@matter/thread-br-client 0.0.1

package/dist/esm/dtls/prf/TlsPrf.d.ts

@@ -0,0 +1,82 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * TLS 1.2 pseudo-random function (RFC 5246 §5) using HMAC-SHA256 — the only PRF
+ * permitted for `TLS_ECJPAKE_WITH_AES_128_CCM_8` (RFC 6655 §3). Mirrors mbedTLS
+ * v3.6.6 `tls_prf_sha256` / `tls_prf_generic`.
+ *
+ * Internal to `dtls/`; not re-exported from the package public API surface.
+ */
+export declare namespace TlsPrf {
+    /**
+     * P_SHA256 expansion as defined in RFC 5246 §5:
+     *
+     *   P_hash(secret, seed) = HMAC_hash(secret, A(1) || seed) ||
+     *                          HMAC_hash(secret, A(2) || seed) || ...
+     *
+     * with `A(0) = seed`, `A(i) = HMAC_hash(secret, A(i-1))`. The TLS 1.2 PRF
+     * over (label, seed) is `P_SHA256(secret, label || seed)` — label bytes are
+     * concatenated with the seed (no length prefix). The label is ASCII per
+     * RFC 5246; we encode it as UTF-8 which coincides for ASCII-only input.
+     */
+    function compute(args: {
+        secret: Uint8Array;
+        label: string;
+        seed: Uint8Array;
+        outputLength: number;
+    }): Uint8Array;
+    /**
+     * `master_secret = PRF(pre_master_secret, "master secret",
+     *                      ClientHello.random || ServerHello.random)[0..47]`
+     * (RFC 5246 §8.1).
+     */
+    function masterSecret(args: {
+        premasterSecret: Uint8Array;
+        clientRandom: Uint8Array;
+        serverRandom: Uint8Array;
+    }): Uint8Array;
+    /**
+     * Slices of the 40-byte key block for `TLS_ECJPAKE_WITH_AES_128_CCM_8`
+     * (AEAD, no MAC keys; RFC 6655 §3, RFC 5246 §6.3).
+     */
+    interface KeyBlock {
+        clientWriteKey: Uint8Array;
+        serverWriteKey: Uint8Array;
+        clientWriteIv: Uint8Array;
+        serverWriteIv: Uint8Array;
+    }
+    /**
+     * `key_block = PRF(master_secret, "key expansion",
+     *                  ServerHello.random || ClientHello.random)[0..39]`
+     * (RFC 5246 §6.3). Note the seed order is REVERSED relative to
+     * {@link masterSecret} (server then client) — see mbedTLS ssl_tls.c v3.6.6
+     * "Swap the client and server random values" (RFC 5246 6.3 vs 8.1).
+     *
+     * For `TLS_ECJPAKE_WITH_AES_128_CCM_8` the layout is:
+     * `client_write_key (16) || server_write_key (16) ||
+     *  client_write_IV (4)  || server_write_IV (4)`.
+     */
+    function keyBlock(args: {
+        masterSecret: Uint8Array;
+        clientRandom: Uint8Array;
+        serverRandom: Uint8Array;
+    }): KeyBlock;
+    /**
+     * Finished `verify_data` (RFC 5246 §7.4.9):
+     *
+     *   verify_data = PRF(master_secret, finished_label,
+     *                     Hash(handshake_messages))[0..11]
+     *
+     * with `finished_label = "client finished"` for the client-sent Finished
+     * and `"server finished"` for the server-sent one.
+     */
+    function verifyData(args: {
+        masterSecret: Uint8Array;
+        role: "client" | "server";
+        transcriptDigest: Uint8Array;
+    }): Uint8Array;
+}
+//# sourceMappingURL=TlsPrf.d.ts.map

package/dist/esm/dtls/prf/TlsPrf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TlsPrf.d.ts","sourceRoot":"","sources":["../../../../src/dtls/prf/TlsPrf.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAqDH;;;;;;GAMG;AACH,yBAAiB,MAAM,CAAC,CAAC;IACrB;;;;;;;;;;OAUG;IACH,SAAgB,OAAO,CAAC,IAAI,EAAE;QAC1B,MAAM,EAAE,UAAU,CAAC;QACnB,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,UAAU,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;KACxB,GAAG,UAAU,CAOb;IAED;;;;OAIG;IACH,SAAgB,YAAY,CAAC,IAAI,EAAE;QAC/B,eAAe,EAAE,UAAU,CAAC;QAC5B,YAAY,EAAE,UAAU,CAAC;QACzB,YAAY,EAAE,UAAU,CAAC;KAC5B,GAAG,UAAU,CAQb;IAED;;;OAGG;IACH,UAAiB,QAAQ;QACrB,cAAc,EAAE,UAAU,CAAC;QAC3B,cAAc,EAAE,UAAU,CAAC;QAC3B,aAAa,EAAE,UAAU,CAAC;QAC1B,aAAa,EAAE,UAAU,CAAC;KAC7B;IAED;;;;;;;;;;OAUG;IACH,SAAgB,QAAQ,CAAC,IAAI,EAAE;QAC3B,YAAY,EAAE,UAAU,CAAC;QACzB,YAAY,EAAE,UAAU,CAAC;QACzB,YAAY,EAAE,UAAU,CAAC;KAC5B,GAAG,QAAQ,CAeX;IAED;;;;;;;;OAQG;IACH,SAAgB,UAAU,CAAC,IAAI,EAAE;QAC7B,YAAY,EAAE,UAAU,CAAC;QACzB,IAAI,EAAE,QAAQ,GAAG,QAAQ,CAAC;QAC1B,gBAAgB,EAAE,UAAU,CAAC;KAChC,GAAG,UAAU,CAMb;CACJ"}

package/dist/esm/dtls/prf/TlsPrf.js

@@ -0,0 +1,101 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { InternalError } from "@matter/general";
+import { createHmac } from "node:crypto";
+const SHA256_LEN = 32;
+const MASTER_SECRET_LEN = 48;
+const RANDOM_LEN = 32;
+const KEY_LEN = 16;
+const IV_LEN = 4;
+const KEY_BLOCK_LEN = KEY_LEN * 2 + IV_LEN * 2;
+const VERIFY_DATA_LEN = 12;
+const ASCII_ENCODER = new TextEncoder();
+function hmacSha256(key, data) {
+  const hmac = createHmac("sha256", key);
+  hmac.update(data);
+  return new Uint8Array(hmac.digest());
+}
+function expectLength(name, value, expected) {
+  if (value.length !== expected) {
+    throw new InternalError(`TlsPrf ${name} must be ${expected} bytes, got ${value.length}`);
+  }
+}
+function pSha256(secret, seed, outputLength) {
+  if (outputLength < 0) {
+    throw new InternalError(`TlsPrf outputLength must be non-negative, got ${outputLength}`);
+  }
+  const out = new Uint8Array(outputLength);
+  if (outputLength === 0) {
+    return out;
+  }
+  let a = hmacSha256(secret, seed);
+  const block = new Uint8Array(SHA256_LEN + seed.length);
+  block.set(seed, SHA256_LEN);
+  let written = 0;
+  while (written < outputLength) {
+    block.set(a, 0);
+    const next = hmacSha256(secret, block);
+    const remaining = outputLength - written;
+    const copyLen = Math.min(SHA256_LEN, remaining);
+    out.set(next.subarray(0, copyLen), written);
+    written += copyLen;
+    if (written < outputLength) {
+      a = hmacSha256(secret, a);
+    }
+  }
+  return out;
+}
+var TlsPrf;
+((TlsPrf2) => {
+  function compute(args) {
+    const { secret, label, seed, outputLength } = args;
+    const labelBytes = ASCII_ENCODER.encode(label);
+    const combined = new Uint8Array(labelBytes.length + seed.length);
+    combined.set(labelBytes, 0);
+    combined.set(seed, labelBytes.length);
+    return pSha256(secret, combined, outputLength);
+  }
+  TlsPrf2.compute = compute;
+  function masterSecret(args) {
+    const { premasterSecret, clientRandom, serverRandom } = args;
+    expectLength("clientRandom", clientRandom, RANDOM_LEN);
+    expectLength("serverRandom", serverRandom, RANDOM_LEN);
+    const seed = new Uint8Array(RANDOM_LEN * 2);
+    seed.set(clientRandom, 0);
+    seed.set(serverRandom, RANDOM_LEN);
+    return compute({ secret: premasterSecret, label: "master secret", seed, outputLength: MASTER_SECRET_LEN });
+  }
+  TlsPrf2.masterSecret = masterSecret;
+  function keyBlock(args) {
+    const { masterSecret: ms, clientRandom, serverRandom } = args;
+    expectLength("masterSecret", ms, MASTER_SECRET_LEN);
+    expectLength("clientRandom", clientRandom, RANDOM_LEN);
+    expectLength("serverRandom", serverRandom, RANDOM_LEN);
+    const seed = new Uint8Array(RANDOM_LEN * 2);
+    seed.set(serverRandom, 0);
+    seed.set(clientRandom, RANDOM_LEN);
+    const block = compute({ secret: ms, label: "key expansion", seed, outputLength: KEY_BLOCK_LEN });
+    return {
+      clientWriteKey: block.slice(0, KEY_LEN),
+      serverWriteKey: block.slice(KEY_LEN, KEY_LEN * 2),
+      clientWriteIv: block.slice(KEY_LEN * 2, KEY_LEN * 2 + IV_LEN),
+      serverWriteIv: block.slice(KEY_LEN * 2 + IV_LEN, KEY_BLOCK_LEN)
+    };
+  }
+  TlsPrf2.keyBlock = keyBlock;
+  function verifyData(args) {
+    const { masterSecret: ms, role, transcriptDigest } = args;
+    expectLength("masterSecret", ms, MASTER_SECRET_LEN);
+    expectLength("transcriptDigest", transcriptDigest, SHA256_LEN);
+    const label = role === "client" ? "client finished" : "server finished";
+    return compute({ secret: ms, label, seed: transcriptDigest, outputLength: VERIFY_DATA_LEN });
+  }
+  TlsPrf2.verifyData = verifyData;
+})(TlsPrf || (TlsPrf = {}));
+export {
+  TlsPrf
+};
+//# sourceMappingURL=TlsPrf.js.map

package/dist/esm/dtls/prf/TlsPrf.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/dtls/prf/TlsPrf.ts"],
+  "mappings": "AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,SAAS,qBAAqB;AAC9B,SAAS,kBAAkB;AAE3B,MAAM,aAAa;AACnB,MAAM,oBAAoB;AAC1B,MAAM,aAAa;AACnB,MAAM,UAAU;AAChB,MAAM,SAAS;AACf,MAAM,gBAAgB,UAAU,IAAI,SAAS;AAC7C,MAAM,kBAAkB;AAExB,MAAM,gBAAgB,IAAI,YAAY;AAEtC,SAAS,WAAW,KAAiB,MAA8B;AAC/D,QAAM,OAAO,WAAW,UAAU,GAAG;AACrC,OAAK,OAAO,IAAI;AAChB,SAAO,IAAI,WAAW,KAAK,OAAO,CAAC;AACvC;AAEA,SAAS,aAAa,MAAc,OAAmB,UAAwB;AAC3E,MAAI,MAAM,WAAW,UAAU;AAC3B,UAAM,IAAI,cAAc,UAAU,IAAI,YAAY,QAAQ,eAAe,MAAM,MAAM,EAAE;AAAA,EAC3F;AACJ;AAEA,SAAS,QAAQ,QAAoB,MAAkB,cAAkC;AACrF,MAAI,eAAe,GAAG;AAClB,UAAM,IAAI,cAAc,iDAAiD,YAAY,EAAE;AAAA,EAC3F;AACA,QAAM,MAAM,IAAI,WAAW,YAAY;AACvC,MAAI,iBAAiB,GAAG;AACpB,WAAO;AAAA,EACX;AACA,MAAI,IAAI,WAAW,QAAQ,IAAI;AAC/B,QAAM,QAAQ,IAAI,WAAW,aAAa,KAAK,MAAM;AACrD,QAAM,IAAI,MAAM,UAAU;AAC1B,MAAI,UAAU;AACd,SAAO,UAAU,cAAc;AAC3B,UAAM,IAAI,GAAG,CAAC;AACd,UAAM,OAAO,WAAW,QAAQ,KAAK;AACrC,UAAM,YAAY,eAAe;AACjC,UAAM,UAAU,KAAK,IAAI,YAAY,SAAS;AAC9C,QAAI,IAAI,KAAK,SAAS,GAAG,OAAO,GAAG,OAAO;AAC1C,eAAW;AACX,QAAI,UAAU,cAAc;AACxB,UAAI,WAAW,QAAQ,CAAC;AAAA,IAC5B;AAAA,EACJ;AACA,SAAO;AACX;AASO,IAAU;AAAA,CAAV,CAAUA,YAAV;AAYI,WAAS,QAAQ,MAKT;AACX,UAAM,EAAE,QAAQ,OAAO,MAAM,aAAa,IAAI;AAC9C,UAAM,aAAa,cAAc,OAAO,KAAK;AAC7C,UAAM,WAAW,IAAI,WAAW,WAAW,SAAS,KAAK,MAAM;AAC/D,aAAS,IAAI,YAAY,CAAC;AAC1B,aAAS,IAAI,MAAM,WAAW,MAAM;AACpC,WAAO,QAAQ,QAAQ,UAAU,YAAY;AAAA,EACjD;AAZO,EAAAA,QAAS;AAmBT,WAAS,aAAa,MAId;AACX,UAAM,EAAE,iBAAiB,cAAc,aAAa,IAAI;AACxD,iBAAa,gBAAgB,cAAc,UAAU;AACrD,iBAAa,gBAAgB,cAAc,UAAU;AACrD,UAAM,OAAO,IAAI,WAAW,aAAa,CAAC;AAC1C,SAAK,IAAI,cAAc,CAAC;AACxB,SAAK,IAAI,cAAc,UAAU;AACjC,WAAO,QAAQ,EAAE,QAAQ,iBAAiB,OAAO,iBAAiB,MAAM,cAAc,kBAAkB,CAAC;AAAA,EAC7G;AAZO,EAAAA,QAAS;AAoCT,WAAS,SAAS,MAIZ;AACT,UAAM,EAAE,cAAc,IAAI,cAAc,aAAa,IAAI;AACzD,iBAAa,gBAAgB,IAAI,iBAAiB;AAClD,iBAAa,gBAAgB,cAAc,UAAU;AACrD,iBAAa,gBAAgB,cAAc,UAAU;AACrD,UAAM,OAAO,IAAI,WAAW,aAAa,CAAC;AAC1C,SAAK,IAAI,cAAc,CAAC;AACxB,SAAK,IAAI,cAAc,UAAU;AACjC,UAAM,QAAQ,QAAQ,EAAE,QAAQ,IAAI,OAAO,iBAAiB,MAAM,cAAc,cAAc,CAAC;AAC/F,WAAO;AAAA,MACH,gBAAgB,MAAM,MAAM,GAAG,OAAO;AAAA,MACtC,gBAAgB,MAAM,MAAM,SAAS,UAAU,CAAC;AAAA,MAChD,eAAe,MAAM,MAAM,UAAU,GAAG,UAAU,IAAI,MAAM;AAAA,MAC5D,eAAe,MAAM,MAAM,UAAU,IAAI,QAAQ,aAAa;AAAA,IAClE;AAAA,EACJ;AAnBO,EAAAA,QAAS;AA8BT,WAAS,WAAW,MAIZ;AACX,UAAM,EAAE,cAAc,IAAI,MAAM,iBAAiB,IAAI;AACrD,iBAAa,gBAAgB,IAAI,iBAAiB;AAClD,iBAAa,oBAAoB,kBAAkB,UAAU;AAC7D,UAAM,QAAQ,SAAS,WAAW,oBAAoB;AACtD,WAAO,QAAQ,EAAE,QAAQ,IAAI,OAAO,MAAM,kBAAkB,cAAc,gBAAgB,CAAC;AAAA,EAC/F;AAVO,EAAAA,QAAS;AAAA,GAjGH;",
+  "names": ["TlsPrf"]
+}

package/dist/esm/dtls/prf/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * TLS 1.2 PRF (P_SHA256) and SHA-256 handshake-transcript helpers used by the
+ * DTLS 1.2 layer. Internal to `dtls/`; not re-exported from the package public
+ * API surface until the {@link DtlsChannel} interface ships in sub-batch 5.
+ */
+export { HandshakeTranscript } from "./HandshakeTranscript.js";
+export { TlsPrf } from "./TlsPrf.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/dtls/prf/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/dtls/prf/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;GAIG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC"}

package/dist/esm/dtls/prf/index.js

@@ -0,0 +1,12 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { HandshakeTranscript } from "./HandshakeTranscript.js";
+import { TlsPrf } from "./TlsPrf.js";
+export {
+  HandshakeTranscript,
+  TlsPrf
+};
+//# sourceMappingURL=index.js.map

package/dist/esm/dtls/prf/index.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/dtls/prf/index.ts"],
+  "mappings": "AAAA;AAAA;AAAA;AAAA;AAAA;AAYA,SAAS,2BAA2B;AACpC,SAAS,cAAc;",
+  "names": []
+}

package/dist/esm/dtls/record/AesCcm8.d.ts

@@ -0,0 +1,32 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * AES-128-CCM with an 8-octet authentication tag, the AEAD primitive used by the
+ * `TLS_ECJPAKE_WITH_AES_128_CCM_8` cipher suite (RFC 6655 §3, RFC 3610).
+ *
+ * Wraps Node's `aes-128-ccm` with a fixed 8-byte tag length and returns
+ * `ciphertext || tag` to match the wire layout expected by the DTLS record layer.
+ *
+ * The 12-byte nonce length implies CCM L=3 (15 - 12), giving a 2^24 byte payload
+ * limit per record — well above the DTLS 16 KiB record cap.
+ */
+export declare namespace AesCcm8 {
+    interface EncryptArgs {
+        key: Uint8Array;
+        nonce: Uint8Array;
+        aad: Uint8Array;
+        plaintext: Uint8Array;
+    }
+    interface DecryptArgs {
+        key: Uint8Array;
+        nonce: Uint8Array;
+        aad: Uint8Array;
+        ciphertextWithTag: Uint8Array;
+    }
+    function encrypt({ key, nonce, aad, plaintext }: EncryptArgs): Uint8Array;
+    function decrypt({ key, nonce, aad, ciphertextWithTag }: DecryptArgs): Uint8Array;
+}
+//# sourceMappingURL=AesCcm8.d.ts.map

package/dist/esm/dtls/record/AesCcm8.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AesCcm8.d.ts","sourceRoot":"","sources":["../../../../src/dtls/record/AesCcm8.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AASH;;;;;;;;;GASG;AACH,yBAAiB,OAAO,CAAC,CAAC;IACtB,UAAiB,WAAW;QACxB,GAAG,EAAE,UAAU,CAAC;QAChB,KAAK,EAAE,UAAU,CAAC;QAClB,GAAG,EAAE,UAAU,CAAC;QAChB,SAAS,EAAE,UAAU,CAAC;KACzB;IAED,UAAiB,WAAW;QACxB,GAAG,EAAE,UAAU,CAAC;QAChB,KAAK,EAAE,UAAU,CAAC;QAClB,GAAG,EAAE,UAAU,CAAC;QAChB,iBAAiB,EAAE,UAAU,CAAC;KACjC;IAED,SAAgB,OAAO,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,WAAW,GAAG,UAAU,CAiB/E;IAED,SAAgB,OAAO,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,iBAAiB,EAAE,EAAE,WAAW,GAAG,UAAU,CAwBvF;CACJ"}

package/dist/esm/dtls/record/AesCcm8.js

@@ -0,0 +1,58 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { InternalError } from "@matter/general";
+import { createCipheriv, createDecipheriv } from "node:crypto";
+import { DtlsError } from "../channel/DtlsChannel.js";
+const KEY_LEN = 16;
+const TAG_LEN = 8;
+var AesCcm8;
+((AesCcm82) => {
+  function encrypt({ key, nonce, aad, plaintext }) {
+    if (key.length !== KEY_LEN) {
+      throw new InternalError(`AES-128-CCM-8 key must be ${KEY_LEN} bytes, got ${key.length}`);
+    }
+    const cipher = createCipheriv("aes-128-ccm", key, nonce, { authTagLength: TAG_LEN });
+    cipher.setAAD(aad, { plaintextLength: plaintext.length });
+    const body = cipher.update(plaintext);
+    const tail = cipher.final();
+    const tag = cipher.getAuthTag();
+    const out = new Uint8Array(plaintext.length + TAG_LEN);
+    out.set(body, 0);
+    if (tail.length > 0) {
+      out.set(tail, body.length);
+    }
+    out.set(tag, plaintext.length);
+    return out;
+  }
+  AesCcm82.encrypt = encrypt;
+  function decrypt({ key, nonce, aad, ciphertextWithTag }) {
+    if (key.length !== KEY_LEN) {
+      throw new InternalError(`AES-128-CCM-8 key must be ${KEY_LEN} bytes, got ${key.length}`);
+    }
+    if (ciphertextWithTag.length < TAG_LEN) {
+      throw new DtlsError(`AES-128-CCM-8 input shorter than ${TAG_LEN}-byte tag`);
+    }
+    const ctLen = ciphertextWithTag.length - TAG_LEN;
+    const ct = ciphertextWithTag.subarray(0, ctLen);
+    const tag = ciphertextWithTag.subarray(ctLen);
+    const decipher = createDecipheriv("aes-128-ccm", key, nonce, { authTagLength: TAG_LEN });
+    decipher.setAAD(aad, { plaintextLength: ctLen });
+    decipher.setAuthTag(tag);
+    const body = decipher.update(ct);
+    const tail = decipher.final();
+    const out = new Uint8Array(ctLen);
+    out.set(body, 0);
+    if (tail.length > 0) {
+      out.set(tail, body.length);
+    }
+    return out;
+  }
+  AesCcm82.decrypt = decrypt;
+})(AesCcm8 || (AesCcm8 = {}));
+export {
+  AesCcm8
+};
+//# sourceMappingURL=AesCcm8.js.map

package/dist/esm/dtls/record/AesCcm8.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/dtls/record/AesCcm8.ts"],
+  "mappings": "AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,SAAS,qBAAqB;AAC9B,SAAS,gBAAgB,wBAAwB;AACjD,SAAS,iBAAiB;AAE1B,MAAM,UAAU;AAChB,MAAM,UAAU;AAYT,IAAU;AAAA,CAAV,CAAUA,aAAV;AAeI,WAAS,QAAQ,EAAE,KAAK,OAAO,KAAK,UAAU,GAA4B;AAC7E,QAAI,IAAI,WAAW,SAAS;AACxB,YAAM,IAAI,cAAc,6BAA6B,OAAO,eAAe,IAAI,MAAM,EAAE;AAAA,IAC3F;AACA,UAAM,SAAS,eAAe,eAAe,KAAK,OAAO,EAAE,eAAe,QAAQ,CAAC;AACnF,WAAO,OAAO,KAAK,EAAE,iBAAiB,UAAU,OAAO,CAAC;AACxD,UAAM,OAAO,OAAO,OAAO,SAAS;AACpC,UAAM,OAAO,OAAO,MAAM;AAC1B,UAAM,MAAM,OAAO,WAAW;AAE9B,UAAM,MAAM,IAAI,WAAW,UAAU,SAAS,OAAO;AACrD,QAAI,IAAI,MAAM,CAAC;AACf,QAAI,KAAK,SAAS,GAAG;AACjB,UAAI,IAAI,MAAM,KAAK,MAAM;AAAA,IAC7B;AACA,QAAI,IAAI,KAAK,UAAU,MAAM;AAC7B,WAAO;AAAA,EACX;AAjBO,EAAAA,SAAS;AAmBT,WAAS,QAAQ,EAAE,KAAK,OAAO,KAAK,kBAAkB,GAA4B;AACrF,QAAI,IAAI,WAAW,SAAS;AACxB,YAAM,IAAI,cAAc,6BAA6B,OAAO,eAAe,IAAI,MAAM,EAAE;AAAA,IAC3F;AACA,QAAI,kBAAkB,SAAS,SAAS;AACpC,YAAM,IAAI,UAAU,oCAAoC,OAAO,WAAW;AAAA,IAC9E;AACA,UAAM,QAAQ,kBAAkB,SAAS;AACzC,UAAM,KAAK,kBAAkB,SAAS,GAAG,KAAK;AAC9C,UAAM,MAAM,kBAAkB,SAAS,KAAK;AAE5C,UAAM,WAAW,iBAAiB,eAAe,KAAK,OAAO,EAAE,eAAe,QAAQ,CAAC;AACvF,aAAS,OAAO,KAAK,EAAE,iBAAiB,MAAM,CAAC;AAC/C,aAAS,WAAW,GAAG;AACvB,UAAM,OAAO,SAAS,OAAO,EAAE;AAE/B,UAAM,OAAO,SAAS,MAAM;AAE5B,UAAM,MAAM,IAAI,WAAW,KAAK;AAChC,QAAI,IAAI,MAAM,CAAC;AACf,QAAI,KAAK,SAAS,GAAG;AACjB,UAAI,IAAI,MAAM,KAAK,MAAM;AAAA,IAC7B;AACA,WAAO;AAAA,EACX;AAxBO,EAAAA,SAAS;AAAA,GAlCH;",
+  "names": ["AesCcm8"]
+}

package/dist/esm/dtls/record/AntiReplayWindow.d.ts

@@ -0,0 +1,38 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * DTLS 1.2 sliding-window anti-replay tracker (RFC 6347 §4.1.2.6).
+ *
+ * Maintains the rightmost (highest) accepted sequence number and a 64-bit
+ * bitmap of which prior numbers within the window have been seen. `check`
+ * combines the "is this in-window?" / "is this fresh?" / "mark as seen" steps
+ * into a single atomic update so callers can use it as a guard:
+ *
+ * ```ts
+ * if (!window.check(seqNum)) {
+ *   // discard or alert
+ * }
+ * ```
+ *
+ * Per the RFC, the window is initialised empty (no sequence numbers seen yet)
+ * and the first valid record sets the rightmost edge.
+ */
+export declare class AntiReplayWindow {
+    #private;
+    /** Window size as defined by RFC 6347 §4.1.2.6 (typically 32 or 64; we use 64). */
+    static readonly WINDOW_SIZE: number;
+    /** Highest sequence number recorded so far, or `-1n` before the first acceptance. */
+    get rightmost(): bigint;
+    /**
+     * Test+mark a sequence number. Returns `true` and records it on first sight,
+     * `false` if the number is a replay or older than the trailing edge.
+     *
+     * Throws on a negative or out-of-48-bit input — DTLS sequence numbers are
+     * 48-bit unsigned by construction; anything else is a programming error.
+     */
+    check(seqNum: bigint): boolean;
+}
+//# sourceMappingURL=AntiReplayWindow.d.ts.map

package/dist/esm/dtls/record/AntiReplayWindow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AntiReplayWindow.d.ts","sourceRoot":"","sources":["../../../../src/dtls/record/AntiReplayWindow.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAQH;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,gBAAgB;;IASzB,mFAAmF;IACnF,MAAM,CAAC,QAAQ,CAAC,WAAW,SAAuB;IAElD,qFAAqF;IACrF,IAAI,SAAS,IAAI,MAAM,CAEtB;IAED;;;;;;OAMG;IACH,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAgC7B;CACJ"}

package/dist/esm/dtls/record/AntiReplayWindow.js

@@ -0,0 +1,64 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { InternalError } from "@matter/general";
+const WINDOW_SIZE = 64n;
+const WINDOW_MASK = (1n << WINDOW_SIZE) - 1n;
+const MAX_SEQ = (1n << 48n) - 1n;
+class AntiReplayWindow {
+  /** Highest sequence number observed so far, or `-1n` if none. */
+  #rightmost = -1n;
+  /**
+   * Bitmap of accepted sequence numbers in the closed range [rightmost-63, rightmost].
+   * Bit 0 represents `rightmost`, bit 1 represents `rightmost-1`, etc.
+   */
+  #window = 0n;
+  /** Window size as defined by RFC 6347 §4.1.2.6 (typically 32 or 64; we use 64). */
+  static WINDOW_SIZE = Number(WINDOW_SIZE);
+  /** Highest sequence number recorded so far, or `-1n` before the first acceptance. */
+  get rightmost() {
+    return this.#rightmost;
+  }
+  /**
+   * Test+mark a sequence number. Returns `true` and records it on first sight,
+   * `false` if the number is a replay or older than the trailing edge.
+   *
+   * Throws on a negative or out-of-48-bit input — DTLS sequence numbers are
+   * 48-bit unsigned by construction; anything else is a programming error.
+   */
+  check(seqNum) {
+    if (seqNum < 0n || seqNum > MAX_SEQ) {
+      throw new InternalError(`AntiReplayWindow: seqNum ${seqNum} out of 48-bit range`);
+    }
+    if (seqNum > this.#rightmost) {
+      if (this.#rightmost >= 0n) {
+        const shift = seqNum - this.#rightmost;
+        if (shift >= WINDOW_SIZE) {
+          this.#window = 1n;
+        } else {
+          this.#window = (this.#window << shift | 1n) & WINDOW_MASK;
+        }
+      } else {
+        this.#window = 1n;
+      }
+      this.#rightmost = seqNum;
+      return true;
+    }
+    const offset = this.#rightmost - seqNum;
+    if (offset >= WINDOW_SIZE) {
+      return false;
+    }
+    const bit = 1n << offset;
+    if ((this.#window & bit) !== 0n) {
+      return false;
+    }
+    this.#window |= bit;
+    return true;
+  }
+}
+export {
+  AntiReplayWindow
+};
+//# sourceMappingURL=AntiReplayWindow.js.map

package/dist/esm/dtls/record/AntiReplayWindow.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/dtls/record/AntiReplayWindow.ts"],
+  "mappings": "AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,SAAS,qBAAqB;AAE9B,MAAM,cAAc;AACpB,MAAM,eAAe,MAAM,eAAe;AAC1C,MAAM,WAAW,MAAM,OAAO;AAmBvB,MAAM,iBAAiB;AAAA;AAAA,EAE1B,aAAa,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,EAKd,UAAU;AAAA;AAAA,EAGV,OAAgB,cAAc,OAAO,WAAW;AAAA;AAAA,EAGhD,IAAI,YAAoB;AACpB,WAAO,KAAK;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,QAAyB;AAC3B,QAAI,SAAS,MAAM,SAAS,SAAS;AACjC,YAAM,IAAI,cAAc,4BAA4B,MAAM,sBAAsB;AAAA,IACpF;AAEA,QAAI,SAAS,KAAK,YAAY;AAE1B,UAAI,KAAK,cAAc,IAAI;AACvB,cAAM,QAAQ,SAAS,KAAK;AAC5B,YAAI,SAAS,aAAa;AACtB,eAAK,UAAU;AAAA,QACnB,OAAO;AACH,eAAK,WAAY,KAAK,WAAW,QAAS,MAAM;AAAA,QACpD;AAAA,MACJ,OAAO;AACH,aAAK,UAAU;AAAA,MACnB;AACA,WAAK,aAAa;AAClB,aAAO;AAAA,IACX;AAEA,UAAM,SAAS,KAAK,aAAa;AACjC,QAAI,UAAU,aAAa;AAEvB,aAAO;AAAA,IACX;AACA,UAAM,MAAM,MAAM;AAClB,SAAK,KAAK,UAAU,SAAS,IAAI;AAC7B,aAAO;AAAA,IACX;AACA,SAAK,WAAW;AAChB,WAAO;AAAA,EACX;AACJ;",
+  "names": []
+}

package/dist/esm/dtls/record/ContentType.d.ts

@@ -0,0 +1,19 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * DTLS 1.2 ContentType values (RFC 6347 §4.1, RFC 5246 §6.2.1).
+ * The four values listed below are the only ones we encode or accept on the wire;
+ * any other byte triggers a decode error.
+ */
+export declare const ContentType: {
+    readonly CHANGE_CIPHER_SPEC: 20;
+    readonly ALERT: 21;
+    readonly HANDSHAKE: 22;
+    readonly APPLICATION_DATA: 23;
+};
+export type ContentType = (typeof ContentType)[keyof typeof ContentType];
+export declare function isContentType(value: number): value is ContentType;
+//# sourceMappingURL=ContentType.d.ts.map

package/dist/esm/dtls/record/ContentType.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ContentType.d.ts","sourceRoot":"","sources":["../../../../src/dtls/record/ContentType.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;GAIG;AACH,eAAO,MAAM,WAAW;aACpB,kBAAkB,EAAE,EAAE;aACtB,KAAK,EAAE,EAAE;aACT,SAAS,EAAE,EAAE;aACb,gBAAgB,EAAE,EAAE;CACd,CAAC;AAEX,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,OAAO,WAAW,CAAC,CAAC;AAEzE,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,WAAW,CAEjE"}

package/dist/esm/dtls/record/ContentType.js

@@ -0,0 +1,19 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+const ContentType = {
+  CHANGE_CIPHER_SPEC: 20,
+  ALERT: 21,
+  HANDSHAKE: 22,
+  APPLICATION_DATA: 23
+};
+function isContentType(value) {
+  return value === 20 || value === 21 || value === 22 || value === 23;
+}
+export {
+  ContentType,
+  isContentType
+};
+//# sourceMappingURL=ContentType.js.map

package/dist/esm/dtls/record/ContentType.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/dtls/record/ContentType.ts"],
+  "mappings": "AAAA;AAAA;AAAA;AAAA;AAAA;AAWO,MAAM,cAAc;AAAA,EACvB,oBAAoB;AAAA,EACpB,OAAO;AAAA,EACP,WAAW;AAAA,EACX,kBAAkB;AACtB;AAIO,SAAS,cAAc,OAAqC;AAC/D,SAAO,UAAU,MAAM,UAAU,MAAM,UAAU,MAAM,UAAU;AACrE;",
+  "names": []
+}

package/dist/esm/dtls/record/DtlsCipherState.d.ts

@@ -0,0 +1,79 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { ContentType } from "./ContentType.js";
+import { type DtlsRecordCipherState } from "./DtlsRecord.js";
+/**
+ * Materials a TLS 1.2 key block produces for `*_WITH_AES_128_CCM_8` (RFC 6655 §3,
+ * RFC 5246 §6.3): two AES-128 keys (`{client,server}_write_key`) and two 4-byte
+ * implicit-IV salts (`{client,server}_write_IV`). The PRF that derives them lands
+ * in sub-batch 4; sub-batch 2 only consumes the four byte arrays.
+ */
+export interface DtlsCipherStateInputs {
+    /** 16-byte AES key the client uses to encrypt outbound records. */
+    clientWriteKey: Uint8Array;
+    /** 16-byte AES key the server uses to encrypt outbound records. */
+    serverWriteKey: Uint8Array;
+    /** 4-byte client implicit-IV salt (`client_write_IV`). */
+    clientWriteSalt: Uint8Array;
+    /** 4-byte server implicit-IV salt (`server_write_IV`). */
+    serverWriteSalt: Uint8Array;
+}
+/**
+ * Per-connection DTLS 1.2 record-layer cipher state for `TLS_ECJPAKE_WITH_AES_128_CCM_8`.
+ *
+ * Holds:
+ * - the four key-block byte arrays,
+ * - the local role (controls which write key/salt is used for encrypt vs decrypt),
+ * - per-direction epoch and sequence counters,
+ * - and a per-read-epoch {@link AntiReplayWindow} (RFC 6347 §4.1.2.6).
+ *
+ * Both epochs start at 0 (plaintext handshake records). After ChangeCipherSpec the
+ * sender bumps its own epoch and resets its sequence counter to 0; the handshake
+ * layer drives that via {@link advanceWriteEpoch} / {@link advanceReadEpoch}. The
+ * read window is allocated lazily for any epoch > 0 because plaintext records carry
+ * no AEAD tag and therefore cannot meaningfully participate in anti-replay.
+ */
+export declare class DtlsCipherState implements DtlsRecordCipherState {
+    #private;
+    readonly role: "client" | "server";
+    constructor(role: "client" | "server", inputs: DtlsCipherStateInputs);
+    get writeEpoch(): number;
+    get readEpoch(): number;
+    /** Most recently allocated outbound seq, or `-1n` before the first allocation in the current epoch. */
+    get lastWriteSeq(): bigint;
+    /**
+     * Allocate the next outbound sequence number for the current write epoch and bump
+     * the counter. Throws if the 48-bit space is exhausted within an epoch.
+     */
+    nextWriteSeq(): bigint;
+    /**
+     * Increment the outbound epoch (called once after sending ChangeCipherSpec) and reset
+     * the seq counter to 0 (RFC 6347 §4.1.2.5).
+     */
+    advanceWriteEpoch(): void;
+    /**
+     * Increment the inbound epoch (called once after receiving ChangeCipherSpec) and
+     * reset the read-side anti-replay window for the new epoch.
+     */
+    advanceReadEpoch(): void;
+    /**
+     * Test+mark an inbound (epoch, seqNum) pair. Returns false on replay or wrong epoch
+     * so callers can drop the record per RFC 6347 §4.1.2.6. Plaintext epoch=0 records
+     * are accepted unconditionally — they carry no MAC and replay is meaningless.
+     */
+    acceptIncoming(epoch: number, seqNum: bigint): boolean;
+    encryptParams(): {
+        key: Uint8Array;
+        salt: Uint8Array;
+    };
+    decryptParams(): {
+        key: Uint8Array;
+        salt: Uint8Array;
+    };
+    nonceFor(salt: Uint8Array, epoch: number, seqNum: bigint): Uint8Array;
+    aadFor(type: ContentType, epoch: number, seqNum: bigint, plaintextLen: number): Uint8Array;
+}
+//# sourceMappingURL=DtlsCipherState.d.ts.map

package/dist/esm/dtls/record/DtlsCipherState.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DtlsCipherState.d.ts","sourceRoot":"","sources":["../../../../src/dtls/record/DtlsCipherState.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAoB,KAAK,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAE/E;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IAClC,mEAAmE;IACnE,cAAc,EAAE,UAAU,CAAC;IAC3B,mEAAmE;IACnE,cAAc,EAAE,UAAU,CAAC;IAC3B,0DAA0D;IAC1D,eAAe,EAAE,UAAU,CAAC;IAC5B,0DAA0D;IAC1D,eAAe,EAAE,UAAU,CAAC;CAC/B;AAgBD;;;;;;;;;;;;;;GAcG;AACH,qBAAa,eAAgB,YAAW,qBAAqB;;IACzD,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAUnC,YAAY,IAAI,EAAE,QAAQ,GAAG,QAAQ,EAAE,MAAM,EAAE,qBAAqB,EAMnE;IAED,IAAI,UAAU,IAAI,MAAM,CAEvB;IAED,IAAI,SAAS,IAAI,MAAM,CAEtB;IAED,uGAAuG;IACvG,IAAI,YAAY,IAAI,MAAM,CAEzB;IAED;;;OAGG;IACH,YAAY,IAAI,MAAM,CASrB;IAED;;;OAGG;IACH,iBAAiB,IAAI,IAAI,CAMxB;IAED;;;OAGG;IACH,gBAAgB,IAAI,IAAI,CAMvB;IAED;;;;OAIG;IACH,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAWrD;IAED,aAAa,IAAI;QAAE,GAAG,EAAE,UAAU,CAAC;QAAC,IAAI,EAAE,UAAU,CAAA;KAAE,CAIrD;IAED,aAAa,IAAI;QAAE,GAAG,EAAE,UAAU,CAAC;QAAC,IAAI,EAAE,UAAU,CAAA;KAAE,CAIrD;IAED,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,UAAU,CAkBpE;IAED,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,UAAU,CAsBzF;CACJ"}