@matter/thread-br-client 0.0.1

package/dist/cjs/dtls/channel/NobleDtlsChannel.js

@@ -0,0 +1,440 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var NobleDtlsChannel_exports = {};
+__export(NobleDtlsChannel_exports, {
+  NobleDtlsChannel: () => NobleDtlsChannel
+});
+module.exports = __toCommonJS(NobleDtlsChannel_exports);
+var import_general = require("@matter/general");
+var import_nist = require("@noble/curves/nist.js");
+var import_DtlsClient = require("../handshake/DtlsClient.js");
+var import_ContentType = require("../record/ContentType.js");
+var import_DtlsRecord = require("../record/DtlsRecord.js");
+var import_DtlsChannel = require("./DtlsChannel.js");
+var import_DtlsRetransmitTimer = require("./DtlsRetransmitTimer.js");
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+const logger = import_general.Logger.get("NobleDtlsChannel");
+const DEFAULT_INITIAL_RETRANSMIT = (0, import_general.Seconds)(1);
+const DEFAULT_MAX_RETRANSMIT = (0, import_general.Minutes)(1);
+const DEFAULT_MAX_RETRANSMITS = 5;
+const DEFAULT_CONNECT_TIMEOUT = (0, import_general.Seconds)(30);
+const DEFAULT_MTU = 1280;
+const MAX_INBOUND_QUEUE = 64;
+const N = import_nist.p256.Point.Fn.ORDER;
+const ALERT_LEVEL_WARNING = 1;
+const ALERT_DESC_CLOSE_NOTIFY = 0;
+function inferUdpType(address, hint) {
+  if (hint !== void 0) {
+    return hint;
+  }
+  return address.includes(":") ? "udp6" : "udp4";
+}
+function defaultRandom(entropy) {
+  return import_general.Bytes.of(entropy.randomBytes(32));
+}
+function concatBuffers(parts) {
+  const total = parts.reduce((a, p) => a + p.length, 0);
+  const out = new Uint8Array(total);
+  let off = 0;
+  for (const p of parts) {
+    out.set(p, off);
+    off += p.length;
+  }
+  return out;
+}
+function defaultEphemeralScalar(entropy) {
+  let v = 0n;
+  const buf = import_general.Bytes.of(entropy.randomBytes(32));
+  for (const byte of buf) {
+    v = v << 8n | BigInt(byte);
+  }
+  return v % (N - 1n) + 1n;
+}
+class NobleDtlsChannel {
+  #opts;
+  #udpType;
+  #udp;
+  #client;
+  #retransmit;
+  /** Established cipher state (snapshot of the DtlsClient's after handshake). */
+  #cipherState;
+  #connected = false;
+  #closed = false;
+  #failure;
+  #failureDelivered = false;
+  /** Connect-deadline timer handle. */
+  #connectDeadline;
+  /** Decrypted application-data plaintexts buffered until a consumer takes them. Bounded by {@link MAX_INBOUND_QUEUE}. */
+  #inboundQueue = new Array();
+  /** A single pending consumer waiting on the async iterator. */
+  #inboundWaiter;
+  #closeListeners = /* @__PURE__ */ new Set();
+  /** Resolves once the DtlsClient reports `established`. */
+  #onConnect;
+  constructor(opts) {
+    this.#opts = opts;
+    this.#udpType = inferUdpType(opts.address, opts.type);
+  }
+  /**
+   * Bind the UDP socket, run the handshake to "established". Throws on
+   * timeout, give-up, or any DTLS-level failure.
+   */
+  async connect() {
+    if (this.#connected) {
+      throw new import_general.ImplementationError("NobleDtlsChannel.connect: already connected");
+    }
+    if (this.#closed) {
+      throw new import_general.ImplementationError("NobleDtlsChannel.connect: closed");
+    }
+    const environment = this.#opts.environment;
+    const network = environment.get(import_general.Network);
+    const entropy = environment.get(import_general.Crypto);
+    const udp = await network.createUdpSocket({ type: this.#udpType, listeningPort: 0 });
+    if (this.#closed) {
+      await udp.close();
+      throw new import_general.ImplementationError("NobleDtlsChannel.connect: closed");
+    }
+    this.#udp = udp;
+    udp.onData((_netInterface, _peerAddress, _peerPort, data) => this.#onDatagram(import_general.Bytes.of(data)));
+    const initialRetransmit = this.#opts.initialRetransmitMs !== void 0 ? (0, import_general.Millis)(this.#opts.initialRetransmitMs) : DEFAULT_INITIAL_RETRANSMIT;
+    const maxRetransmit = this.#opts.maxRetransmitMs !== void 0 ? (0, import_general.Millis)(this.#opts.maxRetransmitMs) : DEFAULT_MAX_RETRANSMIT;
+    const clientCfg = {
+      password: this.#opts.password,
+      random: this.#opts.random ?? (() => defaultRandom(entropy)),
+      ephemeralScalar: this.#opts.ephemeralScalar ?? (() => defaultEphemeralScalar(entropy)),
+      initialRetransmitMs: initialRetransmit,
+      maxRetransmitMs: maxRetransmit,
+      mtu: this.#opts.mtu ?? DEFAULT_MTU
+    };
+    const client = new import_DtlsClient.DtlsClient(clientCfg);
+    this.#client = client;
+    this.#retransmit = new import_DtlsRetransmitTimer.DtlsRetransmitTimer({
+      initialMs: initialRetransmit,
+      maxMs: maxRetransmit,
+      maxRetransmits: this.#opts.maxRetransmits ?? DEFAULT_MAX_RETRANSMITS,
+      onRetransmit: () => this.#onRetransmit(),
+      onGiveUp: () => this.#fail(new import_DtlsChannel.DtlsError("NobleDtlsChannel: handshake gave up after max retransmits"))
+    });
+    const connectPromise = new Promise((resolve, reject) => {
+      this.#onConnect = { resolve, reject };
+    });
+    const connectTimeout = this.#opts.connectTimeoutMs !== void 0 ? (0, import_general.Millis)(this.#opts.connectTimeoutMs) : DEFAULT_CONNECT_TIMEOUT;
+    this.#connectDeadline = import_general.Time.getTimer(
+      "dtls-connect-deadline",
+      connectTimeout,
+      () => this.#fail(new import_general.TimeoutError(`NobleDtlsChannel: connect timed out after ${connectTimeout}ms`))
+    ).start();
+    try {
+      const step = client.start();
+      this.#sendRecords(step.records);
+      this.#retransmit.armNewFlight();
+    } catch (e) {
+      this.#fail(e instanceof Error ? e : new import_general.InternalError(String(e)));
+    }
+    try {
+      await connectPromise;
+    } finally {
+      this.#connectDeadline?.stop();
+      this.#connectDeadline = void 0;
+    }
+  }
+  async send(bytes) {
+    if (this.#closed) {
+      throw new import_general.ImplementationError("NobleDtlsChannel.send: closed");
+    }
+    if (!this.#connected) {
+      throw new import_general.ImplementationError("NobleDtlsChannel.send: not connected");
+    }
+    const cipherState = this.#cipherState;
+    const udp = this.#udp;
+    if (cipherState === void 0 || udp === void 0) {
+      throw new import_general.InternalError("NobleDtlsChannel.send: missing cipher state or transport");
+    }
+    const seq = cipherState.nextWriteSeq();
+    const record = import_DtlsRecord.DtlsRecord.encode(
+      {
+        type: import_ContentType.ContentType.APPLICATION_DATA,
+        epoch: cipherState.writeEpoch,
+        sequenceNumber: seq,
+        fragment: import_general.Bytes.of(bytes)
+      },
+      cipherState
+    );
+    await this.#sendDatagram(udp, record);
+  }
+  [Symbol.asyncIterator]() {
+    return {
+      next: () => {
+        if (this.#inboundQueue.length > 0) {
+          return Promise.resolve({ value: this.#inboundQueue.shift(), done: false });
+        }
+        if (this.#failure !== void 0 && !this.#failureDelivered) {
+          this.#failureDelivered = true;
+          return Promise.reject(this.#failure);
+        }
+        if (this.#closed) {
+          return Promise.resolve({ value: void 0, done: true });
+        }
+        if (this.#inboundWaiter !== void 0) {
+          return Promise.reject(
+            new import_general.ImplementationError("NobleDtlsChannel: concurrent iteration not supported")
+          );
+        }
+        return new Promise((resolve, reject) => {
+          this.#inboundWaiter = { resolve, reject };
+        });
+      },
+      return: async () => {
+        await this.close();
+        return { value: void 0, done: true };
+      }
+    };
+  }
+  onClose(listener) {
+    this.#closeListeners.add(listener);
+    return {
+      close: async () => {
+        this.#closeListeners.delete(listener);
+      }
+    };
+  }
+  async close() {
+    if (this.#closed) {
+      return;
+    }
+    this.#closed = true;
+    const cipherState = this.#cipherState;
+    const udp = this.#udp;
+    if (this.#connected && cipherState !== void 0 && udp !== void 0) {
+      try {
+        const seq = cipherState.nextWriteSeq();
+        const alertRecord = import_DtlsRecord.DtlsRecord.encode(
+          {
+            type: import_ContentType.ContentType.ALERT,
+            epoch: cipherState.writeEpoch,
+            sequenceNumber: seq,
+            fragment: Uint8Array.of(ALERT_LEVEL_WARNING, ALERT_DESC_CLOSE_NOTIFY)
+          },
+          cipherState
+        );
+        await this.#sendDatagram(udp, alertRecord).catch(() => {
+        });
+      } catch {
+      }
+    }
+    if (this.#retransmit !== void 0) {
+      this.#retransmit.cancel();
+    }
+    if (udp !== void 0) {
+      await udp.close().catch(() => {
+      });
+    }
+    const waiter = this.#inboundWaiter;
+    this.#inboundWaiter = void 0;
+    if (waiter !== void 0) {
+      if (this.#failure !== void 0 && !this.#failureDelivered) {
+        this.#failureDelivered = true;
+        waiter.reject(this.#failure);
+      } else {
+        waiter.resolve({ value: void 0, done: true });
+      }
+    }
+    for (const listener of this.#closeListeners) {
+      listener();
+    }
+    if (this.#onConnect !== void 0 && !this.#connected) {
+      const onConnect = this.#onConnect;
+      this.#onConnect = void 0;
+      onConnect.reject(this.#failure ?? new import_DtlsChannel.DtlsError("NobleDtlsChannel: closed"));
+    }
+  }
+  /** True once the handshake reaches "established". */
+  isConnected() {
+    return this.#connected;
+  }
+  // -----------------------------------------------------------------------
+  // Internals
+  #onDatagram(bytes) {
+    if (this.#closed) {
+      return;
+    }
+    try {
+      if (this.#connected) {
+        this.#handleAppDatagram(bytes);
+      } else {
+        this.#handleHandshakeDatagram(bytes);
+      }
+    } catch (e) {
+      this.#fail(e instanceof Error ? e : new import_general.InternalError(String(e)));
+    }
+  }
+  #handleHandshakeDatagram(bytes) {
+    const client = this.#client;
+    const retransmit = this.#retransmit;
+    if (client === void 0 || retransmit === void 0) {
+      throw new import_general.InternalError("NobleDtlsChannel: handshake datagram before client/timer initialised");
+    }
+    const step = client.onDatagram(bytes);
+    retransmit.cancel();
+    if (step.records.length > 0) {
+      this.#sendRecords(step.records);
+    }
+    if (client.isEstablished()) {
+      this.#cipherState = client.cipherState();
+      this.#connected = true;
+      const onConnect = this.#onConnect;
+      this.#onConnect = void 0;
+      if (onConnect !== void 0) {
+        onConnect.resolve();
+      }
+    } else if (step.records.length > 0) {
+      retransmit.armNewFlight();
+    }
+  }
+  #handleAppDatagram(bytes) {
+    const cipherState = this.#cipherState;
+    if (cipherState === void 0) {
+      throw new import_general.InternalError("NobleDtlsChannel: post-handshake datagram with no cipher state");
+    }
+    let p = 0;
+    while (p < bytes.length) {
+      if (bytes.length - p < import_DtlsRecord.DTLS_HEADER_LEN) {
+        throw new import_DtlsChannel.DtlsError("NobleDtlsChannel: short DTLS record header");
+      }
+      const length = bytes[p + 11] << 8 | bytes[p + 12];
+      const recordEnd = p + import_DtlsRecord.DTLS_HEADER_LEN + length;
+      if (recordEnd > bytes.length) {
+        throw new import_DtlsChannel.DtlsError("NobleDtlsChannel: DTLS record length overruns datagram");
+      }
+      const slice = bytes.subarray(p, recordEnd);
+      let record;
+      try {
+        ({ record } = import_DtlsRecord.DtlsRecord.decode(slice, cipherState));
+      } catch (e) {
+        if (e instanceof import_DtlsRecord.DtlsReplayError) {
+          logger.debug(`Dropping replayed DTLS record epoch=${e.epoch} seq=${e.sequenceNumber}`);
+          p = recordEnd;
+          continue;
+        }
+        throw e;
+      }
+      if (record.type === import_ContentType.ContentType.APPLICATION_DATA) {
+        this.#deliverPlaintext(record.fragment);
+      } else if (record.type === import_ContentType.ContentType.ALERT) {
+        if (record.fragment.length >= 2 && record.fragment[1] === ALERT_DESC_CLOSE_NOTIFY) {
+          this.#fail(new import_DtlsChannel.DtlsError("NobleDtlsChannel: peer sent close_notify"));
+          return;
+        }
+        this.#fail(
+          new import_DtlsChannel.DtlsError(
+            `NobleDtlsChannel: peer alert level=${record.fragment[0] ?? -1} desc=${record.fragment[1] ?? -1}`
+          )
+        );
+        return;
+      }
+      p = recordEnd;
+    }
+  }
+  #deliverPlaintext(plaintext) {
+    const waiter = this.#inboundWaiter;
+    if (waiter !== void 0) {
+      this.#inboundWaiter = void 0;
+      waiter.resolve({ value: plaintext, done: false });
+      return;
+    }
+    this.#inboundQueue.push(plaintext);
+    if (this.#inboundQueue.length > MAX_INBOUND_QUEUE) {
+      this.#fail(new import_DtlsChannel.DtlsError("NobleDtlsChannel: inbound buffer overflow \u2014 consumer too slow"));
+    }
+  }
+  #onRetransmit() {
+    const client = this.#client;
+    if (client === void 0 || this.#connected || this.#closed) {
+      return;
+    }
+    try {
+      const step = client.onRetransmit();
+      this.#sendRecords(step.records);
+    } catch (e) {
+      this.#fail(e instanceof Error ? e : new import_general.InternalError(String(e)));
+    }
+  }
+  #sendRecords(records) {
+    const udp = this.#udp;
+    if (udp === void 0) {
+      throw new import_general.InternalError("NobleDtlsChannel: send before bind");
+    }
+    if (records.length === 0) {
+      return;
+    }
+    const mtu = this.#opts.mtu ?? DEFAULT_MTU;
+    const datagrams = new Array();
+    let acc = new Array();
+    let accLen = 0;
+    for (const record of records) {
+      if (accLen > 0 && accLen + record.length > mtu) {
+        datagrams.push(concatBuffers(acc));
+        acc = [];
+        accLen = 0;
+      }
+      acc.push(record);
+      accLen += record.length;
+    }
+    if (acc.length > 0) {
+      datagrams.push(concatBuffers(acc));
+    }
+    for (const dg of datagrams) {
+      void this.#sendDatagram(udp, dg).catch(
+        (e) => this.#fail(e instanceof Error ? e : new import_general.InternalError(String(e)))
+      );
+    }
+  }
+  async #sendDatagram(udp, bytes) {
+    await udp.send(this.#opts.address, this.#opts.port, bytes);
+  }
+  #fail(error) {
+    if (this.#closed) {
+      return;
+    }
+    if (this.#failure === void 0) {
+      this.#failure = error;
+    }
+    if (this.#retransmit !== void 0) {
+      this.#retransmit.cancel();
+    }
+    const onConnect = this.#onConnect;
+    this.#onConnect = void 0;
+    if (onConnect !== void 0 && !this.#connected) {
+      onConnect.reject(error);
+    }
+    const waiter = this.#inboundWaiter;
+    this.#inboundWaiter = void 0;
+    if (waiter !== void 0) {
+      this.#failureDelivered = true;
+      waiter.reject(error);
+    }
+    void this.close().catch(() => {
+    });
+  }
+}
+//# sourceMappingURL=NobleDtlsChannel.js.map

package/dist/cjs/dtls/channel/NobleDtlsChannel.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/dtls/channel/NobleDtlsChannel.ts"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,qBAiBO;AACP,kBAAqB;AACrB,wBAAkD;AAClD,yBAA4B;AAE5B,wBAA6D;AAC7D,yBAA4C;AAE5C,iCAAoC;AA/BpC;AAAA;AAAA;AAAA;AAAA;AAiCA,MAAM,SAAS,sBAAO,IAAI,kBAAkB;AAE5C,MAAM,iCAA6B,wBAAQ,CAAC;AAC5C,MAAM,6BAAyB,wBAAQ,CAAC;AACxC,MAAM,0BAA0B;AAChC,MAAM,8BAA0B,wBAAQ,EAAE;AAC1C,MAAM,cAAc;AAQpB,MAAM,oBAAoB;AAE1B,MAAM,IAAI,iBAAK,MAAM,GAAG;AAExB,MAAM,sBAAsB;AAC5B,MAAM,0BAA0B;AAEhC,SAAS,aAAa,SAAiB,MAAyC;AAC5E,MAAI,SAAS,QAAW;AACpB,WAAO;AAAA,EACX;AACA,SAAO,QAAQ,SAAS,GAAG,IAAI,SAAS;AAC5C;AAEA,SAAS,cAAc,SAA8B;AACjD,SAAO,qBAAM,GAAG,QAAQ,YAAY,EAAE,CAAC;AAC3C;AAEA,SAAS,cAAc,OAAiC;AACpD,QAAM,QAAQ,MAAM,OAAO,CAAC,GAAG,MAAM,IAAI,EAAE,QAAQ,CAAC;AACpD,QAAM,MAAM,IAAI,WAAW,KAAK;AAChC,MAAI,MAAM;AACV,aAAW,KAAK,OAAO;AACnB,QAAI,IAAI,GAAG,GAAG;AACd,WAAO,EAAE;AAAA,EACb;AACA,SAAO;AACX;AAEA,SAAS,uBAAuB,SAA0B;AAGtD,MAAI,IAAI;AACR,QAAM,MAAM,qBAAM,GAAG,QAAQ,YAAY,EAAE,CAAC;AAC5C,aAAW,QAAQ,KAAK;AACpB,QAAK,KAAK,KAAM,OAAO,IAAI;AAAA,EAC/B;AACA,SAAQ,KAAK,IAAI,MAAO;AAC5B;AAaO,MAAM,iBAAwC;AAAA,EACxC;AAAA,EACA;AAAA,EAET;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA,aAAa;AAAA,EACb,UAAU;AAAA,EACV;AAAA,EACA,oBAAoB;AAAA;AAAA,EAGpB;AAAA;AAAA,EAGS,gBAAgB,IAAI,MAAa;AAAA;AAAA,EAE1C;AAAA,EAOS,kBAAkB,oBAAI,IAAgB;AAAA;AAAA,EAG/C;AAAA,EAOA,YAAY,MAAuB;AAC/B,SAAK,QAAQ;AACb,SAAK,WAAW,aAAa,KAAK,SAAS,KAAK,IAAI;AAAA,EACxD;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,UAAyB;AAC3B,QAAI,KAAK,YAAY;AACjB,YAAM,IAAI,mCAAoB,6CAA6C;AAAA,IAC/E;AACA,QAAI,KAAK,SAAS;AACd,YAAM,IAAI,mCAAoB,kCAAkC;AAAA,IACpE;AAEA,UAAM,cAAc,KAAK,MAAM;AAC/B,UAAM,UAAU,YAAY,IAAI,sBAAO;AACvC,UAAM,UAAU,YAAY,IAAI,qBAAM;AACtC,UAAM,MAAM,MAAM,QAAQ,gBAAgB,EAAE,MAAM,KAAK,UAAU,eAAe,EAAE,CAAC;AACnF,QAAI,KAAK,SAAS;AACd,YAAM,IAAI,MAAM;AAChB,YAAM,IAAI,mCAAoB,kCAAkC;AAAA,IACpE;AACA,SAAK,OAAO;AACZ,QAAI,OAAO,CAAC,eAAe,cAAc,WAAW,SAAS,KAAK,YAAY,qBAAM,GAAG,IAAI,CAAC,CAAC;AAE7F,UAAM,oBACF,KAAK,MAAM,wBAAwB,aAC7B,uBAAO,KAAK,MAAM,mBAAmB,IACrC;AACV,UAAM,gBACF,KAAK,MAAM,oBAAoB,aAAY,uBAAO,KAAK,MAAM,eAAe,IAAI;AAEpF,UAAM,YAA8B;AAAA,MAChC,UAAU,KAAK,MAAM;AAAA,MACrB,QAAQ,KAAK,MAAM,WAAW,MAAM,cAAc,OAAO;AAAA,MACzD,iBAAiB,KAAK,MAAM,oBAAoB,MAAM,uBAAuB,OAAO;AAAA,MACpF,qBAAqB;AAAA,MACrB,iBAAiB;AAAA,MACjB,KAAK,KAAK,MAAM,OAAO;AAAA,IAC3B;AACA,UAAM,SAAS,IAAI,6BAAW,SAAS;AACvC,SAAK,UAAU;AAEf,SAAK,cAAc,IAAI,+CAAoB;AAAA,MACvC,WAAW;AAAA,MACX,OAAO;AAAA,MACP,gBAAgB,KAAK,MAAM,kBAAkB;AAAA,MAC7C,cAAc,MAAM,KAAK,cAAc;AAAA,MACvC,UAAU,MAAM,KAAK,MAAM,IAAI,6BAAU,2DAA2D,CAAC;AAAA,IACzG,CAAC;AAED,UAAM,iBAAiB,IAAI,QAAc,CAAC,SAAS,WAAW;AAC1D,WAAK,aAAa,EAAE,SAAS,OAAO;AAAA,IACxC,CAAC;AACD,UAAM,iBACF,KAAK,MAAM,qBAAqB,aAAY,uBAAO,KAAK,MAAM,gBAAgB,IAAI;AACtF,SAAK,mBAAmB,oBAAK;AAAA,MAAS;AAAA,MAAyB;AAAA,MAAgB,MAC3E,KAAK,MAAM,IAAI,4BAAa,6CAA6C,cAAc,IAAI,CAAC;AAAA,IAChG,EAAE,MAAM;AAGR,QAAI;AACA,YAAM,OAAO,OAAO,MAAM;AAC1B,WAAK,aAAa,KAAK,OAAO;AAC9B,WAAK,YAAY,aAAa;AAAA,IAClC,SAAS,GAAG;AACR,WAAK,MAAM,aAAa,QAAQ,IAAI,IAAI,6BAAc,OAAO,CAAC,CAAC,CAAC;AAAA,IACpE;AAEA,QAAI;AACA,YAAM;AAAA,IACV,UAAE;AACE,WAAK,kBAAkB,KAAK;AAC5B,WAAK,mBAAmB;AAAA,IAC5B;AAAA,EACJ;AAAA,EAEA,MAAM,KAAK,OAA6B;AACpC,QAAI,KAAK,SAAS;AACd,YAAM,IAAI,mCAAoB,+BAA+B;AAAA,IACjE;AACA,QAAI,CAAC,KAAK,YAAY;AAClB,YAAM,IAAI,mCAAoB,sCAAsC;AAAA,IACxE;AACA,UAAM,cAAc,KAAK;AACzB,UAAM,MAAM,KAAK;AACjB,QAAI,gBAAgB,UAAa,QAAQ,QAAW;AAChD,YAAM,IAAI,6BAAc,0DAA0D;AAAA,IACtF;AACA,UAAM,MAAM,YAAY,aAAa;AACrC,UAAM,SAAS,6BAAW;AAAA,MACtB;AAAA,QACI,MAAM,+BAAY;AAAA,QAClB,OAAO,YAAY;AAAA,QACnB,gBAAgB;AAAA,QAChB,UAAU,qBAAM,GAAG,KAAK;AAAA,MAC5B;AAAA,MACA;AAAA,IACJ;AACA,UAAM,KAAK,cAAc,KAAK,MAAM;AAAA,EACxC;AAAA,EAEA,CAAC,OAAO,aAAa,IAA0B;AAC3C,WAAO;AAAA,MACH,MAAM,MAAsC;AACxC,YAAI,KAAK,cAAc,SAAS,GAAG;AAC/B,iBAAO,QAAQ,QAAQ,EAAE,OAAO,KAAK,cAAc,MAAM,GAAI,MAAM,MAAM,CAAC;AAAA,QAC9E;AACA,YAAI,KAAK,aAAa,UAAa,CAAC,KAAK,mBAAmB;AACxD,eAAK,oBAAoB;AACzB,iBAAO,QAAQ,OAAO,KAAK,QAAQ;AAAA,QACvC;AACA,YAAI,KAAK,SAAS;AACd,iBAAO,QAAQ,QAAQ,EAAE,OAAO,QAAW,MAAM,KAAK,CAAC;AAAA,QAC3D;AACA,YAAI,KAAK,mBAAmB,QAAW;AACnC,iBAAO,QAAQ;AAAA,YACX,IAAI,mCAAoB,sDAAsD;AAAA,UAClF;AAAA,QACJ;AACA,eAAO,IAAI,QAA+B,CAAC,SAAS,WAAW;AAC3D,eAAK,iBAAiB,EAAE,SAAS,OAAO;AAAA,QAC5C,CAAC;AAAA,MACL;AAAA,MACA,QAAQ,YAA4C;AAChD,cAAM,KAAK,MAAM;AACjB,eAAO,EAAE,OAAO,QAAW,MAAM,KAAK;AAAA,MAC1C;AAAA,IACJ;AAAA,EACJ;AAAA,EAEA,QAAQ,UAA0C;AAC9C,SAAK,gBAAgB,IAAI,QAAQ;AACjC,WAAO;AAAA,MACH,OAAO,YAAY;AACf,aAAK,gBAAgB,OAAO,QAAQ;AAAA,MACxC;AAAA,IACJ;AAAA,EACJ;AAAA,EAEA,MAAM,QAAuB;AACzB,QAAI,KAAK,SAAS;AACd;AAAA,IACJ;AACA,SAAK,UAAU;AAEf,UAAM,cAAc,KAAK;AACzB,UAAM,MAAM,KAAK;AACjB,QAAI,KAAK,cAAc,gBAAgB,UAAa,QAAQ,QAAW;AACnE,UAAI;AACA,cAAM,MAAM,YAAY,aAAa;AACrC,cAAM,cAAc,6BAAW;AAAA,UAC3B;AAAA,YACI,MAAM,+BAAY;AAAA,YAClB,OAAO,YAAY;AAAA,YACnB,gBAAgB;AAAA,YAChB,UAAU,WAAW,GAAG,qBAAqB,uBAAuB;AAAA,UACxE;AAAA,UACA;AAAA,QACJ;AACA,cAAM,KAAK,cAAc,KAAK,WAAW,EAAE,MAAM,MAAM;AAAA,QAAC,CAAC;AAAA,MAC7D,QAAQ;AAAA,MAER;AAAA,IACJ;AACA,QAAI,KAAK,gBAAgB,QAAW;AAChC,WAAK,YAAY,OAAO;AAAA,IAC5B;AACA,QAAI,QAAQ,QAAW;AACnB,YAAM,IAAI,MAAM,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAAA,IACpC;AAEA,UAAM,SAAS,KAAK;AACpB,SAAK,iBAAiB;AACtB,QAAI,WAAW,QAAW;AACtB,UAAI,KAAK,aAAa,UAAa,CAAC,KAAK,mBAAmB;AACxD,aAAK,oBAAoB;AACzB,eAAO,OAAO,KAAK,QAAQ;AAAA,MAC/B,OAAO;AACH,eAAO,QAAQ,EAAE,OAAO,QAAW,MAAM,KAAK,CAAC;AAAA,MACnD;AAAA,IACJ;AACA,eAAW,YAAY,KAAK,iBAAiB;AACzC,eAAS;AAAA,IACb;AACA,QAAI,KAAK,eAAe,UAAa,CAAC,KAAK,YAAY;AACnD,YAAM,YAAY,KAAK;AACvB,WAAK,aAAa;AAClB,gBAAU,OAAO,KAAK,YAAY,IAAI,6BAAU,0BAA0B,CAAC;AAAA,IAC/E;AAAA,EACJ;AAAA;AAAA,EAGA,cAAuB;AACnB,WAAO,KAAK;AAAA,EAChB;AAAA;AAAA;AAAA,EAKA,YAAY,OAAyB;AACjC,QAAI,KAAK,SAAS;AACd;AAAA,IACJ;AACA,QAAI;AACA,UAAI,KAAK,YAAY;AACjB,aAAK,mBAAmB,KAAK;AAAA,MACjC,OAAO;AACH,aAAK,yBAAyB,KAAK;AAAA,MACvC;AAAA,IACJ,SAAS,GAAG;AACR,WAAK,MAAM,aAAa,QAAQ,IAAI,IAAI,6BAAc,OAAO,CAAC,CAAC,CAAC;AAAA,IACpE;AAAA,EACJ;AAAA,EAEA,yBAAyB,OAAyB;AAC9C,UAAM,SAAS,KAAK;AACpB,UAAM,aAAa,KAAK;AACxB,QAAI,WAAW,UAAa,eAAe,QAAW;AAClD,YAAM,IAAI,6BAAc,sEAAsE;AAAA,IAClG;AACA,UAAM,OAAO,OAAO,WAAW,KAAK;AAEpC,eAAW,OAAO;AAClB,QAAI,KAAK,QAAQ,SAAS,GAAG;AACzB,WAAK,aAAa,KAAK,OAAO;AAAA,IAClC;AACA,QAAI,OAAO,cAAc,GAAG;AACxB,WAAK,eAAe,OAAO,YAAY;AACvC,WAAK,aAAa;AAClB,YAAM,YAAY,KAAK;AACvB,WAAK,aAAa;AAClB,UAAI,cAAc,QAAW;AACzB,kBAAU,QAAQ;AAAA,MACtB;AAAA,IACJ,WAAW,KAAK,QAAQ,SAAS,GAAG;AAChC,iBAAW,aAAa;AAAA,IAC5B;AAAA,EACJ;AAAA,EAEA,mBAAmB,OAAyB;AACxC,UAAM,cAAc,KAAK;AACzB,QAAI,gBAAgB,QAAW;AAC3B,YAAM,IAAI,6BAAc,gEAAgE;AAAA,IAC5F;AACA,QAAI,IAAI;AACR,WAAO,IAAI,MAAM,QAAQ;AACrB,UAAI,MAAM,SAAS,IAAI,mCAAiB;AACpC,cAAM,IAAI,6BAAU,4CAA4C;AAAA,MACpE;AACA,YAAM,SAAU,MAAM,IAAI,EAAE,KAAK,IAAK,MAAM,IAAI,EAAE;AAClD,YAAM,YAAY,IAAI,oCAAkB;AACxC,UAAI,YAAY,MAAM,QAAQ;AAC1B,cAAM,IAAI,6BAAU,wDAAwD;AAAA,MAChF;AACA,YAAM,QAAQ,MAAM,SAAS,GAAG,SAAS;AACzC,UAAI;AACJ,UAAI;AACA,SAAC,EAAE,OAAO,IAAI,6BAAW,OAAO,OAAO,WAAW;AAAA,MACtD,SAAS,GAAG;AAIR,YAAI,aAAa,mCAAiB;AAC9B,iBAAO,MAAM,uCAAuC,EAAE,KAAK,QAAQ,EAAE,cAAc,EAAE;AACrF,cAAI;AACJ;AAAA,QACJ;AACA,cAAM;AAAA,MACV;AACA,UAAI,OAAO,SAAS,+BAAY,kBAAkB;AAC9C,aAAK,kBAAkB,OAAO,QAAQ;AAAA,MAC1C,WAAW,OAAO,SAAS,+BAAY,OAAO;AAE1C,YAAI,OAAO,SAAS,UAAU,KAAK,OAAO,SAAS,CAAC,MAAM,yBAAyB;AAC/E,eAAK,MAAM,IAAI,6BAAU,0CAA0C,CAAC;AACpE;AAAA,QACJ;AACA,aAAK;AAAA,UACD,IAAI;AAAA,YACA,sCAAsC,OAAO,SAAS,CAAC,KAAK,EAAE,SAAS,OAAO,SAAS,CAAC,KAAK,EAAE;AAAA,UACnG;AAAA,QACJ;AACA;AAAA,MACJ;AAGA,UAAI;AAAA,IACR;AAAA,EACJ;AAAA,EAEA,kBAAkB,WAA6B;AAC3C,UAAM,SAAS,KAAK;AACpB,QAAI,WAAW,QAAW;AACtB,WAAK,iBAAiB;AACtB,aAAO,QAAQ,EAAE,OAAO,WAAW,MAAM,MAAM,CAAC;AAChD;AAAA,IACJ;AACA,SAAK,cAAc,KAAK,SAAS;AACjC,QAAI,KAAK,cAAc,SAAS,mBAAmB;AAC/C,WAAK,MAAM,IAAI,6BAAU,oEAA+D,CAAC;AAAA,IAC7F;AAAA,EACJ;AAAA,EAEA,gBAAsB;AAClB,UAAM,SAAS,KAAK;AACpB,QAAI,WAAW,UAAa,KAAK,cAAc,KAAK,SAAS;AACzD;AAAA,IACJ;AACA,QAAI;AACA,YAAM,OAAO,OAAO,aAAa;AACjC,WAAK,aAAa,KAAK,OAAO;AAAA,IAClC,SAAS,GAAG;AACR,WAAK,MAAM,aAAa,QAAQ,IAAI,IAAI,6BAAc,OAAO,CAAC,CAAC,CAAC;AAAA,IACpE;AAAA,EACJ;AAAA,EAEA,aAAa,SAA6B;AACtC,UAAM,MAAM,KAAK;AACjB,QAAI,QAAQ,QAAW;AACnB,YAAM,IAAI,6BAAc,oCAAoC;AAAA,IAChE;AACA,QAAI,QAAQ,WAAW,GAAG;AACtB;AAAA,IACJ;AAIA,UAAM,MAAM,KAAK,MAAM,OAAO;AAC9B,UAAM,YAAY,IAAI,MAAkB;AACxC,QAAI,MAAM,IAAI,MAAkB;AAChC,QAAI,SAAS;AACb,eAAW,UAAU,SAAS;AAC1B,UAAI,SAAS,KAAK,SAAS,OAAO,SAAS,KAAK;AAC5C,kBAAU,KAAK,cAAc,GAAG,CAAC;AACjC,cAAM,CAAC;AACP,iBAAS;AAAA,MACb;AACA,UAAI,KAAK,MAAM;AACf,gBAAU,OAAO;AAAA,IACrB;AACA,QAAI,IAAI,SAAS,GAAG;AAChB,gBAAU,KAAK,cAAc,GAAG,CAAC;AAAA,IACrC;AACA,eAAW,MAAM,WAAW;AACxB,WAAK,KAAK,cAAc,KAAK,EAAE,EAAE;AAAA,QAAM,OACnC,KAAK,MAAM,aAAa,QAAQ,IAAI,IAAI,6BAAc,OAAO,CAAC,CAAC,CAAC;AAAA,MACpE;AAAA,IACJ;AAAA,EACJ;AAAA,EAEA,MAAM,cAAc,KAAgB,OAAkC;AAClE,UAAM,IAAI,KAAK,KAAK,MAAM,SAAS,KAAK,MAAM,MAAM,KAAK;AAAA,EAC7D;AAAA,EAEA,MAAM,OAAoB;AACtB,QAAI,KAAK,SAAS;AACd;AAAA,IACJ;AACA,QAAI,KAAK,aAAa,QAAW;AAC7B,WAAK,WAAW;AAAA,IACpB;AACA,QAAI,KAAK,gBAAgB,QAAW;AAChC,WAAK,YAAY,OAAO;AAAA,IAC5B;AACA,UAAM,YAAY,KAAK;AACvB,SAAK,aAAa;AAClB,QAAI,cAAc,UAAa,CAAC,KAAK,YAAY;AAC7C,gBAAU,OAAO,KAAK;AAAA,IAC1B;AACA,UAAM,SAAS,KAAK;AACpB,SAAK,iBAAiB;AACtB,QAAI,WAAW,QAAW;AACtB,WAAK,oBAAoB;AACzB,aAAO,OAAO,KAAK;AAAA,IACvB;AAEA,SAAK,KAAK,MAAM,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AAAA,EACpC;AACJ;",
+  "names": []
+}

package/dist/cjs/dtls/channel/connectDtls.d.ts

@@ -0,0 +1,15 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import type { DtlsChannel } from "./DtlsChannel.js";
+import type { DtlsConnectOpts } from "./DtlsConnectOpts.js";
+/**
+ * Open a DTLS 1.2 + EC-JPAKE channel to the peer: construct a
+ * {@link NobleDtlsChannel}, run its handshake, and resolve with the connected
+ * channel. If the handshake fails the transport is torn down before rethrowing
+ * so the UDP socket never leaks.
+ */
+export declare function connectDtls(opts: DtlsConnectOpts): Promise<DtlsChannel>;
+//# sourceMappingURL=connectDtls.d.ts.map

package/dist/cjs/dtls/channel/connectDtls.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connectDtls.d.ts","sourceRoot":"","sources":["../../../../src/dtls/channel/connectDtls.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAG5D;;;;;GAKG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,WAAW,CAAC,CAS7E"}

package/dist/cjs/dtls/channel/connectDtls.js

@@ -0,0 +1,41 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var connectDtls_exports = {};
+__export(connectDtls_exports, {
+  connectDtls: () => connectDtls
+});
+module.exports = __toCommonJS(connectDtls_exports);
+var import_NobleDtlsChannel = require("./NobleDtlsChannel.js");
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+async function connectDtls(opts) {
+  const channel = new import_NobleDtlsChannel.NobleDtlsChannel(opts);
+  try {
+    await channel.connect();
+  } catch (e) {
+    await channel.close().catch(() => {
+    });
+    throw e;
+  }
+  return channel;
+}
+//# sourceMappingURL=connectDtls.js.map

package/dist/cjs/dtls/channel/connectDtls.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/dtls/channel/connectDtls.ts"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAQA,8BAAiC;AARjC;AAAA;AAAA;AAAA;AAAA;AAgBA,eAAsB,YAAY,MAA6C;AAC3E,QAAM,UAAU,IAAI,yCAAiB,IAAI;AACzC,MAAI;AACA,UAAM,QAAQ,QAAQ;AAAA,EAC1B,SAAS,GAAG;AACR,UAAM,QAAQ,MAAM,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AACpC,UAAM;AAAA,EACV;AACA,SAAO;AACX;",
+  "names": []
+}

package/dist/cjs/dtls/channel/index.d.ts

@@ -0,0 +1,14 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * DTLS 1.2 + EC-JPAKE channel layer — the only surface that escapes from `dtls/`
+ * to the package public API. Handshake/record/PRF/EC-JPAKE internals stay
+ * package-private.
+ */
+export { connectDtls } from "./connectDtls.js";
+export { DtlsError, type DtlsChannel } from "./DtlsChannel.js";
+export type { DtlsConnectOpts } from "./DtlsConnectOpts.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/cjs/dtls/channel/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/dtls/channel/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;GAIG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/D,YAAY,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/cjs/dtls/channel/index.js

@@ -0,0 +1,32 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var channel_exports = {};
+__export(channel_exports, {
+  DtlsError: () => import_DtlsChannel.DtlsError,
+  connectDtls: () => import_connectDtls.connectDtls
+});
+module.exports = __toCommonJS(channel_exports);
+var import_connectDtls = require("./connectDtls.js");
+var import_DtlsChannel = require("./DtlsChannel.js");
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+//# sourceMappingURL=index.js.map

package/dist/cjs/dtls/channel/index.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/dtls/channel/index.ts"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAYA,yBAA4B;AAC5B,yBAA4C;AAb5C;AAAA;AAAA;AAAA;AAAA;",
+  "names": []
+}

package/dist/cjs/dtls/ecjpake/EcJpakePms.d.ts

@@ -0,0 +1,35 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * EC-JPAKE premaster-secret derivation, mirroring mbedTLS v3.6.6
+ * `mbedtls_ecjpake_derive_secret` and its helper `mbedtls_ecjpake_derive_k`.
+ *
+ * Given the agreed pieces from a completed round-2 exchange:
+ *
+ * ```
+ * K   = ( Xp - Xp2 * (xm2 * s mod n) ) * xm2
+ * PMS = SHA-256( K.X as 32-byte BE )
+ * ```
+ *
+ * - `Xp` is the peer's round-2 public point (parsed from `parseRound2`).
+ * - `Xp2` is the peer's *second* round-1 public point.
+ * - `xm2` is our second round-1 private scalar.
+ * - `s` is the EC-JPAKE password as the big-endian integer of its bytes,
+ *   matching `mbedtls_mpi_read_binary` in `mbedtls_ecjpake_setup`.
+ *
+ * The PMS is exactly the SHA-256 hash of the field-element-sized big-endian
+ * encoding of `K.X` — no IDs, no transcript, no nonces. From here the standard
+ * TLS 1.2 PRF takes over (Phase 0c.5 / DTLS layer).
+ */
+export declare const EcJpakePms: {
+    derive(args: {
+        Xp: Uint8Array;
+        Xp2: Uint8Array;
+        xm2: bigint;
+        s: bigint;
+    }): Uint8Array;
+};
+//# sourceMappingURL=EcJpakePms.d.ts.map

package/dist/cjs/dtls/ecjpake/EcJpakePms.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"EcJpakePms.d.ts","sourceRoot":"","sources":["../../../../src/dtls/ecjpake/EcJpakePms.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAWH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,UAAU;IACnB,MAAM,OAAO;QAAE,EAAE,EAAE,UAAU,CAAC;QAAC,GAAG,EAAE,UAAU,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,UAAU;CA2B/E,CAAC"}