONCE_TABLE)
+                .where('sessionNonce', 'like', 'initial:%')
+                .count({ count: '*' })
+                .first();
+            const total = Number(totalRow?.count ?? 0);
+            if (!Number.isSafeInteger(total) || total < 0) {
+                throw new Error('BRC-103 total initial request nonce count is invalid');
+            }
+            const globalEvictionCount = total - this.maxInitialRequestNonces + 1;
+            if (globalEvictionCount > 0) {
+                await this.evictOldestInitialRequestClaims(trx, globalEvictionCount);
+            }
+            try {
+                await trx(exports.AUTH_MESSAGE_NONCE_TABLE).insert({
+                    sessionNonce: claimScope,
+                    messageNonce: initialNonce,
+                    expiresAt
+                });
+                return true;
+            }
+            catch (error) {
+                if (isDuplicateKeyError(error))
+                    return false;
+                throw error;
+            }
+        });
+    }
     /** Delete expired rows. Call from an operator-controlled maintenance task. */
     async pruneExpiredSessions() {
-        return await this.knex(exports.AUTH_SESSION_TABLE)
-            .where('expiresAt', '<=', this.now())
-            .delete();
+        const now = this.currentTime();
+        return await this.knex.transaction(async (trx) => {
+            const removedSessions = await trx(exports.AUTH_SESSION_TABLE).where('expiresAt', '<=', now).delete();
+            await trx(exports.AUTH_MESSAGE_NONCE_TABLE)
+                .where('sessionNonce', 'like', 'initial:%')
+                .where('expiresAt', '<=', now)
+                .delete();
+            // A signed nonce belongs to its session for the full lifetime of that
+            // session, including sliding TTL extensions. Delete only orphaned rows;
+            // their original expiresAt value must not reopen replay in an active
+            // session after it has been touched.
+            await trx(exports.AUTH_MESSAGE_NONCE_TABLE)
+                .whereNot('sessionNonce', 'like', 'initial:%')
+                .whereNotExists(trx(exports.AUTH_SESSION_TABLE)
+                .select(trx.raw('1'))
+                .whereRaw('?? = ??', [`${exports.AUTH_SESSION_TABLE}.sessionNonce`, `${exports.AUTH_MESSAGE_NONCE_TABLE}.sessionNonce`]))
+                .delete();
+            return removedSessions;
+        });
     }
     activeSessions() {
-        return this.knex(exports.AUTH_SESSION_TABLE)
-            .where('expiresAt', '>', this.now());
+        return this.knex(exports.AUTH_SESSION_TABLE).where('expiresAt', '>', this.currentTime());
+    }
+    async evictOldestInitialRequestClaims(trx, count, claimScope) {
+        // Keep batches below conservative SQL parameter limits when an operator
+        // lowers a configured cap beneath an already-populated table.
+        let remaining = count;
+        while (remaining > 0) {
+            const batchSize = Math.min(remaining, 250);
+            const query = trx(exports.AUTH_MESSAGE_NONCE_TABLE)
+                .orderBy('expiresAt', 'asc')
+                .orderBy('sessionNonce', 'asc')
+                .orderBy('messageNonce', 'asc')
+                .limit(batchSize)
+                .select('sessionNonce', 'messageNonce');
+            if (claimScope === undefined) {
+                query.where('sessionNonce', 'like', 'initial:%');
+            }
+            else {
+                query.where({ sessionNonce: claimScope });
+            }
+            const oldestClaims = await query;
+            if (oldestClaims.length === 0)
+                return;
+            await trx(exports.AUTH_MESSAGE_NONCE_TABLE)
+                .whereIn(['sessionNonce', 'messageNonce'], oldestClaims.map(claim => [claim.sessionNonce, claim.messageNonce]))
+                .delete();
+            remaining -= oldestClaims.length;
+        }
     }
     async persistSession(session, coalesceTouch) {
         this.validatePersistentSession(session);
@@ -163,12 +335,12 @@ class KnexSessionManager {
         const elapsed = Number(row.lastUpdate) - persistedLastUpdate;
         if (elapsed < 0 || elapsed >= this.touchIntervalMs)
             return false;
-        if (Number(persisted.expiresAt) - this.now() <= this.touchIntervalMs)
+        if (Number(persisted.expiresAt) - this.currentTime() <= this.touchIntervalMs)
             return false;
-        return nullableEqual(row.peerNonce, persisted.peerNonce) &&
+        return (nullableEqual(row.peerNonce, persisted.peerNonce) &&
             nullableEqual(row.peerIdentityKey, persisted.peerIdentityKey) &&
             nullableBooleanEqual(row.certificatesRequired, persisted.certificatesRequired) &&
-            nullableBooleanEqual(row.certificatesValidated, persisted.certificatesValidated);
+            nullableBooleanEqual(row.certificatesValidated, persisted.certificatesValidated));
     }
     sessionForRow(row) {
         const session = (0, TableAuthSession_1.tableAuthSessionToPeerSession)(row);
@@ -188,7 +360,10 @@ class KnexSessionManager {
             // Authentication and certificate validation only advance during a
             // session. Merge those flags so two writes in the same millisecond
             // cannot downgrade stronger state merely because Date.now collided.
-            isAuthenticated: this.knex.raw('case when ?? = 1 or ? = 1 then 1 else 0 end', ['isAuthenticated', row.isAuthenticated === true || row.isAuthenticated === 1 ? 1 : 0]),
+            isAuthenticated: this.knex.raw('case when ?? = 1 or ? = 1 then 1 else 0 end', [
+                'isAuthenticated',
+                row.isAuthenticated === true || row.isAuthenticated === 1 ? 1 : 0
+            ]),
             certificatesRequired: this.mergeNullableBoolean('certificatesRequired', row.certificatesRequired),
             certificatesValidated: this.mergeNullableBoolean('certificatesValidated', row.certificatesValidated),
             lastUpdate: row.lastUpdate,
@@ -206,7 +381,12 @@ class KnexSessionManager {
         else {
             incoming = 0;
         }
-        return this.knex.raw('case when ?? = 1 or ? = 1 then 1 when ?? is null and ? is null then null else 0 end', [column, incoming, column, incoming]);
+        return this.knex.raw('case when ?? = 1 or ? = 1 then 1 when ?? is null and ? is null then null else 0 end', [
+            column,
+            incoming,
+            column,
+            incoming
+        ]);
     }
     toTableAuthSession(session) {
         const expiresAt = session.lastUpdate + this.ttlMs;
@@ -224,6 +404,13 @@ class KnexSessionManager {
             expiresAt
         };
     }
+    currentTime() {
+        const value = this.now();
+        if (!Number.isSafeInteger(value) || value < 0) {
+            throw new TypeError('KnexSessionManager now must return a non-negative safe integer.');
+        }
+        return value;
+    }
 }
 exports.KnexSessionManager = KnexSessionManager;
 function applyNullableMatch(query, column, value) {
@@ -248,9 +435,14 @@ function isDuplicateKeyError(error) {
     if (typeof error !== 'object' || error == null)
         return false;
     const databaseError = error;
-    return databaseError.code === 'SQLITE_CONSTRAINT_PRIMARYKEY' ||
+    return (databaseError.code === 'SQLITE_CONSTRAINT_PRIMARYKEY' ||
         databaseError.code === 'SQLITE_CONSTRAINT_UNIQUE' ||
         databaseError.code === 'ER_DUP_ENTRY' ||
-        databaseError.errno === 1062;
+        databaseError.errno === 1062);
+}
+function validateNonceIdentifier(value, name, maxLength = 64) {
+    if (typeof value !== 'string' || value.length === 0 || value.length > maxLength) {
+        throw new TypeError(`${name} must be a non-empty string of at most ${maxLength} characters.`);
+    }
 }
 //# sourceMappingURL=KnexSessionManager.js.map