@matter/protocol 0.17.0-alpha.0-20260507-059f7763b → 0.17.0-alpha.0-20260508-29ff5ae9e

package/dist/esm/action/client/ClientInteraction.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ClientInteraction.d.ts","sourceRoot":"","sources":["../../../../src/action/client/ClientInteraction.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAClF,OAAO,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAU,MAAM,2BAA2B,CAAC;AAKjE,OAAO,EAAE,mBAAmB,EAAgB,MAAM,kCAAkC,CAAC;AACrF,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEpD,OAAO,EAAE,0BAA0B,EAAe,MAAM,sCAAsC,CAAC;AAE/F,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAEjE,OAAO,EACH,KAAK,EAIL,WAAW,EAIX,QAAQ,EAER,WAAW,EASX,aAAa,EAEb,gBAAgB,EAGnB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAEpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AAoBhF,MAAM,MAAM,kBAAkB,CAAC,CAAC,SAAS,eAAe,GAAG,eAAe,IAAI,OAAO,CACjF,CAAC,SAAS;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GAAG,qBAAqB,GAAG,gBAAgB,CACzE,CAAC;AAEF,MAAM,WAAW,wBAAwB;IACrC,WAAW,EAAE,WAAW,CAAC;IACzB,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,aAAa,CAAC,aAAa,CAAC;IAC7C,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,eAAO,MAAM,0BAA0B,UAAa,CAAC;AAErD;;;;;GAKG;AACH,eAAO,MAAM,yCAAyC,UAAc,CAAC;AAKrE;;GAEG;AACH,qBAAa,iBAAiB,CAC1B,QAAQ,SAAS,kBAAkB,GAAG,kBAAkB,CAC1D,YAAW,YAAY,CAAC,QAAQ,CAAC;;IAiB/B,YAAY,EAAE,WAAW,EAAE,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,wBAAwB,EAyB/G;IAEK,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,iBAqBzB;IAEK,CAAC,MAAM,CAAC,YAAY,CAAC,kBAE1B;IAED,IAAI,aAAa,wBAKhB;IAED;;OAEG;IACI,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE,WAAW,GAAG,UAAU,CAoCzF;IAED;;;;;;;OAOG;IACG,KAAK,CAAC,OAAO,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,CAmD1D;IAED;;OAEG;IACG,KAAK,CAAC,CAAC,SAAS,WAAW,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,CA0DjF;IA6KD;;;;;;;;OAQG;IACI,MAAM,CAAC,OAAO,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,QAAQ,GAAG,mBAAmB,CAyB5E;IA4OD;;OAEG;IACG,SAAS,CAAC,CAAC,SAAS,eAAe,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE,QAAQ,GAAG,kBAAkB,CAAC,CAAC,CAAC,CA4IhG;IAeK,OAAO,CAAC,OAAO,EAAE,gBAAgB,EAAE,OAAO,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA4BvF;IAyED,IAAI,WAAW,gBAEd;IAED,sFAAsF;IACtF,IAAI,OAAO,uDAEV;IAED,sGAAsG;IACtG,uBAAuB,CAAC,sBAAsB,CAAC,EAAE,QAAQ,EAAE,yBAAyB,UAAQ,YAE3F;IAED,IAAI,OAAO,gBAKV;CACJ;AAED,MAAM,WAAW,cAAc,CAAC,CAAC,SAAS,0BAA0B,GAAG,YAAY,GAAG,0BAA0B;IAC5G,KAAK,EAAE,KAAK,CAAC;IACb,SAAS,EAAE,CAAC,CAAC;IAEb,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1C;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IAC/B,qDAAqD;IACrD,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,6FAA6F;IAC7F,eAAe,CAAC,EAAE,gBAAgB,CAAC;IAEnC,kCAAkC;IAClC,KAAK,CAAC,EAAE,WAAW,CAAC;IAEpB,uFAAuF;IACvF,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC9B"}
+{"version":3,"file":"ClientInteraction.d.ts","sourceRoot":"","sources":["../../../../src/action/client/ClientInteraction.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAClF,OAAO,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAU,MAAM,2BAA2B,CAAC;AAKjE,OAAO,EAAE,mBAAmB,EAAgB,MAAM,kCAAkC,CAAC;AACrF,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEpD,OAAO,EAAE,0BAA0B,EAAe,MAAM,sCAAsC,CAAC;AAE/F,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAEjE,OAAO,EACH,KAAK,EAIL,WAAW,EAIX,QAAQ,EAER,WAAW,EASX,aAAa,EAEb,gBAAgB,EAGnB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAEpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AAoBhF,MAAM,MAAM,kBAAkB,CAAC,CAAC,SAAS,eAAe,GAAG,eAAe,IAAI,OAAO,CACjF,CAAC,SAAS;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GAAG,qBAAqB,GAAG,gBAAgB,CACzE,CAAC;AAEF,MAAM,WAAW,wBAAwB;IACrC,WAAW,EAAE,WAAW,CAAC;IACzB,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,aAAa,CAAC,aAAa,CAAC;IAC7C,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,eAAO,MAAM,0BAA0B,UAAa,CAAC;AAErD;;;;;GAKG;AACH,eAAO,MAAM,yCAAyC,UAAc,CAAC;AAKrE;;GAEG;AACH,qBAAa,iBAAiB,CAC1B,QAAQ,SAAS,kBAAkB,GAAG,kBAAkB,CAC1D,YAAW,YAAY,CAAC,QAAQ,CAAC;;IAiB/B,YAAY,EAAE,WAAW,EAAE,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,wBAAwB,EAyB/G;IAEK,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,iBAqBzB;IAEK,CAAC,MAAM,CAAC,YAAY,CAAC,kBAE1B;IAED,IAAI,aAAa,wBAKhB;IAED;;OAEG;IACI,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE,WAAW,GAAG,UAAU,CAoCzF;IAED;;;;;;;OAOG;IACG,KAAK,CAAC,OAAO,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,CAmD1D;IAED;;OAEG;IACG,KAAK,CAAC,CAAC,SAAS,WAAW,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,CA0DjF;IA6KD;;;;;;;;OAQG;IACI,MAAM,CAAC,OAAO,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,QAAQ,GAAG,mBAAmB,CAyB5E;IA6OD;;OAEG;IACG,SAAS,CAAC,CAAC,SAAS,eAAe,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE,QAAQ,GAAG,kBAAkB,CAAC,CAAC,CAAC,CA4IhG;IAeK,OAAO,CAAC,OAAO,EAAE,gBAAgB,EAAE,OAAO,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA4BvF;IAyED,IAAI,WAAW,gBAEd;IAED,sFAAsF;IACtF,IAAI,OAAO,uDAEV;IAED,sGAAsG;IACtG,uBAAuB,CAAC,sBAAsB,CAAC,EAAE,QAAQ,EAAE,yBAAyB,UAAQ,YAE3F;IAED,IAAI,OAAO,gBAKV;CACJ;AAED,MAAM,WAAW,cAAc,CAAC,CAAC,SAAS,0BAA0B,GAAG,YAAY,GAAG,0BAA0B;IAC5G,KAAK,EAAE,KAAK,CAAC;IACb,SAAS,EAAE,CAAC,CAAC;IAEb,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1C;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IAC/B,qDAAqD;IACrD,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,6FAA6F;IAC7F,eAAe,CAAC,EAAE,gBAAgB,CAAC;IAEnC,kCAAkC;IAClC,KAAK,CAAC,EAAE,WAAW,CAAC;IAEpB,uFAAuF;IACvF,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC9B"}

package/dist/esm/certificate/DeviceAttestationValidator.d.ts

@@ -0,0 +1,89 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { Bytes, Crypto, MaybePromise, PublicKey } from "@matter/general";
+import { VendorId } from "@matter/types";
+import { DclCertificateService } from "../dcl/DclCertificateService.js";
+import { CommissioningError } from "../peer/CommissioningError.js";
+/** Reasons a device attestation validation can fail or produce warnings. */
+export declare enum DeviceAttestationCheck {
+    PaaNotTrusted = "PaaNotTrusted",
+    CertificateChainInvalid = "CertificateChainInvalid",
+    CertificateExpired = "CertificateExpired",
+    VendorIdMismatch = "VendorIdMismatch",
+    AttestationSignatureInvalid = "AttestationSignatureInvalid",
+    AttestationNonceMismatch = "AttestationNonceMismatch",
+    CertificationDeclarationSignatureInvalid = "CertificationDeclarationSignatureInvalid",
+    CertificationDeclarationFieldMismatch = "CertificationDeclarationFieldMismatch",
+    CertificateRevoked = "CertificateRevoked",
+    FirmwareInfoMismatch = "FirmwareInfoMismatch",
+    CertificationTypeProvisional = "CertificationTypeProvisional",
+    CertificationTypeTest = "CertificationTypeTest",
+    CertificateIdNotVerified = "CertificateIdNotVerified",
+    CdSignerVerificationSkipped = "CdSignerVerificationSkipped",
+    PaaTrustStoreTimeMismatch = "PaaTrustStoreTimeMismatch",
+    DclServiceUnavailable = "DclServiceUnavailable"
+}
+/** A single finding from the attestation validation process. */
+export interface AttestationFinding {
+    /** Severity: "error" stops validation immediately, "warning"/"info" are collected. */
+    level: "error" | "warning" | "info";
+    /** The specific check that produced this finding. */
+    type: DeviceAttestationCheck;
+    /** Human-readable description. */
+    message: string;
+}
+/** Error thrown when device attestation validation encounters a hard failure. */
+export declare class DeviceAttestationError extends CommissioningError {
+    readonly failure: DeviceAttestationCheck;
+    constructor(failure: DeviceAttestationCheck, message: string);
+}
+export declare namespace DeviceAttestationValidator {
+    interface Context {
+        crypto: Crypto;
+        attestationChallenge: Bytes;
+        /**
+         * DclCertificateService for PAA trust store, chain validation, revocation checks, and
+         * CD signer lookup. When absent, DCL-dependent checks are skipped (PAA lookup, chain
+         * verification, revocation, CD signature) but local checks still run (nonce, signature,
+         * VendorID, CD fields).
+         */
+        dclCertificateService?: DclCertificateService;
+    }
+    interface DeviceAttestationData {
+        dac: Bytes;
+        pai: Bytes;
+        attestationElements: Bytes;
+        attestationSignature: Bytes;
+        attestationNonce: Bytes;
+        vendorId: VendorId;
+        productId: number;
+    }
+    /** Result of a successful validation, including any non-fatal findings. */
+    interface ValidationResult {
+        dacPublicKey: ReturnType<typeof PublicKey>;
+        findings: AttestationFinding[];
+    }
+    /**
+     * Controls behavior when attestation findings occur.
+     * - `true`: always proceed (warnings/info are logged)
+     * - `false`: reject on any finding (error, warning, or info)
+     * - `undefined`: backward-compatible accept with logging
+     * - function: receives all findings, returns whether to proceed
+     */
+    type OnAttestationFailure = boolean | ((findings: AttestationFinding[]) => MaybePromise<boolean>);
+    /**
+     * Validates device attestation per Matter spec Section 6.2.3.1.
+     *
+     * Local checks (nonce, signature, VendorID, CD fields) always run. DCL-dependent checks
+     * (PAA trust store, chain verification, revocation) only run when dclCertificateService
+     * is provided.
+     *
+     * Errors (hard failures) throw immediately via {@link DeviceAttestationError}.
+     * Warnings and info findings are collected and returned for the caller to evaluate.
+     */
+    function validate(context: Context, data: DeviceAttestationData): Promise<ValidationResult>;
+}
+//# sourceMappingURL=DeviceAttestationValidator.d.ts.map

package/dist/esm/certificate/DeviceAttestationValidator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DeviceAttestationValidator.d.ts","sourceRoot":"","sources":["../../../src/certificate/DeviceAttestationValidator.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,EAAkB,YAAY,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACzF,OAAO,EAAyB,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEhE,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAKnE,4EAA4E;AAC5E,oBAAY,sBAAsB;IAC9B,aAAa,kBAAkB;IAC/B,uBAAuB,4BAA4B;IACnD,kBAAkB,uBAAuB;IACzC,gBAAgB,qBAAqB;IACrC,2BAA2B,gCAAgC;IAC3D,wBAAwB,6BAA6B;IACrD,wCAAwC,6CAA6C;IACrF,qCAAqC,0CAA0C;IAC/E,kBAAkB,uBAAuB;IACzC,oBAAoB,yBAAyB;IAC7C,4BAA4B,iCAAiC;IAC7D,qBAAqB,0BAA0B;IAC/C,wBAAwB,6BAA6B;IACrD,2BAA2B,gCAAgC;IAC3D,yBAAyB,8BAA8B;IACvD,qBAAqB,0BAA0B;CAClD;AAED,gEAAgE;AAChE,MAAM,WAAW,kBAAkB;IAC/B,sFAAsF;IACtF,KAAK,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;IAEpC,qDAAqD;IACrD,IAAI,EAAE,sBAAsB,CAAC;IAE7B,kCAAkC;IAClC,OAAO,EAAE,MAAM,CAAC;CACnB;AAED,iFAAiF;AACjF,qBAAa,sBAAuB,SAAQ,kBAAkB;IAEtD,QAAQ,CAAC,OAAO,EAAE,sBAAsB;IAD5C,YACa,OAAO,EAAE,sBAAsB,EACxC,OAAO,EAAE,MAAM,EAGlB;CACJ;AAED,yBAAiB,0BAA0B,CAAC,CAAC;IACzC,UAAiB,OAAO;QACpB,MAAM,EAAE,MAAM,CAAC;QACf,oBAAoB,EAAE,KAAK,CAAC;QAE5B;;;;;WAKG;QACH,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;KACjD;IAED,UAAiB,qBAAqB;QAClC,GAAG,EAAE,KAAK,CAAC;QACX,GAAG,EAAE,KAAK,CAAC;QACX,mBAAmB,EAAE,KAAK,CAAC;QAC3B,oBAAoB,EAAE,KAAK,CAAC;QAC5B,gBAAgB,EAAE,KAAK,CAAC;QACxB,QAAQ,EAAE,QAAQ,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;KACrB;IAED,2EAA2E;IAC3E,UAAiB,gBAAgB;QAC7B,YAAY,EAAE,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC;QAC3C,QAAQ,EAAE,kBAAkB,EAAE,CAAC;KAClC;IAED;;;;;;OAMG;IACH,KAAY,oBAAoB,GAAG,OAAO,GAAG,CAAC,CAAC,QAAQ,EAAE,kBAAkB,EAAE,KAAK,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IAEzG;;;;;;;;;OASG;IACH,SAAsB,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAkVvG;CACJ"}

package/dist/esm/certificate/DeviceCertification.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DeviceCertification.d.ts","sourceRoot":"","sources":["../../../src/certificate/DeviceCertification.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAsC,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC9G,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAGnD;;GAEG;AACH,qBAAa,mBAAmB;;IAQ5B,IAAI,YAAY,sCAEf;IAED,IAAI,WAAW,4BAEd;IAED,IAAI,uBAAuB,4BAE1B;IAED,IAAI,WAAW,4BAEd;IAED,YAAY,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,mBAAmB,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,kBAAkB,EAqChG;IAQK,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,qDAG3C;CAyBJ;AAED,yBAAiB,mBAAmB,CAAC,CAAC;IAClC,UAAiB,aAAa;QAC1B,UAAU,EAAE,UAAU,GAAG,KAAK,CAAC;QAC/B,WAAW,EAAE,KAAK,CAAC;QACnB,uBAAuB,EAAE,KAAK,CAAC;QAC/B,WAAW,EAAE,KAAK,CAAC;KACtB;IAED,KAAY,UAAU,GAAG,aAAa,GAAG,CAAC,MAAM,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC;CAC3E"}
+{"version":3,"file":"DeviceCertification.d.ts","sourceRoot":"","sources":["../../../src/certificate/DeviceCertification.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAsC,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC9G,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAInD;;GAEG;AACH,qBAAa,mBAAmB;;IAQ5B,IAAI,YAAY,sCAEf;IAED,IAAI,WAAW,4BAEd;IAED,IAAI,uBAAuB,4BAE1B;IAED,IAAI,WAAW,4BAEd;IAED,YAAY,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,mBAAmB,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,kBAAkB,EAqChG;IAsCK,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,qDAG3C;CAyBJ;AAED,yBAAiB,mBAAmB,CAAC,CAAC;IAClC,UAAiB,aAAa;QAC1B,UAAU,EAAE,UAAU,GAAG,KAAK,CAAC;QAC/B,WAAW,EAAE,KAAK,CAAC;QACnB,uBAAuB,EAAE,KAAK,CAAC;QAC/B,WAAW,EAAE,KAAK,CAAC;KACtB;IAED,KAAY,UAAU,GAAG,aAAa,GAAG,CAAC,MAAM,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC;CAC3E"}

package/dist/esm/certificate/index.d.ts

@@ -6,6 +6,7 @@
 export * from "./AttestationCertificateManager.js";
 export * from "./CertificateAuthority.js";
 export * from "./ChipPAAuthorities.js";
+export * from "./DeviceAttestationValidator.js";
 export * from "./DeviceCertification.js";
 export * from "./kinds/AttestationCertificates.js";
 export * from "./kinds/Certificate.js";

package/dist/esm/certificate/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/certificate/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,oCAAoC,CAAC;AACnD,cAAc,2BAA2B,CAAC;AAC1C,cAAc,wBAAwB,CAAC;AACvC,cAAc,0BAA0B,CAAC;AACzC,cAAc,oCAAoC,CAAC;AACnD,cAAc,wBAAwB,CAAC;AACvC,cAAc,qCAAqC,CAAC;AACpD,cAAc,iBAAiB,CAAC;AAChC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/certificate/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,oCAAoC,CAAC;AACnD,cAAc,2BAA2B,CAAC;AAC1C,cAAc,wBAAwB,CAAC;AACvC,cAAc,iCAAiC,CAAC;AAChD,cAAc,0BAA0B,CAAC;AACzC,cAAc,oCAAoC,CAAC;AACnD,cAAc,wBAAwB,CAAC;AACvC,cAAc,qCAAqC,CAAC;AACpD,cAAc,iBAAiB,CAAC;AAChC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC"}

package/dist/esm/certificate/kinds/AttestationCertificates.d.ts

@@ -24,8 +24,12 @@ export declare class Paa extends AttestationBaseCertificate<AttestationCertifica
 }
 /** PAI (Product Attestation Intermediate) Certificate. */
 export declare class Pai extends AttestationBaseCertificate<AttestationCertificate.Pai> {
+    /** Construct the class from an ASN.1/DER encoded certificate */
+    static fromAsn1(asn1: Bytes): Pai;
 }
 /** DAC (Device Attestation Certificate) Certificate. */
 export declare class Dac extends AttestationBaseCertificate<AttestationCertificate.Dac> {
+    /** Construct the class from an ASN.1/DER encoded certificate */
+    static fromAsn1(asn1: Bytes): Dac;
 }
 //# sourceMappingURL=AttestationCertificates.d.ts.map

package/dist/esm/certificate/kinds/AttestationCertificates.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AttestationCertificates.d.ts","sourceRoot":"","sources":["../../../../src/certificate/kinds/AttestationCertificates.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE1D;;GAEG;AACH,8BAAsB,0BAA0B,CAAC,EAAE,SAAS,iBAAiB,CAAE,SAAQ,WAAW,CAAC,EAAE,CAAC;IAClG;;;OAGG;IACY,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,iBAElD;CACJ;AAED,uDAAuD;AACvD,qBAAa,GAAI,SAAQ,0BAA0B,CAAC,sBAAsB,CAAC,GAAG,CAAC;IAC3E,gEAAgE;IAChE,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,GAAG,GAAG,CAGhC;CACJ;AAED,0DAA0D;AAC1D,qBAAa,GAAI,SAAQ,0BAA0B,CAAC,sBAAsB,CAAC,GAAG,CAAC;CAAG;AAElF,wDAAwD;AACxD,qBAAa,GAAI,SAAQ,0BAA0B,CAAC,sBAAsB,CAAC,GAAG,CAAC;CAAG"}
+{"version":3,"file":"AttestationCertificates.d.ts","sourceRoot":"","sources":["../../../../src/certificate/kinds/AttestationCertificates.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE1D;;GAEG;AACH,8BAAsB,0BAA0B,CAAC,EAAE,SAAS,iBAAiB,CAAE,SAAQ,WAAW,CAAC,EAAE,CAAC;IAClG;;;OAGG;IACY,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,iBAElD;CACJ;AAED,uDAAuD;AACvD,qBAAa,GAAI,SAAQ,0BAA0B,CAAC,sBAAsB,CAAC,GAAG,CAAC;IAC3E,gEAAgE;IAChE,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,GAAG,GAAG,CAGhC;CACJ;AAED,0DAA0D;AAC1D,qBAAa,GAAI,SAAQ,0BAA0B,CAAC,sBAAsB,CAAC,GAAG,CAAC;IAC3E,gEAAgE;IAChE,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,GAAG,GAAG,CAGhC;CACJ;AAED,wDAAwD;AACxD,qBAAa,GAAI,SAAQ,0BAA0B,CAAC,sBAAsB,CAAC,GAAG,CAAC;IAC3E,gEAAgE;IAChE,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,GAAG,GAAG,CAGhC;CACJ"}

package/dist/esm/certificate/kinds/Certificate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Certificate.d.ts","sourceRoot":"","sources":["../../../../src/certificate/kinds/Certificate.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACH,KAAK,EAGL,MAAM,EAKN,cAAc,EACd,GAAG,EAMN,MAAM,iBAAiB,CAAC;AASzB,OAAO,EAA4B,QAAQ,EAAE,MAAM,aAAa,CAAC;AAcjE,OAAO,EAAoD,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC5G,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAEpE;;;;GAIG;AACH,8BAAsB,WAAW,CAAC,EAAE,SAAS,iBAAiB;;IAI1D,YAAY,IAAI,EAAE,EAAE,GAAG,QAAQ,CAAC,EAAE,CAAC,EAKlC;IAED,IAAI,IAAI,IAAI,QAAQ,CAAC,EAAE,CAAC,CAEvB;IAED,IAAI,QAAQ,YAEX;IAED;;;OAGG;IACH,IAAI,SAAS,IAWY,cAAc,CANtC;IAED;;;OAGG;IACH,IAAI,SAAS,CAAC,SAAS,EAAE,cAAc,EAKtC;IAED;;;OAGG;IACG,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,iBAEzC;IAED;;;;OAIG;IACH,WAAW,4BAQV;IAED;;OAEG;IACH,aAAa,IAAI,KAAK,CAKrB;IAED;;OAEG;IACH,gBAAgB,CAAC,UAAU,EAAE,oBAAoB;;MAgChD;CACJ;AAED,yBAAiB,WAAW,CAAC,CAAC;IAC1B;;OAEG;IACH,SAAsB,+BAA+B,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,oCAa7E;IAyGD,yEAAyE;IAClE,MAAM,uBAAuB,UAA2D,CAAC;IAEhG,uFAAuF;IAChF,MAAM,mBAAmB,UAAyD,CAAC;IAqL1F;;;OAGG;IACH,SAAgB,oBAAoB,CAChC,WAAW,EAAE,KAAK,EAClB,kBAAkB,WAAsB,GACzC,iBAAiB,CAiGnB;IAED;;OAEG;IACH,SAAsB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,oCA6D1E;CACJ"}
+{"version":3,"file":"Certificate.d.ts","sourceRoot":"","sources":["../../../../src/certificate/kinds/Certificate.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACH,KAAK,EAGL,MAAM,EAKN,cAAc,EACd,GAAG,EAMN,MAAM,iBAAiB,CAAC;AASzB,OAAO,EAA4B,QAAQ,EAAE,MAAM,aAAa,CAAC;AAcjE,OAAO,EAAoD,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC5G,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAEpE;;;;GAIG;AACH,8BAAsB,WAAW,CAAC,EAAE,SAAS,iBAAiB;;IAI1D,YAAY,IAAI,EAAE,EAAE,GAAG,QAAQ,CAAC,EAAE,CAAC,EAKlC;IAED,IAAI,IAAI,IAAI,QAAQ,CAAC,EAAE,CAAC,CAEvB;IAED,IAAI,QAAQ,YAEX;IAED;;;OAGG;IACH,IAAI,SAAS,IAWY,cAAc,CANtC;IAED;;;OAGG;IACH,IAAI,SAAS,CAAC,SAAS,EAAE,cAAc,EAKtC;IAED;;;OAGG;IACG,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,iBAEzC;IAED;;;;OAIG;IACH,WAAW,4BAQV;IAED;;OAEG;IACH,aAAa,IAAI,KAAK,CAOrB;IAED;;OAEG;IACH,gBAAgB,CAAC,UAAU,EAAE,oBAAoB;;MAgChD;CACJ;AAED,yBAAiB,WAAW,CAAC,CAAC;IAC1B;;OAEG;IACH,SAAsB,+BAA+B,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,oCAa7E;IAyGD,yEAAyE;IAClE,MAAM,uBAAuB,UAA2D,CAAC;IAEhG,uFAAuF;IAChF,MAAM,mBAAmB,UAAyD,CAAC;IAqL1F;;;OAGG;IACH,SAAgB,oBAAoB,CAChC,WAAW,EAAE,KAAK,EAClB,kBAAkB,WAAsB,GACzC,iBAAiB,CAqGnB;IAED;;OAEG;IACH,SAAsB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,oCA6D1E;CACJ"}

package/dist/esm/certificate/kinds/CertificationDeclaration.d.ts

@@ -3,12 +3,27 @@
  * Copyright 2022-2026 Matter.js Authors
  * SPDX-License-Identifier: Apache-2.0
  */
-import { Bytes, Crypto } from "@matter/general";
+import { Bytes, Crypto, EcdsaSignature } from "@matter/general";
 import { TypeFromBitmapSchema, VendorId } from "@matter/types";
 import { CertificationDeclaration as CertificationDeclarationDef } from "./definitions/certification-declaration.js";
 /** A Matter Certification Declaration */
 export declare class CertificationDeclaration {
     #private;
+    /**
+     * Parse a DER-encoded CMS/PKCS#7 SignedData structure containing a Certification Declaration.
+     *
+     * Extracts:
+     * - The decoded CD content (TLV fields)
+     * - The signer's subject key identifier
+     * - The ECDSA signature
+     * - The raw eContent bytes (signed data before TLV decoding)
+     */
+    static parse(cdBytes: Bytes): {
+        content: TypeFromBitmapSchema<typeof CertificationDeclarationDef.TlvDc>;
+        signerSubjectKeyId: Bytes;
+        signature: EcdsaSignature;
+        signedData: Bytes;
+    };
     /**
      * Generator which is the main usage for the class from outside.
      * It constructs the class with the relevant details and returns a signed ASN.1 DER version of the CD.
@@ -20,4 +35,23 @@ export declare class CertificationDeclaration {
      */
     asSignedAsn1(crypto: Crypto, privateKey: JsonWebKey): Promise<AllowSharedBufferSource>;
 }
+export declare namespace CertificationDeclaration {
+    /**
+     * Returns the well-known test CD signer's subject key identifier and public key.
+     *
+     * The public key is derived from the private key in Appendix F of the Matter 1.1 Core Specification.
+     * Useful for validating Certification Declarations signed with the test signer.
+     */
+    function testSignerInfo(): {
+        subjectKeyId: Bytes;
+        publicKey: Bytes;
+    };
+    /**
+     * Returns the well-known Matter test CD signer certificate (DER-encoded X.509).
+     * Mirrored from CHIP's `credentials/development/cd-certs/Chip-Test-CD-Cert.der`.
+     * Useful for injecting the test signer into `DclCertificateService.addCertificate` with
+     * kind "CDSigner".
+     */
+    function testSignerCertificate(): Bytes;
+}
 //# sourceMappingURL=CertificationDeclaration.d.ts.map

package/dist/esm/certificate/kinds/CertificationDeclaration.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"CertificationDeclaration.d.ts","sourceRoot":"","sources":["../../../../src/certificate/kinds/CertificationDeclaration.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,KAAK,EAAsB,MAAM,EAA0C,MAAM,iBAAiB,CAAC;AAC5G,OAAO,EAAE,oBAAoB,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAE/D,OAAO,EAAE,wBAAwB,IAAI,2BAA2B,EAAE,MAAM,4CAA4C,CAAC;AAwBrH,yCAAyC;AACzC,qBAAa,wBAAwB;;IAIjC;;;OAGG;IACH,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,UAAQ,oCAiBzF;IAED,YAAY,OAAO,EAAE,oBAAoB,CAAC,OAAO,2BAA2B,CAAC,KAAK,CAAC,EAAE,oBAAoB,EAAE,KAAK,EAG/G;IAED;;OAEG;IACG,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,oCAkBxD;CACJ"}
+{"version":3,"file":"CertificationDeclaration.d.ts","sourceRoot":"","sources":["../../../../src/certificate/kinds/CertificationDeclaration.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACH,KAAK,EAEL,MAAM,EAGN,cAAc,EAKjB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,oBAAoB,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAE/D,OAAO,EACH,wBAAwB,IAAI,2BAA2B,EAE1D,MAAM,4CAA4C,CAAC;AA8BpD,yCAAyC;AACzC,qBAAa,wBAAwB;;IAIjC;;;;;;;;OAQG;IACH,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,GAAG;QAC1B,OAAO,EAAE,oBAAoB,CAAC,OAAO,2BAA2B,CAAC,KAAK,CAAC,CAAC;QACxE,kBAAkB,EAAE,KAAK,CAAC;QAC1B,SAAS,EAAE,cAAc,CAAC;QAC1B,UAAU,EAAE,KAAK,CAAC;KACrB,CAsFA;IAED;;;OAGG;IACH,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,UAAQ,oCAiBzF;IAED,YAAY,OAAO,EAAE,oBAAoB,CAAC,OAAO,2BAA2B,CAAC,KAAK,CAAC,EAAE,oBAAoB,EAAE,KAAK,EAG/G;IAED;;OAEG;IACG,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,oCAkBxD;CACJ;AAED,yBAAiB,wBAAwB,CAAC,CAAC;IACvC;;;;;OAKG;IACH,SAAgB,cAAc,IAAI;QAAE,YAAY,EAAE,KAAK,CAAC;QAAC,SAAS,EAAE,KAAK,CAAA;KAAE,CAM1E;IAED;;;;;OAKG;IACH,SAAgB,qBAAqB,IAAI,KAAK,CAE7C;CACJ"}

package/dist/esm/certificate/kinds/definitions/base.d.ts

@@ -31,6 +31,10 @@ export interface MatterCertificate {
     serialNumber: Bytes;
     signatureAlgorithm: number;
     issuer: {};
+    /** Raw DER bytes of the issuer Name, preserved for exact-match comparisons (e.g. CRL revocation lookup). Only present on parsed certificates. */
+    issuerDer?: Bytes;
+    /** Raw DER bytes of the TBSCertificate, preserved so signature verification matches the bytes that were actually signed. Only present on parsed certificates. */
+    tbsDer?: Bytes;
     notBefore: number;
     notAfter: number;
     subject: {};

package/dist/esm/certificate/kinds/definitions/base.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../../../src/certificate/kinds/definitions/base.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AACxC,OAAO,EAAE,OAAO,EAAgB,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAEhF,eAAO,MAAM,uBAAuB;IAChC,gBAAgB;IAChB,cAAc;IACd,eAAe;IACf,gBAAgB;IAChB,YAAY;IACZ,WAAW;IACX,OAAO;IACP,YAAY;IACZ,YAAY;CACf,CAAC;AACF,eAAO,MAAM,uBAAuB;;;;;;;;;;EAAwC,CAAC;AAE7E,MAAM,WAAW,iBAAiB;IAC9B,YAAY,EAAE,KAAK,CAAC;IACpB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,MAAM,EAAE,EAAE,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,EAAE,CAAC;IACZ,kBAAkB,EAAE,MAAM,CAAC;IAC3B,uBAAuB,EAAE,MAAM,CAAC;IAChC,sBAAsB,EAAE,KAAK,CAAC;IAC9B,UAAU,EAAE;QACR,gBAAgB,EAAE;YACd,IAAI,EAAE,OAAO,CAAC;YACd,OAAO,CAAC,EAAE,MAAM,CAAC;SACpB,CAAC;QACF,QAAQ,EAAE,wBAAwB,CAAC,OAAO,uBAAuB,CAAC,CAAC;QACnE,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC5B,oBAAoB,EAAE,KAAK,CAAC;QAC5B,sBAAsB,EAAE,KAAK,CAAC;QAC9B,eAAe,CAAC,EAAE,KAAK,EAAE,CAAC;KAC7B,CAAC;IACF,SAAS,EAAE,KAAK,CAAC;CACpB"}
+{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../../../src/certificate/kinds/definitions/base.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AACxC,OAAO,EAAE,OAAO,EAAgB,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAEhF,eAAO,MAAM,uBAAuB;IAChC,gBAAgB;IAChB,cAAc;IACd,eAAe;IACf,gBAAgB;IAChB,YAAY;IACZ,WAAW;IACX,OAAO;IACP,YAAY;IACZ,YAAY;CACf,CAAC;AACF,eAAO,MAAM,uBAAuB;;;;;;;;;;EAAwC,CAAC;AAE7E,MAAM,WAAW,iBAAiB;IAC9B,YAAY,EAAE,KAAK,CAAC;IACpB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,MAAM,EAAE,EAAE,CAAC;IACX,iJAAiJ;IACjJ,SAAS,CAAC,EAAE,KAAK,CAAC;IAClB,iKAAiK;IACjK,MAAM,CAAC,EAAE,KAAK,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,EAAE,CAAC;IACZ,kBAAkB,EAAE,MAAM,CAAC;IAC3B,uBAAuB,EAAE,MAAM,CAAC;IAChC,sBAAsB,EAAE,KAAK,CAAC;IAC9B,UAAU,EAAE;QACR,gBAAgB,EAAE;YACd,IAAI,EAAE,OAAO,CAAC;YACd,OAAO,CAAC,EAAE,MAAM,CAAC;SACpB,CAAC;QACF,QAAQ,EAAE,wBAAwB,CAAC,OAAO,uBAAuB,CAAC,CAAC;QACnE,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC5B,oBAAoB,EAAE,KAAK,CAAC;QAC5B,sBAAsB,EAAE,KAAK,CAAC;QAC9B,eAAe,CAAC,EAAE,KAAK,EAAE,CAAC;KAC7B,CAAC;IACF,SAAS,EAAE,KAAK,CAAC;CACpB"}

package/dist/esm/certificate/kinds/definitions/certification-declaration.d.ts

@@ -1,3 +1,12 @@
+/** Certification Declaration certification_type field values per Matter spec Section 6.3.1 */
+export declare enum CertificationType {
+    /** Development/test certification (not for production use) */
+    Test = 0,
+    /** Provisional certification (in process, not yet fully certified) */
+    Provisional = 1,
+    /** Official CSA certification */
+    Official = 2
+}
 /** Definitions for Matter Certification Declaration */
 export declare namespace CertificationDeclaration {
     const TlvDc: import("@matter/types").ObjectSchema<{

package/dist/esm/certificate/kinds/definitions/certification-declaration.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"certification-declaration.d.ts","sourceRoot":"","sources":["../../../../../src/certificate/kinds/definitions/certification-declaration.ts"],"names":[],"mappings":"AAkBA,uDAAuD;AACvD,yBAAiB,wBAAwB,CAAC,CAAC;IAChC,MAAM,KAAK;;;;;;;;;;;;;MAgBhB,CAAC;CACN"}
+{"version":3,"file":"certification-declaration.d.ts","sourceRoot":"","sources":["../../../../../src/certificate/kinds/definitions/certification-declaration.ts"],"names":[],"mappings":"AAkBA,8FAA8F;AAC9F,oBAAY,iBAAiB;IACzB,8DAA8D;IAC9D,IAAI,IAAI;IACR,sEAAsE;IACtE,WAAW,IAAI;IACf,iCAAiC;IACjC,QAAQ,IAAI;CACf;AAED,uDAAuD;AACvD,yBAAiB,wBAAwB,CAAC,CAAC;IAChC,MAAM,KAAK;;;;;;;;;;;;;MAgBhB,CAAC;CACN"}

package/dist/esm/common/Scanner.d.ts

@@ -5,6 +5,7 @@
  */
 import { AddressLifespan, BasicSet, ChannelType, Duration, Environment, Environmental, ServerAddress, ServerAddressIp } from "@matter/general";
 import { DiscoveryCapabilitiesBitmap, TypeFromPartialBitSchema, VendorId } from "@matter/types";
+import { SupportedTransportsBitmap } from "./SupportedTransportsBitmap.js";
 /**
  * All information exposed by a device via announcements.
  *
@@ -29,8 +30,8 @@ export type DiscoveryData = {
     SAI?: Duration;
     /** Session active threshold */
     SAT?: Duration;
-    /** TCP supported */
-    T?: number;
+    /** Supported transports (TCP client/server). */
+    T?: SupportedTransportsBitmap;
     /** ICD Long Idle Time operating mode supported */
     ICD?: number;
 };

package/dist/esm/common/Scanner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Scanner.d.ts","sourceRoot":"","sources":["../../../src/common/Scanner.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACH,eAAe,EACf,QAAQ,EACR,WAAW,EAEX,QAAQ,EACR,WAAW,EACX,aAAa,EAEb,aAAa,EACb,eAAe,EAClB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,2BAA2B,EAAE,wBAAwB,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEhG;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG;IACxB,2BAA2B;IAC3B,EAAE,CAAC,EAAE,MAAM,CAAC;IAEZ,kBAAkB;IAClB,EAAE,CAAC,EAAE,MAAM,CAAC;IAEZ,8BAA8B;IAC9B,EAAE,CAAC,EAAE,MAAM,CAAC;IAEZ,iCAAiC;IACjC,EAAE,CAAC,EAAE,MAAM,CAAC;IAEZ,mBAAmB;IACnB,EAAE,CAAC,EAAE,MAAM,CAAC;IAEZ,2BAA2B;IAC3B,EAAE,CAAC,EAAE,MAAM,CAAC;IAEZ,0BAA0B;IAC1B,GAAG,CAAC,EAAE,QAAQ,CAAC;IAEf,4BAA4B;IAC5B,GAAG,CAAC,EAAE,QAAQ,CAAC;IAEf,+BAA+B;IAC/B,GAAG,CAAC,EAAE,QAAQ,CAAC;IAEf,oBAAoB;IACpB,CAAC,CAAC,EAAE,MAAM,CAAC;IAEX,kDAAkD;IAClD,GAAG,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,wBAAgB,aAAa,CAAC,GAAG,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,iBAoC7D;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,aAAa,GAAG;IAAE,SAAS,CAAC,EAAE,aAAa,EAAE,CAAA;CAAE,EAAE,IAAI,CAAC,EAAE,MAAM,2BAe5G;AAED,MAAM,MAAM,kBAAkB,CAAC,EAAE,SAAS,aAAa,IAAI,aAAa,GACpE,OAAO,CAAC,eAAe,CAAC,GAAG;IACvB,2CAA2C;IAC3C,SAAS,EAAE,EAAE,EAAE,CAAC;CACnB,CAAC;AAEN,MAAM,MAAM,qBAAqB,CAAC,CAAC,SAAS,kBAAkB,CAAC,GAAG,CAAC,IAC/D,CAAC,SAAS,kBAAkB,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;AAExD,MAAM,MAAM,iBAAiB,GAAG,kBAAkB,CAAC,eAAe,CAAC,GAAG;IAClE,gBAAgB,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG,kBAAkB,CAAC,aAAa,CAAC,GAAG;IACnE,gBAAgB,EAAE,MAAM,CAAC;IAEzB,oBAAoB;IACpB,CAAC,EAAE,MAAM,CAAC;IAEV,yBAAyB;IACzB,EAAE,EAAE,MAAM,CAAC;CACd,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,+BAA+B,GACrC;IACI,4EAA4E;IAC5E,UAAU,EAAE,MAAM,CAAC;CACtB,GACD;IACI,iGAAiG;IACjG,iBAAiB,EAAE,MAAM,CAAC;CAC7B,GACD;IACI,uGAAuG;IACvG,kBAAkB,EAAE,MAAM,CAAC;CAC9B,GACD;IACI,yGAAyG;IACzG,QAAQ,EAAE,QAAQ,CAAC;IAEnB,qHAAqH;IACrH,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB,GACD;IACI,uGAAuG;IACvG,UAAU,EAAE,MAAM,CAAC;CACtB,GACD;IACI,2GAA2G;IAC3G,SAAS,EAAE,MAAM,CAAC;CACrB,GACD,EAEC,CAAC;AAER,MAAM,WAAW,OAAO;IACpB,IAAI,EAAE,WAAW,CAAC;IAElB;;;;OAIG;IACH,qCAAqC,CACjC,UAAU,EAAE,+BAA+B,EAC3C,QAAQ,EAAE,CAAC,MAAM,EAAE,oBAAoB,KAAK,IAAI,EAChD,OAAO,CAAC,EAAE,QAAQ,EAClB,YAAY,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,GAC7B,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAC;IAEnC,8GAA8G;IAC9G,kCAAkC,CAAC,UAAU,EAAE,+BAA+B,GAAG,oBAAoB,EAAE,CAAC;IAExG;;;OAGG;IACH,mCAAmC,CAAC,UAAU,EAAE,+BAA+B,EAAE,cAAc,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IAEjH,mDAAmD;IACnD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED,qBAAa,UAAW,SAAQ,QAAQ,CAAC,OAAO,CAAC;IAC7C,UAAU,CAAC,IAAI,EAAE,WAAW,uBAE3B;IAED,aAAa,CAAC,IAAI,EAAE,WAAW,WAE9B;IAED;;OAEG;IACI,MAAM,CAAC,qBAAqB,CAAC,EAAE,wBAAwB,CAAC,OAAO,2BAA2B,CAAC,aAMjG;IAED,MAAM,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,WAAW,cAI7C;CACJ"}
+{"version":3,"file":"Scanner.d.ts","sourceRoot":"","sources":["../../../src/common/Scanner.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACH,eAAe,EACf,QAAQ,EACR,WAAW,EAEX,QAAQ,EACR,WAAW,EACX,aAAa,EAEb,aAAa,EACb,eAAe,EAClB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,2BAA2B,EAAE,wBAAwB,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAChG,OAAO,EAAE,yBAAyB,EAA6B,MAAM,gCAAgC,CAAC;AAEtG;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG;IACxB,2BAA2B;IAC3B,EAAE,CAAC,EAAE,MAAM,CAAC;IAEZ,kBAAkB;IAClB,EAAE,CAAC,EAAE,MAAM,CAAC;IAEZ,8BAA8B;IAC9B,EAAE,CAAC,EAAE,MAAM,CAAC;IAEZ,iCAAiC;IACjC,EAAE,CAAC,EAAE,MAAM,CAAC;IAEZ,mBAAmB;IACnB,EAAE,CAAC,EAAE,MAAM,CAAC;IAEZ,2BAA2B;IAC3B,EAAE,CAAC,EAAE,MAAM,CAAC;IAEZ,0BAA0B;IAC1B,GAAG,CAAC,EAAE,QAAQ,CAAC;IAEf,4BAA4B;IAC5B,GAAG,CAAC,EAAE,QAAQ,CAAC;IAEf,+BAA+B;IAC/B,GAAG,CAAC,EAAE,QAAQ,CAAC;IAEf,gDAAgD;IAChD,CAAC,CAAC,EAAE,yBAAyB,CAAC;IAE9B,kDAAkD;IAClD,GAAG,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,wBAAgB,aAAa,CAAC,GAAG,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,iBA2C7D;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,aAAa,GAAG;IAAE,SAAS,CAAC,EAAE,aAAa,EAAE,CAAA;CAAE,EAAE,IAAI,CAAC,EAAE,MAAM,2BAe5G;AAED,MAAM,MAAM,kBAAkB,CAAC,EAAE,SAAS,aAAa,IAAI,aAAa,GACpE,OAAO,CAAC,eAAe,CAAC,GAAG;IACvB,2CAA2C;IAC3C,SAAS,EAAE,EAAE,EAAE,CAAC;CACnB,CAAC;AAEN,MAAM,MAAM,qBAAqB,CAAC,CAAC,SAAS,kBAAkB,CAAC,GAAG,CAAC,IAC/D,CAAC,SAAS,kBAAkB,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;AAExD,MAAM,MAAM,iBAAiB,GAAG,kBAAkB,CAAC,eAAe,CAAC,GAAG;IAClE,gBAAgB,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG,kBAAkB,CAAC,aAAa,CAAC,GAAG;IACnE,gBAAgB,EAAE,MAAM,CAAC;IAEzB,oBAAoB;IACpB,CAAC,EAAE,MAAM,CAAC;IAEV,yBAAyB;IACzB,EAAE,EAAE,MAAM,CAAC;CACd,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,+BAA+B,GACrC;IACI,4EAA4E;IAC5E,UAAU,EAAE,MAAM,CAAC;CACtB,GACD;IACI,iGAAiG;IACjG,iBAAiB,EAAE,MAAM,CAAC;CAC7B,GACD;IACI,uGAAuG;IACvG,kBAAkB,EAAE,MAAM,CAAC;CAC9B,GACD;IACI,yGAAyG;IACzG,QAAQ,EAAE,QAAQ,CAAC;IAEnB,qHAAqH;IACrH,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB,GACD;IACI,uGAAuG;IACvG,UAAU,EAAE,MAAM,CAAC;CACtB,GACD;IACI,2GAA2G;IAC3G,SAAS,EAAE,MAAM,CAAC;CACrB,GACD,EAEC,CAAC;AAER,MAAM,WAAW,OAAO;IACpB,IAAI,EAAE,WAAW,CAAC;IAElB;;;;OAIG;IACH,qCAAqC,CACjC,UAAU,EAAE,+BAA+B,EAC3C,QAAQ,EAAE,CAAC,MAAM,EAAE,oBAAoB,KAAK,IAAI,EAChD,OAAO,CAAC,EAAE,QAAQ,EAClB,YAAY,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,GAC7B,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAC;IAEnC,8GAA8G;IAC9G,kCAAkC,CAAC,UAAU,EAAE,+BAA+B,GAAG,oBAAoB,EAAE,CAAC;IAExG;;;OAGG;IACH,mCAAmC,CAAC,UAAU,EAAE,+BAA+B,EAAE,cAAc,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IAEjH,mDAAmD;IACnD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED,qBAAa,UAAW,SAAQ,QAAQ,CAAC,OAAO,CAAC;IAC7C,UAAU,CAAC,IAAI,EAAE,WAAW,uBAE3B;IAED,aAAa,CAAC,IAAI,EAAE,WAAW,WAE9B;IAED;;OAEG;IACI,MAAM,CAAC,qBAAqB,CAAC,EAAE,wBAAwB,CAAC,OAAO,2BAA2B,CAAC,aAMjG;IAED,MAAM,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,WAAW,cAI7C;CACJ"}

package/dist/esm/dcl/DclCertificateService.d.ts

@@ -17,11 +17,13 @@ export declare class DclCertificateService {
     constructor(environment: Environment, options?: DclCertificateService.Options);
     get construction(): Construction<DclCertificateService>;
     /**
-     * Get certificate metadata by subject key identifier. Returns undefined if not found.
+     * Get certificate metadata by subject key identifier. Returns undefined if not found or if the
+     * entry is a test certificate while `fetchTestCertificates` is disabled.
      */
     getCertificate(subjectKeyId: Bytes | string): DclCertificateService.CertificateMetadata | undefined;
     /**
-     * Get all certificate metadata entries.
+     * Get all certificate metadata entries (raw enumeration, unaffected by the
+     * `fetchTestCertificates` filter so management commands can still inspect cached test certs).
      */
     get certificates(): DclCertificateService.CertificateMetadata[];
     /**
@@ -29,6 +31,22 @@ export declare class DclCertificateService {
      * @throws {MatterDclError} if certificate not found
      */
     getCertificateAsPem(subjectKeyId: Bytes | string): Promise<string>;
+    /**
+     * Get certificate as DER bytes.
+     * @throws {MatterDclError} if certificate not found
+     */
+    getCertificateAsDer(subjectKeyId: Bytes | string): Promise<Uint8Array<ArrayBufferLike>>;
+    /**
+     * Check if a certificate is revoked by looking up its serial number in the revocation set
+     * for the given authority key identifier.
+     *
+     * Lazily fetches revocation data from DCL on first access per AKID, then caches for 1 hour.
+     * Per spec Section 6.2.4.2, the revocation set is indexed by (AuthorityKeyIdentifier, IssuerDN).
+     *
+     * Returns true if the certificate is revoked, false otherwise.
+     * If revocation data is not available for the given authority, returns false.
+     */
+    isRevoked(authorityKeyIdentifier: Bytes | string, serialNumber: Bytes | string, issuerDnDerHex?: string): Promise<boolean>;
     /**
      * Get certificate metadata by subject key identifier, fetching from DCL if not in local storage. Returns
      * undefined if not found.
@@ -40,6 +58,32 @@ export declare class DclCertificateService {
      * Delete a certificate from storage and index.
      */
     deleteCertificate(subjectKeyId: Bytes | string): Promise<void>;
+    /**
+     * Inject a certificate (PAA or CD signer) into the trust store.
+     *
+     * Returns `true` if the certificate was newly added, `false` if a certificate with the same
+     * SubjectKeyIdentifier already exists (in which case the store is unchanged).
+     *
+     * @param derBytes DER-encoded X.509 certificate
+     * @param kind "PAA" (self-signed root) or "CDSigner" (CMS Certification Declaration signer)
+     * @param options.isProduction  mark as production-trust; defaults to `false`
+     */
+    addCertificate(derBytes: Bytes, kind: DclCertificateService.CertificateKind, options?: {
+        isProduction?: boolean;
+    }): Promise<boolean>;
+    /**
+     * Look up a CD signer certificate by its SubjectKeyIdentifier.
+     *
+     * Checks the local trust store first. On miss, queries the production DCL
+     * (`/dcl/pki/all-certificates?subjectKeyId=<skid>`) and caches the result as a
+     * CDSigner entry with `isProduction: true`.
+     *
+     * Returns `undefined` if no matching CD signer can be found either locally or on DCL.
+     */
+    getOrFetchCdSigner(subjectKeyId: Bytes | string): Promise<{
+        publicKey: Bytes;
+        isProduction: boolean;
+    } | undefined>;
     /**
      * Close the service and stop all timers.
      */
@@ -48,6 +92,10 @@ export declare class DclCertificateService {
      * Update certificates from DCL and GitHub. Returns true if update succeeded, false if it failed.
      */
     update(force?: boolean): Promise<void | boolean>;
+    /** Result of parsing a CRL. */
+    static parseCrl(crlDer: Bytes): DclCertificateService.CrlParseResult;
+    /** Convenience wrapper that returns only the revoked serial numbers from a CRL. */
+    static parseCrlRevokedSerials(crlDer: Bytes): Set<string>;
 }
 export declare namespace DclCertificateService {
     interface Options {
@@ -69,6 +117,8 @@ export declare namespace DclCertificateService {
         /** GitHub config for development certificates. Programmatic override only. Defaults to DclGithubConfig.defaults. */
         githubConfig?: DclGithubConfig;
     }
+    /** Kind of certificate stored in the trust store. */
+    type CertificateKind = "PAA" | "CDSigner";
     /**
      * Metadata for a stored certificate.
      */
@@ -80,6 +130,30 @@ export declare namespace DclCertificateService {
         vid: number;
         isRoot: boolean;
         isProduction: boolean;
+        /** Kind of certificate. Defaults to "PAA" when absent (backward compat). */
+        kind?: CertificateKind;
+        /** Epoch timestamp (ms) when this certificate was first fetched and added to the local trust store. */
+        fetchedAt?: number;
     };
+    /** Cached revocation data for a single AKID. */
+    interface RevocationEntry {
+        serials: Set<string>;
+        issuerDnDerHex?: string;
+    }
+    /** Result of parsing a DER-encoded CRL. */
+    interface CrlParseResult {
+        /** Revoked serial numbers (uppercase hex). */
+        serials: Set<string>;
+        /** Hex of the DER-encoded issuer Name, for composite revocation key matching. */
+        issuerDnDerHex?: string;
+        /** CRL Authority Key Identifier extension value (uppercase hex). */
+        authorityKeyId?: string;
+        /** Raw DER bytes of tbsCertList for signature verification. */
+        tbsDer?: Bytes;
+        /** Raw signature value bytes from the CRL. */
+        signatureValue?: Bytes;
+        /** Unix epoch ms of the CRL's nextUpdate field, if present. */
+        nextUpdateMs?: number;
+    }
 }
 //# sourceMappingURL=DclCertificateService.d.ts.map

package/dist/esm/dcl/DclCertificateService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DclCertificateService.d.ts","sourceRoot":"","sources":["../../../src/dcl/DclCertificateService.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACH,KAAK,EACL,YAAY,EAGZ,QAAQ,EACR,WAAW,EASd,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,SAAS,EAAkB,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAK5D;;;;;GAKG;AACH,qBAAa,qBAAqB;;IAU9B,YAAY,WAAW,EAAE,WAAW,EAAE,OAAO,GAAE,qBAAqB,CAAC,OAAY,EA0BhF;IAED,IAAI,YAAY,wCAEf;IAaD;;OAEG;IACH,cAAc,CAAC,YAAY,EAAE,KAAK,GAAG,MAAM,yDAG1C;IAED;;OAEG;IACH,IAAI,YAAY,gDAGf;IAED;;;OAGG;IACG,mBAAmB,CAAC,YAAY,EAAE,KAAK,GAAG,MAAM,mBAgBrD;IAED;;;OAGG;IACG,qBAAqB,CACvB,YAAY,EAAE,KAAK,GAAG,MAAM,EAC5B,OAAO,CAAC,EAAE,SAAS,CAAC,OAAO,GAAG;QAAE,YAAY,CAAC,EAAE,OAAO,CAAA;KAAE,kEAkE3D;IAED;;OAEG;IACG,iBAAiB,CAAC,YAAY,EAAE,KAAK,GAAG,MAAM,iBAenD;IAED;;OAEG;IACG,KAAK,kBAOV;IA2CD;;OAEG;IACG,MAAM,CAAC,KAAK,UAAQ,2BAoBzB;CAiPJ;AAED,yBAAiB,qBAAqB,CAAC,CAAC;IACpC,UAAiB,OAAO;QACpB,2FAA2F;QAC3F,qBAAqB,CAAC,EAAE,OAAO,CAAC;QAEhC,mHAAmH;QACnH,uBAAuB,CAAC,EAAE,OAAO,CAAC;QAElC;;;WAGG;QACH,cAAc,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC;QAEjC,+CAA+C;QAC/C,OAAO,CAAC,EAAE,QAAQ,CAAC;QAEnB,4EAA4E;QAC5E,SAAS,CAAC,EAAE,SAAS,CAAC;QAEtB,gEAAgE;QAChE,aAAa,CAAC,EAAE,SAAS,CAAC;QAE1B,oHAAoH;QACpH,YAAY,CAAC,EAAE,eAAe,CAAC;KAClC;IAED;;OAEG;IACH,KAAY,mBAAmB,GAAG;QAC9B,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,YAAY,EAAE,MAAM,CAAC;QACrB,YAAY,EAAE,MAAM,CAAC;QACrB,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,EAAE,OAAO,CAAC;QAChB,YAAY,EAAE,OAAO,CAAC;KACzB,CAAC;CACL"}
+{"version":3,"file":"DclCertificateService.d.ts","sourceRoot":"","sources":["../../../src/dcl/DclCertificateService.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAEH,KAAK,EACL,YAAY,EAMZ,QAAQ,EAER,WAAW,EAed,MAAM,iBAAiB,CAAC;AAIzB,OAAO,EAAE,SAAS,EAA0C,MAAM,gBAAgB,CAAC;AACnF,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAK5D;;;;;GAKG;AACH,qBAAa,qBAAqB;;IAc9B,YAAY,WAAW,EAAE,WAAW,EAAE,OAAO,GAAE,qBAAqB,CAAC,OAAY,EAiChF;IAED,IAAI,YAAY,wCAEf;IAyBD;;;OAGG;IACH,cAAc,CAAC,YAAY,EAAE,KAAK,GAAG,MAAM,yDAO1C;IAED;;;OAGG;IACH,IAAI,YAAY,gDAGf;IAED;;;OAGG;IACG,mBAAmB,CAAC,YAAY,EAAE,KAAK,GAAG,MAAM,mBAgBrD;IAED;;;OAGG;IACG,mBAAmB,CAAC,YAAY,EAAE,KAAK,GAAG,MAAM,wCAGrD;IAkBD;;;;;;;;;OASG;IACG,SAAS,CACX,sBAAsB,EAAE,KAAK,GAAG,MAAM,EACtC,YAAY,EAAE,KAAK,GAAG,MAAM,EAC5B,cAAc,CAAC,EAAE,MAAM,GACxB,OAAO,CAAC,OAAO,CAAC,CAgClB;IAED;;;OAGG;IACG,qBAAqB,CACvB,YAAY,EAAE,KAAK,GAAG,MAAM,EAC5B,OAAO,CAAC,EAAE,SAAS,CAAC,OAAO,GAAG;QAAE,YAAY,CAAC,EAAE,OAAO,CAAA;KAAE,kEAkE3D;IAED;;OAEG;IACG,iBAAiB,CAAC,YAAY,EAAE,KAAK,GAAG,MAAM,iBAenD;IAED;;;;;;;;;OASG;IACG,cAAc,CAChB,QAAQ,EAAE,KAAK,EACf,IAAI,EAAE,qBAAqB,CAAC,eAAe,EAC3C,OAAO,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAA;KAAE,GACrC,OAAO,CAAC,OAAO,CAAC,CA6BlB;IAED;;;;;;;;OAQG;IACG,kBAAkB,CACpB,YAAY,EAAE,KAAK,GAAG,MAAM,GAC7B,OAAO,CAAC;QAAE,SAAS,EAAE,KAAK,CAAC;QAAC,YAAY,EAAE,OAAO,CAAA;KAAE,GAAG,SAAS,CAAC,CAkClE;IAED;;OAEG;IACG,KAAK,kBAQV;IA2CD;;OAEG;IACG,MAAM,CAAC,KAAK,UAAQ,2BAoBzB;IAmiBD,+BAA+B;IAC/B,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,GAAG,qBAAqB,CAAC,cAAc,CA+InE;IAED,mFAAmF;IACnF,MAAM,CAAC,sBAAsB,CAAC,MAAM,EAAE,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAExD;CACJ;AAED,yBAAiB,qBAAqB,CAAC,CAAC;IACpC,UAAiB,OAAO;QACpB,2FAA2F;QAC3F,qBAAqB,CAAC,EAAE,OAAO,CAAC;QAEhC,mHAAmH;QACnH,uBAAuB,CAAC,EAAE,OAAO,CAAC;QAElC;;;WAGG;QACH,cAAc,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC;QAEjC,+CAA+C;QAC/C,OAAO,CAAC,EAAE,QAAQ,CAAC;QAEnB,4EAA4E;QAC5E,SAAS,CAAC,EAAE,SAAS,CAAC;QAEtB,gEAAgE;QAChE,aAAa,CAAC,EAAE,SAAS,CAAC;QAE1B,oHAAoH;QACpH,YAAY,CAAC,EAAE,eAAe,CAAC;KAClC;IAED,qDAAqD;IACrD,KAAY,eAAe,GAAG,KAAK,GAAG,UAAU,CAAC;IAEjD;;OAEG;IACH,KAAY,mBAAmB,GAAG;QAC9B,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,YAAY,EAAE,MAAM,CAAC;QACrB,YAAY,EAAE,MAAM,CAAC;QACrB,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,EAAE,OAAO,CAAC;QAChB,YAAY,EAAE,OAAO,CAAC;QAEtB,4EAA4E;QAC5E,IAAI,CAAC,EAAE,eAAe,CAAC;QAEvB,uGAAuG;QACvG,SAAS,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IAEF,gDAAgD;IAChD,UAAiB,eAAe;QAC5B,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QACrB,cAAc,CAAC,EAAE,MAAM,CAAC;KAC3B;IAED,2CAA2C;IAC3C,UAAiB,cAAc;QAC3B,8CAA8C;QAC9C,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QAErB,iFAAiF;QACjF,cAAc,CAAC,EAAE,MAAM,CAAC;QAExB,oEAAoE;QACpE,cAAc,CAAC,EAAE,MAAM,CAAC;QAExB,+DAA+D;QAC/D,MAAM,CAAC,EAAE,KAAK,CAAC;QAEf,8CAA8C;QAC9C,cAAc,CAAC,EAAE,KAAK,CAAC;QAEvB,+DAA+D;QAC/D,YAAY,CAAC,EAAE,MAAM,CAAC;KACzB;CACJ"}

package/dist/esm/dcl/DclClient.d.ts

@@ -6,6 +6,7 @@
 import { DclConfig } from "#dcl/DclConfig.js";
 import { DclApiErrorResponse, DclPkiRootCertificateSubjectReference, DclVendorInfo } from "#dcl/DclRestApiTypes.js";
 import { Duration, MatterError } from "@matter/general";
+import { DeviceAttestationPkiRevocationDclSchema, ProductAttestationDclSchema } from "@matter/types";
 /** Base class for all DCL-related errors */
 export declare class MatterDclError extends MatterError {
 }
@@ -19,7 +20,15 @@ export declare class DclClient {
     #private;
     constructor(config?: DclConfig);
     fetchRootCertificateList(options?: DclClient.Options): Promise<DclPkiRootCertificateSubjectReference[]>;
-    fetchRootCertificateBySubject(subject: DclPkiRootCertificateSubjectReference, options?: DclClient.Options): Promise<import("@matter/types").ProductAttestationDclSchema[]>;
+    /**
+     * Fetch certificates by their SubjectKeyIdentifier from the DCL. Useful for looking up
+     * certificates without knowing their subject DN (e.g. CD signer certificates referenced
+     * only by SKID in Certification Declarations).
+     *
+     * Returns an empty array if no matching certificates exist.
+     */
+    fetchCertificatesBySubjectKeyId(subjectKeyId: string, options?: DclClient.Options): Promise<ProductAttestationDclSchema[]>;
+    fetchRootCertificateBySubject(subject: DclPkiRootCertificateSubjectReference, options?: DclClient.Options): Promise<ProductAttestationDclSchema[]>;
     fetchModelByVidPid(vid: number, pid: number, options?: DclClient.Options): Promise<import("@matter/types").DeviceModelDclSchema>;
     fetchModelVersionsByVidPid(vid: number, pid: number, options?: DclClient.Options): Promise<number[]>;
     fetchModelVersionByVidPidSoftwareVersion(vid: number, pid: number, softwareVersion: number, options?: DclClient.Options): Promise<import("@matter/types").DeviceSoftwareVersionModelDclSchema>;
@@ -27,6 +36,15 @@ export declare class DclClient {
      * Fetch all vendor information from DCL
      */
     fetchAllVendors(options?: DclClient.Options): Promise<DclVendorInfo[]>;
+    /**
+     * Fetch all revocation distribution point entries from DCL.
+     * Uses pagination to retrieve all entries across multiple pages.
+     */
+    fetchRevocationDistributionPoints(options?: DclClient.Options): Promise<DeviceAttestationPkiRevocationDclSchema[]>;
+    /**
+     * Fetch revocation distribution points for a specific issuer by their subject key identifier.
+     */
+    fetchRevocationDistributionPointsByIssuer(issuerSubjectKeyId: string, options?: DclClient.Options): Promise<DeviceAttestationPkiRevocationDclSchema[]>;
 }
 export declare namespace DclClient {
     interface Options {

package/dist/esm/dcl/DclClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DclClient.d.ts","sourceRoot":"","sources":["../../../src/dcl/DclClient.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EACH,mBAAmB,EAMnB,qCAAqC,EACrC,aAAa,EAChB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAU,WAAW,EAAW,MAAM,iBAAiB,CAAC;AAMzE,4CAA4C;AAC5C,qBAAa,cAAe,SAAQ,WAAW;CAAG;AAElD,qDAAqD;AACrD,qBAAa,sBAAuB,SAAQ,cAAc;IACtD,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;IAEvC,YAAY,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,mBAAmB,EAAE,OAAO,CAAC,EAAE,YAAY,EAG3E;CACJ;AAED,8FAA8F;AAC9F,qBAAa,SAAS;;IAGlB,YAAY,MAAM,GAAE,SAAgC,EAEnD;IA+DK,wBAAwB,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC,OAAO,oDAQzD;IAEK,6BAA6B,CAAC,OAAO,EAAE,qCAAqC,EAAE,OAAO,CAAC,EAAE,SAAS,CAAC,OAAO,kEAe9G;IAEK,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,CAAC,OAAO,yDAa7E;IAEK,0BAA0B,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,CAAC,OAAO,qBAarF;IAEK,wCAAwC,CAC1C,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,eAAe,EAAE,MAAM,EACvB,OAAO,CAAC,EAAE,SAAS,CAAC,OAAO,wEAiB9B;IAED;;OAEG;IACG,eAAe,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC,OAAO,4BAEhD;CACJ;AAED,yBAAiB,SAAS,CAAC,CAAC;IACxB,UAAiB,OAAO;QACpB,+CAA+C;QAC/C,OAAO,CAAC,EAAE,QAAQ,CAAC;KACtB;CACJ"}
+{"version":3,"file":"DclClient.d.ts","sourceRoot":"","sources":["../../../src/dcl/DclClient.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EACH,mBAAmB,EASnB,qCAAqC,EACrC,aAAa,EAChB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAU,WAAW,EAAW,MAAM,iBAAiB,CAAC;AACzE,OAAO,EAAE,uCAAuC,EAAE,2BAA2B,EAAY,MAAM,eAAe,CAAC;AAM/G,4CAA4C;AAC5C,qBAAa,cAAe,SAAQ,WAAW;CAAG;AAElD,qDAAqD;AACrD,qBAAa,sBAAuB,SAAQ,cAAc;IACtD,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;IAEvC,YAAY,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,mBAAmB,EAAE,OAAO,CAAC,EAAE,YAAY,EAG3E;CACJ;AAED,8FAA8F;AAC9F,qBAAa,SAAS;;IAGlB,YAAY,MAAM,GAAE,SAAgC,EAEnD;IA+DK,wBAAwB,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC,OAAO,oDAQzD;IAED;;;;;;OAMG;IACG,+BAA+B,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,CAAC,OAAO,0CActF;IAEK,6BAA6B,CAAC,OAAO,EAAE,qCAAqC,EAAE,OAAO,CAAC,EAAE,SAAS,CAAC,OAAO,0CAe9G;IAEK,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,CAAC,OAAO,yDAa7E;IAEK,0BAA0B,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,CAAC,OAAO,qBAarF;IAEK,wCAAwC,CAC1C,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,eAAe,EAAE,MAAM,EACvB,OAAO,CAAC,EAAE,SAAS,CAAC,OAAO,wEAiB9B;IAED;;OAEG;IACG,eAAe,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC,OAAO,4BAEhD;IAED;;;OAGG;IACG,iCAAiC,CACnC,OAAO,CAAC,EAAE,SAAS,CAAC,OAAO,GAC5B,OAAO,CAAC,uCAAuC,EAAE,CAAC,CAOpD;IAED;;OAEG;IACG,yCAAyC,CAC3C,kBAAkB,EAAE,MAAM,EAC1B,OAAO,CAAC,EAAE,SAAS,CAAC,OAAO,GAC5B,OAAO,CAAC,uCAAuC,EAAE,CAAC,CAKpD;CACJ;AAyBD,yBAAiB,SAAS,CAAC,CAAC;IACxB,UAAiB,OAAO;QACpB,+CAA+C;QAC/C,OAAO,CAAC,EAAE,QAAQ,CAAC;KACtB;CACJ"}

package/dist/esm/dcl/DclConfig.d.ts

@@ -27,7 +27,10 @@ export interface DclGithubConfig {
     owner: string;
     repo: string;
     branch: string;
+    /** Path within the repo to the directory containing PAA root .der files. */
     certPath: string;
+    /** Path within the repo to the directory containing CD signer .der files. */
+    cdSignerCertPath: string;
 }
 export declare namespace DclGithubConfig {
     /** Default GitHub PAA certificate repository (project-chip/connectedhomeip) */

package/dist/esm/dcl/DclConfig.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DclConfig.d.ts","sourceRoot":"","sources":["../../../src/dcl/DclConfig.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACtB,GAAG,EAAE,MAAM,CAAC;CACf;AAED,yBAAiB,SAAS,CAAC,CAAC;IACxB,qDAAqD;IAC9C,MAAM,UAAU,EAAE,SAExB,CAAC;IAEF,4CAA4C;IACrC,MAAM,IAAI,EAAE,SAElB,CAAC;CACL;AAED;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CACpB;AAED,yBAAiB,eAAe,CAAC,CAAC;IAC9B,+EAA+E;IACxE,MAAM,QAAQ,EAAE,eAKtB,CAAC;CACL"}
+{"version":3,"file":"DclConfig.d.ts","sourceRoot":"","sources":["../../../src/dcl/DclConfig.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACtB,GAAG,EAAE,MAAM,CAAC;CACf;AAED,yBAAiB,SAAS,CAAC,CAAC;IACxB,qDAAqD;IAC9C,MAAM,UAAU,EAAE,SAExB,CAAC;IAEF,4CAA4C;IACrC,MAAM,IAAI,EAAE,SAElB,CAAC;CACL;AAED;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,4EAA4E;IAC5E,QAAQ,EAAE,MAAM,CAAC;IACjB,6EAA6E;IAC7E,gBAAgB,EAAE,MAAM,CAAC;CAC5B;AAED,yBAAiB,eAAe,CAAC,CAAC;IAC9B,+EAA+E;IACxE,MAAM,QAAQ,EAAE,eAMtB,CAAC;CACL"}

package/dist/esm/dcl/DclRestApiTypes.d.ts

@@ -43,6 +43,15 @@ export interface DclPkiRootCertificatesResponse {
         schemaVersion: number;
     };
 }
+/** Response for /dcl/pki/all-certificates?subjectKeyId=<skid> */
+export interface DclPkiAllCertificatesBySkidResponse {
+    certificates: Array<{
+        subject: string;
+        subjectKeyId: string;
+        certs: ProductAttestationDclSchema[];
+        schemaVersion: number;
+    }>;
+}
 /** Response for /dcl/pki/certificates/{subject}/{subjectKeyId} */
 export interface DclPkiCertificateResponse {
     approvedCertificates: {
@@ -79,4 +88,32 @@ export interface DclVendorInfo {
     creator: string;
     schemaVersion?: number;
 }
+/**
+ * Raw revocation distribution point entry as returned by the DCL REST API.
+ * Note: The DCL API uses "issuerSubjectKeyID" (capital ID) and "dataURL" (capital URL),
+ * which differ from the DeviceAttestationPkiRevocationDclSchema field naming convention.
+ */
+export interface DclPkiRevocationDistributionPointRaw {
+    vid: number;
+    pid: number;
+    isPAA: boolean;
+    label: string;
+    crlSignerDelegator: string;
+    crlSignerCertificate: string;
+    issuerSubjectKeyID: string;
+    dataURL: string;
+    dataFileSize: string;
+    dataDigest: string;
+    dataDigestType: number;
+    revocationType: number;
+    schemaVersion: number;
+}
+/** Response for /dcl/pki/revocation-points/{issuerSubjectKeyId} */
+export interface DclPkiRevocationPointsByIssuerResponse {
+    pkiRevocationDistributionPointsByIssuerSubjectKeyID: {
+        issuerSubjectKeyID: string;
+        points: DclPkiRevocationDistributionPointRaw[];
+        schemaVersion: number;
+    };
+}
 //# sourceMappingURL=DclRestApiTypes.d.ts.map

package/dist/esm/dcl/DclRestApiTypes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DclRestApiTypes.d.ts","sourceRoot":"","sources":["../../../src/dcl/DclRestApiTypes.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,oBAAoB,EAAE,mCAAmC,EAAE,2BAA2B,EAAE,MAAM,eAAe,CAAC;AAEvH;;;GAGG;AACH,oBAAY,aAAa;IACrB,EAAE,IAAI;IACN,QAAQ,IAAI;IACZ,OAAO,IAAI;IACX,eAAe,IAAI;IACnB,gBAAgB,IAAI;IACpB,QAAQ,IAAI;IACZ,aAAa,IAAI;IACjB,gBAAgB,IAAI;IACpB,iBAAiB,IAAI;IACrB,kBAAkB,IAAI;IACtB,OAAO,KAAK;IACZ,UAAU,KAAK;IACf,aAAa,KAAK;IAClB,QAAQ,KAAK;IACb,WAAW,KAAK;IAChB,QAAQ,KAAK;IACb,eAAe,KAAK;CACvB;AAED,MAAM,WAAW,mBAAmB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,qCAAqC;IAClD,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;CACxB;AAED,8CAA8C;AAC9C,MAAM,WAAW,8BAA8B;IAC3C,wBAAwB,EAAE;QACtB,KAAK,EAAE,qCAAqC,EAAE,CAAC;QAC/C,aAAa,EAAE,MAAM,CAAC;KACzB,CAAC;CACL;AAED,kEAAkE;AAClE,MAAM,WAAW,yBAAyB;IACtC,oBAAoB,EAAE;QAClB,OAAO,EAAE,MAAM,CAAC;QAChB,YAAY,EAAE,MAAM,CAAC;QACrB,KAAK,EAAE,2BAA2B,EAAE,CAAC;QACrC,aAAa,EAAE,MAAM,CAAC;KACzB,CAAC;CACL;AAED,iDAAiD;AACjD,MAAM,WAAW,gCAAgC;IAC7C,KAAK,EAAE,oBAAoB,CAAC;CAC/B;AAED,mDAAmD;AACnD,MAAM,WAAW,kCAAkC;IAC/C,aAAa,EAAE;QACX,GAAG,EAAE,MAAM,CAAC;QACZ,GAAG,EAAE,MAAM,CAAC;QACZ,gBAAgB,EAAE,MAAM,EAAE,CAAC;QAC3B,aAAa,EAAE,MAAM,CAAC;KACzB,CAAC;CACL;AAED,qEAAqE;AACrE,MAAM,WAAW,gDAAgD;IAC7D,YAAY,EAAE,mCAAmC,CAAC;CACrD;AAED,kCAAkC;AAClC,MAAM,WAAW,aAAa;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,MAAM,CAAC;IACzB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;CAC1B"}
+{"version":3,"file":"DclRestApiTypes.d.ts","sourceRoot":"","sources":["../../../src/dcl/DclRestApiTypes.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,oBAAoB,EAAE,mCAAmC,EAAE,2BAA2B,EAAE,MAAM,eAAe,CAAC;AAEvH;;;GAGG;AACH,oBAAY,aAAa;IACrB,EAAE,IAAI;IACN,QAAQ,IAAI;IACZ,OAAO,IAAI;IACX,eAAe,IAAI;IACnB,gBAAgB,IAAI;IACpB,QAAQ,IAAI;IACZ,aAAa,IAAI;IACjB,gBAAgB,IAAI;IACpB,iBAAiB,IAAI;IACrB,kBAAkB,IAAI;IACtB,OAAO,KAAK;IACZ,UAAU,KAAK;IACf,aAAa,KAAK;IAClB,QAAQ,KAAK;IACb,WAAW,KAAK;IAChB,QAAQ,KAAK;IACb,eAAe,KAAK;CACvB;AAED,MAAM,WAAW,mBAAmB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,qCAAqC;IAClD,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;CACxB;AAED,8CAA8C;AAC9C,MAAM,WAAW,8BAA8B;IAC3C,wBAAwB,EAAE;QACtB,KAAK,EAAE,qCAAqC,EAAE,CAAC;QAC/C,aAAa,EAAE,MAAM,CAAC;KACzB,CAAC;CACL;AAED,iEAAiE;AACjE,MAAM,WAAW,mCAAmC;IAChD,YAAY,EAAE,KAAK,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,YAAY,EAAE,MAAM,CAAC;QACrB,KAAK,EAAE,2BAA2B,EAAE,CAAC;QACrC,aAAa,EAAE,MAAM,CAAC;KACzB,CAAC,CAAC;CACN;AAED,kEAAkE;AAClE,MAAM,WAAW,yBAAyB;IACtC,oBAAoB,EAAE;QAClB,OAAO,EAAE,MAAM,CAAC;QAChB,YAAY,EAAE,MAAM,CAAC;QACrB,KAAK,EAAE,2BAA2B,EAAE,CAAC;QACrC,aAAa,EAAE,MAAM,CAAC;KACzB,CAAC;CACL;AAED,iDAAiD;AACjD,MAAM,WAAW,gCAAgC;IAC7C,KAAK,EAAE,oBAAoB,CAAC;CAC/B;AAED,mDAAmD;AACnD,MAAM,WAAW,kCAAkC;IAC/C,aAAa,EAAE;QACX,GAAG,EAAE,MAAM,CAAC;QACZ,GAAG,EAAE,MAAM,CAAC;QACZ,gBAAgB,EAAE,MAAM,EAAE,CAAC;QAC3B,aAAa,EAAE,MAAM,CAAC;KACzB,CAAC;CACL;AAED,qEAAqE;AACrE,MAAM,WAAW,gDAAgD;IAC7D,YAAY,EAAE,mCAAmC,CAAC;CACrD;AAED,kCAAkC;AAClC,MAAM,WAAW,aAAa;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,MAAM,CAAC;IACzB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;GAIG;AACH,MAAM,WAAW,oCAAoC;IACjD,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,kBAAkB,EAAE,MAAM,CAAC;IAC3B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;CACzB;AAED,mEAAmE;AACnE,MAAM,WAAW,sCAAsC;IACnD,mDAAmD,EAAE;QACjD,kBAAkB,EAAE,MAAM,CAAC;QAC3B,MAAM,EAAE,oCAAoC,EAAE,CAAC;QAC/C,aAAa,EAAE,MAAM,CAAC;KACzB,CAAC;CACL"}

package/dist/esm/groups/KeySets.d.ts

@@ -39,14 +39,14 @@ export declare class KeySets<T extends OperationalKeySet> extends BasicSet<T> {
      */
     asGroupKeySet(groupKeySetId: number): {
         groupKeySetId: number;
-        epochKey0: AllowSharedBufferSource | null;
-        epochStartTime0: number | bigint | null;
-        epochKey1: AllowSharedBufferSource | null;
-        epochStartTime1: number | bigint | null;
-        epochKey2: AllowSharedBufferSource | null;
-        epochStartTime2: number | bigint | null;
-        groupKeySecurityPolicy: GroupKeyManagement.GroupKeySecurityPolicy;
-        groupKeyMulticastPolicy: GroupKeyManagement.GroupKeyMulticastPolicy | undefined;
+        epochKey0: any;
+        epochStartTime0: any;
+        epochKey1: any;
+        epochStartTime1: any;
+        epochKey2: any;
+        epochStartTime2: any;
+        groupKeySecurityPolicy: any;
+        groupKeyMulticastPolicy: any;
     } | undefined;
     /** Calculates a group session id based on the operational group key. */
     sessionIdFromKey(crypto: Crypto, operationalGroupKey: Bytes): Promise<number>;

package/dist/esm/peer/ControllerCommissioner.d.ts

@@ -4,6 +4,7 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 import { CertificateAuthority } from "#certificate/CertificateAuthority.js";
+import { DeviceAttestationValidator } from "#certificate/DeviceAttestationValidator.js";
 import { DiscoveryData } from "#common/Scanner.js";
 import { Fabric } from "#fabric/Fabric.js";
 import { ControllerCommissioningFlow, ControllerCommissioningFlowOptions } from "#peer/ControllerCommissioningFlow.js";
@@ -19,6 +20,8 @@ import { PeerTimingParameters } from "./PeerTimingParameters.js";
  * General commissioning options.
  */
 export interface CommissioningOptions extends Partial<ControllerCommissioningFlowOptions> {
+    /** Controls behavior when device attestation produces findings. */
+    onAttestationFailure?: DeviceAttestationValidator.OnAttestationFailure;
     /** The fabric into which to commission. */
     fabric: Fabric;
     /** The node ID to assign (the commissioner assigns a random node ID if omitted) */