@matter/thread-br-client 0.0.1

package/dist/esm/crypto/AesCmacPrf128.js

@@ -0,0 +1,87 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { InternalError } from "@matter/general";
+import { createCipheriv } from "node:crypto";
+const BLOCK_SIZE = 16;
+const RB = 135;
+const ZERO_BLOCK = new Uint8Array(BLOCK_SIZE);
+function aesEcbEncryptBlock(key, block) {
+  const cipher = createCipheriv("aes-128-ecb", key, null);
+  cipher.setAutoPadding(false);
+  const out = cipher.update(block);
+  cipher.final();
+  return new Uint8Array(out.buffer, out.byteOffset, out.byteLength);
+}
+function leftShift1(input) {
+  const out = new Uint8Array(input.length);
+  let carry = 0;
+  for (let i = input.length - 1; i >= 0; i--) {
+    const b = input[i];
+    out[i] = b << 1 & 255 | carry;
+    carry = (b & 128) >> 7;
+  }
+  return out;
+}
+function xorInto(target, source, offset = 0) {
+  for (let i = 0; i < BLOCK_SIZE; i++) {
+    target[i] ^= source[offset + i];
+  }
+}
+function generateSubkeys(key) {
+  const l = aesEcbEncryptBlock(key, ZERO_BLOCK);
+  const k1 = leftShift1(l);
+  if ((l[0] & 128) !== 0) k1[BLOCK_SIZE - 1] ^= RB;
+  const k2 = leftShift1(k1);
+  if ((k1[0] & 128) !== 0) k2[BLOCK_SIZE - 1] ^= RB;
+  return { k1, k2 };
+}
+var AesCmac;
+((AesCmac2) => {
+  function compute(key, message) {
+    if (key.length !== 16) {
+      throw new InternalError(`AES-CMAC key must be 16 bytes, got ${key.length}`);
+    }
+    const { k1, k2 } = generateSubkeys(key);
+    const numBlocks = Math.max(1, Math.ceil(message.length / BLOCK_SIZE));
+    const lastBlockComplete = message.length > 0 && message.length % BLOCK_SIZE === 0;
+    const lastBlock = new Uint8Array(BLOCK_SIZE);
+    const lastBlockOffset = (numBlocks - 1) * BLOCK_SIZE;
+    if (lastBlockComplete) {
+      lastBlock.set(message.subarray(lastBlockOffset, lastBlockOffset + BLOCK_SIZE));
+      xorInto(lastBlock, k1);
+    } else {
+      const remaining = message.length - lastBlockOffset;
+      lastBlock.set(message.subarray(lastBlockOffset, lastBlockOffset + remaining));
+      lastBlock[remaining] = 128;
+      xorInto(lastBlock, k2);
+    }
+    const x = new Uint8Array(BLOCK_SIZE);
+    for (let i = 0; i < numBlocks - 1; i++) {
+      xorInto(x, message, i * BLOCK_SIZE);
+      const enc = aesEcbEncryptBlock(key, x);
+      x.set(enc);
+    }
+    xorInto(x, lastBlock);
+    return aesEcbEncryptBlock(key, x);
+  }
+  AesCmac2.compute = compute;
+})(AesCmac || (AesCmac = {}));
+var AesCmacPrf128;
+((AesCmacPrf1282) => {
+  function compute(key, message) {
+    if (key.length === 16) {
+      return AesCmac.compute(key, message);
+    }
+    const derivedKey = AesCmac.compute(ZERO_BLOCK, key);
+    return AesCmac.compute(derivedKey, message);
+  }
+  AesCmacPrf1282.compute = compute;
+})(AesCmacPrf128 || (AesCmacPrf128 = {}));
+export {
+  AesCmac,
+  AesCmacPrf128
+};
+//# sourceMappingURL=AesCmacPrf128.js.map

package/dist/esm/crypto/AesCmacPrf128.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": ["../../../src/crypto/AesCmacPrf128.ts"],
+  "mappings": "AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,SAAS,qBAAqB;AAC9B,SAAS,sBAAsB;AAE/B,MAAM,aAAa;AACnB,MAAM,KAAK;AACX,MAAM,aAAa,IAAI,WAAW,UAAU;AAE5C,SAAS,mBAAmB,KAAiB,OAA+B;AACxE,QAAM,SAAS,eAAe,eAAe,KAAK,IAAI;AACtD,SAAO,eAAe,KAAK;AAC3B,QAAM,MAAM,OAAO,OAAO,KAAK;AAC/B,SAAO,MAAM;AACb,SAAO,IAAI,WAAW,IAAI,QAAQ,IAAI,YAAY,IAAI,UAAU;AACpE;AAEA,SAAS,WAAW,OAA+B;AAC/C,QAAM,MAAM,IAAI,WAAW,MAAM,MAAM;AACvC,MAAI,QAAQ;AACZ,WAAS,IAAI,MAAM,SAAS,GAAG,KAAK,GAAG,KAAK;AACxC,UAAM,IAAI,MAAM,CAAC;AACjB,QAAI,CAAC,IAAM,KAAK,IAAK,MAAQ;AAC7B,aAAS,IAAI,QAAS;AAAA,EAC1B;AACA,SAAO;AACX;AAEA,SAAS,QAAQ,QAAoB,QAAoB,SAAS,GAAS;AACvE,WAAS,IAAI,GAAG,IAAI,YAAY,KAAK;AACjC,WAAO,CAAC,KAAK,OAAO,SAAS,CAAC;AAAA,EAClC;AACJ;AAEA,SAAS,gBAAgB,KAAqD;AAC1E,QAAM,IAAI,mBAAmB,KAAK,UAAU;AAC5C,QAAM,KAAK,WAAW,CAAC;AACvB,OAAK,EAAE,CAAC,IAAI,SAAU,EAAG,IAAG,aAAa,CAAC,KAAK;AAC/C,QAAM,KAAK,WAAW,EAAE;AACxB,OAAK,GAAG,CAAC,IAAI,SAAU,EAAG,IAAG,aAAa,CAAC,KAAK;AAChD,SAAO,EAAE,IAAI,GAAG;AACpB;AAQO,IAAU;AAAA,CAAV,CAAUA,aAAV;AACI,WAAS,QAAQ,KAAiB,SAAiC;AACtE,QAAI,IAAI,WAAW,IAAI;AACnB,YAAM,IAAI,cAAc,sCAAsC,IAAI,MAAM,EAAE;AAAA,IAC9E;AACA,UAAM,EAAE,IAAI,GAAG,IAAI,gBAAgB,GAAG;AAEtC,UAAM,YAAY,KAAK,IAAI,GAAG,KAAK,KAAK,QAAQ,SAAS,UAAU,CAAC;AACpE,UAAM,oBAAoB,QAAQ,SAAS,KAAK,QAAQ,SAAS,eAAe;AAEhF,UAAM,YAAY,IAAI,WAAW,UAAU;AAC3C,UAAM,mBAAmB,YAAY,KAAK;AAC1C,QAAI,mBAAmB;AACnB,gBAAU,IAAI,QAAQ,SAAS,iBAAiB,kBAAkB,UAAU,CAAC;AAC7E,cAAQ,WAAW,EAAE;AAAA,IACzB,OAAO;AACH,YAAM,YAAY,QAAQ,SAAS;AACnC,gBAAU,IAAI,QAAQ,SAAS,iBAAiB,kBAAkB,SAAS,CAAC;AAC5E,gBAAU,SAAS,IAAI;AACvB,cAAQ,WAAW,EAAE;AAAA,IACzB;AAEA,UAAM,IAAI,IAAI,WAAW,UAAU;AACnC,aAAS,IAAI,GAAG,IAAI,YAAY,GAAG,KAAK;AACpC,cAAQ,GAAG,SAAS,IAAI,UAAU;AAClC,YAAM,MAAM,mBAAmB,KAAK,CAAC;AACrC,QAAE,IAAI,GAAG;AAAA,IACb;AACA,YAAQ,GAAG,SAAS;AACpB,WAAO,mBAAmB,KAAK,CAAC;AAAA,EACpC;AA7BO,EAAAA,SAAS;AAAA,GADH;AAuCV,IAAU;AAAA,CAAV,CAAUC,mBAAV;AACI,WAAS,QAAQ,KAAiB,SAAiC;AACtE,QAAI,IAAI,WAAW,IAAI;AACnB,aAAO,QAAQ,QAAQ,KAAK,OAAO;AAAA,IACvC;AACA,UAAM,aAAa,QAAQ,QAAQ,YAAY,GAAG;AAClD,WAAO,QAAQ,QAAQ,YAAY,OAAO;AAAA,EAC9C;AANO,EAAAA,eAAS;AAAA,GADH;",
+  "names": ["AesCmac", "AesCmacPrf128"]
+}

package/dist/esm/crypto/Pbkdf2AesCmac.d.ts

@@ -0,0 +1,18 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * PBKDF2 (RFC 8018 §5.2) using AES-CMAC-PRF-128 as the underlying PRF.
+ *
+ * Hand-rolled because Node's `crypto.pbkdf2` is hardwired to HMAC. The PRF here
+ * always emits 16 bytes, so each output block needs one PRF call per iteration.
+ */
+export declare function pbkdf2AesCmac(args: {
+    password: Uint8Array;
+    salt: Uint8Array;
+    iterations: number;
+    dkLen: number;
+}): Uint8Array;
+//# sourceMappingURL=Pbkdf2AesCmac.d.ts.map

package/dist/esm/crypto/Pbkdf2AesCmac.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Pbkdf2AesCmac.d.ts","sourceRoot":"","sources":["../../../src/crypto/Pbkdf2AesCmac.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAOH;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE;IAChC,QAAQ,EAAE,UAAU,CAAC;IACrB,IAAI,EAAE,UAAU,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;CACjB,GAAG,UAAU,CAkCb"}

package/dist/esm/crypto/Pbkdf2AesCmac.js

@@ -0,0 +1,42 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { ImplementationError } from "@matter/general";
+import { AesCmacPrf128 } from "./AesCmacPrf128.js";
+const HLEN = 16;
+function pbkdf2AesCmac(args) {
+  const { password, salt, iterations, dkLen } = args;
+  if (!Number.isInteger(iterations) || iterations <= 0) {
+    throw new ImplementationError(`iterations must be a positive integer, got ${iterations}`);
+  }
+  if (!Number.isInteger(dkLen) || dkLen <= 0) {
+    throw new ImplementationError(`dkLen must be a positive integer, got ${dkLen}`);
+  }
+  if (dkLen > 4294967295 * HLEN) {
+    throw new ImplementationError(`dkLen ${dkLen} exceeds PBKDF2 maximum`);
+  }
+  const numBlocks = Math.ceil(dkLen / HLEN);
+  const out = new Uint8Array(numBlocks * HLEN);
+  const saltedBlock = new Uint8Array(salt.length + 4);
+  saltedBlock.set(salt, 0);
+  for (let i = 1; i <= numBlocks; i++) {
+    saltedBlock[salt.length] = i >>> 24 & 255;
+    saltedBlock[salt.length + 1] = i >>> 16 & 255;
+    saltedBlock[salt.length + 2] = i >>> 8 & 255;
+    saltedBlock[salt.length + 3] = i & 255;
+    let u = AesCmacPrf128.compute(password, saltedBlock);
+    const t = new Uint8Array(u);
+    for (let j = 1; j < iterations; j++) {
+      u = AesCmacPrf128.compute(password, u);
+      for (let k = 0; k < HLEN; k++) t[k] ^= u[k];
+    }
+    out.set(t, (i - 1) * HLEN);
+  }
+  return out.subarray(0, dkLen);
+}
+export {
+  pbkdf2AesCmac
+};
+//# sourceMappingURL=Pbkdf2AesCmac.js.map

package/dist/esm/crypto/Pbkdf2AesCmac.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": ["../../../src/crypto/Pbkdf2AesCmac.ts"],
+  "mappings": "AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,SAAS,2BAA2B;AACpC,SAAS,qBAAqB;AAE9B,MAAM,OAAO;AAQN,SAAS,cAAc,MAKf;AACX,QAAM,EAAE,UAAU,MAAM,YAAY,MAAM,IAAI;AAC9C,MAAI,CAAC,OAAO,UAAU,UAAU,KAAK,cAAc,GAAG;AAClD,UAAM,IAAI,oBAAoB,8CAA8C,UAAU,EAAE;AAAA,EAC5F;AACA,MAAI,CAAC,OAAO,UAAU,KAAK,KAAK,SAAS,GAAG;AACxC,UAAM,IAAI,oBAAoB,yCAAyC,KAAK,EAAE;AAAA,EAClF;AAEA,MAAI,QAAQ,aAAa,MAAM;AAC3B,UAAM,IAAI,oBAAoB,SAAS,KAAK,yBAAyB;AAAA,EACzE;AAEA,QAAM,YAAY,KAAK,KAAK,QAAQ,IAAI;AACxC,QAAM,MAAM,IAAI,WAAW,YAAY,IAAI;AAC3C,QAAM,cAAc,IAAI,WAAW,KAAK,SAAS,CAAC;AAClD,cAAY,IAAI,MAAM,CAAC;AAEvB,WAAS,IAAI,GAAG,KAAK,WAAW,KAAK;AACjC,gBAAY,KAAK,MAAM,IAAK,MAAM,KAAM;AACxC,gBAAY,KAAK,SAAS,CAAC,IAAK,MAAM,KAAM;AAC5C,gBAAY,KAAK,SAAS,CAAC,IAAK,MAAM,IAAK;AAC3C,gBAAY,KAAK,SAAS,CAAC,IAAI,IAAI;AAEnC,QAAI,IAAI,cAAc,QAAQ,UAAU,WAAW;AACnD,UAAM,IAAI,IAAI,WAAW,CAAC;AAC1B,aAAS,IAAI,GAAG,IAAI,YAAY,KAAK;AACjC,UAAI,cAAc,QAAQ,UAAU,CAAC;AACrC,eAAS,IAAI,GAAG,IAAI,MAAM,IAAK,GAAE,CAAC,KAAK,EAAE,CAAC;AAAA,IAC9C;AACA,QAAI,IAAI,IAAI,IAAI,KAAK,IAAI;AAAA,EAC7B;AAEA,SAAO,IAAI,SAAS,GAAG,KAAK;AAChC;",
+  "names": []
+}

package/dist/esm/crypto/Pskc.d.ts

@@ -0,0 +1,21 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * Thread MeshCoP PSKc derivation.
+ *
+ * Mirrors `openthread/src/core/meshcop/meshcop.cpp::GeneratePskc`. The salt
+ * concatenation order is `"Thread" || extPanId || networkName` — confirmed
+ * against the openthread main branch (the alternative `extPanId || "Thread"
+ * || networkName` ordering is wrong).
+ */
+export declare namespace Pskc {
+    function derive(args: {
+        passphrase: string;
+        extPanId: Uint8Array;
+        networkName: string;
+    }): Uint8Array;
+}
+//# sourceMappingURL=Pskc.d.ts.map

package/dist/esm/crypto/Pskc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Pskc.d.ts","sourceRoot":"","sources":["../../../src/crypto/Pskc.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAcH;;;;;;;GAOG;AACH,yBAAiB,IAAI,CAAC,CAAC;IACnB,SAAgB,MAAM,CAAC,IAAI,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,UAAU,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,GAAG,UAAU,CA4B1G;CACJ"}

package/dist/esm/crypto/Pskc.js

@@ -0,0 +1,49 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { ImplementationError } from "@matter/general";
+import { pbkdf2AesCmac } from "./Pbkdf2AesCmac.js";
+const SALT_PREFIX = new TextEncoder().encode("Thread");
+const EXT_PAN_ID_LENGTH = 8;
+const NETWORK_NAME_MAX_BYTES = 16;
+const PASSPHRASE_MIN_BYTES = 6;
+const PASSPHRASE_MAX_BYTES = 255;
+const ITERATIONS = 16384;
+const PSKC_LENGTH = 16;
+var Pskc;
+((Pskc2) => {
+  function derive(args) {
+    const password = new TextEncoder().encode(args.passphrase);
+    if (password.length < PASSPHRASE_MIN_BYTES || password.length > PASSPHRASE_MAX_BYTES) {
+      throw new ImplementationError(
+        `passphrase UTF-8 length must be ${PASSPHRASE_MIN_BYTES}..${PASSPHRASE_MAX_BYTES} bytes, got ${password.length}`
+      );
+    }
+    if (args.extPanId.length !== EXT_PAN_ID_LENGTH) {
+      throw new ImplementationError(`extPanId must be ${EXT_PAN_ID_LENGTH} bytes, got ${args.extPanId.length}`);
+    }
+    const networkNameBytes = new TextEncoder().encode(args.networkName);
+    if (networkNameBytes.length === 0 || networkNameBytes.length > NETWORK_NAME_MAX_BYTES) {
+      throw new ImplementationError(
+        `networkName UTF-8 length must be 1..${NETWORK_NAME_MAX_BYTES} bytes, got ${networkNameBytes.length}`
+      );
+    }
+    const salt = new Uint8Array(SALT_PREFIX.length + EXT_PAN_ID_LENGTH + networkNameBytes.length);
+    salt.set(SALT_PREFIX, 0);
+    salt.set(args.extPanId, SALT_PREFIX.length);
+    salt.set(networkNameBytes, SALT_PREFIX.length + EXT_PAN_ID_LENGTH);
+    return pbkdf2AesCmac({
+      password,
+      salt,
+      iterations: ITERATIONS,
+      dkLen: PSKC_LENGTH
+    });
+  }
+  Pskc2.derive = derive;
+})(Pskc || (Pskc = {}));
+export {
+  Pskc
+};
+//# sourceMappingURL=Pskc.js.map

package/dist/esm/crypto/Pskc.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": ["../../../src/crypto/Pskc.ts"],
+  "mappings": "AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,SAAS,2BAA2B;AACpC,SAAS,qBAAqB;AAE9B,MAAM,cAAc,IAAI,YAAY,EAAE,OAAO,QAAQ;AACrD,MAAM,oBAAoB;AAC1B,MAAM,yBAAyB;AAC/B,MAAM,uBAAuB;AAC7B,MAAM,uBAAuB;AAE7B,MAAM,aAAa;AACnB,MAAM,cAAc;AAUb,IAAU;AAAA,CAAV,CAAUA,UAAV;AACI,WAAS,OAAO,MAAqF;AACxG,UAAM,WAAW,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU;AACzD,QAAI,SAAS,SAAS,wBAAwB,SAAS,SAAS,sBAAsB;AAClF,YAAM,IAAI;AAAA,QACN,mCAAmC,oBAAoB,KAAK,oBAAoB,eAAe,SAAS,MAAM;AAAA,MAClH;AAAA,IACJ;AACA,QAAI,KAAK,SAAS,WAAW,mBAAmB;AAC5C,YAAM,IAAI,oBAAoB,oBAAoB,iBAAiB,eAAe,KAAK,SAAS,MAAM,EAAE;AAAA,IAC5G;AACA,UAAM,mBAAmB,IAAI,YAAY,EAAE,OAAO,KAAK,WAAW;AAClE,QAAI,iBAAiB,WAAW,KAAK,iBAAiB,SAAS,wBAAwB;AACnF,YAAM,IAAI;AAAA,QACN,uCAAuC,sBAAsB,eAAe,iBAAiB,MAAM;AAAA,MACvG;AAAA,IACJ;AAEA,UAAM,OAAO,IAAI,WAAW,YAAY,SAAS,oBAAoB,iBAAiB,MAAM;AAC5F,SAAK,IAAI,aAAa,CAAC;AACvB,SAAK,IAAI,KAAK,UAAU,YAAY,MAAM;AAC1C,SAAK,IAAI,kBAAkB,YAAY,SAAS,iBAAiB;AAEjE,WAAO,cAAc;AAAA,MACjB;AAAA,MACA;AAAA,MACA,YAAY;AAAA,MACZ,OAAO;AAAA,IACX,CAAC;AAAA,EACL;AA5BO,EAAAA,MAAS;AAAA,GADH;",
+  "names": ["Pskc"]
+}

package/dist/esm/crypto/index.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+export { AesCmac, AesCmacPrf128 } from "./AesCmacPrf128.js";
+export { pbkdf2AesCmac } from "./Pbkdf2AesCmac.js";
+export { Pskc } from "./Pskc.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/crypto/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/crypto/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC"}

package/dist/esm/crypto/index.js

@@ -0,0 +1,15 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { AesCmac, AesCmacPrf128 } from "./AesCmacPrf128.js";
+import { pbkdf2AesCmac } from "./Pbkdf2AesCmac.js";
+import { Pskc } from "./Pskc.js";
+export {
+  AesCmac,
+  AesCmacPrf128,
+  Pskc,
+  pbkdf2AesCmac
+};
+//# sourceMappingURL=index.js.map

package/dist/esm/crypto/index.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": ["../../../src/crypto/index.ts"],
+  "mappings": "AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,SAAS,SAAS,qBAAqB;AACvC,SAAS,qBAAqB;AAC9B,SAAS,YAAY;",
+  "names": []
+}

package/dist/esm/dataset/OperationalDataset.d.ts

@@ -0,0 +1,74 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { Bytes } from "@matter/general";
+import { SecurityPolicy } from "./SecurityPolicy.js";
+export { ThreadDatasetError } from "./errors.js";
+/**
+ * Decoded Thread Operational Dataset.
+ *
+ * Each named accessor mirrors a MeshCoP TLV defined in {@link MeshCopTlvType}.
+ * Unknown TLVs survive a decode/encode round-trip via {@link unknownTlvs}.
+ *
+ * Datasets returned by {@link OperationalDataset.decode} also carry hidden
+ * replay state so {@link OperationalDataset.encode} can reproduce the source
+ * bytes verbatim when no field has been mutated — preserving non-canonical
+ * encodings (legacy 1-byte CHANNEL forms, vendor-specific orderings) emitted
+ * by real Border Routers.
+ */
+export interface OperationalDataset {
+    channel?: number;
+    panId?: number;
+    extPanId?: Uint8Array;
+    networkName?: string;
+    pskc?: Uint8Array;
+    networkKey?: Uint8Array;
+    meshLocalPrefix?: Uint8Array;
+    securityPolicy?: SecurityPolicy;
+    activeTimestamp?: Uint8Array;
+    pendingTimestamp?: Uint8Array;
+    delayTimer?: number;
+    channelMask?: Uint8Array;
+    unknownTlvs: Array<{
+        type: number;
+        value: Uint8Array;
+    }>;
+    raw: Uint8Array;
+}
+export declare namespace OperationalDataset {
+    /**
+     * Decodes a Thread Operational Dataset from either raw bytes or a hex string.
+     *
+     * Accepts a whitespace-tolerant hex string (whitespace is stripped before
+     * parsing) or pre-parsed `Bytes` (e.g. a `Uint8Array`) of MeshCoP TLV bytes. Unknown TLVs survive the
+     * round-trip via {@link OperationalDataset.unknownTlvs}. Throws on malformed
+     * input (bad hex or TLV structure violations).
+     */
+    function decode(input: Bytes | string): OperationalDataset;
+    /**
+     * Encode a Thread Operational Dataset to MeshCoP TLV bytes.
+     *
+     * Datasets produced by {@link decode} are re-encoded with replay fidelity:
+     * unmodified known TLVs reproduce their original bytes (preserving non-canonical
+     * encodings from real Border Routers), while mutated fields are re-encoded
+     * canonically. Datasets constructed directly (without a prior `decode`) are
+     * always encoded in canonical form.
+     *
+     * @param ds - Dataset to encode; may be a decoded or manually constructed object.
+     * @returns MeshCoP TLV byte sequence.
+     */
+    function encode(ds: OperationalDataset): Uint8Array;
+    /**
+     * Return a copy of the dataset with `pskc` and `networkKey` cleared.
+     *
+     * Safe to log or expose via the public API — secret material is removed
+     * while all other fields (channel, network name, timestamps, etc.) are retained.
+     *
+     * @param ds - Source dataset; not mutated.
+     * @returns Shallow copy with secret fields set to `undefined`.
+     */
+    function redact(ds: OperationalDataset): OperationalDataset;
+}
+//# sourceMappingURL=OperationalDataset.d.ts.map

package/dist/esm/dataset/OperationalDataset.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"OperationalDataset.d.ts","sourceRoot":"","sources":["../../../src/dataset/OperationalDataset.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAIxC,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEjD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,kBAAkB;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,UAAU,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,eAAe,CAAC,EAAE,UAAU,CAAC;IAC7B,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,eAAe,CAAC,EAAE,UAAU,CAAC;IAC7B,gBAAgB,CAAC,EAAE,UAAU,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,UAAU,CAAC;IACzB,WAAW,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,UAAU,CAAA;KAAE,CAAC,CAAC;IACxD,GAAG,EAAE,UAAU,CAAC;CACnB;AAED,yBAAiB,kBAAkB,CAAC,CAAC;IACjC;;;;;;;OAOG;IACH,SAAgB,MAAM,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,GAAG,kBAAkB,CAgBhE;IAED;;;;;;;;;;;OAWG;IACH,SAAgB,MAAM,CAAC,EAAE,EAAE,kBAAkB,GAAG,UAAU,CAMzD;IAED;;;;;;;;OAQG;IACH,SAAgB,MAAM,CAAC,EAAE,EAAE,kBAAkB,GAAG,kBAAkB,CAEjE;CACJ"}

package/dist/esm/dataset/OperationalDataset.js

@@ -0,0 +1,224 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { Bytes } from "@matter/general";
+import { BasicTlv } from "../tlv/BasicTlvCodec.js";
+import { ThreadDatasetError } from "./errors.js";
+import { MeshCopTlvType } from "./meshcopTlvTypes.js";
+import { SecurityPolicy } from "./SecurityPolicy.js";
+import { ThreadDatasetError as ThreadDatasetError2 } from "./errors.js";
+var OperationalDataset;
+((OperationalDataset2) => {
+  function decode(input) {
+    const blob = typeof input === "string" ? Bytes.of(Bytes.fromHex(input.replace(/\s+/g, ""))) : Bytes.of(input);
+    const entries = BasicTlv.walk(blob);
+    const unknownTlvs = new Array();
+    const originalTlvs = entries.map((e) => ({ type: e.type, value: e.value.slice() }));
+    const ds = {
+      unknownTlvs,
+      raw: blob.slice()
+    };
+    ORIGINAL_TLVS.set(ds, originalTlvs);
+    for (const entry of entries) {
+      applyKnownTlvToDataset(ds, entry, unknownTlvs);
+    }
+    return ds;
+  }
+  OperationalDataset2.decode = decode;
+  function encode(ds) {
+    const originals = ORIGINAL_TLVS.get(ds);
+    if (originals !== void 0) {
+      return encodeWithReplay(ds, originals);
+    }
+    return BasicTlv.encode(canonicalEntries(ds));
+  }
+  OperationalDataset2.encode = encode;
+  function redact(ds) {
+    return { ...ds, pskc: void 0, networkKey: void 0 };
+  }
+  OperationalDataset2.redact = redact;
+})(OperationalDataset || (OperationalDataset = {}));
+const ORIGINAL_TLVS = /* @__PURE__ */ new WeakMap();
+function applyKnownTlvToDataset(ds, entry, unknownTlvs) {
+  switch (entry.type) {
+    case MeshCopTlvType.CHANNEL:
+      ds.channel = decodeChannel(entry.value);
+      break;
+    case MeshCopTlvType.PANID:
+      if (entry.value.length !== 2) {
+        throw new ThreadDatasetError(`PANID TLV must be 2 bytes, got ${entry.value.length}`);
+      }
+      ds.panId = entry.value[0] << 8 | entry.value[1];
+      break;
+    case MeshCopTlvType.EXTPANID:
+      if (entry.value.length !== 8) {
+        throw new ThreadDatasetError(`EXTPANID TLV must be 8 bytes, got ${entry.value.length}`);
+      }
+      ds.extPanId = entry.value.slice();
+      break;
+    case MeshCopTlvType.NETWORK_NAME:
+      ds.networkName = new TextDecoder("utf-8").decode(entry.value);
+      break;
+    case MeshCopTlvType.PSKC:
+      ds.pskc = entry.value.slice();
+      break;
+    case MeshCopTlvType.NETWORK_KEY:
+      if (entry.value.length !== 16) {
+        throw new ThreadDatasetError(`NETWORK_KEY TLV must be 16 bytes, got ${entry.value.length}`);
+      }
+      ds.networkKey = entry.value.slice();
+      break;
+    case MeshCopTlvType.MESH_LOCAL_PREFIX:
+      if (entry.value.length !== 8) {
+        throw new ThreadDatasetError(`MESH_LOCAL_PREFIX TLV must be 8 bytes, got ${entry.value.length}`);
+      }
+      ds.meshLocalPrefix = entry.value.slice();
+      break;
+    case MeshCopTlvType.SECURITY_POLICY:
+      ds.securityPolicy = SecurityPolicy.decode(entry.value);
+      break;
+    case MeshCopTlvType.ACTIVE_TIMESTAMP:
+      if (entry.value.length !== 8) {
+        throw new ThreadDatasetError(`ACTIVE_TIMESTAMP TLV must be 8 bytes, got ${entry.value.length}`);
+      }
+      ds.activeTimestamp = entry.value.slice();
+      break;
+    case MeshCopTlvType.PENDING_TIMESTAMP:
+      if (entry.value.length !== 8) {
+        throw new ThreadDatasetError(`PENDING_TIMESTAMP TLV must be 8 bytes, got ${entry.value.length}`);
+      }
+      ds.pendingTimestamp = entry.value.slice();
+      break;
+    case MeshCopTlvType.DELAY_TIMER:
+      if (entry.value.length !== 4) {
+        throw new ThreadDatasetError(`DELAY_TIMER TLV must be 4 bytes, got ${entry.value.length}`);
+      }
+      ds.delayTimer = entry.value[0] << 24 | entry.value[1] << 16 | entry.value[2] << 8 | entry.value[3];
+      break;
+    case MeshCopTlvType.CHANNEL_MASK:
+      ds.channelMask = entry.value.slice();
+      break;
+    default:
+      unknownTlvs.push({ type: entry.type, value: entry.value.slice() });
+      break;
+  }
+}
+function encodeWithReplay(ds, originals) {
+  const seenKnownTypes = /* @__PURE__ */ new Set();
+  const unknownCursor = /* @__PURE__ */ new Map();
+  const out = new Array();
+  const scratch = { unknownTlvs: [], raw: EMPTY_BYTES };
+  for (const original of originals) {
+    const known = KNOWN_TLV_HANDLERS.get(original.type);
+    if (known !== void 0) {
+      seenKnownTypes.add(original.type);
+      const canonical = known.encodeCurrent(ds);
+      if (canonical === void 0) continue;
+      applyKnownTlvToDataset(scratch, original, scratch.unknownTlvs);
+      if (known.equalsCurrent(ds, scratch)) {
+        out.push({ type: original.type, value: original.value });
+      } else {
+        out.push({ type: original.type, value: canonical });
+      }
+      continue;
+    }
+    const start = unknownCursor.get(original.type) ?? 0;
+    const matchIdx = ds.unknownTlvs.findIndex(
+      (u, i) => i >= start && u.type === original.type && Bytes.areEqual(u.value, original.value)
+    );
+    if (matchIdx === -1) continue;
+    unknownCursor.set(original.type, matchIdx + 1);
+    out.push({ type: original.type, value: original.value });
+  }
+  for (const known of KNOWN_TLV_HANDLERS.values()) {
+    if (seenKnownTypes.has(known.type)) continue;
+    const canonical = known.encodeCurrent(ds);
+    if (canonical === void 0) continue;
+    out.push({ type: known.type, value: canonical });
+  }
+  return BasicTlv.encode(out);
+}
+const EMPTY_BYTES = new Uint8Array();
+function canonicalEntries(ds) {
+  const out = new Array();
+  for (const known of KNOWN_TLV_HANDLERS.values()) {
+    const canonical = known.encodeCurrent(ds);
+    if (canonical === void 0) continue;
+    out.push({ type: known.type, value: canonical });
+  }
+  for (const u of ds.unknownTlvs) {
+    out.push({ type: u.type, value: u.value.slice() });
+  }
+  return out;
+}
+function handler(type, field, encodeValue, equals) {
+  return {
+    type,
+    encodeCurrent(ds) {
+      const value = ds[field];
+      if (value === void 0) return void 0;
+      return encodeValue(value);
+    },
+    equalsCurrent(ds, other) {
+      const a = ds[field];
+      const b = other[field];
+      if (a === void 0 || b === void 0) return a === b;
+      return equals(a, b);
+    }
+  };
+}
+const eqNumber = (a, b) => a === b;
+const eqString = (a, b) => a === b;
+const eqBytes = (a, b) => Bytes.areEqual(a, b);
+const eqSecurityPolicy = (a, b) => a.rotationTime === b.rotationTime && a.flags === b.flags;
+const KNOWN_TLV_HANDLERS = (() => {
+  const list = [
+    handler(
+      MeshCopTlvType.CHANNEL,
+      "channel",
+      (value) => new Uint8Array([0, value >> 8 & 255, value & 255]),
+      eqNumber
+    ),
+    handler(MeshCopTlvType.PANID, "panId", (value) => new Uint8Array([value >> 8 & 255, value & 255]), eqNumber),
+    handler(MeshCopTlvType.EXTPANID, "extPanId", (value) => value, eqBytes),
+    handler(MeshCopTlvType.NETWORK_NAME, "networkName", (value) => new TextEncoder().encode(value), eqString),
+    handler(MeshCopTlvType.PSKC, "pskc", (value) => value, eqBytes),
+    handler(MeshCopTlvType.NETWORK_KEY, "networkKey", (value) => value, eqBytes),
+    handler(MeshCopTlvType.MESH_LOCAL_PREFIX, "meshLocalPrefix", (value) => value, eqBytes),
+    handler(
+      MeshCopTlvType.SECURITY_POLICY,
+      "securityPolicy",
+      (value) => SecurityPolicy.encode(value),
+      eqSecurityPolicy
+    ),
+    handler(MeshCopTlvType.ACTIVE_TIMESTAMP, "activeTimestamp", (value) => value, eqBytes),
+    handler(MeshCopTlvType.PENDING_TIMESTAMP, "pendingTimestamp", (value) => value, eqBytes),
+    handler(
+      MeshCopTlvType.DELAY_TIMER,
+      "delayTimer",
+      (value) => new Uint8Array([value >> 24 & 255, value >> 16 & 255, value >> 8 & 255, value & 255]),
+      eqNumber
+    ),
+    handler(MeshCopTlvType.CHANNEL_MASK, "channelMask", (value) => value, eqBytes)
+  ];
+  list.sort((a, b) => a.type - b.type);
+  const map = /* @__PURE__ */ new Map();
+  for (const h of list) map.set(h.type, h);
+  return map;
+})();
+function decodeChannel(value) {
+  if (value.length === 1) {
+    return value[0];
+  }
+  if (value.length === 3) {
+    return value[1] << 8 | value[2];
+  }
+  throw new ThreadDatasetError(`CHANNEL TLV must be 1 or 3 bytes, got ${value.length}`);
+}
+export {
+  OperationalDataset,
+  ThreadDatasetError2 as ThreadDatasetError
+};
+//# sourceMappingURL=OperationalDataset.js.map

package/dist/esm/dataset/OperationalDataset.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": ["../../../src/dataset/OperationalDataset.ts"],
+  "mappings": "AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,SAAS,aAAa;AACtB,SAA6B,gBAAgB;AAC7C,SAAS,0BAA0B;AACnC,SAAS,sBAAsB;AAC/B,SAAS,sBAAsB;AAE/B,SAAS,sBAAAA,2BAA0B;AA+B5B,IAAU;AAAA,CAAV,CAAUC,wBAAV;AASI,WAAS,OAAO,OAA2C;AAC9D,UAAM,OAAO,OAAO,UAAU,WAAW,MAAM,GAAG,MAAM,QAAQ,MAAM,QAAQ,QAAQ,EAAE,CAAC,CAAC,IAAI,MAAM,GAAG,KAAK;AAC5G,UAAM,UAAU,SAAS,KAAK,IAAI;AAClC,UAAM,cAAc,IAAI,MAA2C;AACnE,UAAM,eAAe,QAAQ,IAAI,QAAM,EAAE,MAAM,EAAE,MAAM,OAAO,EAAE,MAAM,MAAM,EAAE,EAAE;AAChF,UAAM,KAAyB;AAAA,MAC3B;AAAA,MACA,KAAK,KAAK,MAAM;AAAA,IACpB;AACA,kBAAc,IAAI,IAAI,YAAY;AAElC,eAAW,SAAS,SAAS;AACzB,6BAAuB,IAAI,OAAO,WAAW;AAAA,IACjD;AAEA,WAAO;AAAA,EACX;AAhBO,EAAAA,oBAAS;AA8BT,WAAS,OAAO,IAAoC;AACvD,UAAM,YAAY,cAAc,IAAI,EAAE;AACtC,QAAI,cAAc,QAAW;AACzB,aAAO,iBAAiB,IAAI,SAAS;AAAA,IACzC;AACA,WAAO,SAAS,OAAO,iBAAiB,EAAE,CAAC;AAAA,EAC/C;AANO,EAAAA,oBAAS;AAiBT,WAAS,OAAO,IAA4C;AAC/D,WAAO,EAAE,GAAG,IAAI,MAAM,QAAW,YAAY,OAAU;AAAA,EAC3D;AAFO,EAAAA,oBAAS;AAAA,GAxDH;AAkEjB,MAAM,gBAAgB,oBAAI,QAA0D;AAEpF,SAAS,uBACL,IACA,OACA,aACI;AACJ,UAAQ,MAAM,MAAM;AAAA,IAChB,KAAK,eAAe;AAChB,SAAG,UAAU,cAAc,MAAM,KAAK;AACtC;AAAA,IACJ,KAAK,eAAe;AAChB,UAAI,MAAM,MAAM,WAAW,GAAG;AAC1B,cAAM,IAAI,mBAAmB,kCAAkC,MAAM,MAAM,MAAM,EAAE;AAAA,MACvF;AACA,SAAG,QAAS,MAAM,MAAM,CAAC,KAAK,IAAK,MAAM,MAAM,CAAC;AAChD;AAAA,IACJ,KAAK,eAAe;AAChB,UAAI,MAAM,MAAM,WAAW,GAAG;AAC1B,cAAM,IAAI,mBAAmB,qCAAqC,MAAM,MAAM,MAAM,EAAE;AAAA,MAC1F;AACA,SAAG,WAAW,MAAM,MAAM,MAAM;AAChC;AAAA,IACJ,KAAK,eAAe;AAChB,SAAG,cAAc,IAAI,YAAY,OAAO,EAAE,OAAO,MAAM,KAAK;AAC5D;AAAA,IACJ,KAAK,eAAe;AAChB,SAAG,OAAO,MAAM,MAAM,MAAM;AAC5B;AAAA,IACJ,KAAK,eAAe;AAChB,UAAI,MAAM,MAAM,WAAW,IAAI;AAC3B,cAAM,IAAI,mBAAmB,yCAAyC,MAAM,MAAM,MAAM,EAAE;AAAA,MAC9F;AACA,SAAG,aAAa,MAAM,MAAM,MAAM;AAClC;AAAA,IACJ,KAAK,eAAe;AAChB,UAAI,MAAM,MAAM,WAAW,GAAG;AAC1B,cAAM,IAAI,mBAAmB,8CAA8C,MAAM,MAAM,MAAM,EAAE;AAAA,MACnG;AACA,SAAG,kBAAkB,MAAM,MAAM,MAAM;AACvC;AAAA,IACJ,KAAK,eAAe;AAChB,SAAG,iBAAiB,eAAe,OAAO,MAAM,KAAK;AACrD;AAAA,IACJ,KAAK,eAAe;AAChB,UAAI,MAAM,MAAM,WAAW,GAAG;AAC1B,cAAM,IAAI,mBAAmB,6CAA6C,MAAM,MAAM,MAAM,EAAE;AAAA,MAClG;AACA,SAAG,kBAAkB,MAAM,MAAM,MAAM;AACvC;AAAA,IACJ,KAAK,eAAe;AAChB,UAAI,MAAM,MAAM,WAAW,GAAG;AAC1B,cAAM,IAAI,mBAAmB,8CAA8C,MAAM,MAAM,MAAM,EAAE;AAAA,MACnG;AACA,SAAG,mBAAmB,MAAM,MAAM,MAAM;AACxC;AAAA,IACJ,KAAK,eAAe;AAChB,UAAI,MAAM,MAAM,WAAW,GAAG;AAC1B,cAAM,IAAI,mBAAmB,wCAAwC,MAAM,MAAM,MAAM,EAAE;AAAA,MAC7F;AACA,SAAG,aAAc,MAAM,MAAM,CAAC,KAAK,KAAO,MAAM,MAAM,CAAC,KAAK,KAAO,MAAM,MAAM,CAAC,KAAK,IAAK,MAAM,MAAM,CAAC;AACvG;AAAA,IACJ,KAAK,eAAe;AAChB,SAAG,cAAc,MAAM,MAAM,MAAM;AACnC;AAAA,IACJ;AACI,kBAAY,KAAK,EAAE,MAAM,MAAM,MAAM,OAAO,MAAM,MAAM,MAAM,EAAE,CAAC;AACjE;AAAA,EACR;AACJ;AAEA,SAAS,iBAAiB,IAAwB,WAAqD;AACnG,QAAM,iBAAiB,oBAAI,IAAY;AACvC,QAAM,gBAAgB,oBAAI,IAAoB;AAC9C,QAAM,MAAM,IAAI,MAAqB;AACrC,QAAM,UAA8B,EAAE,aAAa,CAAC,GAAG,KAAK,YAAY;AAExE,aAAW,YAAY,WAAW;AAC9B,UAAM,QAAQ,mBAAmB,IAAI,SAAS,IAAI;AAClD,QAAI,UAAU,QAAW;AACrB,qBAAe,IAAI,SAAS,IAAI;AAChC,YAAM,YAAY,MAAM,cAAc,EAAE;AACxC,UAAI,cAAc,OAAW;AAG7B,6BAAuB,SAAS,UAAU,QAAQ,WAAW;AAC7D,UAAI,MAAM,cAAc,IAAI,OAAO,GAAG;AAClC,YAAI,KAAK,EAAE,MAAM,SAAS,MAAM,OAAO,SAAS,MAAM,CAAC;AAAA,MAC3D,OAAO;AACH,YAAI,KAAK,EAAE,MAAM,SAAS,MAAM,OAAO,UAAU,CAAC;AAAA,MACtD;AACA;AAAA,IACJ;AACA,UAAM,QAAQ,cAAc,IAAI,SAAS,IAAI,KAAK;AAClD,UAAM,WAAW,GAAG,YAAY;AAAA,MAC5B,CAAC,GAAG,MAAM,KAAK,SAAS,EAAE,SAAS,SAAS,QAAQ,MAAM,SAAS,EAAE,OAAO,SAAS,KAAK;AAAA,IAC9F;AACA,QAAI,aAAa,GAAI;AACrB,kBAAc,IAAI,SAAS,MAAM,WAAW,CAAC;AAC7C,QAAI,KAAK,EAAE,MAAM,SAAS,MAAM,OAAO,SAAS,MAAM,CAAC;AAAA,EAC3D;AAEA,aAAW,SAAS,mBAAmB,OAAO,GAAG;AAC7C,QAAI,eAAe,IAAI,MAAM,IAAI,EAAG;AACpC,UAAM,YAAY,MAAM,cAAc,EAAE;AACxC,QAAI,cAAc,OAAW;AAC7B,QAAI,KAAK,EAAE,MAAM,MAAM,MAAM,OAAO,UAAU,CAAC;AAAA,EACnD;AAEA,SAAO,SAAS,OAAO,GAAG;AAC9B;AAEA,MAAM,cAAc,IAAI,WAAW;AAEnC,SAAS,iBAAiB,IAAyC;AAC/D,QAAM,MAAM,IAAI,MAAqB;AACrC,aAAW,SAAS,mBAAmB,OAAO,GAAG;AAC7C,UAAM,YAAY,MAAM,cAAc,EAAE;AACxC,QAAI,cAAc,OAAW;AAC7B,QAAI,KAAK,EAAE,MAAM,MAAM,MAAM,OAAO,UAAU,CAAC;AAAA,EACnD;AACA,aAAW,KAAK,GAAG,aAAa;AAC5B,QAAI,KAAK,EAAE,MAAM,EAAE,MAAM,OAAO,EAAE,MAAM,MAAM,EAAE,CAAC;AAAA,EACrD;AACA,SAAO;AACX;AAcA,SAAS,QACL,MACA,OACA,aACA,QACe;AACf,SAAO;AAAA,IACH;AAAA,IACA,cAAc,IAAI;AACd,YAAM,QAAQ,GAAG,KAAK;AACtB,UAAI,UAAU,OAAW,QAAO;AAChC,aAAO,YAAY,KAAK;AAAA,IAC5B;AAAA,IACA,cAAc,IAAI,OAAO;AACrB,YAAM,IAAI,GAAG,KAAK;AAClB,YAAM,IAAI,MAAM,KAAK;AACrB,UAAI,MAAM,UAAa,MAAM,OAAW,QAAO,MAAM;AACrD,aAAO,OAAO,GAAG,CAAC;AAAA,IACtB;AAAA,EACJ;AACJ;AAEA,MAAM,WAAW,CAAC,GAAW,MAAuB,MAAM;AAC1D,MAAM,WAAW,CAAC,GAAW,MAAuB,MAAM;AAC1D,MAAM,UAAU,CAAC,GAAe,MAA2B,MAAM,SAAS,GAAG,CAAC;AAC9E,MAAM,mBAAmB,CAAC,GAAmB,MACzC,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,UAAU,EAAE;AAEvD,MAAM,sBAAoD,MAAM;AAC5D,QAAM,OAA0B;AAAA,IAC5B;AAAA,MACI,eAAe;AAAA,MACf;AAAA,MACA,WAAS,IAAI,WAAW,CAAC,GAAO,SAAS,IAAK,KAAM,QAAQ,GAAI,CAAC;AAAA,MACjE;AAAA,IACJ;AAAA,IACA,QAAQ,eAAe,OAAO,SAAS,WAAS,IAAI,WAAW,CAAE,SAAS,IAAK,KAAM,QAAQ,GAAI,CAAC,GAAG,QAAQ;AAAA,IAC7G,QAAQ,eAAe,UAAU,YAAY,WAAS,OAAO,OAAO;AAAA,IACpE,QAAQ,eAAe,cAAc,eAAe,WAAS,IAAI,YAAY,EAAE,OAAO,KAAK,GAAG,QAAQ;AAAA,IACtG,QAAQ,eAAe,MAAM,QAAQ,WAAS,OAAO,OAAO;AAAA,IAC5D,QAAQ,eAAe,aAAa,cAAc,WAAS,OAAO,OAAO;AAAA,IACzE,QAAQ,eAAe,mBAAmB,mBAAmB,WAAS,OAAO,OAAO;AAAA,IACpF;AAAA,MACI,eAAe;AAAA,MACf;AAAA,MACA,WAAS,eAAe,OAAO,KAAK;AAAA,MACpC;AAAA,IACJ;AAAA,IACA,QAAQ,eAAe,kBAAkB,mBAAmB,WAAS,OAAO,OAAO;AAAA,IACnF,QAAQ,eAAe,mBAAmB,oBAAoB,WAAS,OAAO,OAAO;AAAA,IACrF;AAAA,MACI,eAAe;AAAA,MACf;AAAA,MACA,WAAS,IAAI,WAAW,CAAE,SAAS,KAAM,KAAO,SAAS,KAAM,KAAO,SAAS,IAAK,KAAM,QAAQ,GAAI,CAAC;AAAA,MACvG;AAAA,IACJ;AAAA,IACA,QAAQ,eAAe,cAAc,eAAe,WAAS,OAAO,OAAO;AAAA,EAC/E;AACA,OAAK,KAAK,CAAC,GAAG,MAAM,EAAE,OAAO,EAAE,IAAI;AACnC,QAAM,MAAM,oBAAI,IAA6B;AAC7C,aAAW,KAAK,KAAM,KAAI,IAAI,EAAE,MAAM,CAAC;AACvC,SAAO;AACX,GAAG;AAOH,SAAS,cAAc,OAA2B;AAC9C,MAAI,MAAM,WAAW,GAAG;AACpB,WAAO,MAAM,CAAC;AAAA,EAClB;AACA,MAAI,MAAM,WAAW,GAAG;AACpB,WAAQ,MAAM,CAAC,KAAK,IAAK,MAAM,CAAC;AAAA,EACpC;AACA,QAAM,IAAI,mBAAmB,yCAAyC,MAAM,MAAM,EAAE;AACxF;",
+  "names": ["ThreadDatasetError", "OperationalDataset"]
+}

package/dist/esm/dataset/SecurityPolicy.d.ts

@@ -0,0 +1,22 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * MeshCoP Security Policy TLV (type 12) is a fixed 4-byte payload: 2-byte
+ * big-endian rotation time (hours) followed by 2 bytes of policy flags.
+ *
+ * Flag bits track the version-dependent layout in Thread spec §8.10.1.15;
+ * we expose the raw 16-bit value so callers can interpret bits as needed
+ * without locking the codec to a particular Thread revision.
+ */
+export interface SecurityPolicy {
+    rotationTime: number;
+    flags: number;
+}
+export declare namespace SecurityPolicy {
+    function decode(value: Uint8Array): SecurityPolicy;
+    function encode(policy: SecurityPolicy): Uint8Array;
+}
+//# sourceMappingURL=SecurityPolicy.d.ts.map

package/dist/esm/dataset/SecurityPolicy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityPolicy.d.ts","sourceRoot":"","sources":["../../../src/dataset/SecurityPolicy.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH;;;;;;;GAOG;AACH,MAAM,WAAW,cAAc;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;CACjB;AAED,yBAAiB,cAAc,CAAC,CAAC;IAC7B,SAAgB,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,cAAc,CAQxD;IAED,SAAgB,MAAM,CAAC,MAAM,EAAE,cAAc,GAAG,UAAU,CAazD;CACJ"}