@matter/thread-br-client 0.0.1 → 0.17.5-alpha.0-20260706-fd4c49e2e

package/src/dtls/handshake/ServerKeyExchangeMessage.ts

@@ -4,6 +4,7 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
+import type { Bytes } from "@matter/general";
 import { type EcJpakeKeyKP, EcJpakeRound } from "../ecjpake/EcJpakeRound.js";
 
 /**
@@ -22,7 +23,7 @@ import { type EcJpakeKeyKP, EcJpakeRound } from "../ecjpake/EcJpakeRound.js";
  */
 
 export const ServerKeyExchangeMessage = {
-    parse(body: Uint8Array): EcJpakeKeyKP {
+    parse(body: Bytes): EcJpakeKeyKP {
         // EcJpakeRound.parseRound2 already validates the 3-byte ECParameters prefix
         // and the ECJPAKEKeyKP body when `expectEcParameters` is true; deferring keeps
         // both error paths (bad prefix, bad body) consistent with round-1 parsers.

package/src/dtls/prf/HandshakeTranscript.ts

@@ -4,8 +4,7 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
-import { InternalError } from "@matter/general";
-import { createHash, type Hash } from "node:crypto";
+import { Bytes, Crypto, InternalError } from "@matter/general";
 
 const SHA256_LEN = 32;
 
@@ -26,24 +25,32 @@ const SHA256_LEN = 32;
  * Internal to `dtls/`; not re-exported from the package public API surface.
  */
 export class HandshakeTranscript {
-    #hash: Hash = createHash("sha256");
+    readonly #crypto: Crypto;
+    readonly #chunks = new Array<Uint8Array>();
+
+    constructor(crypto: Crypto) {
+        this.#crypto = crypto;
+    }
 
     /**
      * Append a handshake message in DTLS 1.2 form
      * (`type(1) || length(3) || message_seq(2) || fragment_offset(3) || fragment_length(3) || body`).
      */
-    appendHandshakeMessage(messageBytes: Uint8Array): void {
-        this.#hash.update(messageBytes);
+    appendHandshakeMessage(messageBytes: Bytes): void {
+        const bytes = Bytes.of(messageBytes);
+        if (bytes.length > 0) {
+            // Copy: the deferred digest() must not observe caller mutations after append.
+            this.#chunks.push(new Uint8Array(bytes));
+        }
     }
 
     /**
-     * Snapshot the running SHA-256 digest without disturbing the transcript so
-     * the same accumulator can compute Finished for both peers and continue
-     * absorbing later messages. Backed by `Hash.copy()` (Node.js >= 13.10).
+     * SHA-256 over the messages appended so far. Non-mutating: the buffer keeps
+     * growing, so the same transcript yields Finished for both peers and keeps
+     * absorbing later messages.
      */
-    digest(): Uint8Array {
-        const snapshot = this.#hash.copy();
-        const out = new Uint8Array(snapshot.digest());
+    async digest(): Promise<Bytes> {
+        const out = Bytes.of(await this.#crypto.computeHash(this.#chunks));
         if (out.length !== SHA256_LEN) {
             throw new InternalError(`HandshakeTranscript digest length ${out.length} != ${SHA256_LEN}`);
         }

package/src/dtls/prf/TlsPrf.ts

@@ -4,8 +4,7 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
-import { InternalError } from "@matter/general";
-import { createHmac } from "node:crypto";
+import { Bytes, Crypto, InternalError } from "@matter/general";
 
 const SHA256_LEN = 32;
 const MASTER_SECRET_LEN = 48;
@@ -17,19 +16,14 @@ const VERIFY_DATA_LEN = 12;
 
 const ASCII_ENCODER = new TextEncoder();
 
-function hmacSha256(key: Uint8Array, data: Uint8Array): Uint8Array {
-    const hmac = createHmac("sha256", key);
-    hmac.update(data);
-    return new Uint8Array(hmac.digest());
-}
-
-function expectLength(name: string, value: Uint8Array, expected: number): void {
-    if (value.length !== expected) {
-        throw new InternalError(`TlsPrf ${name} must be ${expected} bytes, got ${value.length}`);
+function expectLength(name: string, value: Bytes, expected: number): void {
+    const length = value.byteLength;
+    if (length !== expected) {
+        throw new InternalError(`TlsPrf ${name} must be ${expected} bytes, got ${length}`);
     }
 }
 
-function pSha256(secret: Uint8Array, seed: Uint8Array, outputLength: number): Uint8Array {
+async function pSha256(crypto: Crypto, secret: Bytes, seed: Bytes, outputLength: number): Promise<Uint8Array> {
     if (outputLength < 0) {
         throw new InternalError(`TlsPrf outputLength must be non-negative, got ${outputLength}`);
     }
@@ -37,19 +31,19 @@ function pSha256(secret: Uint8Array, seed: Uint8Array, outputLength: number): Ui
     if (outputLength === 0) {
         return out;
     }
-    let a = hmacSha256(secret, seed);
-    const block = new Uint8Array(SHA256_LEN + seed.length);
-    block.set(seed, SHA256_LEN);
+    const seedBytes = Bytes.of(seed);
+    let a = Bytes.of(await crypto.signHmac(secret, seedBytes));
+    const block = new Uint8Array(SHA256_LEN + seedBytes.length);
+    block.set(seedBytes, SHA256_LEN);
     let written = 0;
     while (written < outputLength) {
         block.set(a, 0);
-        const next = hmacSha256(secret, block);
-        const remaining = outputLength - written;
-        const copyLen = Math.min(SHA256_LEN, remaining);
+        const next = Bytes.of(await crypto.signHmac(secret, block));
+        const copyLen = Math.min(SHA256_LEN, outputLength - written);
         out.set(next.subarray(0, copyLen), written);
         written += copyLen;
         if (written < outputLength) {
-            a = hmacSha256(secret, a);
+            a = Bytes.of(await crypto.signHmac(secret, a));
         }
     }
     return out;
@@ -74,18 +68,22 @@ export namespace TlsPrf {
      * concatenated with the seed (no length prefix). The label is ASCII per
      * RFC 5246; we encode it as UTF-8 which coincides for ASCII-only input.
      */
-    export function compute(args: {
-        secret: Uint8Array;
-        label: string;
-        seed: Uint8Array;
-        outputLength: number;
-    }): Uint8Array {
+    export async function compute(
+        crypto: Crypto,
+        args: {
+            secret: Bytes;
+            label: string;
+            seed: Bytes;
+            outputLength: number;
+        },
+    ): Promise<Bytes> {
         const { secret, label, seed, outputLength } = args;
         const labelBytes = ASCII_ENCODER.encode(label);
-        const combined = new Uint8Array(labelBytes.length + seed.length);
+        const seedBytes = Bytes.of(seed);
+        const combined = new Uint8Array(labelBytes.length + seedBytes.length);
         combined.set(labelBytes, 0);
-        combined.set(seed, labelBytes.length);
-        return pSha256(secret, combined, outputLength);
+        combined.set(seedBytes, labelBytes.length);
+        return pSha256(crypto, secret, combined, outputLength);
     }
 
     /**
@@ -93,18 +91,26 @@ export namespace TlsPrf {
      *                      ClientHello.random || ServerHello.random)[0..47]`
      * (RFC 5246 §8.1).
      */
-    export function masterSecret(args: {
-        premasterSecret: Uint8Array;
-        clientRandom: Uint8Array;
-        serverRandom: Uint8Array;
-    }): Uint8Array {
+    export async function masterSecret(
+        crypto: Crypto,
+        args: {
+            premasterSecret: Bytes;
+            clientRandom: Bytes;
+            serverRandom: Bytes;
+        },
+    ): Promise<Bytes> {
         const { premasterSecret, clientRandom, serverRandom } = args;
         expectLength("clientRandom", clientRandom, RANDOM_LEN);
         expectLength("serverRandom", serverRandom, RANDOM_LEN);
         const seed = new Uint8Array(RANDOM_LEN * 2);
-        seed.set(clientRandom, 0);
-        seed.set(serverRandom, RANDOM_LEN);
-        return compute({ secret: premasterSecret, label: "master secret", seed, outputLength: MASTER_SECRET_LEN });
+        seed.set(Bytes.of(clientRandom), 0);
+        seed.set(Bytes.of(serverRandom), RANDOM_LEN);
+        return compute(crypto, {
+            secret: premasterSecret,
+            label: "master secret",
+            seed,
+            outputLength: MASTER_SECRET_LEN,
+        });
     }
 
     /**
@@ -112,10 +118,10 @@ export namespace TlsPrf {
      * (AEAD, no MAC keys; RFC 6655 §3, RFC 5246 §6.3).
      */
     export interface KeyBlock {
-        clientWriteKey: Uint8Array;
-        serverWriteKey: Uint8Array;
-        clientWriteIv: Uint8Array;
-        serverWriteIv: Uint8Array;
+        clientWriteKey: Bytes;
+        serverWriteKey: Bytes;
+        clientWriteIv: Bytes;
+        serverWriteIv: Bytes;
     }
 
     /**
@@ -129,19 +135,24 @@ export namespace TlsPrf {
      * `client_write_key (16) || server_write_key (16) ||
      *  client_write_IV (4)  || server_write_IV (4)`.
      */
-    export function keyBlock(args: {
-        masterSecret: Uint8Array;
-        clientRandom: Uint8Array;
-        serverRandom: Uint8Array;
-    }): KeyBlock {
+    export async function keyBlock(
+        crypto: Crypto,
+        args: {
+            masterSecret: Bytes;
+            clientRandom: Bytes;
+            serverRandom: Bytes;
+        },
+    ): Promise<KeyBlock> {
         const { masterSecret: ms, clientRandom, serverRandom } = args;
         expectLength("masterSecret", ms, MASTER_SECRET_LEN);
         expectLength("clientRandom", clientRandom, RANDOM_LEN);
         expectLength("serverRandom", serverRandom, RANDOM_LEN);
         const seed = new Uint8Array(RANDOM_LEN * 2);
-        seed.set(serverRandom, 0);
-        seed.set(clientRandom, RANDOM_LEN);
-        const block = compute({ secret: ms, label: "key expansion", seed, outputLength: KEY_BLOCK_LEN });
+        seed.set(Bytes.of(serverRandom), 0);
+        seed.set(Bytes.of(clientRandom), RANDOM_LEN);
+        const block = Bytes.of(
+            await compute(crypto, { secret: ms, label: "key expansion", seed, outputLength: KEY_BLOCK_LEN }),
+        );
         return {
             clientWriteKey: block.slice(0, KEY_LEN),
             serverWriteKey: block.slice(KEY_LEN, KEY_LEN * 2),
@@ -159,15 +170,18 @@ export namespace TlsPrf {
      * with `finished_label = "client finished"` for the client-sent Finished
      * and `"server finished"` for the server-sent one.
      */
-    export function verifyData(args: {
-        masterSecret: Uint8Array;
-        role: "client" | "server";
-        transcriptDigest: Uint8Array;
-    }): Uint8Array {
+    export async function verifyData(
+        crypto: Crypto,
+        args: {
+            masterSecret: Bytes;
+            role: "client" | "server";
+            transcriptDigest: Bytes;
+        },
+    ): Promise<Bytes> {
         const { masterSecret: ms, role, transcriptDigest } = args;
         expectLength("masterSecret", ms, MASTER_SECRET_LEN);
         expectLength("transcriptDigest", transcriptDigest, SHA256_LEN);
         const label = role === "client" ? "client finished" : "server finished";
-        return compute({ secret: ms, label, seed: transcriptDigest, outputLength: VERIFY_DATA_LEN });
+        return compute(crypto, { secret: ms, label, seed: transcriptDigest, outputLength: VERIFY_DATA_LEN });
     }
 }

package/src/dtls/record/AesCcm8.ts

@@ -4,8 +4,7 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
-import { InternalError } from "@matter/general";
-import { createCipheriv, createDecipheriv } from "node:crypto";
+import { Bytes, Crypto, InternalError } from "@matter/general";
 import { DtlsError } from "../channel/DtlsChannel.js";
 
 const KEY_LEN = 16;
@@ -15,69 +14,44 @@ const TAG_LEN = 8;
  * AES-128-CCM with an 8-octet authentication tag, the AEAD primitive used by the
  * `TLS_ECJPAKE_WITH_AES_128_CCM_8` cipher suite (RFC 6655 §3, RFC 3610).
  *
- * Wraps Node's `aes-128-ccm` with a fixed 8-byte tag length and returns
- * `ciphertext || tag` to match the wire layout expected by the DTLS record layer.
+ * Delegates to the matter.js {@link Crypto} abstraction with a fixed 8-byte tag length
+ * and returns `ciphertext || tag` to match the wire layout expected by the DTLS record layer.
  *
  * The 12-byte nonce length implies CCM L=3 (15 - 12), giving a 2^24 byte payload
  * limit per record — well above the DTLS 16 KiB record cap.
  */
 export namespace AesCcm8 {
     export interface EncryptArgs {
-        key: Uint8Array;
-        nonce: Uint8Array;
-        aad: Uint8Array;
-        plaintext: Uint8Array;
+        key: Bytes;
+        nonce: Bytes;
+        aad: Bytes;
+        plaintext: Bytes;
     }
 
     export interface DecryptArgs {
-        key: Uint8Array;
-        nonce: Uint8Array;
-        aad: Uint8Array;
-        ciphertextWithTag: Uint8Array;
+        key: Bytes;
+        nonce: Bytes;
+        aad: Bytes;
+        ciphertextWithTag: Bytes;
     }
 
-    export function encrypt({ key, nonce, aad, plaintext }: EncryptArgs): Uint8Array {
-        if (key.length !== KEY_LEN) {
-            throw new InternalError(`AES-128-CCM-8 key must be ${KEY_LEN} bytes, got ${key.length}`);
+    export async function encrypt(crypto: Crypto, { key, nonce, aad, plaintext }: EncryptArgs): Promise<Bytes> {
+        const keyBytes = Bytes.of(key);
+        if (keyBytes.length !== KEY_LEN) {
+            throw new InternalError(`AES-128-CCM-8 key must be ${KEY_LEN} bytes, got ${keyBytes.length}`);
         }
-        const cipher = createCipheriv("aes-128-ccm", key, nonce, { authTagLength: TAG_LEN });
-        cipher.setAAD(aad, { plaintextLength: plaintext.length });
-        const body = cipher.update(plaintext);
-        const tail = cipher.final();
-        const tag = cipher.getAuthTag();
-
-        const out = new Uint8Array(plaintext.length + TAG_LEN);
-        out.set(body, 0);
-        if (tail.length > 0) {
-            out.set(tail, body.length);
-        }
-        out.set(tag, plaintext.length);
-        return out;
+        return crypto.encrypt(keyBytes, plaintext, nonce, aad, TAG_LEN);
     }
 
-    export function decrypt({ key, nonce, aad, ciphertextWithTag }: DecryptArgs): Uint8Array {
-        if (key.length !== KEY_LEN) {
-            throw new InternalError(`AES-128-CCM-8 key must be ${KEY_LEN} bytes, got ${key.length}`);
+    export async function decrypt(crypto: Crypto, { key, nonce, aad, ciphertextWithTag }: DecryptArgs): Promise<Bytes> {
+        const keyBytes = Bytes.of(key);
+        if (keyBytes.length !== KEY_LEN) {
+            throw new InternalError(`AES-128-CCM-8 key must be ${KEY_LEN} bytes, got ${keyBytes.length}`);
         }
-        if (ciphertextWithTag.length < TAG_LEN) {
+        const ciphertextBytes = Bytes.of(ciphertextWithTag);
+        if (ciphertextBytes.length < TAG_LEN) {
             throw new DtlsError(`AES-128-CCM-8 input shorter than ${TAG_LEN}-byte tag`);
         }
-        const ctLen = ciphertextWithTag.length - TAG_LEN;
-        const ct = ciphertextWithTag.subarray(0, ctLen);
-        const tag = ciphertextWithTag.subarray(ctLen);
-
-        const decipher = createDecipheriv("aes-128-ccm", key, nonce, { authTagLength: TAG_LEN });
-        decipher.setAAD(aad, { plaintextLength: ctLen });
-        decipher.setAuthTag(tag);
-        const body = decipher.update(ct);
-        // CCM .final() throws on tag mismatch; bubble up unchanged.
-        const tail = decipher.final();
-
-        const out = new Uint8Array(ctLen);
-        out.set(body, 0);
-        if (tail.length > 0) {
-            out.set(tail, body.length);
-        }
-        return out;
+        return crypto.decrypt(keyBytes, ciphertextBytes, nonce, aad, TAG_LEN);
     }
 }

package/src/dtls/record/DtlsCipherState.ts

@@ -4,7 +4,7 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
-import { InternalError } from "@matter/general";
+import { Bytes, InternalError } from "@matter/general";
 import { AntiReplayWindow } from "./AntiReplayWindow.js";
 import { ContentType } from "./ContentType.js";
 import { DTLS_1_2_VERSION, type DtlsRecordCipherState } from "./DtlsRecord.js";
@@ -17,13 +17,13 @@ import { DTLS_1_2_VERSION, type DtlsRecordCipherState } from "./DtlsRecord.js";
  */
 export interface DtlsCipherStateInputs {
     /** 16-byte AES key the client uses to encrypt outbound records. */
-    clientWriteKey: Uint8Array;
+    clientWriteKey: Bytes;
     /** 16-byte AES key the server uses to encrypt outbound records. */
-    serverWriteKey: Uint8Array;
+    serverWriteKey: Bytes;
     /** 4-byte client implicit-IV salt (`client_write_IV`). */
-    clientWriteSalt: Uint8Array;
+    clientWriteSalt: Bytes;
     /** 4-byte server implicit-IV salt (`server_write_IV`). */
-    serverWriteSalt: Uint8Array;
+    serverWriteSalt: Bytes;
 }
 
 const KEY_LEN = 16;
@@ -33,11 +33,12 @@ const AAD_LEN = 13;
 const MAX_EPOCH = 0xffff;
 const MAX_SEQ = (1n << 48n) - 1n;
 
-function copyExpect(name: string, value: Uint8Array, expectedLen: number): Uint8Array {
-    if (value.length !== expectedLen) {
-        throw new InternalError(`DtlsCipherState ${name} must be ${expectedLen} bytes, got ${value.length}`);
+function copyExpect(name: string, value: Bytes, expectedLen: number): Uint8Array {
+    const bytes = Bytes.of(value);
+    if (bytes.length !== expectedLen) {
+        throw new InternalError(`DtlsCipherState ${name} must be ${expectedLen} bytes, got ${bytes.length}`);
     }
-    return new Uint8Array(value);
+    return new Uint8Array(bytes);
 }
 
 /**
@@ -144,21 +145,24 @@ export class DtlsCipherState implements DtlsRecordCipherState {
         return this.#readWindow.check(seqNum);
     }
 
-    encryptParams(): { key: Uint8Array; salt: Uint8Array } {
+    encryptParams(): { key: Bytes; salt: Bytes } {
         return this.role === "client"
             ? { key: this.#clientWriteKey, salt: this.#clientWriteSalt }
             : { key: this.#serverWriteKey, salt: this.#serverWriteSalt };
     }
 
-    decryptParams(): { key: Uint8Array; salt: Uint8Array } {
+    decryptParams(): { key: Bytes; salt: Bytes } {
         return this.role === "client"
             ? { key: this.#serverWriteKey, salt: this.#serverWriteSalt }
             : { key: this.#clientWriteKey, salt: this.#clientWriteSalt };
     }
 
-    nonceFor(salt: Uint8Array, epoch: number, seqNum: bigint): Uint8Array {
-        if (salt.length !== SALT_LEN) {
-            throw new InternalError(`DtlsCipherState nonceFor: salt must be ${SALT_LEN} bytes, got ${salt.length}`);
+    nonceFor(salt: Bytes, epoch: number, seqNum: bigint): Bytes {
+        const saltBytes = Bytes.of(salt);
+        if (saltBytes.length !== SALT_LEN) {
+            throw new InternalError(
+                `DtlsCipherState nonceFor: salt must be ${SALT_LEN} bytes, got ${saltBytes.length}`,
+            );
         }
         if (epoch < 0 || epoch > MAX_EPOCH) {
             throw new InternalError(`DtlsCipherState nonceFor: epoch ${epoch} out of range`);
@@ -167,7 +171,7 @@ export class DtlsCipherState implements DtlsRecordCipherState {
             throw new InternalError(`DtlsCipherState nonceFor: seqNum ${seqNum} out of range`);
         }
         const out = new Uint8Array(NONCE_LEN);
-        out.set(salt, 0);
+        out.set(saltBytes, 0);
         out[4] = (epoch >>> 8) & 0xff;
         out[5] = epoch & 0xff;
         for (let i = 0; i < 6; i++) {
@@ -176,7 +180,7 @@ export class DtlsCipherState implements DtlsRecordCipherState {
         return out;
     }
 
-    aadFor(type: ContentType, epoch: number, seqNum: bigint, plaintextLen: number): Uint8Array {
+    aadFor(type: ContentType, epoch: number, seqNum: bigint, plaintextLen: number): Bytes {
         if (epoch < 0 || epoch > MAX_EPOCH) {
             throw new InternalError(`DtlsCipherState aadFor: epoch ${epoch} out of range`);
         }

package/src/dtls/record/DtlsRecord.ts

@@ -4,7 +4,7 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
-import { InternalError, MatterError } from "@matter/general";
+import { Bytes, Crypto, InternalError, MatterError } from "@matter/general";
 import { DtlsError } from "../channel/DtlsChannel.js";
 import { AesCcm8 } from "./AesCcm8.js";
 import { ContentType, isContentType } from "./ContentType.js";
@@ -35,13 +35,13 @@ export const DTLS_HEADER_LEN = 13;
  */
 export interface DtlsRecordCipherState {
     /** AES key + 4-byte salt to use for outbound (encrypt) records. */
-    encryptParams(): { key: Uint8Array; salt: Uint8Array };
+    encryptParams(): { key: Bytes; salt: Bytes };
     /** AES key + 4-byte salt to use for inbound (decrypt) records. */
-    decryptParams(): { key: Uint8Array; salt: Uint8Array };
+    decryptParams(): { key: Bytes; salt: Bytes };
     /** Build the 12-byte CCM nonce: salt(4) || epoch(2) || seq(6). */
-    nonceFor(salt: Uint8Array, epoch: number, seqNum: bigint): Uint8Array;
+    nonceFor(salt: Bytes, epoch: number, seqNum: bigint): Bytes;
     /** Build the 13-byte DTLS AAD: epoch||seq(8) || type(1) || version(2) || plaintextLen(2). */
-    aadFor(type: ContentType, epoch: number, seqNum: bigint, plaintextLen: number): Uint8Array;
+    aadFor(type: ContentType, epoch: number, seqNum: bigint, plaintextLen: number): Bytes;
     /** Optional read-side replay-window check; absent on test doubles or pre-handshake states. */
     acceptIncoming?(epoch: number, seqNum: bigint): boolean;
 }
@@ -72,7 +72,7 @@ export interface DtlsRecord {
     type: ContentType;
     epoch: number;
     sequenceNumber: bigint;
-    fragment: Uint8Array;
+    fragment: Bytes;
 }
 
 const MAX_EPOCH = 0xffff;
@@ -119,7 +119,7 @@ function readUint48BE(buf: Uint8Array, offset: number): bigint {
  * decode invokes it after AEAD success and throws {@link DtlsReplayError} on rejection.
  */
 export namespace DtlsRecord {
-    export function encode(record: DtlsRecord, state?: DtlsRecordCipherState): Uint8Array {
+    export async function encode(crypto: Crypto, record: DtlsRecord, state?: DtlsRecordCipherState): Promise<Bytes> {
         if (record.epoch < 0 || record.epoch > MAX_EPOCH) {
             throw new InternalError(`DTLS epoch out of range: ${record.epoch}`);
         }
@@ -129,20 +129,21 @@ export namespace DtlsRecord {
         if (!isContentType(record.type)) {
             throw new InternalError(`DTLS unknown ContentType: ${record.type}`);
         }
+        const fragmentIn = Bytes.of(record.fragment);
 
         let fragment: Uint8Array;
         if (record.epoch === 0) {
-            if (record.fragment.length > DTLS_MAX_FRAGMENT_LEN) {
+            if (fragmentIn.length > DTLS_MAX_FRAGMENT_LEN) {
                 throw new InternalError(
-                    `DTLS plaintext fragment too large: ${record.fragment.length} > ${DTLS_MAX_FRAGMENT_LEN}`,
+                    `DTLS plaintext fragment too large: ${fragmentIn.length} > ${DTLS_MAX_FRAGMENT_LEN}`,
                 );
             }
-            fragment = record.fragment;
+            fragment = fragmentIn;
         } else {
             if (state === undefined) {
                 throw new InternalError(`DTLS encode at epoch ${record.epoch} requires cipher state`);
             }
-            const plaintextLen = record.fragment.length;
+            const plaintextLen = fragmentIn.length;
             if (plaintextLen + DTLS_AEAD_OVERHEAD > DTLS_MAX_FRAGMENT_LEN) {
                 throw new InternalError(
                     `DTLS encrypted fragment too large: ${plaintextLen + DTLS_AEAD_OVERHEAD} > ${DTLS_MAX_FRAGMENT_LEN}`,
@@ -151,7 +152,7 @@ export namespace DtlsRecord {
             const { key, salt } = state.encryptParams();
             const nonce = state.nonceFor(salt, record.epoch, record.sequenceNumber);
             const aad = state.aadFor(record.type, record.epoch, record.sequenceNumber, plaintextLen);
-            const cipherWithTag = AesCcm8.encrypt({ key, nonce, aad, plaintext: record.fragment });
+            const cipherWithTag = Bytes.of(await AesCcm8.encrypt(crypto, { key, nonce, aad, plaintext: fragmentIn }));
 
             fragment = new Uint8Array(8 + cipherWithTag.length);
             // Explicit nonce on the wire mirrors the (epoch || seq) bytes of the AAD/nonce.
@@ -177,7 +178,8 @@ export namespace DtlsRecord {
         consumed: number;
     }
 
-    export function decode(bytes: Uint8Array, state?: DtlsRecordCipherState): DecodeResult {
+    export async function decode(crypto: Crypto, input: Bytes, state?: DtlsRecordCipherState): Promise<DecodeResult> {
+        const bytes = Bytes.of(input);
         if (bytes.length < DTLS_HEADER_LEN) {
             throw new DtlsError(`DTLS record header truncated: have ${bytes.length}, need ${DTLS_HEADER_LEN}`);
         }
@@ -203,7 +205,7 @@ export namespace DtlsRecord {
             throw new DtlsError(`DTLS record truncated: header says ${length}, have ${bytes.length - DTLS_HEADER_LEN}`);
         }
 
-        let fragment: Uint8Array;
+        let fragment: Bytes;
         if (epoch === 0) {
             fragment = bytes.slice(DTLS_HEADER_LEN, total);
         } else {
@@ -233,7 +235,7 @@ export namespace DtlsRecord {
             }
             const nonce = state.nonceFor(salt, epoch, sequenceNumber);
             const aad = state.aadFor(type, epoch, sequenceNumber, plaintextLen);
-            fragment = AesCcm8.decrypt({ key, nonce, aad, ciphertextWithTag: cipherWithTag });
+            fragment = await AesCcm8.decrypt(crypto, { key, nonce, aad, ciphertextWithTag: cipherWithTag });
             // Anti-replay applies only to AEAD-protected records; epoch=0 plaintext has
             // no integrity check that a replay tracker could meaningfully gate.
             if (state.acceptIncoming !== undefined && !state.acceptIncoming(epoch, sequenceNumber)) {

package/src/otbr-rest/OtbrRestCapability.ts

@@ -4,19 +4,19 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
+import type { Bytes } from "@matter/general";
+
 /**
  * Snapshot of an OTBR REST endpoint as observed by {@link OtbrRestProbe}.
  *
  * `keyFormat` reflects the case convention the BR's REST surface uses on the
  * wire (older OTBR builds = pascal, post-2024 builds = camel). The probe
- * detects this from the presence/absence of `/api/actions` — see
- * python-otbr-api `_async_detect_case`.
+ * detects this from the key casing of the `/node` response.
  */
 export interface OtbrRestCapability {
     baseUrl: string;
     keyFormat: "camel" | "pascal";
-    apiVersion?: string;
     probedAt: number;
     networkName: string;
-    extPanId: Uint8Array;
+    extPanId: Bytes;
 }