@matter/protocol 0.16.0-alpha.0-20250909-aecad94f3 → 0.16.0-alpha.0-20250912-0d12bf718

package/dist/esm/session/case/CaseClient.js

@@ -30,10 +30,11 @@ class CaseClient {
   constructor(sessions) {
     this.#sessions = sessions;
   }
-  async pair(exchange, fabric, peerNodeId, expectedProcessingTime) {
+  async pair(exchange, fabric, peerNodeId, options) {
+    const { expectedProcessingTime, caseAuthenticatedTags } = options ?? {};
     const messenger = new CaseClientMessenger(exchange, expectedProcessingTime);
     try {
-      return await this.#doPair(messenger, exchange, fabric, peerNodeId);
+      return await this.#doPair(messenger, exchange, fabric, peerNodeId, caseAuthenticatedTags);
     } catch (error) {
       if (!(error instanceof ChannelStatusResponseError || error instanceof RetransmissionLimitReachedError)) {
         await messenger.sendError(SecureChannelStatusCode.InvalidParam);
@@ -41,7 +42,7 @@ class CaseClient {
       throw error;
     }
   }
-  async #doPair(messenger, exchange, fabric, peerNodeId) {
+  async #doPair(messenger, exchange, fabric, peerNodeId, caseAuthenticatedTags) {
     const { crypto } = fabric;
     const initiatorRandom = crypto.randomBytes(32);
     const initiatorSessionId = await this.#sessions.getNextAvailableSessionId();
@@ -84,7 +85,7 @@ class CaseClient {
         sharedSecret,
         fabric: fabric2,
         sessionParameters: resumptionSessionParams,
-        caseAuthenticatedTags
+        caseAuthenticatedTags: caseAuthenticatedTags2
       } = resumptionRecord;
       const { responderSessionId: peerSessionId, resumptionId, resumeMic } = sigma2Resume;
       const sessionParameters = {
@@ -105,7 +106,7 @@ class CaseClient {
         isInitiator: true,
         isResumption: true,
         peerSessionParameters: sessionParameters,
-        caseAuthenticatedTags
+        caseAuthenticatedTags: caseAuthenticatedTags2
       });
       await messenger.sendSuccess();
       this.#logNewSession("Resumed", secureSession, messenger, fabric2, peerNodeId);
@@ -191,7 +192,7 @@ class CaseClient {
       const encrypted = crypto.encrypt(sigma3Key, encryptedData, TBE_DATA3_NONCE);
       const sigma3Bytes = await messenger.sendSigma3({ encrypted });
       await messenger.waitForSuccess("Sigma3-Success");
-      const { caseAuthenticatedTags } = resumptionRecord ?? {};
+      const sessionCaseAuthenticatedTags = caseAuthenticatedTags ?? resumptionRecord?.caseAuthenticatedTags;
       const secureSessionSalt = Bytes.concat(
         operationalIdentityProtectionKey,
         await crypto.computeSha256([sigma1Bytes, sigma2Bytes, sigma3Bytes])
@@ -206,7 +207,7 @@ class CaseClient {
         isInitiator: true,
         isResumption: false,
         peerSessionParameters,
-        caseAuthenticatedTags
+        caseAuthenticatedTags: sessionCaseAuthenticatedTags
       });
       this.#logNewSession("New", secureSession, messenger, fabric, peerNodeId);
       resumptionRecord = {
@@ -215,7 +216,7 @@ class CaseClient {
         sharedSecret,
         resumptionId: peerResumptionId,
         sessionParameters: secureSession.parameters,
-        caseAuthenticatedTags
+        caseAuthenticatedTags: sessionCaseAuthenticatedTags
       };
     }
     await messenger.close();

package/dist/esm/session/case/CaseClient.js.map

@@ -1,6 +1,6 @@
 {
   "version": 3,
   "sources": ["../../../../src/session/case/CaseClient.ts"],
-  "mappings": "AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,SAAS,YAAY;AACrB,SAAS,WAAW;AAEpB,SAAS,OAAO,YAAsB,QAAQ,WAAW,2BAA2B;AACpF,SAAS,mBAAmB;AAC5B,SAA0B,uCAAuC;AACjE,SAAS,kCAAkC;AAG3C,SAAS,QAAQ,+BAA+B;AAChD;AAAA,EACI;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACG;AACP,SAAS,2BAA2B;AAEpC,MAAM,SAAS,OAAO,IAAI,YAAY;AAE/B,MAAM,WAAW;AAAA,EACpB;AAAA,EAEA,YAAY,UAA0B;AAClC,SAAK,YAAY;AAAA,EACrB;AAAA,EAEA,MAAM,KAAK,UAA2B,QAAgB,YAAoB,wBAAmC;AACzG,UAAM,YAAY,IAAI,oBAAoB,UAAU,sBAAsB;AAE1E,QAAI;AACA,aAAO,MAAM,KAAK,QAAQ,WAAW,UAAU,QAAQ,UAAU;AAAA,IACrE,SAAS,OAAO;AACZ,UAAI,EAAE,iBAAiB,8BAA8B,iBAAiB,kCAAkC;AACpG,cAAM,UAAU,UAAU,wBAAwB,YAAY;AAAA,MAClE;AACA,YAAM;AAAA,IACV;AAAA,EACJ;AAAA,EAEA,MAAM,QAAQ,WAAgC,UAA2B,QAAgB,YAAoB;AACzG,UAAM,EAAE,OAAO,IAAI;AAGnB,UAAM,kBAAkB,OAAO,YAAY,EAAE;AAC7C,UAAM,qBAAqB,MAAM,KAAK,UAAU,0BAA0B;AAC1E,UAAM,EAAE,kCAAkC,iBAAiB,UAAU,oBAAoB,UAAU,IAAI;AACvG,UAAM,WAAW,MAAM,OAAO,cAAc;AAG5C,QAAI;AACJ,QAAI,UAAU;AACd,QAAI,mBAAmB,KAAK,UAAU,8BAA8B,OAAO,UAAU,UAAU,CAAC;AAChG,QAAI,qBAAqB,QAAW;AAChC,YAAM,EAAE,cAAc,aAAa,IAAI;AACvC,YAAM,YAAY,MAAM,OAAO;AAAA,QAC3B;AAAA,QACA,MAAM,OAAO,iBAAiB,YAAY;AAAA,QAC1C;AAAA,MACJ;AACA,YAAM,qBAAqB,OAAO,QAAQ,WAAW,IAAI,WAAW,CAAC,GAAG,iBAAiB;AACzF,oBAAc,MAAM,UAAU,WAAW;AAAA,QACrC;AAAA,QACA,eAAe,MAAM,OAAO,wBAAwB,YAAY,eAAe;AAAA,QAC/E,wBAAwB,SAAS;AAAA,QACjC;AAAA,QACA;AAAA,QACA;AAAA,QACA,wBAAwB,KAAK,UAAU;AAAA,MAC3C,CAAC;AAAA,IACL,OAAO;AACH,oBAAc,MAAM,UAAU,WAAW;AAAA,QACrC;AAAA,QACA,eAAe,MAAM,OAAO,wBAAwB,YAAY,eAAe;AAAA,QAC/E,wBAAwB,SAAS;AAAA,QACjC;AAAA,QACA,wBAAwB,KAAK,UAAU;AAAA,MAC3C,CAAC;AAAA,IACL;AAEA,QAAI;AACJ,UAAM,EAAE,aAAa,QAAQ,aAAa,IAAI,MAAM,UAAU,WAAW;AACzE,QAAI,iBAAiB,QAAW;AAE5B,UAAI,qBAAqB,OAAW,OAAM,IAAI,oBAAoB,sCAAsC;AACxG,YAAM;AAAA,QACF;AAAA,QACA,QAAAA;AAAA,QACA,mBAAmB;AAAA,QACnB;AAAA,MACJ,IAAI;AACJ,YAAM,EAAE,oBAAoB,eAAe,cAAc,UAAU,IAAI;AAGvE,YAAM,oBAAoB;AAAA,QACtB,GAAG,SAAS,QAAQ;AAAA,QACpB,GAAI,2BAA2B,CAAC;AAAA,MACpC;AAEA,YAAM,aAAa,MAAM,OAAO,iBAAiB,YAAY;AAC7D,YAAM,YAAY,MAAM,OAAO,cAAc,cAAc,YAAY,eAAe;AACtF,aAAO,QAAQ,WAAW,WAAW,iBAAiB;AAEtD,YAAM,oBAAoB,MAAM,OAAO,iBAAiB,iBAAiB,YAAY;AACrF,sBAAgB,MAAM,KAAK,UAAU,oBAAoB;AAAA,QACrD,WAAW;AAAA,QACX,QAAAA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,MAAM;AAAA,QACN,aAAa;AAAA,QACb,cAAc;AAAA,QACd,uBAAuB;AAAA,QACvB;AAAA,MACJ,CAAC;AACD,YAAM,UAAU,YAAY;AAC5B,WAAK,eAAe,WAAW,eAAe,WAAWA,SAAQ,UAAU;AAE3E,uBAAiB,eAAe;AAChC,uBAAiB,oBAAoB,cAAc;AACnD,gBAAU;AAAA,IACd,OAAO;AAEH,YAAM;AAAA,QACF,wBAAwB;AAAA,QACxB,WAAW;AAAA,QACX;AAAA,QACA,oBAAoB;AAAA,QACpB;AAAA,MACJ,IAAI;AAEJ,YAAM,wBAAwB;AAAA,QAC1B,GAAG,SAAS,QAAQ;AAAA,QACpB,GAAI,0BAA0B,CAAC;AAAA,MACnC;AACA,YAAM,eAAe,MAAM,OAAO,iBAAiB,UAAU,UAAU,OAAO,CAAC;AAC/E,YAAM,aAAa,MAAM;AAAA,QACrB;AAAA,QACA;AAAA,QACA;AAAA,QACA,MAAM,OAAO,cAAc,WAAW;AAAA,MAC1C;AACA,YAAM,YAAY,MAAM,OAAO,cAAc,cAAc,YAAY,WAAW;AAClF,YAAM,oBAAoB,OAAO,QAAQ,WAAW,eAAe,eAAe;AAClF,YAAM;AAAA,QACF,cAAc;AAAA,QACd,eAAe;AAAA,QACf,WAAW;AAAA,QACX,cAAc;AAAA,MAClB,IAAI,uBAAuB,OAAO,iBAAiB;AACnD,YAAM,oBAAoB,cAAc,OAAO;AAAA,QAC3C,cAAc;AAAA,QACd,eAAe;AAAA,QACf,oBAAoB;AAAA,QACpB,oBAAoB,SAAS;AAAA,MACjC,CAAC;AACD,YAAM;AAAA,QACF,wBAAwB;AAAA,QACxB,SAAS,EAAE,UAAU,oBAAoB,QAAQ,iBAAiB;AAAA,MACtE,IAAI,IAAI,QAAQ,OAAO,EAAE;AAEzB,YAAM,OAAO,YAAY,UAAU,aAAa,GAAG,mBAAmB,aAAa;AAEnF,UAAI,qBAAqB,YAAY;AACjC,cAAM,IAAI;AAAA,UACN,uCAAuC,gBAAgB,4CAA4C,UAAU;AAAA,QACjH;AAAA,MACJ;AACA,UAAI,uBAAuB,OAAO,UAAU;AACxC,cAAM,IAAI;AAAA,UACN,yCAAyC,kBAAkB,yCAAyC,OAAO,QAAQ;AAAA,QACvH;AAAA,MACJ;AACA,UAAI,aAAa,QAAW;AACxB,cAAM;AAAA,UACF,SAAS,EAAE,UAAU,oBAAoB;AAAA,QAC7C,IAAI,KAAK,QAAQ,QAAQ,EAAE;AAE3B,YAAI,wBAAwB,UAAa,wBAAwB,OAAO,UAAU;AAC9E,gBAAM,IAAI;AAAA,YACN,yDAAyD,mBAAmB,yCAAyC,OAAO,QAAQ;AAAA,UACxI;AAAA,QACJ;AAAA,MACJ;AACA,YAAM,OAAO,kBAAkB,SAAS,QAAQ;AAGhD,YAAM,aAAa,MAAM;AAAA,QACrB;AAAA,QACA,MAAM,OAAO,cAAc,CAAC,aAAa,WAAW,CAAC;AAAA,MACzD;AACA,YAAM,YAAY,MAAM,OAAO,cAAc,cAAc,YAAY,WAAW;AAClF,YAAM,gBAAgB,cAAc,OAAO;AAAA,QACvC,cAAc;AAAA,QACd,eAAe;AAAA,QACf,oBAAoB,SAAS;AAAA,QAC7B,oBAAoB;AAAA,MACxB,CAAC;AACD,YAAM,YAAY,MAAM,OAAO,KAAK,aAAa;AACjD,YAAM,gBAAgB,uBAAuB,OAAO;AAAA,QAChD,cAAc;AAAA,QACd,eAAe;AAAA,QACf;AAAA,MACJ,CAAC;AACD,YAAM,YAAY,OAAO,QAAQ,WAAW,eAAe,eAAe;AAC1E,YAAM,cAAc,MAAM,UAAU,WAAW,EAAE,UAAU,CAAC;AAC5D,YAAM,UAAU,eAAe,gBAAgB;AAG/C,YAAM,EAAE,sBAAsB,IAAI,oBAAoB,CAAC;AACvD,YAAM,oBAAoB,MAAM;AAAA,QAC5B;AAAA,QACA,MAAM,OAAO,cAAc,CAAC,aAAa,aAAa,WAAW,CAAC;AAAA,MACtE;AACA,sBAAgB,MAAM,KAAK,UAAU,oBAAoB;AAAA,QACrD,WAAW;AAAA,QACX;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,MAAM;AAAA,QACN,aAAa;AAAA,QACb,cAAc;AAAA,QACd;AAAA,QACA;AAAA,MACJ,CAAC;AACD,WAAK,eAAe,OAAO,eAAe,WAAW,QAAQ,UAAU;AACvE,yBAAmB;AAAA,QACf;AAAA,QACA;AAAA,QACA;AAAA,QACA,cAAc;AAAA,QACd,mBAAmB,cAAc;AAAA,QACjC;AAAA,MACJ;AAAA,IACJ;AAEA,UAAM,UAAU,MAAM;AACtB,UAAM,KAAK,UAAU,qBAAqB,gBAAgB;AAE1D,WAAO,EAAE,SAAS,eAAe,QAAQ;AAAA,EAC7C;AAAA,EAEA,eACI,WACA,SACA,WACA,QACA,YACF;AACE,WAAO;AAAA,MACH,GAAG,SAAS;AAAA,MACZ,WAAW,OAAO,YAAY,EAAE,aAAa,OAAO,aAAa,QAAQ,WAAW,CAAC,EAAE,SAAS,CAAC;AAAA,MACjG,WAAW,KAAK;AAAA,QACZ,IAAI,QAAQ;AAAA,QACZ,SAAS,UAAU;AAAA,QACnB,QAAQ,GAAG,OAAO,YAAY,OAAO,MAAM,CAAC,MAAM,OAAO,WAAW;AAAA,QACpE,GAAG,QAAQ;AAAA,MACf,CAAC;AAAA,IACL;AAAA,EACJ;AACJ;",
-  "names": ["fabric"]
+  "mappings": "AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,SAAS,YAAY;AACrB,SAAS,WAAW;AAEpB,SAAS,OAAO,YAAsB,QAAQ,WAAW,2BAA2B;AACpF,SAAS,mBAAmB;AAC5B,SAA0B,uCAAuC;AACjE,SAAS,kCAAkC;AAG3C,SAA+B,QAAQ,+BAA+B;AACtE;AAAA,EACI;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACG;AACP,SAAS,2BAA2B;AAEpC,MAAM,SAAS,OAAO,IAAI,YAAY;AAE/B,MAAM,WAAW;AAAA,EACpB;AAAA,EAEA,YAAY,UAA0B;AAClC,SAAK,YAAY;AAAA,EACrB;AAAA,EAEA,MAAM,KAAK,UAA2B,QAAgB,YAAoB,SAAkC;AACxG,UAAM,EAAE,wBAAwB,sBAAsB,IAAI,WAAW,CAAC;AACtE,UAAM,YAAY,IAAI,oBAAoB,UAAU,sBAAsB;AAE1E,QAAI;AACA,aAAO,MAAM,KAAK,QAAQ,WAAW,UAAU,QAAQ,YAAY,qBAAqB;AAAA,IAC5F,SAAS,OAAO;AACZ,UAAI,EAAE,iBAAiB,8BAA8B,iBAAiB,kCAAkC;AACpG,cAAM,UAAU,UAAU,wBAAwB,YAAY;AAAA,MAClE;AACA,YAAM;AAAA,IACV;AAAA,EACJ;AAAA,EAEA,MAAM,QACF,WACA,UACA,QACA,YACA,uBACF;AACE,UAAM,EAAE,OAAO,IAAI;AAGnB,UAAM,kBAAkB,OAAO,YAAY,EAAE;AAC7C,UAAM,qBAAqB,MAAM,KAAK,UAAU,0BAA0B;AAC1E,UAAM,EAAE,kCAAkC,iBAAiB,UAAU,oBAAoB,UAAU,IAAI;AACvG,UAAM,WAAW,MAAM,OAAO,cAAc;AAG5C,QAAI;AACJ,QAAI,UAAU;AACd,QAAI,mBAAmB,KAAK,UAAU,8BAA8B,OAAO,UAAU,UAAU,CAAC;AAChG,QAAI,qBAAqB,QAAW;AAChC,YAAM,EAAE,cAAc,aAAa,IAAI;AACvC,YAAM,YAAY,MAAM,OAAO;AAAA,QAC3B;AAAA,QACA,MAAM,OAAO,iBAAiB,YAAY;AAAA,QAC1C;AAAA,MACJ;AACA,YAAM,qBAAqB,OAAO,QAAQ,WAAW,IAAI,WAAW,CAAC,GAAG,iBAAiB;AACzF,oBAAc,MAAM,UAAU,WAAW;AAAA,QACrC;AAAA,QACA,eAAe,MAAM,OAAO,wBAAwB,YAAY,eAAe;AAAA,QAC/E,wBAAwB,SAAS;AAAA,QACjC;AAAA,QACA;AAAA,QACA;AAAA,QACA,wBAAwB,KAAK,UAAU;AAAA,MAC3C,CAAC;AAAA,IACL,OAAO;AACH,oBAAc,MAAM,UAAU,WAAW;AAAA,QACrC;AAAA,QACA,eAAe,MAAM,OAAO,wBAAwB,YAAY,eAAe;AAAA,QAC/E,wBAAwB,SAAS;AAAA,QACjC;AAAA,QACA,wBAAwB,KAAK,UAAU;AAAA,MAC3C,CAAC;AAAA,IACL;AAEA,QAAI;AACJ,UAAM,EAAE,aAAa,QAAQ,aAAa,IAAI,MAAM,UAAU,WAAW;AACzE,QAAI,iBAAiB,QAAW;AAE5B,UAAI,qBAAqB,OAAW,OAAM,IAAI,oBAAoB,sCAAsC;AACxG,YAAM;AAAA,QACF;AAAA,QACA,QAAAA;AAAA,QACA,mBAAmB;AAAA,QACnB,uBAAAC;AAAA,MACJ,IAAI;AACJ,YAAM,EAAE,oBAAoB,eAAe,cAAc,UAAU,IAAI;AAGvE,YAAM,oBAAoB;AAAA,QACtB,GAAG,SAAS,QAAQ;AAAA,QACpB,GAAI,2BAA2B,CAAC;AAAA,MACpC;AAEA,YAAM,aAAa,MAAM,OAAO,iBAAiB,YAAY;AAC7D,YAAM,YAAY,MAAM,OAAO,cAAc,cAAc,YAAY,eAAe;AACtF,aAAO,QAAQ,WAAW,WAAW,iBAAiB;AAEtD,YAAM,oBAAoB,MAAM,OAAO,iBAAiB,iBAAiB,YAAY;AACrF,sBAAgB,MAAM,KAAK,UAAU,oBAAoB;AAAA,QACrD,WAAW;AAAA,QACX,QAAAD;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,MAAM;AAAA,QACN,aAAa;AAAA,QACb,cAAc;AAAA,QACd,uBAAuB;AAAA,QACvB,uBAAAC;AAAA,MACJ,CAAC;AACD,YAAM,UAAU,YAAY;AAC5B,WAAK,eAAe,WAAW,eAAe,WAAWD,SAAQ,UAAU;AAE3E,uBAAiB,eAAe;AAChC,uBAAiB,oBAAoB,cAAc;AACnD,gBAAU;AAAA,IACd,OAAO;AAEH,YAAM;AAAA,QACF,wBAAwB;AAAA,QACxB,WAAW;AAAA,QACX;AAAA,QACA,oBAAoB;AAAA,QACpB;AAAA,MACJ,IAAI;AAEJ,YAAM,wBAAwB;AAAA,QAC1B,GAAG,SAAS,QAAQ;AAAA,QACpB,GAAI,0BAA0B,CAAC;AAAA,MACnC;AACA,YAAM,eAAe,MAAM,OAAO,iBAAiB,UAAU,UAAU,OAAO,CAAC;AAC/E,YAAM,aAAa,MAAM;AAAA,QACrB;AAAA,QACA;AAAA,QACA;AAAA,QACA,MAAM,OAAO,cAAc,WAAW;AAAA,MAC1C;AACA,YAAM,YAAY,MAAM,OAAO,cAAc,cAAc,YAAY,WAAW;AAClF,YAAM,oBAAoB,OAAO,QAAQ,WAAW,eAAe,eAAe;AAClF,YAAM;AAAA,QACF,cAAc;AAAA,QACd,eAAe;AAAA,QACf,WAAW;AAAA,QACX,cAAc;AAAA,MAClB,IAAI,uBAAuB,OAAO,iBAAiB;AACnD,YAAM,oBAAoB,cAAc,OAAO;AAAA,QAC3C,cAAc;AAAA,QACd,eAAe;AAAA,QACf,oBAAoB;AAAA,QACpB,oBAAoB,SAAS;AAAA,MACjC,CAAC;AACD,YAAM;AAAA,QACF,wBAAwB;AAAA,QACxB,SAAS,EAAE,UAAU,oBAAoB,QAAQ,iBAAiB;AAAA,MACtE,IAAI,IAAI,QAAQ,OAAO,EAAE;AAEzB,YAAM,OAAO,YAAY,UAAU,aAAa,GAAG,mBAAmB,aAAa;AAEnF,UAAI,qBAAqB,YAAY;AACjC,cAAM,IAAI;AAAA,UACN,uCAAuC,gBAAgB,4CAA4C,UAAU;AAAA,QACjH;AAAA,MACJ;AACA,UAAI,uBAAuB,OAAO,UAAU;AACxC,cAAM,IAAI;AAAA,UACN,yCAAyC,kBAAkB,yCAAyC,OAAO,QAAQ;AAAA,QACvH;AAAA,MACJ;AACA,UAAI,aAAa,QAAW;AACxB,cAAM;AAAA,UACF,SAAS,EAAE,UAAU,oBAAoB;AAAA,QAC7C,IAAI,KAAK,QAAQ,QAAQ,EAAE;AAE3B,YAAI,wBAAwB,UAAa,wBAAwB,OAAO,UAAU;AAC9E,gBAAM,IAAI;AAAA,YACN,yDAAyD,mBAAmB,yCAAyC,OAAO,QAAQ;AAAA,UACxI;AAAA,QACJ;AAAA,MACJ;AACA,YAAM,OAAO,kBAAkB,SAAS,QAAQ;AAGhD,YAAM,aAAa,MAAM;AAAA,QACrB;AAAA,QACA,MAAM,OAAO,cAAc,CAAC,aAAa,WAAW,CAAC;AAAA,MACzD;AACA,YAAM,YAAY,MAAM,OAAO,cAAc,cAAc,YAAY,WAAW;AAClF,YAAM,gBAAgB,cAAc,OAAO;AAAA,QACvC,cAAc;AAAA,QACd,eAAe;AAAA,QACf,oBAAoB,SAAS;AAAA,QAC7B,oBAAoB;AAAA,MACxB,CAAC;AACD,YAAM,YAAY,MAAM,OAAO,KAAK,aAAa;AACjD,YAAM,gBAAgB,uBAAuB,OAAO;AAAA,QAChD,cAAc;AAAA,QACd,eAAe;AAAA,QACf;AAAA,MACJ,CAAC;AACD,YAAM,YAAY,OAAO,QAAQ,WAAW,eAAe,eAAe;AAC1E,YAAM,cAAc,MAAM,UAAU,WAAW,EAAE,UAAU,CAAC;AAC5D,YAAM,UAAU,eAAe,gBAAgB;AAI/C,YAAM,+BAA+B,yBAAyB,kBAAkB;AAChF,YAAM,oBAAoB,MAAM;AAAA,QAC5B;AAAA,QACA,MAAM,OAAO,cAAc,CAAC,aAAa,aAAa,WAAW,CAAC;AAAA,MACtE;AACA,sBAAgB,MAAM,KAAK,UAAU,oBAAoB;AAAA,QACrD,WAAW;AAAA,QACX;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,MAAM;AAAA,QACN,aAAa;AAAA,QACb,cAAc;AAAA,QACd;AAAA,QACA,uBAAuB;AAAA,MAC3B,CAAC;AACD,WAAK,eAAe,OAAO,eAAe,WAAW,QAAQ,UAAU;AACvE,yBAAmB;AAAA,QACf;AAAA,QACA;AAAA,QACA;AAAA,QACA,cAAc;AAAA,QACd,mBAAmB,cAAc;AAAA,QACjC,uBAAuB;AAAA,MAC3B;AAAA,IACJ;AAEA,UAAM,UAAU,MAAM;AACtB,UAAM,KAAK,UAAU,qBAAqB,gBAAgB;AAE1D,WAAO,EAAE,SAAS,eAAe,QAAQ;AAAA,EAC7C;AAAA,EAEA,eACI,WACA,SACA,WACA,QACA,YACF;AACE,WAAO;AAAA,MACH,GAAG,SAAS;AAAA,MACZ,WAAW,OAAO,YAAY,EAAE,aAAa,OAAO,aAAa,QAAQ,WAAW,CAAC,EAAE,SAAS,CAAC;AAAA,MACjG,WAAW,KAAK;AAAA,QACZ,IAAI,QAAQ;AAAA,QACZ,SAAS,UAAU;AAAA,QACnB,QAAQ,GAAG,OAAO,YAAY,OAAO,MAAM,CAAC,MAAM,OAAO,WAAW;AAAA,QACpE,GAAG,QAAQ;AAAA,MACf,CAAC;AAAA,IACL;AAAA,EACJ;AACJ;",
+  "names": ["fabric", "caseAuthenticatedTags"]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@matter/protocol",
-    "version": "0.16.0-alpha.0-20250909-aecad94f3",
+    "version": "0.16.0-alpha.0-20250912-0d12bf718",
     "description": "Low-level APIs for Matter interaction",
     "keywords": [
         "iot",
@@ -40,13 +40,13 @@
         "#*": "./src/*"
     },
     "dependencies": {
-        "@matter/general": "0.16.0-alpha.0-20250909-aecad94f3",
-        "@matter/model": "0.16.0-alpha.0-20250909-aecad94f3",
-        "@matter/types": "0.16.0-alpha.0-20250909-aecad94f3"
+        "@matter/general": "0.16.0-alpha.0-20250912-0d12bf718",
+        "@matter/model": "0.16.0-alpha.0-20250912-0d12bf718",
+        "@matter/types": "0.16.0-alpha.0-20250912-0d12bf718"
     },
     "devDependencies": {
-        "@matter/tools": "0.16.0-alpha.0-20250909-aecad94f3",
-        "@matter/testing": "0.16.0-alpha.0-20250909-aecad94f3"
+        "@matter/tools": "0.16.0-alpha.0-20250912-0d12bf718",
+        "@matter/testing": "0.16.0-alpha.0-20250912-0d12bf718"
     },
     "files": [
         "dist/**/*",

package/src/interaction/InteractionClient.ts

@@ -23,7 +23,7 @@ import {
 import { Specification } from "#model";
 import { PeerAddress, PeerAddressMap } from "#peer/PeerAddress.js";
 import { PeerDataStore } from "#peer/PeerAddressStore.js";
-import { DiscoveryOptions, PeerSet } from "#peer/PeerSet.js";
+import { PeerConnectionOptions, PeerSet } from "#peer/PeerSet.js";
 import {
     ArraySchema,
     Attribute,
@@ -107,16 +107,14 @@ export class InteractionClientProvider {
 
     async connect(
         address: PeerAddress,
-        options: {
-            discoveryOptions: DiscoveryOptions;
+        options: PeerConnectionOptions & {
             allowUnknownPeer?: boolean;
             operationalAddress?: ServerAddressIp;
         },
     ): Promise<InteractionClient> {
         await this.#peers.ensureConnection(address, options);
 
-        const { discoveryOptions } = options;
-        return this.getInteractionClient(address, discoveryOptions);
+        return this.getInteractionClient(address, options);
     }
 
     async getInteractionClientForChannel(channel: MessageChannel): Promise<InteractionClient> {
@@ -130,7 +128,7 @@ export class InteractionClientProvider {
         );
     }
 
-    async getInteractionClient(address: PeerAddress, discoveryOptions: DiscoveryOptions) {
+    async getInteractionClient(address: PeerAddress, options: PeerConnectionOptions = {}) {
         let client = this.#clients.get(address);
         if (client !== undefined) {
             return client;
@@ -140,7 +138,7 @@ export class InteractionClientProvider {
         const nodeStore = isGroupAddress ? undefined : this.#peers.get(address)?.dataStore;
         await nodeStore?.construction; // Lazy initialize the data if not already done
 
-        const exchangeProvider = await this.#peers.exchangeProviderFor(address, discoveryOptions);
+        const exchangeProvider = await this.#peers.exchangeProviderFor(address, options);
 
         client = new InteractionClient(
             exchangeProvider,

package/src/peer/PeerSet.ts

@@ -45,7 +45,7 @@ import { CaseClient } from "#session/case/CaseClient.js";
 import { SecureSession } from "#session/SecureSession.js";
 import { Session } from "#session/Session.js";
 import { SessionManager } from "#session/SessionManager.js";
-import { GroupId, NodeId, SECURE_CHANNEL_PROTOCOL_ID, SecureChannelStatusCode } from "#types";
+import { CaseAuthenticatedTag, GroupId, NodeId, SECURE_CHANNEL_PROTOCOL_ID, SecureChannelStatusCode } from "#types";
 import { ControllerDiscovery, DiscoveryError, PairRetransmissionLimitReachedError } from "./ControllerDiscovery.js";
 import { InteractionQueue } from "./InteractionQueue.js";
 import { OperationalPeer } from "./OperationalPeer.js";
@@ -85,6 +85,14 @@ export interface DiscoveryOptions {
     discoveryData?: DiscoveryData;
 }
 
+/**
+ * Extended discovery options that include case authenticated tags for peer connections.
+ */
+export interface PeerConnectionOptions {
+    discoveryOptions?: DiscoveryOptions;
+    caseAuthenticatedTags?: CaseAuthenticatedTag[];
+}
+
 interface RunningDiscovery {
     type: NodeDiscoveryType;
     promises?: (() => Promise<MessageChannel>)[];
@@ -247,8 +255,7 @@ export class PeerSet implements ImmutableSet<OperationalPeer>, ObservableSet<Ope
      */
     async ensureConnection(
         address: PeerAddress,
-        options: {
-            discoveryOptions: DiscoveryOptions;
+        options: PeerConnectionOptions & {
             allowUnknownPeer?: boolean;
             operationalAddress?: ServerAddressIp;
         },
@@ -256,7 +263,7 @@ export class PeerSet implements ImmutableSet<OperationalPeer>, ObservableSet<Ope
         address = PeerAddress(address);
 
         const isGroupNode = PeerAddress.isGroup(address);
-        const { discoveryOptions, allowUnknownPeer, operationalAddress } = options;
+        const { allowUnknownPeer, operationalAddress } = options;
         if (!this.#peersByAddress.has(address) && !allowUnknownPeer && !isGroupNode) {
             throw new UnknownNodeError(`Cannot connect to unknown device ${PeerAddress(address)}`);
         }
@@ -275,7 +282,7 @@ export class PeerSet implements ImmutableSet<OperationalPeer>, ObservableSet<Ope
             const { promise, resolver, rejecter } = createPromise<MessageChannel>();
             this.#runningPeerReconnections.set(address, { promise, rejecter });
 
-            this.#resume(address, discoveryOptions, operationalAddress)
+            this.#resume(address, options, operationalAddress)
                 .then(channel => {
                     this.#runningPeerReconnections.delete(address);
                     resolver(channel);
@@ -292,7 +299,7 @@ export class PeerSet implements ImmutableSet<OperationalPeer>, ObservableSet<Ope
     /**
      * Obtain an exchange provider for the designated peer.
      */
-    async exchangeProviderFor(addressOrChannel: PeerAddress | MessageChannel, discoveryOptions?: DiscoveryOptions) {
+    async exchangeProviderFor(addressOrChannel: PeerAddress | MessageChannel, options: PeerConnectionOptions = {}) {
         if (addressOrChannel instanceof MessageChannel) {
             return new DedicatedChannelExchangeProvider(this.#exchanges, addressOrChannel);
         }
@@ -306,10 +313,13 @@ export class PeerSet implements ImmutableSet<OperationalPeer>, ObservableSet<Ope
         }
         let initiallyConnected = this.#channels.hasChannel(address);
         return new ReconnectableExchangeProvider(this.#exchanges, this.#channels, address, async () => {
+            const { caseAuthenticatedTags, discoveryOptions } = options;
+
             if (!initiallyConnected && !this.#channels.hasChannel(address)) {
                 // We got an uninitialized node, so do the first connection as usual
                 await this.ensureConnection(address, {
                     discoveryOptions: { discoveryType: NodeDiscoveryType.None },
+                    caseAuthenticatedTags,
                 });
                 initiallyConnected = true; // We only do this connection once, rest is handled in following code
                 if (this.#channels.hasChannel(address)) {
@@ -337,8 +347,9 @@ export class PeerSet implements ImmutableSet<OperationalPeer>, ObservableSet<Ope
                 throw new RetransmissionLimitReachedError(`No operational address found for ${PeerAddress(address)}`);
             }
             if (
-                (await this.#reconnectKnownAddress(address, operationalAddress, discoveryData, Seconds(2))) ===
-                undefined
+                (await this.#reconnectKnownAddress(address, operationalAddress, discoveryData, {
+                    expectedProcessingTime: Seconds(2),
+                })) === undefined
             ) {
                 throw new RetransmissionLimitReachedError(`${PeerAddress(address)} is not reachable.`);
             }
@@ -411,8 +422,8 @@ export class PeerSet implements ImmutableSet<OperationalPeer>, ObservableSet<Ope
      * device is discovered again using its operational instance details.
      * It returns the operational MessageChannel on success.
      */
-    async #resume(address: PeerAddress, discoveryOptions?: DiscoveryOptions, tryOperationalAddress?: ServerAddressIp) {
-        const { discoveryType } = discoveryOptions ?? {};
+    async #resume(address: PeerAddress, options: PeerConnectionOptions, tryOperationalAddress?: ServerAddressIp) {
+        const { discoveryOptions: { discoveryType } = {} } = options;
 
         const operationalAddress =
             tryOperationalAddress ??
@@ -421,7 +432,7 @@ export class PeerSet implements ImmutableSet<OperationalPeer>, ObservableSet<Ope
                 : this.#knownOperationalAddressFor(address));
 
         try {
-            return await this.#connectOrDiscoverNode(address, operationalAddress, discoveryOptions);
+            return await this.#connectOrDiscoverNode(address, operationalAddress, options);
         } catch (error) {
             if (
                 (error instanceof DiscoveryError || error instanceof NoResponseTimeoutError) &&
@@ -439,14 +450,17 @@ export class PeerSet implements ImmutableSet<OperationalPeer>, ObservableSet<Ope
     async #connectOrDiscoverNode(
         address: PeerAddress,
         operationalAddress?: ServerAddressIp,
-        discoveryOptions: DiscoveryOptions = {},
+        options?: PeerConnectionOptions,
     ) {
         address = PeerAddress(address);
         const {
-            discoveryType: requestedDiscoveryType = NodeDiscoveryType.FullDiscovery,
-            timeout,
-            discoveryData = this.#peersByAddress.get(address)?.discoveryData,
-        } = discoveryOptions;
+            discoveryOptions: {
+                discoveryType: requestedDiscoveryType = NodeDiscoveryType.FullDiscovery,
+                timeout,
+                discoveryData = this.#peersByAddress.get(address)?.discoveryData,
+            } = {},
+            caseAuthenticatedTags,
+        } = options ?? {};
         if (timeout !== undefined && requestedDiscoveryType !== NodeDiscoveryType.TimedDiscovery) {
             throw new ImplementationError("Cannot set timeout without timed discovery.");
         }
@@ -486,7 +500,7 @@ export class PeerSet implements ImmutableSet<OperationalPeer>, ObservableSet<Ope
                 operationalAddress,
                 discoveryData,
                 // When we use a timeout for discovery also use this for reconnecting to the node
-                timeout,
+                { expectedProcessingTime: timeout, caseAuthenticatedTags },
             );
             if (directReconnection !== undefined) {
                 return directReconnection;
@@ -533,6 +547,7 @@ export class PeerSet implements ImmutableSet<OperationalPeer>, ObservableSet<Ope
                                 address,
                                 lastOperationalAddress,
                                 discoveryData,
+                                { caseAuthenticatedTags },
                             );
                             if (result !== undefined && reconnectionPollingTimer?.isRunning) {
                                 reconnectionPollingTimer?.stop();
@@ -589,7 +604,7 @@ export class PeerSet implements ImmutableSet<OperationalPeer>, ObservableSet<Ope
                     return device !== undefined ? [device] : [];
                 },
                 async (operationalAddress, peer) => {
-                    const result = await this.#pair(address, operationalAddress, peer);
+                    const result = await this.#pair(address, operationalAddress, peer, { caseAuthenticatedTags });
                     await this.#addOrUpdatePeer(address, operationalAddress, {
                         ...discoveryData,
                         ...peer,
@@ -617,11 +632,12 @@ export class PeerSet implements ImmutableSet<OperationalPeer>, ObservableSet<Ope
         address: PeerAddress,
         operationalAddress: ServerAddressIp,
         discoveryData?: DiscoveryData,
-        expectedProcessingTime?: Duration,
+        options?: CaseClient.PairOptions,
     ): Promise<MessageChannel | undefined> {
         address = PeerAddress(address);
 
         const { ip, port } = operationalAddress;
+        const { expectedProcessingTime } = options ?? {};
         const startTime = Time.nowMs;
         try {
             logger.debug(
@@ -631,7 +647,7 @@ export class PeerSet implements ImmutableSet<OperationalPeer>, ObservableSet<Ope
                         : ""
                 }`,
             );
-            const channel = await this.#pair(address, operationalAddress, discoveryData, expectedProcessingTime);
+            const channel = await this.#pair(address, operationalAddress, discoveryData, options);
             await this.#addOrUpdatePeer(address, operationalAddress);
             return channel;
         } catch (error) {
@@ -675,7 +691,7 @@ export class PeerSet implements ImmutableSet<OperationalPeer>, ObservableSet<Ope
         address: PeerAddress,
         operationalServerAddress: ServerAddressIp,
         discoveryData?: DiscoveryData,
-        expectedProcessingTime?: Duration,
+        options?: CaseClient.PairOptions,
     ) {
         logger.debug(`Pair with ${address} at ${ServerAddress.urlFor(operationalServerAddress)}`);
         const { ip, port } = operationalServerAddress;
@@ -710,7 +726,7 @@ export class PeerSet implements ImmutableSet<OperationalPeer>, ObservableSet<Ope
             const operationalSecureSession = await this.#doCasePair(
                 new MessageChannel(operationalChannel, unsecureSession),
                 address,
-                expectedProcessingTime,
+                options,
             );
 
             const channel = new MessageChannel(operationalChannel, operationalSecureSession);
@@ -729,19 +745,14 @@ export class PeerSet implements ImmutableSet<OperationalPeer>, ObservableSet<Ope
     async #doCasePair(
         unsecureMessageChannel: MessageChannel,
         address: PeerAddress,
-        expectedProcessingTime?: Duration,
+        options?: CaseClient.PairOptions,
     ): Promise<SecureSession> {
         const fabric = this.#sessions.fabricFor(address);
         let exchange: MessageExchange | undefined;
         try {
             exchange = this.#exchanges.initiateExchangeWithChannel(unsecureMessageChannel, SECURE_CHANNEL_PROTOCOL_ID);
 
-            const { session, resumed } = await this.#caseClient.pair(
-                exchange,
-                fabric,
-                address.nodeId,
-                expectedProcessingTime,
-            );
+            const { session, resumed } = await this.#caseClient.pair(exchange, fabric, address.nodeId, options);
 
             if (!resumed) {
                 // When the session was not resumed then most likely the device firmware got updated, so we clear the cache
@@ -761,7 +772,7 @@ export class PeerSet implements ImmutableSet<OperationalPeer>, ObservableSet<Ope
                         `Case client: Resumption record seems outdated for Fabric ${NodeId.toHexString(fabric.nodeId)} (index ${fabric.fabricIndex}) and PeerNode ${NodeId.toHexString(address.nodeId)}. Retrying pairing without resumption...`,
                     );
                     // An endless loop should not happen here, as the resumption record is deleted in the next step
-                    return await this.#doCasePair(unsecureMessageChannel, address, expectedProcessingTime);
+                    return await this.#doCasePair(unsecureMessageChannel, address, options);
                 }
             }
             throw error;

package/src/session/case/CaseClient.ts

@@ -13,7 +13,7 @@ import { MessageExchange, RetransmissionLimitReachedError } from "#protocol/Mess
 import { ChannelStatusResponseError } from "#securechannel/SecureChannelMessenger.js";
 import { NodeSession } from "#session/NodeSession.js";
 import { SessionManager } from "#session/SessionManager.js";
-import { NodeId, SecureChannelStatusCode } from "#types";
+import { CaseAuthenticatedTag, NodeId, SecureChannelStatusCode } from "#types";
 import {
     KDFSR1_KEY_INFO,
     KDFSR2_INFO,
@@ -38,11 +38,12 @@ export class CaseClient {
         this.#sessions = sessions;
     }
 
-    async pair(exchange: MessageExchange, fabric: Fabric, peerNodeId: NodeId, expectedProcessingTime?: Duration) {
+    async pair(exchange: MessageExchange, fabric: Fabric, peerNodeId: NodeId, options?: CaseClient.PairOptions) {
+        const { expectedProcessingTime, caseAuthenticatedTags } = options ?? {};
         const messenger = new CaseClientMessenger(exchange, expectedProcessingTime);
 
         try {
-            return await this.#doPair(messenger, exchange, fabric, peerNodeId);
+            return await this.#doPair(messenger, exchange, fabric, peerNodeId, caseAuthenticatedTags);
         } catch (error) {
             if (!(error instanceof ChannelStatusResponseError || error instanceof RetransmissionLimitReachedError)) {
                 await messenger.sendError(SecureChannelStatusCode.InvalidParam);
@@ -51,7 +52,13 @@ export class CaseClient {
         }
     }
 
-    async #doPair(messenger: CaseClientMessenger, exchange: MessageExchange, fabric: Fabric, peerNodeId: NodeId) {
+    async #doPair(
+        messenger: CaseClientMessenger,
+        exchange: MessageExchange,
+        fabric: Fabric,
+        peerNodeId: NodeId,
+        caseAuthenticatedTags?: CaseAuthenticatedTag[],
+    ) {
         const { crypto } = fabric;
 
         // Generate pairing info
@@ -221,7 +228,8 @@ export class CaseClient {
             await messenger.waitForSuccess("Sigma3-Success");
 
             // All good! Create secure session
-            const { caseAuthenticatedTags } = resumptionRecord ?? {}; // Even if resumption does not work try to reuse the caseAuthenticatedTags
+            // Configured CATs take precedence over resumption record ones
+            const sessionCaseAuthenticatedTags = caseAuthenticatedTags ?? resumptionRecord?.caseAuthenticatedTags;
             const secureSessionSalt = Bytes.concat(
                 operationalIdentityProtectionKey,
                 await crypto.computeSha256([sigma1Bytes, sigma2Bytes, sigma3Bytes]),
@@ -236,7 +244,7 @@ export class CaseClient {
                 isInitiator: true,
                 isResumption: false,
                 peerSessionParameters,
-                caseAuthenticatedTags,
+                caseAuthenticatedTags: sessionCaseAuthenticatedTags,
             });
             this.#logNewSession("New", secureSession, messenger, fabric, peerNodeId);
             resumptionRecord = {
@@ -245,7 +253,7 @@ export class CaseClient {
                 sharedSecret,
                 resumptionId: peerResumptionId,
                 sessionParameters: secureSession.parameters,
-                caseAuthenticatedTags,
+                caseAuthenticatedTags: sessionCaseAuthenticatedTags,
             };
         }
 
@@ -274,3 +282,10 @@ export class CaseClient {
         );
     }
 }
+
+export namespace CaseClient {
+    export interface PairOptions {
+        expectedProcessingTime?: Duration;
+        caseAuthenticatedTags?: CaseAuthenticatedTag[];
+    }
+}