@matter/thread-br-client 0.0.1 → 0.17.5-alpha.0-20260706-fd4c49e2e

package/dist/esm/util/meshLocalAddr.d.ts

@@ -3,25 +3,26 @@
  * Copyright 2022-2026 Matter.js Authors
  * SPDX-License-Identifier: Apache-2.0
  */
+import { Bytes } from "@matter/general";
 /**
  * Realm-local all-Thread-nodes multicast address (`ff03::1`).
  */
-export declare const ALL_THREAD_NODES_REALM_LOCAL: Uint8Array;
+export declare const ALL_THREAD_NODES_REALM_LOCAL: Bytes;
 /**
  * Realm-local all-Thread-routers multicast address (`ff03::2`). Diagnostic
  * multicast queries (`MGMT_DIAG_GET.qry`) target this group.
  */
-export declare const ALL_THREAD_ROUTERS_REALM_LOCAL: Uint8Array;
+export declare const ALL_THREAD_ROUTERS_REALM_LOCAL: Bytes;
 /**
  * Derive the mesh-local IPv6 address of a node from its RLOC16.
  *
  * Layout: `mlPrefix(8) || 0x0000 00FF FE00 || rloc16(2 BE)` — the well-known
  * Thread RLOC interface identifier with the locator in the low 16 bits.
  */
-export declare function deriveMeshLocalAddress(mlPrefix: Uint8Array, rloc16: number): Uint8Array;
+export declare function deriveMeshLocalAddress(mlPrefix: Bytes, rloc16: number): Bytes;
 /**
  * Format a 16-byte IPv6 address as colon-separated hextets with leading zeros
  * trimmed. No `::` compression — for logs, where unambiguity beats brevity.
  */
-export declare function formatIp6(addr: Uint8Array): string;
+export declare function formatIp6(input: Bytes): string;
 //# sourceMappingURL=meshLocalAddr.d.ts.map

package/dist/esm/util/meshLocalAddr.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"meshLocalAddr.d.ts","sourceRoot":"","sources":["../../../src/util/meshLocalAddr.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH;;GAEG;AACH,eAAO,MAAM,4BAA4B,EAAE,UAA6B,CAAC;AAEzE;;;GAGG;AACH,eAAO,MAAM,8BAA8B,EAAE,UAA6B,CAAC;AAE3E;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,GAAG,UAAU,CAcvF;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,CASlD"}
+{"version":3,"file":"meshLocalAddr.d.ts","sourceRoot":"","sources":["../../../src/util/meshLocalAddr.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,KAAK,EAAuB,MAAM,iBAAiB,CAAC;AAE7D;;GAEG;AACH,eAAO,MAAM,4BAA4B,EAAE,KAAwB,CAAC;AAEpE;;;GAGG;AACH,eAAO,MAAM,8BAA8B,EAAE,KAAwB,CAAC;AAEtE;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,GAAG,KAAK,CAe7E;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,CAU9C"}

package/dist/esm/util/meshLocalAddr.js

@@ -3,25 +3,27 @@
  * Copyright 2022-2026 Matter.js Authors
  * SPDX-License-Identifier: Apache-2.0
  */
-import { ImplementationError } from "@matter/general";
+import { Bytes, ImplementationError } from "@matter/general";
 const ALL_THREAD_NODES_REALM_LOCAL = realmLocal(1);
 const ALL_THREAD_ROUTERS_REALM_LOCAL = realmLocal(2);
 function deriveMeshLocalAddress(mlPrefix, rloc16) {
-  if (mlPrefix.length !== 8) {
-    throw new ImplementationError(`deriveMeshLocalAddress: mlPrefix must be 8 bytes, got ${mlPrefix.length}`);
+  const prefix = Bytes.of(mlPrefix);
+  if (prefix.length !== 8) {
+    throw new ImplementationError(`deriveMeshLocalAddress: mlPrefix must be 8 bytes, got ${prefix.length}`);
   }
   if (!Number.isInteger(rloc16) || rloc16 < 0 || rloc16 > 65535) {
     throw new ImplementationError(`deriveMeshLocalAddress: rloc16 out of range: ${rloc16}`);
   }
   const addr = new Uint8Array(16);
-  addr.set(mlPrefix, 0);
+  addr.set(prefix, 0);
   addr[11] = 255;
   addr[12] = 254;
   addr[14] = rloc16 >> 8 & 255;
   addr[15] = rloc16 & 255;
   return addr;
 }
-function formatIp6(addr) {
+function formatIp6(input) {
+  const addr = Bytes.of(input);
   if (addr.length !== 16) {
     throw new ImplementationError(`formatIp6: address must be 16 bytes, got ${addr.length}`);
   }

package/dist/esm/util/meshLocalAddr.js.map

@@ -1,6 +1,6 @@
 {
   "version": 3,
   "sources": ["../../../src/util/meshLocalAddr.ts"],
-  "mappings": "AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,SAAS,2BAA2B;AAK7B,MAAM,+BAA2C,WAAW,CAAI;AAMhE,MAAM,iCAA6C,WAAW,CAAI;AAQlE,SAAS,uBAAuB,UAAsB,QAA4B;AACrF,MAAI,SAAS,WAAW,GAAG;AACvB,UAAM,IAAI,oBAAoB,yDAAyD,SAAS,MAAM,EAAE;AAAA,EAC5G;AACA,MAAI,CAAC,OAAO,UAAU,MAAM,KAAK,SAAS,KAAK,SAAS,OAAQ;AAC5D,UAAM,IAAI,oBAAoB,gDAAgD,MAAM,EAAE;AAAA,EAC1F;AACA,QAAM,OAAO,IAAI,WAAW,EAAE;AAC9B,OAAK,IAAI,UAAU,CAAC;AACpB,OAAK,EAAE,IAAI;AACX,OAAK,EAAE,IAAI;AACX,OAAK,EAAE,IAAK,UAAU,IAAK;AAC3B,OAAK,EAAE,IAAI,SAAS;AACpB,SAAO;AACX;AAMO,SAAS,UAAU,MAA0B;AAChD,MAAI,KAAK,WAAW,IAAI;AACpB,UAAM,IAAI,oBAAoB,4CAA4C,KAAK,MAAM,EAAE;AAAA,EAC3F;AACA,QAAM,SAAS,IAAI,MAAc;AACjC,WAAS,IAAI,GAAG,IAAI,IAAI,KAAK,GAAG;AAC5B,WAAO,MAAO,KAAK,CAAC,KAAK,IAAK,KAAK,IAAI,CAAC,GAAG,SAAS,EAAE,CAAC;AAAA,EAC3D;AACA,SAAO,OAAO,KAAK,GAAG;AAC1B;AAEA,SAAS,WAAW,UAA8B;AAC9C,QAAM,OAAO,IAAI,WAAW,EAAE;AAC9B,OAAK,CAAC,IAAI;AACV,OAAK,CAAC,IAAI;AACV,OAAK,EAAE,IAAI;AACX,SAAO;AACX;",
+  "mappings": "AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,SAAS,OAAO,2BAA2B;AAKpC,MAAM,+BAAsC,WAAW,CAAI;AAM3D,MAAM,iCAAwC,WAAW,CAAI;AAQ7D,SAAS,uBAAuB,UAAiB,QAAuB;AAC3E,QAAM,SAAS,MAAM,GAAG,QAAQ;AAChC,MAAI,OAAO,WAAW,GAAG;AACrB,UAAM,IAAI,oBAAoB,yDAAyD,OAAO,MAAM,EAAE;AAAA,EAC1G;AACA,MAAI,CAAC,OAAO,UAAU,MAAM,KAAK,SAAS,KAAK,SAAS,OAAQ;AAC5D,UAAM,IAAI,oBAAoB,gDAAgD,MAAM,EAAE;AAAA,EAC1F;AACA,QAAM,OAAO,IAAI,WAAW,EAAE;AAC9B,OAAK,IAAI,QAAQ,CAAC;AAClB,OAAK,EAAE,IAAI;AACX,OAAK,EAAE,IAAI;AACX,OAAK,EAAE,IAAK,UAAU,IAAK;AAC3B,OAAK,EAAE,IAAI,SAAS;AACpB,SAAO;AACX;AAMO,SAAS,UAAU,OAAsB;AAC5C,QAAM,OAAO,MAAM,GAAG,KAAK;AAC3B,MAAI,KAAK,WAAW,IAAI;AACpB,UAAM,IAAI,oBAAoB,4CAA4C,KAAK,MAAM,EAAE;AAAA,EAC3F;AACA,QAAM,SAAS,IAAI,MAAc;AACjC,WAAS,IAAI,GAAG,IAAI,IAAI,KAAK,GAAG;AAC5B,WAAO,MAAO,KAAK,CAAC,KAAK,IAAK,KAAK,IAAI,CAAC,GAAG,SAAS,EAAE,CAAC;AAAA,EAC3D;AACA,SAAO,OAAO,KAAK,GAAG;AAC1B;AAEA,SAAS,WAAW,UAA8B;AAC9C,QAAM,OAAO,IAAI,WAAW,EAAE;AAC9B,OAAK,CAAC,IAAI;AACV,OAAK,CAAC,IAAI;AACV,OAAK,EAAE,IAAI;AACX,SAAO;AACX;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@matter/thread-br-client",
-    "version": "0.0.1",
+    "version": "0.17.5-alpha.0-20260706-fd4c49e2e",
     "description": "Thread Border Router discovery, dataset codec, and MeshCoP/OTBR diagnostics for matter.js",
     "keywords": [
         "iot",
@@ -28,12 +28,12 @@
         "coverage": "c8 matter-test esm"
     },
     "dependencies": {
-        "@matter/general": "*",
-        "@matter/protocol": "*",
+        "@matter/general": "0.17.5-alpha.0-20260706-fd4c49e2e",
+        "@matter/protocol": "0.17.5-alpha.0-20260706-fd4c49e2e",
         "@noble/curves": "^2.2.0"
     },
     "devDependencies": {
-        "@matter/testing": "*"
+        "@matter/testing": "0.17.5-alpha.0-20260706-fd4c49e2e"
     },
     "files": [
         "dist/**/*",
@@ -70,4 +70,4 @@
     "publishConfig": {
         "access": "public"
     }
-}
+}

package/src/coap/CoapClient.ts

@@ -10,6 +10,7 @@ import {
     type Duration,
     type Entropy,
     type Environment,
+    errorOf,
     ImplementationError,
     Logger,
     Millis,
@@ -19,7 +20,7 @@ import {
     Timer,
 } from "@matter/general";
 import type { DtlsChannel } from "../dtls/channel/DtlsChannel.js";
-import { CoapMessage } from "./CoapMessage.js";
+import { CoapError, CoapMessage } from "./CoapMessage.js";
 
 const logger = Logger.get("CoapClient");
 
@@ -71,14 +72,6 @@ function pathsEqual(a: string[], b: string[]): boolean {
     return true;
 }
 
-function tokenHex(token: Uint8Array): string {
-    let out = "";
-    for (const b of token) {
-        out += b.toString(16).padStart(2, "0");
-    }
-    return out;
-}
-
 export class CoapClient {
     #entropy: Entropy;
     #messageId: number;
@@ -110,7 +103,7 @@ export class CoapClient {
         type: "CON" | "NON";
         code: string;
         uriPath: string[];
-        payload?: Uint8Array;
+        payload?: Bytes;
     }): Promise<CoapMessage> {
         const messageId = this.#nextMessageId();
         const token = this.#randomToken();
@@ -152,7 +145,7 @@ export class CoapClient {
                 `CoapClient: messageId collision at ${msg.messageId} — too many concurrent CON requests`,
             );
         }
-        const reqTokenHex = tokenHex(msg.token);
+        const reqTokenHex = Bytes.toHex(msg.token);
         if (this.#pendingByToken.has(reqTokenHex)) {
             throw new ImplementationError(`CoapClient: token collision for ${reqTokenHex}`);
         }
@@ -229,7 +222,7 @@ export class CoapClient {
                     scheduleRetransmit(initialDelay);
                 })
                 .catch(err => {
-                    state.reject(err instanceof Error ? err : new Error(String(err)));
+                    state.reject(errorOf(err));
                 });
         });
     }
@@ -240,7 +233,7 @@ export class CoapClient {
             for await (const bytes of this.#channel) {
                 let msg: CoapMessage;
                 try {
-                    msg = CoapMessage.decode(Bytes.of(bytes));
+                    msg = CoapMessage.decode(bytes);
                 } catch (err) {
                     logger.debug(`CoAP inbound decode failed, dropping: ${err}`);
                     continue;
@@ -249,9 +242,9 @@ export class CoapClient {
                 await this.#dispatchInbound(msg);
             }
         } catch (err) {
-            channelError = err instanceof Error ? err : new Error(String(err));
+            channelError = errorOf(err);
         } finally {
-            const err = channelError ?? new Error("CoapClient: channel closed");
+            const err = channelError ?? new CoapError("CoapClient: channel closed");
             // Reject all outstanding requests (both maps reference the same PendingState entries).
             for (const state of this.#pendingByToken.values()) {
                 state.reject(err);
@@ -268,7 +261,7 @@ export class CoapClient {
                 // Stray ACK (duplicate or for a request we no longer track) — ignore.
                 return;
             }
-            const isEmptyAck = msg.code === "0.00" && msg.payload.length === 0;
+            const isEmptyAck = msg.code === "0.00" && msg.payload.byteLength === 0;
             if (isEmptyAck) {
                 // Separate response coming.
                 state.onEmptyAck();
@@ -282,14 +275,14 @@ export class CoapClient {
         if (msg.type === "RST") {
             const state = this.#pendingByMsgId.get(msg.messageId);
             if (state !== undefined) {
-                state.reject(new Error(`CoAP RST received for messageId=${msg.messageId}`));
+                state.reject(new CoapError(`CoAP RST received for messageId=${msg.messageId}`));
             }
             return;
         }
 
         // CON or NON. Check token first so a separate response is routed back to the
         // originating #sendCon call regardless of which Uri-Path the BR replied on.
-        const inboundTokenHex = tokenHex(msg.token);
+        const inboundTokenHex = Bytes.toHex(msg.token);
         const pending = this.#pendingByToken.get(inboundTokenHex);
         if (pending !== undefined) {
             if (msg.type === "CON") {
@@ -338,7 +331,7 @@ export class CoapClient {
         }
         if (delivered === 0) {
             logger.debug(
-                `CoAP inbound consumed by no request or listener: uri=${uri} type=${msg.type} code=${msg.code} payloadLen=${msg.payload.length}`,
+                `CoAP inbound consumed by no request or listener: uri=${uri} type=${msg.type} code=${msg.code} payloadLen=${msg.payload.byteLength}`,
             );
         }
     }
@@ -349,7 +342,7 @@ export class CoapClient {
         return id;
     }
 
-    #randomToken(): Uint8Array {
+    #randomToken(): Bytes {
         return Bytes.of(this.#entropy.randomBytes(4));
     }
 }

package/src/coap/CoapMessage.ts

@@ -12,12 +12,17 @@ export interface CoapMessage {
     type: CoapType;
     code: string;
     messageId: number;
-    token: Uint8Array;
+    token: Bytes;
     uriPath?: string[];
-    payload: Uint8Array;
+    payload: Bytes;
 }
 
-/** Thrown when a CoAP datagram cannot be decoded per RFC 7252 §3. */
+/**
+ * Thrown for CoAP-layer failures: a datagram that cannot be decoded per RFC
+ * 7252 §3, an RST response, or a clean close of the underlying channel while
+ * requests are still outstanding. A channel that fails with its own error
+ * propagates that error unchanged.
+ */
 export class CoapError extends MatterError {}
 
 const VERSION = 1;
@@ -75,8 +80,10 @@ function encodeOption(out: number[], delta: number, value: Uint8Array): void {
 }
 
 export namespace CoapMessage {
-    export function encode(msg: CoapMessage): Uint8Array {
-        const tokenLength = msg.token.length;
+    export function encode(msg: CoapMessage): Bytes {
+        const token = Bytes.of(msg.token);
+        const payload = Bytes.of(msg.payload);
+        const tokenLength = token.length;
         if (tokenLength > 8) {
             throw new CoapError(`CoAP token too long: ${tokenLength} (max 8)`);
         }
@@ -85,7 +92,7 @@ export namespace CoapMessage {
         out.push((VERSION << 6) | (TYPE_TO_BITS[msg.type] << 4) | tokenLength);
         out.push(encodeCode(msg.code));
         out.push((msg.messageId >> 8) & 0xff, msg.messageId & 0xff);
-        pushAll(out, msg.token);
+        pushAll(out, token);
 
         if (msg.uriPath !== undefined) {
             let lastOptionNumber = 0;
@@ -95,15 +102,16 @@ export namespace CoapMessage {
             }
         }
 
-        if (msg.payload.length > 0) {
+        if (payload.length > 0) {
             out.push(PAYLOAD_MARKER);
-            pushAll(out, msg.payload);
+            pushAll(out, payload);
         }
 
         return Uint8Array.from(out);
     }
 
-    export function decode(bytes: Uint8Array): CoapMessage {
+    export function decode(input: Bytes): CoapMessage {
+        const bytes = Bytes.of(input);
         if (bytes.length < 4) {
             throw new CoapError(`CoAP message too short: ${bytes.length} bytes`);
         }

package/src/commissioner/Commissioner.ts

@@ -86,7 +86,7 @@ export class Commissioner {
             payload: LeadPet.buildRequest(Commissioner.COMMISSIONER_ID),
         });
 
-        logger.debug(`[ThreadDiag] COMM_PET response code=${response.code} payloadLen=${response.payload.length}`);
+        logger.debug(`COMM_PET response code=${response.code} payloadLen=${response.payload.byteLength}`);
         const parsed = LeadPet.parseResponse(response.payload);
 
         if (parsed.state === "accept") {
@@ -162,7 +162,10 @@ export class Commissioner {
             sessionBytes[1] = sessionId & 0xff;
             const releasePayload = BasicTlv.encode([
                 { type: MeshCopTlvType.COMMISSIONER_SESSION_ID, value: sessionBytes },
-                { type: MeshCopTlvType.COMMISSIONER_ID, value: new TextEncoder().encode(Commissioner.COMMISSIONER_ID) },
+                {
+                    type: MeshCopTlvType.COMMISSIONER_ID,
+                    value: new TextEncoder().encode(Commissioner.COMMISSIONER_ID),
+                },
             ]);
             await this.#coap.request({
                 type: "CON",

package/src/commissioner/LeadKa.ts

@@ -4,7 +4,7 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
-import { MatterError } from "@matter/general";
+import { Bytes, MatterError } from "@matter/general";
 import { MeshCopTlvType } from "../dataset/meshcopTlvTypes.js";
 import { BasicTlv } from "../tlv/BasicTlvCodec.js";
 
@@ -19,7 +19,7 @@ export interface LeadKaResponse {
 const STATE_ACCEPT = 0x01;
 
 export namespace LeadKa {
-    export function buildRequest(sessionId: number): Uint8Array {
+    export function buildRequest(sessionId: number): Bytes {
         const sessionBytes = new Uint8Array(2);
         sessionBytes[0] = (sessionId >> 8) & 0xff;
         sessionBytes[1] = sessionId & 0xff;
@@ -32,11 +32,11 @@ export namespace LeadKa {
         ]);
     }
 
-    export function parseResponse(payload: Uint8Array): LeadKaResponse {
+    export function parseResponse(payload: Bytes): LeadKaResponse {
         const entries = BasicTlv.walk(payload);
         for (const entry of entries) {
             if (entry.type === MeshCopTlvType.STATE) {
-                const byte = entry.value[0];
+                const byte = Bytes.of(entry.value)[0];
                 if (byte === 0x01) return { state: "accept" };
                 if (byte === 0xff) return { state: "reject" };
                 if (byte === 0x00) return { state: "pending" };

package/src/commissioner/LeadPet.ts

@@ -15,26 +15,27 @@ export interface LeadPetResponse {
 }
 
 export namespace LeadPet {
-    export function buildRequest(commissionerId: string): Uint8Array {
+    export function buildRequest(commissionerId: string): Bytes {
         return BasicTlv.encode([
             { type: MeshCopTlvType.COMMISSIONER_ID, value: new TextEncoder().encode(commissionerId) },
         ]);
     }
 
-    export function parseResponse(payload: Uint8Array): LeadPetResponse {
+    export function parseResponse(payload: Bytes): LeadPetResponse {
         const entries = BasicTlv.walk(payload);
         let state: "accept" | "reject" | "pending" | undefined;
         let sessionId: number | undefined;
 
         for (const entry of entries) {
             if (entry.type === MeshCopTlvType.STATE) {
-                const byte = entry.value[0];
+                const byte = Bytes.of(entry.value)[0];
                 if (byte === 0x01) state = "accept";
                 else if (byte === 0xff) state = "reject";
                 else if (byte === 0x00) state = "pending";
                 else throw new CommissionerProtocolError(`LeadPet: unknown state byte ${byte}`);
             } else if (entry.type === MeshCopTlvType.COMMISSIONER_SESSION_ID) {
-                sessionId = (entry.value[0] << 8) | entry.value[1];
+                const sessionIdBytes = Bytes.of(entry.value);
+                sessionId = (sessionIdBytes[0] << 8) | sessionIdBytes[1];
             }
         }
 
@@ -42,7 +43,7 @@ export namespace LeadPet {
             const tlvSummary =
                 entries.length === 0
                     ? "none"
-                    : entries.map(e => `t=0x${e.type.toString(16)}/${e.value.length}b`).join(",");
+                    : entries.map(e => `t=0x${e.type.toString(16)}/${e.value.byteLength}b`).join(",");
             throw new CommissionerProtocolError(
                 `LeadPet: response missing STATE TLV (payload=${Bytes.toHex(payload)}, tlvs=[${tlvSummary}])`,
             );

package/src/credentials/ThreadCredentialsRegistry.ts

@@ -19,7 +19,7 @@ export class ThreadCredentialsRegistry {
     readonly #byExtPanId = new Map<string, ThreadNetworkCredentials>();
     readonly events = {
         registered: new Observable<[creds: ThreadNetworkCredentials]>(),
-        unregistered: new Observable<[extPanId: Uint8Array]>(),
+        unregistered: new Observable<[extPanId: Bytes]>(),
     };
 
     /**
@@ -62,10 +62,10 @@ export class ThreadCredentialsRegistry {
      */
     registerCredentials(creds: ThreadNetworkCredentials): void {
         const stored: ThreadNetworkCredentials = {
-            extPanId: creds.extPanId.slice(),
+            extPanId: Bytes.of(creds.extPanId).slice(),
             networkName: creds.networkName,
-            pskc: creds.pskc.slice(),
-            meshLocalPrefix: creds.meshLocalPrefix?.slice(),
+            pskc: Bytes.of(creds.pskc).slice(),
+            meshLocalPrefix: creds.meshLocalPrefix === undefined ? undefined : Bytes.of(creds.meshLocalPrefix).slice(),
             activeTimestamp: creds.activeTimestamp,
         };
         this.#byExtPanId.set(keyOf(stored.extPanId), stored);
@@ -74,15 +74,15 @@ export class ThreadCredentialsRegistry {
     }
 
     /** Remove an entry. No-op if absent. */
-    unregister(extPanId: Uint8Array): void {
+    unregister(extPanId: Bytes): void {
         const key = keyOf(extPanId);
         if (!this.#byExtPanId.has(key)) return;
         this.#byExtPanId.delete(key);
-        this.events.unregistered.emit(extPanId.slice());
+        this.events.unregistered.emit(Bytes.of(extPanId).slice());
     }
 
-    /** Lookup by extPanId. Comparison is by Uint8Array equality, not reference. */
-    getCredentials(extPanId: Uint8Array): ThreadNetworkCredentials | undefined {
+    /** Lookup by extPanId. Comparison is by byte equality, not reference. */
+    getCredentials(extPanId: Bytes): ThreadNetworkCredentials | undefined {
         return this.#byExtPanId.get(keyOf(extPanId));
     }
 
@@ -92,23 +92,24 @@ export class ThreadCredentialsRegistry {
     }
 }
 
-function keyOf(extPanId: Uint8Array): string {
+function keyOf(extPanId: Bytes): string {
     return Bytes.toHex(extPanId);
 }
 
 function snapshot(creds: ThreadNetworkCredentials): ThreadNetworkCredentials {
     return {
-        extPanId: creds.extPanId.slice(),
+        extPanId: Bytes.of(creds.extPanId).slice(),
         networkName: creds.networkName,
-        pskc: creds.pskc.slice(),
-        meshLocalPrefix: creds.meshLocalPrefix?.slice(),
+        pskc: Bytes.of(creds.pskc).slice(),
+        meshLocalPrefix: creds.meshLocalPrefix === undefined ? undefined : Bytes.of(creds.meshLocalPrefix).slice(),
         activeTimestamp: creds.activeTimestamp,
     };
 }
 
 // matter.js exposes `Bytes.fromBigInt` but no inverse `Bytes.toBigInt` yet —
 // dataset's activeTimestamp is a fixed-width 8-byte BE field so the loop is safe.
-function bytesToBigint(bytes: Uint8Array): bigint {
+function bytesToBigint(input: Bytes): bigint {
+    const bytes = Bytes.of(input);
     let result = 0n;
     for (const b of bytes) {
         result = (result << 8n) | BigInt(b);

package/src/credentials/ThreadNetworkCredentials.ts

@@ -4,6 +4,8 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
+import type { Bytes } from "@matter/general";
+
 /**
  * Credentials needed to authenticate against a Thread network's commissioner.
  *
@@ -13,14 +15,14 @@
  */
 export interface ThreadNetworkCredentials {
     /** 8-byte extended PAN ID — primary registry key. */
-    extPanId: Uint8Array;
+    extPanId: Bytes;
     /** Thread network name (UTF-8, ≤16 bytes). */
     networkName: string;
     /** 16-byte EC-JPAKE password (PSKc). Sensitive — redact when logging. */
-    pskc: Uint8Array;
+    pskc: Bytes;
     /** 8-byte mesh-local prefix, used to derive node mesh-local addresses for
      *  UDP-proxy unicast diagnostics. Absent if the dataset omits it. */
-    meshLocalPrefix?: Uint8Array;
+    meshLocalPrefix?: Bytes;
     /** Active timestamp from the dataset, used for change detection. */
     activeTimestamp?: bigint;
 }

package/src/crypto/AesCmacPrf128.ts

@@ -4,98 +4,21 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
-import { InternalError } from "@matter/general";
-import { createCipheriv } from "node:crypto";
+import { Bytes, Crypto } from "@matter/general";
 
-const BLOCK_SIZE = 16;
-const RB = 0x87;
-const ZERO_BLOCK = new Uint8Array(BLOCK_SIZE);
-
-function aesEcbEncryptBlock(key: Uint8Array, block: Uint8Array): Uint8Array {
-    const cipher = createCipheriv("aes-128-ecb", key, null);
-    cipher.setAutoPadding(false);
-    const out = cipher.update(block);
-    cipher.final();
-    return new Uint8Array(out.buffer, out.byteOffset, out.byteLength);
-}
-
-function leftShift1(input: Uint8Array): Uint8Array {
-    const out = new Uint8Array(input.length);
-    let carry = 0;
-    for (let i = input.length - 1; i >= 0; i--) {
-        const b = input[i];
-        out[i] = ((b << 1) & 0xff) | carry;
-        carry = (b & 0x80) >> 7;
-    }
-    return out;
-}
-
-function xorInto(target: Uint8Array, source: Uint8Array, offset = 0): void {
-    for (let i = 0; i < BLOCK_SIZE; i++) {
-        target[i] ^= source[offset + i];
-    }
-}
-
-function generateSubkeys(key: Uint8Array): { k1: Uint8Array; k2: Uint8Array } {
-    const l = aesEcbEncryptBlock(key, ZERO_BLOCK);
-    const k1 = leftShift1(l);
-    if ((l[0] & 0x80) !== 0) k1[BLOCK_SIZE - 1] ^= RB;
-    const k2 = leftShift1(k1);
-    if ((k1[0] & 0x80) !== 0) k2[BLOCK_SIZE - 1] ^= RB;
-    return { k1, k2 };
-}
-
-/**
- * AES-CMAC per RFC 4493.
- *
- * Block-cipher-based MAC with a 128-bit AES key and a 16-byte tag. Empty messages
- * are explicitly supported and pad to a single all-zero block XORed with K2.
- */
-export namespace AesCmac {
-    export function compute(key: Uint8Array, message: Uint8Array): Uint8Array {
-        if (key.length !== 16) {
-            throw new InternalError(`AES-CMAC key must be 16 bytes, got ${key.length}`);
-        }
-        const { k1, k2 } = generateSubkeys(key);
-
-        const numBlocks = Math.max(1, Math.ceil(message.length / BLOCK_SIZE));
-        const lastBlockComplete = message.length > 0 && message.length % BLOCK_SIZE === 0;
-
-        const lastBlock = new Uint8Array(BLOCK_SIZE);
-        const lastBlockOffset = (numBlocks - 1) * BLOCK_SIZE;
-        if (lastBlockComplete) {
-            lastBlock.set(message.subarray(lastBlockOffset, lastBlockOffset + BLOCK_SIZE));
-            xorInto(lastBlock, k1);
-        } else {
-            const remaining = message.length - lastBlockOffset;
-            lastBlock.set(message.subarray(lastBlockOffset, lastBlockOffset + remaining));
-            lastBlock[remaining] = 0x80;
-            xorInto(lastBlock, k2);
-        }
-
-        const x = new Uint8Array(BLOCK_SIZE);
-        for (let i = 0; i < numBlocks - 1; i++) {
-            xorInto(x, message, i * BLOCK_SIZE);
-            const enc = aesEcbEncryptBlock(key, x);
-            x.set(enc);
-        }
-        xorInto(x, lastBlock);
-        return aesEcbEncryptBlock(key, x);
-    }
-}
+const ZERO_BLOCK = new Uint8Array(16);
 
 /**
- * AES-CMAC-PRF-128 per RFC 4615.
- *
- * Lifts AES-CMAC into a variable-length-key PRF: a 16-byte key is used directly,
- * any other key is first compressed via CMAC under an all-zero key.
+ * AES-CMAC-PRF-128 per RFC 4615: a 16-byte key is used directly; any other length is
+ * first compressed via CMAC under an all-zero key. Built on {@link Crypto.cmac}.
  */
 export namespace AesCmacPrf128 {
-    export function compute(key: Uint8Array, message: Uint8Array): Uint8Array {
-        if (key.length === 16) {
-            return AesCmac.compute(key, message);
+    export function compute(crypto: Crypto, key: Bytes, message: Bytes): Bytes {
+        const keyBytes = Bytes.of(key);
+        if (keyBytes.length === 16) {
+            return crypto.cmac(keyBytes, message);
         }
-        const derivedKey = AesCmac.compute(ZERO_BLOCK, key);
-        return AesCmac.compute(derivedKey, message);
+        const derivedKey = crypto.cmac(ZERO_BLOCK, keyBytes);
+        return crypto.cmac(derivedKey, message);
     }
 }

package/src/crypto/Pbkdf2AesCmac.ts

@@ -4,7 +4,7 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
-import { ImplementationError } from "@matter/general";
+import { Bytes, Crypto, ImplementationError } from "@matter/general";
 import { AesCmacPrf128 } from "./AesCmacPrf128.js";
 
 const HLEN = 16;
@@ -15,13 +15,17 @@ const HLEN = 16;
  * Hand-rolled because Node's `crypto.pbkdf2` is hardwired to HMAC. The PRF here
  * always emits 16 bytes, so each output block needs one PRF call per iteration.
  */
-export function pbkdf2AesCmac(args: {
-    password: Uint8Array;
-    salt: Uint8Array;
-    iterations: number;
-    dkLen: number;
-}): Uint8Array {
-    const { password, salt, iterations, dkLen } = args;
+export function pbkdf2AesCmac(
+    crypto: Crypto,
+    args: {
+        password: Bytes;
+        salt: Bytes;
+        iterations: number;
+        dkLen: number;
+    },
+): Bytes {
+    const { password, iterations, dkLen } = args;
+    const salt = Bytes.of(args.salt);
     if (!Number.isInteger(iterations) || iterations <= 0) {
         throw new ImplementationError(`iterations must be a positive integer, got ${iterations}`);
     }
@@ -44,10 +48,10 @@ export function pbkdf2AesCmac(args: {
         saltedBlock[salt.length + 2] = (i >>> 8) & 0xff;
         saltedBlock[salt.length + 3] = i & 0xff;
 
-        let u = AesCmacPrf128.compute(password, saltedBlock);
+        let u = Bytes.of(AesCmacPrf128.compute(crypto, password, saltedBlock));
         const t = new Uint8Array(u);
         for (let j = 1; j < iterations; j++) {
-            u = AesCmacPrf128.compute(password, u);
+            u = Bytes.of(AesCmacPrf128.compute(crypto, password, u));
             for (let k = 0; k < HLEN; k++) t[k] ^= u[k];
         }
         out.set(t, (i - 1) * HLEN);