@matter/protocol 0.11.0-alpha.0-20241005-e3e4e4a7a

package/dist/esm/peer/ControllerCommissioningFlow.js

@@ -0,0 +1,832 @@
+/**
+ * @license
+ * Copyright 2022-2024 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { BasicInformation } from "#clusters/basic-information";
+import { Descriptor } from "#clusters/descriptor";
+import { GeneralCommissioning } from "#clusters/general-commissioning";
+import { NetworkCommissioning } from "#clusters/network-commissioning";
+import { OperationalCredentials } from "#clusters/operational-credentials";
+import { TimeSynchronizationCluster } from "#clusters/time-synchronization";
+import { Bytes, ChannelType, Crypto, Logger, MatterError, Time, UnexpectedDataError } from "#general";
+import {
+  EndpointNumber,
+  StatusResponseError
+} from "#types";
+import { CertificateManager } from "../certificate/CertificateManager.js";
+import { ClusterClient } from "../cluster/client/ClusterClient.js";
+import { TlvCertSigningRequest } from "../common/OperationalCredentialsTypes.js";
+const logger = Logger.get("ControllerCommissioner");
+var CommissioningStepResultCode = /* @__PURE__ */ ((CommissioningStepResultCode2) => {
+  CommissioningStepResultCode2[CommissioningStepResultCode2["Success"] = 0] = "Success";
+  CommissioningStepResultCode2[CommissioningStepResultCode2["Failure"] = 1] = "Failure";
+  CommissioningStepResultCode2[CommissioningStepResultCode2["Skipped"] = 2] = "Skipped";
+  CommissioningStepResultCode2[CommissioningStepResultCode2["Stop"] = 3] = "Stop";
+  return CommissioningStepResultCode2;
+})(CommissioningStepResultCode || {});
+class CommissioningError extends MatterError {
+}
+class RecoverableCommissioningError extends CommissioningError {
+}
+const DEFAULT_FAILSAFE_TIME_MS = 6e4;
+class ControllerCommissioningFlow {
+  #interactionClient;
+  #certificateManager;
+  #fabric;
+  #transitionToCase;
+  #commissioningOptions;
+  #commissioningSteps = new Array();
+  #commissioningStepResults = /* @__PURE__ */ new Map();
+  #clusterClients = /* @__PURE__ */ new Map();
+  #commissioningStartedTime;
+  #commissioningExpiryTime;
+  #lastFailSafeTime;
+  #lastBreadcrumb = 1;
+  #collectedCommissioningData = {};
+  #failSafeTimeMs = DEFAULT_FAILSAFE_TIME_MS;
+  constructor(interactionClient, certificateManager, fabric, commissioningOptions, transitionToCase) {
+    this.#interactionClient = interactionClient;
+    this.#certificateManager = certificateManager;
+    this.#fabric = fabric;
+    this.#transitionToCase = transitionToCase;
+    this.#commissioningOptions = commissioningOptions;
+    logger.debug(`Commissioning options: ${Logger.toJSON(commissioningOptions)}`);
+    this.#initializeCommissioningSteps();
+  }
+  /**
+   * Execute the commissioning process in the defined order. The steps are sorted before execution based on the step
+   * number and sub step number.
+   * If >50% of the failsafe time has passed, the failsafe timer is re-armed (50% of 60s default are 30s and each
+   * action is allowed to take 30s at minimum based on specs).
+   */
+  async executeCommissioning() {
+    this.#sortSteps();
+    for (const step of this.#commissioningSteps) {
+      logger.info(`Executing commissioning step ${step.stepNumber}.${step.subStepNumber}: ${step.name}`);
+      try {
+        const result = await step.stepLogic();
+        this.#setCommissioningStepResult(step, result);
+        if (this.#lastFailSafeTime !== void 0) {
+          const timeSinceLastArmFailsafe = Time.nowMs() - this.#lastFailSafeTime;
+          if (this.#commissioningExpiryTime !== void 0 && Time.nowMs() > this.#commissioningExpiryTime) {
+            logger.error(
+              `Commissioning step ${step.stepNumber}.${step.subStepNumber}: ${step.name} succeeded, but commissioning took too long in general!`
+            );
+            throw new CommissioningError(`Commissioning took too long!`);
+          }
+          if (timeSinceLastArmFailsafe > this.#failSafeTimeMs / 2) {
+            logger.info(
+              `After Commissioning step ${step.stepNumber}.${step.subStepNumber}: ${step.name} succeeded, ${Math.floor(
+                timeSinceLastArmFailsafe / 1e3
+              )}s elapsed since last arm failsafe, re-arming failsafe`
+            );
+            await this.#armFailsafe();
+          }
+        }
+        if (result.code === 3 /* Stop */) {
+          break;
+        }
+      } catch (error) {
+        if (error instanceof RecoverableCommissioningError) {
+          logger.error(
+            `Commissioning step ${step.stepNumber}.${step.subStepNumber}: ${step.name} failed with recoverable error: ${error.message} ... Continuing with process`
+          );
+        } else if (error instanceof CommissioningError || error instanceof StatusResponseError) {
+          logger.error(
+            `Commissioning step ${step.stepNumber}.${step.subStepNumber}: ${step.name} failed with error: ${error.message} ... Aborting commissioning`
+          );
+          await this.#resetFailsafeTimer();
+          StatusResponseError.accept(error);
+          const commError = new CommissioningError(error.message);
+          commError.stack = error.stack;
+          throw commError;
+        } else {
+          throw error;
+        }
+      }
+    }
+  }
+  /**
+   * Helper method to create ClusterClients. If not feature specific and for the Root Endpoint they are also reused.
+   */
+  #getClusterClient(cluster, endpointId = EndpointNumber(0), isFeatureSpecific = false) {
+    if (!isFeatureSpecific && endpointId === 0) {
+      const clusterClient = this.#clusterClients.get(cluster.id);
+      if (clusterClient !== void 0) {
+        logger.debug(
+          `Returning existing cluster client for cluster ${cluster.name} (endpoint ${endpointId}, isFeatureSpecific ${isFeatureSpecific})`
+        );
+        return clusterClient;
+      }
+    }
+    logger.debug(
+      `Creating new cluster client for cluster ${cluster.name} (endpoint ${endpointId}, isFeatureSpecific ${isFeatureSpecific})`
+    );
+    const client = ClusterClient(cluster, endpointId, this.#interactionClient);
+    this.#clusterClients.set(cluster.id, client);
+    return client;
+  }
+  /**
+   * Initialize commissioning steps and add them in the default order
+   */
+  #initializeCommissioningSteps() {
+    this.#commissioningSteps.push({
+      stepNumber: 0,
+      subStepNumber: 1,
+      name: "GetInitialData",
+      stepLogic: () => this.#getInitialData()
+    });
+    this.#commissioningSteps.push({
+      stepNumber: 3,
+      subStepNumber: 1,
+      name: "GeneralCommissioning.ArmFailsafe",
+      stepLogic: () => this.#armFailsafe()
+    });
+    this.#commissioningSteps.push({
+      stepNumber: 5,
+      subStepNumber: 1,
+      name: "GeneralCommissioning.ConfigureRegulatoryInformation",
+      stepLogic: () => this.#configureRegulatoryInformation()
+    });
+    this.#commissioningSteps.push({
+      stepNumber: 5,
+      subStepNumber: 2,
+      name: "TimeSynchronization.SynchronizeTime",
+      stepLogic: () => this.#synchronizeTime()
+    });
+    this.#commissioningSteps.push({
+      stepNumber: 6,
+      subStepNumber: 1,
+      name: "OperationalCredentials.DeviceAttestation",
+      stepLogic: () => this.#deviceAttestation()
+    });
+    this.#commissioningSteps.push({
+      stepNumber: 7,
+      subStepNumber: 1,
+      name: "OperationalCredentials.Certificates",
+      stepLogic: () => this.#certificates()
+    });
+    this.#commissioningSteps.push({
+      stepNumber: 10,
+      subStepNumber: 1,
+      name: "AccessControl",
+      stepLogic: () => this.#configureAccessControlLists()
+    });
+    if (this.#interactionClient.channelType === ChannelType.BLE) {
+      this.#commissioningSteps.push({
+        stepNumber: 11,
+        subStepNumber: 1,
+        name: "NetworkCommissioning.Validate",
+        stepLogic: () => this.#validateNetwork()
+      });
+      if (this.#commissioningOptions.wifiNetwork !== void 0) {
+        this.#commissioningSteps.push({
+          stepNumber: 11,
+          subStepNumber: 2,
+          name: "NetworkCommissioning.Wifi",
+          stepLogic: () => this.#configureNetworkWifi()
+        });
+      }
+      if (this.#commissioningOptions.threadNetwork !== void 0) {
+        this.#commissioningSteps.push({
+          stepNumber: 11,
+          subStepNumber: 3,
+          name: "NetworkCommissioning.Thread",
+          stepLogic: () => this.#configureNetworkThread()
+        });
+      }
+    } else {
+      logger.info(
+        `Skipping NetworkCommissioning steps because the device is already on IP network (${this.#interactionClient.channelType})`
+      );
+    }
+    this.#commissioningSteps.push({
+      stepNumber: 12,
+      subStepNumber: 1,
+      name: "Reconnect",
+      stepLogic: () => this.#reconnectWithDevice()
+    });
+    this.#commissioningSteps.push({
+      stepNumber: 15,
+      subStepNumber: 1,
+      name: "GeneralCommissioning.Complete",
+      stepLogic: () => this.#completeCommissioning()
+    });
+  }
+  #sortSteps() {
+    this.#commissioningSteps.sort((a, b) => {
+      if (a.stepNumber !== b.stepNumber) return a.stepNumber - b.stepNumber;
+      return a.subStepNumber - b.subStepNumber;
+    });
+  }
+  #setCommissioningStepResult(step, result) {
+    this.#commissioningStepResults.set(`${step.stepNumber}-${step.subStepNumber}`, result);
+  }
+  getCommissioningStepResult(stepNumber, subStepNumber) {
+    return this.#commissioningStepResults.get(`${stepNumber}-${subStepNumber}`);
+  }
+  /** Helper method to check for errorCode/debugTest responses and throw error on failure */
+  #ensureOperationalCredentialsSuccess(context, { statusCode, debugText, fabricIndex }) {
+    logger.debug(
+      `Commissioning step ${context} returned ${statusCode}, ${debugText}${fabricIndex !== void 0 ? `, fabricIndex: ${fabricIndex}` : ""}`
+    );
+    if (statusCode === OperationalCredentials.NodeOperationalCertStatus.Ok) return;
+    throw new CommissioningError(
+      `Commission error for "${context}": ${statusCode}, ${debugText}${fabricIndex !== void 0 ? `, fabricIndex: ${fabricIndex}` : ""}`
+    );
+  }
+  /** Helper method to check for errorCode/debugTest responses and throw error on failure */
+  #ensureGeneralCommissioningSuccess(context, { errorCode, debugText }) {
+    logger.debug(`Commissioning step ${context} returned ${errorCode}, ${debugText}`);
+    if (errorCode === GeneralCommissioning.CommissioningError.Ok) return;
+    throw new CommissioningError(`Commission error for "${context}": ${errorCode}, ${debugText}`);
+  }
+  /**
+   * Initial Step to receive some common data used by other steps
+   */
+  async #getInitialData() {
+    const descriptorClient = this.#getClusterClient(Descriptor.Cluster);
+    this.#collectedCommissioningData.rootPartsList = await descriptorClient.getPartsListAttribute();
+    this.#collectedCommissioningData.rootServerList = await descriptorClient.getServerListAttribute();
+    const networkData = await this.#interactionClient.getMultipleAttributes({
+      attributes: [
+        {
+          clusterId: NetworkCommissioning.Complete.id,
+          attributeId: NetworkCommissioning.Complete.attributes.featureMap.id
+        },
+        {
+          clusterId: NetworkCommissioning.Complete.id,
+          attributeId: NetworkCommissioning.Complete.attributes.networks.id
+        }
+      ]
+    });
+    const networkFeatures = new Array();
+    const networkStatus = new Array();
+    for (const {
+      path: { endpointId, attributeId },
+      value
+    } of networkData) {
+      if (attributeId === NetworkCommissioning.Complete.attributes.featureMap.id) {
+        networkFeatures.push({ endpointId, value });
+      } else if (attributeId === NetworkCommissioning.Complete.attributes.networks.id) {
+        networkStatus.push({ endpointId, value });
+      }
+    }
+    this.#collectedCommissioningData.networkFeatures = networkFeatures;
+    this.#collectedCommissioningData.networkStatus = networkStatus;
+    const basicInfoClient = this.#getClusterClient(BasicInformation.Cluster);
+    this.#collectedCommissioningData.vendorId = await basicInfoClient.getVendorIdAttribute();
+    this.#collectedCommissioningData.productId = await basicInfoClient.getProductIdAttribute();
+    this.#collectedCommissioningData.productName = await basicInfoClient.getProductNameAttribute();
+    const generalCommissioningClient = this.#getClusterClient(GeneralCommissioning.Cluster);
+    this.#collectedCommissioningData.supportsConcurrentConnection = await generalCommissioningClient.getSupportsConcurrentConnectionAttribute();
+    return {
+      code: 0 /* Success */,
+      breadcrumb: this.#lastBreadcrumb
+    };
+  }
+  /**
+   * Step 3
+   * Upon completion of PASE session establishment, the Commissionee SHALL autonomously arm the Fail-safe timer for a
+   * timeout of 60 seconds. This is to guard against the Commissioner aborting the Commissioning process without
+   * arming the fail-safe, which may leave the device unable to accept additional connections.
+   * A Commissioner MAY obtain device information including guidance on the fail-safe value from the Commissionee by
+   * reading BasicCommissioningInfo attribute (see Section 11.9.5.2, “BasicCommissioningInfo Attribute”) prior to
+   * invoking the ArmFailSafe command.
+   */
+  async #armFailsafe() {
+    const client = this.#getClusterClient(GeneralCommissioning.Cluster);
+    if (this.#collectedCommissioningData.basicCommissioningInfo === void 0) {
+      const basicCommissioningInfo = await client.getBasicCommissioningInfoAttribute();
+      this.#collectedCommissioningData.basicCommissioningInfo = basicCommissioningInfo;
+      this.#failSafeTimeMs = basicCommissioningInfo.failSafeExpiryLengthSeconds * 1e3;
+      this.#commissioningStartedTime = Time.nowMs();
+      this.#commissioningExpiryTime = this.#commissioningStartedTime + basicCommissioningInfo.maxCumulativeFailsafeSeconds * 1e3;
+    }
+    this.#ensureGeneralCommissioningSuccess(
+      "armFailSafe",
+      await client.armFailSafe({
+        breadcrumb: this.#lastBreadcrumb,
+        expiryLengthSeconds: this.#collectedCommissioningData.basicCommissioningInfo?.failSafeExpiryLengthSeconds
+      })
+    );
+    this.#lastFailSafeTime = Time.nowMs();
+    return {
+      code: 0 /* Success */,
+      breadcrumb: this.#lastBreadcrumb
+    };
+  }
+  async #resetFailsafeTimer() {
+    try {
+      const client = this.#getClusterClient(GeneralCommissioning.Cluster);
+      await client.armFailSafe({
+        breadcrumb: this.#lastBreadcrumb,
+        expiryLengthSeconds: 0
+      });
+    } catch (error) {
+      logger.error(`Error while resetting failsafe timer`, error);
+    }
+  }
+  /**
+   * Step 5 - 1
+   * Commissioner SHALL configure regulatory information in the Commissionee if it has at least one instance of
+   * Network Commissioning cluster on any endpoint with either the WI (i.e. Wi-Fi) or TH (i.e. Thread) feature flags
+   * set in its FeatureMap.
+   * The regulatory information is configured using SetRegulatoryConfig (see Section 11.9.6.4,
+   * “SetRegulatoryConfig Command”).
+   */
+  async #configureRegulatoryInformation() {
+    if (this.#collectedCommissioningData.networkFeatures === void 0) {
+      throw new CommissioningError("No network features collected. This should never happen.");
+    }
+    const hasRadioNetwork = this.#collectedCommissioningData.networkFeatures.some(
+      ({ value: { wiFiNetworkInterface, threadNetworkInterface } }) => wiFiNetworkInterface || threadNetworkInterface
+    );
+    if (hasRadioNetwork) {
+      const client = this.#getClusterClient(GeneralCommissioning.Cluster);
+      let locationCapability = await client.getLocationCapabilityAttribute();
+      if (locationCapability === GeneralCommissioning.RegulatoryLocationType.IndoorOutdoor) {
+        locationCapability = this.#commissioningOptions.regulatoryLocation;
+      } else {
+        logger.debug(
+          `Device does not support a configurable regulatory location type. Location is set to "${locationCapability === GeneralCommissioning.RegulatoryLocationType.Indoor ? "Indoor" : "Outdoor"}"`
+        );
+      }
+      let countryCode = this.#commissioningOptions.regulatoryCountryCode;
+      const regulatoryResult = await client.setRegulatoryConfig(
+        {
+          breadcrumb: this.#lastBreadcrumb++,
+          newRegulatoryConfig: locationCapability,
+          countryCode
+        },
+        { useExtendedFailSafeMessageResponseTimeout: true }
+      );
+      if (regulatoryResult.errorCode === GeneralCommissioning.CommissioningError.ValueOutsideRange && countryCode !== "XX") {
+        logger.debug(
+          `Device does not support a configurable country code. Use "XX" instead of "${countryCode}"`
+        );
+        countryCode = "XX";
+        this.#ensureGeneralCommissioningSuccess(
+          "setRegulatoryConfig",
+          await client.setRegulatoryConfig(
+            {
+              breadcrumb: this.#lastBreadcrumb,
+              newRegulatoryConfig: locationCapability,
+              countryCode
+            },
+            { useExtendedFailSafeMessageResponseTimeout: true }
+          )
+        );
+      } else {
+        this.#ensureGeneralCommissioningSuccess("setRegulatoryConfig", regulatoryResult);
+      }
+      return {
+        code: 0 /* Success */,
+        breadcrumb: this.#lastBreadcrumb
+      };
+    }
+    return {
+      code: 2 /* Skipped */,
+      breadcrumb: this.#lastBreadcrumb
+    };
+  }
+  /**
+   * Step 5 - 2
+   * Commissioner SHOULD configure UTC time, timezone, and DST offset, if the Commissionee supports the time cluster.
+   * The order of configuration of this information is not critical. The UTC time is configured using SetUtcTime
+   * command (see Section 11.16.9.1, “SetUtcTime Command”) while timezone and DST offset are set through TimeZone
+   * (see Section 11.16.8.6, “TimeZone Attribute”) and DstOffset attribute (see Section 11.16.8.7,
+   * “DSTOffset Attribute”), respectively.
+   */
+  async #synchronizeTime() {
+    if (this.#collectedCommissioningData.rootServerList !== void 0 && this.#collectedCommissioningData.rootServerList.find(
+      (clusterId) => clusterId === TimeSynchronizationCluster.id
+    )) {
+      logger.debug("TimeSynchronization cluster is supported");
+    }
+    return {
+      code: 2 /* Skipped */,
+      breadcrumb: this.#lastBreadcrumb
+    };
+  }
+  /**
+   * Step 6
+   * Commissioner SHALL establish the authenticity of the Commissionee as a certified Matter device (see Section
+   * 6.2.3, “Device Attestation Procedure”).
+   */
+  async #deviceAttestation() {
+    const operationalCredentialsClusterClient = this.#getClusterClient(OperationalCredentials.Cluster);
+    const { certificate: deviceAttestation } = await operationalCredentialsClusterClient.certificateChainRequest(
+      {
+        certificateType: OperationalCredentials.CertificateChainType.DacCertificate
+      },
+      { useExtendedFailSafeMessageResponseTimeout: true }
+    );
+    const { certificate: productAttestation } = await operationalCredentialsClusterClient.certificateChainRequest(
+      {
+        certificateType: OperationalCredentials.CertificateChainType.PaiCertificate
+      },
+      { useExtendedFailSafeMessageResponseTimeout: true }
+    );
+    const { attestationElements, attestationSignature } = await operationalCredentialsClusterClient.attestationRequest(
+      {
+        attestationNonce: Crypto.getRandomData(32)
+      },
+      { useExtendedFailSafeMessageResponseTimeout: true }
+    );
+    if (deviceAttestation.length === 0 || productAttestation.length === 0 || attestationElements.length === 0 || attestationSignature.length === 0) {
+      throw new CommissioningError("Device Attestation data missing from device");
+    }
+    return {
+      code: 0 /* Success */,
+      breadcrumb: this.#lastBreadcrumb
+    };
+  }
+  /**
+   * Step 7-9
+   * 7: Following the Device Attestation Procedure yielding a decision to proceed with commissioning, the Commissioner
+   * SHALL request operational CSR from Commissionee using the CSRRequest command (see Section 11.17.6.5,
+   * “CSRRequest Command”). The CSRRequest command will cause the generation of a new operational key pair at the
+   * Commissionee.
+   * 8: Commissioner SHALL generate or otherwise obtain an Operational Certificate containing Operational ID after
+   * receiving the CSRResponse command from the Commissionee (see Section 11.17.6.5, “CSRRequest Command”), using
+   * implementation-specific means.
+   * 9: Commissioner SHALL install operational credentials (see Figure 38, “Node Operational Credentials flow”) on
+   * the Commissionee using the AddTrustedRootCertificate and AddNOC commands.
+   */
+  async #certificates() {
+    const operationalCredentialsClusterClient = this.#getClusterClient(OperationalCredentials.Cluster);
+    const { nocsrElements, attestationSignature: csrSignature } = await operationalCredentialsClusterClient.csrRequest(
+      { csrNonce: Crypto.getRandomData(32) },
+      { useExtendedFailSafeMessageResponseTimeout: true }
+    );
+    if (nocsrElements.length === 0 || csrSignature.length === 0) {
+      throw new UnexpectedDataError("Invalid response from device");
+    }
+    const { certSigningRequest } = TlvCertSigningRequest.decode(nocsrElements);
+    const operationalPublicKey = CertificateManager.getPublicKeyFromCsr(certSigningRequest);
+    await operationalCredentialsClusterClient.addTrustedRootCertificate(
+      {
+        rootCaCertificate: this.#certificateManager.rootCert
+      },
+      { useExtendedFailSafeMessageResponseTimeout: true }
+    );
+    const peerOperationalCert = this.#certificateManager.generateNoc(
+      operationalPublicKey,
+      this.#fabric.fabricId,
+      this.#interactionClient.address.nodeId
+    );
+    this.#ensureOperationalCredentialsSuccess(
+      "addNoc",
+      await operationalCredentialsClusterClient.addNoc(
+        {
+          nocValue: peerOperationalCert,
+          icacValue: new Uint8Array(0),
+          ipkValue: this.#fabric.identityProtectionKey,
+          adminVendorId: this.#fabric.rootVendorId,
+          caseAdminSubject: this.#fabric.rootNodeId
+        },
+        { useExtendedFailSafeMessageResponseTimeout: true }
+      )
+    );
+    return {
+      code: 0 /* Success */,
+      breadcrumb: this.#lastBreadcrumb
+    };
+  }
+  /**
+   * Step 10
+   * Commissioner MAY configure the Access Control List (see Access Control Cluster) on the Commissionee in any way
+   * it sees fit, if the singular entry added by the AddNOC command in the previous step granting Administer
+   * privilege over CASE authentication type for the Node ID provided with the command is not sufficient to express
+   * its desired access control policies.
+   */
+  async #configureAccessControlLists() {
+    return {
+      code: 2 /* Skipped */,
+      breadcrumb: this.#lastBreadcrumb
+    };
+  }
+  /**
+   * Step 11-12
+   * 11: If the Commissionee both supports it and requires it, the Commissioner SHALL configure the operational network
+   * at the Commissionee using commands such as AddOrUpdateWiFiNetwork (see Section 11.8.7.3, “AddOrUpdateWiFiNetwork
+   * Command”) and AddOrUpdateThreadNetwork (see Section 11.8.7.4, “AddOrUpdateThreadNetwork Command”).
+   * A Commissionee requires network commissioning if it is not already on the desired operational network.
+   * A Commissionee supports network commissioning if it has any NetworkCommissioning cluster instances.
+   * A Commissioner MAY learn about the networks visible to the Commissionee using ScanNetworks command
+   * (see Section 11.8.7.1, “ScanNetworks Command”).
+   * 12: The Commissioner SHALL trigger the Commissionee to connect to the operational network using ConnectNetwork
+   * command (see Section 11.8.7.9, “ConnectNetwork Command”) unless the Commissionee is already on the desired operational network.
+   */
+  async #validateNetwork() {
+    if (this.#collectedCommissioningData.networkFeatures === void 0 || this.#collectedCommissioningData.networkStatus === void 0) {
+      throw new CommissioningError("No network features or status collected. This should never happen.");
+    }
+    if (this.#commissioningOptions.wifiNetwork === void 0 && this.#commissioningOptions.threadNetwork === void 0) {
+      const anyEthernetInterface = this.#collectedCommissioningData.networkFeatures.length === 0 || this.#collectedCommissioningData.networkFeatures.some(
+        ({ value: { ethernetNetworkInterface } }) => ethernetNetworkInterface === true
+      );
+      const anyInterfaceConnected = this.#collectedCommissioningData.networkStatus.length === 0 || this.#collectedCommissioningData.networkStatus.some(
+        ({ value }) => value.some(({ connected }) => connected)
+      );
+      if (!anyEthernetInterface && !anyInterfaceConnected) {
+        throw new CommissioningError(
+          "No Wi-Fi/Thread network credentials are configured for commissioning and no Ethernet interface is available on the device and no interface already connected."
+        );
+      }
+    }
+    return {
+      code: 0 /* Success */,
+      breadcrumb: this.#lastBreadcrumb
+    };
+  }
+  async #configureNetworkWifi() {
+    if (this.#commissioningOptions.wifiNetwork === void 0) {
+      logger.debug("WiFi network is not configured");
+      return {
+        code: 2 /* Skipped */,
+        breadcrumb: this.#lastBreadcrumb
+      };
+    }
+    if (this.#collectedCommissioningData.networkFeatures !== void 0 && this.#collectedCommissioningData.networkStatus !== void 0) {
+      const rootNetworkFeatures = this.#collectedCommissioningData.networkFeatures.find(
+        ({ endpointId }) => endpointId === 0
+      )?.value;
+      const rootNetworkStatus = this.#collectedCommissioningData.networkStatus.find(
+        ({ endpointId }) => endpointId === 0
+      )?.value;
+      logger.debug(
+        `Root Networks found: ${Logger.toJSON(rootNetworkFeatures)} - ${Logger.toJSON(rootNetworkStatus)}`
+      );
+      if (rootNetworkFeatures?.wiFiNetworkInterface !== true) {
+        logger.debug("Commissionee does not support any WiFi network interface");
+        return {
+          code: 2 /* Skipped */,
+          breadcrumb: this.#lastBreadcrumb
+        };
+      }
+      if (rootNetworkStatus !== void 0 && rootNetworkStatus.length > 0 && rootNetworkStatus[0].connected) {
+        logger.debug("Commissionee is already connected to the WiFi network");
+        this.#collectedCommissioningData.successfullyConnectedToNetwork = true;
+        return {
+          code: 2 /* Skipped */,
+          breadcrumb: this.#lastBreadcrumb
+        };
+      }
+    }
+    logger.debug("Configuring WiFi network ...");
+    const networkCommissioningClusterClient = this.#getClusterClient(
+      NetworkCommissioning.Cluster.with("WiFiNetworkInterface"),
+      EndpointNumber(0),
+      true
+    );
+    const ssid = Bytes.fromString(this.#commissioningOptions.wifiNetwork.wifiSsid);
+    const credentials = Bytes.fromString(this.#commissioningOptions.wifiNetwork.wifiCredentials);
+    const { networkingStatus, wiFiScanResults, debugText } = await networkCommissioningClusterClient.scanNetworks(
+      {
+        ssid,
+        breadcrumb: this.#lastBreadcrumb++
+      },
+      { useExtendedFailSafeMessageResponseTimeout: true }
+    );
+    if (networkingStatus !== NetworkCommissioning.NetworkCommissioningStatus.Success) {
+      throw new CommissioningError(`Commissionee failed to scan for WiFi networks: ${debugText}`);
+    }
+    if (wiFiScanResults === void 0 || wiFiScanResults.length === 0) {
+      throw new CommissioningError(
+        `Commissionee did not return any WiFi networks for the requested SSID ${this.#commissioningOptions.wifiNetwork.wifiSsid}`
+      );
+    }
+    const {
+      networkingStatus: addNetworkingStatus,
+      debugText: addDebugText,
+      networkIndex
+    } = await networkCommissioningClusterClient.addOrUpdateWiFiNetwork(
+      {
+        ssid,
+        credentials,
+        breadcrumb: this.#lastBreadcrumb++
+      },
+      { useExtendedFailSafeMessageResponseTimeout: true }
+    );
+    if (addNetworkingStatus !== NetworkCommissioning.NetworkCommissioningStatus.Success) {
+      throw new CommissioningError(`Commissionee failed to add WiFi network: ${addDebugText}`);
+    }
+    if (networkIndex === void 0) {
+      throw new CommissioningError(`Commissionee did not return network index`);
+    }
+    logger.debug(
+      `Commissionee added WiFi network ${this.#commissioningOptions.wifiNetwork.wifiSsid} with network index ${networkIndex}`
+    );
+    const updatedNetworks = await networkCommissioningClusterClient.getNetworksAttribute();
+    if (updatedNetworks[networkIndex] === void 0) {
+      throw new CommissioningError(`Commissionee did not return network with index ${networkIndex}`);
+    }
+    const { networkId, connected } = updatedNetworks[networkIndex];
+    if (connected) {
+      this.#collectedCommissioningData.successfullyConnectedToNetwork = true;
+      logger.debug(
+        `Commissionee is already connected to WiFi network ${this.#commissioningOptions.wifiNetwork.wifiSsid} (networkId ${Bytes.toHex(networkId)})`
+      );
+      return {
+        code: 0 /* Success */,
+        breadcrumb: this.#lastBreadcrumb
+      };
+    }
+    const connectResult = await networkCommissioningClusterClient.connectNetwork(
+      {
+        networkId,
+        breadcrumb: this.#lastBreadcrumb++
+      },
+      { useExtendedFailSafeMessageResponseTimeout: true }
+    );
+    if (connectResult.networkingStatus !== NetworkCommissioning.NetworkCommissioningStatus.Success) {
+      throw new CommissioningError(`Commissionee failed to connect to WiFi network: ${connectResult.debugText}`);
+    }
+    this.#collectedCommissioningData.successfullyConnectedToNetwork = true;
+    logger.debug(
+      `Commissionee successfully connected to WiFi network ${this.#commissioningOptions.wifiNetwork.wifiSsid} (networkId ${Bytes.toHex(networkId)})`
+    );
+    return {
+      code: 0 /* Success */,
+      breadcrumb: this.#lastBreadcrumb
+    };
+  }
+  async #configureNetworkThread() {
+    if (this.#collectedCommissioningData.successfullyConnectedToNetwork) {
+      logger.debug("Node is already connected to a network. Skipping Thread configuration.");
+      return {
+        code: 2 /* Skipped */,
+        breadcrumb: this.#lastBreadcrumb
+      };
+    }
+    if (this.#commissioningOptions.threadNetwork === void 0) {
+      logger.debug("Thread network is not configured");
+      return {
+        code: 2 /* Skipped */,
+        breadcrumb: this.#lastBreadcrumb
+      };
+    }
+    if (this.#collectedCommissioningData.networkFeatures !== void 0 && this.#collectedCommissioningData.networkStatus !== void 0) {
+      const rootNetworkFeatures = this.#collectedCommissioningData.networkFeatures.find(
+        ({ endpointId }) => endpointId === 0
+      )?.value;
+      const rootNetworkStatus = this.#collectedCommissioningData.networkStatus.find(
+        ({ endpointId }) => endpointId === 0
+      )?.value;
+      logger.debug(
+        `Root Networks found: ${Logger.toJSON(rootNetworkFeatures)} - ${Logger.toJSON(rootNetworkStatus)}`
+      );
+      if (rootNetworkFeatures?.threadNetworkInterface !== true) {
+        logger.debug("Commissionee does not support any Thread network interface");
+        return {
+          code: 2 /* Skipped */,
+          breadcrumb: this.#lastBreadcrumb
+        };
+      }
+      if (rootNetworkStatus !== void 0 && rootNetworkStatus.length > 0 && rootNetworkStatus[0].connected) {
+        logger.debug("Commissionee is already connected to the Thread network");
+        return {
+          code: 2 /* Skipped */,
+          breadcrumb: this.#lastBreadcrumb
+        };
+      }
+    }
+    logger.debug("Configuring Thread network ...");
+    const networkCommissioningClusterClient = this.#getClusterClient(
+      NetworkCommissioning.Cluster.with("ThreadNetworkInterface"),
+      EndpointNumber(0),
+      true
+    );
+    const { networkingStatus, threadScanResults, debugText } = await networkCommissioningClusterClient.scanNetworks(
+      { breadcrumb: this.#lastBreadcrumb++ },
+      { useExtendedFailSafeMessageResponseTimeout: true }
+    );
+    if (networkingStatus !== NetworkCommissioning.NetworkCommissioningStatus.Success) {
+      throw new CommissioningError(`Commissionee failed to scan for Thread networks: ${debugText}`);
+    }
+    if (threadScanResults === void 0 || threadScanResults.length === 0) {
+      throw new CommissioningError(
+        `Commissionee did not return any Thread networks for the requested Network ${this.#commissioningOptions.threadNetwork.networkName}`
+      );
+    }
+    const wantedNetworkFound = threadScanResults.find(
+      ({ networkName }) => networkName === this.#commissioningOptions.threadNetwork?.networkName
+    );
+    if (wantedNetworkFound === void 0) {
+      throw new CommissioningError(
+        `Commissionee did not return the requested Network ${this.#commissioningOptions.threadNetwork.networkName}: ${Logger.toJSON(threadScanResults)}`
+      );
+    }
+    logger.debug(
+      `Commissionee found wanted Thread network ${this.#commissioningOptions.threadNetwork.networkName}: ${Logger.toJSON(wantedNetworkFound)}`
+    );
+    const {
+      networkingStatus: addNetworkingStatus,
+      debugText: addDebugText,
+      networkIndex
+    } = await networkCommissioningClusterClient.addOrUpdateThreadNetwork(
+      {
+        operationalDataset: Bytes.fromHex(this.#commissioningOptions.threadNetwork.operationalDataset),
+        breadcrumb: this.#lastBreadcrumb++
+      },
+      { useExtendedFailSafeMessageResponseTimeout: true }
+    );
+    if (addNetworkingStatus !== NetworkCommissioning.NetworkCommissioningStatus.Success) {
+      throw new CommissioningError(`Commissionee failed to add Thread network: ${addDebugText}`);
+    }
+    if (networkIndex === void 0) {
+      throw new CommissioningError(`Commissionee did not return network index`);
+    }
+    logger.debug(
+      `Commissionee added Thread network ${this.#commissioningOptions.threadNetwork.networkName} with network index ${networkIndex}`
+    );
+    const updatedNetworks = await networkCommissioningClusterClient.getNetworksAttribute();
+    if (updatedNetworks[networkIndex] === void 0) {
+      throw new CommissioningError(`Commissionee did not return network with index ${networkIndex}`);
+    }
+    const { networkId, connected } = updatedNetworks[networkIndex];
+    if (connected) {
+      logger.debug(
+        `Commissionee is already connected to Thread network ${this.#commissioningOptions.threadNetwork.networkName} (networkId ${Bytes.toHex(networkId)})`
+      );
+      return {
+        code: 0 /* Success */,
+        breadcrumb: this.#lastBreadcrumb
+      };
+    }
+    const connectResult = await networkCommissioningClusterClient.connectNetwork(
+      {
+        networkId,
+        breadcrumb: this.#lastBreadcrumb++
+      },
+      { useExtendedFailSafeMessageResponseTimeout: true }
+    );
+    if (connectResult.networkingStatus !== NetworkCommissioning.NetworkCommissioningStatus.Success) {
+      throw new CommissioningError(
+        `Commissionee failed to connect to Thread network: ${connectResult.debugText}`
+      );
+    }
+    logger.debug(
+      `Commissionee successfully connected to Thread network ${this.#commissioningOptions.threadNetwork.networkName} (networkId ${Bytes.toHex(networkId)})`
+    );
+    return {
+      code: 0 /* Success */,
+      breadcrumb: this.#lastBreadcrumb
+    };
+  }
+  /**
+   * Step 13-14
+   * 13: Finalization of the Commissioning process begins. An Administrator configured in the ACL of the Commissionee
+   * by the Commissioner SHALL use Operational Discovery to discover the Commissionee. This Administrator MAY be
+   * the Commissioner itself, or another Node to which the Commissioner has delegated the task.
+   * 14: The Administrator SHALL open a CASE (see Section 4.13.2, “Certificate Authenticated Session Establishment
+   * (CASE)”) session with the Commissionee over the operational network.
+   *
+   */
+  async #reconnectWithDevice() {
+    logger.debug("Reconnecting with device ...");
+    const transitionResult = await this.#transitionToCase(this.#interactionClient.address);
+    if (transitionResult === void 0) {
+      logger.debug("CASE commissioning handled externally, terminating commissioning flow");
+      return {
+        code: 3 /* Stop */,
+        breadcrumb: this.#lastBreadcrumb
+      };
+    }
+    this.#interactionClient = transitionResult;
+    this.#clusterClients.clear();
+    logger.debug("Successfully reconnected with device ...");
+    return {
+      code: 0 /* Success */,
+      breadcrumb: this.#lastBreadcrumb
+    };
+  }
+  /**
+   * Step 15
+   * The Administrator having established a CASE session with the Commissionee over the operational network in the
+   * previous steps SHALL invoke the CommissioningComplete command (see Section 11.9.6.6,
+   * “CommissioningComplete Command”). A success response after invocation of the CommissioningComplete command ends
+   * the commissioning process.
+   */
+  async #completeCommissioning() {
+    const generalCommissioningClusterClient = this.#getClusterClient(GeneralCommissioning.Cluster);
+    this.#ensureGeneralCommissioningSuccess(
+      "commissioningComplete",
+      await generalCommissioningClusterClient.commissioningComplete(void 0, {
+        useExtendedFailSafeMessageResponseTimeout: true
+      })
+    );
+    return {
+      code: 0 /* Success */,
+      breadcrumb: this.#lastBreadcrumb
+    };
+  }
+}
+export {
+  CommissioningError,
+  ControllerCommissioningFlow
+};
+//# sourceMappingURL=ControllerCommissioningFlow.js.map