@matter/thread-br-client 0.0.1

package/dist/cjs/commissioner/LeadPet.js

@@ -0,0 +1,66 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var LeadPet_exports = {};
+__export(LeadPet_exports, {
+  LeadPet: () => LeadPet
+});
+module.exports = __toCommonJS(LeadPet_exports);
+var import_general = require("@matter/general");
+var import_meshcopTlvTypes = require("../dataset/meshcopTlvTypes.js");
+var import_BasicTlvCodec = require("../tlv/BasicTlvCodec.js");
+var import_LeadKa = require("./LeadKa.js");
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+var LeadPet;
+((LeadPet2) => {
+  function buildRequest(commissionerId) {
+    return import_BasicTlvCodec.BasicTlv.encode([
+      { type: import_meshcopTlvTypes.MeshCopTlvType.COMMISSIONER_ID, value: new TextEncoder().encode(commissionerId) }
+    ]);
+  }
+  LeadPet2.buildRequest = buildRequest;
+  function parseResponse(payload) {
+    const entries = import_BasicTlvCodec.BasicTlv.walk(payload);
+    let state;
+    let sessionId;
+    for (const entry of entries) {
+      if (entry.type === import_meshcopTlvTypes.MeshCopTlvType.STATE) {
+        const byte = entry.value[0];
+        if (byte === 1) state = "accept";
+        else if (byte === 255) state = "reject";
+        else if (byte === 0) state = "pending";
+        else throw new import_LeadKa.CommissionerProtocolError(`LeadPet: unknown state byte ${byte}`);
+      } else if (entry.type === import_meshcopTlvTypes.MeshCopTlvType.COMMISSIONER_SESSION_ID) {
+        sessionId = entry.value[0] << 8 | entry.value[1];
+      }
+    }
+    if (state === void 0) {
+      const tlvSummary = entries.length === 0 ? "none" : entries.map((e) => `t=0x${e.type.toString(16)}/${e.value.length}b`).join(",");
+      throw new import_LeadKa.CommissionerProtocolError(
+        `LeadPet: response missing STATE TLV (payload=${import_general.Bytes.toHex(payload)}, tlvs=[${tlvSummary}])`
+      );
+    }
+    return state === "accept" ? { state, sessionId } : { state };
+  }
+  LeadPet2.parseResponse = parseResponse;
+})(LeadPet || (LeadPet = {}));
+//# sourceMappingURL=LeadPet.js.map

package/dist/cjs/commissioner/LeadPet.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": ["../../../src/commissioner/LeadPet.ts"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,qBAAsB;AACtB,6BAA+B;AAC/B,2BAAyB;AACzB,oBAA0C;AAT1C;AAAA;AAAA;AAAA;AAAA;AAgBO,IAAU;AAAA,CAAV,CAAUA,aAAV;AACI,WAAS,aAAa,gBAAoC;AAC7D,WAAO,8BAAS,OAAO;AAAA,MACnB,EAAE,MAAM,sCAAe,iBAAiB,OAAO,IAAI,YAAY,EAAE,OAAO,cAAc,EAAE;AAAA,IAC5F,CAAC;AAAA,EACL;AAJO,EAAAA,SAAS;AAMT,WAAS,cAAc,SAAsC;AAChE,UAAM,UAAU,8BAAS,KAAK,OAAO;AACrC,QAAI;AACJ,QAAI;AAEJ,eAAW,SAAS,SAAS;AACzB,UAAI,MAAM,SAAS,sCAAe,OAAO;AACrC,cAAM,OAAO,MAAM,MAAM,CAAC;AAC1B,YAAI,SAAS,EAAM,SAAQ;AAAA,iBAClB,SAAS,IAAM,SAAQ;AAAA,iBACvB,SAAS,EAAM,SAAQ;AAAA,YAC3B,OAAM,IAAI,wCAA0B,+BAA+B,IAAI,EAAE;AAAA,MAClF,WAAW,MAAM,SAAS,sCAAe,yBAAyB;AAC9D,oBAAa,MAAM,MAAM,CAAC,KAAK,IAAK,MAAM,MAAM,CAAC;AAAA,MACrD;AAAA,IACJ;AAEA,QAAI,UAAU,QAAW;AACrB,YAAM,aACF,QAAQ,WAAW,IACb,SACA,QAAQ,IAAI,OAAK,OAAO,EAAE,KAAK,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,MAAM,GAAG,EAAE,KAAK,GAAG;AACpF,YAAM,IAAI;AAAA,QACN,gDAAgD,qBAAM,MAAM,OAAO,CAAC,WAAW,UAAU;AAAA,MAC7F;AAAA,IACJ;AAEA,WAAO,UAAU,WAAW,EAAE,OAAO,UAAU,IAAI,EAAE,MAAM;AAAA,EAC/D;AA5BO,EAAAA,SAAS;AAAA,GAPH;",
+  "names": ["LeadPet"]
+}

package/dist/cjs/commissioner/index.d.ts

@@ -0,0 +1,12 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+export { Commissioner, CommissionerKeepAliveError, CommissionerRejectedError, CommissionerTimeoutError, } from "./Commissioner.js";
+export type { CommissionerOpts } from "./Commissioner.js";
+export { CommissionerProtocolError, LeadKa } from "./LeadKa.js";
+export type { LeadKaResponse } from "./LeadKa.js";
+export { LeadPet } from "./LeadPet.js";
+export type { LeadPetResponse } from "./LeadPet.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/cjs/commissioner/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/commissioner/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACH,YAAY,EACZ,0BAA0B,EAC1B,yBAAyB,EACzB,wBAAwB,GAC3B,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,yBAAyB,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAChE,YAAY,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,YAAY,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC"}

package/dist/cjs/commissioner/index.js

@@ -0,0 +1,38 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var commissioner_exports = {};
+__export(commissioner_exports, {
+  Commissioner: () => import_Commissioner.Commissioner,
+  CommissionerKeepAliveError: () => import_Commissioner.CommissionerKeepAliveError,
+  CommissionerProtocolError: () => import_LeadKa.CommissionerProtocolError,
+  CommissionerRejectedError: () => import_Commissioner.CommissionerRejectedError,
+  CommissionerTimeoutError: () => import_Commissioner.CommissionerTimeoutError,
+  LeadKa: () => import_LeadKa.LeadKa,
+  LeadPet: () => import_LeadPet.LeadPet
+});
+module.exports = __toCommonJS(commissioner_exports);
+var import_Commissioner = require("./Commissioner.js");
+var import_LeadKa = require("./LeadKa.js");
+var import_LeadPet = require("./LeadPet.js");
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+//# sourceMappingURL=index.js.map

package/dist/cjs/commissioner/index.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": ["../../../src/commissioner/index.ts"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,0BAKO;AAEP,oBAAkD;AAElD,qBAAwB;AAfxB;AAAA;AAAA;AAAA;AAAA;",
+  "names": []
+}

package/dist/cjs/credentials/ThreadCredentialsRegistry.d.ts

@@ -0,0 +1,50 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { Observable } from "@matter/general";
+import type { OperationalDataset } from "../dataset/OperationalDataset.js";
+import type { ThreadNetworkCredentials } from "./ThreadNetworkCredentials.js";
+/**
+ * In-memory registry of {@link ThreadNetworkCredentials} keyed by extended PAN ID.
+ *
+ * Source of truth for "what credentials do we have to talk to which Thread network".
+ * Diagnostic flows look up entries by extPanId; the network key is dropped on
+ * registration so the registry never holds it.
+ */
+export declare class ThreadCredentialsRegistry {
+    #private;
+    readonly events: {
+        registered: Observable<[creds: ThreadNetworkCredentials], void>;
+        unregistered: Observable<[extPanId: Uint8Array<ArrayBufferLike>], void>;
+    };
+    /**
+     * Register credentials extracted from a parsed Operational Dataset.
+     *
+     * `networkKey` is intentionally dropped on the way in — the registry stores
+     * only what's needed for diagnostic queries (extPanId, networkName, pskc,
+     * activeTimestamp). Smaller blast radius for the most sensitive secret.
+     *
+     * Replaces any existing entry for the same extPanId; throws if the dataset
+     * lacks extPanId, networkName, or pskc.
+     */
+    register(dataset: OperationalDataset): void;
+    /**
+     * Register credentials directly. Intended for tests and external sources
+     * that don't carry a full dataset. Same replacement semantics as {@link register}.
+     *
+     * Replacement always fires `registered` once with the new entry; the old entry
+     * is silently overwritten because consumers care about "what is current", not
+     * about churn. Intentional even when the new dataset's `activeTimestamp` is
+     * older — losing an update is worse than a noisy log line.
+     */
+    registerCredentials(creds: ThreadNetworkCredentials): void;
+    /** Remove an entry. No-op if absent. */
+    unregister(extPanId: Uint8Array): void;
+    /** Lookup by extPanId. Comparison is by Uint8Array equality, not reference. */
+    getCredentials(extPanId: Uint8Array): ThreadNetworkCredentials | undefined;
+    /** Defensive snapshot — caller cannot mutate the registry through it. */
+    list(): ReadonlyArray<ThreadNetworkCredentials>;
+}
+//# sourceMappingURL=ThreadCredentialsRegistry.d.ts.map

package/dist/cjs/credentials/ThreadCredentialsRegistry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ThreadCredentialsRegistry.d.ts","sourceRoot":"","sources":["../../../src/credentials/ThreadCredentialsRegistry.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAA8B,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACzE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAE9E;;;;;;GAMG;AACH,qBAAa,yBAAyB;;IAElC,QAAQ,CAAC,MAAM;QACX,UAAU;QACV,YAAY;MACd;IAEF;;;;;;;;;OASG;IACH,QAAQ,CAAC,OAAO,EAAE,kBAAkB,GAAG,IAAI,CAiB1C;IAED;;;;;;;;OAQG;IACH,mBAAmB,CAAC,KAAK,EAAE,wBAAwB,GAAG,IAAI,CAWzD;IAED,wCAAwC;IACxC,UAAU,CAAC,QAAQ,EAAE,UAAU,GAAG,IAAI,CAKrC;IAED,+EAA+E;IAC/E,cAAc,CAAC,QAAQ,EAAE,UAAU,GAAG,wBAAwB,GAAG,SAAS,CAEzE;IAED,yEAAyE;IACzE,IAAI,IAAI,aAAa,CAAC,wBAAwB,CAAC,CAE9C;CACJ"}

package/dist/cjs/credentials/ThreadCredentialsRegistry.js

@@ -0,0 +1,119 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var ThreadCredentialsRegistry_exports = {};
+__export(ThreadCredentialsRegistry_exports, {
+  ThreadCredentialsRegistry: () => ThreadCredentialsRegistry
+});
+module.exports = __toCommonJS(ThreadCredentialsRegistry_exports);
+var import_general = require("@matter/general");
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+class ThreadCredentialsRegistry {
+  #byExtPanId = /* @__PURE__ */ new Map();
+  events = {
+    registered: new import_general.Observable(),
+    unregistered: new import_general.Observable()
+  };
+  /**
+   * Register credentials extracted from a parsed Operational Dataset.
+   *
+   * `networkKey` is intentionally dropped on the way in — the registry stores
+   * only what's needed for diagnostic queries (extPanId, networkName, pskc,
+   * activeTimestamp). Smaller blast radius for the most sensitive secret.
+   *
+   * Replaces any existing entry for the same extPanId; throws if the dataset
+   * lacks extPanId, networkName, or pskc.
+   */
+  register(dataset) {
+    if (dataset.extPanId === void 0) {
+      throw new import_general.ImplementationError("Cannot register credentials: dataset is missing extPanId");
+    }
+    if (dataset.networkName === void 0) {
+      throw new import_general.ImplementationError("Cannot register credentials: dataset is missing networkName");
+    }
+    if (dataset.pskc === void 0) {
+      throw new import_general.ImplementationError("Cannot register credentials: dataset is missing pskc");
+    }
+    this.registerCredentials({
+      extPanId: dataset.extPanId,
+      networkName: dataset.networkName,
+      pskc: dataset.pskc,
+      meshLocalPrefix: dataset.meshLocalPrefix,
+      activeTimestamp: dataset.activeTimestamp === void 0 ? void 0 : bytesToBigint(dataset.activeTimestamp)
+    });
+  }
+  /**
+   * Register credentials directly. Intended for tests and external sources
+   * that don't carry a full dataset. Same replacement semantics as {@link register}.
+   *
+   * Replacement always fires `registered` once with the new entry; the old entry
+   * is silently overwritten because consumers care about "what is current", not
+   * about churn. Intentional even when the new dataset's `activeTimestamp` is
+   * older — losing an update is worse than a noisy log line.
+   */
+  registerCredentials(creds) {
+    const stored = {
+      extPanId: creds.extPanId.slice(),
+      networkName: creds.networkName,
+      pskc: creds.pskc.slice(),
+      meshLocalPrefix: creds.meshLocalPrefix?.slice(),
+      activeTimestamp: creds.activeTimestamp
+    };
+    this.#byExtPanId.set(keyOf(stored.extPanId), stored);
+    this.events.registered.emit(snapshot(stored));
+  }
+  /** Remove an entry. No-op if absent. */
+  unregister(extPanId) {
+    const key = keyOf(extPanId);
+    if (!this.#byExtPanId.has(key)) return;
+    this.#byExtPanId.delete(key);
+    this.events.unregistered.emit(extPanId.slice());
+  }
+  /** Lookup by extPanId. Comparison is by Uint8Array equality, not reference. */
+  getCredentials(extPanId) {
+    return this.#byExtPanId.get(keyOf(extPanId));
+  }
+  /** Defensive snapshot — caller cannot mutate the registry through it. */
+  list() {
+    return Array.from(this.#byExtPanId.values());
+  }
+}
+function keyOf(extPanId) {
+  return import_general.Bytes.toHex(extPanId);
+}
+function snapshot(creds) {
+  return {
+    extPanId: creds.extPanId.slice(),
+    networkName: creds.networkName,
+    pskc: creds.pskc.slice(),
+    meshLocalPrefix: creds.meshLocalPrefix?.slice(),
+    activeTimestamp: creds.activeTimestamp
+  };
+}
+function bytesToBigint(bytes) {
+  let result = 0n;
+  for (const b of bytes) {
+    result = result << 8n | BigInt(b);
+  }
+  return result;
+}
+//# sourceMappingURL=ThreadCredentialsRegistry.js.map

package/dist/cjs/credentials/ThreadCredentialsRegistry.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": ["../../../src/credentials/ThreadCredentialsRegistry.ts"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,qBAAuD;AANvD;AAAA;AAAA;AAAA;AAAA;AAiBO,MAAM,0BAA0B;AAAA,EAC1B,cAAc,oBAAI,IAAsC;AAAA,EACxD,SAAS;AAAA,IACd,YAAY,IAAI,0BAA8C;AAAA,IAC9D,cAAc,IAAI,0BAAmC;AAAA,EACzD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,SAAS,SAAmC;AACxC,QAAI,QAAQ,aAAa,QAAW;AAChC,YAAM,IAAI,mCAAoB,0DAA0D;AAAA,IAC5F;AACA,QAAI,QAAQ,gBAAgB,QAAW;AACnC,YAAM,IAAI,mCAAoB,6DAA6D;AAAA,IAC/F;AACA,QAAI,QAAQ,SAAS,QAAW;AAC5B,YAAM,IAAI,mCAAoB,sDAAsD;AAAA,IACxF;AACA,SAAK,oBAAoB;AAAA,MACrB,UAAU,QAAQ;AAAA,MAClB,aAAa,QAAQ;AAAA,MACrB,MAAM,QAAQ;AAAA,MACd,iBAAiB,QAAQ;AAAA,MACzB,iBAAiB,QAAQ,oBAAoB,SAAY,SAAY,cAAc,QAAQ,eAAe;AAAA,IAC9G,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,oBAAoB,OAAuC;AACvD,UAAM,SAAmC;AAAA,MACrC,UAAU,MAAM,SAAS,MAAM;AAAA,MAC/B,aAAa,MAAM;AAAA,MACnB,MAAM,MAAM,KAAK,MAAM;AAAA,MACvB,iBAAiB,MAAM,iBAAiB,MAAM;AAAA,MAC9C,iBAAiB,MAAM;AAAA,IAC3B;AACA,SAAK,YAAY,IAAI,MAAM,OAAO,QAAQ,GAAG,MAAM;AAEnD,SAAK,OAAO,WAAW,KAAK,SAAS,MAAM,CAAC;AAAA,EAChD;AAAA;AAAA,EAGA,WAAW,UAA4B;AACnC,UAAM,MAAM,MAAM,QAAQ;AAC1B,QAAI,CAAC,KAAK,YAAY,IAAI,GAAG,EAAG;AAChC,SAAK,YAAY,OAAO,GAAG;AAC3B,SAAK,OAAO,aAAa,KAAK,SAAS,MAAM,CAAC;AAAA,EAClD;AAAA;AAAA,EAGA,eAAe,UAA4D;AACvE,WAAO,KAAK,YAAY,IAAI,MAAM,QAAQ,CAAC;AAAA,EAC/C;AAAA;AAAA,EAGA,OAAgD;AAC5C,WAAO,MAAM,KAAK,KAAK,YAAY,OAAO,CAAC;AAAA,EAC/C;AACJ;AAEA,SAAS,MAAM,UAA8B;AACzC,SAAO,qBAAM,MAAM,QAAQ;AAC/B;AAEA,SAAS,SAAS,OAA2D;AACzE,SAAO;AAAA,IACH,UAAU,MAAM,SAAS,MAAM;AAAA,IAC/B,aAAa,MAAM;AAAA,IACnB,MAAM,MAAM,KAAK,MAAM;AAAA,IACvB,iBAAiB,MAAM,iBAAiB,MAAM;AAAA,IAC9C,iBAAiB,MAAM;AAAA,EAC3B;AACJ;AAIA,SAAS,cAAc,OAA2B;AAC9C,MAAI,SAAS;AACb,aAAW,KAAK,OAAO;AACnB,aAAU,UAAU,KAAM,OAAO,CAAC;AAAA,EACtC;AACA,SAAO;AACX;",
+  "names": []
+}

package/dist/cjs/credentials/ThreadNetworkCredentials.d.ts

@@ -0,0 +1,26 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * Credentials needed to authenticate against a Thread network's commissioner.
+ *
+ * Holds only what the diagnostic flow actually needs — the network key is
+ * intentionally absent because nothing in this codebase ever sends or uses it,
+ * keeping the blast radius of an in-memory leak as small as possible.
+ */
+export interface ThreadNetworkCredentials {
+    /** 8-byte extended PAN ID — primary registry key. */
+    extPanId: Uint8Array;
+    /** Thread network name (UTF-8, ≤16 bytes). */
+    networkName: string;
+    /** 16-byte EC-JPAKE password (PSKc). Sensitive — redact when logging. */
+    pskc: Uint8Array;
+    /** 8-byte mesh-local prefix, used to derive node mesh-local addresses for
+     *  UDP-proxy unicast diagnostics. Absent if the dataset omits it. */
+    meshLocalPrefix?: Uint8Array;
+    /** Active timestamp from the dataset, used for change detection. */
+    activeTimestamp?: bigint;
+}
+//# sourceMappingURL=ThreadNetworkCredentials.d.ts.map

package/dist/cjs/credentials/ThreadNetworkCredentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ThreadNetworkCredentials.d.ts","sourceRoot":"","sources":["../../../src/credentials/ThreadNetworkCredentials.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;;;GAMG;AACH,MAAM,WAAW,wBAAwB;IACrC,qDAAqD;IACrD,QAAQ,EAAE,UAAU,CAAC;IACrB,8CAA8C;IAC9C,WAAW,EAAE,MAAM,CAAC;IACpB,yEAAyE;IACzE,IAAI,EAAE,UAAU,CAAC;IACjB;yEACqE;IACrE,eAAe,CAAC,EAAE,UAAU,CAAC;IAC7B,oEAAoE;IACpE,eAAe,CAAC,EAAE,MAAM,CAAC;CAC5B"}

package/dist/cjs/credentials/ThreadNetworkCredentials.js

@@ -0,0 +1,22 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var ThreadNetworkCredentials_exports = {};
+module.exports = __toCommonJS(ThreadNetworkCredentials_exports);
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+//# sourceMappingURL=ThreadNetworkCredentials.js.map

package/dist/cjs/credentials/ThreadNetworkCredentials.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": ["../../../src/credentials/ThreadNetworkCredentials.ts"],
+  "mappings": ";;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;",
+  "names": []
+}

package/dist/cjs/credentials/index.d.ts

@@ -0,0 +1,8 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+export { ThreadCredentialsRegistry } from "./ThreadCredentialsRegistry.js";
+export type { ThreadNetworkCredentials } from "./ThreadNetworkCredentials.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/cjs/credentials/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/credentials/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,YAAY,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC"}

package/dist/cjs/credentials/index.js

@@ -0,0 +1,30 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var credentials_exports = {};
+__export(credentials_exports, {
+  ThreadCredentialsRegistry: () => import_ThreadCredentialsRegistry.ThreadCredentialsRegistry
+});
+module.exports = __toCommonJS(credentials_exports);
+var import_ThreadCredentialsRegistry = require("./ThreadCredentialsRegistry.js");
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+//# sourceMappingURL=index.js.map

package/dist/cjs/credentials/index.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": ["../../../src/credentials/index.ts"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,uCAA0C;AAN1C;AAAA;AAAA;AAAA;AAAA;",
+  "names": []
+}

package/dist/cjs/crypto/AesCmacPrf128.d.ts

@@ -0,0 +1,24 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * AES-CMAC per RFC 4493.
+ *
+ * Block-cipher-based MAC with a 128-bit AES key and a 16-byte tag. Empty messages
+ * are explicitly supported and pad to a single all-zero block XORed with K2.
+ */
+export declare namespace AesCmac {
+    function compute(key: Uint8Array, message: Uint8Array): Uint8Array;
+}
+/**
+ * AES-CMAC-PRF-128 per RFC 4615.
+ *
+ * Lifts AES-CMAC into a variable-length-key PRF: a 16-byte key is used directly,
+ * any other key is first compressed via CMAC under an all-zero key.
+ */
+export declare namespace AesCmacPrf128 {
+    function compute(key: Uint8Array, message: Uint8Array): Uint8Array;
+}
+//# sourceMappingURL=AesCmacPrf128.d.ts.map

package/dist/cjs/crypto/AesCmacPrf128.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AesCmacPrf128.d.ts","sourceRoot":"","sources":["../../../src/crypto/AesCmacPrf128.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AA2CH;;;;;GAKG;AACH,yBAAiB,OAAO,CAAC,CAAC;IACtB,SAAgB,OAAO,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,GAAG,UAAU,CA6BxE;CACJ;AAED;;;;;GAKG;AACH,yBAAiB,aAAa,CAAC,CAAC;IAC5B,SAAgB,OAAO,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,GAAG,UAAU,CAMxE;CACJ"}

package/dist/cjs/crypto/AesCmacPrf128.js

@@ -0,0 +1,107 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var AesCmacPrf128_exports = {};
+__export(AesCmacPrf128_exports, {
+  AesCmac: () => AesCmac,
+  AesCmacPrf128: () => AesCmacPrf128
+});
+module.exports = __toCommonJS(AesCmacPrf128_exports);
+var import_general = require("@matter/general");
+var import_node_crypto = require("node:crypto");
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+const BLOCK_SIZE = 16;
+const RB = 135;
+const ZERO_BLOCK = new Uint8Array(BLOCK_SIZE);
+function aesEcbEncryptBlock(key, block) {
+  const cipher = (0, import_node_crypto.createCipheriv)("aes-128-ecb", key, null);
+  cipher.setAutoPadding(false);
+  const out = cipher.update(block);
+  cipher.final();
+  return new Uint8Array(out.buffer, out.byteOffset, out.byteLength);
+}
+function leftShift1(input) {
+  const out = new Uint8Array(input.length);
+  let carry = 0;
+  for (let i = input.length - 1; i >= 0; i--) {
+    const b = input[i];
+    out[i] = b << 1 & 255 | carry;
+    carry = (b & 128) >> 7;
+  }
+  return out;
+}
+function xorInto(target, source, offset = 0) {
+  for (let i = 0; i < BLOCK_SIZE; i++) {
+    target[i] ^= source[offset + i];
+  }
+}
+function generateSubkeys(key) {
+  const l = aesEcbEncryptBlock(key, ZERO_BLOCK);
+  const k1 = leftShift1(l);
+  if ((l[0] & 128) !== 0) k1[BLOCK_SIZE - 1] ^= RB;
+  const k2 = leftShift1(k1);
+  if ((k1[0] & 128) !== 0) k2[BLOCK_SIZE - 1] ^= RB;
+  return { k1, k2 };
+}
+var AesCmac;
+((AesCmac2) => {
+  function compute(key, message) {
+    if (key.length !== 16) {
+      throw new import_general.InternalError(`AES-CMAC key must be 16 bytes, got ${key.length}`);
+    }
+    const { k1, k2 } = generateSubkeys(key);
+    const numBlocks = Math.max(1, Math.ceil(message.length / BLOCK_SIZE));
+    const lastBlockComplete = message.length > 0 && message.length % BLOCK_SIZE === 0;
+    const lastBlock = new Uint8Array(BLOCK_SIZE);
+    const lastBlockOffset = (numBlocks - 1) * BLOCK_SIZE;
+    if (lastBlockComplete) {
+      lastBlock.set(message.subarray(lastBlockOffset, lastBlockOffset + BLOCK_SIZE));
+      xorInto(lastBlock, k1);
+    } else {
+      const remaining = message.length - lastBlockOffset;
+      lastBlock.set(message.subarray(lastBlockOffset, lastBlockOffset + remaining));
+      lastBlock[remaining] = 128;
+      xorInto(lastBlock, k2);
+    }
+    const x = new Uint8Array(BLOCK_SIZE);
+    for (let i = 0; i < numBlocks - 1; i++) {
+      xorInto(x, message, i * BLOCK_SIZE);
+      const enc = aesEcbEncryptBlock(key, x);
+      x.set(enc);
+    }
+    xorInto(x, lastBlock);
+    return aesEcbEncryptBlock(key, x);
+  }
+  AesCmac2.compute = compute;
+})(AesCmac || (AesCmac = {}));
+var AesCmacPrf128;
+((AesCmacPrf1282) => {
+  function compute(key, message) {
+    if (key.length === 16) {
+      return AesCmac.compute(key, message);
+    }
+    const derivedKey = AesCmac.compute(ZERO_BLOCK, key);
+    return AesCmac.compute(derivedKey, message);
+  }
+  AesCmacPrf1282.compute = compute;
+})(AesCmacPrf128 || (AesCmacPrf128 = {}));
+//# sourceMappingURL=AesCmacPrf128.js.map

package/dist/cjs/crypto/AesCmacPrf128.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": ["../../../src/crypto/AesCmacPrf128.ts"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,qBAA8B;AAC9B,yBAA+B;AAP/B;AAAA;AAAA;AAAA;AAAA;AASA,MAAM,aAAa;AACnB,MAAM,KAAK;AACX,MAAM,aAAa,IAAI,WAAW,UAAU;AAE5C,SAAS,mBAAmB,KAAiB,OAA+B;AACxE,QAAM,aAAS,mCAAe,eAAe,KAAK,IAAI;AACtD,SAAO,eAAe,KAAK;AAC3B,QAAM,MAAM,OAAO,OAAO,KAAK;AAC/B,SAAO,MAAM;AACb,SAAO,IAAI,WAAW,IAAI,QAAQ,IAAI,YAAY,IAAI,UAAU;AACpE;AAEA,SAAS,WAAW,OAA+B;AAC/C,QAAM,MAAM,IAAI,WAAW,MAAM,MAAM;AACvC,MAAI,QAAQ;AACZ,WAAS,IAAI,MAAM,SAAS,GAAG,KAAK,GAAG,KAAK;AACxC,UAAM,IAAI,MAAM,CAAC;AACjB,QAAI,CAAC,IAAM,KAAK,IAAK,MAAQ;AAC7B,aAAS,IAAI,QAAS;AAAA,EAC1B;AACA,SAAO;AACX;AAEA,SAAS,QAAQ,QAAoB,QAAoB,SAAS,GAAS;AACvE,WAAS,IAAI,GAAG,IAAI,YAAY,KAAK;AACjC,WAAO,CAAC,KAAK,OAAO,SAAS,CAAC;AAAA,EAClC;AACJ;AAEA,SAAS,gBAAgB,KAAqD;AAC1E,QAAM,IAAI,mBAAmB,KAAK,UAAU;AAC5C,QAAM,KAAK,WAAW,CAAC;AACvB,OAAK,EAAE,CAAC,IAAI,SAAU,EAAG,IAAG,aAAa,CAAC,KAAK;AAC/C,QAAM,KAAK,WAAW,EAAE;AACxB,OAAK,GAAG,CAAC,IAAI,SAAU,EAAG,IAAG,aAAa,CAAC,KAAK;AAChD,SAAO,EAAE,IAAI,GAAG;AACpB;AAQO,IAAU;AAAA,CAAV,CAAUA,aAAV;AACI,WAAS,QAAQ,KAAiB,SAAiC;AACtE,QAAI,IAAI,WAAW,IAAI;AACnB,YAAM,IAAI,6BAAc,sCAAsC,IAAI,MAAM,EAAE;AAAA,IAC9E;AACA,UAAM,EAAE,IAAI,GAAG,IAAI,gBAAgB,GAAG;AAEtC,UAAM,YAAY,KAAK,IAAI,GAAG,KAAK,KAAK,QAAQ,SAAS,UAAU,CAAC;AACpE,UAAM,oBAAoB,QAAQ,SAAS,KAAK,QAAQ,SAAS,eAAe;AAEhF,UAAM,YAAY,IAAI,WAAW,UAAU;AAC3C,UAAM,mBAAmB,YAAY,KAAK;AAC1C,QAAI,mBAAmB;AACnB,gBAAU,IAAI,QAAQ,SAAS,iBAAiB,kBAAkB,UAAU,CAAC;AAC7E,cAAQ,WAAW,EAAE;AAAA,IACzB,OAAO;AACH,YAAM,YAAY,QAAQ,SAAS;AACnC,gBAAU,IAAI,QAAQ,SAAS,iBAAiB,kBAAkB,SAAS,CAAC;AAC5E,gBAAU,SAAS,IAAI;AACvB,cAAQ,WAAW,EAAE;AAAA,IACzB;AAEA,UAAM,IAAI,IAAI,WAAW,UAAU;AACnC,aAAS,IAAI,GAAG,IAAI,YAAY,GAAG,KAAK;AACpC,cAAQ,GAAG,SAAS,IAAI,UAAU;AAClC,YAAM,MAAM,mBAAmB,KAAK,CAAC;AACrC,QAAE,IAAI,GAAG;AAAA,IACb;AACA,YAAQ,GAAG,SAAS;AACpB,WAAO,mBAAmB,KAAK,CAAC;AAAA,EACpC;AA7BO,EAAAA,SAAS;AAAA,GADH;AAuCV,IAAU;AAAA,CAAV,CAAUC,mBAAV;AACI,WAAS,QAAQ,KAAiB,SAAiC;AACtE,QAAI,IAAI,WAAW,IAAI;AACnB,aAAO,QAAQ,QAAQ,KAAK,OAAO;AAAA,IACvC;AACA,UAAM,aAAa,QAAQ,QAAQ,YAAY,GAAG;AAClD,WAAO,QAAQ,QAAQ,YAAY,OAAO;AAAA,EAC9C;AANO,EAAAA,eAAS;AAAA,GADH;",
+  "names": ["AesCmac", "AesCmacPrf128"]
+}

package/dist/cjs/crypto/Pbkdf2AesCmac.d.ts

@@ -0,0 +1,18 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * PBKDF2 (RFC 8018 §5.2) using AES-CMAC-PRF-128 as the underlying PRF.
+ *
+ * Hand-rolled because Node's `crypto.pbkdf2` is hardwired to HMAC. The PRF here
+ * always emits 16 bytes, so each output block needs one PRF call per iteration.
+ */
+export declare function pbkdf2AesCmac(args: {
+    password: Uint8Array;
+    salt: Uint8Array;
+    iterations: number;
+    dkLen: number;
+}): Uint8Array;
+//# sourceMappingURL=Pbkdf2AesCmac.d.ts.map

package/dist/cjs/crypto/Pbkdf2AesCmac.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Pbkdf2AesCmac.d.ts","sourceRoot":"","sources":["../../../src/crypto/Pbkdf2AesCmac.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAOH;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE;IAChC,QAAQ,EAAE,UAAU,CAAC;IACrB,IAAI,EAAE,UAAU,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;CACjB,GAAG,UAAU,CAkCb"}