@matter/thread-br-client 0.0.1 → 0.17.5-alpha.0-20260706-fd4c49e2e

package/dist/cjs/dtls/handshake/HelloVerifyRequestMessage.js

@@ -21,6 +21,7 @@ __export(HelloVerifyRequestMessage_exports, {
   HelloVerifyRequestMessage: () => HelloVerifyRequestMessage
 });
 module.exports = __toCommonJS(HelloVerifyRequestMessage_exports);
+var import_general = require("@matter/general");
 var import_DtlsChannel = require("../channel/DtlsChannel.js");
 /**
  * @license
@@ -29,7 +30,8 @@ var import_DtlsChannel = require("../channel/DtlsChannel.js");
  */
 const MAX_COOKIE_LEN = 255;
 const HelloVerifyRequestMessage = {
-  parse(body) {
+  parse(rawBody) {
+    const body = import_general.Bytes.of(rawBody);
     if (body.length < 2 + 1) {
       throw new import_DtlsChannel.DtlsError(`HelloVerifyRequest body truncated: have ${body.length}, need >= 3`);
     }

package/dist/cjs/dtls/handshake/HelloVerifyRequestMessage.js.map

@@ -1,6 +1,6 @@
 {
   "version": 3,
   "sources": ["../../../../src/dtls/handshake/HelloVerifyRequestMessage.ts"],
-  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAuBA,yBAA0B;AAvB1B;AAAA;AAAA;AAAA;AAAA;AAyBA,MAAM,iBAAiB;AAEhB,MAAM,4BAA4B;AAAA,EACrC,MAAM,MAA0C;AAC5C,QAAI,KAAK,SAAS,IAAI,GAAG;AACrB,YAAM,IAAI,6BAAU,2CAA2C,KAAK,MAAM,aAAa;AAAA,IAC3F;AAEA,UAAM,YAAY,KAAK,CAAC;AACxB,QAAI,YAAY,gBAAgB;AAC5B,YAAM,IAAI,6BAAU,oCAAoC,SAAS,YAAY,cAAc,EAAE;AAAA,IACjG;AACA,UAAM,cAAc,IAAI,IAAI;AAC5B,QAAI,KAAK,WAAW,aAAa;AAC7B,YAAM,IAAI;AAAA,QACN,kCAAkC,KAAK,MAAM,iCAAiC,SAAS,cAAc,WAAW;AAAA,MACpH;AAAA,IACJ;AAEA,WAAO,EAAE,QAAQ,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE;AAAA,EAClD;AACJ;",
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAuBA,qBAAsB;AACtB,yBAA0B;AAxB1B;AAAA;AAAA;AAAA;AAAA;AA0BA,MAAM,iBAAiB;AAEhB,MAAM,4BAA4B;AAAA,EACrC,MAAM,SAAmC;AACrC,UAAM,OAAO,qBAAM,GAAG,OAAO;AAC7B,QAAI,KAAK,SAAS,IAAI,GAAG;AACrB,YAAM,IAAI,6BAAU,2CAA2C,KAAK,MAAM,aAAa;AAAA,IAC3F;AAEA,UAAM,YAAY,KAAK,CAAC;AACxB,QAAI,YAAY,gBAAgB;AAC5B,YAAM,IAAI,6BAAU,oCAAoC,SAAS,YAAY,cAAc,EAAE;AAAA,IACjG;AACA,UAAM,cAAc,IAAI,IAAI;AAC5B,QAAI,KAAK,WAAW,aAAa;AAC7B,YAAM,IAAI;AAAA,QACN,kCAAkC,KAAK,MAAM,iCAAiC,SAAS,cAAc,WAAW;AAAA,MACpH;AAAA,IACJ;AAEA,WAAO,EAAE,QAAQ,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE;AAAA,EAClD;AACJ;",
   "names": []
 }

package/dist/cjs/dtls/handshake/ServerHelloDoneMessage.d.ts

@@ -3,12 +3,13 @@
  * Copyright 2022-2026 Matter.js Authors
  * SPDX-License-Identifier: Apache-2.0
  */
+import { Bytes } from "@matter/general";
 /**
  * ServerHelloDone body parser (RFC 5246 §7.4.5). The body is empty; this
  * exists only so the state machine has a uniform per-message entry point and
  * a single place to fail loudly if a future BR ever sends payload bytes here.
  */
 export declare const ServerHelloDoneMessage: {
-    parse(body: Uint8Array): void;
+    parse(body: Bytes): void;
 };
 //# sourceMappingURL=ServerHelloDoneMessage.d.ts.map

package/dist/cjs/dtls/handshake/ServerHelloDoneMessage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ServerHelloDoneMessage.d.ts","sourceRoot":"","sources":["../../../../src/dtls/handshake/ServerHelloDoneMessage.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB;IAC/B,KAAK,OAAO,UAAU,GAAG,IAAI;CAKvB,CAAC"}
+{"version":3,"file":"ServerHelloDoneMessage.d.ts","sourceRoot":"","sources":["../../../../src/dtls/handshake/ServerHelloDoneMessage.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAGxC;;;;GAIG;AACH,eAAO,MAAM,sBAAsB;IAC/B,KAAK,OAAO,KAAK,GAAG,IAAI;CAMlB,CAAC"}

package/dist/cjs/dtls/handshake/ServerHelloDoneMessage.js

@@ -29,8 +29,9 @@ var import_DtlsChannel = require("../channel/DtlsChannel.js");
  */
 const ServerHelloDoneMessage = {
   parse(body) {
-    if (body.length !== 0) {
-      throw new import_DtlsChannel.DtlsError(`ServerHelloDone body must be empty, got ${body.length} bytes`);
+    const length = body.byteLength;
+    if (length !== 0) {
+      throw new import_DtlsChannel.DtlsError(`ServerHelloDone body must be empty, got ${length} bytes`);
     }
   }
 };

package/dist/cjs/dtls/handshake/ServerHelloDoneMessage.js.map

@@ -1,6 +1,6 @@
 {
   "version": 3,
   "sources": ["../../../../src/dtls/handshake/ServerHelloDoneMessage.ts"],
-  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,yBAA0B;AAN1B;AAAA;AAAA;AAAA;AAAA;AAaO,MAAM,yBAAyB;AAAA,EAClC,MAAM,MAAwB;AAC1B,QAAI,KAAK,WAAW,GAAG;AACnB,YAAM,IAAI,6BAAU,2CAA2C,KAAK,MAAM,QAAQ;AAAA,IACtF;AAAA,EACJ;AACJ;",
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAOA,yBAA0B;AAP1B;AAAA;AAAA;AAAA;AAAA;AAcO,MAAM,yBAAyB;AAAA,EAClC,MAAM,MAAmB;AACrB,UAAM,SAAS,KAAK;AACpB,QAAI,WAAW,GAAG;AACd,YAAM,IAAI,6BAAU,2CAA2C,MAAM,QAAQ;AAAA,IACjF;AAAA,EACJ;AACJ;",
   "names": []
 }

package/dist/cjs/dtls/handshake/ServerHelloMessage.d.ts

@@ -3,13 +3,14 @@
  * Copyright 2022-2026 Matter.js Authors
  * SPDX-License-Identifier: Apache-2.0
  */
+import { Bytes } from "@matter/general";
 export interface ParsedServerHello {
     /** Server's 32-byte random — feeds the TLS PRF. */
-    serverRandom: Uint8Array;
+    serverRandom: Bytes;
     /** Server's `ecjpake_kkpp` extension data (round-1 ECJPAKEKeyKPPairList). */
-    ecjpakeKkpp: Uint8Array;
+    ecjpakeKkpp: Bytes;
 }
 export declare const ServerHelloMessage: {
-    parse(body: Uint8Array): ParsedServerHello;
+    parse(rawBody: Bytes): ParsedServerHello;
 };
 //# sourceMappingURL=ServerHelloMessage.d.ts.map

package/dist/cjs/dtls/handshake/ServerHelloMessage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ServerHelloMessage.d.ts","sourceRoot":"","sources":["../../../../src/dtls/handshake/ServerHelloMessage.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAwCH,MAAM,WAAW,iBAAiB;IAC9B,mDAAmD;IACnD,YAAY,EAAE,UAAU,CAAC;IACzB,6EAA6E;IAC7E,WAAW,EAAE,UAAU,CAAC;CAC3B;AAED,eAAO,MAAM,kBAAkB;IAC3B,KAAK,OAAO,UAAU,GAAG,iBAAiB;CA4EpC,CAAC"}
+{"version":3,"file":"ServerHelloMessage.d.ts","sourceRoot":"","sources":["../../../../src/dtls/handshake/ServerHelloMessage.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAuCxC,MAAM,WAAW,iBAAiB;IAC9B,mDAAmD;IACnD,YAAY,EAAE,KAAK,CAAC;IACpB,6EAA6E;IAC7E,WAAW,EAAE,KAAK,CAAC;CACtB;AAED,eAAO,MAAM,kBAAkB;IAC3B,KAAK,UAAU,KAAK,GAAG,iBAAiB;CA6ElC,CAAC"}

package/dist/cjs/dtls/handshake/ServerHelloMessage.js

@@ -21,6 +21,7 @@ __export(ServerHelloMessage_exports, {
   ServerHelloMessage: () => ServerHelloMessage
 });
 module.exports = __toCommonJS(ServerHelloMessage_exports);
+var import_general = require("@matter/general");
 var import_DtlsChannel = require("../channel/DtlsChannel.js");
 var import_ClientHelloMessage = require("./ClientHelloMessage.js");
 /**
@@ -36,7 +37,8 @@ function readUint16BE(buf, offset) {
   return buf[offset] << 8 | buf[offset + 1];
 }
 const ServerHelloMessage = {
-  parse(body) {
+  parse(rawBody) {
+    const body = import_general.Bytes.of(rawBody);
     if (body.length < 2 + RANDOM_LEN + 1 + 2 + 1) {
       throw new import_DtlsChannel.DtlsError(`ServerHello body truncated: have ${body.length}`);
     }

package/dist/cjs/dtls/handshake/ServerHelloMessage.js.map

@@ -1,6 +1,6 @@
 {
   "version": 3,
   "sources": ["../../../../src/dtls/handshake/ServerHelloMessage.ts"],
-  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,yBAA0B;AAC1B,gCAAqF;AAPrF;AAAA;AAAA;AAAA;AAAA;AAmCA,MAAM,iBAAiB;AACvB,MAAM,iBAAiB;AACvB,MAAM,aAAa;AACnB,MAAM,mBAAmB;AAEzB,SAAS,aAAa,KAAiB,QAAwB;AAC3D,SAAQ,IAAI,MAAM,KAAK,IAAK,IAAI,SAAS,CAAC;AAC9C;AASO,MAAM,qBAAqB;AAAA,EAC9B,MAAM,MAAqC;AACvC,QAAI,KAAK,SAAS,IAAI,aAAa,IAAI,IAAI,GAAG;AAC1C,YAAM,IAAI,6BAAU,oCAAoC,KAAK,MAAM,EAAE;AAAA,IACzE;AACA,QAAI,IAAI;AACR,UAAM,QAAQ,KAAK,GAAG;AACtB,UAAM,QAAQ,KAAK,GAAG;AACtB,QAAI,UAAU,kBAAkB,UAAU,gBAAgB;AACtD,YAAM,IAAI,6BAAU,uBAAuB,MAAM,SAAS,EAAE,CAAC,IAAI,MAAM,SAAS,EAAE,CAAC,kBAAkB;AAAA,IACzG;AAEA,UAAM,eAAe,KAAK,MAAM,GAAG,IAAI,UAAU;AACjD,SAAK;AACL,UAAM,eAAe,KAAK,GAAG;AAC7B,QAAI,IAAI,eAAe,KAAK,QAAQ;AAChC,YAAM,IAAI,6BAAU,iCAAiC,YAAY,gBAAgB;AAAA,IACrF;AAEA,SAAK;AACL,QAAI,IAAI,IAAI,IAAI,KAAK,QAAQ;AACzB,YAAM,IAAI,6BAAU,8DAA8D;AAAA,IACtF;AACA,UAAM,QAAQ,aAAa,MAAM,CAAC;AAClC,SAAK;AACL,QAAI,UAAU,mEAAyC;AACnD,YAAM,IAAI;AAAA,QACN,mDAAmD,MAAM,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC;AAAA,MAC1F;AAAA,IACJ;AACA,UAAM,cAAc,KAAK,GAAG;AAC5B,QAAI,gBAAgB,kBAAkB;AAClC,YAAM,IAAI,6BAAU,yDAAyD,YAAY,SAAS,EAAE,CAAC,EAAE;AAAA,IAC3G;AAEA,QAAI;AACJ,QAAI,IAAI,KAAK,QAAQ;AACjB,UAAI,IAAI,IAAI,KAAK,QAAQ;AACrB,cAAM,IAAI,6BAAU,+CAA+C;AAAA,MACvE;AACA,YAAM,UAAU,aAAa,MAAM,CAAC;AACpC,WAAK;AACL,YAAM,UAAU,IAAI;AACpB,UAAI,UAAU,KAAK,QAAQ;AACvB,cAAM,IAAI,6BAAU,iCAAiC,OAAO,gBAAgB;AAAA,MAChF;AACA,aAAO,IAAI,SAAS;AAChB,YAAI,IAAI,IAAI,SAAS;AACjB,gBAAM,IAAI,6BAAU,uCAAuC;AAAA,QAC/D;AACA,cAAM,UAAU,aAAa,MAAM,CAAC;AACpC,aAAK;AACL,cAAM,aAAa,aAAa,MAAM,CAAC;AACvC,aAAK;AACL,YAAI,IAAI,aAAa,SAAS;AAC1B,gBAAM,IAAI,6BAAU,gCAAgC,QAAQ,SAAS,EAAE,CAAC,gBAAgB;AAAA,QAC5F;AACA,YAAI,YAAY,uDAA6B;AACzC,cAAI,gBAAgB,QAAW;AAC3B,kBAAM,IAAI,6BAAU,uDAAuD;AAAA,UAC/E;AACA,wBAAc,KAAK,MAAM,GAAG,IAAI,UAAU;AAAA,QAC9C;AACA,aAAK;AAAA,MACT;AACA,UAAI,MAAM,SAAS;AACf,cAAM,IAAI,6BAAU,yCAAyC,CAAC,cAAc,OAAO,EAAE;AAAA,MACzF;AAAA,IACJ;AACA,QAAI,MAAM,KAAK,QAAQ;AACnB,YAAM,IAAI,6BAAU,mBAAmB,KAAK,SAAS,CAAC,wCAAwC;AAAA,IAClG;AACA,QAAI,gBAAgB,QAAW;AAC3B,YAAM,IAAI,6BAAU,mEAAmE;AAAA,IAC3F;AACA,WAAO,EAAE,cAAc,YAAY;AAAA,EACvC;AACJ;",
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,qBAAsB;AACtB,yBAA0B;AAC1B,gCAAqF;AARrF;AAAA;AAAA;AAAA;AAAA;AAoCA,MAAM,iBAAiB;AACvB,MAAM,iBAAiB;AACvB,MAAM,aAAa;AACnB,MAAM,mBAAmB;AAEzB,SAAS,aAAa,KAAiB,QAAwB;AAC3D,SAAQ,IAAI,MAAM,KAAK,IAAK,IAAI,SAAS,CAAC;AAC9C;AASO,MAAM,qBAAqB;AAAA,EAC9B,MAAM,SAAmC;AACrC,UAAM,OAAO,qBAAM,GAAG,OAAO;AAC7B,QAAI,KAAK,SAAS,IAAI,aAAa,IAAI,IAAI,GAAG;AAC1C,YAAM,IAAI,6BAAU,oCAAoC,KAAK,MAAM,EAAE;AAAA,IACzE;AACA,QAAI,IAAI;AACR,UAAM,QAAQ,KAAK,GAAG;AACtB,UAAM,QAAQ,KAAK,GAAG;AACtB,QAAI,UAAU,kBAAkB,UAAU,gBAAgB;AACtD,YAAM,IAAI,6BAAU,uBAAuB,MAAM,SAAS,EAAE,CAAC,IAAI,MAAM,SAAS,EAAE,CAAC,kBAAkB;AAAA,IACzG;AAEA,UAAM,eAAe,KAAK,MAAM,GAAG,IAAI,UAAU;AACjD,SAAK;AACL,UAAM,eAAe,KAAK,GAAG;AAC7B,QAAI,IAAI,eAAe,KAAK,QAAQ;AAChC,YAAM,IAAI,6BAAU,iCAAiC,YAAY,gBAAgB;AAAA,IACrF;AAEA,SAAK;AACL,QAAI,IAAI,IAAI,IAAI,KAAK,QAAQ;AACzB,YAAM,IAAI,6BAAU,8DAA8D;AAAA,IACtF;AACA,UAAM,QAAQ,aAAa,MAAM,CAAC;AAClC,SAAK;AACL,QAAI,UAAU,mEAAyC;AACnD,YAAM,IAAI;AAAA,QACN,mDAAmD,MAAM,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC;AAAA,MAC1F;AAAA,IACJ;AACA,UAAM,cAAc,KAAK,GAAG;AAC5B,QAAI,gBAAgB,kBAAkB;AAClC,YAAM,IAAI,6BAAU,yDAAyD,YAAY,SAAS,EAAE,CAAC,EAAE;AAAA,IAC3G;AAEA,QAAI;AACJ,QAAI,IAAI,KAAK,QAAQ;AACjB,UAAI,IAAI,IAAI,KAAK,QAAQ;AACrB,cAAM,IAAI,6BAAU,+CAA+C;AAAA,MACvE;AACA,YAAM,UAAU,aAAa,MAAM,CAAC;AACpC,WAAK;AACL,YAAM,UAAU,IAAI;AACpB,UAAI,UAAU,KAAK,QAAQ;AACvB,cAAM,IAAI,6BAAU,iCAAiC,OAAO,gBAAgB;AAAA,MAChF;AACA,aAAO,IAAI,SAAS;AAChB,YAAI,IAAI,IAAI,SAAS;AACjB,gBAAM,IAAI,6BAAU,uCAAuC;AAAA,QAC/D;AACA,cAAM,UAAU,aAAa,MAAM,CAAC;AACpC,aAAK;AACL,cAAM,aAAa,aAAa,MAAM,CAAC;AACvC,aAAK;AACL,YAAI,IAAI,aAAa,SAAS;AAC1B,gBAAM,IAAI,6BAAU,gCAAgC,QAAQ,SAAS,EAAE,CAAC,gBAAgB;AAAA,QAC5F;AACA,YAAI,YAAY,uDAA6B;AACzC,cAAI,gBAAgB,QAAW;AAC3B,kBAAM,IAAI,6BAAU,uDAAuD;AAAA,UAC/E;AACA,wBAAc,KAAK,MAAM,GAAG,IAAI,UAAU;AAAA,QAC9C;AACA,aAAK;AAAA,MACT;AACA,UAAI,MAAM,SAAS;AACf,cAAM,IAAI,6BAAU,yCAAyC,CAAC,cAAc,OAAO,EAAE;AAAA,MACzF;AAAA,IACJ;AACA,QAAI,MAAM,KAAK,QAAQ;AACnB,YAAM,IAAI,6BAAU,mBAAmB,KAAK,SAAS,CAAC,wCAAwC;AAAA,IAClG;AACA,QAAI,gBAAgB,QAAW;AAC3B,YAAM,IAAI,6BAAU,mEAAmE;AAAA,IAC3F;AACA,WAAO,EAAE,cAAc,YAAY;AAAA,EACvC;AACJ;",
   "names": []
 }

package/dist/cjs/dtls/handshake/ServerKeyExchangeMessage.d.ts

@@ -3,6 +3,7 @@
  * Copyright 2022-2026 Matter.js Authors
  * SPDX-License-Identifier: Apache-2.0
  */
+import type { Bytes } from "@matter/general";
 import { type EcJpakeKeyKP } from "../ecjpake/EcJpakeRound.js";
 /**
  * ServerKeyExchange body parser for `TLS_ECJPAKE_WITH_AES_128_CCM_8`
@@ -19,6 +20,6 @@ import { type EcJpakeKeyKP } from "../ecjpake/EcJpakeRound.js";
  * with `expectEcParameters: false`.
  */
 export declare const ServerKeyExchangeMessage: {
-    parse(body: Uint8Array): EcJpakeKeyKP;
+    parse(body: Bytes): EcJpakeKeyKP;
 };
 //# sourceMappingURL=ServerKeyExchangeMessage.d.ts.map

package/dist/cjs/dtls/handshake/ServerKeyExchangeMessage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ServerKeyExchangeMessage.d.ts","sourceRoot":"","sources":["../../../../src/dtls/handshake/ServerKeyExchangeMessage.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,KAAK,YAAY,EAAgB,MAAM,4BAA4B,CAAC;AAE7E;;;;;;;;;;;;;GAaG;AAEH,eAAO,MAAM,wBAAwB;IACjC,KAAK,OAAO,UAAU,GAAG,YAAY;CAM/B,CAAC"}
+{"version":3,"file":"ServerKeyExchangeMessage.d.ts","sourceRoot":"","sources":["../../../../src/dtls/handshake/ServerKeyExchangeMessage.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,KAAK,YAAY,EAAgB,MAAM,4BAA4B,CAAC;AAE7E;;;;;;;;;;;;;GAaG;AAEH,eAAO,MAAM,wBAAwB;IACjC,KAAK,OAAO,KAAK,GAAG,YAAY;CAM1B,CAAC"}

package/dist/cjs/dtls/handshake/ServerKeyExchangeMessage.js.map

@@ -1,6 +1,6 @@
 {
   "version": 3,
   "sources": ["../../../../src/dtls/handshake/ServerKeyExchangeMessage.ts"],
-  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,0BAAgD;AANhD;AAAA;AAAA;AAAA;AAAA;AAuBO,MAAM,2BAA2B;AAAA,EACpC,MAAM,MAAgC;AAIlC,WAAO,iCAAa,YAAY,MAAM,EAAE,oBAAoB,KAAK,CAAC;AAAA,EACtE;AACJ;",
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAOA,0BAAgD;AAPhD;AAAA;AAAA;AAAA;AAAA;AAwBO,MAAM,2BAA2B;AAAA,EACpC,MAAM,MAA2B;AAI7B,WAAO,iCAAa,YAAY,MAAM,EAAE,oBAAoB,KAAK,CAAC;AAAA,EACtE;AACJ;",
   "names": []
 }

package/dist/cjs/dtls/prf/HandshakeTranscript.d.ts

@@ -3,6 +3,7 @@
  * Copyright 2022-2026 Matter.js Authors
  * SPDX-License-Identifier: Apache-2.0
  */
+import { Bytes, Crypto } from "@matter/general";
 /**
  * Running SHA-256 over the DTLS 1.2 handshake transcript that feeds the
  * Finished MAC (RFC 5246 §7.4.9). The transcript covers every handshake
@@ -21,16 +22,17 @@
  */
 export declare class HandshakeTranscript {
     #private;
+    constructor(crypto: Crypto);
     /**
      * Append a handshake message in DTLS 1.2 form
      * (`type(1) || length(3) || message_seq(2) || fragment_offset(3) || fragment_length(3) || body`).
      */
-    appendHandshakeMessage(messageBytes: Uint8Array): void;
+    appendHandshakeMessage(messageBytes: Bytes): void;
     /**
-     * Snapshot the running SHA-256 digest without disturbing the transcript so
-     * the same accumulator can compute Finished for both peers and continue
-     * absorbing later messages. Backed by `Hash.copy()` (Node.js >= 13.10).
+     * SHA-256 over the messages appended so far. Non-mutating: the buffer keeps
+     * growing, so the same transcript yields Finished for both peers and keeps
+     * absorbing later messages.
      */
-    digest(): Uint8Array;
+    digest(): Promise<Bytes>;
 }
 //# sourceMappingURL=HandshakeTranscript.d.ts.map

package/dist/cjs/dtls/prf/HandshakeTranscript.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"HandshakeTranscript.d.ts","sourceRoot":"","sources":["../../../../src/dtls/prf/HandshakeTranscript.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAOH;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,mBAAmB;;IAG5B;;;OAGG;IACH,sBAAsB,CAAC,YAAY,EAAE,UAAU,GAAG,IAAI,CAErD;IAED;;;;OAIG;IACH,MAAM,IAAI,UAAU,CAOnB;CACJ"}
+{"version":3,"file":"HandshakeTranscript.d.ts","sourceRoot":"","sources":["../../../../src/dtls/prf/HandshakeTranscript.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,EAAiB,MAAM,iBAAiB,CAAC;AAI/D;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,mBAAmB;;IAI5B,YAAY,MAAM,EAAE,MAAM,EAEzB;IAED;;;OAGG;IACH,sBAAsB,CAAC,YAAY,EAAE,KAAK,GAAG,IAAI,CAMhD;IAED;;;;OAIG;IACG,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,CAM7B;CACJ"}

package/dist/cjs/dtls/prf/HandshakeTranscript.js

@@ -22,7 +22,6 @@ __export(HandshakeTranscript_exports, {
 });
 module.exports = __toCommonJS(HandshakeTranscript_exports);
 var import_general = require("@matter/general");
-var import_node_crypto = require("node:crypto");
 /**
  * @license
  * Copyright 2022-2026 Matter.js Authors
@@ -30,22 +29,28 @@ var import_node_crypto = require("node:crypto");
  */
 const SHA256_LEN = 32;
 class HandshakeTranscript {
-  #hash = (0, import_node_crypto.createHash)("sha256");
+  #crypto;
+  #chunks = new Array();
+  constructor(crypto) {
+    this.#crypto = crypto;
+  }
   /**
    * Append a handshake message in DTLS 1.2 form
    * (`type(1) || length(3) || message_seq(2) || fragment_offset(3) || fragment_length(3) || body`).
    */
   appendHandshakeMessage(messageBytes) {
-    this.#hash.update(messageBytes);
+    const bytes = import_general.Bytes.of(messageBytes);
+    if (bytes.length > 0) {
+      this.#chunks.push(new Uint8Array(bytes));
+    }
   }
   /**
-   * Snapshot the running SHA-256 digest without disturbing the transcript so
-   * the same accumulator can compute Finished for both peers and continue
-   * absorbing later messages. Backed by `Hash.copy()` (Node.js >= 13.10).
+   * SHA-256 over the messages appended so far. Non-mutating: the buffer keeps
+   * growing, so the same transcript yields Finished for both peers and keeps
+   * absorbing later messages.
    */
-  digest() {
-    const snapshot = this.#hash.copy();
-    const out = new Uint8Array(snapshot.digest());
+  async digest() {
+    const out = import_general.Bytes.of(await this.#crypto.computeHash(this.#chunks));
     if (out.length !== SHA256_LEN) {
       throw new import_general.InternalError(`HandshakeTranscript digest length ${out.length} != ${SHA256_LEN}`);
     }

package/dist/cjs/dtls/prf/HandshakeTranscript.js.map

@@ -1,6 +1,6 @@
 {
   "version": 3,
   "sources": ["../../../../src/dtls/prf/HandshakeTranscript.ts"],
-  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,qBAA8B;AAC9B,yBAAsC;AAPtC;AAAA;AAAA;AAAA;AAAA;AASA,MAAM,aAAa;AAkBZ,MAAM,oBAAoB;AAAA,EAC7B,YAAc,+BAAW,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA,EAMjC,uBAAuB,cAAgC;AACnD,SAAK,MAAM,OAAO,YAAY;AAAA,EAClC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,SAAqB;AACjB,UAAM,WAAW,KAAK,MAAM,KAAK;AACjC,UAAM,MAAM,IAAI,WAAW,SAAS,OAAO,CAAC;AAC5C,QAAI,IAAI,WAAW,YAAY;AAC3B,YAAM,IAAI,6BAAc,qCAAqC,IAAI,MAAM,OAAO,UAAU,EAAE;AAAA,IAC9F;AACA,WAAO;AAAA,EACX;AACJ;",
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,qBAA6C;AAN7C;AAAA;AAAA;AAAA;AAAA;AAQA,MAAM,aAAa;AAkBZ,MAAM,oBAAoB;AAAA,EACpB;AAAA,EACA,UAAU,IAAI,MAAkB;AAAA,EAEzC,YAAY,QAAgB;AACxB,SAAK,UAAU;AAAA,EACnB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,uBAAuB,cAA2B;AAC9C,UAAM,QAAQ,qBAAM,GAAG,YAAY;AACnC,QAAI,MAAM,SAAS,GAAG;AAElB,WAAK,QAAQ,KAAK,IAAI,WAAW,KAAK,CAAC;AAAA,IAC3C;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,SAAyB;AAC3B,UAAM,MAAM,qBAAM,GAAG,MAAM,KAAK,QAAQ,YAAY,KAAK,OAAO,CAAC;AACjE,QAAI,IAAI,WAAW,YAAY;AAC3B,YAAM,IAAI,6BAAc,qCAAqC,IAAI,MAAM,OAAO,UAAU,EAAE;AAAA,IAC9F;AACA,WAAO;AAAA,EACX;AACJ;",
   "names": []
 }

package/dist/cjs/dtls/prf/TlsPrf.d.ts

@@ -3,6 +3,7 @@
  * Copyright 2022-2026 Matter.js Authors
  * SPDX-License-Identifier: Apache-2.0
  */
+import { Bytes, Crypto } from "@matter/general";
 /**
  * TLS 1.2 pseudo-random function (RFC 5246 §5) using HMAC-SHA256 — the only PRF
  * permitted for `TLS_ECJPAKE_WITH_AES_128_CCM_8` (RFC 6655 §3). Mirrors mbedTLS
@@ -22,31 +23,31 @@ export declare namespace TlsPrf {
      * concatenated with the seed (no length prefix). The label is ASCII per
      * RFC 5246; we encode it as UTF-8 which coincides for ASCII-only input.
      */
-    function compute(args: {
-        secret: Uint8Array;
+    function compute(crypto: Crypto, args: {
+        secret: Bytes;
         label: string;
-        seed: Uint8Array;
+        seed: Bytes;
         outputLength: number;
-    }): Uint8Array;
+    }): Promise<Bytes>;
     /**
      * `master_secret = PRF(pre_master_secret, "master secret",
      *                      ClientHello.random || ServerHello.random)[0..47]`
      * (RFC 5246 §8.1).
      */
-    function masterSecret(args: {
-        premasterSecret: Uint8Array;
-        clientRandom: Uint8Array;
-        serverRandom: Uint8Array;
-    }): Uint8Array;
+    function masterSecret(crypto: Crypto, args: {
+        premasterSecret: Bytes;
+        clientRandom: Bytes;
+        serverRandom: Bytes;
+    }): Promise<Bytes>;
     /**
      * Slices of the 40-byte key block for `TLS_ECJPAKE_WITH_AES_128_CCM_8`
      * (AEAD, no MAC keys; RFC 6655 §3, RFC 5246 §6.3).
      */
     interface KeyBlock {
-        clientWriteKey: Uint8Array;
-        serverWriteKey: Uint8Array;
-        clientWriteIv: Uint8Array;
-        serverWriteIv: Uint8Array;
+        clientWriteKey: Bytes;
+        serverWriteKey: Bytes;
+        clientWriteIv: Bytes;
+        serverWriteIv: Bytes;
     }
     /**
      * `key_block = PRF(master_secret, "key expansion",
@@ -59,11 +60,11 @@ export declare namespace TlsPrf {
      * `client_write_key (16) || server_write_key (16) ||
      *  client_write_IV (4)  || server_write_IV (4)`.
      */
-    function keyBlock(args: {
-        masterSecret: Uint8Array;
-        clientRandom: Uint8Array;
-        serverRandom: Uint8Array;
-    }): KeyBlock;
+    function keyBlock(crypto: Crypto, args: {
+        masterSecret: Bytes;
+        clientRandom: Bytes;
+        serverRandom: Bytes;
+    }): Promise<KeyBlock>;
     /**
      * Finished `verify_data` (RFC 5246 §7.4.9):
      *
@@ -73,10 +74,10 @@ export declare namespace TlsPrf {
      * with `finished_label = "client finished"` for the client-sent Finished
      * and `"server finished"` for the server-sent one.
      */
-    function verifyData(args: {
-        masterSecret: Uint8Array;
+    function verifyData(crypto: Crypto, args: {
+        masterSecret: Bytes;
         role: "client" | "server";
-        transcriptDigest: Uint8Array;
-    }): Uint8Array;
+        transcriptDigest: Bytes;
+    }): Promise<Bytes>;
 }
 //# sourceMappingURL=TlsPrf.d.ts.map

package/dist/cjs/dtls/prf/TlsPrf.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"TlsPrf.d.ts","sourceRoot":"","sources":["../../../../src/dtls/prf/TlsPrf.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAqDH;;;;;;GAMG;AACH,yBAAiB,MAAM,CAAC,CAAC;IACrB;;;;;;;;;;OAUG;IACH,SAAgB,OAAO,CAAC,IAAI,EAAE;QAC1B,MAAM,EAAE,UAAU,CAAC;QACnB,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,UAAU,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;KACxB,GAAG,UAAU,CAOb;IAED;;;;OAIG;IACH,SAAgB,YAAY,CAAC,IAAI,EAAE;QAC/B,eAAe,EAAE,UAAU,CAAC;QAC5B,YAAY,EAAE,UAAU,CAAC;QACzB,YAAY,EAAE,UAAU,CAAC;KAC5B,GAAG,UAAU,CAQb;IAED;;;OAGG;IACH,UAAiB,QAAQ;QACrB,cAAc,EAAE,UAAU,CAAC;QAC3B,cAAc,EAAE,UAAU,CAAC;QAC3B,aAAa,EAAE,UAAU,CAAC;QAC1B,aAAa,EAAE,UAAU,CAAC;KAC7B;IAED;;;;;;;;;;OAUG;IACH,SAAgB,QAAQ,CAAC,IAAI,EAAE;QAC3B,YAAY,EAAE,UAAU,CAAC;QACzB,YAAY,EAAE,UAAU,CAAC;QACzB,YAAY,EAAE,UAAU,CAAC;KAC5B,GAAG,QAAQ,CAeX;IAED;;;;;;;;OAQG;IACH,SAAgB,UAAU,CAAC,IAAI,EAAE;QAC7B,YAAY,EAAE,UAAU,CAAC;QACzB,IAAI,EAAE,QAAQ,GAAG,QAAQ,CAAC;QAC1B,gBAAgB,EAAE,UAAU,CAAC;KAChC,GAAG,UAAU,CAMb;CACJ"}
+{"version":3,"file":"TlsPrf.d.ts","sourceRoot":"","sources":["../../../../src/dtls/prf/TlsPrf.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,EAAiB,MAAM,iBAAiB,CAAC;AA6C/D;;;;;;GAMG;AACH,yBAAiB,MAAM,CAAC,CAAC;IACrB;;;;;;;;;;OAUG;IACH,SAAsB,OAAO,CACzB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE;QACF,MAAM,EAAE,KAAK,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,KAAK,CAAC;QACZ,YAAY,EAAE,MAAM,CAAC;KACxB,GACF,OAAO,CAAC,KAAK,CAAC,CAQhB;IAED;;;;OAIG;IACH,SAAsB,YAAY,CAC9B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE;QACF,eAAe,EAAE,KAAK,CAAC;QACvB,YAAY,EAAE,KAAK,CAAC;QACpB,YAAY,EAAE,KAAK,CAAC;KACvB,GACF,OAAO,CAAC,KAAK,CAAC,CAahB;IAED;;;OAGG;IACH,UAAiB,QAAQ;QACrB,cAAc,EAAE,KAAK,CAAC;QACtB,cAAc,EAAE,KAAK,CAAC;QACtB,aAAa,EAAE,KAAK,CAAC;QACrB,aAAa,EAAE,KAAK,CAAC;KACxB;IAED;;;;;;;;;;OAUG;IACH,SAAsB,QAAQ,CAC1B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE;QACF,YAAY,EAAE,KAAK,CAAC;QACpB,YAAY,EAAE,KAAK,CAAC;QACpB,YAAY,EAAE,KAAK,CAAC;KACvB,GACF,OAAO,CAAC,QAAQ,CAAC,CAiBnB;IAED;;;;;;;;OAQG;IACH,SAAsB,UAAU,CAC5B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE;QACF,YAAY,EAAE,KAAK,CAAC;QACpB,IAAI,EAAE,QAAQ,GAAG,QAAQ,CAAC;QAC1B,gBAAgB,EAAE,KAAK,CAAC;KAC3B,GACF,OAAO,CAAC,KAAK,CAAC,CAMhB;CACJ"}

package/dist/cjs/dtls/prf/TlsPrf.js

@@ -22,7 +22,6 @@ __export(TlsPrf_exports, {
 });
 module.exports = __toCommonJS(TlsPrf_exports);
 var import_general = require("@matter/general");
-var import_node_crypto = require("node:crypto");
 /**
  * @license
  * Copyright 2022-2026 Matter.js Authors
@@ -36,17 +35,13 @@ const IV_LEN = 4;
 const KEY_BLOCK_LEN = KEY_LEN * 2 + IV_LEN * 2;
 const VERIFY_DATA_LEN = 12;
 const ASCII_ENCODER = new TextEncoder();
-function hmacSha256(key, data) {
-  const hmac = (0, import_node_crypto.createHmac)("sha256", key);
-  hmac.update(data);
-  return new Uint8Array(hmac.digest());
-}
 function expectLength(name, value, expected) {
-  if (value.length !== expected) {
-    throw new import_general.InternalError(`TlsPrf ${name} must be ${expected} bytes, got ${value.length}`);
+  const length = value.byteLength;
+  if (length !== expected) {
+    throw new import_general.InternalError(`TlsPrf ${name} must be ${expected} bytes, got ${length}`);
   }
 }
-function pSha256(secret, seed, outputLength) {
+async function pSha256(crypto, secret, seed, outputLength) {
   if (outputLength < 0) {
     throw new import_general.InternalError(`TlsPrf outputLength must be non-negative, got ${outputLength}`);
   }
@@ -54,53 +49,61 @@ function pSha256(secret, seed, outputLength) {
   if (outputLength === 0) {
     return out;
   }
-  let a = hmacSha256(secret, seed);
-  const block = new Uint8Array(SHA256_LEN + seed.length);
-  block.set(seed, SHA256_LEN);
+  const seedBytes = import_general.Bytes.of(seed);
+  let a = import_general.Bytes.of(await crypto.signHmac(secret, seedBytes));
+  const block = new Uint8Array(SHA256_LEN + seedBytes.length);
+  block.set(seedBytes, SHA256_LEN);
   let written = 0;
   while (written < outputLength) {
     block.set(a, 0);
-    const next = hmacSha256(secret, block);
-    const remaining = outputLength - written;
-    const copyLen = Math.min(SHA256_LEN, remaining);
+    const next = import_general.Bytes.of(await crypto.signHmac(secret, block));
+    const copyLen = Math.min(SHA256_LEN, outputLength - written);
     out.set(next.subarray(0, copyLen), written);
     written += copyLen;
     if (written < outputLength) {
-      a = hmacSha256(secret, a);
+      a = import_general.Bytes.of(await crypto.signHmac(secret, a));
     }
   }
   return out;
 }
 var TlsPrf;
 ((TlsPrf2) => {
-  function compute(args) {
+  async function compute(crypto, args) {
     const { secret, label, seed, outputLength } = args;
     const labelBytes = ASCII_ENCODER.encode(label);
-    const combined = new Uint8Array(labelBytes.length + seed.length);
+    const seedBytes = import_general.Bytes.of(seed);
+    const combined = new Uint8Array(labelBytes.length + seedBytes.length);
     combined.set(labelBytes, 0);
-    combined.set(seed, labelBytes.length);
-    return pSha256(secret, combined, outputLength);
+    combined.set(seedBytes, labelBytes.length);
+    return pSha256(crypto, secret, combined, outputLength);
   }
   TlsPrf2.compute = compute;
-  function masterSecret(args) {
+  async function masterSecret(crypto, args) {
     const { premasterSecret, clientRandom, serverRandom } = args;
     expectLength("clientRandom", clientRandom, RANDOM_LEN);
     expectLength("serverRandom", serverRandom, RANDOM_LEN);
     const seed = new Uint8Array(RANDOM_LEN * 2);
-    seed.set(clientRandom, 0);
-    seed.set(serverRandom, RANDOM_LEN);
-    return compute({ secret: premasterSecret, label: "master secret", seed, outputLength: MASTER_SECRET_LEN });
+    seed.set(import_general.Bytes.of(clientRandom), 0);
+    seed.set(import_general.Bytes.of(serverRandom), RANDOM_LEN);
+    return compute(crypto, {
+      secret: premasterSecret,
+      label: "master secret",
+      seed,
+      outputLength: MASTER_SECRET_LEN
+    });
   }
   TlsPrf2.masterSecret = masterSecret;
-  function keyBlock(args) {
+  async function keyBlock(crypto, args) {
     const { masterSecret: ms, clientRandom, serverRandom } = args;
     expectLength("masterSecret", ms, MASTER_SECRET_LEN);
     expectLength("clientRandom", clientRandom, RANDOM_LEN);
     expectLength("serverRandom", serverRandom, RANDOM_LEN);
     const seed = new Uint8Array(RANDOM_LEN * 2);
-    seed.set(serverRandom, 0);
-    seed.set(clientRandom, RANDOM_LEN);
-    const block = compute({ secret: ms, label: "key expansion", seed, outputLength: KEY_BLOCK_LEN });
+    seed.set(import_general.Bytes.of(serverRandom), 0);
+    seed.set(import_general.Bytes.of(clientRandom), RANDOM_LEN);
+    const block = import_general.Bytes.of(
+      await compute(crypto, { secret: ms, label: "key expansion", seed, outputLength: KEY_BLOCK_LEN })
+    );
     return {
       clientWriteKey: block.slice(0, KEY_LEN),
       serverWriteKey: block.slice(KEY_LEN, KEY_LEN * 2),
@@ -109,12 +112,12 @@ var TlsPrf;
     };
   }
   TlsPrf2.keyBlock = keyBlock;
-  function verifyData(args) {
+  async function verifyData(crypto, args) {
     const { masterSecret: ms, role, transcriptDigest } = args;
     expectLength("masterSecret", ms, MASTER_SECRET_LEN);
     expectLength("transcriptDigest", transcriptDigest, SHA256_LEN);
     const label = role === "client" ? "client finished" : "server finished";
-    return compute({ secret: ms, label, seed: transcriptDigest, outputLength: VERIFY_DATA_LEN });
+    return compute(crypto, { secret: ms, label, seed: transcriptDigest, outputLength: VERIFY_DATA_LEN });
   }
   TlsPrf2.verifyData = verifyData;
 })(TlsPrf || (TlsPrf = {}));

package/dist/cjs/dtls/prf/TlsPrf.js.map

@@ -1,6 +1,6 @@
 {
   "version": 3,
   "sources": ["../../../../src/dtls/prf/TlsPrf.ts"],
-  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,qBAA8B;AAC9B,yBAA2B;AAP3B;AAAA;AAAA;AAAA;AAAA;AASA,MAAM,aAAa;AACnB,MAAM,oBAAoB;AAC1B,MAAM,aAAa;AACnB,MAAM,UAAU;AAChB,MAAM,SAAS;AACf,MAAM,gBAAgB,UAAU,IAAI,SAAS;AAC7C,MAAM,kBAAkB;AAExB,MAAM,gBAAgB,IAAI,YAAY;AAEtC,SAAS,WAAW,KAAiB,MAA8B;AAC/D,QAAM,WAAO,+BAAW,UAAU,GAAG;AACrC,OAAK,OAAO,IAAI;AAChB,SAAO,IAAI,WAAW,KAAK,OAAO,CAAC;AACvC;AAEA,SAAS,aAAa,MAAc,OAAmB,UAAwB;AAC3E,MAAI,MAAM,WAAW,UAAU;AAC3B,UAAM,IAAI,6BAAc,UAAU,IAAI,YAAY,QAAQ,eAAe,MAAM,MAAM,EAAE;AAAA,EAC3F;AACJ;AAEA,SAAS,QAAQ,QAAoB,MAAkB,cAAkC;AACrF,MAAI,eAAe,GAAG;AAClB,UAAM,IAAI,6BAAc,iDAAiD,YAAY,EAAE;AAAA,EAC3F;AACA,QAAM,MAAM,IAAI,WAAW,YAAY;AACvC,MAAI,iBAAiB,GAAG;AACpB,WAAO;AAAA,EACX;AACA,MAAI,IAAI,WAAW,QAAQ,IAAI;AAC/B,QAAM,QAAQ,IAAI,WAAW,aAAa,KAAK,MAAM;AACrD,QAAM,IAAI,MAAM,UAAU;AAC1B,MAAI,UAAU;AACd,SAAO,UAAU,cAAc;AAC3B,UAAM,IAAI,GAAG,CAAC;AACd,UAAM,OAAO,WAAW,QAAQ,KAAK;AACrC,UAAM,YAAY,eAAe;AACjC,UAAM,UAAU,KAAK,IAAI,YAAY,SAAS;AAC9C,QAAI,IAAI,KAAK,SAAS,GAAG,OAAO,GAAG,OAAO;AAC1C,eAAW;AACX,QAAI,UAAU,cAAc;AACxB,UAAI,WAAW,QAAQ,CAAC;AAAA,IAC5B;AAAA,EACJ;AACA,SAAO;AACX;AASO,IAAU;AAAA,CAAV,CAAUA,YAAV;AAYI,WAAS,QAAQ,MAKT;AACX,UAAM,EAAE,QAAQ,OAAO,MAAM,aAAa,IAAI;AAC9C,UAAM,aAAa,cAAc,OAAO,KAAK;AAC7C,UAAM,WAAW,IAAI,WAAW,WAAW,SAAS,KAAK,MAAM;AAC/D,aAAS,IAAI,YAAY,CAAC;AAC1B,aAAS,IAAI,MAAM,WAAW,MAAM;AACpC,WAAO,QAAQ,QAAQ,UAAU,YAAY;AAAA,EACjD;AAZO,EAAAA,QAAS;AAmBT,WAAS,aAAa,MAId;AACX,UAAM,EAAE,iBAAiB,cAAc,aAAa,IAAI;AACxD,iBAAa,gBAAgB,cAAc,UAAU;AACrD,iBAAa,gBAAgB,cAAc,UAAU;AACrD,UAAM,OAAO,IAAI,WAAW,aAAa,CAAC;AAC1C,SAAK,IAAI,cAAc,CAAC;AACxB,SAAK,IAAI,cAAc,UAAU;AACjC,WAAO,QAAQ,EAAE,QAAQ,iBAAiB,OAAO,iBAAiB,MAAM,cAAc,kBAAkB,CAAC;AAAA,EAC7G;AAZO,EAAAA,QAAS;AAoCT,WAAS,SAAS,MAIZ;AACT,UAAM,EAAE,cAAc,IAAI,cAAc,aAAa,IAAI;AACzD,iBAAa,gBAAgB,IAAI,iBAAiB;AAClD,iBAAa,gBAAgB,cAAc,UAAU;AACrD,iBAAa,gBAAgB,cAAc,UAAU;AACrD,UAAM,OAAO,IAAI,WAAW,aAAa,CAAC;AAC1C,SAAK,IAAI,cAAc,CAAC;AACxB,SAAK,IAAI,cAAc,UAAU;AACjC,UAAM,QAAQ,QAAQ,EAAE,QAAQ,IAAI,OAAO,iBAAiB,MAAM,cAAc,cAAc,CAAC;AAC/F,WAAO;AAAA,MACH,gBAAgB,MAAM,MAAM,GAAG,OAAO;AAAA,MACtC,gBAAgB,MAAM,MAAM,SAAS,UAAU,CAAC;AAAA,MAChD,eAAe,MAAM,MAAM,UAAU,GAAG,UAAU,IAAI,MAAM;AAAA,MAC5D,eAAe,MAAM,MAAM,UAAU,IAAI,QAAQ,aAAa;AAAA,IAClE;AAAA,EACJ;AAnBO,EAAAA,QAAS;AA8BT,WAAS,WAAW,MAIZ;AACX,UAAM,EAAE,cAAc,IAAI,MAAM,iBAAiB,IAAI;AACrD,iBAAa,gBAAgB,IAAI,iBAAiB;AAClD,iBAAa,oBAAoB,kBAAkB,UAAU;AAC7D,UAAM,QAAQ,SAAS,WAAW,oBAAoB;AACtD,WAAO,QAAQ,EAAE,QAAQ,IAAI,OAAO,MAAM,kBAAkB,cAAc,gBAAgB,CAAC;AAAA,EAC/F;AAVO,EAAAA,QAAS;AAAA,GAjGH;",
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,qBAA6C;AAN7C;AAAA;AAAA;AAAA;AAAA;AAQA,MAAM,aAAa;AACnB,MAAM,oBAAoB;AAC1B,MAAM,aAAa;AACnB,MAAM,UAAU;AAChB,MAAM,SAAS;AACf,MAAM,gBAAgB,UAAU,IAAI,SAAS;AAC7C,MAAM,kBAAkB;AAExB,MAAM,gBAAgB,IAAI,YAAY;AAEtC,SAAS,aAAa,MAAc,OAAc,UAAwB;AACtE,QAAM,SAAS,MAAM;AACrB,MAAI,WAAW,UAAU;AACrB,UAAM,IAAI,6BAAc,UAAU,IAAI,YAAY,QAAQ,eAAe,MAAM,EAAE;AAAA,EACrF;AACJ;AAEA,eAAe,QAAQ,QAAgB,QAAe,MAAa,cAA2C;AAC1G,MAAI,eAAe,GAAG;AAClB,UAAM,IAAI,6BAAc,iDAAiD,YAAY,EAAE;AAAA,EAC3F;AACA,QAAM,MAAM,IAAI,WAAW,YAAY;AACvC,MAAI,iBAAiB,GAAG;AACpB,WAAO;AAAA,EACX;AACA,QAAM,YAAY,qBAAM,GAAG,IAAI;AAC/B,MAAI,IAAI,qBAAM,GAAG,MAAM,OAAO,SAAS,QAAQ,SAAS,CAAC;AACzD,QAAM,QAAQ,IAAI,WAAW,aAAa,UAAU,MAAM;AAC1D,QAAM,IAAI,WAAW,UAAU;AAC/B,MAAI,UAAU;AACd,SAAO,UAAU,cAAc;AAC3B,UAAM,IAAI,GAAG,CAAC;AACd,UAAM,OAAO,qBAAM,GAAG,MAAM,OAAO,SAAS,QAAQ,KAAK,CAAC;AAC1D,UAAM,UAAU,KAAK,IAAI,YAAY,eAAe,OAAO;AAC3D,QAAI,IAAI,KAAK,SAAS,GAAG,OAAO,GAAG,OAAO;AAC1C,eAAW;AACX,QAAI,UAAU,cAAc;AACxB,UAAI,qBAAM,GAAG,MAAM,OAAO,SAAS,QAAQ,CAAC,CAAC;AAAA,IACjD;AAAA,EACJ;AACA,SAAO;AACX;AASO,IAAU;AAAA,CAAV,CAAUA,YAAV;AAYH,iBAAsB,QAClB,QACA,MAMc;AACd,UAAM,EAAE,QAAQ,OAAO,MAAM,aAAa,IAAI;AAC9C,UAAM,aAAa,cAAc,OAAO,KAAK;AAC7C,UAAM,YAAY,qBAAM,GAAG,IAAI;AAC/B,UAAM,WAAW,IAAI,WAAW,WAAW,SAAS,UAAU,MAAM;AACpE,aAAS,IAAI,YAAY,CAAC;AAC1B,aAAS,IAAI,WAAW,WAAW,MAAM;AACzC,WAAO,QAAQ,QAAQ,QAAQ,UAAU,YAAY;AAAA,EACzD;AAhBA,EAAAA,QAAsB;AAuBtB,iBAAsB,aAClB,QACA,MAKc;AACd,UAAM,EAAE,iBAAiB,cAAc,aAAa,IAAI;AACxD,iBAAa,gBAAgB,cAAc,UAAU;AACrD,iBAAa,gBAAgB,cAAc,UAAU;AACrD,UAAM,OAAO,IAAI,WAAW,aAAa,CAAC;AAC1C,SAAK,IAAI,qBAAM,GAAG,YAAY,GAAG,CAAC;AAClC,SAAK,IAAI,qBAAM,GAAG,YAAY,GAAG,UAAU;AAC3C,WAAO,QAAQ,QAAQ;AAAA,MACnB,QAAQ;AAAA,MACR,OAAO;AAAA,MACP;AAAA,MACA,cAAc;AAAA,IAClB,CAAC;AAAA,EACL;AApBA,EAAAA,QAAsB;AA4CtB,iBAAsB,SAClB,QACA,MAKiB;AACjB,UAAM,EAAE,cAAc,IAAI,cAAc,aAAa,IAAI;AACzD,iBAAa,gBAAgB,IAAI,iBAAiB;AAClD,iBAAa,gBAAgB,cAAc,UAAU;AACrD,iBAAa,gBAAgB,cAAc,UAAU;AACrD,UAAM,OAAO,IAAI,WAAW,aAAa,CAAC;AAC1C,SAAK,IAAI,qBAAM,GAAG,YAAY,GAAG,CAAC;AAClC,SAAK,IAAI,qBAAM,GAAG,YAAY,GAAG,UAAU;AAC3C,UAAM,QAAQ,qBAAM;AAAA,MAChB,MAAM,QAAQ,QAAQ,EAAE,QAAQ,IAAI,OAAO,iBAAiB,MAAM,cAAc,cAAc,CAAC;AAAA,IACnG;AACA,WAAO;AAAA,MACH,gBAAgB,MAAM,MAAM,GAAG,OAAO;AAAA,MACtC,gBAAgB,MAAM,MAAM,SAAS,UAAU,CAAC;AAAA,MAChD,eAAe,MAAM,MAAM,UAAU,GAAG,UAAU,IAAI,MAAM;AAAA,MAC5D,eAAe,MAAM,MAAM,UAAU,IAAI,QAAQ,aAAa;AAAA,IAClE;AAAA,EACJ;AAxBA,EAAAA,QAAsB;AAmCtB,iBAAsB,WAClB,QACA,MAKc;AACd,UAAM,EAAE,cAAc,IAAI,MAAM,iBAAiB,IAAI;AACrD,iBAAa,gBAAgB,IAAI,iBAAiB;AAClD,iBAAa,oBAAoB,kBAAkB,UAAU;AAC7D,UAAM,QAAQ,SAAS,WAAW,oBAAoB;AACtD,WAAO,QAAQ,QAAQ,EAAE,QAAQ,IAAI,OAAO,MAAM,kBAAkB,cAAc,gBAAgB,CAAC;AAAA,EACvG;AAbA,EAAAA,QAAsB;AAAA,GAlHT;",
   "names": ["TlsPrf"]
 }

package/dist/cjs/dtls/record/AesCcm8.d.ts

@@ -3,30 +3,31 @@
  * Copyright 2022-2026 Matter.js Authors
  * SPDX-License-Identifier: Apache-2.0
  */
+import { Bytes, Crypto } from "@matter/general";
 /**
  * AES-128-CCM with an 8-octet authentication tag, the AEAD primitive used by the
  * `TLS_ECJPAKE_WITH_AES_128_CCM_8` cipher suite (RFC 6655 §3, RFC 3610).
  *
- * Wraps Node's `aes-128-ccm` with a fixed 8-byte tag length and returns
- * `ciphertext || tag` to match the wire layout expected by the DTLS record layer.
+ * Delegates to the matter.js {@link Crypto} abstraction with a fixed 8-byte tag length
+ * and returns `ciphertext || tag` to match the wire layout expected by the DTLS record layer.
  *
  * The 12-byte nonce length implies CCM L=3 (15 - 12), giving a 2^24 byte payload
  * limit per record — well above the DTLS 16 KiB record cap.
  */
 export declare namespace AesCcm8 {
     interface EncryptArgs {
-        key: Uint8Array;
-        nonce: Uint8Array;
-        aad: Uint8Array;
-        plaintext: Uint8Array;
+        key: Bytes;
+        nonce: Bytes;
+        aad: Bytes;
+        plaintext: Bytes;
     }
     interface DecryptArgs {
-        key: Uint8Array;
-        nonce: Uint8Array;
-        aad: Uint8Array;
-        ciphertextWithTag: Uint8Array;
+        key: Bytes;
+        nonce: Bytes;
+        aad: Bytes;
+        ciphertextWithTag: Bytes;
     }
-    function encrypt({ key, nonce, aad, plaintext }: EncryptArgs): Uint8Array;
-    function decrypt({ key, nonce, aad, ciphertextWithTag }: DecryptArgs): Uint8Array;
+    function encrypt(crypto: Crypto, { key, nonce, aad, plaintext }: EncryptArgs): Promise<Bytes>;
+    function decrypt(crypto: Crypto, { key, nonce, aad, ciphertextWithTag }: DecryptArgs): Promise<Bytes>;
 }
 //# sourceMappingURL=AesCcm8.d.ts.map

package/dist/cjs/dtls/record/AesCcm8.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AesCcm8.d.ts","sourceRoot":"","sources":["../../../../src/dtls/record/AesCcm8.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AASH;;;;;;;;;GASG;AACH,yBAAiB,OAAO,CAAC,CAAC;IACtB,UAAiB,WAAW;QACxB,GAAG,EAAE,UAAU,CAAC;QAChB,KAAK,EAAE,UAAU,CAAC;QAClB,GAAG,EAAE,UAAU,CAAC;QAChB,SAAS,EAAE,UAAU,CAAC;KACzB;IAED,UAAiB,WAAW;QACxB,GAAG,EAAE,UAAU,CAAC;QAChB,KAAK,EAAE,UAAU,CAAC;QAClB,GAAG,EAAE,UAAU,CAAC;QAChB,iBAAiB,EAAE,UAAU,CAAC;KACjC;IAED,SAAgB,OAAO,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,WAAW,GAAG,UAAU,CAiB/E;IAED,SAAgB,OAAO,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,iBAAiB,EAAE,EAAE,WAAW,GAAG,UAAU,CAwBvF;CACJ"}
+{"version":3,"file":"AesCcm8.d.ts","sourceRoot":"","sources":["../../../../src/dtls/record/AesCcm8.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,EAAiB,MAAM,iBAAiB,CAAC;AAM/D;;;;;;;;;GASG;AACH,yBAAiB,OAAO,CAAC,CAAC;IACtB,UAAiB,WAAW;QACxB,GAAG,EAAE,KAAK,CAAC;QACX,KAAK,EAAE,KAAK,CAAC;QACb,GAAG,EAAE,KAAK,CAAC;QACX,SAAS,EAAE,KAAK,CAAC;KACpB;IAED,UAAiB,WAAW;QACxB,GAAG,EAAE,KAAK,CAAC;QACX,KAAK,EAAE,KAAK,CAAC;QACb,GAAG,EAAE,KAAK,CAAC;QACX,iBAAiB,EAAE,KAAK,CAAC;KAC5B;IAED,SAAsB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,CAMzG;IAED,SAAsB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,iBAAiB,EAAE,EAAE,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,CAUjH;CACJ"}

package/dist/cjs/dtls/record/AesCcm8.js

@@ -22,7 +22,6 @@ __export(AesCcm8_exports, {
 });
 module.exports = __toCommonJS(AesCcm8_exports);
 var import_general = require("@matter/general");
-var import_node_crypto = require("node:crypto");
 var import_DtlsChannel = require("../channel/DtlsChannel.js");
 /**
  * @license
@@ -33,45 +32,24 @@ const KEY_LEN = 16;
 const TAG_LEN = 8;
 var AesCcm8;
 ((AesCcm82) => {
-  function encrypt({ key, nonce, aad, plaintext }) {
-    if (key.length !== KEY_LEN) {
-      throw new import_general.InternalError(`AES-128-CCM-8 key must be ${KEY_LEN} bytes, got ${key.length}`);
+  async function encrypt(crypto, { key, nonce, aad, plaintext }) {
+    const keyBytes = import_general.Bytes.of(key);
+    if (keyBytes.length !== KEY_LEN) {
+      throw new import_general.InternalError(`AES-128-CCM-8 key must be ${KEY_LEN} bytes, got ${keyBytes.length}`);
     }
-    const cipher = (0, import_node_crypto.createCipheriv)("aes-128-ccm", key, nonce, { authTagLength: TAG_LEN });
-    cipher.setAAD(aad, { plaintextLength: plaintext.length });
-    const body = cipher.update(plaintext);
-    const tail = cipher.final();
-    const tag = cipher.getAuthTag();
-    const out = new Uint8Array(plaintext.length + TAG_LEN);
-    out.set(body, 0);
-    if (tail.length > 0) {
-      out.set(tail, body.length);
-    }
-    out.set(tag, plaintext.length);
-    return out;
+    return crypto.encrypt(keyBytes, plaintext, nonce, aad, TAG_LEN);
   }
   AesCcm82.encrypt = encrypt;
-  function decrypt({ key, nonce, aad, ciphertextWithTag }) {
-    if (key.length !== KEY_LEN) {
-      throw new import_general.InternalError(`AES-128-CCM-8 key must be ${KEY_LEN} bytes, got ${key.length}`);
+  async function decrypt(crypto, { key, nonce, aad, ciphertextWithTag }) {
+    const keyBytes = import_general.Bytes.of(key);
+    if (keyBytes.length !== KEY_LEN) {
+      throw new import_general.InternalError(`AES-128-CCM-8 key must be ${KEY_LEN} bytes, got ${keyBytes.length}`);
     }
-    if (ciphertextWithTag.length < TAG_LEN) {
+    const ciphertextBytes = import_general.Bytes.of(ciphertextWithTag);
+    if (ciphertextBytes.length < TAG_LEN) {
       throw new import_DtlsChannel.DtlsError(`AES-128-CCM-8 input shorter than ${TAG_LEN}-byte tag`);
     }
-    const ctLen = ciphertextWithTag.length - TAG_LEN;
-    const ct = ciphertextWithTag.subarray(0, ctLen);
-    const tag = ciphertextWithTag.subarray(ctLen);
-    const decipher = (0, import_node_crypto.createDecipheriv)("aes-128-ccm", key, nonce, { authTagLength: TAG_LEN });
-    decipher.setAAD(aad, { plaintextLength: ctLen });
-    decipher.setAuthTag(tag);
-    const body = decipher.update(ct);
-    const tail = decipher.final();
-    const out = new Uint8Array(ctLen);
-    out.set(body, 0);
-    if (tail.length > 0) {
-      out.set(tail, body.length);
-    }
-    return out;
+    return crypto.decrypt(keyBytes, ciphertextBytes, nonce, aad, TAG_LEN);
   }
   AesCcm82.decrypt = decrypt;
 })(AesCcm8 || (AesCcm8 = {}));