@matter/thread-br-client 0.0.1

package/dist/cjs/dtls/ecjpake/SchnorrZkp.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/dtls/ecjpake/SchnorrZkp.ts"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,qBAA8B;AAC9B,kBAAqB;AACrB,kBAAuB;AACvB,yBAA0B;AAT1B;AAAA;AAAA;AAAA;AAAA;AA6BA,MAAM,QAAQ,iBAAK;AACnB,MAAM,IAAI,MAAM,GAAG;AACnB,MAAM,YAAY;AAElB,SAAS,KAAK,OAA2B;AACrC,QAAM,MAAM,IAAI,WAAW,CAAC;AAC5B,MAAI,SAAS,IAAI,MAAM,EAAE,UAAU,GAAG,OAAO,KAAK;AAClD,SAAO;AACX;AAEA,SAAS,cAAc,MAKZ;AACP,QAAM,EAAE,QAAQ,QAAQ,QAAQ,QAAQ,IAAI;AAC5C,QAAM,QAAQ,IAAI,OAAO,SAAS,IAAI,OAAO,SAAS,IAAI,OAAO,SAAS,IAAI,QAAQ;AACtF,QAAM,MAAM,IAAI,WAAW,KAAK;AAChC,MAAI,IAAI;AACR,MAAI,IAAI,KAAK,OAAO,MAAM,GAAG,CAAC;AAC9B,OAAK;AACL,MAAI,IAAI,QAAQ,CAAC;AACjB,OAAK,OAAO;AACZ,MAAI,IAAI,KAAK,OAAO,MAAM,GAAG,CAAC;AAC9B,OAAK;AACL,MAAI,IAAI,QAAQ,CAAC;AACjB,OAAK,OAAO;AACZ,MAAI,IAAI,KAAK,OAAO,MAAM,GAAG,CAAC;AAC9B,OAAK;AACL,MAAI,IAAI,QAAQ,CAAC;AACjB,OAAK,OAAO;AACZ,MAAI,IAAI,KAAK,QAAQ,MAAM,GAAG,CAAC;AAC/B,OAAK;AACL,MAAI,IAAI,SAAS,CAAC;AAElB,QAAM,aAAS,oBAAO,GAAG;AACzB,MAAI,IAAI;AACR,aAAW,QAAQ,QAAQ;AACvB,QAAK,KAAK,KAAM,OAAO,IAAI;AAAA,EAC/B;AACA,SAAO,IAAI;AACf;AAEA,SAAS,kBAAkB,OAA2B;AAClD,MAAI,QAAQ,IAAI;AACZ,UAAM,IAAI,6BAAc,8CAA8C;AAAA,EAC1E;AACA,MAAI,UAAU,IAAI;AACd,WAAO,IAAI,WAAW,CAAC;AAAA,EAC3B;AACA,QAAM,MAAM,IAAI,MAAc;AAC9B,MAAI,IAAI;AACR,SAAO,IAAI,IAAI;AACX,QAAI,KAAK,OAAO,IAAI,KAAK,CAAC;AAC1B,UAAM;AAAA,EACV;AACA,SAAO,WAAW,KAAK,IAAI,QAAQ,CAAC;AACxC;AAEA,SAAS,aAAa,OAA2B;AAC7C,MAAI,IAAI;AACR,aAAW,QAAQ,OAAO;AACtB,QAAK,KAAK,KAAM,OAAO,IAAI;AAAA,EAC/B;AACA,SAAO;AACX;AAEA,SAAS,gBAA4B;AACjC,SAAO,MAAM,KAAK,QAAQ,KAAK;AACnC;AAEA,SAAS,eAAe,OAA+C;AACnE,MAAI,MAAM,WAAW,aAAa,MAAM,CAAC,MAAM,GAAM;AACjD,UAAM,IAAI;AAAA,MACN,2EAA2E,MAAM,MAAM,SAAS,MAAM,CAAC,CAAC;AAAA,IAC5G;AAAA,EACJ;AACA,SAAO,MAAM,UAAU,KAAK;AAChC;AAaA,SAAS,gBAAgB,GAA8C;AACnE,MAAI,GAAG;AACH,QAAI,EAAE,MAAM,WAAW,aAAa,EAAE,MAAM,CAAC,MAAM,GAAM;AACrD,YAAM,IAAI,6BAAc,yEAAyE;AAAA,IACrG;AACA,WAAO;AAAA,EACX;AACA,SAAO,EAAE,OAAO,MAAM,MAAM,OAAO,cAAc,EAAE;AACvD;AAEO,MAAM,aAAa;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWtB,SAAS,MAMM;AACX,UAAM,EAAE,YAAY,WAAW,WAAW,GAAG,IAAI;AACjD,QAAI,aAAa,MAAM,aAAa,GAAG;AACnC,YAAM,IAAI,6BAAc,sCAAsC;AAAA,IAClE;AACA,QAAI,cAAc,MAAM,cAAc,GAAG;AACrC,YAAM,IAAI,6BAAc,wCAAwC;AAAA,IACpE;AACA,UAAM,IAAI,gBAAgB,KAAK,SAAS;AACxC,UAAM,IAAI,EAAE,MAAM,SAAS,SAAS;AACpC,UAAM,SAAS,EAAE,QAAQ,KAAK;AAC9B,UAAM,UAAU,IAAI,YAAY,EAAE,OAAO,EAAE;AAC3C,UAAM,IAAI,cAAc,EAAE,QAAQ,EAAE,OAAO,QAAQ,QAAQ,WAAW,QAAQ,CAAC;AAE/E,UAAM,SAAU,YAAc,IAAI,aAAc,KAAM,IAAK,KAAK;AAChE,WAAO,EAAE,GAAG,QAAQ,GAAG,kBAAkB,IAAI,EAAE;AAAA,EACnD;AAAA,EAEA,OAAO,MAAwG;AAC3G,UAAM,EAAE,KAAK,WAAW,GAAG,IAAI;AAC/B,UAAM,UAAU,IAAI,YAAY,EAAE,OAAO,EAAE;AAC3C,QAAI;AACJ,QAAI;AACJ,QAAI;AACJ,QAAI;AACA,UAAI,gBAAgB,KAAK,SAAS;AAClC,UAAI,eAAe,IAAI,CAAC;AACxB,UAAI,eAAe,SAAS;AAAA,IAChC,QAAQ;AACJ,aAAO;AAAA,IACX;AACA,QAAI,EAAE,IAAI,KAAK,EAAE,IAAI,GAAG;AACpB,aAAO;AAAA,IACX;AACA,UAAM,IAAI,aAAa,IAAI,CAAC;AAC5B,QAAI,KAAK,GAAG;AACR,aAAO;AAAA,IACX;AACA,UAAM,IAAI,cAAc,EAAE,QAAQ,EAAE,OAAO,QAAQ,IAAI,GAAG,QAAQ,WAAW,QAAQ,CAAC;AAGtF,UAAM,MAAM,EAAE,MAAM,eAAe,CAAC,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC;AAC7D,WAAO,IAAI,OAAO,CAAC;AAAA,EACvB;AACJ;",
+  "names": []
+}

package/dist/cjs/dtls/ecjpake/index.d.ts

@@ -0,0 +1,28 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * Production EC-JPAKE crypto core (P-256 / draft-cragie-tls-ecjpake-01, mbedTLS-compatible).
+ *
+ * Hardening applied (Phase 3 sub-batch 1):
+ * - Constant-time scalar multiplication on password-derived secrets (`EcJpakePms.derive`
+ *   uses `Point.multiply`; `SchnorrZkp.verify` keeps `multiplyUnsafe` only on peer-supplied
+ *   `r` and the hash digest `h`, neither of which is secret).
+ * - Single pre-sized `Uint8Array` allocation in `EcJpakeRound.serializeRound1` /
+ *   `serializeRound2` (replaces ~330 `Array.push` calls per round-1 message).
+ * - Defensive copies on parse outputs: `EcJpakeRound.parseRound1` / `parseRound2` slice
+ *   the input so returned `Uint8Array`s own their backing buffer.
+ * - Hoisted participant identifiers `ECJPAKE_ID_CLIENT` / `ECJPAKE_ID_SERVER`.
+ *
+ * Constant-time guarantees rest on noble's `Point.multiply` implementation; if upstream
+ * drops that property, revisit `EcJpakePms.derive`.
+ *
+ * Internal to `dtls/`; not re-exported from the package public API surface.
+ */
+export { ECJPAKE_ID_CLIENT, ECJPAKE_ID_SERVER, EcJpakeRound } from "./EcJpakeRound.js";
+export type { EcJpakeKeyKP } from "./EcJpakeRound.js";
+export { SchnorrZkp } from "./SchnorrZkp.js";
+export type { SchnorrZkp as SchnorrZkpType } from "./SchnorrZkp.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/cjs/dtls/ecjpake/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/dtls/ecjpake/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACvF,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,YAAY,EAAE,UAAU,IAAI,cAAc,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/cjs/dtls/ecjpake/index.js

@@ -0,0 +1,34 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var ecjpake_exports = {};
+__export(ecjpake_exports, {
+  ECJPAKE_ID_CLIENT: () => import_EcJpakeRound.ECJPAKE_ID_CLIENT,
+  ECJPAKE_ID_SERVER: () => import_EcJpakeRound.ECJPAKE_ID_SERVER,
+  EcJpakeRound: () => import_EcJpakeRound.EcJpakeRound,
+  SchnorrZkp: () => import_SchnorrZkp.SchnorrZkp
+});
+module.exports = __toCommonJS(ecjpake_exports);
+var import_EcJpakeRound = require("./EcJpakeRound.js");
+var import_SchnorrZkp = require("./SchnorrZkp.js");
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+//# sourceMappingURL=index.js.map

package/dist/cjs/dtls/ecjpake/index.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/dtls/ecjpake/index.ts"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAyBA,0BAAmE;AAEnE,wBAA2B;AA3B3B;AAAA;AAAA;AAAA;AAAA;",
+  "names": []
+}

package/dist/cjs/dtls/handshake/ChangeCipherSpec.d.ts

@@ -0,0 +1,23 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * ChangeCipherSpec is *not* a handshake message — it sits at the record layer
+ * under its own ContentType (20) and consists of a single byte 0x01
+ * (RFC 5246 §7.1). The state machine wraps {@link CHANGE_CIPHER_SPEC_BODY}
+ * in a `DtlsRecord` with `type = ContentType.CHANGE_CIPHER_SPEC`, NOT in a
+ * handshake envelope, and the bytes do not feed the handshake-transcript
+ * hash (RFC 5246 §7.4.9).
+ *
+ * Kept as a shared 1-byte buffer so the state machine can pass it directly
+ * to `DtlsRecord.encode` without per-call allocation. (Typed arrays cannot
+ * be `Object.freeze`d while their element storage is live, so the readonly
+ * guarantee is type-only.)
+ */
+export declare const CHANGE_CIPHER_SPEC_BODY: Readonly<Uint8Array>;
+export declare const ChangeCipherSpec: {
+    parse(body: Uint8Array): void;
+};
+//# sourceMappingURL=ChangeCipherSpec.d.ts.map

package/dist/cjs/dtls/handshake/ChangeCipherSpec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ChangeCipherSpec.d.ts","sourceRoot":"","sources":["../../../../src/dtls/handshake/ChangeCipherSpec.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,UAAU,CAA0B,CAAC;AAEpF,eAAO,MAAM,gBAAgB;IACzB,KAAK,OAAO,UAAU,GAAG,IAAI;CAOvB,CAAC"}

package/dist/cjs/dtls/handshake/ChangeCipherSpec.js

@@ -0,0 +1,41 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var ChangeCipherSpec_exports = {};
+__export(ChangeCipherSpec_exports, {
+  CHANGE_CIPHER_SPEC_BODY: () => CHANGE_CIPHER_SPEC_BODY,
+  ChangeCipherSpec: () => ChangeCipherSpec
+});
+module.exports = __toCommonJS(ChangeCipherSpec_exports);
+var import_DtlsChannel = require("../channel/DtlsChannel.js");
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+const CHANGE_CIPHER_SPEC_BODY = new Uint8Array([1]);
+const ChangeCipherSpec = {
+  parse(body) {
+    if (body.length !== 1 || body[0] !== 1) {
+      throw new import_DtlsChannel.DtlsError(
+        `ChangeCipherSpec must be a single 0x01 byte, got len=${body.length} first=${body[0] ?? "undefined"}`
+      );
+    }
+  }
+};
+//# sourceMappingURL=ChangeCipherSpec.js.map

package/dist/cjs/dtls/handshake/ChangeCipherSpec.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/dtls/handshake/ChangeCipherSpec.ts"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,yBAA0B;AAN1B;AAAA;AAAA;AAAA;AAAA;AAqBO,MAAM,0BAAgD,IAAI,WAAW,CAAC,CAAI,CAAC;AAE3E,MAAM,mBAAmB;AAAA,EAC5B,MAAM,MAAwB;AAC1B,QAAI,KAAK,WAAW,KAAK,KAAK,CAAC,MAAM,GAAM;AACvC,YAAM,IAAI;AAAA,QACN,wDAAwD,KAAK,MAAM,UAAU,KAAK,CAAC,KAAK,WAAW;AAAA,MACvG;AAAA,IACJ;AAAA,EACJ;AACJ;",
+  "names": []
+}

package/dist/cjs/dtls/handshake/ClientHelloMessage.d.ts

@@ -0,0 +1,34 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/** TLS extension type for `ecjpake_kkpp` (draft-cragie-tls-ecjpake-01 §3). */
+export declare const EXTENSION_TYPE_ECJPAKE_KKPP = 256;
+/** TLS extension type for `supported_groups` (RFC 8422 §5.1.1, formerly `elliptic_curves`). */
+export declare const EXTENSION_TYPE_SUPPORTED_GROUPS = 10;
+/** TLS extension type for `ec_point_formats` (RFC 8422 §5.1.2). */
+export declare const EXTENSION_TYPE_EC_POINT_FORMATS = 11;
+/** Named-curve identifier for `secp256r1` (P-256, RFC 8422 §5.1.1). */
+export declare const NAMED_CURVE_SECP256R1 = 23;
+/** TLS cipher-suite identifier for `TLS_ECJPAKE_WITH_AES_128_CCM_8` (mbedTLS, experimental). */
+export declare const CIPHER_SUITE_ECJPAKE_WITH_AES_128_CCM_8 = 49407;
+export interface ClientHelloFields {
+    /** 32 random bytes that will become `ClientHello.random`. */
+    random: Uint8Array;
+    /**
+     * DTLS cookie returned by `HelloVerifyRequest`, or empty on the first ClientHello
+     * (RFC 6347 §4.2.1).
+     */
+    cookie: Uint8Array;
+    /** `ecjpake_kkpp` extension payload — the round-1 ECJPAKEKeyKPPairList bytes. */
+    ecjpakeKkpp: Uint8Array;
+}
+export declare const ClientHelloMessage: {
+    /**
+     * Serialise a ClientHello body. Caller wraps the result in a
+     * {@link HandshakeMessage} and a `DtlsRecord` of `ContentType.HANDSHAKE`.
+     */
+    build(fields: ClientHelloFields): Uint8Array;
+};
+//# sourceMappingURL=ClientHelloMessage.d.ts.map

package/dist/cjs/dtls/handshake/ClientHelloMessage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClientHelloMessage.d.ts","sourceRoot":"","sources":["../../../../src/dtls/handshake/ClientHelloMessage.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AA2BH,8EAA8E;AAC9E,eAAO,MAAM,2BAA2B,MAAS,CAAC;AAElD,+FAA+F;AAC/F,eAAO,MAAM,+BAA+B,KAAS,CAAC;AAEtD,mEAAmE;AACnE,eAAO,MAAM,+BAA+B,KAAS,CAAC;AAEtD,uEAAuE;AACvE,eAAO,MAAM,qBAAqB,KAAS,CAAC;AAE5C,gGAAgG;AAChG,eAAO,MAAM,uCAAuC,QAAS,CAAC;AAQ9D,MAAM,WAAW,iBAAiB;IAC9B,6DAA6D;IAC7D,MAAM,EAAE,UAAU,CAAC;IACnB;;;OAGG;IACH,MAAM,EAAE,UAAU,CAAC;IACnB,iFAAiF;IACjF,WAAW,EAAE,UAAU,CAAC;CAC3B;AAOD,eAAO,MAAM,kBAAkB;IAC3B;;;OAGG;IACH,KAAK,SAAS,iBAAiB,GAAG,UAAU;CA2EtC,CAAC"}

package/dist/cjs/dtls/handshake/ClientHelloMessage.js

@@ -0,0 +1,117 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var ClientHelloMessage_exports = {};
+__export(ClientHelloMessage_exports, {
+  CIPHER_SUITE_ECJPAKE_WITH_AES_128_CCM_8: () => CIPHER_SUITE_ECJPAKE_WITH_AES_128_CCM_8,
+  ClientHelloMessage: () => ClientHelloMessage,
+  EXTENSION_TYPE_ECJPAKE_KKPP: () => EXTENSION_TYPE_ECJPAKE_KKPP,
+  EXTENSION_TYPE_EC_POINT_FORMATS: () => EXTENSION_TYPE_EC_POINT_FORMATS,
+  EXTENSION_TYPE_SUPPORTED_GROUPS: () => EXTENSION_TYPE_SUPPORTED_GROUPS,
+  NAMED_CURVE_SECP256R1: () => NAMED_CURVE_SECP256R1
+});
+module.exports = __toCommonJS(ClientHelloMessage_exports);
+var import_general = require("@matter/general");
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+const EXTENSION_TYPE_ECJPAKE_KKPP = 256;
+const EXTENSION_TYPE_SUPPORTED_GROUPS = 10;
+const EXTENSION_TYPE_EC_POINT_FORMATS = 11;
+const NAMED_CURVE_SECP256R1 = 23;
+const CIPHER_SUITE_ECJPAKE_WITH_AES_128_CCM_8 = 49407;
+const DTLS_1_2_MAJOR = 254;
+const DTLS_1_2_MINOR = 253;
+const RANDOM_LEN = 32;
+const COMPRESSION_NULL = 0;
+const MAX_COOKIE_LEN = 255;
+function writeUint16BE(buf, offset, value) {
+  buf[offset] = value >>> 8 & 255;
+  buf[offset + 1] = value & 255;
+}
+const ClientHelloMessage = {
+  /**
+   * Serialise a ClientHello body. Caller wraps the result in a
+   * {@link HandshakeMessage} and a `DtlsRecord` of `ContentType.HANDSHAKE`.
+   */
+  build(fields) {
+    const { random, cookie, ecjpakeKkpp } = fields;
+    if (random.length !== RANDOM_LEN) {
+      throw new import_general.InternalError(`ClientHello random must be ${RANDOM_LEN} bytes, got ${random.length}`);
+    }
+    if (cookie.length > MAX_COOKIE_LEN) {
+      throw new import_general.InternalError(`ClientHello cookie must be <= ${MAX_COOKIE_LEN} bytes, got ${cookie.length}`);
+    }
+    const ecjpakeExtLen = 2 + 2 + ecjpakeKkpp.length;
+    const supportedGroupsExtLen = 2 + 2 + 2 + 2;
+    const ecPointFormatsExtLen = 2 + 2 + 1 + 1;
+    const extEntryLen = ecjpakeExtLen + supportedGroupsExtLen + ecPointFormatsExtLen;
+    const extensionsBlockLen = 2 + extEntryLen;
+    const totalLen = 2 + // version
+    RANDOM_LEN + 1 + // session_id length (always 0)
+    1 + cookie.length + // cookie length + body
+    2 + 2 + // cipher_suites length(2) + 2 bytes for the suite
+    1 + 1 + // compression length(1) + 1 byte (null)
+    extensionsBlockLen;
+    const out = new Uint8Array(totalLen);
+    let p = 0;
+    out[p++] = DTLS_1_2_MAJOR;
+    out[p++] = DTLS_1_2_MINOR;
+    out.set(random, p);
+    p += RANDOM_LEN;
+    out[p++] = 0;
+    out[p++] = cookie.length;
+    out.set(cookie, p);
+    p += cookie.length;
+    writeUint16BE(out, p, 2);
+    p += 2;
+    out[p++] = CIPHER_SUITE_ECJPAKE_WITH_AES_128_CCM_8 >>> 8 & 255;
+    out[p++] = CIPHER_SUITE_ECJPAKE_WITH_AES_128_CCM_8 & 255;
+    out[p++] = 1;
+    out[p++] = COMPRESSION_NULL;
+    writeUint16BE(out, p, extEntryLen);
+    p += 2;
+    writeUint16BE(out, p, EXTENSION_TYPE_ECJPAKE_KKPP);
+    p += 2;
+    writeUint16BE(out, p, ecjpakeKkpp.length);
+    p += 2;
+    out.set(ecjpakeKkpp, p);
+    p += ecjpakeKkpp.length;
+    writeUint16BE(out, p, EXTENSION_TYPE_SUPPORTED_GROUPS);
+    p += 2;
+    writeUint16BE(out, p, 4);
+    p += 2;
+    writeUint16BE(out, p, 2);
+    p += 2;
+    writeUint16BE(out, p, NAMED_CURVE_SECP256R1);
+    p += 2;
+    writeUint16BE(out, p, EXTENSION_TYPE_EC_POINT_FORMATS);
+    p += 2;
+    writeUint16BE(out, p, 2);
+    p += 2;
+    out[p++] = 1;
+    out[p++] = 0;
+    if (p !== totalLen) {
+      throw new import_general.InternalError(`ClientHello internal length mismatch: wrote ${p}, expected ${totalLen}`);
+    }
+    return out;
+  }
+};
+//# sourceMappingURL=ClientHelloMessage.js.map

package/dist/cjs/dtls/handshake/ClientHelloMessage.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/dtls/handshake/ClientHelloMessage.ts"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA6BA,qBAA8B;AA7B9B;AAAA;AAAA;AAAA;AAAA;AAgCO,MAAM,8BAA8B;AAGpC,MAAM,kCAAkC;AAGxC,MAAM,kCAAkC;AAGxC,MAAM,wBAAwB;AAG9B,MAAM,0CAA0C;AAEvD,MAAM,iBAAiB;AACvB,MAAM,iBAAiB;AACvB,MAAM,aAAa;AACnB,MAAM,mBAAmB;AACzB,MAAM,iBAAiB;AAcvB,SAAS,cAAc,KAAiB,QAAgB,OAAqB;AACzE,MAAI,MAAM,IAAK,UAAU,IAAK;AAC9B,MAAI,SAAS,CAAC,IAAI,QAAQ;AAC9B;AAEO,MAAM,qBAAqB;AAAA;AAAA;AAAA;AAAA;AAAA,EAK9B,MAAM,QAAuC;AACzC,UAAM,EAAE,QAAQ,QAAQ,YAAY,IAAI;AACxC,QAAI,OAAO,WAAW,YAAY;AAC9B,YAAM,IAAI,6BAAc,8BAA8B,UAAU,eAAe,OAAO,MAAM,EAAE;AAAA,IAClG;AACA,QAAI,OAAO,SAAS,gBAAgB;AAChC,YAAM,IAAI,6BAAc,iCAAiC,cAAc,eAAe,OAAO,MAAM,EAAE;AAAA,IACzG;AACA,UAAM,gBAAgB,IAAI,IAAI,YAAY;AAC1C,UAAM,wBAAwB,IAAI,IAAI,IAAI;AAC1C,UAAM,uBAAuB,IAAI,IAAI,IAAI;AACzC,UAAM,cAAc,gBAAgB,wBAAwB;AAC5D,UAAM,qBAAqB,IAAI;AAE/B,UAAM,WACF;AAAA,IACA,aACA;AAAA,IACA,IACA,OAAO;AAAA,IACP,IACA;AAAA,IACA,IACA;AAAA,IACA;AAEJ,UAAM,MAAM,IAAI,WAAW,QAAQ;AACnC,QAAI,IAAI;AACR,QAAI,GAAG,IAAI;AACX,QAAI,GAAG,IAAI;AACX,QAAI,IAAI,QAAQ,CAAC;AACjB,SAAK;AACL,QAAI,GAAG,IAAI;AACX,QAAI,GAAG,IAAI,OAAO;AAClB,QAAI,IAAI,QAAQ,CAAC;AACjB,SAAK,OAAO;AAEZ,kBAAc,KAAK,GAAG,CAAC;AACvB,SAAK;AACL,QAAI,GAAG,IAAK,4CAA4C,IAAK;AAC7D,QAAI,GAAG,IAAI,0CAA0C;AAErD,QAAI,GAAG,IAAI;AACX,QAAI,GAAG,IAAI;AAEX,kBAAc,KAAK,GAAG,WAAW;AACjC,SAAK;AAEL,kBAAc,KAAK,GAAG,2BAA2B;AACjD,SAAK;AACL,kBAAc,KAAK,GAAG,YAAY,MAAM;AACxC,SAAK;AACL,QAAI,IAAI,aAAa,CAAC;AACtB,SAAK,YAAY;AAEjB,kBAAc,KAAK,GAAG,+BAA+B;AACrD,SAAK;AACL,kBAAc,KAAK,GAAG,CAAC;AACvB,SAAK;AACL,kBAAc,KAAK,GAAG,CAAC;AACvB,SAAK;AACL,kBAAc,KAAK,GAAG,qBAAqB;AAC3C,SAAK;AAEL,kBAAc,KAAK,GAAG,+BAA+B;AACrD,SAAK;AACL,kBAAc,KAAK,GAAG,CAAC;AACvB,SAAK;AACL,QAAI,GAAG,IAAI;AACX,QAAI,GAAG,IAAI;AACX,QAAI,MAAM,UAAU;AAChB,YAAM,IAAI,6BAAc,+CAA+C,CAAC,cAAc,QAAQ,EAAE;AAAA,IACpG;AACA,WAAO;AAAA,EACX;AACJ;",
+  "names": []
+}

package/dist/cjs/dtls/handshake/ClientKeyExchangeMessage.d.ts

@@ -0,0 +1,22 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type EcJpakeKeyKP } from "../ecjpake/EcJpakeRound.js";
+/**
+ * ClientKeyExchange body builder for `TLS_ECJPAKE_WITH_AES_128_CCM_8`
+ * (mbedTLS `ssl_tls12_client.c:2618-2635`).
+ *
+ * Wire layout — `ECJPAKEKeyKP` only, no ECParameters prefix (the asymmetry
+ * vs. ServerKeyExchange is documented in
+ * `2026-04-29-thread-meshcop-dtls-architecture-notes.md` §2):
+ *
+ * ```
+ * ECJPAKEKeyKP client_round2        // 1 + 65 + 1 + 65 + 1 + |r| bytes
+ * ```
+ */
+export declare const ClientKeyExchangeMessage: {
+    build(kp: EcJpakeKeyKP): Uint8Array;
+};
+//# sourceMappingURL=ClientKeyExchangeMessage.d.ts.map

package/dist/cjs/dtls/handshake/ClientKeyExchangeMessage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClientKeyExchangeMessage.d.ts","sourceRoot":"","sources":["../../../../src/dtls/handshake/ClientKeyExchangeMessage.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,KAAK,YAAY,EAAgB,MAAM,4BAA4B,CAAC;AAE7E;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,wBAAwB;IACjC,KAAK,KAAK,YAAY,GAAG,UAAU;CAG7B,CAAC"}

package/dist/cjs/dtls/handshake/ClientKeyExchangeMessage.js

@@ -0,0 +1,35 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var ClientKeyExchangeMessage_exports = {};
+__export(ClientKeyExchangeMessage_exports, {
+  ClientKeyExchangeMessage: () => ClientKeyExchangeMessage
+});
+module.exports = __toCommonJS(ClientKeyExchangeMessage_exports);
+var import_EcJpakeRound = require("../ecjpake/EcJpakeRound.js");
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+const ClientKeyExchangeMessage = {
+  build(kp) {
+    return import_EcJpakeRound.EcJpakeRound.serializeRound2(kp, { prependEcParameters: false });
+  }
+};
+//# sourceMappingURL=ClientKeyExchangeMessage.js.map

package/dist/cjs/dtls/handshake/ClientKeyExchangeMessage.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/dtls/handshake/ClientKeyExchangeMessage.ts"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,0BAAgD;AANhD;AAAA;AAAA;AAAA;AAAA;AAoBO,MAAM,2BAA2B;AAAA,EACpC,MAAM,IAA8B;AAChC,WAAO,iCAAa,gBAAgB,IAAI,EAAE,qBAAqB,MAAM,CAAC;AAAA,EAC1E;AACJ;",
+  "names": []
+}

package/dist/cjs/dtls/handshake/DtlsClient.d.ts

@@ -0,0 +1,57 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { DtlsCipherState } from "../record/DtlsCipherState.js";
+/**
+ * DTLS 1.2 client-side handshake state machine for
+ * `TLS_ECJPAKE_WITH_AES_128_CCM_8` (RFC 6347, RFC 5246, RFC 6655,
+ * draft-cragie-tls-ecjpake-01).
+ *
+ * In scope (Phase 3 sub-batch 3): transport-agnostic flight assembly,
+ * cookie exchange, transcript + key derivation, Finished verification,
+ * retransmit emission. Out of scope: UDP socket binding (sub-batch 5),
+ * server-side state machine, application-data flow.
+ *
+ * Transcript reset on cookie exchange — RFC 6347 §4.2.6 says the FIRST
+ * ClientHello and HelloVerifyRequest are NOT in the transcript; the
+ * transcript begins with the SECOND ClientHello (also mbedTLS's behaviour,
+ * `library/ssl_msg.c` reset on `mbedtls_ssl_reset_checksum`).
+ */
+/** Discriminated states the client traverses during the handshake. */
+export type DtlsClientState = "initial" | "sent_first_clienthello" | "sent_clienthello_with_cookie" | "received_serverhello_flight" | "sent_clientkeyexchange_flight" | "established" | "failed";
+export interface DtlsClientConfig {
+    /** EC-JPAKE password (PSKc bytes for Thread). Hashed by mbedTLS as the integer of these bytes. */
+    password: Uint8Array;
+    /** Returns 32 bytes for `ClientHello.random`. Production: CSPRNG. */
+    random: () => Uint8Array;
+    /**
+     * Returns a fresh scalar in [1, n-1]. Called five times per attempt:
+     * x1, x2 (round-1 private keys), v1, v2 (round-1 ZKP ephemerals), v3 (round-2 ZKP ephemeral).
+     */
+    ephemeralScalar: () => bigint;
+    /** Initial retransmit timeout in ms (RFC 6347 §4.2.4). Default 1000. */
+    initialRetransmitMs?: number;
+    /** Retransmit cap in ms (RFC 6347 §4.2.4 — exponential doubling, capped). Default 60000. */
+    maxRetransmitMs?: number;
+    /** Path MTU advisory (not enforced — flights are below 1280 in practice). */
+    mtu?: number;
+}
+export interface DtlsClientStep {
+    /** Records to emit on the wire (already framed as DTLS records). */
+    records: Uint8Array[];
+}
+export declare class DtlsClient {
+    #private;
+    constructor(config: DtlsClientConfig);
+    state(): DtlsClientState;
+    isEstablished(): boolean;
+    cipherState(): DtlsCipherState;
+    /** Initial flight: ClientHello with empty cookie. */
+    start(): DtlsClientStep;
+    /** Re-emit the last flight bytes-identically (RFC 6347 §4.2.4). */
+    onRetransmit(): DtlsClientStep;
+    onDatagram(bytes: Uint8Array): DtlsClientStep;
+}
+//# sourceMappingURL=DtlsClient.d.ts.map

package/dist/cjs/dtls/handshake/DtlsClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DtlsClient.d.ts","sourceRoot":"","sources":["../../../../src/dtls/handshake/DtlsClient.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAUH,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAa/D;;;;;;;;;;;;;;GAcG;AAEH,sEAAsE;AACtE,MAAM,MAAM,eAAe,GACrB,SAAS,GACT,wBAAwB,GACxB,8BAA8B,GAC9B,6BAA6B,GAC7B,+BAA+B,GAC/B,aAAa,GACb,QAAQ,CAAC;AAEf,MAAM,WAAW,gBAAgB;IAC7B,kGAAkG;IAClG,QAAQ,EAAE,UAAU,CAAC;IACrB,qEAAqE;IACrE,MAAM,EAAE,MAAM,UAAU,CAAC;IACzB;;;OAGG;IACH,eAAe,EAAE,MAAM,MAAM,CAAC;IAC9B,wEAAwE;IACxE,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,4FAA4F;IAC5F,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,6EAA6E;IAC7E,GAAG,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC3B,oEAAoE;IACpE,OAAO,EAAE,UAAU,EAAE,CAAC;CACzB;AA0BD,qBAAa,UAAU;;IAyBnB,YAAY,MAAM,EAAE,gBAAgB,EAEnC;IAED,KAAK,IAAI,eAAe,CAEvB;IAED,aAAa,IAAI,OAAO,CAEvB;IAED,WAAW,IAAI,eAAe,CAO7B;IAED,qDAAqD;IACrD,KAAK,IAAI,cAAc,CAwBtB;IAED,mEAAmE;IACnE,YAAY,IAAI,cAAc,CAK7B;IAED,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,cAAc,CAuB5C;CA0YJ"}