@matter/protocol 0.14.1-alpha.0-20250605-9fc134af0 → 0.14.1-alpha.0-20250606-a9bcd03f9

package/dist/cjs/groups/KeySets.d.ts

@@ -0,0 +1,64 @@
+/**
+ * @license
+ * Copyright 2022-2025 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import type { GroupKeyManagement } from "#clusters/group-key-management";
+import { BasicSet } from "#general";
+export declare const GROUP_KEY_INFO: Uint8Array<ArrayBufferLike>;
+export declare class KeySets<T extends OperationalKeySet> extends BasicSet<T> {
+    #private;
+    get sessions(): Map<number, {
+        keySetId: number;
+        key: Uint8Array;
+    }[]>;
+    add(item: T): void;
+    delete<F extends keyof T>(itemOrField: T | F, value?: T[F]): boolean;
+    forId(groupKeySetId: number): OperationalKeySet | undefined;
+    /**
+     * Return an operative list of operational keys, start time and their session IDs for a specified
+     * group key set id. This is mainly used for receiving messages.
+     */
+    allKeysForId(keySetId: number): {
+        key: Uint8Array;
+        sessionId?: number;
+        startTime: number | bigint;
+    }[];
+    /**
+     * Returns the current operational group key for a given group KeySet Id and returns the keys, start time and
+     * their session IDs. This is mainly used for sending messages.
+     */
+    currentKeyForId(keySetId: number): {
+        key: Uint8Array;
+        sessionId?: number;
+        startTime: number | bigint;
+    };
+    /**
+     * Returns the group key set for a given group key set id in the official data format from the Group key Management
+     * cluster.
+     */
+    asGroupKeySet(groupKeySetId: number): {
+        groupKeySetId: number;
+        epochKey0: Uint8Array<ArrayBufferLike> | null;
+        epochStartTime0: number | bigint | null;
+        epochKey1: Uint8Array<ArrayBufferLike> | null;
+        epochStartTime1: number | bigint | null;
+        epochKey2: Uint8Array<ArrayBufferLike> | null;
+        epochStartTime2: number | bigint | null;
+        groupKeySecurityPolicy: GroupKeyManagement.GroupKeySecurityPolicy;
+        groupKeyMulticastPolicy: GroupKeyManagement.GroupKeyMulticastPolicy | undefined;
+    } | undefined;
+    /** Calculates a group session id based on the operational group key. */
+    sessionIdFromKey(operationalGroupKey: Uint8Array): Promise<number>;
+}
+export type GroupKeySet = GroupKeyManagement.GroupKeySet;
+/** Enhanced structure of GroupKeySet to include operational data for easier operational processing. */
+export type OperationalKeySet = GroupKeySet & {
+    operationalEpochKey0: Uint8Array;
+    groupSessionId0: number | null;
+    operationalEpochKey1: Uint8Array | null;
+    groupSessionId1: number | null;
+    operationalEpochKey2: Uint8Array | null;
+    groupSessionId2: number | null;
+};
+//# sourceMappingURL=KeySets.d.ts.map

package/dist/cjs/groups/KeySets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"KeySets.d.ts","sourceRoot":"","sources":["../../../src/groups/KeySets.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,QAAQ,EAAyE,MAAM,UAAU,CAAC;AAE3G,eAAO,MAAM,cAAc,6BAAmC,CAAC;AAE/D,qBAAa,OAAO,CAAC,CAAC,SAAS,iBAAiB,CAAE,SAAQ,QAAQ,CAAC,CAAC,CAAC;;IAIjE,IAAI,QAAQ;kBAFqC,MAAM;aAAO,UAAU;SAIvE;IAEQ,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI;IAMlB,MAAM,CAAC,CAAC,SAAS,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO;IAQ7E,KAAK,CAAC,aAAa,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS;IAI3D;;;OAGG;IACH,YAAY,CAAC,QAAQ,EAAE,MAAM;aAKY,UAAU;oBAAc,MAAM;mBAAa,MAAM,GAAG,MAAM;;IA8BnG;;;OAGG;IACH,eAAe,CAAC,QAAQ,EAAE,MAAM;aAlCS,UAAU;oBAAc,MAAM;mBAAa,MAAM,GAAG,MAAM;;IA+DnG;;;OAGG;IACH,aAAa,CAAC,aAAa,EAAE,MAAM;;;;;;;;;;;IA6BnC,wEAAwE;IAClE,gBAAgB,CAAC,mBAAmB,EAAE,UAAU;CAsCzD;AAED,MAAM,MAAM,WAAW,GAAG,kBAAkB,CAAC,WAAW,CAAC;AAEzD,uGAAuG;AACvG,MAAM,MAAM,iBAAiB,GAAG,WAAW,GAAG;IAC1C,oBAAoB,EAAE,UAAU,CAAC;IACjC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,oBAAoB,EAAE,UAAU,GAAG,IAAI,CAAC;IACxC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,oBAAoB,EAAE,UAAU,GAAG,IAAI,CAAC;IACxC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC,CAAC"}

package/dist/cjs/groups/KeySets.js

@@ -0,0 +1,179 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var KeySets_exports = {};
+__export(KeySets_exports, {
+  GROUP_KEY_INFO: () => GROUP_KEY_INFO,
+  KeySets: () => KeySets
+});
+module.exports = __toCommonJS(KeySets_exports);
+var import_general = require("#general");
+/**
+ * @license
+ * Copyright 2022-2025 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+const GROUP_KEY_INFO = import_general.Bytes.fromString("GroupKeyHash");
+class KeySets extends import_general.BasicSet {
+  /** Operational enhanced structure for fast access based on the group session id. */
+  #sessions = /* @__PURE__ */ new Map();
+  get sessions() {
+    return this.#sessions;
+  }
+  add(item) {
+    this.delete("groupKeySetId", item.groupKeySetId);
+    super.add(item);
+    this.#updateSessions();
+  }
+  delete(itemOrField, value) {
+    const deleted = super.delete(itemOrField, value);
+    if (deleted) {
+      this.#updateSessions();
+    }
+    return deleted;
+  }
+  forId(groupKeySetId) {
+    return this.get("groupKeySetId", groupKeySetId);
+  }
+  /**
+   * Return an operative list of operational keys, start time and their session IDs for a specified
+   * group key set id. This is mainly used for receiving messages.
+   */
+  allKeysForId(keySetId) {
+    const groupKeySet = this.forId(keySetId);
+    if (groupKeySet === void 0) {
+      throw new import_general.MatterFlowError(`GroupKeySet for groupKeySet ${keySetId} not found.`);
+    }
+    const operationalKeys = Array();
+    const {
+      operationalEpochKey0,
+      groupSessionId0,
+      epochStartTime0,
+      operationalEpochKey1,
+      groupSessionId1,
+      epochStartTime1,
+      operationalEpochKey2,
+      groupSessionId2,
+      epochStartTime2
+    } = groupKeySet;
+    if (operationalEpochKey0 === null || epochStartTime0 === null || keySetId !== 0 && groupSessionId0 === null) {
+      throw new import_general.MatterFlowError(`EpochKey0 for groupKeySet ${keySetId} not found.`);
+    }
+    operationalKeys.push({
+      key: operationalEpochKey0,
+      sessionId: groupSessionId0 !== null ? groupSessionId0 : void 0,
+      startTime: epochStartTime0
+    });
+    if (operationalEpochKey1 !== null && groupSessionId1 !== null && epochStartTime1 !== null) {
+      operationalKeys.push({ key: operationalEpochKey1, sessionId: groupSessionId1, startTime: epochStartTime1 });
+    }
+    if (operationalEpochKey2 !== null && groupSessionId2 !== null && epochStartTime2 !== null) {
+      operationalKeys.push({ key: operationalEpochKey2, sessionId: groupSessionId2, startTime: epochStartTime2 });
+    }
+    return operationalKeys;
+  }
+  /**
+   * Returns the current operational group key for a given group KeySet Id and returns the keys, start time and
+   * their session IDs. This is mainly used for sending messages.
+   */
+  currentKeyForId(keySetId) {
+    const operationalKeys = this.allKeysForId(keySetId);
+    if (operationalKeys.length === 0) {
+      throw new import_general.MatterFlowError(`No operational keys found for groupKeySet ${keySetId}.`);
+    }
+    if (keySetId === 0) {
+      if (operationalKeys.length > 2) {
+        return operationalKeys[1];
+      }
+      return operationalKeys[0];
+    } else {
+      const now = import_general.Time.nowUs();
+      const relevantKeys = operationalKeys.filter(({ startTime }) => startTime <= now);
+      if (relevantKeys.length === 0) {
+        throw new import_general.ImplementationError(
+          `No operational keys found for groupKeySet ${keySetId} that are not in the future.`
+        );
+      }
+      return relevantKeys[operationalKeys.length - 1];
+    }
+  }
+  /**
+   * Returns the group key set for a given group key set id in the official data format from the Group key Management
+   * cluster.
+   */
+  asGroupKeySet(groupKeySetId) {
+    const groupKeySet = this.forId(groupKeySetId);
+    if (groupKeySet === void 0) {
+      return void 0;
+    }
+    const {
+      epochKey0,
+      epochStartTime0,
+      epochKey1,
+      epochStartTime1,
+      epochKey2,
+      epochStartTime2,
+      groupKeySecurityPolicy,
+      groupKeyMulticastPolicy
+    } = groupKeySet;
+    return {
+      groupKeySetId,
+      epochKey0,
+      epochStartTime0,
+      epochKey1,
+      epochStartTime1,
+      epochKey2,
+      epochStartTime2,
+      groupKeySecurityPolicy,
+      groupKeyMulticastPolicy
+    };
+  }
+  /** Calculates a group session id based on the operational group key. */
+  async sessionIdFromKey(operationalGroupKey) {
+    const groupKeyHash = await import_general.Crypto.hkdf(operationalGroupKey, new Uint8Array(), GROUP_KEY_INFO, 2);
+    return new import_general.DataReader(groupKeyHash).readUInt16();
+  }
+  /**
+   * Updates the group session map based on the current group key sets.
+   * This is used to quickly find the operational keys by their group session id.
+   */
+  #updateSessions() {
+    this.#sessions.clear();
+    for (const [id, keySet] of this.mapOf("groupKeySetId").entries()) {
+      if (id === 0) {
+        continue;
+      }
+      if (keySet.groupSessionId0 !== null) {
+        const list = this.#sessions.get(keySet.groupSessionId0) ?? [];
+        list.push({ key: keySet.operationalEpochKey0, keySetId: id });
+        this.#sessions.set(keySet.groupSessionId0, list);
+      }
+      if (keySet.groupSessionId1 !== null && keySet.operationalEpochKey1 !== null) {
+        const list = this.#sessions.get(keySet.groupSessionId1) ?? [];
+        list.push({ key: keySet.operationalEpochKey1, keySetId: id });
+        this.#sessions.set(keySet.groupSessionId1, list);
+      }
+      if (keySet.groupSessionId2 !== null && keySet.operationalEpochKey2 !== null) {
+        const list = this.#sessions.get(keySet.groupSessionId2) ?? [];
+        list.push({ key: keySet.operationalEpochKey2, keySetId: id });
+        this.#sessions.set(keySet.groupSessionId2, list);
+      }
+    }
+  }
+}
+//# sourceMappingURL=KeySets.js.map

package/dist/cjs/groups/KeySets.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": ["../../../src/groups/KeySets.ts"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAOA,qBAAgG;AAPhG;AAAA;AAAA;AAAA;AAAA;AASO,MAAM,iBAAiB,qBAAM,WAAW,cAAc;AAEtD,MAAM,gBAA6C,wBAAY;AAAA;AAAA,EAEzD,YAAY,oBAAI,IAAqD;AAAA,EAE9E,IAAI,WAAW;AACX,WAAO,KAAK;AAAA,EAChB;AAAA,EAES,IAAI,MAAe;AACxB,SAAK,OAAO,iBAAiB,KAAK,aAAa;AAC/C,UAAM,IAAI,IAAI;AACd,SAAK,gBAAgB;AAAA,EACzB;AAAA,EAES,OAA0B,aAAoB,OAAuB;AAC1E,UAAM,UAAU,MAAM,OAAO,aAAoB,KAAY;AAC7D,QAAI,SAAS;AACT,WAAK,gBAAgB;AAAA,IACzB;AACA,WAAO;AAAA,EACX;AAAA,EAEA,MAAM,eAAsD;AACxD,WAAO,KAAK,IAAI,iBAAiB,aAAa;AAAA,EAClD;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,aAAa,UAAkB;AAC3B,UAAM,cAAc,KAAK,MAAM,QAAQ;AACvC,QAAI,gBAAgB,QAAW;AAC3B,YAAM,IAAI,+BAAgB,+BAA+B,QAAQ,aAAa;AAAA,IAClF;AACA,UAAM,kBAAkB,MAA2E;AACnG,UAAM;AAAA,MACF;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACJ,IAAI;AACJ,QAAI,yBAAyB,QAAQ,oBAAoB,QAAS,aAAa,KAAK,oBAAoB,MAAO;AAE3G,YAAM,IAAI,+BAAgB,6BAA6B,QAAQ,aAAa;AAAA,IAChF;AACA,oBAAgB,KAAK;AAAA,MACjB,KAAK;AAAA,MACL,WAAW,oBAAoB,OAAO,kBAAkB;AAAA,MACxD,WAAW;AAAA,IACf,CAAC;AACD,QAAI,yBAAyB,QAAQ,oBAAoB,QAAQ,oBAAoB,MAAM;AACvF,sBAAgB,KAAK,EAAE,KAAK,sBAAsB,WAAW,iBAAiB,WAAW,gBAAgB,CAAC;AAAA,IAC9G;AACA,QAAI,yBAAyB,QAAQ,oBAAoB,QAAQ,oBAAoB,MAAM;AACvF,sBAAgB,KAAK,EAAE,KAAK,sBAAsB,WAAW,iBAAiB,WAAW,gBAAgB,CAAC;AAAA,IAC9G;AACA,WAAO;AAAA,EACX;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,gBAAgB,UAAkB;AAC9B,UAAM,kBAAkB,KAAK,aAAa,QAAQ;AAClD,QAAI,gBAAgB,WAAW,GAAG;AAC9B,YAAM,IAAI,+BAAgB,6CAA6C,QAAQ,GAAG;AAAA,IACtF;AACA,QAAI,aAAa,GAAG;AAIhB,UAAI,gBAAgB,SAAS,GAAG;AAC5B,eAAO,gBAAgB,CAAC;AAAA,MAC5B;AACA,aAAO,gBAAgB,CAAC;AAAA,IAC5B,OAAO;AAKH,YAAM,MAAM,oBAAK,MAAM;AACvB,YAAM,eAAe,gBAAgB,OAAO,CAAC,EAAE,UAAU,MAAM,aAAa,GAAG;AAC/E,UAAI,aAAa,WAAW,GAAG;AAC3B,cAAM,IAAI;AAAA,UACN,6CAA6C,QAAQ;AAAA,QACzD;AAAA,MACJ;AACA,aAAO,aAAa,gBAAgB,SAAS,CAAC;AAAA,IAClD;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,cAAc,eAAuB;AACjC,UAAM,cAAc,KAAK,MAAM,aAAa;AAC5C,QAAI,gBAAgB,QAAW;AAC3B,aAAO;AAAA,IACX;AAEA,UAAM;AAAA,MACF;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACJ,IAAI;AACJ,WAAO;AAAA,MACH;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACJ;AAAA,EACJ;AAAA;AAAA,EAGA,MAAM,iBAAiB,qBAAiC;AAEpD,UAAM,eAAe,MAAM,sBAAO,KAAK,qBAAqB,IAAI,WAAW,GAAG,gBAAgB,CAAC;AAK/F,WAAO,IAAI,0BAAW,YAAY,EAAE,WAAW;AAAA,EACnD;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,kBAAkB;AACd,SAAK,UAAU,MAAM;AACrB,eAAW,CAAC,IAAI,MAAM,KAAK,KAAK,MAAM,eAAe,EAAE,QAAQ,GAAG;AAC9D,UAAI,OAAO,GAAG;AAEV;AAAA,MACJ;AACA,UAAI,OAAO,oBAAoB,MAAM;AACjC,cAAM,OAAO,KAAK,UAAU,IAAI,OAAO,eAAe,KAAK,CAAC;AAC5D,aAAK,KAAK,EAAE,KAAK,OAAO,sBAAsB,UAAU,GAAG,CAAC;AAC5D,aAAK,UAAU,IAAI,OAAO,iBAAiB,IAAI;AAAA,MACnD;AACA,UAAI,OAAO,oBAAoB,QAAQ,OAAO,yBAAyB,MAAM;AACzE,cAAM,OAAO,KAAK,UAAU,IAAI,OAAO,eAAe,KAAK,CAAC;AAC5D,aAAK,KAAK,EAAE,KAAK,OAAO,sBAAsB,UAAU,GAAG,CAAC;AAC5D,aAAK,UAAU,IAAI,OAAO,iBAAiB,IAAI;AAAA,MACnD;AACA,UAAI,OAAO,oBAAoB,QAAQ,OAAO,yBAAyB,MAAM;AACzE,cAAM,OAAO,KAAK,UAAU,IAAI,OAAO,eAAe,KAAK,CAAC;AAC5D,aAAK,KAAK,EAAE,KAAK,OAAO,sBAAsB,UAAU,GAAG,CAAC;AAC5D,aAAK,UAAU,IAAI,OAAO,iBAAiB,IAAI;AAAA,MACnD;AAAA,IACJ;AAAA,EACJ;AACJ;",
+  "names": []
+}

package/dist/cjs/groups/MessagingState.d.ts

@@ -0,0 +1,24 @@
+/**
+ * @license
+ * Copyright 2022-2025 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { StorageContext } from "#general";
+import { PersistedMessageCounter } from "#protocol/MessageCounter.js";
+import { MessageReceptionStateEncryptedWithRollover } from "#protocol/MessageReceptionState.js";
+import { NodeId } from "#types";
+export declare class MessagingState {
+    #private;
+    constructor(storage?: StorageContext);
+    set storage(storage: StorageContext);
+    /**
+     * Return the message counter for sending messages to a group with the given operational key.
+     */
+    counterFor(operationalKey: Uint8Array): PersistedMessageCounter;
+    removeCounter(key: Uint8Array, forDelete?: boolean): Promise<void>;
+    /**
+     * Returns the message reception state for a given source node id and operational key.
+     */
+    receptionStateFor(sourceNodeId: NodeId, operationalKey: Uint8Array): MessageReceptionStateEncryptedWithRollover;
+}
+//# sourceMappingURL=MessagingState.d.ts.map

package/dist/cjs/groups/MessagingState.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MessagingState.d.ts","sourceRoot":"","sources":["../../../src/groups/MessagingState.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAA6C,cAAc,EAAE,MAAM,UAAU,CAAC;AACrF,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,EAAE,0CAA0C,EAAE,MAAM,oCAAoC,CAAC;AAChG,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,qBAAa,cAAc;;gBAaX,OAAO,CAAC,EAAE,cAAc;IAMpC,IAAI,OAAO,CAAC,OAAO,EAAE,cAAc,EAKlC;IAED;;OAEG;IACH,UAAU,CAAC,cAAc,EAAE,UAAU;IAa/B,aAAa,CAAC,GAAG,EAAE,UAAU,EAAE,SAAS,UAAQ;IAStD;;OAEG;IACH,iBAAiB,CAAC,YAAY,EAAE,MAAM,EAAE,cAAc,EAAE,UAAU;CAWrE"}

package/dist/cjs/groups/MessagingState.js

@@ -0,0 +1,91 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var MessagingState_exports = {};
+__export(MessagingState_exports, {
+  MessagingState: () => MessagingState
+});
+module.exports = __toCommonJS(MessagingState_exports);
+var import_general = require("#general");
+var import_MessageCounter = require("#protocol/MessageCounter.js");
+var import_MessageReceptionState = require("#protocol/MessageReceptionState.js");
+/**
+ * @license
+ * Copyright 2022-2025 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+class MessagingState {
+  /**
+   * Message counter for sending data messages to a group per Operational key. No need to scope to a source node
+   * because we are the sending node
+   * TODO: For management: Make sure to start rotating the key early enough that a former counter-value is not used
+   *  again for the same key.
+   */
+  #groupDataCounters = /* @__PURE__ */ new Map();
+  /** Message reception state for data messages per Operational key and source node. */
+  #messageDataReceptionState = /* @__PURE__ */ new Map();
+  #storage;
+  constructor(storage) {
+    if (storage !== void 0) {
+      this.#storage = storage;
+    }
+  }
+  set storage(storage) {
+    if (this.#storage !== void 0) {
+      throw new import_general.InternalError("Storage context can only be set once.");
+    }
+    this.#storage = storage;
+  }
+  /**
+   * Return the message counter for sending messages to a group with the given operational key.
+   */
+  counterFor(operationalKey) {
+    if (!this.#storage) {
+      throw new import_general.ImplementationError("Group session cannot be created without storage context.");
+    }
+    const operationalKeyHex = import_general.Bytes.toHex(operationalKey);
+    let counter = this.#groupDataCounters.get(operationalKeyHex);
+    if (counter === void 0) {
+      counter = new import_MessageCounter.PersistedMessageCounter(this.#storage, `${operationalKeyHex}-data`);
+      this.#groupDataCounters.set(operationalKeyHex, counter);
+    }
+    return counter;
+  }
+  async removeCounter(key, forDelete = false) {
+    const operationalKeyHex = import_general.Bytes.toHex(key);
+    this.#groupDataCounters.delete(operationalKeyHex);
+    if (forDelete) {
+      await this.#storage?.delete(`${operationalKeyHex}-data`);
+    }
+  }
+  /**
+   * Returns the message reception state for a given source node id and operational key.
+   */
+  receptionStateFor(sourceNodeId, operationalKey) {
+    const operationalKeyHex = import_general.Bytes.toHex(operationalKey);
+    let receptionState = this.#messageDataReceptionState.get(operationalKeyHex)?.get(sourceNodeId);
+    if (receptionState === void 0) {
+      receptionState = new import_MessageReceptionState.MessageReceptionStateEncryptedWithRollover();
+      const keyMap = this.#messageDataReceptionState.get(operationalKeyHex) ?? /* @__PURE__ */ new Map();
+      keyMap.set(sourceNodeId, receptionState);
+      this.#messageDataReceptionState.set(operationalKeyHex, keyMap);
+    }
+    return receptionState;
+  }
+}
+//# sourceMappingURL=MessagingState.js.map

package/dist/cjs/groups/MessagingState.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": ["../../../src/groups/MessagingState.ts"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAKA,qBAA0E;AAC1E,4BAAwC;AACxC,mCAA2D;AAP3D;AAAA;AAAA;AAAA;AAAA;AAUO,MAAM,eAAe;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOf,qBAAqB,oBAAI,IAAqC;AAAA;AAAA,EAG9D,6BAA6B,oBAAI,IAAqE;AAAA,EAC/G;AAAA,EAEA,YAAY,SAA0B;AAClC,QAAI,YAAY,QAAW;AACvB,WAAK,WAAW;AAAA,IACpB;AAAA,EACJ;AAAA,EAEA,IAAI,QAAQ,SAAyB;AACjC,QAAI,KAAK,aAAa,QAAW;AAC7B,YAAM,IAAI,6BAAc,uCAAuC;AAAA,IACnE;AACA,SAAK,WAAW;AAAA,EACpB;AAAA;AAAA;AAAA;AAAA,EAKA,WAAW,gBAA4B;AACnC,QAAI,CAAC,KAAK,UAAU;AAChB,YAAM,IAAI,mCAAoB,0DAA0D;AAAA,IAC5F;AACA,UAAM,oBAAoB,qBAAM,MAAM,cAAc;AACpD,QAAI,UAAU,KAAK,mBAAmB,IAAI,iBAAiB;AAC3D,QAAI,YAAY,QAAW;AACvB,gBAAU,IAAI,8CAAwB,KAAK,UAAU,GAAG,iBAAiB,OAAO;AAChF,WAAK,mBAAmB,IAAI,mBAAmB,OAAO;AAAA,IAC1D;AACA,WAAO;AAAA,EACX;AAAA,EAEA,MAAM,cAAc,KAAiB,YAAY,OAAO;AACpD,UAAM,oBAAoB,qBAAM,MAAM,GAAG;AACzC,SAAK,mBAAmB,OAAO,iBAAiB;AAChD,QAAI,WAAW;AAEX,YAAM,KAAK,UAAU,OAAO,GAAG,iBAAiB,OAAO;AAAA,IAC3D;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA,EAKA,kBAAkB,cAAsB,gBAA4B;AAChE,UAAM,oBAAoB,qBAAM,MAAM,cAAc;AACpD,QAAI,iBAAiB,KAAK,2BAA2B,IAAI,iBAAiB,GAAG,IAAI,YAAY;AAC7F,QAAI,mBAAmB,QAAW;AAC9B,uBAAiB,IAAI,wEAA2C;AAChE,YAAM,SAAS,KAAK,2BAA2B,IAAI,iBAAiB,KAAK,oBAAI,IAAI;AACjF,aAAO,IAAI,cAAc,cAAc;AACvC,WAAK,2BAA2B,IAAI,mBAAmB,MAAM;AAAA,IACjE;AACA,WAAO;AAAA,EACX;AACJ;",
+  "names": []
+}

package/dist/cjs/groups/index.d.ts

@@ -0,0 +1,8 @@
+/**
+ * @license
+ * Copyright 2022-2025 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+export * from "./FabricGroupsManager.js";
+export * from "./KeySets.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/cjs/groups/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/groups/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,0BAA0B,CAAC;AACzC,cAAc,cAAc,CAAC"}

package/dist/cjs/groups/index.js

@@ -0,0 +1,25 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __reExport = (target, mod, secondTarget) => (__copyProps(target, mod, "default"), secondTarget && __copyProps(secondTarget, mod, "default"));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var groups_exports = {};
+module.exports = __toCommonJS(groups_exports);
+__reExport(groups_exports, require("./FabricGroupsManager.js"), module.exports);
+__reExport(groups_exports, require("./KeySets.js"), module.exports);
+/**
+ * @license
+ * Copyright 2022-2025 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+//# sourceMappingURL=index.js.map

package/dist/cjs/groups/index.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": ["../../../src/groups/index.ts"],
+  "mappings": ";;;;;;;;;;;;;;;AAAA;AAAA;AAMA,2BAAc,qCANd;AAOA,2BAAc,yBAPd;AAAA;AAAA;AAAA;AAAA;AAAA;",
+  "names": []
+}

package/dist/cjs/index.d.ts

@@ -11,6 +11,7 @@ export * from "./codec/index.js";
 export * from "./common/index.js";
 export * from "./events/index.js";
 export * from "./fabric/index.js";
+export * from "./groups/index.js";
 export * from "./interaction/index.js";
 export * from "./mdns/index.js";
 export * from "./peer/index.js";

package/dist/cjs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,wBAAwB,CAAC;AACvC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,wBAAwB,CAAC;AACvC,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,qBAAqB,CAAC;AACpC,cAAc,0BAA0B,CAAC;AACzC,cAAc,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,wBAAwB,CAAC;AACvC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,wBAAwB,CAAC;AACvC,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,qBAAqB,CAAC;AACpC,cAAc,0BAA0B,CAAC;AACzC,cAAc,oBAAoB,CAAC"}

package/dist/cjs/index.js

@@ -23,6 +23,7 @@ __reExport(src_exports, require("./codec/index.js"), module.exports);
 __reExport(src_exports, require("./common/index.js"), module.exports);
 __reExport(src_exports, require("./events/index.js"), module.exports);
 __reExport(src_exports, require("./fabric/index.js"), module.exports);
+__reExport(src_exports, require("./groups/index.js"), module.exports);
 __reExport(src_exports, require("./interaction/index.js"), module.exports);
 __reExport(src_exports, require("./mdns/index.js"), module.exports);
 __reExport(src_exports, require("./peer/index.js"), module.exports);

package/dist/cjs/index.js.map

@@ -1,6 +1,6 @@
 {
   "version": 3,
   "sources": ["../../src/index.ts"],
-  "mappings": ";;;;;;;;;;;;;;;AAAA;AAAA;AAMA,wBAAc,8BANd;AAOA,wBAAc,2BAPd;AAQA,wBAAc,mCARd;AASA,wBAAc,+BATd;AAUA,wBAAc,6BAVd;AAWA,wBAAc,8BAXd;AAYA,wBAAc,8BAZd;AAaA,wBAAc,8BAbd;AAcA,wBAAc,mCAdd;AAeA,wBAAc,4BAfd;AAgBA,wBAAc,4BAhBd;AAiBA,wBAAc,gCAjBd;AAkBA,wBAAc,qCAlBd;AAmBA,wBAAc,+BAnBd;AAAA;AAAA;AAAA;AAAA;AAAA;",
+  "mappings": ";;;;;;;;;;;;;;;AAAA;AAAA;AAMA,wBAAc,8BANd;AAOA,wBAAc,2BAPd;AAQA,wBAAc,mCARd;AASA,wBAAc,+BATd;AAUA,wBAAc,6BAVd;AAWA,wBAAc,8BAXd;AAYA,wBAAc,8BAZd;AAaA,wBAAc,8BAbd;AAcA,wBAAc,8BAdd;AAeA,wBAAc,mCAfd;AAgBA,wBAAc,4BAhBd;AAiBA,wBAAc,4BAjBd;AAkBA,wBAAc,gCAlBd;AAmBA,wBAAc,qCAnBd;AAoBA,wBAAc,+BApBd;AAAA;AAAA;AAAA;AAAA;AAAA;",
   "names": []
 }

package/dist/cjs/interaction/AccessControlManager.d.ts

@@ -1,12 +1,7 @@
-/**
- * @license
- * Copyright 2022-2023 Project CHIP Authors
- * SPDX-License-Identifier: Apache-2.0
- */
 import { AccessControl } from "#clusters/access-control";
 import { AccessLevel } from "#model";
-import { ClusterId, DeviceTypeId, EndpointNumber, FabricIndex, NodeId, StatusResponseError } from "#types";
-import { SecureSession } from "../session/SecureSession.js";
+import { ClusterId, DeviceTypeId, EndpointNumber, FabricIndex, StatusResponseError, SubjectId } from "#types";
+import { AccessControl as AccessControlContext } from "../action/server/AccessControl.js";
 export type AclEntry = Omit<AccessControl.AccessControlEntry, "privilege"> & {
     privilege: AccessLevel;
 };
@@ -23,7 +18,7 @@ declare enum AuthModeNone {
 export type IncomingSubjectDescriptor = {
     isCommissioning: boolean;
     authMode: AccessControl.AccessControlEntryAuthMode | AuthModeNone;
-    subjects: NodeId[];
+    subjects: SubjectId[];
     fabricIndex: FabricIndex;
 };
 export declare class AccessDeniedError extends StatusResponseError {
@@ -39,14 +34,10 @@ export declare class AccessControlManager {
      * Public method used to update the Access Control List on changes.
      */
     updateAccessControlList(aclList?: AccessControl.AccessControlEntry[]): void;
-    /**
-     * Check if the given ACL entry is allowed to be used for the given subject descriptor, endpoint, and cluster ID.
-     */
-    allowsPrivilege(session: SecureSession, endpoint: AclEndpointContext, clusterId: ClusterId, privilege: AccessLevel): boolean;
     /**
      * Determines the granted privileges for the given session, endpoint, and cluster ID and returns them.
      */
-    getGrantedPrivileges(session: SecureSession, endpoint: AclEndpointContext, clusterId: ClusterId): AccessLevel[];
+    getGrantedPrivileges(context: AccessControlContext.Session, endpoint: AclEndpointContext, clusterId: ClusterId): AccessLevel[];
 }
 export {};
 //# sourceMappingURL=AccessControlManager.d.ts.map

package/dist/cjs/interaction/AccessControlManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AccessControlManager.d.ts","sourceRoot":"","sources":["../../../src/interaction/AccessControlManager.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAEzD,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,EAEH,SAAS,EACT,YAAY,EACZ,cAAc,EACd,WAAW,EACX,MAAM,EAEN,mBAAmB,EACtB,MAAM,QAAQ,CAAC;AAEhB,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAI5D,MAAM,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,kBAAkB,EAAE,WAAW,CAAC,GAAG;IACzE,SAAS,EAAE,WAAW,CAAC;CAC1B,CAAC;AACF,MAAM,MAAM,OAAO,GAAG,QAAQ,EAAE,CAAC;AAEjC,MAAM,MAAM,iBAAiB,GAAG,aAAa,CAAC,sBAAsB,CAAC;AACrE,MAAM,MAAM,gBAAgB,GAAG,iBAAiB,EAAE,CAAC;AAEnD,MAAM,MAAM,kBAAkB,GAAG;IAC7B,EAAE,EAAE,cAAc,CAAC;IACnB,WAAW,EAAE,YAAY,EAAE,CAAC;CAC/B,CAAC;AAUF,aAAK,YAAY;IACb,IAAI,IAAI;CACX;AAED,MAAM,MAAM,yBAAyB,GAAG;IACpC,eAAe,EAAE,OAAO,CAAC;IACzB,QAAQ,EAAE,aAAa,CAAC,0BAA0B,GAAG,YAAY,CAAC;IAClE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,WAAW,EAAE,WAAW,CAAC;CAC5B,CAAC;AAEF,qBAAa,iBAAkB,SAAQ,mBAAmB;gBAC1C,OAAO,CAAC,EAAE,MAAM;CAG/B;AAED;;GAEG;AACH,qBAAa,oBAAoB;;gBAWzB,OAAO,GAAE,aAAa,CAAC,kBAAkB,EAAO,EAChD,yBAAyB,CAAC,EAAE,CACxB,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,QAAQ,EAClB,WAAW,EAAE,yBAAyB,EACtC,QAAQ,EAAE,kBAAkB,EAC5B,SAAS,EAAE,SAAS,KACnB,OAAO;IAQhB;;OAEG;IACH,uBAAuB,CAAC,OAAO,GAAE,aAAa,CAAC,kBAAkB,EAAO,GAAG,IAAI;IAyD/E;;OAEG;IACH,eAAe,CACX,OAAO,EAAE,aAAa,EACtB,QAAQ,EAAE,kBAAkB,EAC5B,SAAS,EAAE,SAAS,EACpB,SAAS,EAAE,WAAW,GACvB,OAAO;IAoBV;;OAEG;IACH,oBAAoB,CAAC,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,kBAAkB,EAAE,SAAS,EAAE,SAAS,GAAG,WAAW,EAAE;CA6KlH"}
+{"version":3,"file":"AccessControlManager.d.ts","sourceRoot":"","sources":["../../../src/interaction/AccessControlManager.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAEzD,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,EAEH,SAAS,EACT,YAAY,EACZ,cAAc,EACd,WAAW,EAGX,mBAAmB,EACnB,SAAS,EACZ,MAAM,QAAQ,CAAC;AAChB,OAAO,EAAE,aAAa,IAAI,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAE1F,MAAM,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,kBAAkB,EAAE,WAAW,CAAC,GAAG;IACzE,SAAS,EAAE,WAAW,CAAC;CAC1B,CAAC;AACF,MAAM,MAAM,OAAO,GAAG,QAAQ,EAAE,CAAC;AAEjC,MAAM,MAAM,iBAAiB,GAAG,aAAa,CAAC,sBAAsB,CAAC;AACrE,MAAM,MAAM,gBAAgB,GAAG,iBAAiB,EAAE,CAAC;AAEnD,MAAM,MAAM,kBAAkB,GAAG;IAC7B,EAAE,EAAE,cAAc,CAAC;IACnB,WAAW,EAAE,YAAY,EAAE,CAAC;CAC/B,CAAC;AAUF,aAAK,YAAY;IACb,IAAI,IAAI;CACX;AAED,MAAM,MAAM,yBAAyB,GAAG;IACpC,eAAe,EAAE,OAAO,CAAC;IACzB,QAAQ,EAAE,aAAa,CAAC,0BAA0B,GAAG,YAAY,CAAC;IAClE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACtB,WAAW,EAAE,WAAW,CAAC;CAC5B,CAAC;AAEF,qBAAa,iBAAkB,SAAQ,mBAAmB;gBAC1C,OAAO,CAAC,EAAE,MAAM;CAG/B;AAED;;GAEG;AACH,qBAAa,oBAAoB;;gBAWzB,OAAO,GAAE,aAAa,CAAC,kBAAkB,EAAO,EAChD,yBAAyB,CAAC,EAAE,CACxB,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,QAAQ,EAClB,WAAW,EAAE,yBAAyB,EACtC,QAAQ,EAAE,kBAAkB,EAC5B,SAAS,EAAE,SAAS,KACnB,OAAO;IAQhB;;OAEG;IACH,uBAAuB,CAAC,OAAO,GAAE,aAAa,CAAC,kBAAkB,EAAO,GAAG,IAAI;IA2D/E;;OAEG;IACH,oBAAoB,CAChB,OAAO,EAAE,oBAAoB,CAAC,OAAO,EACrC,QAAQ,EAAE,kBAAkB,EAC5B,SAAS,EAAE,SAAS,GACrB,WAAW,EAAE;CAoKnB"}