opcjs-base 0.1.26-alpha → 0.1.32-alpha

package/dist/index.cjs

@@ -2,6 +2,40 @@
 
 var fastXmlParser = require('fast-xml-parser');
 
+// src/types/expandedNodeId.ts
+var ExpandedNodeId = class {
+  /** The wrapped NodeId. */
+  nodeId;
+  /** The server index (optional, for cross-server references). */
+  serverIndex;
+  /** The namespace URI (optional, alternative to the namespace index on nodeId). */
+  namespaceUri;
+  /**
+   * Create a new ExpandedNodeId.
+   *
+   * @param nodeId - The wrapped NodeId
+   * @param namespaceUri - Optional namespace URI
+   * @param serverIndex - Optional server index
+   */
+  constructor(nodeId, namespaceUri, serverIndex) {
+    this.nodeId = nodeId;
+    this.namespaceUri = namespaceUri;
+    this.serverIndex = serverIndex;
+  }
+  /** Convert ExpandedNodeId to string representation. */
+  toString() {
+    let result = "";
+    if (this.serverIndex !== void 0) {
+      result += `svr=${this.serverIndex};`;
+    }
+    if (this.namespaceUri !== void 0) {
+      result += `nsu=${this.namespaceUri};`;
+    }
+    result += this.nodeId.toString();
+    return result;
+  }
+};
+
 // src/types/nodeId.ts
 var NodeIdType = /* @__PURE__ */ ((NodeIdType2) => {
   NodeIdType2[NodeIdType2["Numeric"] = 0] = "Numeric";
@@ -172,47 +206,6 @@ var NodeId = class _NodeId {
   }
 };
 
-// src/types/expandedNodeId.ts
-var ExpandedNodeId = class extends NodeId {
-  /**
-   * The server index (optional, for cross-server references)
-   */
-  serverIndex;
-  /**
-   * The namespace URI (optional, alternative to namespace index)
-   */
-  namespaceUri;
-  /**
-   * Create a new ExpandedNodeId
-   * 
-   * @param namespace - The namespace index
-   * @param identifier - The identifier
-   * @param namespaceUri - Optional namespace URI
-   * @param serverIndex - Optional server index
-   */
-  constructor(namespace = 0, identifier = 0, namespaceUri, serverIndex) {
-    super(namespace, identifier);
-    this.namespaceUri = namespaceUri;
-    this.serverIndex = serverIndex;
-  }
-  /**
-   * Convert ExpandedNodeId to string representation
-   * 
-   * @returns String representation of the ExpandedNodeId
-   */
-  toString() {
-    let result = "";
-    if (this.serverIndex !== void 0) {
-      result += `svr=${this.serverIndex};`;
-    }
-    if (this.namespaceUri !== void 0) {
-      result += `nsu=${this.namespaceUri};`;
-    }
-    result += super.toString();
-    return result;
-  }
-};
-
 // src/codecs/encoder.ts
 var Encoder = class {
   encoders = /* @__PURE__ */ new Map();
@@ -230,7 +223,7 @@ var Encoder = class {
     }
     const writer = writerFactory();
     const encodingId = value.getBinaryEncodingId();
-    const eid = new ExpandedNodeId(0, encodingId);
+    const eid = new ExpandedNodeId(new NodeId(0, encodingId));
     writer.writeExpandedNodeId(eid);
     const typeId = value.getTypeId();
     const encodingFunction = this.encoders.get(typeId);
@@ -277,7 +270,7 @@ var Decoder = class {
     }
     const reader = readerFactory(data);
     const eid = reader.readExpandedNodeId();
-    return this.decodeWithEncodingId(eid.identifier, reader);
+    return this.decodeWithEncodingId(eid.nodeId.identifier, reader);
   }
   decodeWithEncodingId(encodingId, reader) {
     const decodingInfo = this.encodingIdMap.get(encodingId);
@@ -493,7 +486,7 @@ function decodeExpandedNodeId(reader) {
   if (hasServerIndex) {
     serverIndex = reader.readUInt32();
   }
-  return new ExpandedNodeId(nodeId.namespace, nodeId.identifier, namespaceUri, serverIndex);
+  return new ExpandedNodeId(nodeId, namespaceUri, serverIndex);
 }
 function encodeExpandedNodeId(writer, value) {
   let extraFlags = 0;
@@ -504,9 +497,9 @@ function encodeExpandedNodeId(writer, value) {
     extraFlags |= ExpandedNodeIdMask.ServerIndexFlag;
   }
   if (extraFlags === 0) {
-    encodeNodeId(writer, value);
+    encodeNodeId(writer, value.nodeId);
   } else {
-    encodeNodeIdWithExtraFlags(writer, value, extraFlags);
+    encodeNodeIdWithExtraFlags(writer, value.nodeId, extraFlags);
   }
   if (value.namespaceUri !== void 0) {
     writer.writeString(value.namespaceUri);
@@ -727,7 +720,7 @@ function encodeLocalizedText(writer, value) {
 // src/types/extensionObject.ts
 var ExtensionObject = class _ExtensionObject {
   /**
-   * The NodeId that identifies the type of structure encoded in the body.
+   * The NodeId (or ExpandedNodeId) that identifies the type of structure encoded in the body.
    */
   typeId;
   /**
@@ -1056,7 +1049,7 @@ function decodeExtensionObject(reader, decoder) {
 }
 function encodeExtensionObject(writer, value, encoder) {
   const typeId = value.typeId;
-  if ("namespaceUri" in typeId || "serverIndex" in typeId) {
+  if (typeId instanceof ExpandedNodeId) {
     encodeExpandedNodeId(writer, typeId);
   } else {
     encodeNodeId(writer, typeId);
@@ -1372,7 +1365,7 @@ function StatusCodeToString(statusCode) {
   if (statusCode === void 0) {
     return "Unknown";
   }
-  const baseCode = statusCode & 4294901760;
+  const baseCode = (statusCode & 4294901760) >>> 0;
   const name = Object.entries(StatusCode).find(([, v]) => v === baseCode)?.[0];
   return name ?? `0x${baseCode.toString(16).toUpperCase().padStart(8, "0")}`;
 }
@@ -1395,7 +1388,7 @@ function StatusCodeGetFlagBits(statusCode) {
   };
 }
 function StatusCodeIs(statusCode, expected) {
-  return (statusCode & 4294901760) === expected;
+  return (statusCode & 4294901760) >>> 0 === expected;
 }
 
 // src/types/dataValue.ts
@@ -2939,12 +2932,22 @@ var SecureChannelTypeEncoder = class extends TransformStream {
   }
 };
 
+// src/secureChannel/messages/msgType.ts
+var MsgTypeOpenFinal = "O".charCodeAt(0) | "P".charCodeAt(0) << 8 | "N".charCodeAt(0) << 16 | "F".charCodeAt(0) << 24;
+var MsgTypeOpenChunk = "O".charCodeAt(0) | "P".charCodeAt(0) << 8 | "N".charCodeAt(0) << 16 | "C".charCodeAt(0) << 24;
+var MsgTypeAbort = "M".charCodeAt(0) | "S".charCodeAt(0) << 8 | "G".charCodeAt(0) << 16 | "A".charCodeAt(0) << 24;
+var MsgTypeChunk = "M".charCodeAt(0) | "S".charCodeAt(0) << 8 | "G".charCodeAt(0) << 16 | "C".charCodeAt(0) << 24;
+var MsgTypeFinal = "M".charCodeAt(0) | "S".charCodeAt(0) << 8 | "G".charCodeAt(0) << 16 | "F".charCodeAt(0) << 24;
+var MsgTypeCloseFinal = "C".charCodeAt(0) | "L".charCodeAt(0) << 8 | "O".charCodeAt(0) << 16 | "F".charCodeAt(0) << 24;
+
 // src/secureChannel/secureChannelTypeDecoder.ts
 var SecureChannelTypeDecoder = class extends TransformStream {
   constructor(decoder) {
     super({
       transform(msg, controller) {
-        msg.body = decoder.decode(msg.body, "binary");
+        if (msg.header.msgType !== MsgTypeAbort) {
+          msg.body = decoder.decode(msg.body, "binary");
+        }
         controller.enqueue(msg);
       }
     });
@@ -17406,13 +17409,6 @@ var MsgSymmetric = class _MsgSymmetric extends MsgBase2 {
   }
 };
 
-// src/secureChannel/messages/msgType.ts
-var MsgTypeOpenFinal = "O".charCodeAt(0) | "P".charCodeAt(0) << 8 | "N".charCodeAt(0) << 16 | "F".charCodeAt(0) << 24;
-var MsgTypeAbort = "M".charCodeAt(0) | "S".charCodeAt(0) << 8 | "G".charCodeAt(0) << 16 | "A".charCodeAt(0) << 24;
-var MsgTypeChunk = "M".charCodeAt(0) | "S".charCodeAt(0) << 8 | "G".charCodeAt(0) << 16 | "C".charCodeAt(0) << 24;
-var MsgTypeFinal = "M".charCodeAt(0) | "S".charCodeAt(0) << 8 | "G".charCodeAt(0) << 16 | "F".charCodeAt(0) << 24;
-var MsgTypeCloseFinal = "C".charCodeAt(0) | "L".charCodeAt(0) << 8 | "O".charCodeAt(0) << 16 | "F".charCodeAt(0) << 24;
-
 // src/secureChannel/pendingRequests.ts
 var PendingRequests = class {
   map = /* @__PURE__ */ new Map();
@@ -17464,6 +17460,7 @@ var Certificate = class {
 };
 
 // src/secureChannel/secureChannelFacade.ts
+var TOKEN_RENEW_FRACTION = 0.75;
 var SecureChannelFacade = class {
   // ─── Constructor ────────────────────────────────────────────────────────────────
   constructor(context, readerTransform, writerTransform) {
@@ -17478,11 +17475,17 @@ var SecureChannelFacade = class {
   logger = getLogger("secureChannel.SecureChannelFacade");
   writer;
   reader;
+  /** Timer handle for the scheduled token renewal; undefined when no renewal is pending. */
+  renewalTimer;
   /**
-   * Sends the OpenSecureChannel request and resolves once the server replies.
-   * Updates `context.channelId` and `context.tokenId` on success.
+   * Builds and sends an OpenSecureChannel request.
+   * Called for both the initial Issue and subsequent Renew requests.
+   *
+   * On success the context `channelId` and `tokenId` are updated and a new
+   * renewal is scheduled at 75 % of the server-revised token lifetime, per
+   * OPC UA Part 4 Section 5.4.1 / Part 6 Section 6.7.3.
    */
-  async openSecureChannel() {
+  async sendOpenSecureChannel(requestType) {
     const requestHeader = new RequestHeader();
     requestHeader.authenticationToken = NodeId.newTwoByte(0);
     requestHeader.timestamp = /* @__PURE__ */ new Date();
@@ -17494,31 +17497,72 @@ var SecureChannelFacade = class {
     const request = new OpenSecureChannelRequest();
     request.requestHeader = requestHeader;
     request.clientProtocolVersion = 0;
-    request.requestType = 0 /* Issue */;
+    request.requestType = requestType;
     request.securityMode = this.context.securityPolicy.getSecurityMode();
     request.clientNonce = null;
     request.requestedLifetime = 36e5;
     const { sequenceNumber, requestId } = this.context.nextIds();
-    this.context.securityAlgorithm = this.context.securityPolicy.getAlgorithmAsymmetric(new Uint8Array(), new Uint8Array());
+    this.context.securityAlgorithm = this.context.securityPolicy.getAlgorithmAsymmetric(
+      new Uint8Array(),
+      new Uint8Array()
+    );
     const msg = new MsgAsymmetric(
-      new MsgHeader2(MsgTypeOpenFinal, 0, 0),
+      new MsgHeader2(MsgTypeOpenFinal, 0, this.context.channelId),
       new MsgSecurityHeaderAsymmetric(
         "http://opcfoundation.org/UA/SecurityPolicy#None"
       ),
       new MsgSequenceHeader(sequenceNumber, requestId),
       request
     );
-    this.logger.debug("Sending OpenSecureChannelRequest...");
-    return this.pushMessage(msg).then((response) => {
-      const openResponse = response;
-      this.logger.debug("OpenSecureChannelResponse received");
-      this.context.channelId = openResponse.securityToken?.channelId;
-      this.context.tokenId = openResponse.securityToken?.tokenId;
-      this.context.securityAlgorithm = this.context.securityPolicy.getAlgorithmSymmetric(
-        new Certificate(),
-        new Certificate()
-      );
-    });
+    const response = await this.pushMessage(msg);
+    this.context.channelId = response.securityToken?.channelId;
+    this.context.tokenId = response.securityToken?.tokenId;
+    this.context.securityAlgorithm = this.context.securityPolicy.getAlgorithmSymmetric(
+      new Certificate(),
+      new Certificate()
+    );
+    const revisedLifetimeMs = response.securityToken?.revisedLifetime;
+    this.scheduleRenewal(revisedLifetimeMs);
+  }
+  /**
+   * Schedules a proactive token renewal at {@link TOKEN_RENEW_FRACTION} of
+   * `lifetimeMs`.  Any previously scheduled renewal is cancelled first.
+   */
+  scheduleRenewal(lifetimeMs) {
+    if (this.renewalTimer !== void 0) {
+      clearTimeout(this.renewalTimer);
+    }
+    const delayMs = Math.floor(lifetimeMs * TOKEN_RENEW_FRACTION);
+    this.logger.debug(
+      `Scheduling SecurityToken renewal in ${delayMs} ms (75 % of ${lifetimeMs} ms lifetime).`
+    );
+    this.renewalTimer = setTimeout(() => {
+      this.renewalTimer = void 0;
+      this.logger.info("Renewing SecurityToken...");
+      this.sendOpenSecureChannel(1 /* Renew */).catch((err) => {
+        this.logger.error("SecurityToken renewal failed:", err);
+      });
+    }, delayMs);
+  }
+  /**
+   * Sends the initial OpenSecureChannel request and resolves once the server
+   * replies.  Updates `context.channelId` and `context.tokenId` on success
+   * and schedules automatic renewal at 75 % of the token lifetime.
+   */
+  openSecureChannel() {
+    this.logger.debug("Sending OpenSecureChannelRequest (Issue)...");
+    return this.sendOpenSecureChannel(0 /* Issue */);
+  }
+  /**
+   * Cancels any pending token renewal timer and releases the stream writer.
+   * Call this when the secure channel is no longer needed.
+   */
+  close() {
+    if (this.renewalTimer !== void 0) {
+      clearTimeout(this.renewalTimer);
+      this.renewalTimer = void 0;
+    }
+    this.writer.releaseLock();
   }
   // ─── ISecureChannel implementation ─────────────────────────────────────────────
   getSecurityPolicy() {
@@ -17555,14 +17599,20 @@ var SecureChannelFacade = class {
         if (!value) {
           this.logger.error("Received empty frame");
         }
-        const response = value.body;
-        if (response instanceof ServiceFault) {
-          this.pending.failAll(
-            // todo: create a human readable error message based on the ServiceFault content
-            new Error(`ServiceFault: ${JSON.stringify(response)}`)
-          );
+        const requestId = value.sequenceHeader.requestId;
+        if (value.header.msgType === MsgTypeAbort) {
+          const reader = new BinaryReader(value.body);
+          const statusCode = reader.readUInt32();
+          const reason = reader.readString();
+          this.context.chunkBuffers.delete(requestId);
+          this.pending.fail(requestId, new Error(`Abort 0x${statusCode.toString(16).toUpperCase()}: ${reason}`));
         } else {
-          this.pending.settle(value.sequenceHeader.requestId, response);
+          const response = value.body;
+          if (response instanceof ServiceFault) {
+            this.pending.fail(requestId, new Error(`ServiceFault: ${JSON.stringify(response)}`));
+          } else {
+            this.pending.settle(requestId, response);
+          }
         }
       }
     } catch (e) {
@@ -17693,33 +17743,67 @@ var SecurityPolicyNone = class {
 };
 
 // src/secureChannel/secureChannelContext.ts
-var INT32_MAX = 2147483647;
+var SEQ_WRAP_THRESHOLD = 4294967295 - 1024;
+var SEQ_WRAP_START = 1;
 var SecureChannelContext = class {
   constructor(endpointUrl) {
     this.endpointUrl = endpointUrl;
   }
-  sequenceNumber = 0;
-  requestNumber = 1;
+  /**
+   * Next outgoing sequence number. Starts at 1 for non-ECC legacy profiles
+   * per OPC UA Part 6, Section 6.7.2.4.  The value 0 is used only as the
+   * LastSequenceNumber sentinel in the OPN request ("no prior sequence").
+   */
+  sequenceNumber = 1;
+  /** Next outgoing request ID. The value 0 is reserved and must be skipped. */
+  requestId = 1;
   channelId = 0;
   tokenId = 0;
-  maxSendBufferSize = INT32_MAX;
-  maxRecvBufferSize = INT32_MAX;
-  chunkBuffers = [];
+  maxSendBufferSize = 2147483647;
+  maxRecvBufferSize = 2147483647;
+  /** Pending chunk bodies keyed by requestId, for reassembling multi-chunk messages. */
+  chunkBuffers = /* @__PURE__ */ new Map();
   securityAlgorithm;
+  /** Last remote sequence number seen; undefined before the first received message. */
+  lastRemoteSequenceNumber = void 0;
   securityPolicy = new SecurityPolicyNone();
   /**
-   * Atomically increments and returns the next sequence number and request id.
-   * Call once per outgoing message so both counters stay in sync.
+   * Returns the current outgoing sequence number then advances it with
+   * UInt32 wrap-around per OPC UA Part 6, Section 6.7.2.4.  Only advances
+   * the sequence counter — use when creating additional chunks for the same
+   * message (each chunk needs its own sequence number but the same requestId).
+   */
+  nextSequenceNumber() {
+    const seq = this.sequenceNumber;
+    if (this.sequenceNumber >= SEQ_WRAP_THRESHOLD) {
+      this.sequenceNumber = SEQ_WRAP_START;
+    } else {
+      this.sequenceNumber++;
+    }
+    return seq;
+  }
+  /**
+   * Returns the next outgoing sequence number and request ID, then advances
+   * both counters.  Call once per outgoing message; use {@link nextSequenceNumber}
+   * for additional chunks of the same message.
+   *
+   * Handles UInt32 wrap-around per OPC UA Part 6, Section 6.7.2.4:
+   * sequence numbers reset to 1 after reaching 0xFFFFFFFF-1024; request IDs
+   * skip the reserved value 0 on wrap.
    */
   nextIds() {
-    return {
-      sequenceNumber: this.sequenceNumber++,
-      requestId: this.requestNumber++
-    };
+    const result = { sequenceNumber: this.nextSequenceNumber(), requestId: this.requestId };
+    this.requestId++;
+    if (this.requestId === 0) {
+      this.requestId = 1;
+    }
+    return result;
   }
 };
 
 // src/secureChannel/secureChannelMessageDecoder.ts
+var SEQ_WRAP_THRESHOLD2 = 4294967295 - 1024;
+var SEQ_WRAP_MAX = 1024;
 var SecureChannelMessageDecoder = class extends TransformStream {
   constructor(context) {
     super({
@@ -17728,12 +17812,34 @@ var SecureChannelMessageDecoder = class extends TransformStream {
     this.context = context;
   }
   logger = getLogger("secureChannel.SecureChannelMessageDecoder");
+  /**
+   * Validates that `sequenceNumber` is strictly increasing from the last
+   * seen remote sequence.  Allows exactly one UInt32 wrap-around per token.
+   * Returns false and logs an error if the number is a duplicate or out of order.
+   */
+  validateSequenceNumber(sequenceNumber, controller) {
+    const last = this.context.lastRemoteSequenceNumber;
+    if (last === void 0) {
+      this.context.lastRemoteSequenceNumber = sequenceNumber;
+      return true;
+    }
+    const isIncrement = sequenceNumber === last + 1;
+    const isWrap = last >= SEQ_WRAP_THRESHOLD2 && sequenceNumber < SEQ_WRAP_MAX;
+    if (!isIncrement && !isWrap) {
+      this.logger.error(`Invalid remote sequence number: expected ${last + 1}, got ${sequenceNumber}`);
+      controller.error(new Error(`Invalid remote sequence number: expected ${last + 1}, got ${sequenceNumber}`));
+      return false;
+    }
+    this.context.lastRemoteSequenceNumber = sequenceNumber;
+    return true;
+  }
   transform(data, controller) {
     const buffer = new BinaryReader(data);
     const header = MsgHeader2.decode(buffer);
     switch (header.msgType) {
-      case MsgTypeOpenFinal: {
-        this.logger.debug("SecureChannel received OpenFinal message");
+      case MsgTypeOpenFinal:
+      case MsgTypeOpenChunk: {
+        this.logger.debug("SecureChannel received OpenFinal/OpenChunk message");
         const secHeader = MsgSecurityHeaderAsymmetric.decode(buffer);
         const msgAsym = MsgAsymmetric.decode(
           buffer,
@@ -17741,16 +17847,22 @@ var SecureChannelMessageDecoder = class extends TransformStream {
           secHeader,
           this.context.securityAlgorithm
         );
+        if (!this.validateSequenceNumber(msgAsym.sequenceHeader.sequenceNumber, controller)) return;
         controller.enqueue(msgAsym);
         break;
       }
-      case MsgTypeAbort:
-        this.logger.warn("Unimplemented Abort message");
+      case MsgTypeAbort: {
+        this.logger.warn("SecureChannel received Abort message");
+        const secHeader = MsgSecurityHeaderSymmetric.decode(buffer);
+        const msgSym = MsgSymmetric.decode(buffer, header, secHeader, this.context.securityAlgorithm);
+        controller.enqueue(msgSym);
         break;
+      }
       case MsgTypeChunk: {
         this.logger.debug("SecureChannel received Chunk message.");
         const secHeader = MsgSecurityHeaderSymmetric.decode(buffer);
         const msgSym = MsgSymmetric.decode(buffer, header, secHeader, this.context.securityAlgorithm);
+        if (!this.validateSequenceNumber(msgSym.sequenceHeader.sequenceNumber, controller)) return;
         controller.enqueue(msgSym);
         break;
       }
@@ -17758,11 +17870,12 @@ var SecureChannelMessageDecoder = class extends TransformStream {
         this.logger.debug("SecureChannel received Final message");
         const secHeader = MsgSecurityHeaderSymmetric.decode(buffer);
         const msgSym = MsgSymmetric.decode(buffer, header, secHeader, this.context.securityAlgorithm);
+        if (!this.validateSequenceNumber(msgSym.sequenceHeader.sequenceNumber, controller)) return;
         controller.enqueue(msgSym);
         break;
       }
       case MsgTypeCloseFinal:
-        this.logger.warn("Unimplemented  CloseFinal message. ");
+        this.logger.warn("Unimplemented CloseFinal message.");
         break;
       default:
         this.logger.warn("SecureChannel received unknown message type:", header.msgType);
@@ -17772,7 +17885,7 @@ var SecureChannelMessageDecoder = class extends TransformStream {
 };
 
 // src/secureChannel/secureChannelMessageEncoder.ts
-var SecureChannelMesssageEncoder = class extends TransformStream {
+var SecureChannelMessageEncoder = class extends TransformStream {
   constructor(context) {
     super({
       transform(msg, controller) {
@@ -17787,24 +17900,33 @@ var SecureChannelMesssageEncoder = class extends TransformStream {
 // src/secureChannel/secureChannelChunkReader.ts
 var SecureChannelChunkReader = class extends TransformStream {
   logger = getLogger("secureChannel.SecureChannelChunkReader");
-  prependChunk(chunk, body) {
-    const result = new Uint8Array(chunk.byteLength + body.byteLength);
-    result.set(chunk, 0);
-    result.set(body, chunk.byteLength);
-    return result;
-  }
   transform(msg, context, controller) {
+    const requestId = msg.sequenceHeader.requestId;
     switch (msg.header.msgType) {
-      case MsgTypeChunk: {
+      case MsgTypeChunk:
+      case MsgTypeOpenChunk: {
         this.logger.debug("Received Chunk message");
-        context.chunkBuffers.push(msg.body);
+        const chunks = context.chunkBuffers.get(requestId) ?? [];
+        chunks.push(msg.body);
+        context.chunkBuffers.set(requestId, chunks);
         break;
       }
-      case MsgTypeFinal: {
+      case MsgTypeFinal:
+      case MsgTypeOpenFinal: {
         this.logger.debug("Received Final message");
-        while (context.chunkBuffers.length > 0) {
-          const chunk = context.chunkBuffers.pop();
-          msg.body = this.prependChunk(chunk, msg.body);
+        const chunks = context.chunkBuffers.get(requestId);
+        if (chunks && chunks.length > 0) {
+          const finalBody = msg.body;
+          const totalLength = chunks.reduce((sum, c) => sum + c.byteLength, 0) + finalBody.byteLength;
+          const assembled = new Uint8Array(totalLength);
+          let offset = 0;
+          for (const chunk of chunks) {
+            assembled.set(chunk, offset);
+            offset += chunk.byteLength;
+          }
+          assembled.set(finalBody, offset);
+          msg.body = assembled;
+          context.chunkBuffers.delete(requestId);
         }
         controller.enqueue(msg);
         break;
@@ -17838,29 +17960,39 @@ var SecureChannelChunkWriter = class extends TransformStream {
           this.logger.debug("Received Final message");
           const securityAlgorithm = this.context.securityAlgorithm;
           const maxCipherTextSize = this.context.maxSendBufferSize - MsgHeader2.Size - MsgSecurityHeaderSymmetric.Size;
-          const maxPlainTextSize = maxCipherTextSize / securityAlgorithm.GetEncryptedSize(maxCipherTextSize);
-          const maxPayloadSize = maxPlainTextSize - securityAlgorithm.GetSignatureLength() - 1 - MsgSecurityHeaderSymmetric.Size + (securityAlgorithm.IsAuthenticated() ? 1 : 0);
+          const maxPayloadSize = securityAlgorithm.GetMaxPayload(maxCipherTextSize) - MsgSequenceHeader.Size;
           const data = msgSymmetric.body;
-          const chunkCount = data.byteLength / maxPayloadSize;
-          if (chunkCount > 1) {
-            this.logger.debug(`Message body exceeds max chunk size, splitting into ${chunkCount} chunks.`);
-            for (let i = 0; i < chunkCount; i++) {
+          const numChunks = Math.ceil(data.byteLength / maxPayloadSize);
+          if (numChunks > 1) {
+            this.logger.debug(`Message body exceeds max chunk size, splitting into ${numChunks} chunks.`);
+            for (let i = 0; i < numChunks - 1; i++) {
               const chunkMsg = new MsgSymmetric(
-                new MsgHeader2(MsgTypeChunk, -1, msgSymmetric.header.secureChannelId),
+                // messageSize=0 is a placeholder: MsgBase.Encrypt() overwrites it at byte offset 4
+                // with the actual encrypted size before writing to the wire.
+                new MsgHeader2(MsgTypeChunk, 0, msgSymmetric.header.secureChannelId),
                 msgSymmetric.securityHeader,
-                msgSymmetric.sequenceHeader,
+                new MsgSequenceHeader(
+                  this.context.nextSequenceNumber(),
+                  msgSymmetric.sequenceHeader.requestId
+                ),
                 data.subarray(i * maxPayloadSize, (i + 1) * maxPayloadSize)
               );
-              this.logger.trace(`Enqueuing chunk ${i + 1}/${chunkCount} with size ${chunkMsg.body.byteLength} bytes.`);
+              this.logger.trace(
+                `Enqueuing chunk ${i + 1}/${numChunks} with size ${chunkMsg.body.byteLength} bytes.`
+              );
               controller.enqueue(chunkMsg);
             }
-            msg.body = data.subarray(chunkCount * maxPayloadSize);
+            msg.sequenceHeader = new MsgSequenceHeader(
+              this.context.nextSequenceNumber(),
+              msgSymmetric.sequenceHeader.requestId
+            );
+            msg.body = data.subarray((numChunks - 1) * maxPayloadSize);
           }
           break;
         }
       }
     }
-    this.logger.trace(`Enqueuing message default message with body size ${msg.body.byteLength} bytes.`);
+    this.logger.trace(`Enqueuing final message with body size ${msg.body.byteLength} bytes.`);
     controller.enqueue(msg);
   }
 };
@@ -18203,7 +18335,7 @@ exports.SecureChannelChunkWriter = SecureChannelChunkWriter;
 exports.SecureChannelContext = SecureChannelContext;
 exports.SecureChannelFacade = SecureChannelFacade;
 exports.SecureChannelMessageDecoder = SecureChannelMessageDecoder;
-exports.SecureChannelMesssageEncoder = SecureChannelMesssageEncoder;
+exports.SecureChannelMessageEncoder = SecureChannelMessageEncoder;
 exports.SecureChannelTypeDecoder = SecureChannelTypeDecoder;
 exports.SecureChannelTypeEncoder = SecureChannelTypeEncoder;
 exports.SecurityGroupDataType = SecurityGroupDataType;