@corewire/core 0.0.0 → 1.0.0-next.2

package/dist/pairing.mjs

@@ -0,0 +1,2487 @@
+import { r as __require, t as __commonJSMin } from "./chunk-wE0WeVzl.mjs";
+import { f as PairingError, n as AuthenticationError } from "./errors-DVv1n4fL.mjs";
+import { a as generateKeyPair, f as decrypt$1, g as encrypt, h as decrypt, l as generateKeyPair$1, n as deriveEncryptionKeys, o as sign, p as encrypt$1, s as verify, t as derive, u as generateSharedSecKey } from "./crypto-CXSIS6si.mjs";
+import { a as Value, c as encode, d as encode$1, i as State, n as Flags, o as bail, r as Method, s as decode } from "./encoding-BaLbwFQ0.mjs";
+import { a as DEFAULT_CLIENT_NAME } from "./transport-C4BMdD2J.mjs";
+import { randomBytes, randomUUID } from "node:crypto";
+
+//#region src/pairing/cipher.ts
+/** HKDF-SHA512 with string salt and info, as every HAP pairing key uses. */
+function deriveKey(key, salt, info, length = 32) {
+	return derive({
+		hash: "sha512",
+		key,
+		length,
+		salt: Buffer.from(salt),
+		info: Buffer.from(info)
+	});
+}
+/**
+* ChaCha20-Poly1305 with the session key and an 8-byte message nonce ("PS-Msg05"), the auth tag
+* appended. Legacy devices use AES-128-CTR instead, keyed from the shared secret; the nonce then
+* plays no part.
+*/
+function pairingCipher(phase, sharedSecret, sessionKey, useAes) {
+	if (useAes) {
+		const key = deriveKey(sharedSecret, "", `${phase}-AES-Key`, 16);
+		const iv = deriveKey(sharedSecret, "", `${phase}-AES-IV`, 16);
+		return {
+			seal: (_, plaintext) => encrypt(key, iv, plaintext),
+			open: (_, sealed) => decrypt(key, iv, sealed)
+		};
+	}
+	return {
+		seal: (nonce, plaintext) => {
+			const { authTag, ciphertext } = encrypt$1(sessionKey, Buffer.from(nonce), null, plaintext);
+			return Buffer.concat([ciphertext, authTag]);
+		},
+		open: (nonce, sealed) => decrypt$1(sessionKey, Buffer.from(nonce), null, sealed.subarray(0, -16), sealed.subarray(-16))
+	};
+}
+/** The HAP channel keys, named from the controller's side: we decrypt with `Control-Read-Encryption-Key`. */
+function deriveControlKeys(sharedSecret) {
+	const { readKey, writeKey } = deriveEncryptionKeys(sharedSecret, "Control-Salt", "Control-Read-Encryption-Key", "Control-Write-Encryption-Key");
+	return {
+		accessoryToControllerKey: readKey,
+		controllerToAccessoryKey: writeKey
+	};
+}
+/** Decodes a TLV8 message and throws the accessory's error when it carries one. */
+function decodeTlv(context, buffer) {
+	const data = decode(buffer);
+	if (data.has(Value.Error)) bail(data);
+	context.logger.raw("Decoded TLV", data);
+	return data;
+}
+
+//#endregion
+//#region ../../node_modules/.bun/fast-srp-hap@2.0.4/node_modules/fast-srp-hap/jsbn/jsbn.js
+var require_jsbn = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	var crypt = __require("crypto");
+	var dbits;
+	function BigInteger(a, b) {
+		if (a != null) if ("number" == typeof a) this.fromNumber(a, b);
+		else if (Buffer.isBuffer(a)) this.fromBuffer(a);
+		else if (b == null && "string" != typeof a) this.fromByteArray(a);
+		else this.fromString(a, b);
+	}
+	function nbi() {
+		return new BigInteger(null);
+	}
+	function am3(i, x, w, j, c, n) {
+		var xl = x & 16383, xh = x >> 14;
+		while (--n >= 0) {
+			var l = this[i] & 16383;
+			var h = this[i++] >> 14;
+			var m = xh * l + h * xl;
+			l = xl * l + ((m & 16383) << 14) + w[j] + c;
+			c = (l >> 28) + (m >> 14) + xh * h;
+			w[j++] = l & 268435455;
+		}
+		return c;
+	}
+	BigInteger.prototype.am = am3;
+	dbits = 28;
+	BigInteger.prototype.DB = dbits;
+	BigInteger.prototype.DM = (1 << dbits) - 1;
+	BigInteger.prototype.DV = 1 << dbits;
+	var BI_FP = 52;
+	BigInteger.prototype.FV = Math.pow(2, BI_FP);
+	BigInteger.prototype.F1 = BI_FP - dbits;
+	BigInteger.prototype.F2 = 2 * dbits - BI_FP;
+	var BI_RM = "0123456789abcdefghijklmnopqrstuvwxyz";
+	var BI_RC = new Array();
+	var rr = "0".charCodeAt(0), vv;
+	for (vv = 0; vv <= 9; ++vv) BI_RC[rr++] = vv;
+	rr = "a".charCodeAt(0);
+	for (vv = 10; vv < 36; ++vv) BI_RC[rr++] = vv;
+	rr = "A".charCodeAt(0);
+	for (vv = 10; vv < 36; ++vv) BI_RC[rr++] = vv;
+	function int2char(n) {
+		return BI_RM.charAt(n);
+	}
+	function intAt(s, i) {
+		var c = BI_RC[s.charCodeAt(i)];
+		return c == null ? -1 : c;
+	}
+	function bnpCopyTo(r) {
+		for (var i = this.t - 1; i >= 0; --i) r[i] = this[i];
+		r.t = this.t;
+		r.s = this.s;
+	}
+	function bnpFromInt(x) {
+		this.t = 1;
+		this.s = x < 0 ? -1 : 0;
+		if (x > 0) this[0] = x;
+		else if (x < -1) this[0] = x + DV;
+		else this.t = 0;
+	}
+	function nbv(i) {
+		var r = nbi();
+		r.fromInt(i);
+		return r;
+	}
+	function bnpFromString(data, radix, unsigned) {
+		var k;
+		switch (radix) {
+			case 2:
+				k = 1;
+				break;
+			case 4:
+				k = 2;
+				break;
+			case 8:
+				k = 3;
+				break;
+			case 16:
+				k = 4;
+				break;
+			case 32:
+				k = 5;
+				break;
+			case 256:
+				k = 8;
+				break;
+			default:
+				this.fromRadix(data, radix);
+				return;
+		}
+		this.t = 0;
+		this.s = 0;
+		var i = data.length;
+		var mi = false;
+		var sh = 0;
+		while (--i >= 0) {
+			var x = k == 8 ? data[i] & 255 : intAt(data, i);
+			if (x < 0) {
+				if (data.charAt(i) == "-") mi = true;
+				continue;
+			}
+			mi = false;
+			if (sh === 0) this[this.t++] = x;
+			else if (sh + k > this.DB) {
+				this[this.t - 1] |= (x & (1 << this.DB - sh) - 1) << sh;
+				this[this.t++] = x >> this.DB - sh;
+			} else this[this.t - 1] |= x << sh;
+			sh += k;
+			if (sh >= this.DB) sh -= this.DB;
+		}
+		if (!unsigned && k == 8 && (data[0] & 128) != 0) {
+			this.s = -1;
+			if (sh > 0) this[this.t - 1] |= (1 << this.DB - sh) - 1 << sh;
+		}
+		this.clamp();
+		if (mi) BigInteger.ZERO.subTo(this, this);
+	}
+	function bnpFromByteArray(a, unsigned) {
+		this.fromString(a, 256, unsigned);
+	}
+	function bnpFromBuffer(a) {
+		this.fromString(a, 256, true);
+	}
+	function bnpClamp() {
+		var c = this.s & this.DM;
+		while (this.t > 0 && this[this.t - 1] == c) --this.t;
+	}
+	function bnToString(b) {
+		if (this.s < 0) return "-" + this.negate().toString(b);
+		var k;
+		if (b == 16) k = 4;
+		else if (b == 8) k = 3;
+		else if (b == 2) k = 1;
+		else if (b == 32) k = 5;
+		else if (b == 4) k = 2;
+		else return this.toRadix(b);
+		var km = (1 << k) - 1, d, m = false, r = "", i = this.t;
+		var p = this.DB - i * this.DB % k;
+		if (i-- > 0) {
+			if (p < this.DB && (d = this[i] >> p) > 0) {
+				m = true;
+				r = int2char(d);
+			}
+			while (i >= 0) {
+				if (p < k) {
+					d = (this[i] & (1 << p) - 1) << k - p;
+					d |= this[--i] >> (p += this.DB - k);
+				} else {
+					d = this[i] >> (p -= k) & km;
+					if (p <= 0) {
+						p += this.DB;
+						--i;
+					}
+				}
+				if (d > 0) m = true;
+				if (m) r += int2char(d);
+			}
+		}
+		//! Fix to be compatible with node >0.12.7 Buffer.js
+		if (b == 16 && r.length % 2 != 0) r = "0" + r;
+		return m ? r : "0";
+	}
+	function bnNegate() {
+		var r = nbi();
+		BigInteger.ZERO.subTo(this, r);
+		return r;
+	}
+	function bnAbs() {
+		return this.s < 0 ? this.negate() : this;
+	}
+	function bnCompareTo(a) {
+		var r = this.s - a.s;
+		if (r != 0) return r;
+		var i = this.t;
+		r = i - a.t;
+		if (r != 0) return this.s < 0 ? -r : r;
+		while (--i >= 0) if ((r = this[i] - a[i]) != 0) return r;
+		return 0;
+	}
+	function bnEqual(a) {
+		console.log(this.compareTo(a));
+		return this.compareTo(a) == 0 ? true : false;
+	}
+	function bnGreater(a) {
+		return this.compareTo(a) > 0 ? true : false;
+	}
+	function bnGreaterOrEqual(a) {
+		return this.compareTo(a) >= 0 ? true : false;
+	}
+	function bnLesser(a) {
+		return this.compareTo(a) < 0 ? true : false;
+	}
+	function bnLesserOrEqual(a) {
+		return this.compareTo(a) <= 0 ? true : false;
+	}
+	function nbits(x) {
+		var r = 1, t;
+		if ((t = x >>> 16) != 0) {
+			x = t;
+			r += 16;
+		}
+		if ((t = x >> 8) != 0) {
+			x = t;
+			r += 8;
+		}
+		if ((t = x >> 4) != 0) {
+			x = t;
+			r += 4;
+		}
+		if ((t = x >> 2) != 0) {
+			x = t;
+			r += 2;
+		}
+		if ((t = x >> 1) != 0) {
+			x = t;
+			r += 1;
+		}
+		return r;
+	}
+	function bnBitLength() {
+		if (this.t <= 0) return 0;
+		return this.DB * (this.t - 1) + nbits(this[this.t - 1] ^ this.s & this.DM);
+	}
+	function bnpDLShiftTo(n, r) {
+		var i;
+		for (i = this.t - 1; i >= 0; --i) r[i + n] = this[i];
+		for (i = n - 1; i >= 0; --i) r[i] = 0;
+		r.t = this.t + n;
+		r.s = this.s;
+	}
+	function bnpDRShiftTo(n, r) {
+		for (var i = n; i < this.t; ++i) r[i - n] = this[i];
+		r.t = Math.max(this.t - n, 0);
+		r.s = this.s;
+	}
+	function bnpLShiftTo(n, r) {
+		var bs = n % this.DB;
+		var cbs = this.DB - bs;
+		var bm = (1 << cbs) - 1;
+		var ds = Math.floor(n / this.DB), c = this.s << bs & this.DM, i;
+		for (i = this.t - 1; i >= 0; --i) {
+			r[i + ds + 1] = this[i] >> cbs | c;
+			c = (this[i] & bm) << bs;
+		}
+		for (i = ds - 1; i >= 0; --i) r[i] = 0;
+		r[ds] = c;
+		r.t = this.t + ds + 1;
+		r.s = this.s;
+		r.clamp();
+	}
+	function bnpRShiftTo(n, r) {
+		r.s = this.s;
+		var ds = Math.floor(n / this.DB);
+		if (ds >= this.t) {
+			r.t = 0;
+			return;
+		}
+		var bs = n % this.DB;
+		var cbs = this.DB - bs;
+		var bm = (1 << bs) - 1;
+		r[0] = this[ds] >> bs;
+		for (var i = ds + 1; i < this.t; ++i) {
+			r[i - ds - 1] |= (this[i] & bm) << cbs;
+			r[i - ds] = this[i] >> bs;
+		}
+		if (bs > 0) r[this.t - ds - 1] |= (this.s & bm) << cbs;
+		r.t = this.t - ds;
+		r.clamp();
+	}
+	function bnpSubTo(a, r) {
+		var i = 0, c = 0, m = Math.min(a.t, this.t);
+		while (i < m) {
+			c += this[i] - a[i];
+			r[i++] = c & this.DM;
+			c >>= this.DB;
+		}
+		if (a.t < this.t) {
+			c -= a.s;
+			while (i < this.t) {
+				c += this[i];
+				r[i++] = c & this.DM;
+				c >>= this.DB;
+			}
+			c += this.s;
+		} else {
+			c += this.s;
+			while (i < a.t) {
+				c -= a[i];
+				r[i++] = c & this.DM;
+				c >>= this.DB;
+			}
+			c -= a.s;
+		}
+		r.s = c < 0 ? -1 : 0;
+		if (c < -1) r[i++] = this.DV + c;
+		else if (c > 0) r[i++] = c;
+		r.t = i;
+		r.clamp();
+	}
+	function bnpMultiplyTo(a, r) {
+		var x = this.abs(), y = a.abs();
+		var i = x.t;
+		r.t = i + y.t;
+		while (--i >= 0) r[i] = 0;
+		for (i = 0; i < y.t; ++i) r[i + x.t] = x.am(0, y[i], r, i, 0, x.t);
+		r.s = 0;
+		r.clamp();
+		if (this.s != a.s) BigInteger.ZERO.subTo(r, r);
+	}
+	function bnpSquareTo(r) {
+		var x = this.abs();
+		var i = r.t = 2 * x.t;
+		while (--i >= 0) r[i] = 0;
+		for (i = 0; i < x.t - 1; ++i) {
+			var c = x.am(i, x[i], r, 2 * i, 0, 1);
+			if ((r[i + x.t] += x.am(i + 1, 2 * x[i], r, 2 * i + 1, c, x.t - i - 1)) >= x.DV) {
+				r[i + x.t] -= x.DV;
+				r[i + x.t + 1] = 1;
+			}
+		}
+		if (r.t > 0) r[r.t - 1] += x.am(i, x[i], r, 2 * i, 0, 1);
+		r.s = 0;
+		r.clamp();
+	}
+	function bnpDivRemTo(m, q, r) {
+		var pm = m.abs();
+		if (pm.t <= 0) return;
+		var pt = this.abs();
+		if (pt.t < pm.t) {
+			if (q != null) q.fromInt(0);
+			if (r != null) this.copyTo(r);
+			return;
+		}
+		if (r == null) r = nbi();
+		var y = nbi(), ts = this.s, ms = m.s;
+		var nsh = this.DB - nbits(pm[pm.t - 1]);
+		if (nsh > 0) {
+			pm.lShiftTo(nsh, y);
+			pt.lShiftTo(nsh, r);
+		} else {
+			pm.copyTo(y);
+			pt.copyTo(r);
+		}
+		var ys = y.t;
+		var y0 = y[ys - 1];
+		if (y0 === 0) return;
+		var yt = y0 * (1 << this.F1) + (ys > 1 ? y[ys - 2] >> this.F2 : 0);
+		var d1 = this.FV / yt, d2 = (1 << this.F1) / yt, e = 1 << this.F2;
+		var i = r.t, j = i - ys, t = q == null ? nbi() : q;
+		y.dlShiftTo(j, t);
+		if (r.compareTo(t) >= 0) {
+			r[r.t++] = 1;
+			r.subTo(t, r);
+		}
+		BigInteger.ONE.dlShiftTo(ys, t);
+		t.subTo(y, y);
+		while (y.t < ys) y[y.t++] = 0;
+		while (--j >= 0) {
+			var qd = r[--i] == y0 ? this.DM : Math.floor(r[i] * d1 + (r[i - 1] + e) * d2);
+			if ((r[i] += y.am(0, qd, r, j, 0, ys)) < qd) {
+				y.dlShiftTo(j, t);
+				r.subTo(t, r);
+				while (r[i] < --qd) r.subTo(t, r);
+			}
+		}
+		if (q != null) {
+			r.drShiftTo(ys, q);
+			if (ts != ms) BigInteger.ZERO.subTo(q, q);
+		}
+		r.t = ys;
+		r.clamp();
+		if (nsh > 0) r.rShiftTo(nsh, r);
+		if (ts < 0) BigInteger.ZERO.subTo(r, r);
+	}
+	function bnMod(a) {
+		var r = nbi();
+		this.abs().divRemTo(a, null, r);
+		if (this.s < 0 && r.compareTo(BigInteger.ZERO) > 0) a.subTo(r, r);
+		return r;
+	}
+	function Classic(m) {
+		this.m = m;
+	}
+	function cConvert(x) {
+		if (x.s < 0 || x.compareTo(this.m) >= 0) return x.mod(this.m);
+		else return x;
+	}
+	function cRevert(x) {
+		return x;
+	}
+	function cReduce(x) {
+		x.divRemTo(this.m, null, x);
+	}
+	function cMulTo(x, y, r) {
+		x.multiplyTo(y, r);
+		this.reduce(r);
+	}
+	function cSqrTo(x, r) {
+		x.squareTo(r);
+		this.reduce(r);
+	}
+	Classic.prototype.convert = cConvert;
+	Classic.prototype.revert = cRevert;
+	Classic.prototype.reduce = cReduce;
+	Classic.prototype.mulTo = cMulTo;
+	Classic.prototype.sqrTo = cSqrTo;
+	function bnpInvDigit() {
+		if (this.t < 1) return 0;
+		var x = this[0];
+		if ((x & 1) === 0) return 0;
+		var y = x & 3;
+		y = y * (2 - (x & 15) * y) & 15;
+		y = y * (2 - (x & 255) * y) & 255;
+		y = y * (2 - ((x & 65535) * y & 65535)) & 65535;
+		y = y * (2 - x * y % this.DV) % this.DV;
+		return y > 0 ? this.DV - y : -y;
+	}
+	function Montgomery(m) {
+		this.m = m;
+		this.mp = m.invDigit();
+		this.mpl = this.mp & 32767;
+		this.mph = this.mp >> 15;
+		this.um = (1 << m.DB - 15) - 1;
+		this.mt2 = 2 * m.t;
+	}
+	function montConvert(x) {
+		var r = nbi();
+		x.abs().dlShiftTo(this.m.t, r);
+		r.divRemTo(this.m, null, r);
+		if (x.s < 0 && r.compareTo(BigInteger.ZERO) > 0) this.m.subTo(r, r);
+		return r;
+	}
+	function montRevert(x) {
+		var r = nbi();
+		x.copyTo(r);
+		this.reduce(r);
+		return r;
+	}
+	function montReduce(x) {
+		while (x.t <= this.mt2) x[x.t++] = 0;
+		for (var i = 0; i < this.m.t; ++i) {
+			var j = x[i] & 32767;
+			var u0 = j * this.mpl + ((j * this.mph + (x[i] >> 15) * this.mpl & this.um) << 15) & x.DM;
+			j = i + this.m.t;
+			x[j] += this.m.am(0, u0, x, i, 0, this.m.t);
+			while (x[j] >= x.DV) {
+				x[j] -= x.DV;
+				x[++j]++;
+			}
+		}
+		x.clamp();
+		x.drShiftTo(this.m.t, x);
+		if (x.compareTo(this.m) >= 0) x.subTo(this.m, x);
+	}
+	function montSqrTo(x, r) {
+		x.squareTo(r);
+		this.reduce(r);
+	}
+	function montMulTo(x, y, r) {
+		x.multiplyTo(y, r);
+		this.reduce(r);
+	}
+	Montgomery.prototype.convert = montConvert;
+	Montgomery.prototype.revert = montRevert;
+	Montgomery.prototype.reduce = montReduce;
+	Montgomery.prototype.mulTo = montMulTo;
+	Montgomery.prototype.sqrTo = montSqrTo;
+	function bnpIsEven() {
+		return (this.t > 0 ? this[0] & 1 : this.s) === 0;
+	}
+	function bnpExp(e, z) {
+		if (e > 4294967295 || e < 1) return BigInteger.ONE;
+		var r = nbi(), r2 = nbi(), g = z.convert(this), i = nbits(e) - 1;
+		g.copyTo(r);
+		while (--i >= 0) {
+			z.sqrTo(r, r2);
+			if ((e & 1 << i) > 0) z.mulTo(r2, g, r);
+			else {
+				var t = r;
+				r = r2;
+				r2 = t;
+			}
+		}
+		return z.revert(r);
+	}
+	function bnModPowInt(e, m) {
+		var z;
+		if (e < 256 || m.isEven()) z = new Classic(m);
+		else z = new Montgomery(m);
+		return this.exp(e, z);
+	}
+	function bnClone() {
+		var r = nbi();
+		this.copyTo(r);
+		return r;
+	}
+	function bnIntValue() {
+		if (this.s < 0) {
+			if (this.t == 1) return this[0] - this.DV;
+			else if (this.t === 0) return -1;
+		} else if (this.t == 1) return this[0];
+		else if (this.t === 0) return 0;
+		return (this[1] & (1 << 32 - this.DB) - 1) << this.DB | this[0];
+	}
+	function bnByteValue() {
+		return this.t == 0 ? this.s : this[0] << 24 >> 24;
+	}
+	function bnShortValue() {
+		return this.t == 0 ? this.s : this[0] << 16 >> 16;
+	}
+	function bnpChunkSize(r) {
+		return Math.floor(Math.LN2 * this.DB / Math.log(r));
+	}
+	function bnSigNum() {
+		if (this.s < 0) return -1;
+		else if (this.t <= 0 || this.t == 1 && this[0] <= 0) return 0;
+		else return 1;
+	}
+	function bnpToRadix(b) {
+		if (b == null) b = 10;
+		if (this.signum() === 0 || b < 2 || b > 36) return "0";
+		var cs = this.chunkSize(b);
+		var a = Math.pow(b, cs);
+		var d = nbv(a), y = nbi(), z = nbi(), r = "";
+		this.divRemTo(d, y, z);
+		while (y.signum() > 0) {
+			r = (a + z.intValue()).toString(b).substr(1) + r;
+			y.divRemTo(d, y, z);
+		}
+		return z.intValue().toString(b) + r;
+	}
+	function bnpFromRadix(s, b) {
+		this.fromInt(0);
+		if (b == null) b = 10;
+		var cs = this.chunkSize(b);
+		var d = Math.pow(b, cs), mi = false, j = 0, w = 0;
+		for (var i = 0; i < s.length; ++i) {
+			var x = intAt(s, i);
+			if (x < 0) {
+				if (s.charAt(i) == "-" && this.signum() === 0) mi = true;
+				continue;
+			}
+			w = b * w + x;
+			if (++j >= cs) {
+				this.dMultiply(d);
+				this.dAddOffset(w, 0);
+				j = 0;
+				w = 0;
+			}
+		}
+		if (j > 0) {
+			this.dMultiply(Math.pow(b, j));
+			this.dAddOffset(w, 0);
+		}
+		if (mi) BigInteger.ZERO.subTo(this, this);
+	}
+	function bnpFromNumber(a, b) {
+		if ("number" == typeof b) if (a < 2) this.fromInt(1);
+		else {
+			this.fromNumber(a);
+			if (!this.testBit(a - 1)) this.bitwiseTo(BigInteger.ONE.shiftLeft(a - 1), op_or, this);
+			if (this.isEven()) this.dAddOffset(1, 0);
+			while (!this.isProbablePrime(b)) {
+				this.dAddOffset(2, 0);
+				if (this.bitLength() > a) this.subTo(BigInteger.ONE.shiftLeft(a - 1), this);
+			}
+		}
+		else {
+			var x = crypt.randomBytes((a >> 3) + 1);
+			var t = a & 7;
+			if (t > 0) x[0] &= (1 << t) - 1;
+			else x[0] = 0;
+			this.fromByteArray(x);
+		}
+	}
+	function bnToByteArray() {
+		var i = this.t, r = new Array();
+		r[0] = this.s;
+		var p = this.DB - i * this.DB % 8, d, k = 0;
+		if (i-- > 0) {
+			if (p < this.DB && (d = this[i] >> p) != (this.s & this.DM) >> p) r[k++] = d | this.s << this.DB - p;
+			while (i >= 0) {
+				if (p < 8) {
+					d = (this[i] & (1 << p) - 1) << 8 - p;
+					d |= this[--i] >> (p += this.DB - 8);
+				} else {
+					d = this[i] >> (p -= 8) & 255;
+					if (p <= 0) {
+						p += this.DB;
+						--i;
+					}
+				}
+				if ((d & 128) != 0) d |= -256;
+				if (k === 0 && (this.s & 128) != (d & 128)) ++k;
+				if (k > 0 || d != this.s) r[k++] = d;
+			}
+		}
+		return r;
+	}
+	/**
+	* return Buffer object
+	* @param trim {boolean} slice buffer if first element == 0
+	* @returns {Buffer}
+	*/
+	function bnToBuffer(trimOrSize) {
+		var res = Buffer.from(this.toByteArray());
+		if (trimOrSize === true && res[0] === 0) res = res.slice(1);
+		else if (typeof trimOrSize == "number") {
+			if (res.length > trimOrSize) {
+				for (var i = 0; i < res.length - trimOrSize; i++) if (res[i] !== 0) return null;
+				return res.slice(res.length - trimOrSize);
+			} else if (res.length < trimOrSize) {
+				var padded = Buffer.alloc(trimOrSize);
+				padded.fill(0, 0, trimOrSize - res.length);
+				res.copy(padded, trimOrSize - res.length);
+				return padded;
+			}
+		}
+		return res;
+	}
+	function bnEquals(a) {
+		return this.compareTo(a) == 0;
+	}
+	function bnMin(a) {
+		return this.compareTo(a) < 0 ? this : a;
+	}
+	function bnMax(a) {
+		return this.compareTo(a) > 0 ? this : a;
+	}
+	function bnpBitwiseTo(a, op, r) {
+		var i, f, m = Math.min(a.t, this.t);
+		for (i = 0; i < m; ++i) r[i] = op(this[i], a[i]);
+		if (a.t < this.t) {
+			f = a.s & this.DM;
+			for (i = m; i < this.t; ++i) r[i] = op(this[i], f);
+			r.t = this.t;
+		} else {
+			f = this.s & this.DM;
+			for (i = m; i < a.t; ++i) r[i] = op(f, a[i]);
+			r.t = a.t;
+		}
+		r.s = op(this.s, a.s);
+		r.clamp();
+	}
+	function op_and(x, y) {
+		return x & y;
+	}
+	function bnAnd(a) {
+		var r = nbi();
+		this.bitwiseTo(a, op_and, r);
+		return r;
+	}
+	function op_or(x, y) {
+		return x | y;
+	}
+	function bnOr(a) {
+		var r = nbi();
+		this.bitwiseTo(a, op_or, r);
+		return r;
+	}
+	function op_xor(x, y) {
+		return x ^ y;
+	}
+	function bnXor(a) {
+		var r = nbi();
+		this.bitwiseTo(a, op_xor, r);
+		return r;
+	}
+	function op_andnot(x, y) {
+		return x & ~y;
+	}
+	function bnAndNot(a) {
+		var r = nbi();
+		this.bitwiseTo(a, op_andnot, r);
+		return r;
+	}
+	function bnNot() {
+		var r = nbi();
+		for (var i = 0; i < this.t; ++i) r[i] = this.DM & ~this[i];
+		r.t = this.t;
+		r.s = ~this.s;
+		return r;
+	}
+	function bnShiftLeft(n) {
+		var r = nbi();
+		if (n < 0) this.rShiftTo(-n, r);
+		else this.lShiftTo(n, r);
+		return r;
+	}
+	function bnShiftRight(n) {
+		var r = nbi();
+		if (n < 0) this.lShiftTo(-n, r);
+		else this.rShiftTo(n, r);
+		return r;
+	}
+	function lbit(x) {
+		if (x === 0) return -1;
+		var r = 0;
+		if ((x & 65535) === 0) {
+			x >>= 16;
+			r += 16;
+		}
+		if ((x & 255) === 0) {
+			x >>= 8;
+			r += 8;
+		}
+		if ((x & 15) === 0) {
+			x >>= 4;
+			r += 4;
+		}
+		if ((x & 3) === 0) {
+			x >>= 2;
+			r += 2;
+		}
+		if ((x & 1) === 0) ++r;
+		return r;
+	}
+	function bnGetLowestSetBit() {
+		for (var i = 0; i < this.t; ++i) if (this[i] != 0) return i * this.DB + lbit(this[i]);
+		if (this.s < 0) return this.t * this.DB;
+		return -1;
+	}
+	function cbit(x) {
+		var r = 0;
+		while (x != 0) {
+			x &= x - 1;
+			++r;
+		}
+		return r;
+	}
+	function bnBitCount() {
+		var r = 0, x = this.s & this.DM;
+		for (var i = 0; i < this.t; ++i) r += cbit(this[i] ^ x);
+		return r;
+	}
+	function bnTestBit(n) {
+		var j = Math.floor(n / this.DB);
+		if (j >= this.t) return this.s != 0;
+		return (this[j] & 1 << n % this.DB) != 0;
+	}
+	function bnpChangeBit(n, op) {
+		var r = BigInteger.ONE.shiftLeft(n);
+		this.bitwiseTo(r, op, r);
+		return r;
+	}
+	function bnSetBit(n) {
+		return this.changeBit(n, op_or);
+	}
+	function bnClearBit(n) {
+		return this.changeBit(n, op_andnot);
+	}
+	function bnFlipBit(n) {
+		return this.changeBit(n, op_xor);
+	}
+	function bnpAddTo(a, r) {
+		var i = 0, c = 0, m = Math.min(a.t, this.t);
+		while (i < m) {
+			c += this[i] + a[i];
+			r[i++] = c & this.DM;
+			c >>= this.DB;
+		}
+		if (a.t < this.t) {
+			c += a.s;
+			while (i < this.t) {
+				c += this[i];
+				r[i++] = c & this.DM;
+				c >>= this.DB;
+			}
+			c += this.s;
+		} else {
+			c += this.s;
+			while (i < a.t) {
+				c += a[i];
+				r[i++] = c & this.DM;
+				c >>= this.DB;
+			}
+			c += a.s;
+		}
+		r.s = c < 0 ? -1 : 0;
+		if (c > 0) r[i++] = c;
+		else if (c < -1) r[i++] = this.DV + c;
+		r.t = i;
+		r.clamp();
+	}
+	function bnAdd(a) {
+		var r = nbi();
+		this.addTo(a, r);
+		return r;
+	}
+	function bnSubtract(a) {
+		var r = nbi();
+		this.subTo(a, r);
+		return r;
+	}
+	function bnMultiply(a) {
+		var r = nbi();
+		this.multiplyTo(a, r);
+		return r;
+	}
+	function bnSquare() {
+		var r = nbi();
+		this.squareTo(r);
+		return r;
+	}
+	function bnDivide(a) {
+		var r = nbi();
+		this.divRemTo(a, r, null);
+		return r;
+	}
+	function bnRemainder(a) {
+		var r = nbi();
+		this.divRemTo(a, null, r);
+		return r;
+	}
+	function bnDivideAndRemainder(a) {
+		var q = nbi(), r = nbi();
+		this.divRemTo(a, q, r);
+		return new Array(q, r);
+	}
+	function bnpDMultiply(n) {
+		this[this.t] = this.am(0, n - 1, this, 0, 0, this.t);
+		++this.t;
+		this.clamp();
+	}
+	function bnpDAddOffset(n, w) {
+		if (n === 0) return;
+		while (this.t <= w) this[this.t++] = 0;
+		this[w] += n;
+		while (this[w] >= this.DV) {
+			this[w] -= this.DV;
+			if (++w >= this.t) this[this.t++] = 0;
+			++this[w];
+		}
+	}
+	function NullExp() {}
+	function nNop(x) {
+		return x;
+	}
+	function nMulTo(x, y, r) {
+		x.multiplyTo(y, r);
+	}
+	function nSqrTo(x, r) {
+		x.squareTo(r);
+	}
+	NullExp.prototype.convert = nNop;
+	NullExp.prototype.revert = nNop;
+	NullExp.prototype.mulTo = nMulTo;
+	NullExp.prototype.sqrTo = nSqrTo;
+	function bnPow(e) {
+		return this.exp(e, new NullExp());
+	}
+	function bnpMultiplyLowerTo(a, n, r) {
+		var i = Math.min(this.t + a.t, n);
+		r.s = 0;
+		r.t = i;
+		while (i > 0) r[--i] = 0;
+		var j;
+		for (j = r.t - this.t; i < j; ++i) r[i + this.t] = this.am(0, a[i], r, i, 0, this.t);
+		for (j = Math.min(a.t, n); i < j; ++i) this.am(0, a[i], r, i, 0, n - i);
+		r.clamp();
+	}
+	function bnpMultiplyUpperTo(a, n, r) {
+		--n;
+		var i = r.t = this.t + a.t - n;
+		r.s = 0;
+		while (--i >= 0) r[i] = 0;
+		for (i = Math.max(n - this.t, 0); i < a.t; ++i) r[this.t + i - n] = this.am(n - i, a[i], r, 0, 0, this.t + i - n);
+		r.clamp();
+		r.drShiftTo(1, r);
+	}
+	function Barrett(m) {
+		this.r2 = nbi();
+		this.q3 = nbi();
+		BigInteger.ONE.dlShiftTo(2 * m.t, this.r2);
+		this.mu = this.r2.divide(m);
+		this.m = m;
+	}
+	function barrettConvert(x) {
+		if (x.s < 0 || x.t > 2 * this.m.t) return x.mod(this.m);
+		else if (x.compareTo(this.m) < 0) return x;
+		else {
+			var r = nbi();
+			x.copyTo(r);
+			this.reduce(r);
+			return r;
+		}
+	}
+	function barrettRevert(x) {
+		return x;
+	}
+	function barrettReduce(x) {
+		x.drShiftTo(this.m.t - 1, this.r2);
+		if (x.t > this.m.t + 1) {
+			x.t = this.m.t + 1;
+			x.clamp();
+		}
+		this.mu.multiplyUpperTo(this.r2, this.m.t + 1, this.q3);
+		this.m.multiplyLowerTo(this.q3, this.m.t + 1, this.r2);
+		while (x.compareTo(this.r2) < 0) x.dAddOffset(1, this.m.t + 1);
+		x.subTo(this.r2, x);
+		while (x.compareTo(this.m) >= 0) x.subTo(this.m, x);
+	}
+	function barrettSqrTo(x, r) {
+		x.squareTo(r);
+		this.reduce(r);
+	}
+	function barrettMulTo(x, y, r) {
+		x.multiplyTo(y, r);
+		this.reduce(r);
+	}
+	Barrett.prototype.convert = barrettConvert;
+	Barrett.prototype.revert = barrettRevert;
+	Barrett.prototype.reduce = barrettReduce;
+	Barrett.prototype.mulTo = barrettMulTo;
+	Barrett.prototype.sqrTo = barrettSqrTo;
+	function bnModPow(e, m) {
+		var i = e.bitLength(), k, r = nbv(1), z;
+		if (i <= 0) return r;
+		else if (i < 18) k = 1;
+		else if (i < 48) k = 3;
+		else if (i < 144) k = 4;
+		else if (i < 768) k = 5;
+		else k = 6;
+		if (i < 8) z = new Classic(m);
+		else if (m.isEven()) z = new Barrett(m);
+		else z = new Montgomery(m);
+		var g = new Array(), n = 3, k1 = k - 1, km = (1 << k) - 1;
+		g[1] = z.convert(this);
+		if (k > 1) {
+			var g2 = nbi();
+			z.sqrTo(g[1], g2);
+			while (n <= km) {
+				g[n] = nbi();
+				z.mulTo(g2, g[n - 2], g[n]);
+				n += 2;
+			}
+		}
+		var j = e.t - 1, w, is1 = true, r2 = nbi(), t;
+		i = nbits(e[j]) - 1;
+		while (j >= 0) {
+			if (i >= k1) w = e[j] >> i - k1 & km;
+			else {
+				w = (e[j] & (1 << i + 1) - 1) << k1 - i;
+				if (j > 0) w |= e[j - 1] >> this.DB + i - k1;
+			}
+			n = k;
+			while ((w & 1) === 0) {
+				w >>= 1;
+				--n;
+			}
+			if ((i -= n) < 0) {
+				i += this.DB;
+				--j;
+			}
+			if (is1) {
+				g[w].copyTo(r);
+				is1 = false;
+			} else {
+				while (n > 1) {
+					z.sqrTo(r, r2);
+					z.sqrTo(r2, r);
+					n -= 2;
+				}
+				if (n > 0) z.sqrTo(r, r2);
+				else {
+					t = r;
+					r = r2;
+					r2 = t;
+				}
+				z.mulTo(r2, g[w], r);
+			}
+			while (j >= 0 && (e[j] & 1 << i) === 0) {
+				z.sqrTo(r, r2);
+				t = r;
+				r = r2;
+				r2 = t;
+				if (--i < 0) {
+					i = this.DB - 1;
+					--j;
+				}
+			}
+		}
+		return z.revert(r);
+	}
+	function bnGCD(a) {
+		var x = this.s < 0 ? this.negate() : this.clone();
+		var y = a.s < 0 ? a.negate() : a.clone();
+		if (x.compareTo(y) < 0) {
+			var t = x;
+			x = y;
+			y = t;
+		}
+		var i = x.getLowestSetBit(), g = y.getLowestSetBit();
+		if (g < 0) return x;
+		if (i < g) g = i;
+		if (g > 0) {
+			x.rShiftTo(g, x);
+			y.rShiftTo(g, y);
+		}
+		while (x.signum() > 0) {
+			if ((i = x.getLowestSetBit()) > 0) x.rShiftTo(i, x);
+			if ((i = y.getLowestSetBit()) > 0) y.rShiftTo(i, y);
+			if (x.compareTo(y) >= 0) {
+				x.subTo(y, x);
+				x.rShiftTo(1, x);
+			} else {
+				y.subTo(x, y);
+				y.rShiftTo(1, y);
+			}
+		}
+		if (g > 0) y.lShiftTo(g, y);
+		return y;
+	}
+	function bnpModInt(n) {
+		if (n <= 0) return 0;
+		var d = this.DV % n, r = this.s < 0 ? n - 1 : 0;
+		if (this.t > 0) if (d === 0) r = this[0] % n;
+		else for (var i = this.t - 1; i >= 0; --i) r = (d * r + this[i]) % n;
+		return r;
+	}
+	function bnModInverse(m) {
+		var ac = m.isEven();
+		if (this.isEven() && ac || m.signum() === 0) return BigInteger.ZERO;
+		var u = m.clone(), v = this.clone();
+		var a = nbv(1), b = nbv(0), c = nbv(0), d = nbv(1);
+		while (u.signum() != 0) {
+			while (u.isEven()) {
+				u.rShiftTo(1, u);
+				if (ac) {
+					if (!a.isEven() || !b.isEven()) {
+						a.addTo(this, a);
+						b.subTo(m, b);
+					}
+					a.rShiftTo(1, a);
+				} else if (!b.isEven()) b.subTo(m, b);
+				b.rShiftTo(1, b);
+			}
+			while (v.isEven()) {
+				v.rShiftTo(1, v);
+				if (ac) {
+					if (!c.isEven() || !d.isEven()) {
+						c.addTo(this, c);
+						d.subTo(m, d);
+					}
+					c.rShiftTo(1, c);
+				} else if (!d.isEven()) d.subTo(m, d);
+				d.rShiftTo(1, d);
+			}
+			if (u.compareTo(v) >= 0) {
+				u.subTo(v, u);
+				if (ac) a.subTo(c, a);
+				b.subTo(d, b);
+			} else {
+				v.subTo(u, v);
+				if (ac) c.subTo(a, c);
+				d.subTo(b, d);
+			}
+		}
+		if (v.compareTo(BigInteger.ONE) != 0) return BigInteger.ZERO;
+		if (d.compareTo(m) >= 0) return d.subtract(m);
+		if (d.signum() < 0) d.addTo(m, d);
+		else return d;
+		if (d.signum() < 0) return d.add(m);
+		else return d;
+	}
+	var lowprimes = [
+		2,
+		3,
+		5,
+		7,
+		11,
+		13,
+		17,
+		19,
+		23,
+		29,
+		31,
+		37,
+		41,
+		43,
+		47,
+		53,
+		59,
+		61,
+		67,
+		71,
+		73,
+		79,
+		83,
+		89,
+		97,
+		101,
+		103,
+		107,
+		109,
+		113,
+		127,
+		131,
+		137,
+		139,
+		149,
+		151,
+		157,
+		163,
+		167,
+		173,
+		179,
+		181,
+		191,
+		193,
+		197,
+		199,
+		211,
+		223,
+		227,
+		229,
+		233,
+		239,
+		241,
+		251,
+		257,
+		263,
+		269,
+		271,
+		277,
+		281,
+		283,
+		293,
+		307,
+		311,
+		313,
+		317,
+		331,
+		337,
+		347,
+		349,
+		353,
+		359,
+		367,
+		373,
+		379,
+		383,
+		389,
+		397,
+		401,
+		409,
+		419,
+		421,
+		431,
+		433,
+		439,
+		443,
+		449,
+		457,
+		461,
+		463,
+		467,
+		479,
+		487,
+		491,
+		499,
+		503,
+		509,
+		521,
+		523,
+		541,
+		547,
+		557,
+		563,
+		569,
+		571,
+		577,
+		587,
+		593,
+		599,
+		601,
+		607,
+		613,
+		617,
+		619,
+		631,
+		641,
+		643,
+		647,
+		653,
+		659,
+		661,
+		673,
+		677,
+		683,
+		691,
+		701,
+		709,
+		719,
+		727,
+		733,
+		739,
+		743,
+		751,
+		757,
+		761,
+		769,
+		773,
+		787,
+		797,
+		809,
+		811,
+		821,
+		823,
+		827,
+		829,
+		839,
+		853,
+		857,
+		859,
+		863,
+		877,
+		881,
+		883,
+		887,
+		907,
+		911,
+		919,
+		929,
+		937,
+		941,
+		947,
+		953,
+		967,
+		971,
+		977,
+		983,
+		991,
+		997
+	];
+	var lplim = (1 << 26) / lowprimes[lowprimes.length - 1];
+	function bnIsProbablePrime(t) {
+		var i, x = this.abs();
+		if (x.t == 1 && x[0] <= lowprimes[lowprimes.length - 1]) {
+			for (i = 0; i < lowprimes.length; ++i) if (x[0] == lowprimes[i]) return true;
+			return false;
+		}
+		if (x.isEven()) return false;
+		i = 1;
+		while (i < lowprimes.length) {
+			var m = lowprimes[i], j = i + 1;
+			while (j < lowprimes.length && m < lplim) m *= lowprimes[j++];
+			m = x.modInt(m);
+			while (i < j) if (m % lowprimes[i++] === 0) return false;
+		}
+		return x.millerRabin(t);
+	}
+	function bnpMillerRabin(t) {
+		var n1 = this.subtract(BigInteger.ONE);
+		var k = n1.getLowestSetBit();
+		if (k <= 0) return false;
+		var r = n1.shiftRight(k);
+		t = t + 1 >> 1;
+		if (t > lowprimes.length) t = lowprimes.length;
+		var a = nbi();
+		for (var i = 0; i < t; ++i) {
+			a.fromInt(lowprimes[Math.floor(Math.random() * lowprimes.length)]);
+			var y = a.modPow(r, this);
+			if (y.compareTo(BigInteger.ONE) != 0 && y.compareTo(n1) != 0) {
+				var j = 1;
+				while (j++ < k && y.compareTo(n1) != 0) {
+					y = y.modPowInt(2, this);
+					if (y.compareTo(BigInteger.ONE) === 0) return false;
+				}
+				if (y.compareTo(n1) != 0) return false;
+			}
+		}
+		return true;
+	}
+	BigInteger.prototype.copyTo = bnpCopyTo;
+	BigInteger.prototype.fromInt = bnpFromInt;
+	BigInteger.prototype.fromString = bnpFromString;
+	BigInteger.prototype.fromByteArray = bnpFromByteArray;
+	BigInteger.prototype.fromBuffer = bnpFromBuffer;
+	BigInteger.prototype.clamp = bnpClamp;
+	BigInteger.prototype.dlShiftTo = bnpDLShiftTo;
+	BigInteger.prototype.drShiftTo = bnpDRShiftTo;
+	BigInteger.prototype.lShiftTo = bnpLShiftTo;
+	BigInteger.prototype.rShiftTo = bnpRShiftTo;
+	BigInteger.prototype.subTo = bnpSubTo;
+	BigInteger.prototype.multiplyTo = bnpMultiplyTo;
+	BigInteger.prototype.squareTo = bnpSquareTo;
+	BigInteger.prototype.divRemTo = bnpDivRemTo;
+	BigInteger.prototype.invDigit = bnpInvDigit;
+	BigInteger.prototype.isEven = bnpIsEven;
+	BigInteger.prototype.exp = bnpExp;
+	BigInteger.prototype.chunkSize = bnpChunkSize;
+	BigInteger.prototype.toRadix = bnpToRadix;
+	BigInteger.prototype.fromRadix = bnpFromRadix;
+	BigInteger.prototype.fromNumber = bnpFromNumber;
+	BigInteger.prototype.bitwiseTo = bnpBitwiseTo;
+	BigInteger.prototype.changeBit = bnpChangeBit;
+	BigInteger.prototype.addTo = bnpAddTo;
+	BigInteger.prototype.dMultiply = bnpDMultiply;
+	BigInteger.prototype.dAddOffset = bnpDAddOffset;
+	BigInteger.prototype.multiplyLowerTo = bnpMultiplyLowerTo;
+	BigInteger.prototype.multiplyUpperTo = bnpMultiplyUpperTo;
+	BigInteger.prototype.modInt = bnpModInt;
+	BigInteger.prototype.millerRabin = bnpMillerRabin;
+	BigInteger.prototype.toString = bnToString;
+	BigInteger.prototype.negate = bnNegate;
+	BigInteger.prototype.abs = bnAbs;
+	BigInteger.prototype.compareTo = bnCompareTo;
+	BigInteger.prototype.bitLength = bnBitLength;
+	BigInteger.prototype.mod = bnMod;
+	BigInteger.prototype.modPowInt = bnModPowInt;
+	BigInteger.prototype.clone = bnClone;
+	BigInteger.prototype.intValue = bnIntValue;
+	BigInteger.prototype.byteValue = bnByteValue;
+	BigInteger.prototype.shortValue = bnShortValue;
+	BigInteger.prototype.signum = bnSigNum;
+	BigInteger.prototype.toByteArray = bnToByteArray;
+	BigInteger.prototype.toBuffer = bnToBuffer;
+	BigInteger.prototype.equals = bnEquals;
+	BigInteger.prototype.eq = bnEqual;
+	BigInteger.prototype.gt = bnGreater;
+	BigInteger.prototype.gte = bnGreaterOrEqual;
+	BigInteger.prototype.lt = bnLesser;
+	BigInteger.prototype.lte = bnLesserOrEqual;
+	BigInteger.prototype.min = bnMin;
+	BigInteger.prototype.max = bnMax;
+	BigInteger.prototype.and = bnAnd;
+	BigInteger.prototype.or = bnOr;
+	BigInteger.prototype.xor = bnXor;
+	BigInteger.prototype.andNot = bnAndNot;
+	BigInteger.prototype.not = bnNot;
+	BigInteger.prototype.shiftLeft = bnShiftLeft;
+	BigInteger.prototype.shiftRight = bnShiftRight;
+	BigInteger.prototype.getLowestSetBit = bnGetLowestSetBit;
+	BigInteger.prototype.bitCount = bnBitCount;
+	BigInteger.prototype.testBit = bnTestBit;
+	BigInteger.prototype.setBit = bnSetBit;
+	BigInteger.prototype.clearBit = bnClearBit;
+	BigInteger.prototype.flipBit = bnFlipBit;
+	BigInteger.prototype.add = bnAdd;
+	BigInteger.prototype.subtract = bnSubtract;
+	BigInteger.prototype.multiply = bnMultiply;
+	BigInteger.prototype.divide = bnDivide;
+	BigInteger.prototype.remainder = bnRemainder;
+	BigInteger.prototype.divideAndRemainder = bnDivideAndRemainder;
+	BigInteger.prototype.modPow = bnModPow;
+	BigInteger.prototype.modInverse = bnModInverse;
+	BigInteger.prototype.pow = bnPow;
+	BigInteger.prototype.gcd = bnGCD;
+	BigInteger.prototype.isProbablePrime = bnIsProbablePrime;
+	BigInteger.int2char = int2char;
+	BigInteger.ZERO = nbv(0);
+	BigInteger.ONE = nbv(1);
+	BigInteger.prototype.square = bnSquare;
+	module.exports = BigInteger;
+}));
+
+//#endregion
+//#region ../../node_modules/.bun/fast-srp-hap@2.0.4/node_modules/fast-srp-hap/lib/params.js
+var require_params = /* @__PURE__ */ __commonJSMin(((exports) => {
+	/**
+	* SRP Group Parameters
+	* http://tools.ietf.org/html/rfc5054#appendix-A
+	*
+	* The 1024-, 1536-, and 2048-bit groups are taken from software
+	* developed by Tom Wu and Eugene Jhong for the Stanford SRP
+	* distribution, and subsequently proven to be prime.  The larger primes
+	* are taken from [MODP], but generators have been calculated that are
+	* primitive roots of N, unlike the generators in [MODP].
+	*
+	* The 1024-bit and 1536-bit groups MUST be supported.
+	*/
+	Object.defineProperty(exports, "__esModule", { value: true });
+	exports.params = exports.hex = void 0;
+	const BigInteger = require_jsbn();
+	function hex(s) {
+		return new BigInteger(s.split(/\s|\n/).join(""), 16);
+	}
+	exports.hex = hex;
+	exports.params = {
+		1024: {
+			N_length_bits: 1024,
+			N: hex(`
+      EEAF0AB9 ADB38DD6 9C33F80A FA8FC5E8 60726187 75FF3C0B 9EA2314C
+      9C256576 D674DF74 96EA81D3 383B4813 D692C6E0 E0D5D8E2 50B98BE4
+      8E495C1D 6089DAD1 5DC7D7B4 6154D6B6 CE8EF4AD 69B15D49 82559B29
+      7BCF1885 C529F566 660E57EC 68EDBC3C 05726CC0 2FD4CBF4 976EAA9A
+      FD5138FE 8376435B 9FC61D2F C0EB06E3
+    `),
+			g: hex("02"),
+			hash: "sha1"
+		},
+		1536: {
+			N_length_bits: 1536,
+			N: hex(`
+      9DEF3CAF B939277A B1F12A86 17A47BBB DBA51DF4 99AC4C80 BEEEA961
+      4B19CC4D 5F4F5F55 6E27CBDE 51C6A94B E4607A29 1558903B A0D0F843
+      80B655BB 9A22E8DC DF028A7C EC67F0D0 8134B1C8 B9798914 9B609E0B
+      E3BAB63D 47548381 DBC5B1FC 764E3F4B 53DD9DA1 158BFD3E 2B9C8CF5
+      6EDF0195 39349627 DB2FD53D 24B7C486 65772E43 7D6C7F8C E442734A
+      F7CCB7AE 837C264A E3A9BEB8 7F8A2FE9 B8B5292E 5A021FFF 5E91479E
+      8CE7A28C 2442C6F3 15180F93 499A234D CF76E3FE D135F9BB
+    `),
+			g: hex("02"),
+			hash: "sha1"
+		},
+		2048: {
+			N_length_bits: 2048,
+			N: hex(`
+      AC6BDB41 324A9A9B F166DE5E 1389582F AF72B665 1987EE07 FC319294
+      3DB56050 A37329CB B4A099ED 8193E075 7767A13D D52312AB 4B03310D
+      CD7F48A9 DA04FD50 E8083969 EDB767B0 CF609517 9A163AB3 661A05FB
+      D5FAAAE8 2918A996 2F0B93B8 55F97993 EC975EEA A80D740A DBF4FF74
+      7359D041 D5C33EA7 1D281E44 6B14773B CA97B43A 23FB8016 76BD207A
+      436C6481 F1D2B907 8717461A 5B9D32E6 88F87748 544523B5 24B0D57D
+      5EA77A27 75D2ECFA 032CFBDB F52FB378 61602790 04E57AE6 AF874E73
+      03CE5329 9CCC041C 7BC308D8 2A5698F3 A8D0C382 71AE35F8 E9DBFBB6
+      94B5C803 D89F7AE4 35DE236D 525F5475 9B65E372 FCD68EF2 0FA7111F
+      9E4AFF73
+    `),
+			g: hex("02"),
+			hash: "sha256"
+		},
+		3072: {
+			N_length_bits: 3072,
+			N: hex(`
+      FFFFFFFF FFFFFFFF C90FDAA2 2168C234 C4C6628B 80DC1CD1 29024E08
+      8A67CC74 020BBEA6 3B139B22 514A0879 8E3404DD EF9519B3 CD3A431B
+      302B0A6D F25F1437 4FE1356D 6D51C245 E485B576 625E7EC6 F44C42E9
+      A637ED6B 0BFF5CB6 F406B7ED EE386BFB 5A899FA5 AE9F2411 7C4B1FE6
+      49286651 ECE45B3D C2007CB8 A163BF05 98DA4836 1C55D39A 69163FA8
+      FD24CF5F 83655D23 DCA3AD96 1C62F356 208552BB 9ED52907 7096966D
+      670C354E 4ABC9804 F1746C08 CA18217C 32905E46 2E36CE3B E39E772C
+      180E8603 9B2783A2 EC07A28F B5C55DF0 6F4C52C9 DE2BCBF6 95581718
+      3995497C EA956AE5 15D22618 98FA0510 15728E5A 8AAAC42D AD33170D
+      04507A33 A85521AB DF1CBA64 ECFB8504 58DBEF0A 8AEA7157 5D060C7D
+      B3970F85 A6E1E4C7 ABF5AE8C DB0933D7 1E8C94E0 4A25619D CEE3D226
+      1AD2EE6B F12FFA06 D98A0864 D8760273 3EC86A64 521F2B18 177B200C
+      BBE11757 7A615D6C 770988C0 BAD946E2 08E24FA0 74E5AB31 43DB5BFC
+      E0FD108E 4B82D120 A93AD2CA FFFFFFFF FFFFFFFF
+    `),
+			g: hex("05"),
+			hash: "sha256"
+		},
+		hap: {
+			N_length_bits: 3072,
+			N: hex(`
+      FFFFFFFF FFFFFFFF C90FDAA2 2168C234 C4C6628B 80DC1CD1 29024E08
+      8A67CC74 020BBEA6 3B139B22 514A0879 8E3404DD EF9519B3 CD3A431B
+      302B0A6D F25F1437 4FE1356D 6D51C245 E485B576 625E7EC6 F44C42E9
+      A637ED6B 0BFF5CB6 F406B7ED EE386BFB 5A899FA5 AE9F2411 7C4B1FE6
+      49286651 ECE45B3D C2007CB8 A163BF05 98DA4836 1C55D39A 69163FA8
+      FD24CF5F 83655D23 DCA3AD96 1C62F356 208552BB 9ED52907 7096966D
+      670C354E 4ABC9804 F1746C08 CA18217C 32905E46 2E36CE3B E39E772C
+      180E8603 9B2783A2 EC07A28F B5C55DF0 6F4C52C9 DE2BCBF6 95581718
+      3995497C EA956AE5 15D22618 98FA0510 15728E5A 8AAAC42D AD33170D
+      04507A33 A85521AB DF1CBA64 ECFB8504 58DBEF0A 8AEA7157 5D060C7D
+      B3970F85 A6E1E4C7 ABF5AE8C DB0933D7 1E8C94E0 4A25619D CEE3D226
+      1AD2EE6B F12FFA06 D98A0864 D8760273 3EC86A64 521F2B18 177B200C
+      BBE11757 7A615D6C 770988C0 BAD946E2 08E24FA0 74E5AB31 43DB5BFC
+      E0FD108E 4B82D120 A93AD2CA FFFFFFFF FFFFFFFF
+    `),
+			g: hex("05"),
+			hash: "sha512"
+		},
+		4096: {
+			N_length_bits: 4096,
+			N: hex(`
+      FFFFFFFF FFFFFFFF C90FDAA2 2168C234 C4C6628B 80DC1CD1 29024E08
+      8A67CC74 020BBEA6 3B139B22 514A0879 8E3404DD EF9519B3 CD3A431B
+      302B0A6D F25F1437 4FE1356D 6D51C245 E485B576 625E7EC6 F44C42E9
+      A637ED6B 0BFF5CB6 F406B7ED EE386BFB 5A899FA5 AE9F2411 7C4B1FE6
+      49286651 ECE45B3D C2007CB8 A163BF05 98DA4836 1C55D39A 69163FA8
+      FD24CF5F 83655D23 DCA3AD96 1C62F356 208552BB 9ED52907 7096966D
+      670C354E 4ABC9804 F1746C08 CA18217C 32905E46 2E36CE3B E39E772C
+      180E8603 9B2783A2 EC07A28F B5C55DF0 6F4C52C9 DE2BCBF6 95581718
+      3995497C EA956AE5 15D22618 98FA0510 15728E5A 8AAAC42D AD33170D
+      04507A33 A85521AB DF1CBA64 ECFB8504 58DBEF0A 8AEA7157 5D060C7D
+      B3970F85 A6E1E4C7 ABF5AE8C DB0933D7 1E8C94E0 4A25619D CEE3D226
+      1AD2EE6B F12FFA06 D98A0864 D8760273 3EC86A64 521F2B18 177B200C
+      BBE11757 7A615D6C 770988C0 BAD946E2 08E24FA0 74E5AB31 43DB5BFC
+      E0FD108E 4B82D120 A9210801 1A723C12 A787E6D7 88719A10 BDBA5B26
+      99C32718 6AF4E23C 1A946834 B6150BDA 2583E9CA 2AD44CE8 DBBBC2DB
+      04DE8EF9 2E8EFC14 1FBECAA6 287C5947 4E6BC05D 99B2964F A090C3A2
+      233BA186 515BE7ED 1F612970 CEE2D7AF B81BDD76 2170481C D0069127
+      D5B05AA9 93B4EA98 8D8FDDC1 86FFB7DC 90A6C08F 4DF435C9 34063199
+      FFFFFFFF FFFFFFFF
+    `),
+			g: hex("05"),
+			hash: "sha256"
+		},
+		6244: {
+			N_length_bits: 6244,
+			N: hex(`
+      FFFFFFFF FFFFFFFF C90FDAA2 2168C234 C4C6628B 80DC1CD1 29024E08
+      8A67CC74 020BBEA6 3B139B22 514A0879 8E3404DD EF9519B3 CD3A431B
+      302B0A6D F25F1437 4FE1356D 6D51C245 E485B576 625E7EC6 F44C42E9
+      A637ED6B 0BFF5CB6 F406B7ED EE386BFB 5A899FA5 AE9F2411 7C4B1FE6
+      49286651 ECE45B3D C2007CB8 A163BF05 98DA4836 1C55D39A 69163FA8
+      FD24CF5F 83655D23 DCA3AD96 1C62F356 208552BB 9ED52907 7096966D
+      670C354E 4ABC9804 F1746C08 CA18217C 32905E46 2E36CE3B E39E772C
+      180E8603 9B2783A2 EC07A28F B5C55DF0 6F4C52C9 DE2BCBF6 95581718
+      3995497C EA956AE5 15D22618 98FA0510 15728E5A 8AAAC42D AD33170D
+      04507A33 A85521AB DF1CBA64 ECFB8504 58DBEF0A 8AEA7157 5D060C7D
+      B3970F85 A6E1E4C7 ABF5AE8C DB0933D7 1E8C94E0 4A25619D CEE3D226
+      1AD2EE6B F12FFA06 D98A0864 D8760273 3EC86A64 521F2B18 177B200C
+      BBE11757 7A615D6C 770988C0 BAD946E2 08E24FA0 74E5AB31 43DB5BFC
+      E0FD108E 4B82D120 A9210801 1A723C12 A787E6D7 88719A10 BDBA5B26
+      99C32718 6AF4E23C 1A946834 B6150BDA 2583E9CA 2AD44CE8 DBBBC2DB
+      04DE8EF9 2E8EFC14 1FBECAA6 287C5947 4E6BC05D 99B2964F A090C3A2
+      233BA186 515BE7ED 1F612970 CEE2D7AF B81BDD76 2170481C D0069127
+      D5B05AA9 93B4EA98 8D8FDDC1 86FFB7DC 90A6C08F 4DF435C9 34028492
+      36C3FAB4 D27C7026 C1D4DCB2 602646DE C9751E76 3DBA37BD F8FF9406
+      AD9E530E E5DB382F 413001AE B06A53ED 9027D831 179727B0 865A8918
+      DA3EDBEB CF9B14ED 44CE6CBA CED4BB1B DB7F1447 E6CC254B 33205151
+      2BD7AF42 6FB8F401 378CD2BF 5983CA01 C64B92EC F032EA15 D1721D03
+      F482D7CE 6E74FEF6 D55E702F 46980C82 B5A84031 900B1C9E 59E7C97F
+      BEC7E8F3 23A97A7E 36CC88BE 0F1D45B7 FF585AC5 4BD407B2 2B4154AA
+      CC8F6D7E BF48E1D8 14CC5ED2 0F8037E0 A79715EE F29BE328 06A1D58B
+      B7C5DA76 F550AA3D 8A1FBFF0 EB19CCB1 A313D55C DA56C9EC 2EF29632
+      387FE8D7 6E3C0468 043E8F66 3F4860EE 12BF2D5B 0B7474D6 E694F91E
+      6DCC4024 FFFFFFFF FFFFFFFF
+    `),
+			g: hex("05"),
+			hash: "sha256"
+		},
+		8192: {
+			N_length_bits: 8192,
+			N: hex(`
+      FFFFFFFF FFFFFFFF C90FDAA2 2168C234 C4C6628B 80DC1CD1 29024E08
+      8A67CC74 020BBEA6 3B139B22 514A0879 8E3404DD EF9519B3 CD3A431B
+      302B0A6D F25F1437 4FE1356D 6D51C245 E485B576 625E7EC6 F44C42E9
+      A637ED6B 0BFF5CB6 F406B7ED EE386BFB 5A899FA5 AE9F2411 7C4B1FE6
+      49286651 ECE45B3D C2007CB8 A163BF05 98DA4836 1C55D39A 69163FA8
+      FD24CF5F 83655D23 DCA3AD96 1C62F356 208552BB 9ED52907 7096966D
+      670C354E 4ABC9804 F1746C08 CA18217C 32905E46 2E36CE3B E39E772C
+      180E8603 9B2783A2 EC07A28F B5C55DF0 6F4C52C9 DE2BCBF6 95581718
+      3995497C EA956AE5 15D22618 98FA0510 15728E5A 8AAAC42D AD33170D
+      04507A33 A85521AB DF1CBA64 ECFB8504 58DBEF0A 8AEA7157 5D060C7D
+      B3970F85 A6E1E4C7 ABF5AE8C DB0933D7 1E8C94E0 4A25619D CEE3D226
+      1AD2EE6B F12FFA06 D98A0864 D8760273 3EC86A64 521F2B18 177B200C
+      BBE11757 7A615D6C 770988C0 BAD946E2 08E24FA0 74E5AB31 43DB5BFC
+      E0FD108E 4B82D120 A9210801 1A723C12 A787E6D7 88719A10 BDBA5B26
+      99C32718 6AF4E23C 1A946834 B6150BDA 2583E9CA 2AD44CE8 DBBBC2DB
+      04DE8EF9 2E8EFC14 1FBECAA6 287C5947 4E6BC05D 99B2964F A090C3A2
+      233BA186 515BE7ED 1F612970 CEE2D7AF B81BDD76 2170481C D0069127
+      D5B05AA9 93B4EA98 8D8FDDC1 86FFB7DC 90A6C08F 4DF435C9 34028492
+      36C3FAB4 D27C7026 C1D4DCB2 602646DE C9751E76 3DBA37BD F8FF9406
+      AD9E530E E5DB382F 413001AE B06A53ED 9027D831 179727B0 865A8918
+      DA3EDBEB CF9B14ED 44CE6CBA CED4BB1B DB7F1447 E6CC254B 33205151
+      2BD7AF42 6FB8F401 378CD2BF 5983CA01 C64B92EC F032EA15 D1721D03
+      F482D7CE 6E74FEF6 D55E702F 46980C82 B5A84031 900B1C9E 59E7C97F
+      BEC7E8F3 23A97A7E 36CC88BE 0F1D45B7 FF585AC5 4BD407B2 2B4154AA
+      CC8F6D7E BF48E1D8 14CC5ED2 0F8037E0 A79715EE F29BE328 06A1D58B
+      B7C5DA76 F550AA3D 8A1FBFF0 EB19CCB1 A313D55C DA56C9EC 2EF29632
+      387FE8D7 6E3C0468 043E8F66 3F4860EE 12BF2D5B 0B7474D6 E694F91E
+      6DBE1159 74A3926F 12FEE5E4 38777CB6 A932DF8C D8BEC4D0 73B931BA
+      3BC832B6 8D9DD300 741FA7BF 8AFC47ED 2576F693 6BA42466 3AAB639C
+      5AE4F568 3423B474 2BF1C978 238F16CB E39D652D E3FDB8BE FC848AD9
+      22222E04 A4037C07 13EB57A8 1A23F0C7 3473FC64 6CEA306B 4BCBC886
+      2F8385DD FA9D4B7F A2C087E8 79683303 ED5BDD3A 062B3CF5 B3A278A6
+      6D2A13F8 3F44F82D DF310EE0 74AB6A36 4597E899 A0255DC1 64F31CC5
+      0846851D F9AB4819 5DED7EA1 B1D510BD 7EE74D73 FAF36BC3 1ECFA268
+      359046F4 EB879F92 4009438B 481C6CD7 889A002E D5EE382B C9190DA6
+      FC026E47 9558E447 5677E9AA 9E3050E2 765694DF C81F56E8 80B96E71
+      60C980DD 98EDD3DF FFFFFFFF FFFFFFFF
+    `),
+			g: hex("13"),
+			hash: "sha256"
+		}
+	};
+	exports.default = exports.params;
+}));
+
+//#endregion
+//#region ../../node_modules/.bun/fast-srp-hap@2.0.4/node_modules/fast-srp-hap/lib/srp.js
+var require_srp = /* @__PURE__ */ __commonJSMin(((exports) => {
+	var __importDefault = exports && exports.__importDefault || function(mod) {
+		return mod && mod.__esModule ? mod : { "default": mod };
+	};
+	Object.defineProperty(exports, "__esModule", { value: true });
+	exports.SrpServer = exports.SrpClient = exports.SRP = void 0;
+	const crypto_1 = __importDefault(__require("crypto"));
+	const assert_1 = __importDefault(__require("assert"));
+	const BigInteger = require_jsbn();
+	const params_1 = require_params();
+	const zero = new BigInteger(0, 10);
+	function assert_(val, msg) {
+		if (!val) throw new Error(msg || "assertion");
+	}
+	function assertIsBuffer(arg, argname = "arg") {
+		assert_(Buffer.isBuffer(arg), `Type error: ${argname} must be a buffer`);
+	}
+	function assertIsBigInteger(arg, argname = "arg") {
+		assert_(arg instanceof BigInteger, `Type error: ${argname} must be a BigInteger`);
+	}
+	/**
+	* If a conversion is explicitly specified with the operator PAD(),
+	* the integer will first be implicitly converted, then the resultant
+	* byte-string will be left-padded with zeros (if necessary) until its
+	* length equals the implicitly-converted length of N.
+	*
+	* @param {Buffer} n Number to pad
+	* @param {number} len Length of the resulting Buffer
+	* @return {Buffer}
+	*/
+	function padTo(n, len) {
+		assertIsBuffer(n, "n");
+		const padding = len - n.length;
+		assert_(padding > -1, "Negative padding.  Very uncomfortable.");
+		const result = Buffer.alloc(len);
+		result.fill(0, 0, padding);
+		n.copy(result, padding);
+		assert_1.default.strictEqual(result.length, len);
+		return result;
+	}
+	function padToN(number, params) {
+		assertIsBigInteger(number);
+		const n = number.toString(16).length % 2 !== 0 ? "0" + number.toString(16) : number.toString(16);
+		return padTo(Buffer.from(n, "hex"), params.N_length_bits / 8);
+	}
+	/**
+	* Compute the intermediate value x as a hash of three buffers:
+	* salt, identity, and password.  And a colon.  FOUR buffers.
+	*
+	*      x = H(s | H(I | ":" | P))
+	*
+	* @param {object} params
+	* @param {Buffer} salt
+	* @param {Buffer} I User identity
+	* @param {Buffer} P User password
+	* @return {BigInteger} User secret
+	*/
+	function getx(params, salt, I, P) {
+		assertIsBuffer(salt, "salt (salt)");
+		assertIsBuffer(I, "identity (I)");
+		assertIsBuffer(P, "password (P)");
+		const hashIP = crypto_1.default.createHash(params.hash).update(Buffer.concat([
+			I,
+			Buffer.from(":"),
+			P
+		])).digest();
+		return new BigInteger(crypto_1.default.createHash(params.hash).update(salt).update(hashIP).digest());
+	}
+	var SRP = class SRP {
+		/**
+		* The verifier is calculated as described in Section 3 of [SRP-RFC].
+		* We give the algorithm here for convenience.
+		*
+		* The verifier (v) is computed based on the salt (s), user name (I),
+		* password (P), and group parameters (N, g).
+		*
+		*         x = H(s | H(I | ":" | P))
+		*         v = g^x % N
+		*
+		* @param {object} params Group parameters, with .N, .g, .hash
+		* @param {Buffer} salt
+		* @param {Buffer} I User identity
+		* @param {Buffer} P User password
+		* @return {Buffer}
+		*/
+		static computeVerifier(params, salt, I, P) {
+			assertIsBuffer(salt, "salt (salt)");
+			assertIsBuffer(I, "identity (I)");
+			assertIsBuffer(P, "password (P)");
+			return params.g.modPow(getx(params, salt, I, P), params.N).toBuffer(params.N_length_bits / 8);
+		}
+		static genKey(bytes = 32, callback) {
+			if (typeof bytes !== "number") {
+				callback = bytes;
+				bytes = 32;
+			}
+			if (!callback) return new Promise((rs, rj) => SRP.genKey(bytes, (err, data) => err ? rj(err) : rs(data)));
+			crypto_1.default.randomBytes(bytes, (err, buf) => {
+				if (err) return callback(err, null);
+				return callback(null, buf);
+			});
+		}
+	};
+	exports.SRP = SRP;
+	SRP.params = params_1.params;
+	/**
+	* Calculate the SRP-6 multiplier.
+	*
+	* @param {object} params Group parameters, with .N, .g, .hash
+	* @return {BigInteger}
+	*/
+	function getk(params) {
+		return new BigInteger(crypto_1.default.createHash(params.hash).update(padToN(params.N, params)).update(padToN(params.g, params)).digest());
+	}
+	/**
+	* The server key exchange message also contains the server's public
+	* value (B).  The server calculates this value as B = k*v + g^b % N,
+	* where b is a random number that SHOULD be at least 256 bits in length
+	* and k = H(N | PAD(g)).
+	*
+	* Note: as the tests imply, the entire expression is mod N.
+	*
+	* @param {SrpParams} params Group parameters, with .N, .g, .hash
+	* @param {BigInteger} k
+	* @param {BigInteger} v Verifier (stored)
+	* @param {BigInteger} b Server secret exponent
+	* @return {Buffer} B - The server public message
+	*/
+	function getB(params, k, v, b) {
+		assertIsBigInteger(v);
+		assertIsBigInteger(k);
+		assertIsBigInteger(b);
+		return k.multiply(v).add(params.g.modPow(b, params.N)).mod(params.N).toBuffer(params.N_length_bits / 8);
+	}
+	/**
+	* The client key exchange message carries the client's public value
+	* (A).  The client calculates this value as A = g^a % N, where a is a
+	* random number that SHOULD be at least 256 bits in length.
+	*
+	* Note: for this implementation, we take that to mean 256/8 bytes.
+	*
+	* @param {object} params Group parameters, with .N, .g, .hash
+	* @param {BigInteger} a_num Client secret exponent
+	* @return {Buffer} A - The client public message
+	*/
+	function getA(params, a_num) {
+		assertIsBigInteger(a_num);
+		if (Math.ceil(a_num.toString(16).length / 2) < 32) console.warn("getA: client key length %d is less than the recommended 256 bits", a_num.bitLength());
+		return params.g.modPow(a_num, params.N).toBuffer(params.N_length_bits / 8);
+	}
+	/**
+	* getu() hashes the two public messages together, to obtain a scrambling
+	* parameter "u" which cannot be predicted by either party ahead of time.
+	* This makes it safe to use the message ordering defined in the SRP-6a
+	* paper, in which the server reveals their "B" value before the client
+	* commits to their "A" value.
+	*
+	* @param {object} params Group parameters, with .N, .g, .hash
+	* @param {Buffer} A Client ephemeral public key
+	* @param {Buffer} B Server ephemeral public key
+	* @return {BigInteger} u - Shared scrambling parameter
+	*/
+	function getu(params, A, B) {
+		assertIsBuffer(A, "A");
+		assertIsBuffer(B, "B");
+		return new BigInteger(crypto_1.default.createHash(params.hash).update(padTo(A, params.N_length_bits / 8)).update(padTo(B, params.N_length_bits / 8)).digest());
+	}
+	/**
+	* The TLS premaster secret as calculated by the client
+	*
+	* @param {SrpParams} params Group parameters, with .N, .g, .hash
+	* @param {BigInteger} k_num
+	* @param {BigInteger} x_num
+	* @param {BigInteger} a_num
+	* @param {BigInteger} B_num
+	* @param {BigInteger} u_num
+	* @return {Buffer}
+	*/
+	function client_getS(params, k_num, x_num, a_num, B_num, u_num) {
+		assertIsBigInteger(k_num);
+		assertIsBigInteger(x_num);
+		assertIsBigInteger(a_num);
+		assertIsBigInteger(B_num);
+		assertIsBigInteger(u_num);
+		if (zero.compareTo(B_num) >= 0 || params.N.compareTo(B_num) <= 0) throw new Error("invalid server-supplied \"B\", must be 1..N-1");
+		return B_num.subtract(k_num.multiply(params.g.modPow(x_num, params.N))).modPow(a_num.add(u_num.multiply(x_num)), params.N).mod(params.N).toBuffer(params.N_length_bits / 8);
+	}
+	/**
+	* The TLS premastersecret as calculated by the server
+	*
+	* @param {BigInteger} params Group parameters, with .N, .g, .hash
+	* @param {BigInteger} v_num Verifier (stored on server)
+	* @param {BigInteger} A_num Ephemeral client public key (read from client)
+	* @param {BigInteger} b_num Server ephemeral private key (generated for session)
+	* @param {BigInteger} u_num {@see getu}
+	* @return {Buffer}
+	*/
+	function server_getS(params, v_num, A_num, b_num, u_num) {
+		assertIsBigInteger(v_num);
+		assertIsBigInteger(A_num);
+		assertIsBigInteger(b_num);
+		assertIsBigInteger(u_num);
+		if (zero.compareTo(A_num) >= 0 || params.N.compareTo(A_num) <= 0) throw new Error("invalid client-supplied \"A\", must be 1..N-1");
+		return A_num.multiply(v_num.modPow(u_num, params.N)).modPow(b_num, params.N).mod(params.N).toBuffer(params.N_length_bits / 8);
+	}
+	/**
+	* Compute the shared session key K from S
+	*
+	* @param {object} params Group parameters, with .N, .g, .hash
+	* @param {Buffer} S_buf Session key
+	* @return {Buffer}
+	*/
+	function getK(params, S_buf) {
+		assertIsBuffer(S_buf, "S");
+		if (params.hash === "sha1") return Buffer.concat([crypto_1.default.createHash(params.hash).update(S_buf).update(Buffer.from([
+			0,
+			0,
+			0,
+			0
+		])).digest(), crypto_1.default.createHash(params.hash).update(S_buf).update(Buffer.from([
+			0,
+			0,
+			0,
+			1
+		])).digest()]);
+		else return crypto_1.default.createHash(params.hash).update(S_buf).digest();
+	}
+	function getM1(params, u_buf, s_buf, A_buf, B_buf, K_buf) {
+		if (arguments.length > 4) {
+			assertIsBuffer(u_buf, "identity (I)");
+			assertIsBuffer(s_buf, "salt (s)");
+			assertIsBuffer(A_buf, "client public key (A)");
+			assertIsBuffer(B_buf, "server public key (B)");
+			assertIsBuffer(K_buf, "session key (K)");
+			const hN = crypto_1.default.createHash(params.hash).update(params.N.toBuffer(true)).digest();
+			const hG = crypto_1.default.createHash(params.hash).update(params.g.toBuffer(true)).digest();
+			for (let i = 0; i < hN.length; i++) hN[i] ^= hG[i];
+			const hU = crypto_1.default.createHash(params.hash).update(u_buf).digest();
+			return crypto_1.default.createHash(params.hash).update(hN).update(hU).update(s_buf).update(A_buf).update(B_buf).update(K_buf).digest();
+		} else {
+			[A_buf, B_buf, s_buf] = [
+				u_buf,
+				s_buf,
+				A_buf
+			];
+			assertIsBuffer(A_buf, "A");
+			assertIsBuffer(B_buf, "B");
+			assertIsBuffer(s_buf, "S");
+			return crypto_1.default.createHash(params.hash).update(A_buf).update(B_buf).update(s_buf).digest();
+		}
+	}
+	function getM2(params, A_buf, M1_buf, K_buf) {
+		assertIsBuffer(A_buf, "A");
+		assertIsBuffer(M1_buf, "M1");
+		assertIsBuffer(K_buf, "K");
+		return crypto_1.default.createHash(params.hash).update(A_buf).update(M1_buf).update(K_buf).digest();
+	}
+	function equal(buf1, buf2) {
+		return buf1.toString("hex") === buf2.toString("hex");
+	}
+	var SrpClient = class {
+		/**
+		* Create an SRP client.
+		*
+		* @param {object} params Group parameters, with .N, .g, .hash
+		* @param {Buffer} salt_buf User salt (from server)
+		* @param {Buffer} identity_buf Identity/username
+		* @param {Buffer} password_buf Password
+		* @param {Buffer} secret1_buf Client private key {@see genKey}
+		* @param {boolean} hap
+		*/
+		constructor(params, salt_buf, identity_buf, password_buf, secret1_buf, hap = true) {
+			assertIsBuffer(salt_buf, "salt (s)");
+			assertIsBuffer(identity_buf, "identity (I)");
+			assertIsBuffer(password_buf, "password (P)");
+			assertIsBuffer(secret1_buf, "secret1");
+			this._params = params;
+			this._k = getk(params);
+			this._x = getx(params, salt_buf, identity_buf, password_buf);
+			this._a = new BigInteger(secret1_buf);
+			if (hap) {
+				this._I = identity_buf;
+				this._s = salt_buf;
+			}
+			this._A = getA(params, this._a);
+		}
+		/**
+		* Returns the client's public key (A).
+		*
+		* @return {Buffer}
+		*/
+		computeA() {
+			return this._A;
+		}
+		/**
+		* Sets the server's public key (B).
+		*
+		* @param {Buffer} B_buf The server's public key
+		*/
+		setB(B_buf) {
+			const u_num = getu(this._params, this._A, B_buf);
+			const S_buf_x = client_getS(this._params, this._k, this._x, this._a, new BigInteger(B_buf), u_num);
+			this._K = getK(this._params, S_buf_x);
+			this._u = u_num;
+			this._S = S_buf_x;
+			this._B = B_buf;
+			if (this._I && this._s) this._M1 = getM1(this._params, this._I, this._s, this._A, this._B, this._K);
+			else this._M1 = getM1(this._params, this._A, this._B, this._S);
+			this._M2 = getM2(this._params, this._A, this._M1, this._K);
+		}
+		/**
+		* Gets the M1 value.
+		* This requires setting the server's public key {@see Client.setB}.
+		*
+		* @return {Buffer}
+		*/
+		computeM1() {
+			if (this._M1 === void 0) throw new Error("incomplete protocol");
+			return this._M1;
+		}
+		/**
+		* Checks the server was able to calculate M2.
+		* This requires setting the server's public key {@see Client.setB}.
+		*
+		* @param M2 The server's M2 value
+		*/
+		checkM2(M2) {
+			if (!equal(this._M2, M2)) throw new Error("server is not authentic");
+		}
+		/**
+		* Returns the shared session key.
+		*
+		* @return {Buffer}
+		*/
+		computeK() {
+			if (this._K === void 0) throw new Error("incomplete protocol");
+			return this._K;
+		}
+	};
+	exports.SrpClient = SrpClient;
+	var SrpServer = class {
+		constructor(params, salt_buf, identity_buf, password_buf, secret2_buf) {
+			this._params = params;
+			this._k = getk(params);
+			if (arguments.length > 3) {
+				assertIsBuffer(salt_buf, "salt (salt)");
+				assertIsBuffer(identity_buf, "identity (I)");
+				assertIsBuffer(password_buf, "password (P)");
+				assertIsBuffer(secret2_buf, "secret2");
+				this._b = new BigInteger(secret2_buf);
+				this._v = new BigInteger(SRP.computeVerifier(params, salt_buf, identity_buf, password_buf));
+				this._I = identity_buf;
+				this._s = salt_buf;
+			} else if (salt_buf instanceof Buffer) {
+				const verifier_buf = salt_buf;
+				[secret2_buf, salt_buf, identity_buf, password_buf] = [
+					identity_buf,
+					void 0,
+					void 0,
+					void 0
+				];
+				assertIsBuffer(verifier_buf, "verifier (v)");
+				assertIsBuffer(secret2_buf, "secret2");
+				this._b = new BigInteger(secret2_buf);
+				this._v = new BigInteger(verifier_buf);
+			} else {
+				const identity = salt_buf;
+				[secret2_buf, salt_buf, identity_buf, password_buf] = [
+					identity_buf,
+					void 0,
+					void 0,
+					void 0
+				];
+				(0, assert_1.default)(identity.username instanceof Buffer || typeof identity.username === "string", "identity.username (I) must be a string or Buffer");
+				assertIsBuffer(identity.salt, "identity.salt (s)");
+				(0, assert_1.default)("password" in identity || "verifier" in identity, "identity requires a password or verifier");
+				if ("verifier" in identity) assertIsBuffer(identity.verifier, "identity.verifier (v)");
+				else (0, assert_1.default)(identity.password instanceof Buffer || typeof identity.password === "string", "identity.password (p) must be a string or Buffer");
+				assertIsBuffer(secret2_buf, "secret2");
+				const username = typeof identity.username === "string" ? Buffer.from(identity.username) : identity.username;
+				this._b = new BigInteger(secret2_buf);
+				if ("verifier" in identity) this._v = new BigInteger(identity.verifier);
+				else this._v = new BigInteger(SRP.computeVerifier(params, identity.salt, username, typeof identity.password === "string" ? Buffer.from(identity.password) : identity.password));
+				this._I = username;
+				this._s = identity.salt;
+			}
+			this._B = getB(params, this._k, this._v, this._b);
+		}
+		/**
+		* Returns the server's public key (B).
+		*
+		* @return {Buffer}
+		*/
+		computeB() {
+			return this._B;
+		}
+		/**
+		* Sets the client's public key (A).
+		*
+		* @param {Buffer} A The client's public key
+		*/
+		setA(A) {
+			const u_num = getu(this._params, A, this._B);
+			const S_buf = server_getS(this._params, this._v, new BigInteger(A), this._b, u_num);
+			this._K = getK(this._params, S_buf);
+			this._u = u_num;
+			this._S = S_buf;
+			if (this._I && this._s) this._M1 = getM1(this._params, this._I, this._s, A, this._B, this._K);
+			else this._M1 = getM1(this._params, A, this._B, this._S);
+			this._M2 = getM2(this._params, A, this._M1, this._K);
+		}
+		/**
+		* Checks the client was able to calculate M1.
+		*
+		* @param {Buffer} M1 The client's M1 value
+		*/
+		checkM1(M1) {
+			if (this._M1 === void 0) throw new Error("incomplete protocol");
+			if (!equal(this._M1, M1)) throw new Error("client did not use the same password");
+		}
+		/**
+		* Returns the shared session key.
+		*
+		* @return {Buffer}
+		*/
+		computeK() {
+			if (this._K === void 0) throw new Error("incomplete protocol");
+			return this._K;
+		}
+		/**
+		* Gets the M2 value.
+		* This requires setting the client's public key {@see Server.setA}.
+		*
+		* @return {Buffer}
+		*/
+		computeM2() {
+			if (this._M2 === void 0) throw new Error("incomplete protocol");
+			return this._M2;
+		}
+	};
+	exports.SrpServer = SrpServer;
+}));
+
+//#endregion
+//#region src/pairing/const.ts
+var import_srp = require_srp();
+/** The fixed setup code of a HAP transient pair-setup. */
+const TRANSIENT_PAIRING_PIN = "3939";
+
+//#endregion
+//#region src/pairing/client.ts
+/**
+* Runs HAP pair-setup as the controller, with SRP-6a followed by an Ed25519 identity exchange.
+*
+* A PIN pairing runs M1 to M6 and yields long-term credentials. A transient pairing stops after M4
+* with the fixed {@link TRANSIENT_PAIRING_PIN} and yields session keys only. The steps are public
+* for a caller that has to wait for the PIN between M1 and M2.
+*/
+var PairSetup = class {
+	#context;
+	#pairingId;
+	#transport;
+	#useAes;
+	#publicKey;
+	#secretKey;
+	#srp;
+	constructor(context, transport, options = {}) {
+		this.#context = context;
+		this.#pairingId = Buffer.from(randomUUID().toUpperCase());
+		this.#transport = transport;
+		this.#useAes = options.useAes ?? false;
+	}
+	/** Generates the controller's long-term Ed25519 key pair. Call before {@link pin}. */
+	async start() {
+		const keyPair = generateKeyPair();
+		this.#publicKey = Buffer.from(keyPair.publicKey);
+		this.#secretKey = Buffer.from(keyPair.secretKey);
+	}
+	/**
+	* Runs a PIN pairing from M1 to M6. It calls `askPin` after M1, once the accessory shows the PIN.
+	*
+	* @throws {PairingError} If a step fails.
+	*/
+	async pin(askPin) {
+		const m1 = await this.m1();
+		const m2 = await this.m2(m1, await askPin());
+		const m3 = await this.m3(m2);
+		const m4 = await this.m4(m3);
+		const m5 = await this.m5(m4);
+		const m6 = await this.m6(m4, m5);
+		if (!m6) throw new PairingError("Pairing failed, could not get accessory keys.");
+		return m6;
+	}
+	/** Runs a transient pairing from M1 to M4 without a PIN. The keys hold for this connection only. */
+	async transient() {
+		const m1 = await this.m1([[Value.Flags, Flags.TransientPairing]]);
+		const m2 = await this.m2(m1);
+		const m3 = await this.m3(m2);
+		const m4 = await this.m4(m3);
+		return {
+			pairingId: this.#pairingId,
+			sharedSecret: m4.sharedSecret,
+			...deriveControlKeys(m4.sharedSecret)
+		};
+	}
+	/** Asks the accessory for its SRP public key and salt. */
+	async m1(additionalTlv = []) {
+		const response = await this.#transport(encode([
+			[Value.Method, Method.PairSetup],
+			[Value.State, State.M1],
+			...additionalTlv
+		]), "m1");
+		const data = decodeTlv(this.#context, response);
+		return {
+			publicKey: data.get(Value.PublicKey),
+			salt: data.get(Value.Salt)
+		};
+	}
+	/** Computes the SRP public key and the proof that we know the PIN. Sends nothing. */
+	async m2(m1, pin = TRANSIENT_PAIRING_PIN) {
+		const srpKey = await import_srp.SRP.genKey(32);
+		this.#srp = new import_srp.SrpClient(import_srp.SRP.params.hap, m1.salt, Buffer.from("Pair-Setup"), Buffer.from(pin), srpKey, true);
+		this.#srp.setB(m1.publicKey);
+		return {
+			publicKey: this.#srp.computeA(),
+			proof: this.#srp.computeM1()
+		};
+	}
+	/** Sends our SRP public key and proof, and receives the accessory's proof. */
+	async m3(m2) {
+		const response = await this.#transport(encode([
+			[Value.State, State.M3],
+			[Value.PublicKey, m2.publicKey],
+			[Value.Proof, m2.proof]
+		]), "m3");
+		return { serverProof: decodeTlv(this.#context, response).get(Value.Proof) };
+	}
+	/** Checks the accessory's proof and derives the SRP shared secret. Sends nothing. */
+	async m4(m3) {
+		this.#srp.checkM2(m3.serverProof);
+		return { sharedSecret: this.#srp.computeK() };
+	}
+	/** Sends our signed, encrypted identity and receives the accessory's encrypted identity. */
+	async m5(m4) {
+		const iosDeviceX = deriveKey(m4.sharedSecret, "Pair-Setup-Controller-Sign-Salt", "Pair-Setup-Controller-Sign-Info");
+		const sessionKey = deriveKey(m4.sharedSecret, "Pair-Setup-Encrypt-Salt", "Pair-Setup-Encrypt-Info");
+		const cipher = pairingCipher("Pair-Setup", m4.sharedSecret, sessionKey, this.#useAes);
+		const signature = sign(Buffer.concat([
+			iosDeviceX,
+			this.#pairingId,
+			this.#publicKey
+		]), this.#secretKey);
+		const innerTlv = encode([
+			[Value.Identifier, this.#pairingId],
+			[Value.PublicKey, this.#publicKey],
+			[Value.Signature, Buffer.from(signature)],
+			[Value.Name, encode$1({ name: this.#context.identity.name ?? "CoreWire" })]
+		]);
+		const response = await this.#transport(encode([[Value.State, State.M5], [Value.EncryptedData, cipher.seal("PS-Msg05", innerTlv)]]), "m5");
+		return {
+			encryptedData: decodeTlv(this.#context, response).get(Value.EncryptedData),
+			sessionKey
+		};
+	}
+	/**
+	* Decrypts and verifies the accessory's identity from M5. Sends nothing.
+	*
+	* @throws {AuthenticationError} If the accessory signature is invalid.
+	*/
+	async m6(m4, m5) {
+		const cipher = pairingCipher("Pair-Setup", m4.sharedSecret, m5.sessionKey, this.#useAes);
+		const tlv = decode(cipher.open("PS-Msg06", m5.encryptedData));
+		const accessoryIdentifier = tlv.get(Value.Identifier);
+		const accessoryLongTermPublicKey = tlv.get(Value.PublicKey);
+		const accessorySignature = tlv.get(Value.Signature);
+		const accessoryX = deriveKey(m4.sharedSecret, "Pair-Setup-Accessory-Sign-Salt", "Pair-Setup-Accessory-Sign-Info");
+		const accessoryInfo = Buffer.concat([
+			accessoryX,
+			accessoryIdentifier,
+			accessoryLongTermPublicKey
+		]);
+		if (!verify(accessoryInfo, accessorySignature, accessoryLongTermPublicKey)) throw new AuthenticationError("Invalid accessory signature.");
+		return {
+			accessoryIdentifier: accessoryIdentifier.toString(),
+			accessoryLongTermPublicKey,
+			pairingId: this.#pairingId,
+			publicKey: this.#publicKey,
+			secretKey: this.#secretKey
+		};
+	}
+};
+/**
+* Runs HAP pair-verify as the controller. An ephemeral Curve25519 exchange proves both long-term
+* identities from an earlier pair-setup, so every session gets fresh keys without the PIN.
+*/
+var PairVerify = class {
+	#context;
+	#ephemeralKeyPair;
+	#transport;
+	#useAes;
+	constructor(context, transport, options = {}) {
+		this.#context = context;
+		this.#ephemeralKeyPair = generateKeyPair$1();
+		this.#transport = transport;
+		this.#useAes = options.useAes ?? false;
+	}
+	/**
+	* Verifies the pairing and returns the shared secret. The channel keys stay empty, because
+	* each protocol derives its own from the secret.
+	*
+	* @throws {AuthenticationError} If the accessory's identity does not match the credentials.
+	*/
+	async start(credentials) {
+		const m1 = await this.#m1();
+		const m2 = await this.#m2(credentials.accessoryIdentifier, credentials.accessoryLongTermPublicKey, m1);
+		await this.#m3(credentials.pairingId, credentials.secretKey, m2);
+		return {
+			accessoryToControllerKey: Buffer.alloc(0),
+			controllerToAccessoryKey: Buffer.alloc(0),
+			pairingId: credentials.pairingId,
+			sharedSecret: m2.sharedSecret
+		};
+	}
+	async #m1() {
+		const response = await this.#transport(encode([[Value.State, State.M1], [Value.PublicKey, Buffer.from(this.#ephemeralKeyPair.publicKey)]]), "m1");
+		const data = decodeTlv(this.#context, response);
+		return {
+			encryptedData: data.get(Value.EncryptedData),
+			serverPublicKey: data.get(Value.PublicKey)
+		};
+	}
+	/** Derives the shared secret and verifies the accessory's signed identity. Sends nothing. */
+	async #m2(localAccessoryIdentifier, longTermPublicKey, m1) {
+		const sharedSecret = Buffer.from(generateSharedSecKey(this.#ephemeralKeyPair.secretKey, m1.serverPublicKey));
+		const cipher = pairingCipher("Pair-Verify", sharedSecret, deriveKey(sharedSecret, "Pair-Verify-Encrypt-Salt", "Pair-Verify-Encrypt-Info"), this.#useAes);
+		const tlv = decode(cipher.open("PV-Msg02", m1.encryptedData));
+		const accessoryIdentifier = tlv.get(Value.Identifier);
+		const accessorySignature = tlv.get(Value.Signature);
+		if (accessoryIdentifier.toString() !== localAccessoryIdentifier) throw new AuthenticationError(`Invalid accessory identifier. Expected ${accessoryIdentifier.toString()} to be ${localAccessoryIdentifier}.`);
+		const accessoryInfo = Buffer.concat([
+			m1.serverPublicKey,
+			accessoryIdentifier,
+			this.#ephemeralKeyPair.publicKey
+		]);
+		if (!verify(accessoryInfo, accessorySignature, longTermPublicKey)) throw new AuthenticationError("Invalid accessory signature.");
+		return {
+			cipher,
+			serverEphemeralPublicKey: m1.serverPublicKey,
+			sharedSecret
+		};
+	}
+	/** Sends our signed proof. The M4 reply carries nothing we use. */
+	async #m3(pairingId, secretKey, m2) {
+		const iosDeviceInfo = Buffer.concat([
+			this.#ephemeralKeyPair.publicKey,
+			pairingId,
+			m2.serverEphemeralPublicKey
+		]);
+		const iosDeviceSignature = Buffer.from(sign(iosDeviceInfo, secretKey));
+		const innerTlv = encode([[Value.Identifier, pairingId], [Value.Signature, iosDeviceSignature]]);
+		await this.#transport(encode([[Value.State, State.M3], [Value.EncryptedData, m2.cipher.seal("PV-Msg03", innerTlv)]]), "m3");
+	}
+};
+
+//#endregion
+//#region src/pairing/server.ts
+/**
+* Answers HAP pair-setup as the accessory, M1, M3 and M5 with M2, M4 and M6. After M5,
+* {@link controller} holds the verified controller identity to persist.
+*/
+var PairSetupServer = class {
+	get controller() {
+		return this.#controller;
+	}
+	/** The SRP session key, available after M3. */
+	get sharedSecret() {
+		return this.#sharedSecret;
+	}
+	#context;
+	#identity;
+	#pin;
+	#useAes;
+	#controller;
+	#sharedSecret;
+	#srp;
+	constructor(context, identity, pin, options = {}) {
+		this.#context = context;
+		this.#identity = identity;
+		this.#pin = pin;
+		this.#useAes = options.useAes ?? false;
+	}
+	/**
+	* Answers one pair-setup request with the next message.
+	*
+	* @throws {PairingError} If the request carries an unexpected state.
+	* @throws {AuthenticationError} If the PIN proof or the controller signature is wrong.
+	*/
+	async handle(request) {
+		const data = decodeTlv(this.#context, request);
+		const state = data.get(Value.State)?.[0];
+		switch (state) {
+			case State.M1: return this.#m1();
+			case State.M3: return this.#m3(data);
+			case State.M5: return this.#m5(data);
+			default: throw new PairingError(`Unexpected pair-setup state ${state}.`);
+		}
+	}
+	async #m1() {
+		const salt = randomBytes(16);
+		const secretKey = await import_srp.SRP.genKey(32);
+		this.#srp = new import_srp.SrpServer(import_srp.SRP.params.hap, salt, Buffer.from("Pair-Setup"), Buffer.from(this.#pin), secretKey);
+		return encode([
+			[Value.State, State.M2],
+			[Value.PublicKey, this.#srp.computeB()],
+			[Value.Salt, salt]
+		]);
+	}
+	async #m3(data) {
+		this.#srp.setA(data.get(Value.PublicKey));
+		try {
+			this.#srp.checkM1(data.get(Value.Proof));
+		} catch {
+			throw new AuthenticationError("Invalid controller proof, wrong PIN.");
+		}
+		const serverProof = this.#srp.computeM2();
+		this.#sharedSecret = this.#srp.computeK();
+		return encode([[Value.State, State.M4], [Value.Proof, serverProof]]);
+	}
+	async #m5(data) {
+		const sharedSecret = this.#sharedSecret;
+		const cipher = pairingCipher("Pair-Setup", sharedSecret, deriveKey(sharedSecret, "Pair-Setup-Encrypt-Salt", "Pair-Setup-Encrypt-Info"), this.#useAes);
+		const inner = decode(cipher.open("PS-Msg05", data.get(Value.EncryptedData)));
+		const controllerIdentifier = inner.get(Value.Identifier);
+		const controllerPublicKey = inner.get(Value.PublicKey);
+		const controllerSignature = inner.get(Value.Signature);
+		const iosDeviceX = deriveKey(sharedSecret, "Pair-Setup-Controller-Sign-Salt", "Pair-Setup-Controller-Sign-Info");
+		if (!verify(Buffer.concat([
+			iosDeviceX,
+			controllerIdentifier,
+			controllerPublicKey
+		]), controllerSignature, controllerPublicKey)) throw new AuthenticationError("Invalid controller signature.");
+		this.#controller = {
+			identifier: controllerIdentifier.toString(),
+			longTermPublicKey: controllerPublicKey
+		};
+		const accessoryIdentifier = Buffer.from(this.#identity.identifier);
+		const accessoryX = deriveKey(sharedSecret, "Pair-Setup-Accessory-Sign-Salt", "Pair-Setup-Accessory-Sign-Info");
+		const accessorySignature = Buffer.from(sign(Buffer.concat([
+			accessoryX,
+			accessoryIdentifier,
+			this.#identity.publicKey
+		]), this.#identity.secretKey));
+		const innerTlv = encode([
+			[Value.Identifier, accessoryIdentifier],
+			[Value.PublicKey, this.#identity.publicKey],
+			[Value.Signature, accessorySignature]
+		]);
+		return encode([[Value.State, State.M6], [Value.EncryptedData, cipher.seal("PS-Msg06", innerTlv)]]);
+	}
+};
+/**
+* Answers HAP pair-verify as the accessory, M1 and M3 with M2 and M4. Once M3 verifies the
+* controller, {@link sharedSecret} feeds the channel key derivation.
+*/
+var PairVerifyServer = class {
+	/** The pairing identifier of the verified controller, available after M3. */
+	get pairingId() {
+		return this.#pairingId;
+	}
+	/** The Curve25519 shared secret, available after M1. */
+	get sharedSecret() {
+		return this.#sharedSecret;
+	}
+	#context;
+	#identity;
+	#resolveController;
+	#useAes;
+	#cipher;
+	#controllerPublicKey;
+	#ephemeralKeyPair;
+	#pairingId;
+	#sharedSecret;
+	constructor(context, identity, resolveController, options = {}) {
+		this.#context = context;
+		this.#identity = identity;
+		this.#resolveController = resolveController;
+		this.#useAes = options.useAes ?? false;
+	}
+	/**
+	* Answers one pair-verify request with the next message.
+	*
+	* @throws {PairingError} If the request carries an unexpected state.
+	* @throws {AuthenticationError} If the controller is unknown or its signature is wrong.
+	*/
+	async handle(request) {
+		const data = decodeTlv(this.#context, request);
+		const state = data.get(Value.State)?.[0];
+		switch (state) {
+			case State.M1: return this.#m1(data);
+			case State.M3: return this.#m3(data);
+			default: throw new PairingError(`Unexpected pair-verify state ${state}.`);
+		}
+	}
+	async #m1(data) {
+		this.#controllerPublicKey = data.get(Value.PublicKey);
+		this.#ephemeralKeyPair = generateKeyPair$1();
+		const sharedSecret = Buffer.from(generateSharedSecKey(this.#ephemeralKeyPair.secretKey, this.#controllerPublicKey));
+		const sessionKey = deriveKey(sharedSecret, "Pair-Verify-Encrypt-Salt", "Pair-Verify-Encrypt-Info");
+		this.#sharedSecret = sharedSecret;
+		this.#cipher = pairingCipher("Pair-Verify", sharedSecret, sessionKey, this.#useAes);
+		const accessoryEphemeralPublicKey = Buffer.from(this.#ephemeralKeyPair.publicKey);
+		const accessoryIdentifier = Buffer.from(this.#identity.identifier);
+		const accessoryInfo = Buffer.concat([
+			accessoryEphemeralPublicKey,
+			accessoryIdentifier,
+			this.#controllerPublicKey
+		]);
+		const accessorySignature = Buffer.from(sign(accessoryInfo, this.#identity.secretKey));
+		const innerTlv = encode([[Value.Identifier, accessoryIdentifier], [Value.Signature, accessorySignature]]);
+		return encode([
+			[Value.State, State.M2],
+			[Value.PublicKey, accessoryEphemeralPublicKey],
+			[Value.EncryptedData, this.#cipher.seal("PV-Msg02", innerTlv)]
+		]);
+	}
+	async #m3(data) {
+		const inner = decode(this.#cipher.open("PV-Msg03", data.get(Value.EncryptedData)));
+		const controllerIdentifier = inner.get(Value.Identifier);
+		const controllerSignature = inner.get(Value.Signature);
+		const longTermPublicKey = this.#resolveController(controllerIdentifier.toString());
+		if (!longTermPublicKey) throw new AuthenticationError("Unknown controller. Pair before verifying.");
+		const controllerInfo = Buffer.concat([
+			this.#controllerPublicKey,
+			controllerIdentifier,
+			Buffer.from(this.#ephemeralKeyPair.publicKey)
+		]);
+		if (!verify(controllerInfo, controllerSignature, longTermPublicKey)) throw new AuthenticationError("Invalid controller signature.");
+		this.#pairingId = controllerIdentifier;
+		return encode([[Value.State, State.M4]]);
+	}
+};
+/** Generates an accessory identity with a random MAC-style identifier and a new Ed25519 key pair. */
+function generateAccessoryIdentity() {
+	const keyPair = generateKeyPair();
+	return {
+		identifier: Array.from(randomBytes(6)).map((byte) => byte.toString(16).padStart(2, "0").toUpperCase()).join(":"),
+		publicKey: Buffer.from(keyPair.publicKey),
+		secretKey: Buffer.from(keyPair.secretKey)
+	};
+}
+
+//#endregion
+export { PairSetup, PairSetupServer, PairVerify, PairVerifyServer, TRANSIENT_PAIRING_PIN, deriveControlKeys, generateAccessoryIdentity };