major [Data Integrity & Integration]
→ ]8;;vscode://file//work/apps/alp-fusion/src/protocol/messages.ts:64apps/alp-fusion/src/protocol/messages.ts:64-74]8;;

Preserve uint64 values exactly.

Type.create and Type.verify do not convert decimal strings or
bigint. Convert payloads with Type.fromObject, reject unsafe number
values, and define a lossless contract using bigint, Long, or decimal
strings. Add a round-trip test above 2^53 - 1.

minor [Functional Correctness]
→ ]8;;vscode://file//work/apps/alp-fusion/src/protocol/messages.ts:101apps/alp-fusion/src/protocol/messages.ts:101-104]8;;

Validate direct encoder payloads before encoding.

Type.create and Type.encode do not validate required fields. Call
Type.verify before Type.create in encodeComponent and
encodeInitialCommitment, as encodeMessage does.

major [Functional Correctness]
→ ]8;;vscode://file//work/apps/alp-fusion/src/protocol/messages.ts:64apps/alp-fusion/src/protocol/messages.ts:64-74]8;;

Validate oneofField before encoding.

If oneofField is unknown, Type.create accepts it and Type.verify
ignores the unknown property. Type.encode then emits an empty envelope
instead of reporting the invalid message type.


Proposed fix

 export function encodeMessage(
     Type: protobuf.Type,
     oneofField: string,
     payload: Record<string, unknown>,
 ): Buffer {
-    const msg = Type.create({ msg: oneofField, [oneofField]: payload });
-    const err = Type.verify(msg);
+    const oneof = Type.oneofs.msg;
+    if (!oneof?.oneof.includes(oneofField)) {
+        throw new Error(`Unsupported message field: ${oneofField}`);
+    }
+    const value = { [oneofField]: payload };
+    const err = Type.verify(value);
     if (err) {
         throw new Error(String(err));
     }
+    const msg = Type.create(value);
     return Buffer.from(Type.encode(msg).finish());
 }

minor [Stability & Availability]
→ ]8;;vscode://file//work/apps/alp-fusion/test/protocol/messages.test.ts:210apps/alp-fusion/test/protocol/messages.test.ts:210-253]8;;

Close the client connection in finally.

client.close() runs at Line 249 inside the try block. If any assertion
above it fails, the socket stays open. The mocha process then holds an
open handle after the failure.

Move the close into the finally block.





🧹 Proposed cleanup

         const serverConns: FusionConnection[] = [];
         const { port, close } = await listen('127.0.0.1', 0, conn => {
             serverConns.push(conn);
         });
+        let client: FusionConnection | undefined;
         try {
-            const client = await connect('127.0.0.1', port);
+            client = await connect('127.0.0.1', port);
@@
             expect(reply.payload.atomTiers).to.deep.equal([1000n]);
-
-            client.close();
         } finally {
+            client?.close();
             await close();
         }

minor [Data Integrity & Integration]
→ ]8;;vscode://file//work/apps/alp-fusion/src/protocol/messages.ts:67apps/alp-fusion/src/protocol/messages.ts:67-95]8;;

Range-check bigint inputs for 64-bit fields.

assertSafeNumbers validates number only. A bigint passes unchecked.
protobufjs then reduces the value to 64 bits, so -1n encodes as
18446744073709551615 and values above 2^64-1 truncate. Both cases
produce a valid frame with a wrong amount for sats, token_atoms,
excess_fee, and atom_tier.

Reject out-of-range bigint values in the same guard.





🛡️ Proposed range check

 function assertSafeNumbers(value: unknown, path = ''): void {
+    if (typeof value === 'bigint') {
+        if (value < 0n || value > 0xffffffffffffffffn) {
+            throw new Error(
+                `Out-of-range bigint${path ? ` at ${path}` : ''}: ` +
+                    'uint64/fixed64 fields accept 0 .. 2^64-1',
+            );
+        }
+        return;
+    }
     if (typeof value === 'number') {
         if (!Number.isSafeInteger(value)) {

major [Data Integrity & Integration]
→ ]8;;vscode://file//work/apps/alp-fusion/src/protocol/messages.ts:235apps/alp-fusion/src/protocol/messages.ts:235-254]8;;

Enforce required fields on the decode path.

The decode functions receive bytes from a remote peer. Type.decode does
not reject missing proto2 required fields, as the comment on lines
107-108 already states. A peer can omit ClientHello.version,
Component.salt_commitment, or InitialCommitment.sats_commitment, and
the decoded payload then carries defaults such as empty bytes or 0.
Downstream round logic cannot distinguish that from a legitimate value.

Apply assertRequiredFields after every decode, and validate the nested
payload of the oneof wrapper against its resolved type.





🛡️ Proposed fix for the decode paths

     const payload = (msg as unknown as Record<string, unknown>)[field] as
         | Record<string, unknown>
         | undefined;
     if (!payload) {
         throw new Error(`Missing payload for ${field}`);
     }
+    const nested = Type.fields[field]?.resolvedType;
+    if (nested instanceof protobuf.Type) {
+        assertRequiredFields(nested, payload, `${Type.name}.${field}`);
+    }
     return {
         field,
         payload: longsToBigInt(payload) as Record<string, unknown>,
     };
 }

 export function decodeComponent(buf: Buffer): Record<string, unknown> {
     const Type = requireProto().lookupType('alpfusion.Component');
-    return longsToBigInt(Type.decode(buf)) as Record<string, unknown>;
+    const msg = Type.decode(buf);
+    assertRequiredFields(Type, msg);
+    return longsToBigInt(msg) as Record<string, unknown>;
 }

 export function decodeInitialCommitment(buf: Buffer): Record<string, unknown> {
     const Type = requireProto().lookupType('alpfusion.InitialCommitment');
-    return longsToBigInt(Type.decode(buf)) as Record<string, unknown>;
+    const msg = Type.decode(buf);
+    assertRequiredFields(Type, msg);
+    return longsToBigInt(msg) as Record<string, unknown>;
 }

Also applies to: 274-277, 299-302

minor [Data Integrity & Integration]
→ ]8;;vscode://file//work/apps/alp-fusion/test/protocol/messages.test.ts:147apps/alp-fusion/test/protocol/messages.test.ts:147-153]8;;

Assert the decoded version bytes, and confirm the type of
PROTOCOL_VERSION.

ClientHello.version is required bytes. If PROTOCOL_VERSION is a
string, Type.fromObject base64-decodes it, and the encoded bytes then
differ from the intended value. This test asserts only decoded.field, so
that corruption stays invisible. Add a byte-level assertion, and confirm
that PROTOCOL_VERSION in src/protocol/constants.js is a Uint8Array
or Buffer.





💚 Proposed assertion

         const decoded = decodeMessage(types.ClientMessage, hello);
         expect(decoded.field).to.equal('clienthello');
+        expect(
+            Buffer.from(decoded.payload.version as Uint8Array).equals(
+                Buffer.from(PROTOCOL_VERSION),
+            ),
+        ).to.equal(true);

minor [Data Integrity & Integration]
→ ]8;;vscode://file//work/apps/alp-fusion/src/protocol/messages.ts:186apps/alp-fusion/src/protocol/messages.ts:186-222]8;;

Guard the decode fallback

If protobuf.util.Long is unavailable, protobufjs uses toNumber() for
64-bit fields. longsToBigInt leaves that number unchanged. Values above
Number.MAX_SAFE_INTEGER can lose precision and remain number. Ensure
Long is configured before decoding, or reject unsafe numeric results.

major [Data Integrity & Integration]
→ ]8;;vscode://file//work/apps/alp-fusion/src/protocol/messages.ts:82apps/alp-fusion/src/protocol/messages.ts:82-90]8;;

Reject negative plain numbers for unsigned fields.

Type.verify accepts negative integers for uint32, uint64, and
fixed64. protobufjs encodes sats: -1 as 18446744073709551615. Add
a value < 0 check in the number branch.

minor [Data Integrity & Integration]
→ ]8;;vscode://file//work/apps/alp-fusion/src/protocol/messages.ts:88apps/alp-fusion/src/protocol/messages.ts:88-141]8;;

Handle a repeated field that receives a non-array value.

At Line 103 the branch requires field.repeated && Array.isArray(child).
If a caller passes a scalar for a repeated uint64 field, for example
atomTiers: 5n, the code falls through to Line 124 and passes the
bigint check, so validation reports no error. fromObject then ignores
or mishandles the value. The same gap exists at Line 196 for repeated
message fields. Reject a non-array value for a repeated field explicitly.


🛡️ Reject non-array values for repeated fields

         const child = obj[field.name];
         const childPath = `${path}.${field.name}`;
-        if (field.repeated && Array.isArray(child)) {
+        if (field.repeated) {
+            if (!Array.isArray(child)) {
+                throw new Error(`${childPath}: expected array for repeated field`);
+            }
             for (let i = 0; i < child.length; i++) {

Also applies to: 149-217

minor [Stability & Availability]
→ ]8;;vscode://file//work/apps/alp-fusion/test/protocol/messages.test.ts:343apps/alp-fusion/test/protocol/messages.test.ts:343-346]8;;

Close the accepted server connections.

The finally block closes the client and the listener. It leaves the
accepted connection in serverConns open. If close() only stops
accepting, that socket keeps a handle alive and can delay mocha exit.





🧹 Proposed cleanup

         } finally {
             client?.close();
+            for (const conn of serverConns) {
+                conn.close();
+            }
             await close();
         }

critical [Functional Correctness]
→ ]8;;vscode://file//work/apps/alp-fusion/src/protocol/messages.ts:204apps/alp-fusion/src/protocol/messages.ts:204-222]8;;

Apply the same narrowing fix here.

child on Line 204 has type unknown. The compound guard on Line 205
does not narrow it, so child.length on Line 211 and child[i] on Line
212 fail to compile for the same reason as in assertUint64Fields.





🐛 Proposed fix for the narrowing

         const child = (msg as Record<string, unknown>)[field.name];
-        if (field.repeated && !Array.isArray(child)) {
-            throw new Error(
-                `${path}.${field.name}: expected array for repeated field`,
-            );
-        }
         if (field.repeated) {
+            if (!Array.isArray(child)) {
+                throw new Error(
+                    `${path}.${field.name}: expected array for repeated field`,
+                );
+            }
             for (let i = 0; i < child.length; i++) {
-                const item = child[i];
+                const item: unknown = child[i];

critical [Functional Correctness]
→ ]8;;vscode://file//work/apps/alp-fusion/src/protocol/messages.ts:107apps/alp-fusion/src/protocol/messages.ts:107-132]8;;

child stays unknown, so tsc fails on child.length and child[i].

child has type unknown. The guard on Line 109 uses the compound
condition field.repeated && !Array.isArray(child). TypeScript does not
narrow child after that statement, because the negated condition is not
a type guard on child alone. child.length on Line 113 and child[i]
on Line 114 then fail to compile.

The unit tests do not catch this. pnpm test runs mocha --import=tsx,
which strips types without checking them. Only pnpm build fails.

Move the Array.isArray check inside the field.repeated branch so the
narrowing applies.





🐛 Proposed fix for the narrowing

-        if (field.repeated && !Array.isArray(child)) {
-            throw new Error(`${childPath}: expected array for repeated field`);
-        }
         if (field.repeated) {
+            if (!Array.isArray(child)) {
+                throw new Error(
+                    `${childPath}: expected array for repeated field`,
+                );
+            }
             for (let i = 0; i < child.length; i++) {
-                const item = child[i];
+                const item: unknown = child[i];
                 const itemPath = `${childPath}[${i}]`;