@matter/thread-br-client 0.0.1

package/dist/esm/commissioner/Commissioner.js

@@ -0,0 +1,168 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { Logger, MatterError, Millis, Seconds, Time, TimeoutError } from "@matter/general";
+import { MeshCopTlvType } from "../dataset/meshcopTlvTypes.js";
+import { BasicTlv } from "../tlv/BasicTlvCodec.js";
+import { LeadKa } from "./LeadKa.js";
+import { LeadPet } from "./LeadPet.js";
+const logger = Logger.get("Commissioner");
+class CommissionerRejectedError extends MatterError {
+  constructor() {
+    super("Commissioner petition rejected by Border Router");
+    this.name = "CommissionerRejectedError";
+  }
+}
+class CommissionerTimeoutError extends TimeoutError {
+  constructor() {
+    super("Commissioner petition timed out (still pending after retry)");
+    this.name = "CommissionerTimeoutError";
+  }
+}
+class CommissionerKeepAliveError extends MatterError {
+}
+class Commissioner {
+  static COMMISSIONER_ID = "matter-server";
+  static #KA_INTERVAL = Seconds(40);
+  static #PENDING_RETRY_DELAY = Seconds(30);
+  #coap;
+  #pendingRetryDelay;
+  /**
+   * @param coap - CoAP transport connected to the target Border Router.
+   * @param opts - Optional overrides (e.g. `pendingRetryDelayMs` for tests).
+   */
+  constructor(coap, opts) {
+    this.#coap = coap;
+    this.#pendingRetryDelay = opts?.pendingRetryDelayMs !== void 0 ? Millis(opts.pendingRetryDelayMs) : Commissioner.#PENDING_RETRY_DELAY;
+  }
+  /**
+   * Send a MeshCoP `COMM_PET` (commissioner petition) request.
+   *
+   * When the BR responds `pending`, retries once after `pendingRetryDelayMs`
+   * (default 30 s). Accepts on the first `accept` response.
+   *
+   * @returns The commissioner session ID assigned by the Border Router.
+   * @throws {@link CommissionerRejectedError} when the BR returns `reject` on
+   *   the initial petition or on the retry.
+   * @throws {@link CommissionerTimeoutError} when the BR returns `pending` on
+   *   both the initial petition and the retry.
+   * @throws `Error` on CoAP transport or TLV parse failure.
+   */
+  async petition() {
+    const response = await this.#coap.request({
+      type: "CON",
+      code: "0.02",
+      uriPath: ["c", "cp"],
+      payload: LeadPet.buildRequest(Commissioner.COMMISSIONER_ID)
+    });
+    logger.debug(`[ThreadDiag] COMM_PET response code=${response.code} payloadLen=${response.payload.length}`);
+    const parsed = LeadPet.parseResponse(response.payload);
+    if (parsed.state === "accept") {
+      return parsed.sessionId;
+    }
+    if (parsed.state === "reject") {
+      throw new CommissionerRejectedError();
+    }
+    await Time.sleep("commissioner-pending-retry", this.#pendingRetryDelay);
+    const retryResponse = await this.#coap.request({
+      type: "CON",
+      code: "0.02",
+      uriPath: ["c", "cp"],
+      payload: LeadPet.buildRequest(Commissioner.COMMISSIONER_ID)
+    });
+    const retryParsed = LeadPet.parseResponse(retryResponse.payload);
+    if (retryParsed.state === "accept") {
+      return retryParsed.sessionId;
+    }
+    if (retryParsed.state === "reject") {
+      throw new CommissionerRejectedError();
+    }
+    throw new CommissionerTimeoutError();
+  }
+  /**
+   * Send a MeshCoP `COMM_KA` (commissioner keep-alive) request.
+   *
+   * Must be called periodically (typically every ~40 s) while the session is
+   * active; the BR will revoke the session if no keep-alive is received within
+   * its timeout window. Prefer {@link Commissioner.withSession}, which schedules
+   * keep-alives automatically.
+   *
+   * @param sessionId - Session ID returned by {@link petition}.
+   * @throws {@link CommissionerKeepAliveError} when the BR rejects the keep-alive; propagates CoAP errors.
+   */
+  async keepAlive(sessionId) {
+    const response = await this.#coap.request({
+      type: "CON",
+      code: "0.02",
+      uriPath: ["c", "ka"],
+      payload: LeadKa.buildRequest(sessionId)
+    });
+    const parsed = LeadKa.parseResponse(response.payload);
+    if (parsed.state !== "accept") {
+      throw new CommissionerKeepAliveError(`Commissioner keep-alive rejected: state=${parsed.state}`);
+    }
+  }
+  /**
+   * Send a MeshCoP `COMM_REL` (commissioner release) request.
+   *
+   * Best-effort — CoAP errors are logged at `warn` level and swallowed so a
+   * failed release does not block teardown. The BR will expire the session on
+   * its own if the release is lost.
+   *
+   * @param sessionId - Session ID returned by {@link petition}.
+   */
+  async release(sessionId) {
+    try {
+      const sessionBytes = new Uint8Array(2);
+      sessionBytes[0] = sessionId >> 8 & 255;
+      sessionBytes[1] = sessionId & 255;
+      const releasePayload = BasicTlv.encode([
+        { type: MeshCopTlvType.COMMISSIONER_SESSION_ID, value: sessionBytes },
+        { type: MeshCopTlvType.COMMISSIONER_ID, value: new TextEncoder().encode(Commissioner.COMMISSIONER_ID) }
+      ]);
+      await this.#coap.request({
+        type: "CON",
+        code: "0.02",
+        uriPath: ["c", "cr"],
+        payload: releasePayload
+      });
+    } catch (err) {
+      logger.warn("Commissioner release failed (best-effort):", err);
+    }
+  }
+  /**
+   * Run `fn` inside a commissioner session, managing petition, keep-alive, and
+   * release automatically.
+   *
+   * Keep-alive requests fire every ~40 s while `fn` is executing. The session is
+   * released in a `finally` block regardless of whether `fn` resolves or rejects.
+   *
+   * @param fn - Async callback receiving the active session ID.
+   * @returns The value resolved by `fn`.
+   * @throws {@link CommissionerRejectedError} or {@link CommissionerTimeoutError}
+   *   when the petition fails (before `fn` is invoked).
+   */
+  async withSession(fn) {
+    const sessionId = await this.petition();
+    const kaInterval = Time.getPeriodicTimer("commissioner-keepalive", Commissioner.#KA_INTERVAL, () => {
+      void this.keepAlive(sessionId).catch((err) => {
+        logger.warn("Commissioner keep-alive error:", err);
+      });
+    }).start();
+    try {
+      return await fn(sessionId);
+    } finally {
+      kaInterval.stop();
+      await this.release(sessionId);
+    }
+  }
+}
+export {
+  Commissioner,
+  CommissionerKeepAliveError,
+  CommissionerRejectedError,
+  CommissionerTimeoutError
+};
+//# sourceMappingURL=Commissioner.js.map

package/dist/esm/commissioner/Commissioner.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": ["../../../src/commissioner/Commissioner.ts"],
+  "mappings": "AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,SAAwB,QAAQ,aAAa,QAAQ,SAAS,MAAM,oBAAgC;AAEpG,SAAS,sBAAsB;AAC/B,SAAS,gBAAgB;AACzB,SAAS,cAAc;AACvB,SAAS,eAAe;AAExB,MAAM,SAAS,OAAO,IAAI,cAAc;AAGjC,MAAM,kCAAkC,YAAY;AAAA,EACvD,cAAc;AACV,UAAM,iDAAiD;AACvD,SAAK,OAAO;AAAA,EAChB;AACJ;AAGO,MAAM,iCAAiC,aAAa;AAAA,EACvD,cAAc;AACV,UAAM,6DAA6D;AACnE,SAAK,OAAO;AAAA,EAChB;AACJ;AAGO,MAAM,mCAAmC,YAAY;AAAC;AAetD,MAAM,aAAa;AAAA,EACtB,OAAgB,kBAAkB;AAAA,EAClC,OAAgB,eAAe,QAAQ,EAAE;AAAA,EACzC,OAAgB,uBAAuB,QAAQ,EAAE;AAAA,EAExC;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMT,YAAY,MAAkB,MAAyB;AACnD,SAAK,QAAQ;AACb,SAAK,qBACD,MAAM,wBAAwB,SACxB,OAAO,KAAK,mBAAmB,IAC/B,aAAa;AAAA,EAC3B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAM,WAA4B;AAC9B,UAAM,WAAW,MAAM,KAAK,MAAM,QAAQ;AAAA,MACtC,MAAM;AAAA,MACN,MAAM;AAAA,MACN,SAAS,CAAC,KAAK,IAAI;AAAA,MACnB,SAAS,QAAQ,aAAa,aAAa,eAAe;AAAA,IAC9D,CAAC;AAED,WAAO,MAAM,uCAAuC,SAAS,IAAI,eAAe,SAAS,QAAQ,MAAM,EAAE;AACzG,UAAM,SAAS,QAAQ,cAAc,SAAS,OAAO;AAErD,QAAI,OAAO,UAAU,UAAU;AAC3B,aAAO,OAAO;AAAA,IAClB;AAEA,QAAI,OAAO,UAAU,UAAU;AAC3B,YAAM,IAAI,0BAA0B;AAAA,IACxC;AAGA,UAAM,KAAK,MAAM,8BAA8B,KAAK,kBAAkB;AAEtE,UAAM,gBAAgB,MAAM,KAAK,MAAM,QAAQ;AAAA,MAC3C,MAAM;AAAA,MACN,MAAM;AAAA,MACN,SAAS,CAAC,KAAK,IAAI;AAAA,MACnB,SAAS,QAAQ,aAAa,aAAa,eAAe;AAAA,IAC9D,CAAC;AAED,UAAM,cAAc,QAAQ,cAAc,cAAc,OAAO;AAE/D,QAAI,YAAY,UAAU,UAAU;AAChC,aAAO,YAAY;AAAA,IACvB;AAEA,QAAI,YAAY,UAAU,UAAU;AAChC,YAAM,IAAI,0BAA0B;AAAA,IACxC;AAEA,UAAM,IAAI,yBAAyB;AAAA,EACvC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,UAAU,WAAkC;AAC9C,UAAM,WAAW,MAAM,KAAK,MAAM,QAAQ;AAAA,MACtC,MAAM;AAAA,MACN,MAAM;AAAA,MACN,SAAS,CAAC,KAAK,IAAI;AAAA,MACnB,SAAS,OAAO,aAAa,SAAS;AAAA,IAC1C,CAAC;AAED,UAAM,SAAS,OAAO,cAAc,SAAS,OAAO;AACpD,QAAI,OAAO,UAAU,UAAU;AAC3B,YAAM,IAAI,2BAA2B,2CAA2C,OAAO,KAAK,EAAE;AAAA,IAClG;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,QAAQ,WAAkC;AAC5C,QAAI;AAEA,YAAM,eAAe,IAAI,WAAW,CAAC;AACrC,mBAAa,CAAC,IAAK,aAAa,IAAK;AACrC,mBAAa,CAAC,IAAI,YAAY;AAC9B,YAAM,iBAAiB,SAAS,OAAO;AAAA,QACnC,EAAE,MAAM,eAAe,yBAAyB,OAAO,aAAa;AAAA,QACpE,EAAE,MAAM,eAAe,iBAAiB,OAAO,IAAI,YAAY,EAAE,OAAO,aAAa,eAAe,EAAE;AAAA,MAC1G,CAAC;AACD,YAAM,KAAK,MAAM,QAAQ;AAAA,QACrB,MAAM;AAAA,QACN,MAAM;AAAA,QACN,SAAS,CAAC,KAAK,IAAI;AAAA,QACnB,SAAS;AAAA,MACb,CAAC;AAAA,IACL,SAAS,KAAK;AACV,aAAO,KAAK,8CAA8C,GAAG;AAAA,IACjE;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,MAAM,YAAe,IAAmD;AACpE,UAAM,YAAY,MAAM,KAAK,SAAS;AACtC,UAAM,aAAoB,KAAK,iBAAiB,0BAA0B,aAAa,cAAc,MAAM;AACvG,WAAK,KAAK,UAAU,SAAS,EAAE,MAAM,SAAO;AACxC,eAAO,KAAK,kCAAkC,GAAG;AAAA,MACrD,CAAC;AAAA,IACL,CAAC,EAAE,MAAM;AAET,QAAI;AACA,aAAO,MAAM,GAAG,SAAS;AAAA,IAC7B,UAAE;AACE,iBAAW,KAAK;AAChB,YAAM,KAAK,QAAQ,SAAS;AAAA,IAChC;AAAA,EACJ;AACJ;",
+  "names": []
+}

package/dist/esm/commissioner/LeadKa.d.ts

@@ -0,0 +1,17 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { MatterError } from "@matter/general";
+/** Thrown when a commissioner BR response (LeadKa/LeadPet) cannot be parsed. */
+export declare class CommissionerProtocolError extends MatterError {
+}
+export interface LeadKaResponse {
+    state: "accept" | "reject" | "pending";
+}
+export declare namespace LeadKa {
+    function buildRequest(sessionId: number): Uint8Array;
+    function parseResponse(payload: Uint8Array): LeadKaResponse;
+}
+//# sourceMappingURL=LeadKa.d.ts.map

package/dist/esm/commissioner/LeadKa.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"LeadKa.d.ts","sourceRoot":"","sources":["../../../src/commissioner/LeadKa.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAI9C,gFAAgF;AAChF,qBAAa,yBAA0B,SAAQ,WAAW;CAAG;AAE7D,MAAM,WAAW,cAAc;IAC3B,KAAK,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;CAC1C;AAKD,yBAAiB,MAAM,CAAC,CAAC;IACrB,SAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,UAAU,CAW1D;IAED,SAAgB,aAAa,CAAC,OAAO,EAAE,UAAU,GAAG,cAAc,CAYjE;CACJ"}

package/dist/esm/commissioner/LeadKa.js

@@ -0,0 +1,43 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { MatterError } from "@matter/general";
+import { MeshCopTlvType } from "../dataset/meshcopTlvTypes.js";
+import { BasicTlv } from "../tlv/BasicTlvCodec.js";
+class CommissionerProtocolError extends MatterError {
+}
+const STATE_ACCEPT = 1;
+var LeadKa;
+((LeadKa2) => {
+  function buildRequest(sessionId) {
+    const sessionBytes = new Uint8Array(2);
+    sessionBytes[0] = sessionId >> 8 & 255;
+    sessionBytes[1] = sessionId & 255;
+    return BasicTlv.encode([
+      { type: MeshCopTlvType.STATE, value: new Uint8Array([STATE_ACCEPT]) },
+      { type: MeshCopTlvType.COMMISSIONER_SESSION_ID, value: sessionBytes }
+    ]);
+  }
+  LeadKa2.buildRequest = buildRequest;
+  function parseResponse(payload) {
+    const entries = BasicTlv.walk(payload);
+    for (const entry of entries) {
+      if (entry.type === MeshCopTlvType.STATE) {
+        const byte = entry.value[0];
+        if (byte === 1) return { state: "accept" };
+        if (byte === 255) return { state: "reject" };
+        if (byte === 0) return { state: "pending" };
+        throw new CommissionerProtocolError(`LeadKa: unknown state byte ${byte}`);
+      }
+    }
+    throw new CommissionerProtocolError("LeadKa: response missing STATE TLV");
+  }
+  LeadKa2.parseResponse = parseResponse;
+})(LeadKa || (LeadKa = {}));
+export {
+  CommissionerProtocolError,
+  LeadKa
+};
+//# sourceMappingURL=LeadKa.js.map

package/dist/esm/commissioner/LeadKa.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": ["../../../src/commissioner/LeadKa.ts"],
+  "mappings": "AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,SAAS,mBAAmB;AAC5B,SAAS,sBAAsB;AAC/B,SAAS,gBAAgB;AAGlB,MAAM,kCAAkC,YAAY;AAAC;AAO5D,MAAM,eAAe;AAEd,IAAU;AAAA,CAAV,CAAUA,YAAV;AACI,WAAS,aAAa,WAA+B;AACxD,UAAM,eAAe,IAAI,WAAW,CAAC;AACrC,iBAAa,CAAC,IAAK,aAAa,IAAK;AACrC,iBAAa,CAAC,IAAI,YAAY;AAI9B,WAAO,SAAS,OAAO;AAAA,MACnB,EAAE,MAAM,eAAe,OAAO,OAAO,IAAI,WAAW,CAAC,YAAY,CAAC,EAAE;AAAA,MACpE,EAAE,MAAM,eAAe,yBAAyB,OAAO,aAAa;AAAA,IACxE,CAAC;AAAA,EACL;AAXO,EAAAA,QAAS;AAaT,WAAS,cAAc,SAAqC;AAC/D,UAAM,UAAU,SAAS,KAAK,OAAO;AACrC,eAAW,SAAS,SAAS;AACzB,UAAI,MAAM,SAAS,eAAe,OAAO;AACrC,cAAM,OAAO,MAAM,MAAM,CAAC;AAC1B,YAAI,SAAS,EAAM,QAAO,EAAE,OAAO,SAAS;AAC5C,YAAI,SAAS,IAAM,QAAO,EAAE,OAAO,SAAS;AAC5C,YAAI,SAAS,EAAM,QAAO,EAAE,OAAO,UAAU;AAC7C,cAAM,IAAI,0BAA0B,8BAA8B,IAAI,EAAE;AAAA,MAC5E;AAAA,IACJ;AACA,UAAM,IAAI,0BAA0B,oCAAoC;AAAA,EAC5E;AAZO,EAAAA,QAAS;AAAA,GAdH;",
+  "names": ["LeadKa"]
+}

package/dist/esm/commissioner/LeadPet.d.ts

@@ -0,0 +1,14 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+export interface LeadPetResponse {
+    state: "accept" | "reject" | "pending";
+    sessionId?: number;
+}
+export declare namespace LeadPet {
+    function buildRequest(commissionerId: string): Uint8Array;
+    function parseResponse(payload: Uint8Array): LeadPetResponse;
+}
+//# sourceMappingURL=LeadPet.d.ts.map

package/dist/esm/commissioner/LeadPet.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"LeadPet.d.ts","sourceRoot":"","sources":["../../../src/commissioner/LeadPet.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAOH,MAAM,WAAW,eAAe;IAC5B,KAAK,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;IACvC,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,yBAAiB,OAAO,CAAC,CAAC;IACtB,SAAgB,YAAY,CAAC,cAAc,EAAE,MAAM,GAAG,UAAU,CAI/D;IAED,SAAgB,aAAa,CAAC,OAAO,EAAE,UAAU,GAAG,eAAe,CA4BlE;CACJ"}

package/dist/esm/commissioner/LeadPet.js

@@ -0,0 +1,46 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { Bytes } from "@matter/general";
+import { MeshCopTlvType } from "../dataset/meshcopTlvTypes.js";
+import { BasicTlv } from "../tlv/BasicTlvCodec.js";
+import { CommissionerProtocolError } from "./LeadKa.js";
+var LeadPet;
+((LeadPet2) => {
+  function buildRequest(commissionerId) {
+    return BasicTlv.encode([
+      { type: MeshCopTlvType.COMMISSIONER_ID, value: new TextEncoder().encode(commissionerId) }
+    ]);
+  }
+  LeadPet2.buildRequest = buildRequest;
+  function parseResponse(payload) {
+    const entries = BasicTlv.walk(payload);
+    let state;
+    let sessionId;
+    for (const entry of entries) {
+      if (entry.type === MeshCopTlvType.STATE) {
+        const byte = entry.value[0];
+        if (byte === 1) state = "accept";
+        else if (byte === 255) state = "reject";
+        else if (byte === 0) state = "pending";
+        else throw new CommissionerProtocolError(`LeadPet: unknown state byte ${byte}`);
+      } else if (entry.type === MeshCopTlvType.COMMISSIONER_SESSION_ID) {
+        sessionId = entry.value[0] << 8 | entry.value[1];
+      }
+    }
+    if (state === void 0) {
+      const tlvSummary = entries.length === 0 ? "none" : entries.map((e) => `t=0x${e.type.toString(16)}/${e.value.length}b`).join(",");
+      throw new CommissionerProtocolError(
+        `LeadPet: response missing STATE TLV (payload=${Bytes.toHex(payload)}, tlvs=[${tlvSummary}])`
+      );
+    }
+    return state === "accept" ? { state, sessionId } : { state };
+  }
+  LeadPet2.parseResponse = parseResponse;
+})(LeadPet || (LeadPet = {}));
+export {
+  LeadPet
+};
+//# sourceMappingURL=LeadPet.js.map

package/dist/esm/commissioner/LeadPet.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": ["../../../src/commissioner/LeadPet.ts"],
+  "mappings": "AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,SAAS,aAAa;AACtB,SAAS,sBAAsB;AAC/B,SAAS,gBAAgB;AACzB,SAAS,iCAAiC;AAOnC,IAAU;AAAA,CAAV,CAAUA,aAAV;AACI,WAAS,aAAa,gBAAoC;AAC7D,WAAO,SAAS,OAAO;AAAA,MACnB,EAAE,MAAM,eAAe,iBAAiB,OAAO,IAAI,YAAY,EAAE,OAAO,cAAc,EAAE;AAAA,IAC5F,CAAC;AAAA,EACL;AAJO,EAAAA,SAAS;AAMT,WAAS,cAAc,SAAsC;AAChE,UAAM,UAAU,SAAS,KAAK,OAAO;AACrC,QAAI;AACJ,QAAI;AAEJ,eAAW,SAAS,SAAS;AACzB,UAAI,MAAM,SAAS,eAAe,OAAO;AACrC,cAAM,OAAO,MAAM,MAAM,CAAC;AAC1B,YAAI,SAAS,EAAM,SAAQ;AAAA,iBAClB,SAAS,IAAM,SAAQ;AAAA,iBACvB,SAAS,EAAM,SAAQ;AAAA,YAC3B,OAAM,IAAI,0BAA0B,+BAA+B,IAAI,EAAE;AAAA,MAClF,WAAW,MAAM,SAAS,eAAe,yBAAyB;AAC9D,oBAAa,MAAM,MAAM,CAAC,KAAK,IAAK,MAAM,MAAM,CAAC;AAAA,MACrD;AAAA,IACJ;AAEA,QAAI,UAAU,QAAW;AACrB,YAAM,aACF,QAAQ,WAAW,IACb,SACA,QAAQ,IAAI,OAAK,OAAO,EAAE,KAAK,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,MAAM,GAAG,EAAE,KAAK,GAAG;AACpF,YAAM,IAAI;AAAA,QACN,gDAAgD,MAAM,MAAM,OAAO,CAAC,WAAW,UAAU;AAAA,MAC7F;AAAA,IACJ;AAEA,WAAO,UAAU,WAAW,EAAE,OAAO,UAAU,IAAI,EAAE,MAAM;AAAA,EAC/D;AA5BO,EAAAA,SAAS;AAAA,GAPH;",
+  "names": ["LeadPet"]
+}

package/dist/esm/commissioner/index.d.ts

@@ -0,0 +1,12 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+export { Commissioner, CommissionerKeepAliveError, CommissionerRejectedError, CommissionerTimeoutError, } from "./Commissioner.js";
+export type { CommissionerOpts } from "./Commissioner.js";
+export { CommissionerProtocolError, LeadKa } from "./LeadKa.js";
+export type { LeadKaResponse } from "./LeadKa.js";
+export { LeadPet } from "./LeadPet.js";
+export type { LeadPetResponse } from "./LeadPet.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/commissioner/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/commissioner/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACH,YAAY,EACZ,0BAA0B,EAC1B,yBAAyB,EACzB,wBAAwB,GAC3B,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,yBAAyB,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAChE,YAAY,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,YAAY,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC"}

package/dist/esm/commissioner/index.js

@@ -0,0 +1,23 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import {
+  Commissioner,
+  CommissionerKeepAliveError,
+  CommissionerRejectedError,
+  CommissionerTimeoutError
+} from "./Commissioner.js";
+import { CommissionerProtocolError, LeadKa } from "./LeadKa.js";
+import { LeadPet } from "./LeadPet.js";
+export {
+  Commissioner,
+  CommissionerKeepAliveError,
+  CommissionerProtocolError,
+  CommissionerRejectedError,
+  CommissionerTimeoutError,
+  LeadKa,
+  LeadPet
+};
+//# sourceMappingURL=index.js.map

package/dist/esm/commissioner/index.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": ["../../../src/commissioner/index.ts"],
+  "mappings": "AAAA;AAAA;AAAA;AAAA;AAAA;AAMA;AAAA,EACI;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACG;AAEP,SAAS,2BAA2B,cAAc;AAElD,SAAS,eAAe;",
+  "names": []
+}

package/dist/esm/credentials/ThreadCredentialsRegistry.d.ts

@@ -0,0 +1,50 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { Observable } from "@matter/general";
+import type { OperationalDataset } from "../dataset/OperationalDataset.js";
+import type { ThreadNetworkCredentials } from "./ThreadNetworkCredentials.js";
+/**
+ * In-memory registry of {@link ThreadNetworkCredentials} keyed by extended PAN ID.
+ *
+ * Source of truth for "what credentials do we have to talk to which Thread network".
+ * Diagnostic flows look up entries by extPanId; the network key is dropped on
+ * registration so the registry never holds it.
+ */
+export declare class ThreadCredentialsRegistry {
+    #private;
+    readonly events: {
+        registered: Observable<[creds: ThreadNetworkCredentials], void>;
+        unregistered: Observable<[extPanId: Uint8Array<ArrayBufferLike>], void>;
+    };
+    /**
+     * Register credentials extracted from a parsed Operational Dataset.
+     *
+     * `networkKey` is intentionally dropped on the way in — the registry stores
+     * only what's needed for diagnostic queries (extPanId, networkName, pskc,
+     * activeTimestamp). Smaller blast radius for the most sensitive secret.
+     *
+     * Replaces any existing entry for the same extPanId; throws if the dataset
+     * lacks extPanId, networkName, or pskc.
+     */
+    register(dataset: OperationalDataset): void;
+    /**
+     * Register credentials directly. Intended for tests and external sources
+     * that don't carry a full dataset. Same replacement semantics as {@link register}.
+     *
+     * Replacement always fires `registered` once with the new entry; the old entry
+     * is silently overwritten because consumers care about "what is current", not
+     * about churn. Intentional even when the new dataset's `activeTimestamp` is
+     * older — losing an update is worse than a noisy log line.
+     */
+    registerCredentials(creds: ThreadNetworkCredentials): void;
+    /** Remove an entry. No-op if absent. */
+    unregister(extPanId: Uint8Array): void;
+    /** Lookup by extPanId. Comparison is by Uint8Array equality, not reference. */
+    getCredentials(extPanId: Uint8Array): ThreadNetworkCredentials | undefined;
+    /** Defensive snapshot — caller cannot mutate the registry through it. */
+    list(): ReadonlyArray<ThreadNetworkCredentials>;
+}
+//# sourceMappingURL=ThreadCredentialsRegistry.d.ts.map

package/dist/esm/credentials/ThreadCredentialsRegistry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ThreadCredentialsRegistry.d.ts","sourceRoot":"","sources":["../../../src/credentials/ThreadCredentialsRegistry.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAA8B,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACzE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAE9E;;;;;;GAMG;AACH,qBAAa,yBAAyB;;IAElC,QAAQ,CAAC,MAAM;QACX,UAAU;QACV,YAAY;MACd;IAEF;;;;;;;;;OASG;IACH,QAAQ,CAAC,OAAO,EAAE,kBAAkB,GAAG,IAAI,CAiB1C;IAED;;;;;;;;OAQG;IACH,mBAAmB,CAAC,KAAK,EAAE,wBAAwB,GAAG,IAAI,CAWzD;IAED,wCAAwC;IACxC,UAAU,CAAC,QAAQ,EAAE,UAAU,GAAG,IAAI,CAKrC;IAED,+EAA+E;IAC/E,cAAc,CAAC,QAAQ,EAAE,UAAU,GAAG,wBAAwB,GAAG,SAAS,CAEzE;IAED,yEAAyE;IACzE,IAAI,IAAI,aAAa,CAAC,wBAAwB,CAAC,CAE9C;CACJ"}

package/dist/esm/credentials/ThreadCredentialsRegistry.js

@@ -0,0 +1,99 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { Bytes, ImplementationError, Observable } from "@matter/general";
+class ThreadCredentialsRegistry {
+  #byExtPanId = /* @__PURE__ */ new Map();
+  events = {
+    registered: new Observable(),
+    unregistered: new Observable()
+  };
+  /**
+   * Register credentials extracted from a parsed Operational Dataset.
+   *
+   * `networkKey` is intentionally dropped on the way in — the registry stores
+   * only what's needed for diagnostic queries (extPanId, networkName, pskc,
+   * activeTimestamp). Smaller blast radius for the most sensitive secret.
+   *
+   * Replaces any existing entry for the same extPanId; throws if the dataset
+   * lacks extPanId, networkName, or pskc.
+   */
+  register(dataset) {
+    if (dataset.extPanId === void 0) {
+      throw new ImplementationError("Cannot register credentials: dataset is missing extPanId");
+    }
+    if (dataset.networkName === void 0) {
+      throw new ImplementationError("Cannot register credentials: dataset is missing networkName");
+    }
+    if (dataset.pskc === void 0) {
+      throw new ImplementationError("Cannot register credentials: dataset is missing pskc");
+    }
+    this.registerCredentials({
+      extPanId: dataset.extPanId,
+      networkName: dataset.networkName,
+      pskc: dataset.pskc,
+      meshLocalPrefix: dataset.meshLocalPrefix,
+      activeTimestamp: dataset.activeTimestamp === void 0 ? void 0 : bytesToBigint(dataset.activeTimestamp)
+    });
+  }
+  /**
+   * Register credentials directly. Intended for tests and external sources
+   * that don't carry a full dataset. Same replacement semantics as {@link register}.
+   *
+   * Replacement always fires `registered` once with the new entry; the old entry
+   * is silently overwritten because consumers care about "what is current", not
+   * about churn. Intentional even when the new dataset's `activeTimestamp` is
+   * older — losing an update is worse than a noisy log line.
+   */
+  registerCredentials(creds) {
+    const stored = {
+      extPanId: creds.extPanId.slice(),
+      networkName: creds.networkName,
+      pskc: creds.pskc.slice(),
+      meshLocalPrefix: creds.meshLocalPrefix?.slice(),
+      activeTimestamp: creds.activeTimestamp
+    };
+    this.#byExtPanId.set(keyOf(stored.extPanId), stored);
+    this.events.registered.emit(snapshot(stored));
+  }
+  /** Remove an entry. No-op if absent. */
+  unregister(extPanId) {
+    const key = keyOf(extPanId);
+    if (!this.#byExtPanId.has(key)) return;
+    this.#byExtPanId.delete(key);
+    this.events.unregistered.emit(extPanId.slice());
+  }
+  /** Lookup by extPanId. Comparison is by Uint8Array equality, not reference. */
+  getCredentials(extPanId) {
+    return this.#byExtPanId.get(keyOf(extPanId));
+  }
+  /** Defensive snapshot — caller cannot mutate the registry through it. */
+  list() {
+    return Array.from(this.#byExtPanId.values());
+  }
+}
+function keyOf(extPanId) {
+  return Bytes.toHex(extPanId);
+}
+function snapshot(creds) {
+  return {
+    extPanId: creds.extPanId.slice(),
+    networkName: creds.networkName,
+    pskc: creds.pskc.slice(),
+    meshLocalPrefix: creds.meshLocalPrefix?.slice(),
+    activeTimestamp: creds.activeTimestamp
+  };
+}
+function bytesToBigint(bytes) {
+  let result = 0n;
+  for (const b of bytes) {
+    result = result << 8n | BigInt(b);
+  }
+  return result;
+}
+export {
+  ThreadCredentialsRegistry
+};
+//# sourceMappingURL=ThreadCredentialsRegistry.js.map

package/dist/esm/credentials/ThreadCredentialsRegistry.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": ["../../../src/credentials/ThreadCredentialsRegistry.ts"],
+  "mappings": "AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,SAAS,OAAO,qBAAqB,kBAAkB;AAWhD,MAAM,0BAA0B;AAAA,EAC1B,cAAc,oBAAI,IAAsC;AAAA,EACxD,SAAS;AAAA,IACd,YAAY,IAAI,WAA8C;AAAA,IAC9D,cAAc,IAAI,WAAmC;AAAA,EACzD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,SAAS,SAAmC;AACxC,QAAI,QAAQ,aAAa,QAAW;AAChC,YAAM,IAAI,oBAAoB,0DAA0D;AAAA,IAC5F;AACA,QAAI,QAAQ,gBAAgB,QAAW;AACnC,YAAM,IAAI,oBAAoB,6DAA6D;AAAA,IAC/F;AACA,QAAI,QAAQ,SAAS,QAAW;AAC5B,YAAM,IAAI,oBAAoB,sDAAsD;AAAA,IACxF;AACA,SAAK,oBAAoB;AAAA,MACrB,UAAU,QAAQ;AAAA,MAClB,aAAa,QAAQ;AAAA,MACrB,MAAM,QAAQ;AAAA,MACd,iBAAiB,QAAQ;AAAA,MACzB,iBAAiB,QAAQ,oBAAoB,SAAY,SAAY,cAAc,QAAQ,eAAe;AAAA,IAC9G,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,oBAAoB,OAAuC;AACvD,UAAM,SAAmC;AAAA,MACrC,UAAU,MAAM,SAAS,MAAM;AAAA,MAC/B,aAAa,MAAM;AAAA,MACnB,MAAM,MAAM,KAAK,MAAM;AAAA,MACvB,iBAAiB,MAAM,iBAAiB,MAAM;AAAA,MAC9C,iBAAiB,MAAM;AAAA,IAC3B;AACA,SAAK,YAAY,IAAI,MAAM,OAAO,QAAQ,GAAG,MAAM;AAEnD,SAAK,OAAO,WAAW,KAAK,SAAS,MAAM,CAAC;AAAA,EAChD;AAAA;AAAA,EAGA,WAAW,UAA4B;AACnC,UAAM,MAAM,MAAM,QAAQ;AAC1B,QAAI,CAAC,KAAK,YAAY,IAAI,GAAG,EAAG;AAChC,SAAK,YAAY,OAAO,GAAG;AAC3B,SAAK,OAAO,aAAa,KAAK,SAAS,MAAM,CAAC;AAAA,EAClD;AAAA;AAAA,EAGA,eAAe,UAA4D;AACvE,WAAO,KAAK,YAAY,IAAI,MAAM,QAAQ,CAAC;AAAA,EAC/C;AAAA;AAAA,EAGA,OAAgD;AAC5C,WAAO,MAAM,KAAK,KAAK,YAAY,OAAO,CAAC;AAAA,EAC/C;AACJ;AAEA,SAAS,MAAM,UAA8B;AACzC,SAAO,MAAM,MAAM,QAAQ;AAC/B;AAEA,SAAS,SAAS,OAA2D;AACzE,SAAO;AAAA,IACH,UAAU,MAAM,SAAS,MAAM;AAAA,IAC/B,aAAa,MAAM;AAAA,IACnB,MAAM,MAAM,KAAK,MAAM;AAAA,IACvB,iBAAiB,MAAM,iBAAiB,MAAM;AAAA,IAC9C,iBAAiB,MAAM;AAAA,EAC3B;AACJ;AAIA,SAAS,cAAc,OAA2B;AAC9C,MAAI,SAAS;AACb,aAAW,KAAK,OAAO;AACnB,aAAU,UAAU,KAAM,OAAO,CAAC;AAAA,EACtC;AACA,SAAO;AACX;",
+  "names": []
+}

package/dist/esm/credentials/ThreadNetworkCredentials.d.ts

@@ -0,0 +1,26 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * Credentials needed to authenticate against a Thread network's commissioner.
+ *
+ * Holds only what the diagnostic flow actually needs — the network key is
+ * intentionally absent because nothing in this codebase ever sends or uses it,
+ * keeping the blast radius of an in-memory leak as small as possible.
+ */
+export interface ThreadNetworkCredentials {
+    /** 8-byte extended PAN ID — primary registry key. */
+    extPanId: Uint8Array;
+    /** Thread network name (UTF-8, ≤16 bytes). */
+    networkName: string;
+    /** 16-byte EC-JPAKE password (PSKc). Sensitive — redact when logging. */
+    pskc: Uint8Array;
+    /** 8-byte mesh-local prefix, used to derive node mesh-local addresses for
+     *  UDP-proxy unicast diagnostics. Absent if the dataset omits it. */
+    meshLocalPrefix?: Uint8Array;
+    /** Active timestamp from the dataset, used for change detection. */
+    activeTimestamp?: bigint;
+}
+//# sourceMappingURL=ThreadNetworkCredentials.d.ts.map

package/dist/esm/credentials/ThreadNetworkCredentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ThreadNetworkCredentials.d.ts","sourceRoot":"","sources":["../../../src/credentials/ThreadNetworkCredentials.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;;;GAMG;AACH,MAAM,WAAW,wBAAwB;IACrC,qDAAqD;IACrD,QAAQ,EAAE,UAAU,CAAC;IACrB,8CAA8C;IAC9C,WAAW,EAAE,MAAM,CAAC;IACpB,yEAAyE;IACzE,IAAI,EAAE,UAAU,CAAC;IACjB;yEACqE;IACrE,eAAe,CAAC,EAAE,UAAU,CAAC;IAC7B,oEAAoE;IACpE,eAAe,CAAC,EAAE,MAAM,CAAC;CAC5B"}

package/dist/esm/credentials/ThreadNetworkCredentials.js

@@ -0,0 +1,6 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+//# sourceMappingURL=ThreadNetworkCredentials.js.map

package/dist/esm/credentials/ThreadNetworkCredentials.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": ["../../../src/credentials/ThreadNetworkCredentials.ts"],
+  "mappings": "AAAA;AAAA;AAAA;AAAA;AAAA;",
+  "names": []
+}

package/dist/esm/credentials/index.d.ts

@@ -0,0 +1,8 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+export { ThreadCredentialsRegistry } from "./ThreadCredentialsRegistry.js";
+export type { ThreadNetworkCredentials } from "./ThreadNetworkCredentials.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/credentials/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/credentials/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,YAAY,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC"}

package/dist/esm/credentials/index.js

@@ -0,0 +1,10 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { ThreadCredentialsRegistry } from "./ThreadCredentialsRegistry.js";
+export {
+  ThreadCredentialsRegistry
+};
+//# sourceMappingURL=index.js.map

package/dist/esm/credentials/index.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": ["../../../src/credentials/index.ts"],
+  "mappings": "AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,SAAS,iCAAiC;",
+  "names": []
+}

package/dist/esm/crypto/AesCmacPrf128.d.ts

@@ -0,0 +1,24 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * AES-CMAC per RFC 4493.
+ *
+ * Block-cipher-based MAC with a 128-bit AES key and a 16-byte tag. Empty messages
+ * are explicitly supported and pad to a single all-zero block XORed with K2.
+ */
+export declare namespace AesCmac {
+    function compute(key: Uint8Array, message: Uint8Array): Uint8Array;
+}
+/**
+ * AES-CMAC-PRF-128 per RFC 4615.
+ *
+ * Lifts AES-CMAC into a variable-length-key PRF: a 16-byte key is used directly,
+ * any other key is first compressed via CMAC under an all-zero key.
+ */
+export declare namespace AesCmacPrf128 {
+    function compute(key: Uint8Array, message: Uint8Array): Uint8Array;
+}
+//# sourceMappingURL=AesCmacPrf128.d.ts.map

package/dist/esm/crypto/AesCmacPrf128.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AesCmacPrf128.d.ts","sourceRoot":"","sources":["../../../src/crypto/AesCmacPrf128.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AA2CH;;;;;GAKG;AACH,yBAAiB,OAAO,CAAC,CAAC;IACtB,SAAgB,OAAO,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,GAAG,UAAU,CA6BxE;CACJ;AAED;;;;;GAKG;AACH,yBAAiB,aAAa,CAAC,CAAC;IAC5B,SAAgB,OAAO,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,GAAG,UAAU,CAMxE;CACJ"}