@matter/protocol 0.11.0-alpha.0-20241005-e3e4e4a7a

package/dist/esm/securechannel/SecureChannelStatusMessageSchema.js

@@ -0,0 +1,33 @@
+/**
+ * @license
+ * Copyright 2022-2024 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { DataReader, DataWriter, Endian } from "#general";
+import { Schema } from "#types";
+class SecureChannelStatusMessageSchema extends Schema {
+  encodeInternal({ generalStatus, protocolId, protocolStatus, protocolData }) {
+    const writer = new DataWriter(Endian.Little);
+    writer.writeUInt16(generalStatus);
+    writer.writeUInt32(protocolId);
+    writer.writeUInt16(protocolStatus);
+    if (protocolData !== void 0 && protocolData.length > 0) {
+      writer.writeByteArray(protocolData);
+    }
+    return writer.toByteArray();
+  }
+  decodeInternal(bytes) {
+    const reader = new DataReader(bytes, Endian.Little);
+    const generalStatus = reader.readUInt16();
+    const protocolId = reader.readUInt32();
+    const protocolStatus = reader.readUInt16();
+    const remainingBytes = reader.getRemainingBytesCount() > 0 ? reader.getRemainingBytes() : void 0;
+    return { generalStatus, protocolId, protocolStatus, remainingBytes };
+  }
+}
+const TlvSecureChannelStatusMessage = new SecureChannelStatusMessageSchema();
+export {
+  SecureChannelStatusMessageSchema,
+  TlvSecureChannelStatusMessage
+};
+//# sourceMappingURL=SecureChannelStatusMessageSchema.js.map

package/dist/esm/securechannel/SecureChannelStatusMessageSchema.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": ["../../../src/securechannel/SecureChannelStatusMessageSchema.ts"],
+  "mappings": "AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,SAAS,YAAY,YAAY,cAAc;AAC/C,SAAgD,cAAc;AASvD,MAAM,yCAAyC,OAAkC;AAAA,EACpF,eAAe,EAAE,eAAe,YAAY,gBAAgB,aAAa,GAAkB;AACvF,UAAM,SAAS,IAAI,WAAW,OAAO,MAAM;AAC3C,WAAO,YAAY,aAAa;AAChC,WAAO,YAAY,UAAU;AAC7B,WAAO,YAAY,cAAc;AACjC,QAAI,iBAAiB,UAAa,aAAa,SAAS,GAAG;AACvD,aAAO,eAAe,YAAY;AAAA,IACtC;AACA,WAAO,OAAO,YAAY;AAAA,EAC9B;AAAA,EAEA,eAAe,OAAmB;AAC9B,UAAM,SAAS,IAAI,WAAW,OAAO,OAAO,MAAM;AAClD,UAAM,gBAAgB,OAAO,WAAW;AACxC,UAAM,aAAa,OAAO,WAAW;AACrC,UAAM,iBAAiB,OAAO,WAAW;AACzC,UAAM,iBAAiB,OAAO,uBAAuB,IAAI,IAAI,OAAO,kBAAkB,IAAI;AAE1F,WAAO,EAAE,eAAe,YAAY,gBAAgB,eAAe;AAAA,EACvE;AACJ;AAEO,MAAM,gCAAgC,IAAI,iCAAiC;",
+  "names": []
+}

package/dist/esm/securechannel/index.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @license
+ * Copyright 2022-2024 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+export * from "./SecureChannelMessenger.js";
+export * from "./SecureChannelProtocol.js";
+export * from "./SecureChannelStatusMessageSchema.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/securechannel/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/securechannel/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,cAAc,6BAA6B,CAAC;AAC5C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,uCAAuC,CAAC"}

package/dist/esm/securechannel/index.js

@@ -0,0 +1,9 @@
+/**
+ * @license
+ * Copyright 2022-2024 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+export * from "./SecureChannelMessenger.js";
+export * from "./SecureChannelProtocol.js";
+export * from "./SecureChannelStatusMessageSchema.js";
+//# sourceMappingURL=index.js.map

package/dist/esm/securechannel/index.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": ["../../../src/securechannel/index.ts"],
+  "mappings": "AAAA;AAAA;AAAA;AAAA;AAAA;AAOA,cAAc;AACd,cAAc;AACd,cAAc;",
+  "names": []
+}

package/dist/esm/session/InsecureSession.d.ts

@@ -0,0 +1,38 @@
+/**
+ * @license
+ * Copyright 2022-2024 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { NodeId } from "#types";
+import { DecodedMessage, DecodedPacket, Message, Packet } from "../codec/MessageCodec.js";
+import { Fabric } from "../fabric/Fabric.js";
+import { MessageCounter } from "../protocol/MessageCounter.js";
+import { Session, SessionParameterOptions } from "./Session.js";
+import { SessionManager } from "./SessionManager.js";
+export declare class InsecureSession extends Session {
+    #private;
+    readonly closingAfterExchangeFinished = false;
+    readonly supportsMRP = true;
+    constructor(args: {
+        manager?: SessionManager;
+        messageCounter: MessageCounter;
+        initiatorNodeId?: NodeId;
+        sessionParameters?: SessionParameterOptions;
+        isInitiator?: boolean;
+    });
+    get isSecure(): boolean;
+    get isPase(): boolean;
+    decode(packet: DecodedPacket): DecodedMessage;
+    encode(message: Message): Packet;
+    get attestationChallengeKey(): Uint8Array;
+    setFabric(_fabric: Fabric): void;
+    get name(): string;
+    get id(): number;
+    get peerSessionId(): number;
+    get nodeId(): NodeId;
+    get peerNodeId(): undefined;
+    get associatedFabric(): Fabric;
+    destroy(): Promise<void>;
+    end(): Promise<void>;
+}
+//# sourceMappingURL=InsecureSession.d.ts.map

package/dist/esm/session/InsecureSession.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"InsecureSession.d.ts","sourceRoot":"","sources":["../../../src/session/InsecureSession.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,OAAO,EAAgB,MAAM,EAAE,MAAM,0BAA0B,CAAC;AACxG,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAG/D,OAAO,EAAE,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,cAAc,EAA+B,MAAM,qBAAqB,CAAC;AAIlF,qBAAa,eAAgB,SAAQ,OAAO;;IAExC,QAAQ,CAAC,4BAA4B,SAAS;IAC9C,QAAQ,CAAC,WAAW,QAAQ;gBAEhB,IAAI,EAAE;QACd,OAAO,CAAC,EAAE,cAAc,CAAC;QACzB,cAAc,EAAE,cAAc,CAAC;QAC/B,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,iBAAiB,CAAC,EAAE,uBAAuB,CAAC;QAC5C,WAAW,CAAC,EAAE,OAAO,CAAC;KACzB;IAUD,IAAI,QAAQ,YAEX;IAED,IAAI,MAAM,YAET;IAED,MAAM,CAAC,MAAM,EAAE,aAAa,GAAG,cAAc;IAI7C,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM;IAIhC,IAAI,uBAAuB,IAAI,UAAU,CAExC;IAED,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAIhC,IAAI,IAAI,WAEP;IAED,IAAI,EAAE,IAAI,MAAM,CAEf;IAED,IAAI,aAAa,IAAI,MAAM,CAE1B;IAED,IAAI,MAAM,WAET;IAED,IAAI,UAAU,cAEb;IAED,IAAI,gBAAgB,IAAI,MAAM,CAE7B;IAEK,OAAO;IAIP,GAAG;CAIZ"}

package/dist/esm/session/InsecureSession.js

@@ -0,0 +1,75 @@
+/**
+ * @license
+ * Copyright 2022-2024 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { Logger, MatterFlowError } from "#general";
+import { NodeId } from "#types";
+import { MessageCodec } from "../codec/MessageCodec.js";
+import { MessageReceptionStateUnencryptedWithRollover } from "../protocol/MessageReceptionState.js";
+import { NoAssociatedFabricError } from "./SecureSession.js";
+import { Session } from "./Session.js";
+import { UNICAST_UNSECURE_SESSION_ID } from "./SessionManager.js";
+const logger = Logger.get("InsecureSession");
+class InsecureSession extends Session {
+  #initiatorNodeId;
+  closingAfterExchangeFinished = false;
+  supportsMRP = true;
+  constructor(args) {
+    const { initiatorNodeId, isInitiator } = args;
+    super({
+      ...args,
+      setActiveTimestamp: !isInitiator,
+      // When we are the initiator we assume the node is in idle mode
+      messageReceptionState: new MessageReceptionStateUnencryptedWithRollover()
+    });
+    this.#initiatorNodeId = initiatorNodeId ?? NodeId.randomOperationalNodeId();
+  }
+  get isSecure() {
+    return false;
+  }
+  get isPase() {
+    return false;
+  }
+  decode(packet) {
+    return MessageCodec.decodePayload(packet);
+  }
+  encode(message) {
+    return MessageCodec.encodePayload(message);
+  }
+  get attestationChallengeKey() {
+    throw new MatterFlowError("Not supported on an unsecure session");
+  }
+  setFabric(_fabric) {
+    throw new MatterFlowError("Not supported on an unsecure session");
+  }
+  get name() {
+    return `insecure/${this.#initiatorNodeId}`;
+  }
+  get id() {
+    return UNICAST_UNSECURE_SESSION_ID;
+  }
+  get peerSessionId() {
+    return UNICAST_UNSECURE_SESSION_ID;
+  }
+  get nodeId() {
+    return this.#initiatorNodeId;
+  }
+  get peerNodeId() {
+    return void 0;
+  }
+  get associatedFabric() {
+    throw new NoAssociatedFabricError("Session needs to be a secure session");
+  }
+  async destroy() {
+    await this.end();
+  }
+  async end() {
+    logger.info(`End insecure session ${this.name}`);
+    this.manager?.insecureSessions.delete(this.nodeId);
+  }
+}
+export {
+  InsecureSession
+};
+//# sourceMappingURL=InsecureSession.js.map

package/dist/esm/session/InsecureSession.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": ["../../../src/session/InsecureSession.ts"],
+  "mappings": "AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,SAAS,QAAQ,uBAAuB;AACxC,SAAS,cAAc;AACvB,SAAiD,oBAA4B;AAG7E,SAAS,oDAAoD;AAC7D,SAAS,+BAA+B;AACxC,SAAS,eAAwC;AACjD,SAAyB,mCAAmC;AAE5D,MAAM,SAAS,OAAO,IAAI,iBAAiB;AAEpC,MAAM,wBAAwB,QAAQ;AAAA,EAChC;AAAA,EACA,+BAA+B;AAAA,EAC/B,cAAc;AAAA,EAEvB,YAAY,MAMT;AACC,UAAM,EAAE,iBAAiB,YAAY,IAAI;AACzC,UAAM;AAAA,MACF,GAAG;AAAA,MACH,oBAAoB,CAAC;AAAA;AAAA,MACrB,uBAAuB,IAAI,6CAA6C;AAAA,IAC5E,CAAC;AACD,SAAK,mBAAmB,mBAAmB,OAAO,wBAAwB;AAAA,EAC9E;AAAA,EAEA,IAAI,WAAW;AACX,WAAO;AAAA,EACX;AAAA,EAEA,IAAI,SAAS;AACT,WAAO;AAAA,EACX;AAAA,EAEA,OAAO,QAAuC;AAC1C,WAAO,aAAa,cAAc,MAAM;AAAA,EAC5C;AAAA,EAEA,OAAO,SAA0B;AAC7B,WAAO,aAAa,cAAc,OAAO;AAAA,EAC7C;AAAA,EAEA,IAAI,0BAAsC;AACtC,UAAM,IAAI,gBAAgB,sCAAsC;AAAA,EACpE;AAAA,EAEA,UAAU,SAAuB;AAC7B,UAAM,IAAI,gBAAgB,sCAAsC;AAAA,EACpE;AAAA,EAEA,IAAI,OAAO;AACP,WAAO,YAAY,KAAK,gBAAgB;AAAA,EAC5C;AAAA,EAEA,IAAI,KAAa;AACb,WAAO;AAAA,EACX;AAAA,EAEA,IAAI,gBAAwB;AACxB,WAAO;AAAA,EACX;AAAA,EAEA,IAAI,SAAS;AACT,WAAO,KAAK;AAAA,EAChB;AAAA,EAEA,IAAI,aAAa;AACb,WAAO;AAAA,EACX;AAAA,EAEA,IAAI,mBAA2B;AAC3B,UAAM,IAAI,wBAAwB,sCAAsC;AAAA,EAC5E;AAAA,EAEA,MAAM,UAAU;AACZ,UAAM,KAAK,IAAI;AAAA,EACnB;AAAA,EAEA,MAAM,MAAM;AACR,WAAO,KAAK,wBAAwB,KAAK,IAAI,EAAE;AAC/C,SAAK,SAAS,iBAAiB,OAAO,KAAK,MAAM;AAAA,EACrD;AACJ;",
+  "names": []
+}

package/dist/esm/session/SecureSession.d.ts

@@ -0,0 +1,81 @@
+/**
+ * @license
+ * Copyright 2022-2024 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { BasicSet } from "#general";
+import { Subscription } from "#interaction/Subscription.js";
+import { PeerAddress } from "#peer/PeerAddress.js";
+import { CaseAuthenticatedTag, NodeId, StatusResponseError } from "#types";
+import { DecodedMessage, DecodedPacket, Message, Packet } from "../codec/MessageCodec.js";
+import { Fabric } from "../fabric/Fabric.js";
+import { Session, SessionParameterOptions } from "./Session.js";
+import { type SessionManager } from "./SessionManager.js";
+export declare class NoAssociatedFabricError extends StatusResponseError {
+    constructor(message: string);
+}
+export declare class SecureSession extends Session {
+    #private;
+    readonly supportsMRP = true;
+    static create(args: {
+        manager?: SessionManager;
+        id: number;
+        fabric: Fabric | undefined;
+        peerNodeId: NodeId;
+        peerSessionId: number;
+        sharedSecret: Uint8Array;
+        salt: Uint8Array;
+        isInitiator: boolean;
+        isResumption: boolean;
+        peerSessionParameters?: SessionParameterOptions;
+        caseAuthenticatedTags?: CaseAuthenticatedTag[];
+    }): Promise<SecureSession>;
+    constructor(args: {
+        manager?: SessionManager;
+        id: number;
+        fabric: Fabric | undefined;
+        peerNodeId: NodeId;
+        peerSessionId: number;
+        decryptKey: Uint8Array;
+        encryptKey: Uint8Array;
+        attestationKey: Uint8Array;
+        sessionParameters?: SessionParameterOptions;
+        caseAuthenticatedTags?: CaseAuthenticatedTag[];
+        isInitiator: boolean;
+    });
+    get caseAuthenticatedTags(): CaseAuthenticatedTag[];
+    get closingAfterExchangeFinished(): boolean;
+    get sendCloseMessageWhenClosing(): boolean;
+    get isSecure(): boolean;
+    get isPase(): boolean;
+    get subscriptions(): BasicSet<Subscription, Subscription>;
+    get isClosing(): boolean;
+    close(closeAfterExchangeFinished?: boolean): Promise<void>;
+    decode({ header, applicationPayload, messageExtension }: DecodedPacket, aad: Uint8Array): DecodedMessage;
+    encode(message: Message): Packet;
+    get attestationChallengeKey(): Uint8Array;
+    get fabric(): Fabric | undefined;
+    addAssociatedFabric(fabric: Fabric): void;
+    get id(): number;
+    get name(): string;
+    get peerSessionId(): number;
+    get nodeId(): NodeId;
+    get peerNodeId(): NodeId;
+    get associatedFabric(): Fabric;
+    clearSubscriptions(flushSubscriptions?: boolean): Promise<void>;
+    /** Ends a session. Outstanding subscription data will be flushed before the session is destroyed. */
+    end(sendClose: boolean, closeAfterExchangeFinished?: boolean): Promise<void>;
+    /** Destroys a session. Outstanding subscription data will be discarded. */
+    destroy(sendClose?: boolean, closeAfterExchangeFinished?: boolean): Promise<void>;
+    /**
+     * The peer node's address.
+     */
+    get peerAddress(): PeerAddress;
+    /**
+     * Indicates whether a peer matches a specific address.
+     */
+    peerIs(address: PeerAddress): boolean;
+    private generateNonce;
+}
+export declare function assertSecureSession(session?: Session, errorText?: string): asserts session is SecureSession;
+//# sourceMappingURL=SecureSession.d.ts.map

package/dist/esm/session/SecureSession.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecureSession.d.ts","sourceRoot":"","sources":["../../../src/session/SecureSession.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACH,QAAQ,EASX,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,oBAAoB,EAAe,MAAM,EAAc,mBAAmB,EAAE,MAAM,QAAQ,CAAC;AACpG,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,OAAO,EAAgB,MAAM,EAAE,MAAM,0BAA0B,CAAC;AACxG,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAG7C,OAAO,EAAE,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAO1D,qBAAa,uBAAwB,SAAQ,mBAAmB;gBAChD,OAAO,EAAE,MAAM;CAG9B;AAED,qBAAa,aAAc,SAAQ,OAAO;;IAatC,QAAQ,CAAC,WAAW,QAAQ;WAEf,MAAM,CAAC,IAAI,EAAE;QACtB,OAAO,CAAC,EAAE,cAAc,CAAC;QACzB,EAAE,EAAE,MAAM,CAAC;QACX,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;QAC3B,UAAU,EAAE,MAAM,CAAC;QACnB,aAAa,EAAE,MAAM,CAAC;QACtB,YAAY,EAAE,UAAU,CAAC;QACzB,IAAI,EAAE,UAAU,CAAC;QACjB,WAAW,EAAE,OAAO,CAAC;QACrB,YAAY,EAAE,OAAO,CAAC;QACtB,qBAAqB,CAAC,EAAE,uBAAuB,CAAC;QAChD,qBAAqB,CAAC,EAAE,oBAAoB,EAAE,CAAC;KAClD;gBAsCW,IAAI,EAAE;QACd,OAAO,CAAC,EAAE,cAAc,CAAC;QACzB,EAAE,EAAE,MAAM,CAAC;QACX,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;QAC3B,UAAU,EAAE,MAAM,CAAC;QACnB,aAAa,EAAE,MAAM,CAAC;QACtB,UAAU,EAAE,UAAU,CAAC;QACvB,UAAU,EAAE,UAAU,CAAC;QACvB,cAAc,EAAE,UAAU,CAAC;QAC3B,iBAAiB,CAAC,EAAE,uBAAuB,CAAC;QAC5C,qBAAqB,CAAC,EAAE,oBAAoB,EAAE,CAAC;QAC/C,WAAW,EAAE,OAAO,CAAC;KACxB;IAoDD,IAAI,qBAAqB,2BAExB;IAED,IAAI,4BAA4B,YAE/B;IAED,IAAI,2BAA2B,YAE9B;IAED,IAAI,QAAQ,IAAI,OAAO,CAEtB;IAED,IAAI,MAAM,IAAI,OAAO,CAEpB;IAED,IAAI,aAAa,yCAEhB;IAED,IAAI,SAAS,YAEZ;IAEK,KAAK,CAAC,0BAA0B,CAAC,EAAE,OAAO;IAOhD,MAAM,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,UAAU,GAAG,cAAc;IAqBxG,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM;IAYhC,IAAI,uBAAuB,IAAI,UAAU,CAExC;IAED,IAAI,MAAM,uBAET;IAED,mBAAmB,CAAC,MAAM,EAAE,MAAM;IAOlC,IAAI,EAAE,WAEL;IAED,IAAI,IAAI,WAEP;IAED,IAAI,aAAa,IAAI,MAAM,CAE1B;IAED,IAAI,MAAM,WAET;IAED,IAAI,UAAU,WAEb;IAED,IAAI,gBAAgB,IAAI,MAAM,CAO7B;IAEK,kBAAkB,CAAC,kBAAkB,UAAQ;IAOnD,qGAAqG;IAC/F,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,0BAA0B,UAAQ;IAKhE,2EAA2E;IACrE,OAAO,CAAC,SAAS,UAAQ,EAAE,0BAA0B,UAAO;IAsBlE;;OAEG;IACH,IAAI,WAAW,gBAKd;IAED;;OAEG;IACH,MAAM,CAAC,OAAO,EAAE,WAAW;IAO3B,OAAO,CAAC,aAAa;CAOxB;AAED,wBAAgB,mBAAmB,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,IAAI,aAAa,CAI3G"}

package/dist/esm/session/SecureSession.js

@@ -0,0 +1,281 @@
+/**
+ * @license
+ * Copyright 2022-2024 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import {
+  BasicSet,
+  Bytes,
+  CRYPTO_SYMMETRIC_KEY_LENGTH,
+  Crypto,
+  DataWriter,
+  Diagnostic,
+  Endian,
+  Logger,
+  MatterFlowError
+} from "#general";
+import { PeerAddress } from "#peer/PeerAddress.js";
+import { FabricIndex, NodeId, StatusCode, StatusResponseError } from "#types";
+import { MessageCodec } from "../codec/MessageCodec.js";
+import { MessageCounter } from "../protocol/MessageCounter.js";
+import { MessageReceptionStateEncryptedWithoutRollover } from "../protocol/MessageReceptionState.js";
+import { Session } from "./Session.js";
+const logger = Logger.get("SecureSession");
+const SESSION_KEYS_INFO = Bytes.fromString("SessionKeys");
+const SESSION_RESUMPTION_KEYS_INFO = Bytes.fromString("SessionResumptionKeys");
+class NoAssociatedFabricError extends StatusResponseError {
+  constructor(message) {
+    super(message, StatusCode.UnsupportedAccess);
+  }
+}
+class SecureSession extends Session {
+  #subscriptions = new BasicSet();
+  #closingAfterExchangeFinished = false;
+  #sendCloseMessageWhenClosing = true;
+  #id;
+  #fabric;
+  #peerNodeId;
+  #peerSessionId;
+  #decryptKey;
+  #encryptKey;
+  #attestationKey;
+  #caseAuthenticatedTags;
+  #isClosing = false;
+  supportsMRP = true;
+  static async create(args) {
+    const {
+      manager,
+      id,
+      fabric,
+      peerNodeId,
+      peerSessionId,
+      sharedSecret,
+      salt,
+      isInitiator,
+      isResumption,
+      peerSessionParameters,
+      caseAuthenticatedTags
+    } = args;
+    const keys = await Crypto.hkdf(
+      sharedSecret,
+      salt,
+      isResumption ? SESSION_RESUMPTION_KEYS_INFO : SESSION_KEYS_INFO,
+      CRYPTO_SYMMETRIC_KEY_LENGTH * 3
+    );
+    const decryptKey = isInitiator ? keys.slice(16, 32) : keys.slice(0, 16);
+    const encryptKey = isInitiator ? keys.slice(0, 16) : keys.slice(16, 32);
+    const attestationKey = keys.slice(32, 48);
+    return new SecureSession({
+      manager,
+      id,
+      fabric,
+      peerNodeId,
+      peerSessionId,
+      decryptKey,
+      encryptKey,
+      attestationKey,
+      sessionParameters: peerSessionParameters,
+      isInitiator,
+      caseAuthenticatedTags
+    });
+  }
+  constructor(args) {
+    super({
+      ...args,
+      setActiveTimestamp: true,
+      // We always set the active timestamp for Secure sessions
+      // Can be changed to a PersistedMessageCounter if we implement session storage
+      messageCounter: new MessageCounter(() => {
+        this.end(true, true).catch((error) => logger.error(`Error while closing session: ${error}`));
+      }),
+      messageReceptionState: new MessageReceptionStateEncryptedWithoutRollover()
+    });
+    const {
+      manager,
+      id,
+      fabric,
+      peerNodeId,
+      peerSessionId,
+      decryptKey,
+      encryptKey,
+      attestationKey,
+      caseAuthenticatedTags
+    } = args;
+    this.#id = id;
+    this.#fabric = fabric;
+    this.#peerNodeId = peerNodeId;
+    this.#peerSessionId = peerSessionId;
+    this.#decryptKey = decryptKey;
+    this.#encryptKey = encryptKey;
+    this.#attestationKey = attestationKey;
+    this.#caseAuthenticatedTags = caseAuthenticatedTags ?? [];
+    manager?.sessions.add(this);
+    fabric?.addSession(this);
+    logger.debug(
+      `Created secure ${this.isPase ? "PASE" : "CASE"} session for fabric index ${fabric?.fabricIndex}`,
+      this.name,
+      Diagnostic.dict({
+        idleIntervalMs: this.idleIntervalMs,
+        activeIntervalMs: this.activeIntervalMs,
+        activeThresholdMs: this.activeThresholdMs,
+        dataModelRevision: this.dataModelRevision,
+        interactionModelRevision: this.interactionModelRevision,
+        specificationVersion: this.specificationVersion,
+        maxPathsPerInvoke: this.maxPathsPerInvoke,
+        caseAuthenticatedTags: this.#caseAuthenticatedTags
+      })
+    );
+  }
+  get caseAuthenticatedTags() {
+    return this.#caseAuthenticatedTags;
+  }
+  get closingAfterExchangeFinished() {
+    return this.#closingAfterExchangeFinished;
+  }
+  get sendCloseMessageWhenClosing() {
+    return this.#sendCloseMessageWhenClosing;
+  }
+  get isSecure() {
+    return true;
+  }
+  get isPase() {
+    return this.#peerNodeId === NodeId.UNSPECIFIED_NODE_ID;
+  }
+  get subscriptions() {
+    return this.#subscriptions;
+  }
+  get isClosing() {
+    return this.#isClosing;
+  }
+  async close(closeAfterExchangeFinished) {
+    if (closeAfterExchangeFinished === void 0) {
+      closeAfterExchangeFinished = this.isPeerActive();
+    }
+    await this.end(true, closeAfterExchangeFinished);
+  }
+  decode({ header, applicationPayload, messageExtension }, aad) {
+    if (header.hasMessageExtensions) {
+      logger.info(
+        `Message extensions are not supported. Ignoring ${messageExtension ? Bytes.toHex(messageExtension) : void 0}`
+      );
+    }
+    const nonce = this.generateNonce(header.securityFlags, header.messageId, this.#peerNodeId);
+    const message = MessageCodec.decodePayload({
+      header,
+      applicationPayload: Crypto.decrypt(this.#decryptKey, applicationPayload, nonce, aad)
+    });
+    if (message.payloadHeader.hasSecuredExtension) {
+      logger.info(
+        `Secured extensions are not supported. Ignoring ${message.securityExtension ? Bytes.toHex(message.securityExtension) : void 0}`
+      );
+    }
+    return message;
+  }
+  encode(message) {
+    message.packetHeader.sessionId = this.#peerSessionId;
+    const { header, applicationPayload } = MessageCodec.encodePayload(message);
+    const headerBytes = MessageCodec.encodePacketHeader(message.packetHeader);
+    const securityFlags = headerBytes[3];
+    const sessionNodeId = this.isPase ? NodeId.UNSPECIFIED_NODE_ID : this.#fabric?.nodeId ?? NodeId.UNSPECIFIED_NODE_ID;
+    const nonce = this.generateNonce(securityFlags, header.messageId, sessionNodeId);
+    return { header, applicationPayload: Crypto.encrypt(this.#encryptKey, applicationPayload, nonce, headerBytes) };
+  }
+  get attestationChallengeKey() {
+    return this.#attestationKey;
+  }
+  get fabric() {
+    return this.#fabric;
+  }
+  addAssociatedFabric(fabric) {
+    if (this.#fabric !== void 0) {
+      throw new MatterFlowError("Session already has an associated Fabric. Cannot change this.");
+    }
+    this.#fabric = fabric;
+  }
+  get id() {
+    return this.#id;
+  }
+  get name() {
+    return `secure/${this.#id}`;
+  }
+  get peerSessionId() {
+    return this.#peerSessionId;
+  }
+  get nodeId() {
+    return this.#fabric?.nodeId ?? NodeId.UNSPECIFIED_NODE_ID;
+  }
+  get peerNodeId() {
+    return this.#peerNodeId;
+  }
+  get associatedFabric() {
+    if (this.#fabric === void 0) {
+      throw new NoAssociatedFabricError(
+        `${this.isPase ? "PASE " : ""}Session needs to have an associated Fabric for fabric sensitive data handling.`
+      );
+    }
+    return this.#fabric;
+  }
+  async clearSubscriptions(flushSubscriptions = false) {
+    const subscriptions = [...this.#subscriptions];
+    for (const subscription of subscriptions) {
+      await subscription.close(flushSubscriptions);
+    }
+  }
+  /** Ends a session. Outstanding subscription data will be flushed before the session is destroyed. */
+  async end(sendClose, closeAfterExchangeFinished = false) {
+    await this.clearSubscriptions(true);
+    await this.destroy(sendClose, closeAfterExchangeFinished);
+  }
+  /** Destroys a session. Outstanding subscription data will be discarded. */
+  async destroy(sendClose = false, closeAfterExchangeFinished = true) {
+    await this.clearSubscriptions(false);
+    this.#fabric?.removeSession(this);
+    if (!sendClose) {
+      this.#sendCloseMessageWhenClosing = false;
+    }
+    if (closeAfterExchangeFinished) {
+      logger.info(`Register Session ${this.name} to close when exchange is ended.`);
+      this.#closingAfterExchangeFinished = true;
+    } else {
+      this.#isClosing = true;
+      logger.info(`End ${this.isPase ? "PASE" : "CASE"} session ${this.name}`);
+      this.manager?.sessions.delete(this);
+      if (this.closer) {
+        await this.closer;
+      }
+    }
+  }
+  /**
+   * The peer node's address.
+   */
+  get peerAddress() {
+    return PeerAddress({
+      fabricIndex: this.#fabric?.fabricIndex ?? FabricIndex.NO_FABRIC,
+      nodeId: this.#peerNodeId
+    });
+  }
+  /**
+   * Indicates whether a peer matches a specific address.
+   */
+  peerIs(address) {
+    return (this.#fabric?.fabricIndex ?? FabricIndex.NO_FABRIC) === address.fabricIndex && this.#peerNodeId === address.nodeId;
+  }
+  generateNonce(securityFlags, messageId, nodeId) {
+    const writer = new DataWriter(Endian.Little);
+    writer.writeUInt8(securityFlags);
+    writer.writeUInt32(messageId);
+    writer.writeUInt64(nodeId);
+    return writer.toByteArray();
+  }
+}
+function assertSecureSession(session, errorText) {
+  if (!session?.isSecure) {
+    throw new MatterFlowError(errorText ?? "Insecure session in secure context");
+  }
+}
+export {
+  NoAssociatedFabricError,
+  SecureSession,
+  assertSecureSession
+};
+//# sourceMappingURL=SecureSession.js.map

package/dist/esm/session/SecureSession.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": ["../../../src/session/SecureSession.ts"],
+  "mappings": "AAAA;AAAA;AAAA;AAAA;AAAA;AAMA;AAAA,EACI;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACG;AAEP,SAAS,mBAAmB;AAC5B,SAA+B,aAAa,QAAQ,YAAY,2BAA2B;AAC3F,SAAiD,oBAA4B;AAE7E,SAAS,sBAAsB;AAC/B,SAAS,qDAAqD;AAC9D,SAAS,eAAwC;AAGjD,MAAM,SAAS,OAAO,IAAI,eAAe;AAEzC,MAAM,oBAAoB,MAAM,WAAW,aAAa;AACxD,MAAM,+BAA+B,MAAM,WAAW,uBAAuB;AAEtE,MAAM,gCAAgC,oBAAoB;AAAA,EAC7D,YAAY,SAAiB;AACzB,UAAM,SAAS,WAAW,iBAAiB;AAAA,EAC/C;AACJ;AAEO,MAAM,sBAAsB,QAAQ;AAAA,EAC9B,iBAAiB,IAAI,SAAuB;AAAA,EACrD,gCAAgC;AAAA,EAChC,+BAA+B;AAAA,EACtB;AAAA,EACT;AAAA,EACS;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACT;AAAA,EACA,aAAa;AAAA,EACJ,cAAc;AAAA,EAEvB,aAAa,OAAO,MAYjB;AACC,UAAM;AAAA,MACF;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACJ,IAAI;AACJ,UAAM,OAAO,MAAM,OAAO;AAAA,MACtB;AAAA,MACA;AAAA,MACA,eAAe,+BAA+B;AAAA,MAC9C,8BAA8B;AAAA,IAClC;AACA,UAAM,aAAa,cAAc,KAAK,MAAM,IAAI,EAAE,IAAI,KAAK,MAAM,GAAG,EAAE;AACtE,UAAM,aAAa,cAAc,KAAK,MAAM,GAAG,EAAE,IAAI,KAAK,MAAM,IAAI,EAAE;AACtE,UAAM,iBAAiB,KAAK,MAAM,IAAI,EAAE;AACxC,WAAO,IAAI,cAAc;AAAA,MACrB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,mBAAmB;AAAA,MACnB;AAAA,MACA;AAAA,IACJ,CAAC;AAAA,EACL;AAAA,EAEA,YAAY,MAYT;AACC,UAAM;AAAA,MACF,GAAG;AAAA,MACH,oBAAoB;AAAA;AAAA;AAAA,MAEpB,gBAAgB,IAAI,eAAe,MAAM;AAGrC,aAAK,IAAI,MAAM,IAAI,EAAE,MAAM,WAAS,OAAO,MAAM,gCAAgC,KAAK,EAAE,CAAC;AAAA,MAC7F,CAAC;AAAA,MACD,uBAAuB,IAAI,8CAA8C;AAAA,IAC7E,CAAC;AACD,UAAM;AAAA,MACF;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACJ,IAAI;AAEJ,SAAK,MAAM;AACX,SAAK,UAAU;AACf,SAAK,cAAc;AACnB,SAAK,iBAAiB;AACtB,SAAK,cAAc;AACnB,SAAK,cAAc;AACnB,SAAK,kBAAkB;AACvB,SAAK,yBAAyB,yBAAyB,CAAC;AAExD,aAAS,SAAS,IAAI,IAAI;AAC1B,YAAQ,WAAW,IAAI;AAEvB,WAAO;AAAA,MACH,kBAAkB,KAAK,SAAS,SAAS,MAAM,6BAA6B,QAAQ,WAAW;AAAA,MAC/F,KAAK;AAAA,MACL,WAAW,KAAK;AAAA,QACZ,gBAAgB,KAAK;AAAA,QACrB,kBAAkB,KAAK;AAAA,QACvB,mBAAmB,KAAK;AAAA,QACxB,mBAAmB,KAAK;AAAA,QACxB,0BAA0B,KAAK;AAAA,QAC/B,sBAAsB,KAAK;AAAA,QAC3B,mBAAmB,KAAK;AAAA,QACxB,uBAAuB,KAAK;AAAA,MAChC,CAAC;AAAA,IACL;AAAA,EACJ;AAAA,EAEA,IAAI,wBAAwB;AACxB,WAAO,KAAK;AAAA,EAChB;AAAA,EAEA,IAAI,+BAA+B;AAC/B,WAAO,KAAK;AAAA,EAChB;AAAA,EAEA,IAAI,8BAA8B;AAC9B,WAAO,KAAK;AAAA,EAChB;AAAA,EAEA,IAAI,WAAoB;AACpB,WAAO;AAAA,EACX;AAAA,EAEA,IAAI,SAAkB;AAClB,WAAO,KAAK,gBAAgB,OAAO;AAAA,EACvC;AAAA,EAEA,IAAI,gBAAgB;AAChB,WAAO,KAAK;AAAA,EAChB;AAAA,EAEA,IAAI,YAAY;AACZ,WAAO,KAAK;AAAA,EAChB;AAAA,EAEA,MAAM,MAAM,4BAAsC;AAC9C,QAAI,+BAA+B,QAAW;AAC1C,mCAA6B,KAAK,aAAa;AAAA,IACnD;AACA,UAAM,KAAK,IAAI,MAAM,0BAA0B;AAAA,EACnD;AAAA,EAEA,OAAO,EAAE,QAAQ,oBAAoB,iBAAiB,GAAkB,KAAiC;AACrG,QAAI,OAAO,sBAAsB;AAC7B,aAAO;AAAA,QACH,kDAAkD,mBAAmB,MAAM,MAAM,gBAAgB,IAAI,MAAS;AAAA,MAClH;AAAA,IACJ;AACA,UAAM,QAAQ,KAAK,cAAc,OAAO,eAAe,OAAO,WAAW,KAAK,WAAW;AACzF,UAAM,UAAU,aAAa,cAAc;AAAA,MACvC;AAAA,MACA,oBAAoB,OAAO,QAAQ,KAAK,aAAa,oBAAoB,OAAO,GAAG;AAAA,IACvF,CAAC;AAED,QAAI,QAAQ,cAAc,qBAAqB;AAC3C,aAAO;AAAA,QACH,kDAAkD,QAAQ,oBAAoB,MAAM,MAAM,QAAQ,iBAAiB,IAAI,MAAS;AAAA,MACpI;AAAA,IACJ;AAEA,WAAO;AAAA,EACX;AAAA,EAEA,OAAO,SAA0B;AAC7B,YAAQ,aAAa,YAAY,KAAK;AACtC,UAAM,EAAE,QAAQ,mBAAmB,IAAI,aAAa,cAAc,OAAO;AACzE,UAAM,cAAc,aAAa,mBAAmB,QAAQ,YAAY;AACxE,UAAM,gBAAgB,YAAY,CAAC;AACnC,UAAM,gBAAgB,KAAK,SACrB,OAAO,sBACN,KAAK,SAAS,UAAU,OAAO;AACtC,UAAM,QAAQ,KAAK,cAAc,eAAe,OAAO,WAAW,aAAa;AAC/E,WAAO,EAAE,QAAQ,oBAAoB,OAAO,QAAQ,KAAK,aAAa,oBAAoB,OAAO,WAAW,EAAE;AAAA,EAClH;AAAA,EAEA,IAAI,0BAAsC;AACtC,WAAO,KAAK;AAAA,EAChB;AAAA,EAEA,IAAI,SAAS;AACT,WAAO,KAAK;AAAA,EAChB;AAAA,EAEA,oBAAoB,QAAgB;AAChC,QAAI,KAAK,YAAY,QAAW;AAC5B,YAAM,IAAI,gBAAgB,+DAA+D;AAAA,IAC7F;AACA,SAAK,UAAU;AAAA,EACnB;AAAA,EAEA,IAAI,KAAK;AACL,WAAO,KAAK;AAAA,EAChB;AAAA,EAEA,IAAI,OAAO;AACP,WAAO,UAAU,KAAK,GAAG;AAAA,EAC7B;AAAA,EAEA,IAAI,gBAAwB;AACxB,WAAO,KAAK;AAAA,EAChB;AAAA,EAEA,IAAI,SAAS;AACT,WAAO,KAAK,SAAS,UAAU,OAAO;AAAA,EAC1C;AAAA,EAEA,IAAI,aAAa;AACb,WAAO,KAAK;AAAA,EAChB;AAAA,EAEA,IAAI,mBAA2B;AAC3B,QAAI,KAAK,YAAY,QAAW;AAC5B,YAAM,IAAI;AAAA,QACN,GAAG,KAAK,SAAS,UAAU,EAAE;AAAA,MACjC;AAAA,IACJ;AACA,WAAO,KAAK;AAAA,EAChB;AAAA,EAEA,MAAM,mBAAmB,qBAAqB,OAAO;AACjD,UAAM,gBAAgB,CAAC,GAAG,KAAK,cAAc;AAC7C,eAAW,gBAAgB,eAAe;AACtC,YAAM,aAAa,MAAM,kBAAkB;AAAA,IAC/C;AAAA,EACJ;AAAA;AAAA,EAGA,MAAM,IAAI,WAAoB,6BAA6B,OAAO;AAC9D,UAAM,KAAK,mBAAmB,IAAI;AAClC,UAAM,KAAK,QAAQ,WAAW,0BAA0B;AAAA,EAC5D;AAAA;AAAA,EAGA,MAAM,QAAQ,YAAY,OAAO,6BAA6B,MAAM;AAChE,UAAM,KAAK,mBAAmB,KAAK;AACnC,SAAK,SAAS,cAAc,IAAI;AAChC,QAAI,CAAC,WAAW;AACZ,WAAK,+BAA+B;AAAA,IACxC;AAEA,QAAI,4BAA4B;AAC5B,aAAO,KAAK,oBAAoB,KAAK,IAAI,mCAAmC;AAC5E,WAAK,gCAAgC;AAAA,IACzC,OAAO;AACH,WAAK,aAAa;AAClB,aAAO,KAAK,OAAO,KAAK,SAAS,SAAS,MAAM,YAAY,KAAK,IAAI,EAAE;AACvE,WAAK,SAAS,SAAS,OAAO,IAAI;AAGlC,UAAI,KAAK,QAAQ;AACb,cAAM,KAAK;AAAA,MACf;AAAA,IACJ;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA,EAKA,IAAI,cAAc;AACd,WAAO,YAAY;AAAA,MACf,aAAa,KAAK,SAAS,eAAe,YAAY;AAAA,MACtD,QAAQ,KAAK;AAAA,IACjB,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,SAAsB;AACzB,YACK,KAAK,SAAS,eAAe,YAAY,eAAe,QAAQ,eACjE,KAAK,gBAAgB,QAAQ;AAAA,EAErC;AAAA,EAEQ,cAAc,eAAuB,WAAmB,QAAgB;AAC5E,UAAM,SAAS,IAAI,WAAW,OAAO,MAAM;AAC3C,WAAO,WAAW,aAAa;AAC/B,WAAO,YAAY,SAAS;AAC5B,WAAO,YAAY,MAAM;AACzB,WAAO,OAAO,YAAY;AAAA,EAC9B;AACJ;AAEO,SAAS,oBAAoB,SAAmB,WAAsD;AACzG,MAAI,CAAC,SAAS,UAAU;AACpB,UAAM,IAAI,gBAAgB,aAAa,oCAAoC;AAAA,EAC/E;AACJ;",
+  "names": []
+}