@matter/thread-br-client 0.0.1 → 0.17.5-alpha.0-20260706-fd4c49e2e

package/dist/cjs/credentials/ThreadCredentialsRegistry.d.ts

@@ -3,7 +3,7 @@
  * Copyright 2022-2026 Matter.js Authors
  * SPDX-License-Identifier: Apache-2.0
  */
-import { Observable } from "@matter/general";
+import { Bytes, Observable } from "@matter/general";
 import type { OperationalDataset } from "../dataset/OperationalDataset.js";
 import type { ThreadNetworkCredentials } from "./ThreadNetworkCredentials.js";
 /**
@@ -17,7 +17,7 @@ export declare class ThreadCredentialsRegistry {
     #private;
     readonly events: {
         registered: Observable<[creds: ThreadNetworkCredentials], void>;
-        unregistered: Observable<[extPanId: Uint8Array<ArrayBufferLike>], void>;
+        unregistered: Observable<[extPanId: AllowSharedBufferSource], void>;
     };
     /**
      * Register credentials extracted from a parsed Operational Dataset.
@@ -41,9 +41,9 @@ export declare class ThreadCredentialsRegistry {
      */
     registerCredentials(creds: ThreadNetworkCredentials): void;
     /** Remove an entry. No-op if absent. */
-    unregister(extPanId: Uint8Array): void;
-    /** Lookup by extPanId. Comparison is by Uint8Array equality, not reference. */
-    getCredentials(extPanId: Uint8Array): ThreadNetworkCredentials | undefined;
+    unregister(extPanId: Bytes): void;
+    /** Lookup by extPanId. Comparison is by byte equality, not reference. */
+    getCredentials(extPanId: Bytes): ThreadNetworkCredentials | undefined;
     /** Defensive snapshot — caller cannot mutate the registry through it. */
     list(): ReadonlyArray<ThreadNetworkCredentials>;
 }

package/dist/cjs/credentials/ThreadCredentialsRegistry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ThreadCredentialsRegistry.d.ts","sourceRoot":"","sources":["../../../src/credentials/ThreadCredentialsRegistry.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAA8B,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACzE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAE9E;;;;;;GAMG;AACH,qBAAa,yBAAyB;;IAElC,QAAQ,CAAC,MAAM;QACX,UAAU;QACV,YAAY;MACd;IAEF;;;;;;;;;OASG;IACH,QAAQ,CAAC,OAAO,EAAE,kBAAkB,GAAG,IAAI,CAiB1C;IAED;;;;;;;;OAQG;IACH,mBAAmB,CAAC,KAAK,EAAE,wBAAwB,GAAG,IAAI,CAWzD;IAED,wCAAwC;IACxC,UAAU,CAAC,QAAQ,EAAE,UAAU,GAAG,IAAI,CAKrC;IAED,+EAA+E;IAC/E,cAAc,CAAC,QAAQ,EAAE,UAAU,GAAG,wBAAwB,GAAG,SAAS,CAEzE;IAED,yEAAyE;IACzE,IAAI,IAAI,aAAa,CAAC,wBAAwB,CAAC,CAE9C;CACJ"}
+{"version":3,"file":"ThreadCredentialsRegistry.d.ts","sourceRoot":"","sources":["../../../src/credentials/ThreadCredentialsRegistry.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,KAAK,EAAuB,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACzE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAE9E;;;;;;GAMG;AACH,qBAAa,yBAAyB;;IAElC,QAAQ,CAAC,MAAM;QACX,UAAU;QACV,YAAY;MACd;IAEF;;;;;;;;;OASG;IACH,QAAQ,CAAC,OAAO,EAAE,kBAAkB,GAAG,IAAI,CAiB1C;IAED;;;;;;;;OAQG;IACH,mBAAmB,CAAC,KAAK,EAAE,wBAAwB,GAAG,IAAI,CAWzD;IAED,wCAAwC;IACxC,UAAU,CAAC,QAAQ,EAAE,KAAK,GAAG,IAAI,CAKhC;IAED,yEAAyE;IACzE,cAAc,CAAC,QAAQ,EAAE,KAAK,GAAG,wBAAwB,GAAG,SAAS,CAEpE;IAED,yEAAyE;IACzE,IAAI,IAAI,aAAa,CAAC,wBAAwB,CAAC,CAE9C;CACJ"}

package/dist/cjs/credentials/ThreadCredentialsRegistry.js

@@ -72,10 +72,10 @@ class ThreadCredentialsRegistry {
    */
   registerCredentials(creds) {
     const stored = {
-      extPanId: creds.extPanId.slice(),
+      extPanId: import_general.Bytes.of(creds.extPanId).slice(),
       networkName: creds.networkName,
-      pskc: creds.pskc.slice(),
-      meshLocalPrefix: creds.meshLocalPrefix?.slice(),
+      pskc: import_general.Bytes.of(creds.pskc).slice(),
+      meshLocalPrefix: creds.meshLocalPrefix === void 0 ? void 0 : import_general.Bytes.of(creds.meshLocalPrefix).slice(),
       activeTimestamp: creds.activeTimestamp
     };
     this.#byExtPanId.set(keyOf(stored.extPanId), stored);
@@ -86,9 +86,9 @@ class ThreadCredentialsRegistry {
     const key = keyOf(extPanId);
     if (!this.#byExtPanId.has(key)) return;
     this.#byExtPanId.delete(key);
-    this.events.unregistered.emit(extPanId.slice());
+    this.events.unregistered.emit(import_general.Bytes.of(extPanId).slice());
   }
-  /** Lookup by extPanId. Comparison is by Uint8Array equality, not reference. */
+  /** Lookup by extPanId. Comparison is by byte equality, not reference. */
   getCredentials(extPanId) {
     return this.#byExtPanId.get(keyOf(extPanId));
   }
@@ -102,14 +102,15 @@ function keyOf(extPanId) {
 }
 function snapshot(creds) {
   return {
-    extPanId: creds.extPanId.slice(),
+    extPanId: import_general.Bytes.of(creds.extPanId).slice(),
     networkName: creds.networkName,
-    pskc: creds.pskc.slice(),
-    meshLocalPrefix: creds.meshLocalPrefix?.slice(),
+    pskc: import_general.Bytes.of(creds.pskc).slice(),
+    meshLocalPrefix: creds.meshLocalPrefix === void 0 ? void 0 : import_general.Bytes.of(creds.meshLocalPrefix).slice(),
     activeTimestamp: creds.activeTimestamp
   };
 }
-function bytesToBigint(bytes) {
+function bytesToBigint(input) {
+  const bytes = import_general.Bytes.of(input);
   let result = 0n;
   for (const b of bytes) {
     result = result << 8n | BigInt(b);

package/dist/cjs/credentials/ThreadCredentialsRegistry.js.map

@@ -1,6 +1,6 @@
 {
   "version": 3,
   "sources": ["../../../src/credentials/ThreadCredentialsRegistry.ts"],
-  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,qBAAuD;AANvD;AAAA;AAAA;AAAA;AAAA;AAiBO,MAAM,0BAA0B;AAAA,EAC1B,cAAc,oBAAI,IAAsC;AAAA,EACxD,SAAS;AAAA,IACd,YAAY,IAAI,0BAA8C;AAAA,IAC9D,cAAc,IAAI,0BAAmC;AAAA,EACzD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,SAAS,SAAmC;AACxC,QAAI,QAAQ,aAAa,QAAW;AAChC,YAAM,IAAI,mCAAoB,0DAA0D;AAAA,IAC5F;AACA,QAAI,QAAQ,gBAAgB,QAAW;AACnC,YAAM,IAAI,mCAAoB,6DAA6D;AAAA,IAC/F;AACA,QAAI,QAAQ,SAAS,QAAW;AAC5B,YAAM,IAAI,mCAAoB,sDAAsD;AAAA,IACxF;AACA,SAAK,oBAAoB;AAAA,MACrB,UAAU,QAAQ;AAAA,MAClB,aAAa,QAAQ;AAAA,MACrB,MAAM,QAAQ;AAAA,MACd,iBAAiB,QAAQ;AAAA,MACzB,iBAAiB,QAAQ,oBAAoB,SAAY,SAAY,cAAc,QAAQ,eAAe;AAAA,IAC9G,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,oBAAoB,OAAuC;AACvD,UAAM,SAAmC;AAAA,MACrC,UAAU,MAAM,SAAS,MAAM;AAAA,MAC/B,aAAa,MAAM;AAAA,MACnB,MAAM,MAAM,KAAK,MAAM;AAAA,MACvB,iBAAiB,MAAM,iBAAiB,MAAM;AAAA,MAC9C,iBAAiB,MAAM;AAAA,IAC3B;AACA,SAAK,YAAY,IAAI,MAAM,OAAO,QAAQ,GAAG,MAAM;AAEnD,SAAK,OAAO,WAAW,KAAK,SAAS,MAAM,CAAC;AAAA,EAChD;AAAA;AAAA,EAGA,WAAW,UAA4B;AACnC,UAAM,MAAM,MAAM,QAAQ;AAC1B,QAAI,CAAC,KAAK,YAAY,IAAI,GAAG,EAAG;AAChC,SAAK,YAAY,OAAO,GAAG;AAC3B,SAAK,OAAO,aAAa,KAAK,SAAS,MAAM,CAAC;AAAA,EAClD;AAAA;AAAA,EAGA,eAAe,UAA4D;AACvE,WAAO,KAAK,YAAY,IAAI,MAAM,QAAQ,CAAC;AAAA,EAC/C;AAAA;AAAA,EAGA,OAAgD;AAC5C,WAAO,MAAM,KAAK,KAAK,YAAY,OAAO,CAAC;AAAA,EAC/C;AACJ;AAEA,SAAS,MAAM,UAA8B;AACzC,SAAO,qBAAM,MAAM,QAAQ;AAC/B;AAEA,SAAS,SAAS,OAA2D;AACzE,SAAO;AAAA,IACH,UAAU,MAAM,SAAS,MAAM;AAAA,IAC/B,aAAa,MAAM;AAAA,IACnB,MAAM,MAAM,KAAK,MAAM;AAAA,IACvB,iBAAiB,MAAM,iBAAiB,MAAM;AAAA,IAC9C,iBAAiB,MAAM;AAAA,EAC3B;AACJ;AAIA,SAAS,cAAc,OAA2B;AAC9C,MAAI,SAAS;AACb,aAAW,KAAK,OAAO;AACnB,aAAU,UAAU,KAAM,OAAO,CAAC;AAAA,EACtC;AACA,SAAO;AACX;",
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,qBAAuD;AANvD;AAAA;AAAA;AAAA;AAAA;AAiBO,MAAM,0BAA0B;AAAA,EAC1B,cAAc,oBAAI,IAAsC;AAAA,EACxD,SAAS;AAAA,IACd,YAAY,IAAI,0BAA8C;AAAA,IAC9D,cAAc,IAAI,0BAA8B;AAAA,EACpD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,SAAS,SAAmC;AACxC,QAAI,QAAQ,aAAa,QAAW;AAChC,YAAM,IAAI,mCAAoB,0DAA0D;AAAA,IAC5F;AACA,QAAI,QAAQ,gBAAgB,QAAW;AACnC,YAAM,IAAI,mCAAoB,6DAA6D;AAAA,IAC/F;AACA,QAAI,QAAQ,SAAS,QAAW;AAC5B,YAAM,IAAI,mCAAoB,sDAAsD;AAAA,IACxF;AACA,SAAK,oBAAoB;AAAA,MACrB,UAAU,QAAQ;AAAA,MAClB,aAAa,QAAQ;AAAA,MACrB,MAAM,QAAQ;AAAA,MACd,iBAAiB,QAAQ;AAAA,MACzB,iBAAiB,QAAQ,oBAAoB,SAAY,SAAY,cAAc,QAAQ,eAAe;AAAA,IAC9G,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,oBAAoB,OAAuC;AACvD,UAAM,SAAmC;AAAA,MACrC,UAAU,qBAAM,GAAG,MAAM,QAAQ,EAAE,MAAM;AAAA,MACzC,aAAa,MAAM;AAAA,MACnB,MAAM,qBAAM,GAAG,MAAM,IAAI,EAAE,MAAM;AAAA,MACjC,iBAAiB,MAAM,oBAAoB,SAAY,SAAY,qBAAM,GAAG,MAAM,eAAe,EAAE,MAAM;AAAA,MACzG,iBAAiB,MAAM;AAAA,IAC3B;AACA,SAAK,YAAY,IAAI,MAAM,OAAO,QAAQ,GAAG,MAAM;AAEnD,SAAK,OAAO,WAAW,KAAK,SAAS,MAAM,CAAC;AAAA,EAChD;AAAA;AAAA,EAGA,WAAW,UAAuB;AAC9B,UAAM,MAAM,MAAM,QAAQ;AAC1B,QAAI,CAAC,KAAK,YAAY,IAAI,GAAG,EAAG;AAChC,SAAK,YAAY,OAAO,GAAG;AAC3B,SAAK,OAAO,aAAa,KAAK,qBAAM,GAAG,QAAQ,EAAE,MAAM,CAAC;AAAA,EAC5D;AAAA;AAAA,EAGA,eAAe,UAAuD;AAClE,WAAO,KAAK,YAAY,IAAI,MAAM,QAAQ,CAAC;AAAA,EAC/C;AAAA;AAAA,EAGA,OAAgD;AAC5C,WAAO,MAAM,KAAK,KAAK,YAAY,OAAO,CAAC;AAAA,EAC/C;AACJ;AAEA,SAAS,MAAM,UAAyB;AACpC,SAAO,qBAAM,MAAM,QAAQ;AAC/B;AAEA,SAAS,SAAS,OAA2D;AACzE,SAAO;AAAA,IACH,UAAU,qBAAM,GAAG,MAAM,QAAQ,EAAE,MAAM;AAAA,IACzC,aAAa,MAAM;AAAA,IACnB,MAAM,qBAAM,GAAG,MAAM,IAAI,EAAE,MAAM;AAAA,IACjC,iBAAiB,MAAM,oBAAoB,SAAY,SAAY,qBAAM,GAAG,MAAM,eAAe,EAAE,MAAM;AAAA,IACzG,iBAAiB,MAAM;AAAA,EAC3B;AACJ;AAIA,SAAS,cAAc,OAAsB;AACzC,QAAM,QAAQ,qBAAM,GAAG,KAAK;AAC5B,MAAI,SAAS;AACb,aAAW,KAAK,OAAO;AACnB,aAAU,UAAU,KAAM,OAAO,CAAC;AAAA,EACtC;AACA,SAAO;AACX;",
   "names": []
 }

package/dist/cjs/credentials/ThreadNetworkCredentials.d.ts

@@ -3,6 +3,7 @@
  * Copyright 2022-2026 Matter.js Authors
  * SPDX-License-Identifier: Apache-2.0
  */
+import type { Bytes } from "@matter/general";
 /**
  * Credentials needed to authenticate against a Thread network's commissioner.
  *
@@ -12,14 +13,14 @@
  */
 export interface ThreadNetworkCredentials {
     /** 8-byte extended PAN ID — primary registry key. */
-    extPanId: Uint8Array;
+    extPanId: Bytes;
     /** Thread network name (UTF-8, ≤16 bytes). */
     networkName: string;
     /** 16-byte EC-JPAKE password (PSKc). Sensitive — redact when logging. */
-    pskc: Uint8Array;
+    pskc: Bytes;
     /** 8-byte mesh-local prefix, used to derive node mesh-local addresses for
      *  UDP-proxy unicast diagnostics. Absent if the dataset omits it. */
-    meshLocalPrefix?: Uint8Array;
+    meshLocalPrefix?: Bytes;
     /** Active timestamp from the dataset, used for change detection. */
     activeTimestamp?: bigint;
 }

package/dist/cjs/credentials/ThreadNetworkCredentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ThreadNetworkCredentials.d.ts","sourceRoot":"","sources":["../../../src/credentials/ThreadNetworkCredentials.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;;;GAMG;AACH,MAAM,WAAW,wBAAwB;IACrC,qDAAqD;IACrD,QAAQ,EAAE,UAAU,CAAC;IACrB,8CAA8C;IAC9C,WAAW,EAAE,MAAM,CAAC;IACpB,yEAAyE;IACzE,IAAI,EAAE,UAAU,CAAC;IACjB;yEACqE;IACrE,eAAe,CAAC,EAAE,UAAU,CAAC;IAC7B,oEAAoE;IACpE,eAAe,CAAC,EAAE,MAAM,CAAC;CAC5B"}
+{"version":3,"file":"ThreadNetworkCredentials.d.ts","sourceRoot":"","sources":["../../../src/credentials/ThreadNetworkCredentials.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAE7C;;;;;;GAMG;AACH,MAAM,WAAW,wBAAwB;IACrC,qDAAqD;IACrD,QAAQ,EAAE,KAAK,CAAC;IAChB,8CAA8C;IAC9C,WAAW,EAAE,MAAM,CAAC;IACpB,yEAAyE;IACzE,IAAI,EAAE,KAAK,CAAC;IACZ;yEACqE;IACrE,eAAe,CAAC,EAAE,KAAK,CAAC;IACxB,oEAAoE;IACpE,eAAe,CAAC,EAAE,MAAM,CAAC;CAC5B"}

package/dist/cjs/crypto/AesCmacPrf128.d.ts

@@ -3,22 +3,12 @@
  * Copyright 2022-2026 Matter.js Authors
  * SPDX-License-Identifier: Apache-2.0
  */
+import { Bytes, Crypto } from "@matter/general";
 /**
- * AES-CMAC per RFC 4493.
- *
- * Block-cipher-based MAC with a 128-bit AES key and a 16-byte tag. Empty messages
- * are explicitly supported and pad to a single all-zero block XORed with K2.
- */
-export declare namespace AesCmac {
-    function compute(key: Uint8Array, message: Uint8Array): Uint8Array;
-}
-/**
- * AES-CMAC-PRF-128 per RFC 4615.
- *
- * Lifts AES-CMAC into a variable-length-key PRF: a 16-byte key is used directly,
- * any other key is first compressed via CMAC under an all-zero key.
+ * AES-CMAC-PRF-128 per RFC 4615: a 16-byte key is used directly; any other length is
+ * first compressed via CMAC under an all-zero key. Built on {@link Crypto.cmac}.
  */
 export declare namespace AesCmacPrf128 {
-    function compute(key: Uint8Array, message: Uint8Array): Uint8Array;
+    function compute(crypto: Crypto, key: Bytes, message: Bytes): Bytes;
 }
 //# sourceMappingURL=AesCmacPrf128.d.ts.map

package/dist/cjs/crypto/AesCmacPrf128.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AesCmacPrf128.d.ts","sourceRoot":"","sources":["../../../src/crypto/AesCmacPrf128.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AA2CH;;;;;GAKG;AACH,yBAAiB,OAAO,CAAC,CAAC;IACtB,SAAgB,OAAO,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,GAAG,UAAU,CA6BxE;CACJ;AAED;;;;;GAKG;AACH,yBAAiB,aAAa,CAAC,CAAC;IAC5B,SAAgB,OAAO,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,GAAG,UAAU,CAMxE;CACJ"}
+{"version":3,"file":"AesCmacPrf128.d.ts","sourceRoot":"","sources":["../../../src/crypto/AesCmacPrf128.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAIhD;;;GAGG;AACH,yBAAiB,aAAa,CAAC,CAAC;IAC5B,SAAgB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,GAAG,KAAK,CAOzE;CACJ"}

package/dist/cjs/crypto/AesCmacPrf128.js

@@ -18,89 +18,25 @@ var __copyProps = (to, from, except, desc) => {
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var AesCmacPrf128_exports = {};
 __export(AesCmacPrf128_exports, {
-  AesCmac: () => AesCmac,
   AesCmacPrf128: () => AesCmacPrf128
 });
 module.exports = __toCommonJS(AesCmacPrf128_exports);
 var import_general = require("@matter/general");
-var import_node_crypto = require("node:crypto");
 /**
  * @license
  * Copyright 2022-2026 Matter.js Authors
  * SPDX-License-Identifier: Apache-2.0
  */
-const BLOCK_SIZE = 16;
-const RB = 135;
-const ZERO_BLOCK = new Uint8Array(BLOCK_SIZE);
-function aesEcbEncryptBlock(key, block) {
-  const cipher = (0, import_node_crypto.createCipheriv)("aes-128-ecb", key, null);
-  cipher.setAutoPadding(false);
-  const out = cipher.update(block);
-  cipher.final();
-  return new Uint8Array(out.buffer, out.byteOffset, out.byteLength);
-}
-function leftShift1(input) {
-  const out = new Uint8Array(input.length);
-  let carry = 0;
-  for (let i = input.length - 1; i >= 0; i--) {
-    const b = input[i];
-    out[i] = b << 1 & 255 | carry;
-    carry = (b & 128) >> 7;
-  }
-  return out;
-}
-function xorInto(target, source, offset = 0) {
-  for (let i = 0; i < BLOCK_SIZE; i++) {
-    target[i] ^= source[offset + i];
-  }
-}
-function generateSubkeys(key) {
-  const l = aesEcbEncryptBlock(key, ZERO_BLOCK);
-  const k1 = leftShift1(l);
-  if ((l[0] & 128) !== 0) k1[BLOCK_SIZE - 1] ^= RB;
-  const k2 = leftShift1(k1);
-  if ((k1[0] & 128) !== 0) k2[BLOCK_SIZE - 1] ^= RB;
-  return { k1, k2 };
-}
-var AesCmac;
-((AesCmac2) => {
-  function compute(key, message) {
-    if (key.length !== 16) {
-      throw new import_general.InternalError(`AES-CMAC key must be 16 bytes, got ${key.length}`);
-    }
-    const { k1, k2 } = generateSubkeys(key);
-    const numBlocks = Math.max(1, Math.ceil(message.length / BLOCK_SIZE));
-    const lastBlockComplete = message.length > 0 && message.length % BLOCK_SIZE === 0;
-    const lastBlock = new Uint8Array(BLOCK_SIZE);
-    const lastBlockOffset = (numBlocks - 1) * BLOCK_SIZE;
-    if (lastBlockComplete) {
-      lastBlock.set(message.subarray(lastBlockOffset, lastBlockOffset + BLOCK_SIZE));
-      xorInto(lastBlock, k1);
-    } else {
-      const remaining = message.length - lastBlockOffset;
-      lastBlock.set(message.subarray(lastBlockOffset, lastBlockOffset + remaining));
-      lastBlock[remaining] = 128;
-      xorInto(lastBlock, k2);
-    }
-    const x = new Uint8Array(BLOCK_SIZE);
-    for (let i = 0; i < numBlocks - 1; i++) {
-      xorInto(x, message, i * BLOCK_SIZE);
-      const enc = aesEcbEncryptBlock(key, x);
-      x.set(enc);
-    }
-    xorInto(x, lastBlock);
-    return aesEcbEncryptBlock(key, x);
-  }
-  AesCmac2.compute = compute;
-})(AesCmac || (AesCmac = {}));
+const ZERO_BLOCK = new Uint8Array(16);
 var AesCmacPrf128;
 ((AesCmacPrf1282) => {
-  function compute(key, message) {
-    if (key.length === 16) {
-      return AesCmac.compute(key, message);
+  function compute(crypto, key, message) {
+    const keyBytes = import_general.Bytes.of(key);
+    if (keyBytes.length === 16) {
+      return crypto.cmac(keyBytes, message);
     }
-    const derivedKey = AesCmac.compute(ZERO_BLOCK, key);
-    return AesCmac.compute(derivedKey, message);
+    const derivedKey = crypto.cmac(ZERO_BLOCK, keyBytes);
+    return crypto.cmac(derivedKey, message);
   }
   AesCmacPrf1282.compute = compute;
 })(AesCmacPrf128 || (AesCmacPrf128 = {}));

package/dist/cjs/crypto/AesCmacPrf128.js.map

@@ -1,6 +1,6 @@
 {
   "version": 3,
   "sources": ["../../../src/crypto/AesCmacPrf128.ts"],
-  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,qBAA8B;AAC9B,yBAA+B;AAP/B;AAAA;AAAA;AAAA;AAAA;AASA,MAAM,aAAa;AACnB,MAAM,KAAK;AACX,MAAM,aAAa,IAAI,WAAW,UAAU;AAE5C,SAAS,mBAAmB,KAAiB,OAA+B;AACxE,QAAM,aAAS,mCAAe,eAAe,KAAK,IAAI;AACtD,SAAO,eAAe,KAAK;AAC3B,QAAM,MAAM,OAAO,OAAO,KAAK;AAC/B,SAAO,MAAM;AACb,SAAO,IAAI,WAAW,IAAI,QAAQ,IAAI,YAAY,IAAI,UAAU;AACpE;AAEA,SAAS,WAAW,OAA+B;AAC/C,QAAM,MAAM,IAAI,WAAW,MAAM,MAAM;AACvC,MAAI,QAAQ;AACZ,WAAS,IAAI,MAAM,SAAS,GAAG,KAAK,GAAG,KAAK;AACxC,UAAM,IAAI,MAAM,CAAC;AACjB,QAAI,CAAC,IAAM,KAAK,IAAK,MAAQ;AAC7B,aAAS,IAAI,QAAS;AAAA,EAC1B;AACA,SAAO;AACX;AAEA,SAAS,QAAQ,QAAoB,QAAoB,SAAS,GAAS;AACvE,WAAS,IAAI,GAAG,IAAI,YAAY,KAAK;AACjC,WAAO,CAAC,KAAK,OAAO,SAAS,CAAC;AAAA,EAClC;AACJ;AAEA,SAAS,gBAAgB,KAAqD;AAC1E,QAAM,IAAI,mBAAmB,KAAK,UAAU;AAC5C,QAAM,KAAK,WAAW,CAAC;AACvB,OAAK,EAAE,CAAC,IAAI,SAAU,EAAG,IAAG,aAAa,CAAC,KAAK;AAC/C,QAAM,KAAK,WAAW,EAAE;AACxB,OAAK,GAAG,CAAC,IAAI,SAAU,EAAG,IAAG,aAAa,CAAC,KAAK;AAChD,SAAO,EAAE,IAAI,GAAG;AACpB;AAQO,IAAU;AAAA,CAAV,CAAUA,aAAV;AACI,WAAS,QAAQ,KAAiB,SAAiC;AACtE,QAAI,IAAI,WAAW,IAAI;AACnB,YAAM,IAAI,6BAAc,sCAAsC,IAAI,MAAM,EAAE;AAAA,IAC9E;AACA,UAAM,EAAE,IAAI,GAAG,IAAI,gBAAgB,GAAG;AAEtC,UAAM,YAAY,KAAK,IAAI,GAAG,KAAK,KAAK,QAAQ,SAAS,UAAU,CAAC;AACpE,UAAM,oBAAoB,QAAQ,SAAS,KAAK,QAAQ,SAAS,eAAe;AAEhF,UAAM,YAAY,IAAI,WAAW,UAAU;AAC3C,UAAM,mBAAmB,YAAY,KAAK;AAC1C,QAAI,mBAAmB;AACnB,gBAAU,IAAI,QAAQ,SAAS,iBAAiB,kBAAkB,UAAU,CAAC;AAC7E,cAAQ,WAAW,EAAE;AAAA,IACzB,OAAO;AACH,YAAM,YAAY,QAAQ,SAAS;AACnC,gBAAU,IAAI,QAAQ,SAAS,iBAAiB,kBAAkB,SAAS,CAAC;AAC5E,gBAAU,SAAS,IAAI;AACvB,cAAQ,WAAW,EAAE;AAAA,IACzB;AAEA,UAAM,IAAI,IAAI,WAAW,UAAU;AACnC,aAAS,IAAI,GAAG,IAAI,YAAY,GAAG,KAAK;AACpC,cAAQ,GAAG,SAAS,IAAI,UAAU;AAClC,YAAM,MAAM,mBAAmB,KAAK,CAAC;AACrC,QAAE,IAAI,GAAG;AAAA,IACb;AACA,YAAQ,GAAG,SAAS;AACpB,WAAO,mBAAmB,KAAK,CAAC;AAAA,EACpC;AA7BO,EAAAA,SAAS;AAAA,GADH;AAuCV,IAAU;AAAA,CAAV,CAAUC,mBAAV;AACI,WAAS,QAAQ,KAAiB,SAAiC;AACtE,QAAI,IAAI,WAAW,IAAI;AACnB,aAAO,QAAQ,QAAQ,KAAK,OAAO;AAAA,IACvC;AACA,UAAM,aAAa,QAAQ,QAAQ,YAAY,GAAG;AAClD,WAAO,QAAQ,QAAQ,YAAY,OAAO;AAAA,EAC9C;AANO,EAAAA,eAAS;AAAA,GADH;",
-  "names": ["AesCmac", "AesCmacPrf128"]
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,qBAA8B;AAN9B;AAAA;AAAA;AAAA;AAAA;AAQA,MAAM,aAAa,IAAI,WAAW,EAAE;AAM7B,IAAU;AAAA,CAAV,CAAUA,mBAAV;AACI,WAAS,QAAQ,QAAgB,KAAY,SAAuB;AACvE,UAAM,WAAW,qBAAM,GAAG,GAAG;AAC7B,QAAI,SAAS,WAAW,IAAI;AACxB,aAAO,OAAO,KAAK,UAAU,OAAO;AAAA,IACxC;AACA,UAAM,aAAa,OAAO,KAAK,YAAY,QAAQ;AACnD,WAAO,OAAO,KAAK,YAAY,OAAO;AAAA,EAC1C;AAPO,EAAAA,eAAS;AAAA,GADH;",
+  "names": ["AesCmacPrf128"]
 }

package/dist/cjs/crypto/Pbkdf2AesCmac.d.ts

@@ -3,16 +3,17 @@
  * Copyright 2022-2026 Matter.js Authors
  * SPDX-License-Identifier: Apache-2.0
  */
+import { Bytes, Crypto } from "@matter/general";
 /**
  * PBKDF2 (RFC 8018 §5.2) using AES-CMAC-PRF-128 as the underlying PRF.
  *
  * Hand-rolled because Node's `crypto.pbkdf2` is hardwired to HMAC. The PRF here
  * always emits 16 bytes, so each output block needs one PRF call per iteration.
  */
-export declare function pbkdf2AesCmac(args: {
-    password: Uint8Array;
-    salt: Uint8Array;
+export declare function pbkdf2AesCmac(crypto: Crypto, args: {
+    password: Bytes;
+    salt: Bytes;
     iterations: number;
     dkLen: number;
-}): Uint8Array;
+}): Bytes;
 //# sourceMappingURL=Pbkdf2AesCmac.d.ts.map

package/dist/cjs/crypto/Pbkdf2AesCmac.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Pbkdf2AesCmac.d.ts","sourceRoot":"","sources":["../../../src/crypto/Pbkdf2AesCmac.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAOH;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE;IAChC,QAAQ,EAAE,UAAU,CAAC;IACrB,IAAI,EAAE,UAAU,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;CACjB,GAAG,UAAU,CAkCb"}
+{"version":3,"file":"Pbkdf2AesCmac.d.ts","sourceRoot":"","sources":["../../../src/crypto/Pbkdf2AesCmac.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,EAAuB,MAAM,iBAAiB,CAAC;AAKrE;;;;;GAKG;AACH,wBAAgB,aAAa,CACzB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE;IACF,QAAQ,EAAE,KAAK,CAAC;IAChB,IAAI,EAAE,KAAK,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;CACjB,GACF,KAAK,CAmCP"}

package/dist/cjs/crypto/Pbkdf2AesCmac.js

@@ -29,8 +29,9 @@ var import_AesCmacPrf128 = require("./AesCmacPrf128.js");
  * SPDX-License-Identifier: Apache-2.0
  */
 const HLEN = 16;
-function pbkdf2AesCmac(args) {
-  const { password, salt, iterations, dkLen } = args;
+function pbkdf2AesCmac(crypto, args) {
+  const { password, iterations, dkLen } = args;
+  const salt = import_general.Bytes.of(args.salt);
   if (!Number.isInteger(iterations) || iterations <= 0) {
     throw new import_general.ImplementationError(`iterations must be a positive integer, got ${iterations}`);
   }
@@ -49,10 +50,10 @@ function pbkdf2AesCmac(args) {
     saltedBlock[salt.length + 1] = i >>> 16 & 255;
     saltedBlock[salt.length + 2] = i >>> 8 & 255;
     saltedBlock[salt.length + 3] = i & 255;
-    let u = import_AesCmacPrf128.AesCmacPrf128.compute(password, saltedBlock);
+    let u = import_general.Bytes.of(import_AesCmacPrf128.AesCmacPrf128.compute(crypto, password, saltedBlock));
     const t = new Uint8Array(u);
     for (let j = 1; j < iterations; j++) {
-      u = import_AesCmacPrf128.AesCmacPrf128.compute(password, u);
+      u = import_general.Bytes.of(import_AesCmacPrf128.AesCmacPrf128.compute(crypto, password, u));
       for (let k = 0; k < HLEN; k++) t[k] ^= u[k];
     }
     out.set(t, (i - 1) * HLEN);

package/dist/cjs/crypto/Pbkdf2AesCmac.js.map

@@ -1,6 +1,6 @@
 {
   "version": 3,
   "sources": ["../../../src/crypto/Pbkdf2AesCmac.ts"],
-  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,qBAAoC;AACpC,2BAA8B;AAP9B;AAAA;AAAA;AAAA;AAAA;AASA,MAAM,OAAO;AAQN,SAAS,cAAc,MAKf;AACX,QAAM,EAAE,UAAU,MAAM,YAAY,MAAM,IAAI;AAC9C,MAAI,CAAC,OAAO,UAAU,UAAU,KAAK,cAAc,GAAG;AAClD,UAAM,IAAI,mCAAoB,8CAA8C,UAAU,EAAE;AAAA,EAC5F;AACA,MAAI,CAAC,OAAO,UAAU,KAAK,KAAK,SAAS,GAAG;AACxC,UAAM,IAAI,mCAAoB,yCAAyC,KAAK,EAAE;AAAA,EAClF;AAEA,MAAI,QAAQ,aAAa,MAAM;AAC3B,UAAM,IAAI,mCAAoB,SAAS,KAAK,yBAAyB;AAAA,EACzE;AAEA,QAAM,YAAY,KAAK,KAAK,QAAQ,IAAI;AACxC,QAAM,MAAM,IAAI,WAAW,YAAY,IAAI;AAC3C,QAAM,cAAc,IAAI,WAAW,KAAK,SAAS,CAAC;AAClD,cAAY,IAAI,MAAM,CAAC;AAEvB,WAAS,IAAI,GAAG,KAAK,WAAW,KAAK;AACjC,gBAAY,KAAK,MAAM,IAAK,MAAM,KAAM;AACxC,gBAAY,KAAK,SAAS,CAAC,IAAK,MAAM,KAAM;AAC5C,gBAAY,KAAK,SAAS,CAAC,IAAK,MAAM,IAAK;AAC3C,gBAAY,KAAK,SAAS,CAAC,IAAI,IAAI;AAEnC,QAAI,IAAI,mCAAc,QAAQ,UAAU,WAAW;AACnD,UAAM,IAAI,IAAI,WAAW,CAAC;AAC1B,aAAS,IAAI,GAAG,IAAI,YAAY,KAAK;AACjC,UAAI,mCAAc,QAAQ,UAAU,CAAC;AACrC,eAAS,IAAI,GAAG,IAAI,MAAM,IAAK,GAAE,CAAC,KAAK,EAAE,CAAC;AAAA,IAC9C;AACA,QAAI,IAAI,IAAI,IAAI,KAAK,IAAI;AAAA,EAC7B;AAEA,SAAO,IAAI,SAAS,GAAG,KAAK;AAChC;",
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,qBAAmD;AACnD,2BAA8B;AAP9B;AAAA;AAAA;AAAA;AAAA;AASA,MAAM,OAAO;AAQN,SAAS,cACZ,QACA,MAMK;AACL,QAAM,EAAE,UAAU,YAAY,MAAM,IAAI;AACxC,QAAM,OAAO,qBAAM,GAAG,KAAK,IAAI;AAC/B,MAAI,CAAC,OAAO,UAAU,UAAU,KAAK,cAAc,GAAG;AAClD,UAAM,IAAI,mCAAoB,8CAA8C,UAAU,EAAE;AAAA,EAC5F;AACA,MAAI,CAAC,OAAO,UAAU,KAAK,KAAK,SAAS,GAAG;AACxC,UAAM,IAAI,mCAAoB,yCAAyC,KAAK,EAAE;AAAA,EAClF;AAEA,MAAI,QAAQ,aAAa,MAAM;AAC3B,UAAM,IAAI,mCAAoB,SAAS,KAAK,yBAAyB;AAAA,EACzE;AAEA,QAAM,YAAY,KAAK,KAAK,QAAQ,IAAI;AACxC,QAAM,MAAM,IAAI,WAAW,YAAY,IAAI;AAC3C,QAAM,cAAc,IAAI,WAAW,KAAK,SAAS,CAAC;AAClD,cAAY,IAAI,MAAM,CAAC;AAEvB,WAAS,IAAI,GAAG,KAAK,WAAW,KAAK;AACjC,gBAAY,KAAK,MAAM,IAAK,MAAM,KAAM;AACxC,gBAAY,KAAK,SAAS,CAAC,IAAK,MAAM,KAAM;AAC5C,gBAAY,KAAK,SAAS,CAAC,IAAK,MAAM,IAAK;AAC3C,gBAAY,KAAK,SAAS,CAAC,IAAI,IAAI;AAEnC,QAAI,IAAI,qBAAM,GAAG,mCAAc,QAAQ,QAAQ,UAAU,WAAW,CAAC;AACrE,UAAM,IAAI,IAAI,WAAW,CAAC;AAC1B,aAAS,IAAI,GAAG,IAAI,YAAY,KAAK;AACjC,UAAI,qBAAM,GAAG,mCAAc,QAAQ,QAAQ,UAAU,CAAC,CAAC;AACvD,eAAS,IAAI,GAAG,IAAI,MAAM,IAAK,GAAE,CAAC,KAAK,EAAE,CAAC;AAAA,IAC9C;AACA,QAAI,IAAI,IAAI,IAAI,KAAK,IAAI;AAAA,EAC7B;AAEA,SAAO,IAAI,SAAS,GAAG,KAAK;AAChC;",
   "names": []
 }

package/dist/cjs/crypto/Pskc.d.ts

@@ -3,6 +3,7 @@
  * Copyright 2022-2026 Matter.js Authors
  * SPDX-License-Identifier: Apache-2.0
  */
+import { Bytes, Crypto } from "@matter/general";
 /**
  * Thread MeshCoP PSKc derivation.
  *
@@ -12,10 +13,10 @@
  * || networkName` ordering is wrong).
  */
 export declare namespace Pskc {
-    function derive(args: {
+    function derive(crypto: Crypto, args: {
         passphrase: string;
-        extPanId: Uint8Array;
+        extPanId: Bytes;
         networkName: string;
-    }): Uint8Array;
+    }): Bytes;
 }
 //# sourceMappingURL=Pskc.d.ts.map

package/dist/cjs/crypto/Pskc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Pskc.d.ts","sourceRoot":"","sources":["../../../src/crypto/Pskc.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAcH;;;;;;;GAOG;AACH,yBAAiB,IAAI,CAAC,CAAC;IACnB,SAAgB,MAAM,CAAC,IAAI,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,UAAU,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,GAAG,UAAU,CA4B1G;CACJ"}
+{"version":3,"file":"Pskc.d.ts","sourceRoot":"","sources":["../../../src/crypto/Pskc.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,EAAuB,MAAM,iBAAiB,CAAC;AAYrE;;;;;;;GAOG;AACH,yBAAiB,IAAI,CAAC,CAAC;IACnB,SAAgB,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,KAAK,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,GAAG,KAAK,CA6BhH;CACJ"}

package/dist/cjs/crypto/Pskc.js

@@ -37,15 +37,16 @@ const ITERATIONS = 16384;
 const PSKC_LENGTH = 16;
 var Pskc;
 ((Pskc2) => {
-  function derive(args) {
+  function derive(crypto, args) {
     const password = new TextEncoder().encode(args.passphrase);
     if (password.length < PASSPHRASE_MIN_BYTES || password.length > PASSPHRASE_MAX_BYTES) {
       throw new import_general.ImplementationError(
         `passphrase UTF-8 length must be ${PASSPHRASE_MIN_BYTES}..${PASSPHRASE_MAX_BYTES} bytes, got ${password.length}`
       );
     }
-    if (args.extPanId.length !== EXT_PAN_ID_LENGTH) {
-      throw new import_general.ImplementationError(`extPanId must be ${EXT_PAN_ID_LENGTH} bytes, got ${args.extPanId.length}`);
+    const extPanId = import_general.Bytes.of(args.extPanId);
+    if (extPanId.length !== EXT_PAN_ID_LENGTH) {
+      throw new import_general.ImplementationError(`extPanId must be ${EXT_PAN_ID_LENGTH} bytes, got ${extPanId.length}`);
     }
     const networkNameBytes = new TextEncoder().encode(args.networkName);
     if (networkNameBytes.length === 0 || networkNameBytes.length > NETWORK_NAME_MAX_BYTES) {
@@ -55,9 +56,9 @@ var Pskc;
     }
     const salt = new Uint8Array(SALT_PREFIX.length + EXT_PAN_ID_LENGTH + networkNameBytes.length);
     salt.set(SALT_PREFIX, 0);
-    salt.set(args.extPanId, SALT_PREFIX.length);
+    salt.set(extPanId, SALT_PREFIX.length);
     salt.set(networkNameBytes, SALT_PREFIX.length + EXT_PAN_ID_LENGTH);
-    return (0, import_Pbkdf2AesCmac.pbkdf2AesCmac)({
+    return (0, import_Pbkdf2AesCmac.pbkdf2AesCmac)(crypto, {
       password,
       salt,
       iterations: ITERATIONS,

package/dist/cjs/crypto/Pskc.js.map

@@ -1,6 +1,6 @@
 {
   "version": 3,
   "sources": ["../../../src/crypto/Pskc.ts"],
-  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,qBAAoC;AACpC,2BAA8B;AAP9B;AAAA;AAAA;AAAA;AAAA;AASA,MAAM,cAAc,IAAI,YAAY,EAAE,OAAO,QAAQ;AACrD,MAAM,oBAAoB;AAC1B,MAAM,yBAAyB;AAC/B,MAAM,uBAAuB;AAC7B,MAAM,uBAAuB;AAE7B,MAAM,aAAa;AACnB,MAAM,cAAc;AAUb,IAAU;AAAA,CAAV,CAAUA,UAAV;AACI,WAAS,OAAO,MAAqF;AACxG,UAAM,WAAW,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU;AACzD,QAAI,SAAS,SAAS,wBAAwB,SAAS,SAAS,sBAAsB;AAClF,YAAM,IAAI;AAAA,QACN,mCAAmC,oBAAoB,KAAK,oBAAoB,eAAe,SAAS,MAAM;AAAA,MAClH;AAAA,IACJ;AACA,QAAI,KAAK,SAAS,WAAW,mBAAmB;AAC5C,YAAM,IAAI,mCAAoB,oBAAoB,iBAAiB,eAAe,KAAK,SAAS,MAAM,EAAE;AAAA,IAC5G;AACA,UAAM,mBAAmB,IAAI,YAAY,EAAE,OAAO,KAAK,WAAW;AAClE,QAAI,iBAAiB,WAAW,KAAK,iBAAiB,SAAS,wBAAwB;AACnF,YAAM,IAAI;AAAA,QACN,uCAAuC,sBAAsB,eAAe,iBAAiB,MAAM;AAAA,MACvG;AAAA,IACJ;AAEA,UAAM,OAAO,IAAI,WAAW,YAAY,SAAS,oBAAoB,iBAAiB,MAAM;AAC5F,SAAK,IAAI,aAAa,CAAC;AACvB,SAAK,IAAI,KAAK,UAAU,YAAY,MAAM;AAC1C,SAAK,IAAI,kBAAkB,YAAY,SAAS,iBAAiB;AAEjE,eAAO,oCAAc;AAAA,MACjB;AAAA,MACA;AAAA,MACA,YAAY;AAAA,MACZ,OAAO;AAAA,IACX,CAAC;AAAA,EACL;AA5BO,EAAAA,MAAS;AAAA,GADH;",
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,qBAAmD;AACnD,2BAA8B;AAP9B;AAAA;AAAA;AAAA;AAAA;AASA,MAAM,cAAc,IAAI,YAAY,EAAE,OAAO,QAAQ;AACrD,MAAM,oBAAoB;AAC1B,MAAM,yBAAyB;AAC/B,MAAM,uBAAuB;AAC7B,MAAM,uBAAuB;AAE7B,MAAM,aAAa;AACnB,MAAM,cAAc;AAUb,IAAU;AAAA,CAAV,CAAUA,UAAV;AACI,WAAS,OAAO,QAAgB,MAA2E;AAC9G,UAAM,WAAW,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU;AACzD,QAAI,SAAS,SAAS,wBAAwB,SAAS,SAAS,sBAAsB;AAClF,YAAM,IAAI;AAAA,QACN,mCAAmC,oBAAoB,KAAK,oBAAoB,eAAe,SAAS,MAAM;AAAA,MAClH;AAAA,IACJ;AACA,UAAM,WAAW,qBAAM,GAAG,KAAK,QAAQ;AACvC,QAAI,SAAS,WAAW,mBAAmB;AACvC,YAAM,IAAI,mCAAoB,oBAAoB,iBAAiB,eAAe,SAAS,MAAM,EAAE;AAAA,IACvG;AACA,UAAM,mBAAmB,IAAI,YAAY,EAAE,OAAO,KAAK,WAAW;AAClE,QAAI,iBAAiB,WAAW,KAAK,iBAAiB,SAAS,wBAAwB;AACnF,YAAM,IAAI;AAAA,QACN,uCAAuC,sBAAsB,eAAe,iBAAiB,MAAM;AAAA,MACvG;AAAA,IACJ;AAEA,UAAM,OAAO,IAAI,WAAW,YAAY,SAAS,oBAAoB,iBAAiB,MAAM;AAC5F,SAAK,IAAI,aAAa,CAAC;AACvB,SAAK,IAAI,UAAU,YAAY,MAAM;AACrC,SAAK,IAAI,kBAAkB,YAAY,SAAS,iBAAiB;AAEjE,eAAO,oCAAc,QAAQ;AAAA,MACzB;AAAA,MACA;AAAA,MACA,YAAY;AAAA,MACZ,OAAO;AAAA,IACX,CAAC;AAAA,EACL;AA7BO,EAAAA,MAAS;AAAA,GADH;",
   "names": ["Pskc"]
 }

package/dist/cjs/crypto/index.d.ts

@@ -3,7 +3,7 @@
  * Copyright 2022-2026 Matter.js Authors
  * SPDX-License-Identifier: Apache-2.0
  */
-export { AesCmac, AesCmacPrf128 } from "./AesCmacPrf128.js";
+export { AesCmacPrf128 } from "./AesCmacPrf128.js";
 export { pbkdf2AesCmac } from "./Pbkdf2AesCmac.js";
 export { Pskc } from "./Pskc.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/cjs/crypto/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/crypto/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/crypto/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC"}

package/dist/cjs/crypto/index.js

@@ -18,7 +18,6 @@ var __copyProps = (to, from, except, desc) => {
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var crypto_exports = {};
 __export(crypto_exports, {
-  AesCmac: () => import_AesCmacPrf128.AesCmac,
   AesCmacPrf128: () => import_AesCmacPrf128.AesCmacPrf128,
   Pskc: () => import_Pskc.Pskc,
   pbkdf2AesCmac: () => import_Pbkdf2AesCmac.pbkdf2AesCmac

package/dist/cjs/crypto/index.js.map

@@ -1,6 +1,6 @@
 {
   "version": 3,
   "sources": ["../../../src/crypto/index.ts"],
-  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,2BAAuC;AACvC,2BAA8B;AAC9B,kBAAqB;AARrB;AAAA;AAAA;AAAA;AAAA;",
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,2BAA8B;AAC9B,2BAA8B;AAC9B,kBAAqB;AARrB;AAAA;AAAA;AAAA;AAAA;",
   "names": []
 }

package/dist/cjs/dataset/OperationalDataset.d.ts

@@ -21,21 +21,21 @@ export { ThreadDatasetError } from "./errors.js";
 export interface OperationalDataset {
     channel?: number;
     panId?: number;
-    extPanId?: Uint8Array;
+    extPanId?: Bytes;
     networkName?: string;
-    pskc?: Uint8Array;
-    networkKey?: Uint8Array;
-    meshLocalPrefix?: Uint8Array;
+    pskc?: Bytes;
+    networkKey?: Bytes;
+    meshLocalPrefix?: Bytes;
     securityPolicy?: SecurityPolicy;
-    activeTimestamp?: Uint8Array;
-    pendingTimestamp?: Uint8Array;
+    activeTimestamp?: Bytes;
+    pendingTimestamp?: Bytes;
     delayTimer?: number;
-    channelMask?: Uint8Array;
+    channelMask?: Bytes;
     unknownTlvs: Array<{
         type: number;
-        value: Uint8Array;
+        value: Bytes;
     }>;
-    raw: Uint8Array;
+    raw: Bytes;
 }
 export declare namespace OperationalDataset {
     /**
@@ -59,7 +59,7 @@ export declare namespace OperationalDataset {
      * @param ds - Dataset to encode; may be a decoded or manually constructed object.
      * @returns MeshCoP TLV byte sequence.
      */
-    function encode(ds: OperationalDataset): Uint8Array;
+    function encode(ds: OperationalDataset): Bytes;
     /**
      * Return a copy of the dataset with `pskc` and `networkKey` cleared.
      *

package/dist/cjs/dataset/OperationalDataset.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OperationalDataset.d.ts","sourceRoot":"","sources":["../../../src/dataset/OperationalDataset.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAIxC,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEjD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,kBAAkB;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,UAAU,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,eAAe,CAAC,EAAE,UAAU,CAAC;IAC7B,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,eAAe,CAAC,EAAE,UAAU,CAAC;IAC7B,gBAAgB,CAAC,EAAE,UAAU,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,UAAU,CAAC;IACzB,WAAW,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,UAAU,CAAA;KAAE,CAAC,CAAC;IACxD,GAAG,EAAE,UAAU,CAAC;CACnB;AAED,yBAAiB,kBAAkB,CAAC,CAAC;IACjC;;;;;;;OAOG;IACH,SAAgB,MAAM,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,GAAG,kBAAkB,CAgBhE;IAED;;;;;;;;;;;OAWG;IACH,SAAgB,MAAM,CAAC,EAAE,EAAE,kBAAkB,GAAG,UAAU,CAMzD;IAED;;;;;;;;OAQG;IACH,SAAgB,MAAM,CAAC,EAAE,EAAE,kBAAkB,GAAG,kBAAkB,CAEjE;CACJ"}
+{"version":3,"file":"OperationalDataset.d.ts","sourceRoot":"","sources":["../../../src/dataset/OperationalDataset.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAIxC,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEjD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,kBAAkB;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,KAAK,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,KAAK,CAAC;IACb,UAAU,CAAC,EAAE,KAAK,CAAC;IACnB,eAAe,CAAC,EAAE,KAAK,CAAC;IACxB,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,eAAe,CAAC,EAAE,KAAK,CAAC;IACxB,gBAAgB,CAAC,EAAE,KAAK,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,KAAK,CAAC;IACpB,WAAW,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,KAAK,CAAA;KAAE,CAAC,CAAC;IACnD,GAAG,EAAE,KAAK,CAAC;CACd;AAED,yBAAiB,kBAAkB,CAAC,CAAC;IACjC;;;;;;;OAOG;IACH,SAAgB,MAAM,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,GAAG,kBAAkB,CAgBhE;IAED;;;;;;;;;;;OAWG;IACH,SAAgB,MAAM,CAAC,EAAE,EAAE,kBAAkB,GAAG,KAAK,CAMpD;IAED;;;;;;;;OAQG;IACH,SAAgB,MAAM,CAAC,EAAE,EAAE,kBAAkB,GAAG,kBAAkB,CAEjE;CACJ"}

package/dist/cjs/dataset/OperationalDataset.js

@@ -39,7 +39,7 @@ var OperationalDataset;
     const blob = typeof input === "string" ? import_general.Bytes.of(import_general.Bytes.fromHex(input.replace(/\s+/g, ""))) : import_general.Bytes.of(input);
     const entries = import_BasicTlvCodec.BasicTlv.walk(blob);
     const unknownTlvs = new Array();
-    const originalTlvs = entries.map((e) => ({ type: e.type, value: e.value.slice() }));
+    const originalTlvs = entries.map((e) => ({ type: e.type, value: import_general.Bytes.of(e.value).slice() }));
     const ds = {
       unknownTlvs,
       raw: blob.slice()
@@ -56,7 +56,7 @@ var OperationalDataset;
     if (originals !== void 0) {
       return encodeWithReplay(ds, originals);
     }
-    return import_BasicTlvCodec.BasicTlv.encode(canonicalEntries(ds));
+    return import_general.Bytes.of(import_BasicTlvCodec.BasicTlv.encode(canonicalEntries(ds)));
   }
   OperationalDataset2.encode = encode;
   function redact(ds) {
@@ -66,66 +66,67 @@ var OperationalDataset;
 })(OperationalDataset || (OperationalDataset = {}));
 const ORIGINAL_TLVS = /* @__PURE__ */ new WeakMap();
 function applyKnownTlvToDataset(ds, entry, unknownTlvs) {
+  const value = import_general.Bytes.of(entry.value);
   switch (entry.type) {
     case import_meshcopTlvTypes.MeshCopTlvType.CHANNEL:
-      ds.channel = decodeChannel(entry.value);
+      ds.channel = decodeChannel(value);
       break;
     case import_meshcopTlvTypes.MeshCopTlvType.PANID:
-      if (entry.value.length !== 2) {
-        throw new import_errors.ThreadDatasetError(`PANID TLV must be 2 bytes, got ${entry.value.length}`);
+      if (value.length !== 2) {
+        throw new import_errors.ThreadDatasetError(`PANID TLV must be 2 bytes, got ${value.length}`);
       }
-      ds.panId = entry.value[0] << 8 | entry.value[1];
+      ds.panId = value[0] << 8 | value[1];
       break;
     case import_meshcopTlvTypes.MeshCopTlvType.EXTPANID:
-      if (entry.value.length !== 8) {
-        throw new import_errors.ThreadDatasetError(`EXTPANID TLV must be 8 bytes, got ${entry.value.length}`);
+      if (value.length !== 8) {
+        throw new import_errors.ThreadDatasetError(`EXTPANID TLV must be 8 bytes, got ${value.length}`);
       }
-      ds.extPanId = entry.value.slice();
+      ds.extPanId = value.slice();
       break;
     case import_meshcopTlvTypes.MeshCopTlvType.NETWORK_NAME:
-      ds.networkName = new TextDecoder("utf-8").decode(entry.value);
+      ds.networkName = new TextDecoder("utf-8").decode(value);
       break;
     case import_meshcopTlvTypes.MeshCopTlvType.PSKC:
-      ds.pskc = entry.value.slice();
+      ds.pskc = value.slice();
       break;
     case import_meshcopTlvTypes.MeshCopTlvType.NETWORK_KEY:
-      if (entry.value.length !== 16) {
-        throw new import_errors.ThreadDatasetError(`NETWORK_KEY TLV must be 16 bytes, got ${entry.value.length}`);
+      if (value.length !== 16) {
+        throw new import_errors.ThreadDatasetError(`NETWORK_KEY TLV must be 16 bytes, got ${value.length}`);
       }
-      ds.networkKey = entry.value.slice();
+      ds.networkKey = value.slice();
       break;
     case import_meshcopTlvTypes.MeshCopTlvType.MESH_LOCAL_PREFIX:
-      if (entry.value.length !== 8) {
-        throw new import_errors.ThreadDatasetError(`MESH_LOCAL_PREFIX TLV must be 8 bytes, got ${entry.value.length}`);
+      if (value.length !== 8) {
+        throw new import_errors.ThreadDatasetError(`MESH_LOCAL_PREFIX TLV must be 8 bytes, got ${value.length}`);
       }
-      ds.meshLocalPrefix = entry.value.slice();
+      ds.meshLocalPrefix = value.slice();
       break;
     case import_meshcopTlvTypes.MeshCopTlvType.SECURITY_POLICY:
-      ds.securityPolicy = import_SecurityPolicy.SecurityPolicy.decode(entry.value);
+      ds.securityPolicy = import_SecurityPolicy.SecurityPolicy.decode(value);
       break;
     case import_meshcopTlvTypes.MeshCopTlvType.ACTIVE_TIMESTAMP:
-      if (entry.value.length !== 8) {
-        throw new import_errors.ThreadDatasetError(`ACTIVE_TIMESTAMP TLV must be 8 bytes, got ${entry.value.length}`);
+      if (value.length !== 8) {
+        throw new import_errors.ThreadDatasetError(`ACTIVE_TIMESTAMP TLV must be 8 bytes, got ${value.length}`);
       }
-      ds.activeTimestamp = entry.value.slice();
+      ds.activeTimestamp = value.slice();
       break;
     case import_meshcopTlvTypes.MeshCopTlvType.PENDING_TIMESTAMP:
-      if (entry.value.length !== 8) {
-        throw new import_errors.ThreadDatasetError(`PENDING_TIMESTAMP TLV must be 8 bytes, got ${entry.value.length}`);
+      if (value.length !== 8) {
+        throw new import_errors.ThreadDatasetError(`PENDING_TIMESTAMP TLV must be 8 bytes, got ${value.length}`);
       }
-      ds.pendingTimestamp = entry.value.slice();
+      ds.pendingTimestamp = value.slice();
       break;
     case import_meshcopTlvTypes.MeshCopTlvType.DELAY_TIMER:
-      if (entry.value.length !== 4) {
-        throw new import_errors.ThreadDatasetError(`DELAY_TIMER TLV must be 4 bytes, got ${entry.value.length}`);
+      if (value.length !== 4) {
+        throw new import_errors.ThreadDatasetError(`DELAY_TIMER TLV must be 4 bytes, got ${value.length}`);
       }
-      ds.delayTimer = entry.value[0] << 24 | entry.value[1] << 16 | entry.value[2] << 8 | entry.value[3];
+      ds.delayTimer = value[0] << 24 | value[1] << 16 | value[2] << 8 | value[3];
       break;
     case import_meshcopTlvTypes.MeshCopTlvType.CHANNEL_MASK:
-      ds.channelMask = entry.value.slice();
+      ds.channelMask = value.slice();
       break;
     default:
-      unknownTlvs.push({ type: entry.type, value: entry.value.slice() });
+      unknownTlvs.push({ type: entry.type, value: value.slice() });
       break;
   }
 }
@@ -162,7 +163,7 @@ function encodeWithReplay(ds, originals) {
     if (canonical === void 0) continue;
     out.push({ type: known.type, value: canonical });
   }
-  return import_BasicTlvCodec.BasicTlv.encode(out);
+  return import_general.Bytes.of(import_BasicTlvCodec.BasicTlv.encode(out));
 }
 const EMPTY_BYTES = new Uint8Array();
 function canonicalEntries(ds) {
@@ -173,7 +174,7 @@ function canonicalEntries(ds) {
     out.push({ type: known.type, value: canonical });
   }
   for (const u of ds.unknownTlvs) {
-    out.push({ type: u.type, value: u.value.slice() });
+    out.push({ type: u.type, value: import_general.Bytes.of(u.value).slice() });
   }
   return out;
 }