@matter/thread-br-client 0.0.1

package/dist/esm/dtls/channel/DtlsChannel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DtlsChannel.d.ts","sourceRoot":"","sources":["../../../../src/dtls/channel/DtlsChannel.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,KAAK,KAAK,EAAyB,WAAW,EAAE,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjG,8FAA8F;AAC9F,qBAAa,SAAU,SAAQ,WAAW;CAAG;AAE7C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,WAAW,WAAY,SAAQ,aAAa,CAAC,KAAK,CAAC;IACrD,wEAAwE;IACxE,IAAI,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAElC,mFAAmF;IACnF,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvB,wDAAwD;IACxD,OAAO,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC;CACrD"}

package/dist/esm/dtls/channel/DtlsChannel.js

@@ -0,0 +1,12 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { MatterError } from "@matter/general";
+class DtlsError extends MatterError {
+}
+export {
+  DtlsError
+};
+//# sourceMappingURL=DtlsChannel.js.map

package/dist/esm/dtls/channel/DtlsChannel.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/dtls/channel/DtlsChannel.ts"],
+  "mappings": "AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,SAA4C,mBAAmC;AAGxE,MAAM,kBAAkB,YAAY;AAAC;",
+  "names": []
+}

package/dist/esm/dtls/channel/DtlsConnectOpts.d.ts

@@ -0,0 +1,38 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import type { Environment } from "@matter/general";
+/**
+ * Connection parameters consumed by {@link connectDtls}. The `random` and
+ * `ephemeralScalar` overrides exist for deterministic tests; production callers
+ * leave them unset and the channel wires in {@link Entropy}-backed defaults.
+ */
+export interface DtlsConnectOpts {
+    /** IPv6 (or IPv4) address of the peer's MeshCoP DTLS port. Link-local zone IDs (`%en0`) accepted. */
+    address: string;
+    /** UDP port (typically 49191 for the ot-cli simulator's MeshCoP service). */
+    port: number;
+    /** EC-JPAKE password (PSKc — 16 bytes for Thread MeshCoP). */
+    password: Uint8Array;
+    /** Override the IPv4/IPv6 binding hint; default inferred from `address`. */
+    type?: "udp4" | "udp6";
+    /** RFC 6347 §4.2.4 initial retransmit interval. Default 1000ms. */
+    initialRetransmitMs?: number;
+    /** RFC 6347 §4.2.4 retransmit cap (doubling stops here). Default 60000ms. */
+    maxRetransmitMs?: number;
+    /** Maximum retransmit attempts before giving up. Default 5 (~31s total at default initial). */
+    maxRetransmits?: number;
+    /** Path-MTU advisory. Default 1280 — the Thread mesh constraint. */
+    mtu?: number;
+    /** Connect timeout. Default 30000ms. */
+    connectTimeoutMs?: number;
+    /** Override `random()` for deterministic testing. Production: CSPRNG. */
+    random?: () => Uint8Array;
+    /** Override `ephemeralScalar()` for deterministic testing. Production: CSPRNG-backed. */
+    ephemeralScalar?: () => bigint;
+    /** Environment providing the {@link Network} used for the UDP transport and the {@link Crypto} entropy source. */
+    environment: Environment;
+}
+//# sourceMappingURL=DtlsConnectOpts.d.ts.map

package/dist/esm/dtls/channel/DtlsConnectOpts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DtlsConnectOpts.d.ts","sourceRoot":"","sources":["../../../../src/dtls/channel/DtlsConnectOpts.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAEnD;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC5B,qGAAqG;IACrG,OAAO,EAAE,MAAM,CAAC;IAEhB,6EAA6E;IAC7E,IAAI,EAAE,MAAM,CAAC;IAEb,8DAA8D;IAC9D,QAAQ,EAAE,UAAU,CAAC;IAErB,4EAA4E;IAC5E,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAEvB,mEAAmE;IACnE,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAE7B,6EAA6E;IAC7E,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB,+FAA+F;IAC/F,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,oEAAoE;IACpE,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,wCAAwC;IACxC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B,yEAAyE;IACzE,MAAM,CAAC,EAAE,MAAM,UAAU,CAAC;IAE1B,yFAAyF;IACzF,eAAe,CAAC,EAAE,MAAM,MAAM,CAAC;IAE/B,kHAAkH;IAClH,WAAW,EAAE,WAAW,CAAC;CAC5B"}

package/dist/esm/dtls/channel/DtlsConnectOpts.js

@@ -0,0 +1,6 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+//# sourceMappingURL=DtlsConnectOpts.js.map

package/dist/esm/dtls/channel/DtlsConnectOpts.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/dtls/channel/DtlsConnectOpts.ts"],
+  "mappings": "AAAA;AAAA;AAAA;AAAA;AAAA;",
+  "names": []
+}

package/dist/esm/dtls/channel/DtlsRetransmitTimer.d.ts

@@ -0,0 +1,43 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * Per-flight DTLS 1.2 retransmit timer (RFC 6347 §4.2.4).
+ *
+ * On `armNewFlight()` the timer is scheduled at `initialMs`. On each fire it
+ * invokes `onRetransmit`, doubles the next interval (capped at `maxMs`), and
+ * increments the attempt counter. After `maxRetransmits` attempts the timer
+ * stops and `onGiveUp` is invoked instead. `cancel()` (e.g. when the next
+ * inbound flight implicitly acknowledges the previous one) is idempotent.
+ *
+ * Tests use MockTime to control timer advancement deterministically.
+ */
+export interface DtlsRetransmitTimerOpts {
+    /** Initial delay before the first retransmit fires. */
+    initialMs: number;
+    /** Cap on the doubling sequence — RFC 6347 §4.2.4 default 60_000ms. */
+    maxMs: number;
+    /** Maximum retransmits before invoking `onGiveUp`. */
+    maxRetransmits: number;
+    /** Fired each retransmit (caller re-emits the last flight). */
+    onRetransmit: () => void;
+    /** Fired once after `maxRetransmits` attempts have elapsed without acknowledgement. */
+    onGiveUp: () => void;
+}
+export declare class DtlsRetransmitTimer {
+    #private;
+    constructor(opts: DtlsRetransmitTimerOpts);
+    /**
+     * Arm or re-arm the timer for a freshly emitted flight, resetting the attempt
+     * counter and the doubling delay back to `initialMs`.
+     */
+    armNewFlight(): void;
+    /** Cancel any pending timer. Safe to call when not armed. */
+    cancel(): void;
+    isArmed(): boolean;
+    /** Visible for tests — current attempt count (0 before the first fire). */
+    get attempt(): number;
+}
+//# sourceMappingURL=DtlsRetransmitTimer.d.ts.map

package/dist/esm/dtls/channel/DtlsRetransmitTimer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DtlsRetransmitTimer.d.ts","sourceRoot":"","sources":["../../../../src/dtls/channel/DtlsRetransmitTimer.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH;;;;;;;;;;GAUG;AACH,MAAM,WAAW,uBAAuB;IACpC,uDAAuD;IACvD,SAAS,EAAE,MAAM,CAAC;IAClB,uEAAuE;IACvE,KAAK,EAAE,MAAM,CAAC;IACd,sDAAsD;IACtD,cAAc,EAAE,MAAM,CAAC;IACvB,+DAA+D;IAC/D,YAAY,EAAE,MAAM,IAAI,CAAC;IACzB,uFAAuF;IACvF,QAAQ,EAAE,MAAM,IAAI,CAAC;CACxB;AAED,qBAAa,mBAAmB;;IAW5B,YAAY,IAAI,EAAE,uBAAuB,EAoBxC;IAED;;;OAGG;IACH,YAAY,IAAI,IAAI,CAKnB;IAED,6DAA6D;IAC7D,MAAM,IAAI,IAAI,CAGb;IAED,OAAO,IAAI,OAAO,CAEjB;IAED,2EAA2E;IAC3E,IAAI,OAAO,IAAI,MAAM,CAEpB;CAiBJ"}

package/dist/esm/dtls/channel/DtlsRetransmitTimer.js

@@ -0,0 +1,77 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { ImplementationError, Millis, Time } from "@matter/general";
+class DtlsRetransmitTimer {
+  #initialMs;
+  #maxMs;
+  #maxRetransmits;
+  #onRetransmit;
+  #onGiveUp;
+  #timer;
+  #attempt = 0;
+  #nextDelayMs;
+  constructor(opts) {
+    if (opts.initialMs <= 0) {
+      throw new ImplementationError(`DtlsRetransmitTimer initialMs must be > 0, got ${opts.initialMs}`);
+    }
+    if (opts.maxMs < opts.initialMs) {
+      throw new ImplementationError(
+        `DtlsRetransmitTimer maxMs ${opts.maxMs} must be >= initialMs ${opts.initialMs}`
+      );
+    }
+    if (opts.maxRetransmits < 1) {
+      throw new ImplementationError(
+        `DtlsRetransmitTimer maxRetransmits must be >= 1, got ${opts.maxRetransmits}`
+      );
+    }
+    this.#initialMs = opts.initialMs;
+    this.#maxMs = opts.maxMs;
+    this.#maxRetransmits = opts.maxRetransmits;
+    this.#onRetransmit = opts.onRetransmit;
+    this.#onGiveUp = opts.onGiveUp;
+    this.#nextDelayMs = opts.initialMs;
+  }
+  /**
+   * Arm or re-arm the timer for a freshly emitted flight, resetting the attempt
+   * counter and the doubling delay back to `initialMs`.
+   */
+  armNewFlight() {
+    this.cancel();
+    this.#attempt = 0;
+    this.#nextDelayMs = this.#initialMs;
+    this.#schedule();
+  }
+  /** Cancel any pending timer. Safe to call when not armed. */
+  cancel() {
+    this.#timer?.stop();
+    this.#timer = void 0;
+  }
+  isArmed() {
+    return this.#timer !== void 0;
+  }
+  /** Visible for tests — current attempt count (0 before the first fire). */
+  get attempt() {
+    return this.#attempt;
+  }
+  #schedule() {
+    const delay = this.#nextDelayMs;
+    this.#timer = Time.getTimer("dtls-retransmit", Millis(delay), () => {
+      this.#timer = void 0;
+      this.#attempt += 1;
+      if (this.#attempt > this.#maxRetransmits) {
+        this.#onGiveUp();
+        return;
+      }
+      this.#onRetransmit();
+      this.#nextDelayMs = Math.min(this.#nextDelayMs * 2, this.#maxMs);
+      this.#schedule();
+    }).start();
+  }
+}
+export {
+  DtlsRetransmitTimer
+};
+//# sourceMappingURL=DtlsRetransmitTimer.js.map

package/dist/esm/dtls/channel/DtlsRetransmitTimer.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/dtls/channel/DtlsRetransmitTimer.ts"],
+  "mappings": "AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,SAAS,qBAAqB,QAAQ,YAAwB;AA0BvD,MAAM,oBAAoB;AAAA,EACpB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET;AAAA,EACA,WAAW;AAAA,EACX;AAAA,EAEA,YAAY,MAA+B;AACvC,QAAI,KAAK,aAAa,GAAG;AACrB,YAAM,IAAI,oBAAoB,kDAAkD,KAAK,SAAS,EAAE;AAAA,IACpG;AACA,QAAI,KAAK,QAAQ,KAAK,WAAW;AAC7B,YAAM,IAAI;AAAA,QACN,6BAA6B,KAAK,KAAK,yBAAyB,KAAK,SAAS;AAAA,MAClF;AAAA,IACJ;AACA,QAAI,KAAK,iBAAiB,GAAG;AACzB,YAAM,IAAI;AAAA,QACN,wDAAwD,KAAK,cAAc;AAAA,MAC/E;AAAA,IACJ;AACA,SAAK,aAAa,KAAK;AACvB,SAAK,SAAS,KAAK;AACnB,SAAK,kBAAkB,KAAK;AAC5B,SAAK,gBAAgB,KAAK;AAC1B,SAAK,YAAY,KAAK;AACtB,SAAK,eAAe,KAAK;AAAA,EAC7B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,eAAqB;AACjB,SAAK,OAAO;AACZ,SAAK,WAAW;AAChB,SAAK,eAAe,KAAK;AACzB,SAAK,UAAU;AAAA,EACnB;AAAA;AAAA,EAGA,SAAe;AACX,SAAK,QAAQ,KAAK;AAClB,SAAK,SAAS;AAAA,EAClB;AAAA,EAEA,UAAmB;AACf,WAAO,KAAK,WAAW;AAAA,EAC3B;AAAA;AAAA,EAGA,IAAI,UAAkB;AAClB,WAAO,KAAK;AAAA,EAChB;AAAA,EAEA,YAAkB;AACd,UAAM,QAAQ,KAAK;AACnB,SAAK,SAAS,KAAK,SAAS,mBAAmB,OAAO,KAAK,GAAG,MAAM;AAChE,WAAK,SAAS;AACd,WAAK,YAAY;AACjB,UAAI,KAAK,WAAW,KAAK,iBAAiB;AACtC,aAAK,UAAU;AACf;AAAA,MACJ;AACA,WAAK,cAAc;AAEnB,WAAK,eAAe,KAAK,IAAI,KAAK,eAAe,GAAG,KAAK,MAAM;AAC/D,WAAK,UAAU;AAAA,IACnB,CAAC,EAAE,MAAM;AAAA,EACb;AACJ;",
+  "names": []
+}

package/dist/esm/dtls/channel/NobleDtlsChannel.d.ts

@@ -0,0 +1,35 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { Bytes, type Transport } from "@matter/general";
+import { type DtlsChannel } from "./DtlsChannel.js";
+import type { DtlsConnectOpts } from "./DtlsConnectOpts.js";
+/**
+ * UDP-bound DTLS 1.2 + EC-JPAKE client. Drives a {@link DtlsClient} state machine
+ * over a matter.js {@link UdpSocket}, applies RFC 6347 §4.2.4 retransmit on the
+ * handshake flights, then exposes a plaintext {@link DtlsChannel} surface for
+ * application data (CoAP in Phase 4).
+ *
+ * Lifecycle: caller constructs with {@link DtlsConnectOpts}, awaits
+ * {@link connect()} (which throws on handshake failure / timeout / give-up),
+ * then uses {@link send} and inbound async iteration until {@link close}.
+ * `close()` is idempotent and will best-effort send a close_notify alert.
+ */
+export declare class NobleDtlsChannel implements DtlsChannel {
+    #private;
+    constructor(opts: DtlsConnectOpts);
+    /**
+     * Bind the UDP socket, run the handshake to "established". Throws on
+     * timeout, give-up, or any DTLS-level failure.
+     */
+    connect(): Promise<void>;
+    send(bytes: Bytes): Promise<void>;
+    [Symbol.asyncIterator](): AsyncIterator<Bytes>;
+    onClose(listener: () => void): Transport.Listener;
+    close(): Promise<void>;
+    /** True once the handshake reaches "established". */
+    isConnected(): boolean;
+}
+//# sourceMappingURL=NobleDtlsChannel.d.ts.map

package/dist/esm/dtls/channel/NobleDtlsChannel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"NobleDtlsChannel.d.ts","sourceRoot":"","sources":["../../../../src/dtls/channel/NobleDtlsChannel.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACH,KAAK,EAcL,KAAK,SAAS,EAEjB,MAAM,iBAAiB,CAAC;AAMzB,OAAO,EAAE,KAAK,WAAW,EAAa,MAAM,kBAAkB,CAAC;AAC/D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAyD5D;;;;;;;;;;GAUG;AACH,qBAAa,gBAAiB,YAAW,WAAW;;IAsChD,YAAY,IAAI,EAAE,eAAe,EAGhC;IAED;;;OAGG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAqE7B;IAEK,IAAI,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBtC;IAED,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,aAAa,CAAC,KAAK,CAAC,CA2B7C;IAED,OAAO,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAOhD;IAEK,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAkD3B;IAED,qDAAqD;IACrD,WAAW,IAAI,OAAO,CAErB;CAwLJ"}

package/dist/esm/dtls/channel/NobleDtlsChannel.js

@@ -0,0 +1,432 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import {
+  Bytes,
+  Crypto,
+  ImplementationError,
+  InternalError,
+  Logger,
+  Millis,
+  Minutes,
+  Network,
+  Seconds,
+  Time,
+  TimeoutError
+} from "@matter/general";
+import { p256 } from "@noble/curves/nist.js";
+import { DtlsClient } from "../handshake/DtlsClient.js";
+import { ContentType } from "../record/ContentType.js";
+import { DTLS_HEADER_LEN, DtlsRecord, DtlsReplayError } from "../record/DtlsRecord.js";
+import { DtlsError } from "./DtlsChannel.js";
+import { DtlsRetransmitTimer } from "./DtlsRetransmitTimer.js";
+const logger = Logger.get("NobleDtlsChannel");
+const DEFAULT_INITIAL_RETRANSMIT = Seconds(1);
+const DEFAULT_MAX_RETRANSMIT = Minutes(1);
+const DEFAULT_MAX_RETRANSMITS = 5;
+const DEFAULT_CONNECT_TIMEOUT = Seconds(30);
+const DEFAULT_MTU = 1280;
+const MAX_INBOUND_QUEUE = 64;
+const N = p256.Point.Fn.ORDER;
+const ALERT_LEVEL_WARNING = 1;
+const ALERT_DESC_CLOSE_NOTIFY = 0;
+function inferUdpType(address, hint) {
+  if (hint !== void 0) {
+    return hint;
+  }
+  return address.includes(":") ? "udp6" : "udp4";
+}
+function defaultRandom(entropy) {
+  return Bytes.of(entropy.randomBytes(32));
+}
+function concatBuffers(parts) {
+  const total = parts.reduce((a, p) => a + p.length, 0);
+  const out = new Uint8Array(total);
+  let off = 0;
+  for (const p of parts) {
+    out.set(p, off);
+    off += p.length;
+  }
+  return out;
+}
+function defaultEphemeralScalar(entropy) {
+  let v = 0n;
+  const buf = Bytes.of(entropy.randomBytes(32));
+  for (const byte of buf) {
+    v = v << 8n | BigInt(byte);
+  }
+  return v % (N - 1n) + 1n;
+}
+class NobleDtlsChannel {
+  #opts;
+  #udpType;
+  #udp;
+  #client;
+  #retransmit;
+  /** Established cipher state (snapshot of the DtlsClient's after handshake). */
+  #cipherState;
+  #connected = false;
+  #closed = false;
+  #failure;
+  #failureDelivered = false;
+  /** Connect-deadline timer handle. */
+  #connectDeadline;
+  /** Decrypted application-data plaintexts buffered until a consumer takes them. Bounded by {@link MAX_INBOUND_QUEUE}. */
+  #inboundQueue = new Array();
+  /** A single pending consumer waiting on the async iterator. */
+  #inboundWaiter;
+  #closeListeners = /* @__PURE__ */ new Set();
+  /** Resolves once the DtlsClient reports `established`. */
+  #onConnect;
+  constructor(opts) {
+    this.#opts = opts;
+    this.#udpType = inferUdpType(opts.address, opts.type);
+  }
+  /**
+   * Bind the UDP socket, run the handshake to "established". Throws on
+   * timeout, give-up, or any DTLS-level failure.
+   */
+  async connect() {
+    if (this.#connected) {
+      throw new ImplementationError("NobleDtlsChannel.connect: already connected");
+    }
+    if (this.#closed) {
+      throw new ImplementationError("NobleDtlsChannel.connect: closed");
+    }
+    const environment = this.#opts.environment;
+    const network = environment.get(Network);
+    const entropy = environment.get(Crypto);
+    const udp = await network.createUdpSocket({ type: this.#udpType, listeningPort: 0 });
+    if (this.#closed) {
+      await udp.close();
+      throw new ImplementationError("NobleDtlsChannel.connect: closed");
+    }
+    this.#udp = udp;
+    udp.onData((_netInterface, _peerAddress, _peerPort, data) => this.#onDatagram(Bytes.of(data)));
+    const initialRetransmit = this.#opts.initialRetransmitMs !== void 0 ? Millis(this.#opts.initialRetransmitMs) : DEFAULT_INITIAL_RETRANSMIT;
+    const maxRetransmit = this.#opts.maxRetransmitMs !== void 0 ? Millis(this.#opts.maxRetransmitMs) : DEFAULT_MAX_RETRANSMIT;
+    const clientCfg = {
+      password: this.#opts.password,
+      random: this.#opts.random ?? (() => defaultRandom(entropy)),
+      ephemeralScalar: this.#opts.ephemeralScalar ?? (() => defaultEphemeralScalar(entropy)),
+      initialRetransmitMs: initialRetransmit,
+      maxRetransmitMs: maxRetransmit,
+      mtu: this.#opts.mtu ?? DEFAULT_MTU
+    };
+    const client = new DtlsClient(clientCfg);
+    this.#client = client;
+    this.#retransmit = new DtlsRetransmitTimer({
+      initialMs: initialRetransmit,
+      maxMs: maxRetransmit,
+      maxRetransmits: this.#opts.maxRetransmits ?? DEFAULT_MAX_RETRANSMITS,
+      onRetransmit: () => this.#onRetransmit(),
+      onGiveUp: () => this.#fail(new DtlsError("NobleDtlsChannel: handshake gave up after max retransmits"))
+    });
+    const connectPromise = new Promise((resolve, reject) => {
+      this.#onConnect = { resolve, reject };
+    });
+    const connectTimeout = this.#opts.connectTimeoutMs !== void 0 ? Millis(this.#opts.connectTimeoutMs) : DEFAULT_CONNECT_TIMEOUT;
+    this.#connectDeadline = Time.getTimer(
+      "dtls-connect-deadline",
+      connectTimeout,
+      () => this.#fail(new TimeoutError(`NobleDtlsChannel: connect timed out after ${connectTimeout}ms`))
+    ).start();
+    try {
+      const step = client.start();
+      this.#sendRecords(step.records);
+      this.#retransmit.armNewFlight();
+    } catch (e) {
+      this.#fail(e instanceof Error ? e : new InternalError(String(e)));
+    }
+    try {
+      await connectPromise;
+    } finally {
+      this.#connectDeadline?.stop();
+      this.#connectDeadline = void 0;
+    }
+  }
+  async send(bytes) {
+    if (this.#closed) {
+      throw new ImplementationError("NobleDtlsChannel.send: closed");
+    }
+    if (!this.#connected) {
+      throw new ImplementationError("NobleDtlsChannel.send: not connected");
+    }
+    const cipherState = this.#cipherState;
+    const udp = this.#udp;
+    if (cipherState === void 0 || udp === void 0) {
+      throw new InternalError("NobleDtlsChannel.send: missing cipher state or transport");
+    }
+    const seq = cipherState.nextWriteSeq();
+    const record = DtlsRecord.encode(
+      {
+        type: ContentType.APPLICATION_DATA,
+        epoch: cipherState.writeEpoch,
+        sequenceNumber: seq,
+        fragment: Bytes.of(bytes)
+      },
+      cipherState
+    );
+    await this.#sendDatagram(udp, record);
+  }
+  [Symbol.asyncIterator]() {
+    return {
+      next: () => {
+        if (this.#inboundQueue.length > 0) {
+          return Promise.resolve({ value: this.#inboundQueue.shift(), done: false });
+        }
+        if (this.#failure !== void 0 && !this.#failureDelivered) {
+          this.#failureDelivered = true;
+          return Promise.reject(this.#failure);
+        }
+        if (this.#closed) {
+          return Promise.resolve({ value: void 0, done: true });
+        }
+        if (this.#inboundWaiter !== void 0) {
+          return Promise.reject(
+            new ImplementationError("NobleDtlsChannel: concurrent iteration not supported")
+          );
+        }
+        return new Promise((resolve, reject) => {
+          this.#inboundWaiter = { resolve, reject };
+        });
+      },
+      return: async () => {
+        await this.close();
+        return { value: void 0, done: true };
+      }
+    };
+  }
+  onClose(listener) {
+    this.#closeListeners.add(listener);
+    return {
+      close: async () => {
+        this.#closeListeners.delete(listener);
+      }
+    };
+  }
+  async close() {
+    if (this.#closed) {
+      return;
+    }
+    this.#closed = true;
+    const cipherState = this.#cipherState;
+    const udp = this.#udp;
+    if (this.#connected && cipherState !== void 0 && udp !== void 0) {
+      try {
+        const seq = cipherState.nextWriteSeq();
+        const alertRecord = DtlsRecord.encode(
+          {
+            type: ContentType.ALERT,
+            epoch: cipherState.writeEpoch,
+            sequenceNumber: seq,
+            fragment: Uint8Array.of(ALERT_LEVEL_WARNING, ALERT_DESC_CLOSE_NOTIFY)
+          },
+          cipherState
+        );
+        await this.#sendDatagram(udp, alertRecord).catch(() => {
+        });
+      } catch {
+      }
+    }
+    if (this.#retransmit !== void 0) {
+      this.#retransmit.cancel();
+    }
+    if (udp !== void 0) {
+      await udp.close().catch(() => {
+      });
+    }
+    const waiter = this.#inboundWaiter;
+    this.#inboundWaiter = void 0;
+    if (waiter !== void 0) {
+      if (this.#failure !== void 0 && !this.#failureDelivered) {
+        this.#failureDelivered = true;
+        waiter.reject(this.#failure);
+      } else {
+        waiter.resolve({ value: void 0, done: true });
+      }
+    }
+    for (const listener of this.#closeListeners) {
+      listener();
+    }
+    if (this.#onConnect !== void 0 && !this.#connected) {
+      const onConnect = this.#onConnect;
+      this.#onConnect = void 0;
+      onConnect.reject(this.#failure ?? new DtlsError("NobleDtlsChannel: closed"));
+    }
+  }
+  /** True once the handshake reaches "established". */
+  isConnected() {
+    return this.#connected;
+  }
+  // -----------------------------------------------------------------------
+  // Internals
+  #onDatagram(bytes) {
+    if (this.#closed) {
+      return;
+    }
+    try {
+      if (this.#connected) {
+        this.#handleAppDatagram(bytes);
+      } else {
+        this.#handleHandshakeDatagram(bytes);
+      }
+    } catch (e) {
+      this.#fail(e instanceof Error ? e : new InternalError(String(e)));
+    }
+  }
+  #handleHandshakeDatagram(bytes) {
+    const client = this.#client;
+    const retransmit = this.#retransmit;
+    if (client === void 0 || retransmit === void 0) {
+      throw new InternalError("NobleDtlsChannel: handshake datagram before client/timer initialised");
+    }
+    const step = client.onDatagram(bytes);
+    retransmit.cancel();
+    if (step.records.length > 0) {
+      this.#sendRecords(step.records);
+    }
+    if (client.isEstablished()) {
+      this.#cipherState = client.cipherState();
+      this.#connected = true;
+      const onConnect = this.#onConnect;
+      this.#onConnect = void 0;
+      if (onConnect !== void 0) {
+        onConnect.resolve();
+      }
+    } else if (step.records.length > 0) {
+      retransmit.armNewFlight();
+    }
+  }
+  #handleAppDatagram(bytes) {
+    const cipherState = this.#cipherState;
+    if (cipherState === void 0) {
+      throw new InternalError("NobleDtlsChannel: post-handshake datagram with no cipher state");
+    }
+    let p = 0;
+    while (p < bytes.length) {
+      if (bytes.length - p < DTLS_HEADER_LEN) {
+        throw new DtlsError("NobleDtlsChannel: short DTLS record header");
+      }
+      const length = bytes[p + 11] << 8 | bytes[p + 12];
+      const recordEnd = p + DTLS_HEADER_LEN + length;
+      if (recordEnd > bytes.length) {
+        throw new DtlsError("NobleDtlsChannel: DTLS record length overruns datagram");
+      }
+      const slice = bytes.subarray(p, recordEnd);
+      let record;
+      try {
+        ({ record } = DtlsRecord.decode(slice, cipherState));
+      } catch (e) {
+        if (e instanceof DtlsReplayError) {
+          logger.debug(`Dropping replayed DTLS record epoch=${e.epoch} seq=${e.sequenceNumber}`);
+          p = recordEnd;
+          continue;
+        }
+        throw e;
+      }
+      if (record.type === ContentType.APPLICATION_DATA) {
+        this.#deliverPlaintext(record.fragment);
+      } else if (record.type === ContentType.ALERT) {
+        if (record.fragment.length >= 2 && record.fragment[1] === ALERT_DESC_CLOSE_NOTIFY) {
+          this.#fail(new DtlsError("NobleDtlsChannel: peer sent close_notify"));
+          return;
+        }
+        this.#fail(
+          new DtlsError(
+            `NobleDtlsChannel: peer alert level=${record.fragment[0] ?? -1} desc=${record.fragment[1] ?? -1}`
+          )
+        );
+        return;
+      }
+      p = recordEnd;
+    }
+  }
+  #deliverPlaintext(plaintext) {
+    const waiter = this.#inboundWaiter;
+    if (waiter !== void 0) {
+      this.#inboundWaiter = void 0;
+      waiter.resolve({ value: plaintext, done: false });
+      return;
+    }
+    this.#inboundQueue.push(plaintext);
+    if (this.#inboundQueue.length > MAX_INBOUND_QUEUE) {
+      this.#fail(new DtlsError("NobleDtlsChannel: inbound buffer overflow \u2014 consumer too slow"));
+    }
+  }
+  #onRetransmit() {
+    const client = this.#client;
+    if (client === void 0 || this.#connected || this.#closed) {
+      return;
+    }
+    try {
+      const step = client.onRetransmit();
+      this.#sendRecords(step.records);
+    } catch (e) {
+      this.#fail(e instanceof Error ? e : new InternalError(String(e)));
+    }
+  }
+  #sendRecords(records) {
+    const udp = this.#udp;
+    if (udp === void 0) {
+      throw new InternalError("NobleDtlsChannel: send before bind");
+    }
+    if (records.length === 0) {
+      return;
+    }
+    const mtu = this.#opts.mtu ?? DEFAULT_MTU;
+    const datagrams = new Array();
+    let acc = new Array();
+    let accLen = 0;
+    for (const record of records) {
+      if (accLen > 0 && accLen + record.length > mtu) {
+        datagrams.push(concatBuffers(acc));
+        acc = [];
+        accLen = 0;
+      }
+      acc.push(record);
+      accLen += record.length;
+    }
+    if (acc.length > 0) {
+      datagrams.push(concatBuffers(acc));
+    }
+    for (const dg of datagrams) {
+      void this.#sendDatagram(udp, dg).catch(
+        (e) => this.#fail(e instanceof Error ? e : new InternalError(String(e)))
+      );
+    }
+  }
+  async #sendDatagram(udp, bytes) {
+    await udp.send(this.#opts.address, this.#opts.port, bytes);
+  }
+  #fail(error) {
+    if (this.#closed) {
+      return;
+    }
+    if (this.#failure === void 0) {
+      this.#failure = error;
+    }
+    if (this.#retransmit !== void 0) {
+      this.#retransmit.cancel();
+    }
+    const onConnect = this.#onConnect;
+    this.#onConnect = void 0;
+    if (onConnect !== void 0 && !this.#connected) {
+      onConnect.reject(error);
+    }
+    const waiter = this.#inboundWaiter;
+    this.#inboundWaiter = void 0;
+    if (waiter !== void 0) {
+      this.#failureDelivered = true;
+      waiter.reject(error);
+    }
+    void this.close().catch(() => {
+    });
+  }
+}
+export {
+  NobleDtlsChannel
+};
+//# sourceMappingURL=NobleDtlsChannel.js.map