opcjs-base 0.1.37-alpha → 0.1.39-alpha

package/dist/index.d.cts

@@ -8281,9 +8281,13 @@ declare class SecureChannelMessageDecoder extends TransformStream<Uint8Array, Ms
     private context;
     private logger;
     /**
-     * Validates that `sequenceNumber` is strictly increasing from the last
+     * Validates that `sequenceNumber` is monotonically increasing from the last
      * seen remote sequence.  Allows exactly one UInt32 wrap-around per token.
-     * Returns false and logs an error if the number is a duplicate or out of order.
+     *
+     * Forward gaps are tolerated with a warning because some server implementations
+     * may consume sequence numbers internally (e.g. cancelled responses) without
+     * sending them on the wire.  Backward jumps and duplicates are rejected as
+     * errors since they indicate replay or reordering.
      */
     private validateSequenceNumber;
     private transform;

package/dist/index.d.ts

@@ -8281,9 +8281,13 @@ declare class SecureChannelMessageDecoder extends TransformStream<Uint8Array, Ms
     private context;
     private logger;
     /**
-     * Validates that `sequenceNumber` is strictly increasing from the last
+     * Validates that `sequenceNumber` is monotonically increasing from the last
      * seen remote sequence.  Allows exactly one UInt32 wrap-around per token.
-     * Returns false and logs an error if the number is a duplicate or out of order.
+     *
+     * Forward gaps are tolerated with a warning because some server implementations
+     * may consume sequence numbers internally (e.g. cancelled responses) without
+     * sending them on the wire.  Backward jumps and duplicates are rejected as
+     * errors since they indicate replay or reordering.
      */
     private validateSequenceNumber;
     private transform;

package/dist/index.js

@@ -17868,23 +17868,33 @@ var SecureChannelMessageDecoder = class extends TransformStream {
   }
   logger = getLogger("secureChannel.SecureChannelMessageDecoder");
   /**
-   * Validates that `sequenceNumber` is strictly increasing from the last
+   * Validates that `sequenceNumber` is monotonically increasing from the last
    * seen remote sequence.  Allows exactly one UInt32 wrap-around per token.
-   * Returns false and logs an error if the number is a duplicate or out of order.
+   *
+   * Forward gaps are tolerated with a warning because some server implementations
+   * may consume sequence numbers internally (e.g. cancelled responses) without
+   * sending them on the wire.  Backward jumps and duplicates are rejected as
+   * errors since they indicate replay or reordering.
    */
-  validateSequenceNumber(sequenceNumber, controller) {
+  validateSequenceNumber(sequenceNumber, msgType, controller) {
     const last = this.context.lastRemoteSequenceNumber;
     if (last === void 0) {
       this.context.lastRemoteSequenceNumber = sequenceNumber;
+      this.logger.debug(`[${msgType}] Sequence number initialized to ${sequenceNumber}`);
       return true;
     }
-    const isIncrement = sequenceNumber === last + 1;
     const isWrap = last >= SEQ_WRAP_THRESHOLD2 && sequenceNumber < SEQ_WRAP_MAX;
-    if (!isIncrement && !isWrap) {
-      this.logger.error(`Invalid remote sequence number: expected ${last + 1}, got ${sequenceNumber}`);
-      controller.error(new Error(`Invalid remote sequence number: expected ${last + 1}, got ${sequenceNumber}`));
+    const isForward = sequenceNumber > last;
+    if (!isForward && !isWrap) {
+      this.logger.error(`[${msgType}] Invalid remote sequence number: expected > ${last}, got ${sequenceNumber}`);
+      controller.error(new Error(`Invalid remote sequence number: expected > ${last}, got ${sequenceNumber}`));
       return false;
     }
+    if (sequenceNumber !== last + 1 && !isWrap) {
+      this.logger.warn(`[${msgType}] Remote sequence number gap: expected ${last + 1}, got ${sequenceNumber} (skipped ${sequenceNumber - last - 1})`);
+    } else {
+      this.logger.debug(`[${msgType}] Sequence number advanced: ${last} \u2192 ${sequenceNumber}`);
+    }
     this.context.lastRemoteSequenceNumber = sequenceNumber;
     return true;
   }
@@ -17902,8 +17912,7 @@ var SecureChannelMessageDecoder = class extends TransformStream {
           secHeader,
           this.context.securityAlgorithm
         );
-        this.context.lastRemoteSequenceNumber = void 0;
-        if (!this.validateSequenceNumber(msgAsym.sequenceHeader.sequenceNumber, controller)) return;
+        if (!this.validateSequenceNumber(msgAsym.sequenceHeader.sequenceNumber, "OPN", controller)) return;
         controller.enqueue(msgAsym);
         break;
       }
@@ -17911,7 +17920,7 @@ var SecureChannelMessageDecoder = class extends TransformStream {
         this.logger.warn("SecureChannel received Abort message");
         const secHeader = MsgSecurityHeaderSymmetric.decode(buffer);
         const msgSym = MsgSymmetric.decode(buffer, header, secHeader, this.context.securityAlgorithm);
-        if (!this.validateSequenceNumber(msgSym.sequenceHeader.sequenceNumber, controller)) return;
+        if (!this.validateSequenceNumber(msgSym.sequenceHeader.sequenceNumber, "MSG-A", controller)) return;
         controller.enqueue(msgSym);
         break;
       }
@@ -17919,7 +17928,7 @@ var SecureChannelMessageDecoder = class extends TransformStream {
         this.logger.debug("SecureChannel received Chunk message.");
         const secHeader = MsgSecurityHeaderSymmetric.decode(buffer);
         const msgSym = MsgSymmetric.decode(buffer, header, secHeader, this.context.securityAlgorithm);
-        if (!this.validateSequenceNumber(msgSym.sequenceHeader.sequenceNumber, controller)) return;
+        if (!this.validateSequenceNumber(msgSym.sequenceHeader.sequenceNumber, "MSG-C", controller)) return;
         controller.enqueue(msgSym);
         break;
       }
@@ -17927,7 +17936,7 @@ var SecureChannelMessageDecoder = class extends TransformStream {
         this.logger.debug("SecureChannel received Final message");
         const secHeader = MsgSecurityHeaderSymmetric.decode(buffer);
         const msgSym = MsgSymmetric.decode(buffer, header, secHeader, this.context.securityAlgorithm);
-        if (!this.validateSequenceNumber(msgSym.sequenceHeader.sequenceNumber, controller)) return;
+        if (!this.validateSequenceNumber(msgSym.sequenceHeader.sequenceNumber, "MSG-F", controller)) return;
         controller.enqueue(msgSym);
         break;
       }
@@ -17935,7 +17944,7 @@ var SecureChannelMessageDecoder = class extends TransformStream {
         this.logger.warn("SecureChannel received CloseFinal message.");
         const secHeader = MsgSecurityHeaderSymmetric.decode(buffer);
         const msgSym = MsgSymmetric.decode(buffer, header, secHeader, this.context.securityAlgorithm);
-        this.validateSequenceNumber(msgSym.sequenceHeader.sequenceNumber, controller);
+        this.validateSequenceNumber(msgSym.sequenceHeader.sequenceNumber, "CLO-F", controller);
         break;
       }
       default: