@matter/thread-br-client 0.0.1

package/dist/cjs/dtls/prf/HandshakeTranscript.d.ts

@@ -0,0 +1,36 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * Running SHA-256 over the DTLS 1.2 handshake transcript that feeds the
+ * Finished MAC (RFC 5246 §7.4.9). The transcript covers every handshake
+ * message from the initial ClientHello up to (and EXCLUDING) the Finished
+ * being computed or verified.
+ *
+ * Callers feed the **full DTLS 1.2 handshake message bytes** (12-byte header
+ * including `message_seq` / `fragment_offset` / `fragment_length`, then body).
+ * mbedTLS — and OpenThread BRs built on it — hash the full DTLS form;
+ * stripping the DTLS-only fields makes the Finished MAC mismatch.
+ * `fragment_offset`/`fragment_length` are normalised to the unfragmented form
+ * regardless of how the message was actually fragmented on the wire (RFC 6347
+ * §4.2.6).
+ *
+ * Internal to `dtls/`; not re-exported from the package public API surface.
+ */
+export declare class HandshakeTranscript {
+    #private;
+    /**
+     * Append a handshake message in DTLS 1.2 form
+     * (`type(1) || length(3) || message_seq(2) || fragment_offset(3) || fragment_length(3) || body`).
+     */
+    appendHandshakeMessage(messageBytes: Uint8Array): void;
+    /**
+     * Snapshot the running SHA-256 digest without disturbing the transcript so
+     * the same accumulator can compute Finished for both peers and continue
+     * absorbing later messages. Backed by `Hash.copy()` (Node.js >= 13.10).
+     */
+    digest(): Uint8Array;
+}
+//# sourceMappingURL=HandshakeTranscript.d.ts.map

package/dist/cjs/dtls/prf/HandshakeTranscript.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"HandshakeTranscript.d.ts","sourceRoot":"","sources":["../../../../src/dtls/prf/HandshakeTranscript.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAOH;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,mBAAmB;;IAG5B;;;OAGG;IACH,sBAAsB,CAAC,YAAY,EAAE,UAAU,GAAG,IAAI,CAErD;IAED;;;;OAIG;IACH,MAAM,IAAI,UAAU,CAOnB;CACJ"}

package/dist/cjs/dtls/prf/HandshakeTranscript.js

@@ -0,0 +1,55 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var HandshakeTranscript_exports = {};
+__export(HandshakeTranscript_exports, {
+  HandshakeTranscript: () => HandshakeTranscript
+});
+module.exports = __toCommonJS(HandshakeTranscript_exports);
+var import_general = require("@matter/general");
+var import_node_crypto = require("node:crypto");
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+const SHA256_LEN = 32;
+class HandshakeTranscript {
+  #hash = (0, import_node_crypto.createHash)("sha256");
+  /**
+   * Append a handshake message in DTLS 1.2 form
+   * (`type(1) || length(3) || message_seq(2) || fragment_offset(3) || fragment_length(3) || body`).
+   */
+  appendHandshakeMessage(messageBytes) {
+    this.#hash.update(messageBytes);
+  }
+  /**
+   * Snapshot the running SHA-256 digest without disturbing the transcript so
+   * the same accumulator can compute Finished for both peers and continue
+   * absorbing later messages. Backed by `Hash.copy()` (Node.js >= 13.10).
+   */
+  digest() {
+    const snapshot = this.#hash.copy();
+    const out = new Uint8Array(snapshot.digest());
+    if (out.length !== SHA256_LEN) {
+      throw new import_general.InternalError(`HandshakeTranscript digest length ${out.length} != ${SHA256_LEN}`);
+    }
+    return out;
+  }
+}
+//# sourceMappingURL=HandshakeTranscript.js.map

package/dist/cjs/dtls/prf/HandshakeTranscript.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/dtls/prf/HandshakeTranscript.ts"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,qBAA8B;AAC9B,yBAAsC;AAPtC;AAAA;AAAA;AAAA;AAAA;AASA,MAAM,aAAa;AAkBZ,MAAM,oBAAoB;AAAA,EAC7B,YAAc,+BAAW,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA,EAMjC,uBAAuB,cAAgC;AACnD,SAAK,MAAM,OAAO,YAAY;AAAA,EAClC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,SAAqB;AACjB,UAAM,WAAW,KAAK,MAAM,KAAK;AACjC,UAAM,MAAM,IAAI,WAAW,SAAS,OAAO,CAAC;AAC5C,QAAI,IAAI,WAAW,YAAY;AAC3B,YAAM,IAAI,6BAAc,qCAAqC,IAAI,MAAM,OAAO,UAAU,EAAE;AAAA,IAC9F;AACA,WAAO;AAAA,EACX;AACJ;",
+  "names": []
+}

package/dist/cjs/dtls/prf/TlsPrf.d.ts

@@ -0,0 +1,82 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * TLS 1.2 pseudo-random function (RFC 5246 §5) using HMAC-SHA256 — the only PRF
+ * permitted for `TLS_ECJPAKE_WITH_AES_128_CCM_8` (RFC 6655 §3). Mirrors mbedTLS
+ * v3.6.6 `tls_prf_sha256` / `tls_prf_generic`.
+ *
+ * Internal to `dtls/`; not re-exported from the package public API surface.
+ */
+export declare namespace TlsPrf {
+    /**
+     * P_SHA256 expansion as defined in RFC 5246 §5:
+     *
+     *   P_hash(secret, seed) = HMAC_hash(secret, A(1) || seed) ||
+     *                          HMAC_hash(secret, A(2) || seed) || ...
+     *
+     * with `A(0) = seed`, `A(i) = HMAC_hash(secret, A(i-1))`. The TLS 1.2 PRF
+     * over (label, seed) is `P_SHA256(secret, label || seed)` — label bytes are
+     * concatenated with the seed (no length prefix). The label is ASCII per
+     * RFC 5246; we encode it as UTF-8 which coincides for ASCII-only input.
+     */
+    function compute(args: {
+        secret: Uint8Array;
+        label: string;
+        seed: Uint8Array;
+        outputLength: number;
+    }): Uint8Array;
+    /**
+     * `master_secret = PRF(pre_master_secret, "master secret",
+     *                      ClientHello.random || ServerHello.random)[0..47]`
+     * (RFC 5246 §8.1).
+     */
+    function masterSecret(args: {
+        premasterSecret: Uint8Array;
+        clientRandom: Uint8Array;
+        serverRandom: Uint8Array;
+    }): Uint8Array;
+    /**
+     * Slices of the 40-byte key block for `TLS_ECJPAKE_WITH_AES_128_CCM_8`
+     * (AEAD, no MAC keys; RFC 6655 §3, RFC 5246 §6.3).
+     */
+    interface KeyBlock {
+        clientWriteKey: Uint8Array;
+        serverWriteKey: Uint8Array;
+        clientWriteIv: Uint8Array;
+        serverWriteIv: Uint8Array;
+    }
+    /**
+     * `key_block = PRF(master_secret, "key expansion",
+     *                  ServerHello.random || ClientHello.random)[0..39]`
+     * (RFC 5246 §6.3). Note the seed order is REVERSED relative to
+     * {@link masterSecret} (server then client) — see mbedTLS ssl_tls.c v3.6.6
+     * "Swap the client and server random values" (RFC 5246 6.3 vs 8.1).
+     *
+     * For `TLS_ECJPAKE_WITH_AES_128_CCM_8` the layout is:
+     * `client_write_key (16) || server_write_key (16) ||
+     *  client_write_IV (4)  || server_write_IV (4)`.
+     */
+    function keyBlock(args: {
+        masterSecret: Uint8Array;
+        clientRandom: Uint8Array;
+        serverRandom: Uint8Array;
+    }): KeyBlock;
+    /**
+     * Finished `verify_data` (RFC 5246 §7.4.9):
+     *
+     *   verify_data = PRF(master_secret, finished_label,
+     *                     Hash(handshake_messages))[0..11]
+     *
+     * with `finished_label = "client finished"` for the client-sent Finished
+     * and `"server finished"` for the server-sent one.
+     */
+    function verifyData(args: {
+        masterSecret: Uint8Array;
+        role: "client" | "server";
+        transcriptDigest: Uint8Array;
+    }): Uint8Array;
+}
+//# sourceMappingURL=TlsPrf.d.ts.map

package/dist/cjs/dtls/prf/TlsPrf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TlsPrf.d.ts","sourceRoot":"","sources":["../../../../src/dtls/prf/TlsPrf.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAqDH;;;;;;GAMG;AACH,yBAAiB,MAAM,CAAC,CAAC;IACrB;;;;;;;;;;OAUG;IACH,SAAgB,OAAO,CAAC,IAAI,EAAE;QAC1B,MAAM,EAAE,UAAU,CAAC;QACnB,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,UAAU,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;KACxB,GAAG,UAAU,CAOb;IAED;;;;OAIG;IACH,SAAgB,YAAY,CAAC,IAAI,EAAE;QAC/B,eAAe,EAAE,UAAU,CAAC;QAC5B,YAAY,EAAE,UAAU,CAAC;QACzB,YAAY,EAAE,UAAU,CAAC;KAC5B,GAAG,UAAU,CAQb;IAED;;;OAGG;IACH,UAAiB,QAAQ;QACrB,cAAc,EAAE,UAAU,CAAC;QAC3B,cAAc,EAAE,UAAU,CAAC;QAC3B,aAAa,EAAE,UAAU,CAAC;QAC1B,aAAa,EAAE,UAAU,CAAC;KAC7B;IAED;;;;;;;;;;OAUG;IACH,SAAgB,QAAQ,CAAC,IAAI,EAAE;QAC3B,YAAY,EAAE,UAAU,CAAC;QACzB,YAAY,EAAE,UAAU,CAAC;QACzB,YAAY,EAAE,UAAU,CAAC;KAC5B,GAAG,QAAQ,CAeX;IAED;;;;;;;;OAQG;IACH,SAAgB,UAAU,CAAC,IAAI,EAAE;QAC7B,YAAY,EAAE,UAAU,CAAC;QACzB,IAAI,EAAE,QAAQ,GAAG,QAAQ,CAAC;QAC1B,gBAAgB,EAAE,UAAU,CAAC;KAChC,GAAG,UAAU,CAMb;CACJ"}

package/dist/cjs/dtls/prf/TlsPrf.js

@@ -0,0 +1,121 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var TlsPrf_exports = {};
+__export(TlsPrf_exports, {
+  TlsPrf: () => TlsPrf
+});
+module.exports = __toCommonJS(TlsPrf_exports);
+var import_general = require("@matter/general");
+var import_node_crypto = require("node:crypto");
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+const SHA256_LEN = 32;
+const MASTER_SECRET_LEN = 48;
+const RANDOM_LEN = 32;
+const KEY_LEN = 16;
+const IV_LEN = 4;
+const KEY_BLOCK_LEN = KEY_LEN * 2 + IV_LEN * 2;
+const VERIFY_DATA_LEN = 12;
+const ASCII_ENCODER = new TextEncoder();
+function hmacSha256(key, data) {
+  const hmac = (0, import_node_crypto.createHmac)("sha256", key);
+  hmac.update(data);
+  return new Uint8Array(hmac.digest());
+}
+function expectLength(name, value, expected) {
+  if (value.length !== expected) {
+    throw new import_general.InternalError(`TlsPrf ${name} must be ${expected} bytes, got ${value.length}`);
+  }
+}
+function pSha256(secret, seed, outputLength) {
+  if (outputLength < 0) {
+    throw new import_general.InternalError(`TlsPrf outputLength must be non-negative, got ${outputLength}`);
+  }
+  const out = new Uint8Array(outputLength);
+  if (outputLength === 0) {
+    return out;
+  }
+  let a = hmacSha256(secret, seed);
+  const block = new Uint8Array(SHA256_LEN + seed.length);
+  block.set(seed, SHA256_LEN);
+  let written = 0;
+  while (written < outputLength) {
+    block.set(a, 0);
+    const next = hmacSha256(secret, block);
+    const remaining = outputLength - written;
+    const copyLen = Math.min(SHA256_LEN, remaining);
+    out.set(next.subarray(0, copyLen), written);
+    written += copyLen;
+    if (written < outputLength) {
+      a = hmacSha256(secret, a);
+    }
+  }
+  return out;
+}
+var TlsPrf;
+((TlsPrf2) => {
+  function compute(args) {
+    const { secret, label, seed, outputLength } = args;
+    const labelBytes = ASCII_ENCODER.encode(label);
+    const combined = new Uint8Array(labelBytes.length + seed.length);
+    combined.set(labelBytes, 0);
+    combined.set(seed, labelBytes.length);
+    return pSha256(secret, combined, outputLength);
+  }
+  TlsPrf2.compute = compute;
+  function masterSecret(args) {
+    const { premasterSecret, clientRandom, serverRandom } = args;
+    expectLength("clientRandom", clientRandom, RANDOM_LEN);
+    expectLength("serverRandom", serverRandom, RANDOM_LEN);
+    const seed = new Uint8Array(RANDOM_LEN * 2);
+    seed.set(clientRandom, 0);
+    seed.set(serverRandom, RANDOM_LEN);
+    return compute({ secret: premasterSecret, label: "master secret", seed, outputLength: MASTER_SECRET_LEN });
+  }
+  TlsPrf2.masterSecret = masterSecret;
+  function keyBlock(args) {
+    const { masterSecret: ms, clientRandom, serverRandom } = args;
+    expectLength("masterSecret", ms, MASTER_SECRET_LEN);
+    expectLength("clientRandom", clientRandom, RANDOM_LEN);
+    expectLength("serverRandom", serverRandom, RANDOM_LEN);
+    const seed = new Uint8Array(RANDOM_LEN * 2);
+    seed.set(serverRandom, 0);
+    seed.set(clientRandom, RANDOM_LEN);
+    const block = compute({ secret: ms, label: "key expansion", seed, outputLength: KEY_BLOCK_LEN });
+    return {
+      clientWriteKey: block.slice(0, KEY_LEN),
+      serverWriteKey: block.slice(KEY_LEN, KEY_LEN * 2),
+      clientWriteIv: block.slice(KEY_LEN * 2, KEY_LEN * 2 + IV_LEN),
+      serverWriteIv: block.slice(KEY_LEN * 2 + IV_LEN, KEY_BLOCK_LEN)
+    };
+  }
+  TlsPrf2.keyBlock = keyBlock;
+  function verifyData(args) {
+    const { masterSecret: ms, role, transcriptDigest } = args;
+    expectLength("masterSecret", ms, MASTER_SECRET_LEN);
+    expectLength("transcriptDigest", transcriptDigest, SHA256_LEN);
+    const label = role === "client" ? "client finished" : "server finished";
+    return compute({ secret: ms, label, seed: transcriptDigest, outputLength: VERIFY_DATA_LEN });
+  }
+  TlsPrf2.verifyData = verifyData;
+})(TlsPrf || (TlsPrf = {}));
+//# sourceMappingURL=TlsPrf.js.map

package/dist/cjs/dtls/prf/TlsPrf.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/dtls/prf/TlsPrf.ts"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,qBAA8B;AAC9B,yBAA2B;AAP3B;AAAA;AAAA;AAAA;AAAA;AASA,MAAM,aAAa;AACnB,MAAM,oBAAoB;AAC1B,MAAM,aAAa;AACnB,MAAM,UAAU;AAChB,MAAM,SAAS;AACf,MAAM,gBAAgB,UAAU,IAAI,SAAS;AAC7C,MAAM,kBAAkB;AAExB,MAAM,gBAAgB,IAAI,YAAY;AAEtC,SAAS,WAAW,KAAiB,MAA8B;AAC/D,QAAM,WAAO,+BAAW,UAAU,GAAG;AACrC,OAAK,OAAO,IAAI;AAChB,SAAO,IAAI,WAAW,KAAK,OAAO,CAAC;AACvC;AAEA,SAAS,aAAa,MAAc,OAAmB,UAAwB;AAC3E,MAAI,MAAM,WAAW,UAAU;AAC3B,UAAM,IAAI,6BAAc,UAAU,IAAI,YAAY,QAAQ,eAAe,MAAM,MAAM,EAAE;AAAA,EAC3F;AACJ;AAEA,SAAS,QAAQ,QAAoB,MAAkB,cAAkC;AACrF,MAAI,eAAe,GAAG;AAClB,UAAM,IAAI,6BAAc,iDAAiD,YAAY,EAAE;AAAA,EAC3F;AACA,QAAM,MAAM,IAAI,WAAW,YAAY;AACvC,MAAI,iBAAiB,GAAG;AACpB,WAAO;AAAA,EACX;AACA,MAAI,IAAI,WAAW,QAAQ,IAAI;AAC/B,QAAM,QAAQ,IAAI,WAAW,aAAa,KAAK,MAAM;AACrD,QAAM,IAAI,MAAM,UAAU;AAC1B,MAAI,UAAU;AACd,SAAO,UAAU,cAAc;AAC3B,UAAM,IAAI,GAAG,CAAC;AACd,UAAM,OAAO,WAAW,QAAQ,KAAK;AACrC,UAAM,YAAY,eAAe;AACjC,UAAM,UAAU,KAAK,IAAI,YAAY,SAAS;AAC9C,QAAI,IAAI,KAAK,SAAS,GAAG,OAAO,GAAG,OAAO;AAC1C,eAAW;AACX,QAAI,UAAU,cAAc;AACxB,UAAI,WAAW,QAAQ,CAAC;AAAA,IAC5B;AAAA,EACJ;AACA,SAAO;AACX;AASO,IAAU;AAAA,CAAV,CAAUA,YAAV;AAYI,WAAS,QAAQ,MAKT;AACX,UAAM,EAAE,QAAQ,OAAO,MAAM,aAAa,IAAI;AAC9C,UAAM,aAAa,cAAc,OAAO,KAAK;AAC7C,UAAM,WAAW,IAAI,WAAW,WAAW,SAAS,KAAK,MAAM;AAC/D,aAAS,IAAI,YAAY,CAAC;AAC1B,aAAS,IAAI,MAAM,WAAW,MAAM;AACpC,WAAO,QAAQ,QAAQ,UAAU,YAAY;AAAA,EACjD;AAZO,EAAAA,QAAS;AAmBT,WAAS,aAAa,MAId;AACX,UAAM,EAAE,iBAAiB,cAAc,aAAa,IAAI;AACxD,iBAAa,gBAAgB,cAAc,UAAU;AACrD,iBAAa,gBAAgB,cAAc,UAAU;AACrD,UAAM,OAAO,IAAI,WAAW,aAAa,CAAC;AAC1C,SAAK,IAAI,cAAc,CAAC;AACxB,SAAK,IAAI,cAAc,UAAU;AACjC,WAAO,QAAQ,EAAE,QAAQ,iBAAiB,OAAO,iBAAiB,MAAM,cAAc,kBAAkB,CAAC;AAAA,EAC7G;AAZO,EAAAA,QAAS;AAoCT,WAAS,SAAS,MAIZ;AACT,UAAM,EAAE,cAAc,IAAI,cAAc,aAAa,IAAI;AACzD,iBAAa,gBAAgB,IAAI,iBAAiB;AAClD,iBAAa,gBAAgB,cAAc,UAAU;AACrD,iBAAa,gBAAgB,cAAc,UAAU;AACrD,UAAM,OAAO,IAAI,WAAW,aAAa,CAAC;AAC1C,SAAK,IAAI,cAAc,CAAC;AACxB,SAAK,IAAI,cAAc,UAAU;AACjC,UAAM,QAAQ,QAAQ,EAAE,QAAQ,IAAI,OAAO,iBAAiB,MAAM,cAAc,cAAc,CAAC;AAC/F,WAAO;AAAA,MACH,gBAAgB,MAAM,MAAM,GAAG,OAAO;AAAA,MACtC,gBAAgB,MAAM,MAAM,SAAS,UAAU,CAAC;AAAA,MAChD,eAAe,MAAM,MAAM,UAAU,GAAG,UAAU,IAAI,MAAM;AAAA,MAC5D,eAAe,MAAM,MAAM,UAAU,IAAI,QAAQ,aAAa;AAAA,IAClE;AAAA,EACJ;AAnBO,EAAAA,QAAS;AA8BT,WAAS,WAAW,MAIZ;AACX,UAAM,EAAE,cAAc,IAAI,MAAM,iBAAiB,IAAI;AACrD,iBAAa,gBAAgB,IAAI,iBAAiB;AAClD,iBAAa,oBAAoB,kBAAkB,UAAU;AAC7D,UAAM,QAAQ,SAAS,WAAW,oBAAoB;AACtD,WAAO,QAAQ,EAAE,QAAQ,IAAI,OAAO,MAAM,kBAAkB,cAAc,gBAAgB,CAAC;AAAA,EAC/F;AAVO,EAAAA,QAAS;AAAA,GAjGH;",
+  "names": ["TlsPrf"]
+}

package/dist/cjs/dtls/prf/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * TLS 1.2 PRF (P_SHA256) and SHA-256 handshake-transcript helpers used by the
+ * DTLS 1.2 layer. Internal to `dtls/`; not re-exported from the package public
+ * API surface until the {@link DtlsChannel} interface ships in sub-batch 5.
+ */
+export { HandshakeTranscript } from "./HandshakeTranscript.js";
+export { TlsPrf } from "./TlsPrf.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/cjs/dtls/prf/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/dtls/prf/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;GAIG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC"}

package/dist/cjs/dtls/prf/index.js

@@ -0,0 +1,32 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var prf_exports = {};
+__export(prf_exports, {
+  HandshakeTranscript: () => import_HandshakeTranscript.HandshakeTranscript,
+  TlsPrf: () => import_TlsPrf.TlsPrf
+});
+module.exports = __toCommonJS(prf_exports);
+var import_HandshakeTranscript = require("./HandshakeTranscript.js");
+var import_TlsPrf = require("./TlsPrf.js");
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+//# sourceMappingURL=index.js.map

package/dist/cjs/dtls/prf/index.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/dtls/prf/index.ts"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAYA,iCAAoC;AACpC,oBAAuB;AAbvB;AAAA;AAAA;AAAA;AAAA;",
+  "names": []
+}

package/dist/cjs/dtls/record/AesCcm8.d.ts

@@ -0,0 +1,32 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * AES-128-CCM with an 8-octet authentication tag, the AEAD primitive used by the
+ * `TLS_ECJPAKE_WITH_AES_128_CCM_8` cipher suite (RFC 6655 §3, RFC 3610).
+ *
+ * Wraps Node's `aes-128-ccm` with a fixed 8-byte tag length and returns
+ * `ciphertext || tag` to match the wire layout expected by the DTLS record layer.
+ *
+ * The 12-byte nonce length implies CCM L=3 (15 - 12), giving a 2^24 byte payload
+ * limit per record — well above the DTLS 16 KiB record cap.
+ */
+export declare namespace AesCcm8 {
+    interface EncryptArgs {
+        key: Uint8Array;
+        nonce: Uint8Array;
+        aad: Uint8Array;
+        plaintext: Uint8Array;
+    }
+    interface DecryptArgs {
+        key: Uint8Array;
+        nonce: Uint8Array;
+        aad: Uint8Array;
+        ciphertextWithTag: Uint8Array;
+    }
+    function encrypt({ key, nonce, aad, plaintext }: EncryptArgs): Uint8Array;
+    function decrypt({ key, nonce, aad, ciphertextWithTag }: DecryptArgs): Uint8Array;
+}
+//# sourceMappingURL=AesCcm8.d.ts.map

package/dist/cjs/dtls/record/AesCcm8.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AesCcm8.d.ts","sourceRoot":"","sources":["../../../../src/dtls/record/AesCcm8.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AASH;;;;;;;;;GASG;AACH,yBAAiB,OAAO,CAAC,CAAC;IACtB,UAAiB,WAAW;QACxB,GAAG,EAAE,UAAU,CAAC;QAChB,KAAK,EAAE,UAAU,CAAC;QAClB,GAAG,EAAE,UAAU,CAAC;QAChB,SAAS,EAAE,UAAU,CAAC;KACzB;IAED,UAAiB,WAAW;QACxB,GAAG,EAAE,UAAU,CAAC;QAChB,KAAK,EAAE,UAAU,CAAC;QAClB,GAAG,EAAE,UAAU,CAAC;QAChB,iBAAiB,EAAE,UAAU,CAAC;KACjC;IAED,SAAgB,OAAO,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,WAAW,GAAG,UAAU,CAiB/E;IAED,SAAgB,OAAO,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,iBAAiB,EAAE,EAAE,WAAW,GAAG,UAAU,CAwBvF;CACJ"}

package/dist/cjs/dtls/record/AesCcm8.js

@@ -0,0 +1,78 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var AesCcm8_exports = {};
+__export(AesCcm8_exports, {
+  AesCcm8: () => AesCcm8
+});
+module.exports = __toCommonJS(AesCcm8_exports);
+var import_general = require("@matter/general");
+var import_node_crypto = require("node:crypto");
+var import_DtlsChannel = require("../channel/DtlsChannel.js");
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+const KEY_LEN = 16;
+const TAG_LEN = 8;
+var AesCcm8;
+((AesCcm82) => {
+  function encrypt({ key, nonce, aad, plaintext }) {
+    if (key.length !== KEY_LEN) {
+      throw new import_general.InternalError(`AES-128-CCM-8 key must be ${KEY_LEN} bytes, got ${key.length}`);
+    }
+    const cipher = (0, import_node_crypto.createCipheriv)("aes-128-ccm", key, nonce, { authTagLength: TAG_LEN });
+    cipher.setAAD(aad, { plaintextLength: plaintext.length });
+    const body = cipher.update(plaintext);
+    const tail = cipher.final();
+    const tag = cipher.getAuthTag();
+    const out = new Uint8Array(plaintext.length + TAG_LEN);
+    out.set(body, 0);
+    if (tail.length > 0) {
+      out.set(tail, body.length);
+    }
+    out.set(tag, plaintext.length);
+    return out;
+  }
+  AesCcm82.encrypt = encrypt;
+  function decrypt({ key, nonce, aad, ciphertextWithTag }) {
+    if (key.length !== KEY_LEN) {
+      throw new import_general.InternalError(`AES-128-CCM-8 key must be ${KEY_LEN} bytes, got ${key.length}`);
+    }
+    if (ciphertextWithTag.length < TAG_LEN) {
+      throw new import_DtlsChannel.DtlsError(`AES-128-CCM-8 input shorter than ${TAG_LEN}-byte tag`);
+    }
+    const ctLen = ciphertextWithTag.length - TAG_LEN;
+    const ct = ciphertextWithTag.subarray(0, ctLen);
+    const tag = ciphertextWithTag.subarray(ctLen);
+    const decipher = (0, import_node_crypto.createDecipheriv)("aes-128-ccm", key, nonce, { authTagLength: TAG_LEN });
+    decipher.setAAD(aad, { plaintextLength: ctLen });
+    decipher.setAuthTag(tag);
+    const body = decipher.update(ct);
+    const tail = decipher.final();
+    const out = new Uint8Array(ctLen);
+    out.set(body, 0);
+    if (tail.length > 0) {
+      out.set(tail, body.length);
+    }
+    return out;
+  }
+  AesCcm82.decrypt = decrypt;
+})(AesCcm8 || (AesCcm8 = {}));
+//# sourceMappingURL=AesCcm8.js.map

package/dist/cjs/dtls/record/AesCcm8.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/dtls/record/AesCcm8.ts"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,qBAA8B;AAC9B,yBAAiD;AACjD,yBAA0B;AAR1B;AAAA;AAAA;AAAA;AAAA;AAUA,MAAM,UAAU;AAChB,MAAM,UAAU;AAYT,IAAU;AAAA,CAAV,CAAUA,aAAV;AAeI,WAAS,QAAQ,EAAE,KAAK,OAAO,KAAK,UAAU,GAA4B;AAC7E,QAAI,IAAI,WAAW,SAAS;AACxB,YAAM,IAAI,6BAAc,6BAA6B,OAAO,eAAe,IAAI,MAAM,EAAE;AAAA,IAC3F;AACA,UAAM,aAAS,mCAAe,eAAe,KAAK,OAAO,EAAE,eAAe,QAAQ,CAAC;AACnF,WAAO,OAAO,KAAK,EAAE,iBAAiB,UAAU,OAAO,CAAC;AACxD,UAAM,OAAO,OAAO,OAAO,SAAS;AACpC,UAAM,OAAO,OAAO,MAAM;AAC1B,UAAM,MAAM,OAAO,WAAW;AAE9B,UAAM,MAAM,IAAI,WAAW,UAAU,SAAS,OAAO;AACrD,QAAI,IAAI,MAAM,CAAC;AACf,QAAI,KAAK,SAAS,GAAG;AACjB,UAAI,IAAI,MAAM,KAAK,MAAM;AAAA,IAC7B;AACA,QAAI,IAAI,KAAK,UAAU,MAAM;AAC7B,WAAO;AAAA,EACX;AAjBO,EAAAA,SAAS;AAmBT,WAAS,QAAQ,EAAE,KAAK,OAAO,KAAK,kBAAkB,GAA4B;AACrF,QAAI,IAAI,WAAW,SAAS;AACxB,YAAM,IAAI,6BAAc,6BAA6B,OAAO,eAAe,IAAI,MAAM,EAAE;AAAA,IAC3F;AACA,QAAI,kBAAkB,SAAS,SAAS;AACpC,YAAM,IAAI,6BAAU,oCAAoC,OAAO,WAAW;AAAA,IAC9E;AACA,UAAM,QAAQ,kBAAkB,SAAS;AACzC,UAAM,KAAK,kBAAkB,SAAS,GAAG,KAAK;AAC9C,UAAM,MAAM,kBAAkB,SAAS,KAAK;AAE5C,UAAM,eAAW,qCAAiB,eAAe,KAAK,OAAO,EAAE,eAAe,QAAQ,CAAC;AACvF,aAAS,OAAO,KAAK,EAAE,iBAAiB,MAAM,CAAC;AAC/C,aAAS,WAAW,GAAG;AACvB,UAAM,OAAO,SAAS,OAAO,EAAE;AAE/B,UAAM,OAAO,SAAS,MAAM;AAE5B,UAAM,MAAM,IAAI,WAAW,KAAK;AAChC,QAAI,IAAI,MAAM,CAAC;AACf,QAAI,KAAK,SAAS,GAAG;AACjB,UAAI,IAAI,MAAM,KAAK,MAAM;AAAA,IAC7B;AACA,WAAO;AAAA,EACX;AAxBO,EAAAA,SAAS;AAAA,GAlCH;",
+  "names": ["AesCcm8"]
+}

package/dist/cjs/dtls/record/AntiReplayWindow.d.ts

@@ -0,0 +1,38 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * DTLS 1.2 sliding-window anti-replay tracker (RFC 6347 §4.1.2.6).
+ *
+ * Maintains the rightmost (highest) accepted sequence number and a 64-bit
+ * bitmap of which prior numbers within the window have been seen. `check`
+ * combines the "is this in-window?" / "is this fresh?" / "mark as seen" steps
+ * into a single atomic update so callers can use it as a guard:
+ *
+ * ```ts
+ * if (!window.check(seqNum)) {
+ *   // discard or alert
+ * }
+ * ```
+ *
+ * Per the RFC, the window is initialised empty (no sequence numbers seen yet)
+ * and the first valid record sets the rightmost edge.
+ */
+export declare class AntiReplayWindow {
+    #private;
+    /** Window size as defined by RFC 6347 §4.1.2.6 (typically 32 or 64; we use 64). */
+    static readonly WINDOW_SIZE: number;
+    /** Highest sequence number recorded so far, or `-1n` before the first acceptance. */
+    get rightmost(): bigint;
+    /**
+     * Test+mark a sequence number. Returns `true` and records it on first sight,
+     * `false` if the number is a replay or older than the trailing edge.
+     *
+     * Throws on a negative or out-of-48-bit input — DTLS sequence numbers are
+     * 48-bit unsigned by construction; anything else is a programming error.
+     */
+    check(seqNum: bigint): boolean;
+}
+//# sourceMappingURL=AntiReplayWindow.d.ts.map

package/dist/cjs/dtls/record/AntiReplayWindow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AntiReplayWindow.d.ts","sourceRoot":"","sources":["../../../../src/dtls/record/AntiReplayWindow.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAQH;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,gBAAgB;;IASzB,mFAAmF;IACnF,MAAM,CAAC,QAAQ,CAAC,WAAW,SAAuB;IAElD,qFAAqF;IACrF,IAAI,SAAS,IAAI,MAAM,CAEtB;IAED;;;;;;OAMG;IACH,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAgC7B;CACJ"}

package/dist/cjs/dtls/record/AntiReplayWindow.js

@@ -0,0 +1,84 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var AntiReplayWindow_exports = {};
+__export(AntiReplayWindow_exports, {
+  AntiReplayWindow: () => AntiReplayWindow
+});
+module.exports = __toCommonJS(AntiReplayWindow_exports);
+var import_general = require("@matter/general");
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+const WINDOW_SIZE = 64n;
+const WINDOW_MASK = (1n << WINDOW_SIZE) - 1n;
+const MAX_SEQ = (1n << 48n) - 1n;
+class AntiReplayWindow {
+  /** Highest sequence number observed so far, or `-1n` if none. */
+  #rightmost = -1n;
+  /**
+   * Bitmap of accepted sequence numbers in the closed range [rightmost-63, rightmost].
+   * Bit 0 represents `rightmost`, bit 1 represents `rightmost-1`, etc.
+   */
+  #window = 0n;
+  /** Window size as defined by RFC 6347 §4.1.2.6 (typically 32 or 64; we use 64). */
+  static WINDOW_SIZE = Number(WINDOW_SIZE);
+  /** Highest sequence number recorded so far, or `-1n` before the first acceptance. */
+  get rightmost() {
+    return this.#rightmost;
+  }
+  /**
+   * Test+mark a sequence number. Returns `true` and records it on first sight,
+   * `false` if the number is a replay or older than the trailing edge.
+   *
+   * Throws on a negative or out-of-48-bit input — DTLS sequence numbers are
+   * 48-bit unsigned by construction; anything else is a programming error.
+   */
+  check(seqNum) {
+    if (seqNum < 0n || seqNum > MAX_SEQ) {
+      throw new import_general.InternalError(`AntiReplayWindow: seqNum ${seqNum} out of 48-bit range`);
+    }
+    if (seqNum > this.#rightmost) {
+      if (this.#rightmost >= 0n) {
+        const shift = seqNum - this.#rightmost;
+        if (shift >= WINDOW_SIZE) {
+          this.#window = 1n;
+        } else {
+          this.#window = (this.#window << shift | 1n) & WINDOW_MASK;
+        }
+      } else {
+        this.#window = 1n;
+      }
+      this.#rightmost = seqNum;
+      return true;
+    }
+    const offset = this.#rightmost - seqNum;
+    if (offset >= WINDOW_SIZE) {
+      return false;
+    }
+    const bit = 1n << offset;
+    if ((this.#window & bit) !== 0n) {
+      return false;
+    }
+    this.#window |= bit;
+    return true;
+  }
+}
+//# sourceMappingURL=AntiReplayWindow.js.map

package/dist/cjs/dtls/record/AntiReplayWindow.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/dtls/record/AntiReplayWindow.ts"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,qBAA8B;AAN9B;AAAA;AAAA;AAAA;AAAA;AAQA,MAAM,cAAc;AACpB,MAAM,eAAe,MAAM,eAAe;AAC1C,MAAM,WAAW,MAAM,OAAO;AAmBvB,MAAM,iBAAiB;AAAA;AAAA,EAE1B,aAAa,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,EAKd,UAAU;AAAA;AAAA,EAGV,OAAgB,cAAc,OAAO,WAAW;AAAA;AAAA,EAGhD,IAAI,YAAoB;AACpB,WAAO,KAAK;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,QAAyB;AAC3B,QAAI,SAAS,MAAM,SAAS,SAAS;AACjC,YAAM,IAAI,6BAAc,4BAA4B,MAAM,sBAAsB;AAAA,IACpF;AAEA,QAAI,SAAS,KAAK,YAAY;AAE1B,UAAI,KAAK,cAAc,IAAI;AACvB,cAAM,QAAQ,SAAS,KAAK;AAC5B,YAAI,SAAS,aAAa;AACtB,eAAK,UAAU;AAAA,QACnB,OAAO;AACH,eAAK,WAAY,KAAK,WAAW,QAAS,MAAM;AAAA,QACpD;AAAA,MACJ,OAAO;AACH,aAAK,UAAU;AAAA,MACnB;AACA,WAAK,aAAa;AAClB,aAAO;AAAA,IACX;AAEA,UAAM,SAAS,KAAK,aAAa;AACjC,QAAI,UAAU,aAAa;AAEvB,aAAO;AAAA,IACX;AACA,UAAM,MAAM,MAAM;AAClB,SAAK,KAAK,UAAU,SAAS,IAAI;AAC7B,aAAO;AAAA,IACX;AACA,SAAK,WAAW;AAChB,WAAO;AAAA,EACX;AACJ;",
+  "names": []
+}

package/dist/cjs/dtls/record/ContentType.d.ts

@@ -0,0 +1,19 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * DTLS 1.2 ContentType values (RFC 6347 §4.1, RFC 5246 §6.2.1).
+ * The four values listed below are the only ones we encode or accept on the wire;
+ * any other byte triggers a decode error.
+ */
+export declare const ContentType: {
+    readonly CHANGE_CIPHER_SPEC: 20;
+    readonly ALERT: 21;
+    readonly HANDSHAKE: 22;
+    readonly APPLICATION_DATA: 23;
+};
+export type ContentType = (typeof ContentType)[keyof typeof ContentType];
+export declare function isContentType(value: number): value is ContentType;
+//# sourceMappingURL=ContentType.d.ts.map