@matter/thread-br-client 0.0.1

package/dist/esm/dtls/record/DtlsCipherState.js

@@ -0,0 +1,153 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { InternalError } from "@matter/general";
+import { AntiReplayWindow } from "./AntiReplayWindow.js";
+import { DTLS_1_2_VERSION } from "./DtlsRecord.js";
+const KEY_LEN = 16;
+const SALT_LEN = 4;
+const NONCE_LEN = 12;
+const AAD_LEN = 13;
+const MAX_EPOCH = 65535;
+const MAX_SEQ = (1n << 48n) - 1n;
+function copyExpect(name, value, expectedLen) {
+  if (value.length !== expectedLen) {
+    throw new InternalError(`DtlsCipherState ${name} must be ${expectedLen} bytes, got ${value.length}`);
+  }
+  return new Uint8Array(value);
+}
+class DtlsCipherState {
+  role;
+  #clientWriteKey;
+  #serverWriteKey;
+  #clientWriteSalt;
+  #serverWriteSalt;
+  #writeEpoch = 0;
+  #writeSeq = 0n;
+  #readEpoch = 0;
+  #readWindow;
+  constructor(role, inputs) {
+    this.role = role;
+    this.#clientWriteKey = copyExpect("clientWriteKey", inputs.clientWriteKey, KEY_LEN);
+    this.#serverWriteKey = copyExpect("serverWriteKey", inputs.serverWriteKey, KEY_LEN);
+    this.#clientWriteSalt = copyExpect("clientWriteSalt", inputs.clientWriteSalt, SALT_LEN);
+    this.#serverWriteSalt = copyExpect("serverWriteSalt", inputs.serverWriteSalt, SALT_LEN);
+  }
+  get writeEpoch() {
+    return this.#writeEpoch;
+  }
+  get readEpoch() {
+    return this.#readEpoch;
+  }
+  /** Most recently allocated outbound seq, or `-1n` before the first allocation in the current epoch. */
+  get lastWriteSeq() {
+    return this.#writeSeq - 1n;
+  }
+  /**
+   * Allocate the next outbound sequence number for the current write epoch and bump
+   * the counter. Throws if the 48-bit space is exhausted within an epoch.
+   */
+  nextWriteSeq() {
+    if (this.#writeSeq > MAX_SEQ) {
+      throw new InternalError(
+        `DtlsCipherState write sequence_number space exhausted at epoch ${this.#writeEpoch}`
+      );
+    }
+    const seq = this.#writeSeq;
+    this.#writeSeq += 1n;
+    return seq;
+  }
+  /**
+   * Increment the outbound epoch (called once after sending ChangeCipherSpec) and reset
+   * the seq counter to 0 (RFC 6347 §4.1.2.5).
+   */
+  advanceWriteEpoch() {
+    if (this.#writeEpoch >= MAX_EPOCH) {
+      throw new InternalError(`DtlsCipherState write epoch overflow`);
+    }
+    this.#writeEpoch += 1;
+    this.#writeSeq = 0n;
+  }
+  /**
+   * Increment the inbound epoch (called once after receiving ChangeCipherSpec) and
+   * reset the read-side anti-replay window for the new epoch.
+   */
+  advanceReadEpoch() {
+    if (this.#readEpoch >= MAX_EPOCH) {
+      throw new InternalError(`DtlsCipherState read epoch overflow`);
+    }
+    this.#readEpoch += 1;
+    this.#readWindow = new AntiReplayWindow();
+  }
+  /**
+   * Test+mark an inbound (epoch, seqNum) pair. Returns false on replay or wrong epoch
+   * so callers can drop the record per RFC 6347 §4.1.2.6. Plaintext epoch=0 records
+   * are accepted unconditionally — they carry no MAC and replay is meaningless.
+   */
+  acceptIncoming(epoch, seqNum) {
+    if (epoch !== this.#readEpoch) {
+      return false;
+    }
+    if (epoch === 0) {
+      return true;
+    }
+    if (this.#readWindow === void 0) {
+      this.#readWindow = new AntiReplayWindow();
+    }
+    return this.#readWindow.check(seqNum);
+  }
+  encryptParams() {
+    return this.role === "client" ? { key: this.#clientWriteKey, salt: this.#clientWriteSalt } : { key: this.#serverWriteKey, salt: this.#serverWriteSalt };
+  }
+  decryptParams() {
+    return this.role === "client" ? { key: this.#serverWriteKey, salt: this.#serverWriteSalt } : { key: this.#clientWriteKey, salt: this.#clientWriteSalt };
+  }
+  nonceFor(salt, epoch, seqNum) {
+    if (salt.length !== SALT_LEN) {
+      throw new InternalError(`DtlsCipherState nonceFor: salt must be ${SALT_LEN} bytes, got ${salt.length}`);
+    }
+    if (epoch < 0 || epoch > MAX_EPOCH) {
+      throw new InternalError(`DtlsCipherState nonceFor: epoch ${epoch} out of range`);
+    }
+    if (seqNum < 0n || seqNum > MAX_SEQ) {
+      throw new InternalError(`DtlsCipherState nonceFor: seqNum ${seqNum} out of range`);
+    }
+    const out = new Uint8Array(NONCE_LEN);
+    out.set(salt, 0);
+    out[4] = epoch >>> 8 & 255;
+    out[5] = epoch & 255;
+    for (let i = 0; i < 6; i++) {
+      out[6 + i] = Number(seqNum >> BigInt((5 - i) * 8) & 0xffn);
+    }
+    return out;
+  }
+  aadFor(type, epoch, seqNum, plaintextLen) {
+    if (epoch < 0 || epoch > MAX_EPOCH) {
+      throw new InternalError(`DtlsCipherState aadFor: epoch ${epoch} out of range`);
+    }
+    if (seqNum < 0n || seqNum > MAX_SEQ) {
+      throw new InternalError(`DtlsCipherState aadFor: seqNum ${seqNum} out of range`);
+    }
+    if (plaintextLen < 0 || plaintextLen > 65535) {
+      throw new InternalError(`DtlsCipherState aadFor: plaintextLen ${plaintextLen} out of range`);
+    }
+    const out = new Uint8Array(AAD_LEN);
+    out[0] = epoch >>> 8 & 255;
+    out[1] = epoch & 255;
+    for (let i = 0; i < 6; i++) {
+      out[2 + i] = Number(seqNum >> BigInt((5 - i) * 8) & 0xffn);
+    }
+    out[8] = type;
+    out[9] = DTLS_1_2_VERSION.major;
+    out[10] = DTLS_1_2_VERSION.minor;
+    out[11] = plaintextLen >>> 8 & 255;
+    out[12] = plaintextLen & 255;
+    return out;
+  }
+}
+export {
+  DtlsCipherState
+};
+//# sourceMappingURL=DtlsCipherState.js.map

package/dist/esm/dtls/record/DtlsCipherState.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/dtls/record/DtlsCipherState.ts"],
+  "mappings": "AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,SAAS,qBAAqB;AAC9B,SAAS,wBAAwB;AAEjC,SAAS,wBAAoD;AAmB7D,MAAM,UAAU;AAChB,MAAM,WAAW;AACjB,MAAM,YAAY;AAClB,MAAM,UAAU;AAChB,MAAM,YAAY;AAClB,MAAM,WAAW,MAAM,OAAO;AAE9B,SAAS,WAAW,MAAc,OAAmB,aAAiC;AAClF,MAAI,MAAM,WAAW,aAAa;AAC9B,UAAM,IAAI,cAAc,mBAAmB,IAAI,YAAY,WAAW,eAAe,MAAM,MAAM,EAAE;AAAA,EACvG;AACA,SAAO,IAAI,WAAW,KAAK;AAC/B;AAiBO,MAAM,gBAAiD;AAAA,EACjD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACT,cAAc;AAAA,EACd,YAAY;AAAA,EACZ,aAAa;AAAA,EACb;AAAA,EAEA,YAAY,MAA2B,QAA+B;AAClE,SAAK,OAAO;AACZ,SAAK,kBAAkB,WAAW,kBAAkB,OAAO,gBAAgB,OAAO;AAClF,SAAK,kBAAkB,WAAW,kBAAkB,OAAO,gBAAgB,OAAO;AAClF,SAAK,mBAAmB,WAAW,mBAAmB,OAAO,iBAAiB,QAAQ;AACtF,SAAK,mBAAmB,WAAW,mBAAmB,OAAO,iBAAiB,QAAQ;AAAA,EAC1F;AAAA,EAEA,IAAI,aAAqB;AACrB,WAAO,KAAK;AAAA,EAChB;AAAA,EAEA,IAAI,YAAoB;AACpB,WAAO,KAAK;AAAA,EAChB;AAAA;AAAA,EAGA,IAAI,eAAuB;AACvB,WAAO,KAAK,YAAY;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,eAAuB;AACnB,QAAI,KAAK,YAAY,SAAS;AAC1B,YAAM,IAAI;AAAA,QACN,kEAAkE,KAAK,WAAW;AAAA,MACtF;AAAA,IACJ;AACA,UAAM,MAAM,KAAK;AACjB,SAAK,aAAa;AAClB,WAAO;AAAA,EACX;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,oBAA0B;AACtB,QAAI,KAAK,eAAe,WAAW;AAC/B,YAAM,IAAI,cAAc,sCAAsC;AAAA,IAClE;AACA,SAAK,eAAe;AACpB,SAAK,YAAY;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,mBAAyB;AACrB,QAAI,KAAK,cAAc,WAAW;AAC9B,YAAM,IAAI,cAAc,qCAAqC;AAAA,IACjE;AACA,SAAK,cAAc;AACnB,SAAK,cAAc,IAAI,iBAAiB;AAAA,EAC5C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,eAAe,OAAe,QAAyB;AACnD,QAAI,UAAU,KAAK,YAAY;AAC3B,aAAO;AAAA,IACX;AACA,QAAI,UAAU,GAAG;AACb,aAAO;AAAA,IACX;AACA,QAAI,KAAK,gBAAgB,QAAW;AAChC,WAAK,cAAc,IAAI,iBAAiB;AAAA,IAC5C;AACA,WAAO,KAAK,YAAY,MAAM,MAAM;AAAA,EACxC;AAAA,EAEA,gBAAuD;AACnD,WAAO,KAAK,SAAS,WACf,EAAE,KAAK,KAAK,iBAAiB,MAAM,KAAK,iBAAiB,IACzD,EAAE,KAAK,KAAK,iBAAiB,MAAM,KAAK,iBAAiB;AAAA,EACnE;AAAA,EAEA,gBAAuD;AACnD,WAAO,KAAK,SAAS,WACf,EAAE,KAAK,KAAK,iBAAiB,MAAM,KAAK,iBAAiB,IACzD,EAAE,KAAK,KAAK,iBAAiB,MAAM,KAAK,iBAAiB;AAAA,EACnE;AAAA,EAEA,SAAS,MAAkB,OAAe,QAA4B;AAClE,QAAI,KAAK,WAAW,UAAU;AAC1B,YAAM,IAAI,cAAc,0CAA0C,QAAQ,eAAe,KAAK,MAAM,EAAE;AAAA,IAC1G;AACA,QAAI,QAAQ,KAAK,QAAQ,WAAW;AAChC,YAAM,IAAI,cAAc,mCAAmC,KAAK,eAAe;AAAA,IACnF;AACA,QAAI,SAAS,MAAM,SAAS,SAAS;AACjC,YAAM,IAAI,cAAc,oCAAoC,MAAM,eAAe;AAAA,IACrF;AACA,UAAM,MAAM,IAAI,WAAW,SAAS;AACpC,QAAI,IAAI,MAAM,CAAC;AACf,QAAI,CAAC,IAAK,UAAU,IAAK;AACzB,QAAI,CAAC,IAAI,QAAQ;AACjB,aAAS,IAAI,GAAG,IAAI,GAAG,KAAK;AACxB,UAAI,IAAI,CAAC,IAAI,OAAQ,UAAU,QAAQ,IAAI,KAAK,CAAC,IAAK,KAAK;AAAA,IAC/D;AACA,WAAO;AAAA,EACX;AAAA,EAEA,OAAO,MAAmB,OAAe,QAAgB,cAAkC;AACvF,QAAI,QAAQ,KAAK,QAAQ,WAAW;AAChC,YAAM,IAAI,cAAc,iCAAiC,KAAK,eAAe;AAAA,IACjF;AACA,QAAI,SAAS,MAAM,SAAS,SAAS;AACjC,YAAM,IAAI,cAAc,kCAAkC,MAAM,eAAe;AAAA,IACnF;AACA,QAAI,eAAe,KAAK,eAAe,OAAQ;AAC3C,YAAM,IAAI,cAAc,wCAAwC,YAAY,eAAe;AAAA,IAC/F;AACA,UAAM,MAAM,IAAI,WAAW,OAAO;AAClC,QAAI,CAAC,IAAK,UAAU,IAAK;AACzB,QAAI,CAAC,IAAI,QAAQ;AACjB,aAAS,IAAI,GAAG,IAAI,GAAG,KAAK;AACxB,UAAI,IAAI,CAAC,IAAI,OAAQ,UAAU,QAAQ,IAAI,KAAK,CAAC,IAAK,KAAK;AAAA,IAC/D;AACA,QAAI,CAAC,IAAI;AACT,QAAI,CAAC,IAAI,iBAAiB;AAC1B,QAAI,EAAE,IAAI,iBAAiB;AAC3B,QAAI,EAAE,IAAK,iBAAiB,IAAK;AACjC,QAAI,EAAE,IAAI,eAAe;AACzB,WAAO;AAAA,EACX;AACJ;",
+  "names": []
+}

package/dist/esm/dtls/record/DtlsRecord.d.ts

@@ -0,0 +1,89 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { MatterError } from "@matter/general";
+import { ContentType } from "./ContentType.js";
+/**
+ * DTLS 1.2 protocol version on the wire is `{ major: 0xfe, minor: 0xfd }`,
+ * the 1's-complement convention TLS uses (RFC 6347 §4.1).
+ */
+export declare const DTLS_1_2_VERSION: Readonly<{
+    major: 254;
+    minor: 253;
+}>;
+/** Maximum length of the DTLSCiphertext.fragment field (RFC 6347 §4.1). */
+export declare const DTLS_MAX_FRAGMENT_LEN: number;
+/** 8-byte explicit AEAD nonce + 8-byte CCM-8 tag overhead per RFC 6655 §3. */
+export declare const DTLS_AEAD_OVERHEAD = 16;
+/** Length of the DTLS record header (RFC 6347 §4.1). */
+export declare const DTLS_HEADER_LEN = 13;
+/**
+ * Minimal cipher-state surface the record codec needs. The full {@link DtlsCipherState}
+ * class implements this and adds key-block bookkeeping; this interface lets the codec
+ * accept either the class or a stand-in test double without forcing a circular import.
+ *
+ * `acceptIncoming`, when present, is invoked after a successful AEAD decrypt to apply
+ * the RFC 6347 §4.1.2.6 anti-replay window. Returning `false` causes the codec to throw
+ * a {@link DtlsReplayError}.
+ */
+export interface DtlsRecordCipherState {
+    /** AES key + 4-byte salt to use for outbound (encrypt) records. */
+    encryptParams(): {
+        key: Uint8Array;
+        salt: Uint8Array;
+    };
+    /** AES key + 4-byte salt to use for inbound (decrypt) records. */
+    decryptParams(): {
+        key: Uint8Array;
+        salt: Uint8Array;
+    };
+    /** Build the 12-byte CCM nonce: salt(4) || epoch(2) || seq(6). */
+    nonceFor(salt: Uint8Array, epoch: number, seqNum: bigint): Uint8Array;
+    /** Build the 13-byte DTLS AAD: epoch||seq(8) || type(1) || version(2) || plaintextLen(2). */
+    aadFor(type: ContentType, epoch: number, seqNum: bigint, plaintextLen: number): Uint8Array;
+    /** Optional read-side replay-window check; absent on test doubles or pre-handshake states. */
+    acceptIncoming?(epoch: number, seqNum: bigint): boolean;
+}
+/**
+ * Thrown by {@link DtlsRecord.decode} when a successfully-decrypted record is rejected
+ * by the read-side anti-replay window. Distinguishable from AEAD failures so the caller
+ * can log/drop without treating the record as a fatal error.
+ */
+export declare class DtlsReplayError extends MatterError {
+    readonly epoch: number;
+    readonly sequenceNumber: bigint;
+    constructor(epoch: number, sequenceNumber: bigint);
+}
+/**
+ * Decoded DTLS 1.2 record (RFC 6347 §4.1).
+ * `fragment` is always the *plaintext* payload — for epoch=0 records it is the wire bytes
+ * verbatim, for epoch>0 records it is the AEAD-decrypted body.
+ */
+export interface DtlsRecord {
+    type: ContentType;
+    epoch: number;
+    sequenceNumber: bigint;
+    fragment: Uint8Array;
+}
+/**
+ * DTLS 1.2 record-layer codec.
+ *
+ * `encode` frames a record as `header(13) || fragment`; for `epoch > 0` the fragment is
+ * `explicit_nonce(8) || ciphertext(plaintext_len) || tag(8)` per RFC 6655 §3.
+ *
+ * `decode` parses one record off the front of the buffer and returns it together with
+ * the number of consumed bytes, so a caller can split multiple records concatenated in
+ * one UDP datagram. When the supplied state implements {@link DtlsRecordCipherState.acceptIncoming},
+ * decode invokes it after AEAD success and throws {@link DtlsReplayError} on rejection.
+ */
+export declare namespace DtlsRecord {
+    function encode(record: DtlsRecord, state?: DtlsRecordCipherState): Uint8Array;
+    interface DecodeResult {
+        record: DtlsRecord;
+        consumed: number;
+    }
+    function decode(bytes: Uint8Array, state?: DtlsRecordCipherState): DecodeResult;
+}
+//# sourceMappingURL=DtlsRecord.d.ts.map

package/dist/esm/dtls/record/DtlsRecord.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DtlsRecord.d.ts","sourceRoot":"","sources":["../../../../src/dtls/record/DtlsRecord.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAiB,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAG7D,OAAO,EAAE,WAAW,EAAiB,MAAM,kBAAkB,CAAC;AAE9D;;;GAGG;AACH,eAAO,MAAM,gBAAgB;;;EAA8C,CAAC;AAE5E,2EAA2E;AAC3E,eAAO,MAAM,qBAAqB,QAAU,CAAC;AAE7C,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,KAAK,CAAC;AAErC,wDAAwD;AACxD,eAAO,MAAM,eAAe,KAAK,CAAC;AAElC;;;;;;;;GAQG;AACH,MAAM,WAAW,qBAAqB;IAClC,mEAAmE;IACnE,aAAa,IAAI;QAAE,GAAG,EAAE,UAAU,CAAC;QAAC,IAAI,EAAE,UAAU,CAAA;KAAE,CAAC;IACvD,kEAAkE;IAClE,aAAa,IAAI;QAAE,GAAG,EAAE,UAAU,CAAC;QAAC,IAAI,EAAE,UAAU,CAAA;KAAE,CAAC;IACvD,kEAAkE;IAClE,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,UAAU,CAAC;IACtE,6FAA6F;IAC7F,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,UAAU,CAAC;IAC3F,8FAA8F;IAC9F,cAAc,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;CAC3D;AAED;;;;GAIG;AACH,qBAAa,eAAgB,SAAQ,WAAW;IAC5C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAEhC,YAAY,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAKhD;CACJ;AAED;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACvB,IAAI,EAAE,WAAW,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,UAAU,CAAC;CACxB;AAkCD;;;;;;;;;;GAUG;AACH,yBAAiB,UAAU,CAAC,CAAC;IACzB,SAAgB,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE,qBAAqB,GAAG,UAAU,CAmDpF;IAED,UAAiB,YAAY;QACzB,MAAM,EAAE,UAAU,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC;KACpB;IAED,SAAgB,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE,qBAAqB,GAAG,YAAY,CAoErF;CACJ"}

package/dist/esm/dtls/record/DtlsRecord.js

@@ -0,0 +1,175 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { InternalError, MatterError } from "@matter/general";
+import { DtlsError } from "../channel/DtlsChannel.js";
+import { AesCcm8 } from "./AesCcm8.js";
+import { isContentType } from "./ContentType.js";
+const DTLS_1_2_VERSION = Object.freeze({ major: 254, minor: 253 });
+const DTLS_MAX_FRAGMENT_LEN = 1 << 14;
+const DTLS_AEAD_OVERHEAD = 16;
+const DTLS_HEADER_LEN = 13;
+class DtlsReplayError extends MatterError {
+  epoch;
+  sequenceNumber;
+  constructor(epoch, sequenceNumber) {
+    super(`DTLS replay or wrong-epoch record at epoch=${epoch} seq=${sequenceNumber}`);
+    this.name = "DtlsReplayError";
+    this.epoch = epoch;
+    this.sequenceNumber = sequenceNumber;
+  }
+}
+const MAX_EPOCH = 65535;
+const MAX_SEQ = (1n << 48n) - 1n;
+function writeUint16BE(buf, offset, value) {
+  buf[offset] = value >>> 8 & 255;
+  buf[offset + 1] = value & 255;
+}
+function readUint16BE(buf, offset) {
+  return buf[offset] << 8 | buf[offset + 1];
+}
+function writeUint48BE(buf, offset, value) {
+  if (value < 0n || value > MAX_SEQ) {
+    throw new InternalError(`DTLS sequence_number out of range: ${value}`);
+  }
+  buf[offset] = Number(value >> 40n & 0xffn);
+  buf[offset + 1] = Number(value >> 32n & 0xffn);
+  buf[offset + 2] = Number(value >> 24n & 0xffn);
+  buf[offset + 3] = Number(value >> 16n & 0xffn);
+  buf[offset + 4] = Number(value >> 8n & 0xffn);
+  buf[offset + 5] = Number(value & 0xffn);
+}
+function readUint48BE(buf, offset) {
+  let v = 0n;
+  for (let i = 0; i < 6; i++) {
+    v = v << 8n | BigInt(buf[offset + i]);
+  }
+  return v;
+}
+var DtlsRecord;
+((DtlsRecord2) => {
+  function encode(record, state) {
+    if (record.epoch < 0 || record.epoch > MAX_EPOCH) {
+      throw new InternalError(`DTLS epoch out of range: ${record.epoch}`);
+    }
+    if (record.sequenceNumber < 0n || record.sequenceNumber > MAX_SEQ) {
+      throw new InternalError(`DTLS sequence_number out of range: ${record.sequenceNumber}`);
+    }
+    if (!isContentType(record.type)) {
+      throw new InternalError(`DTLS unknown ContentType: ${record.type}`);
+    }
+    let fragment;
+    if (record.epoch === 0) {
+      if (record.fragment.length > DTLS_MAX_FRAGMENT_LEN) {
+        throw new InternalError(
+          `DTLS plaintext fragment too large: ${record.fragment.length} > ${DTLS_MAX_FRAGMENT_LEN}`
+        );
+      }
+      fragment = record.fragment;
+    } else {
+      if (state === void 0) {
+        throw new InternalError(`DTLS encode at epoch ${record.epoch} requires cipher state`);
+      }
+      const plaintextLen = record.fragment.length;
+      if (plaintextLen + DTLS_AEAD_OVERHEAD > DTLS_MAX_FRAGMENT_LEN) {
+        throw new InternalError(
+          `DTLS encrypted fragment too large: ${plaintextLen + DTLS_AEAD_OVERHEAD} > ${DTLS_MAX_FRAGMENT_LEN}`
+        );
+      }
+      const { key, salt } = state.encryptParams();
+      const nonce = state.nonceFor(salt, record.epoch, record.sequenceNumber);
+      const aad = state.aadFor(record.type, record.epoch, record.sequenceNumber, plaintextLen);
+      const cipherWithTag = AesCcm8.encrypt({ key, nonce, aad, plaintext: record.fragment });
+      fragment = new Uint8Array(8 + cipherWithTag.length);
+      fragment[0] = record.epoch >>> 8 & 255;
+      fragment[1] = record.epoch & 255;
+      writeUint48BE(fragment, 2, record.sequenceNumber);
+      fragment.set(cipherWithTag, 8);
+    }
+    const out = new Uint8Array(DTLS_HEADER_LEN + fragment.length);
+    out[0] = record.type;
+    out[1] = DTLS_1_2_VERSION.major;
+    out[2] = DTLS_1_2_VERSION.minor;
+    writeUint16BE(out, 3, record.epoch);
+    writeUint48BE(out, 5, record.sequenceNumber);
+    writeUint16BE(out, 11, fragment.length);
+    out.set(fragment, DTLS_HEADER_LEN);
+    return out;
+  }
+  DtlsRecord2.encode = encode;
+  function decode(bytes, state) {
+    if (bytes.length < DTLS_HEADER_LEN) {
+      throw new DtlsError(`DTLS record header truncated: have ${bytes.length}, need ${DTLS_HEADER_LEN}`);
+    }
+    const type = bytes[0];
+    if (!isContentType(type)) {
+      throw new DtlsError(`DTLS unknown ContentType: ${type}`);
+    }
+    const major = bytes[1];
+    const minor = bytes[2];
+    if (major !== DTLS_1_2_VERSION.major || minor !== DTLS_1_2_VERSION.minor) {
+      throw new DtlsError(
+        `DTLS unsupported version ${major.toString(16)}.${minor.toString(16)}; only DTLS 1.2 is supported`
+      );
+    }
+    const epoch = readUint16BE(bytes, 3);
+    const sequenceNumber = readUint48BE(bytes, 5);
+    const length = readUint16BE(bytes, 11);
+    if (length > DTLS_MAX_FRAGMENT_LEN) {
+      throw new DtlsError(`DTLS fragment length ${length} exceeds limit ${DTLS_MAX_FRAGMENT_LEN}`);
+    }
+    const total = DTLS_HEADER_LEN + length;
+    if (bytes.length < total) {
+      throw new DtlsError(`DTLS record truncated: header says ${length}, have ${bytes.length - DTLS_HEADER_LEN}`);
+    }
+    let fragment;
+    if (epoch === 0) {
+      fragment = bytes.slice(DTLS_HEADER_LEN, total);
+    } else {
+      if (state === void 0) {
+        throw new InternalError(`DTLS decode at epoch ${epoch} requires cipher state`);
+      }
+      if (length < DTLS_AEAD_OVERHEAD) {
+        throw new DtlsError(
+          `DTLS encrypted fragment ${length} bytes < ${DTLS_AEAD_OVERHEAD}-byte AEAD overhead`
+        );
+      }
+      const explicitNonce = bytes.subarray(DTLS_HEADER_LEN, DTLS_HEADER_LEN + 8);
+      const cipherWithTag = bytes.subarray(DTLS_HEADER_LEN + 8, total);
+      const plaintextLen = cipherWithTag.length - 8;
+      const { key, salt } = state.decryptParams();
+      const wireEpoch = explicitNonce[0] << 8 | explicitNonce[1];
+      let wireSeq = 0n;
+      for (let i = 2; i < 8; i++) {
+        wireSeq = wireSeq << 8n | BigInt(explicitNonce[i]);
+      }
+      if (wireEpoch !== epoch || wireSeq !== sequenceNumber) {
+        throw new DtlsError(
+          `DTLS explicit nonce ${wireEpoch}/${wireSeq} disagrees with header ${epoch}/${sequenceNumber}`
+        );
+      }
+      const nonce = state.nonceFor(salt, epoch, sequenceNumber);
+      const aad = state.aadFor(type, epoch, sequenceNumber, plaintextLen);
+      fragment = AesCcm8.decrypt({ key, nonce, aad, ciphertextWithTag: cipherWithTag });
+      if (state.acceptIncoming !== void 0 && !state.acceptIncoming(epoch, sequenceNumber)) {
+        throw new DtlsReplayError(epoch, sequenceNumber);
+      }
+    }
+    return {
+      record: { type, epoch, sequenceNumber, fragment },
+      consumed: total
+    };
+  }
+  DtlsRecord2.decode = decode;
+})(DtlsRecord || (DtlsRecord = {}));
+export {
+  DTLS_1_2_VERSION,
+  DTLS_AEAD_OVERHEAD,
+  DTLS_HEADER_LEN,
+  DTLS_MAX_FRAGMENT_LEN,
+  DtlsRecord,
+  DtlsReplayError
+};
+//# sourceMappingURL=DtlsRecord.js.map

package/dist/esm/dtls/record/DtlsRecord.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/dtls/record/DtlsRecord.ts"],
+  "mappings": "AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,SAAS,eAAe,mBAAmB;AAC3C,SAAS,iBAAiB;AAC1B,SAAS,eAAe;AACxB,SAAsB,qBAAqB;AAMpC,MAAM,mBAAmB,OAAO,OAAO,EAAE,OAAO,KAAM,OAAO,IAAK,CAAC;AAGnE,MAAM,wBAAwB,KAAK;AAGnC,MAAM,qBAAqB;AAG3B,MAAM,kBAAkB;AA6BxB,MAAM,wBAAwB,YAAY;AAAA,EACpC;AAAA,EACA;AAAA,EAET,YAAY,OAAe,gBAAwB;AAC/C,UAAM,8CAA8C,KAAK,QAAQ,cAAc,EAAE;AACjF,SAAK,OAAO;AACZ,SAAK,QAAQ;AACb,SAAK,iBAAiB;AAAA,EAC1B;AACJ;AAcA,MAAM,YAAY;AAClB,MAAM,WAAW,MAAM,OAAO;AAE9B,SAAS,cAAc,KAAiB,QAAgB,OAAqB;AACzE,MAAI,MAAM,IAAK,UAAU,IAAK;AAC9B,MAAI,SAAS,CAAC,IAAI,QAAQ;AAC9B;AAEA,SAAS,aAAa,KAAiB,QAAwB;AAC3D,SAAQ,IAAI,MAAM,KAAK,IAAK,IAAI,SAAS,CAAC;AAC9C;AAEA,SAAS,cAAc,KAAiB,QAAgB,OAAqB;AACzE,MAAI,QAAQ,MAAM,QAAQ,SAAS;AAC/B,UAAM,IAAI,cAAc,sCAAsC,KAAK,EAAE;AAAA,EACzE;AACA,MAAI,MAAM,IAAI,OAAQ,SAAS,MAAO,KAAK;AAC3C,MAAI,SAAS,CAAC,IAAI,OAAQ,SAAS,MAAO,KAAK;AAC/C,MAAI,SAAS,CAAC,IAAI,OAAQ,SAAS,MAAO,KAAK;AAC/C,MAAI,SAAS,CAAC,IAAI,OAAQ,SAAS,MAAO,KAAK;AAC/C,MAAI,SAAS,CAAC,IAAI,OAAQ,SAAS,KAAM,KAAK;AAC9C,MAAI,SAAS,CAAC,IAAI,OAAO,QAAQ,KAAK;AAC1C;AAEA,SAAS,aAAa,KAAiB,QAAwB;AAC3D,MAAI,IAAI;AACR,WAAS,IAAI,GAAG,IAAI,GAAG,KAAK;AACxB,QAAK,KAAK,KAAM,OAAO,IAAI,SAAS,CAAC,CAAC;AAAA,EAC1C;AACA,SAAO;AACX;AAaO,IAAU;AAAA,CAAV,CAAUA,gBAAV;AACI,WAAS,OAAO,QAAoB,OAA2C;AAClF,QAAI,OAAO,QAAQ,KAAK,OAAO,QAAQ,WAAW;AAC9C,YAAM,IAAI,cAAc,4BAA4B,OAAO,KAAK,EAAE;AAAA,IACtE;AACA,QAAI,OAAO,iBAAiB,MAAM,OAAO,iBAAiB,SAAS;AAC/D,YAAM,IAAI,cAAc,sCAAsC,OAAO,cAAc,EAAE;AAAA,IACzF;AACA,QAAI,CAAC,cAAc,OAAO,IAAI,GAAG;AAC7B,YAAM,IAAI,cAAc,6BAA6B,OAAO,IAAI,EAAE;AAAA,IACtE;AAEA,QAAI;AACJ,QAAI,OAAO,UAAU,GAAG;AACpB,UAAI,OAAO,SAAS,SAAS,uBAAuB;AAChD,cAAM,IAAI;AAAA,UACN,sCAAsC,OAAO,SAAS,MAAM,MAAM,qBAAqB;AAAA,QAC3F;AAAA,MACJ;AACA,iBAAW,OAAO;AAAA,IACtB,OAAO;AACH,UAAI,UAAU,QAAW;AACrB,cAAM,IAAI,cAAc,wBAAwB,OAAO,KAAK,wBAAwB;AAAA,MACxF;AACA,YAAM,eAAe,OAAO,SAAS;AACrC,UAAI,eAAe,qBAAqB,uBAAuB;AAC3D,cAAM,IAAI;AAAA,UACN,sCAAsC,eAAe,kBAAkB,MAAM,qBAAqB;AAAA,QACtG;AAAA,MACJ;AACA,YAAM,EAAE,KAAK,KAAK,IAAI,MAAM,cAAc;AAC1C,YAAM,QAAQ,MAAM,SAAS,MAAM,OAAO,OAAO,OAAO,cAAc;AACtE,YAAM,MAAM,MAAM,OAAO,OAAO,MAAM,OAAO,OAAO,OAAO,gBAAgB,YAAY;AACvF,YAAM,gBAAgB,QAAQ,QAAQ,EAAE,KAAK,OAAO,KAAK,WAAW,OAAO,SAAS,CAAC;AAErF,iBAAW,IAAI,WAAW,IAAI,cAAc,MAAM;AAElD,eAAS,CAAC,IAAK,OAAO,UAAU,IAAK;AACrC,eAAS,CAAC,IAAI,OAAO,QAAQ;AAC7B,oBAAc,UAAU,GAAG,OAAO,cAAc;AAChD,eAAS,IAAI,eAAe,CAAC;AAAA,IACjC;AAEA,UAAM,MAAM,IAAI,WAAW,kBAAkB,SAAS,MAAM;AAC5D,QAAI,CAAC,IAAI,OAAO;AAChB,QAAI,CAAC,IAAI,iBAAiB;AAC1B,QAAI,CAAC,IAAI,iBAAiB;AAC1B,kBAAc,KAAK,GAAG,OAAO,KAAK;AAClC,kBAAc,KAAK,GAAG,OAAO,cAAc;AAC3C,kBAAc,KAAK,IAAI,SAAS,MAAM;AACtC,QAAI,IAAI,UAAU,eAAe;AACjC,WAAO;AAAA,EACX;AAnDO,EAAAA,YAAS;AA0DT,WAAS,OAAO,OAAmB,OAA6C;AACnF,QAAI,MAAM,SAAS,iBAAiB;AAChC,YAAM,IAAI,UAAU,sCAAsC,MAAM,MAAM,UAAU,eAAe,EAAE;AAAA,IACrG;AACA,UAAM,OAAO,MAAM,CAAC;AACpB,QAAI,CAAC,cAAc,IAAI,GAAG;AACtB,YAAM,IAAI,UAAU,6BAA6B,IAAI,EAAE;AAAA,IAC3D;AACA,UAAM,QAAQ,MAAM,CAAC;AACrB,UAAM,QAAQ,MAAM,CAAC;AACrB,QAAI,UAAU,iBAAiB,SAAS,UAAU,iBAAiB,OAAO;AACtE,YAAM,IAAI;AAAA,QACN,4BAA4B,MAAM,SAAS,EAAE,CAAC,IAAI,MAAM,SAAS,EAAE,CAAC;AAAA,MACxE;AAAA,IACJ;AACA,UAAM,QAAQ,aAAa,OAAO,CAAC;AACnC,UAAM,iBAAiB,aAAa,OAAO,CAAC;AAC5C,UAAM,SAAS,aAAa,OAAO,EAAE;AACrC,QAAI,SAAS,uBAAuB;AAChC,YAAM,IAAI,UAAU,wBAAwB,MAAM,kBAAkB,qBAAqB,EAAE;AAAA,IAC/F;AACA,UAAM,QAAQ,kBAAkB;AAChC,QAAI,MAAM,SAAS,OAAO;AACtB,YAAM,IAAI,UAAU,sCAAsC,MAAM,UAAU,MAAM,SAAS,eAAe,EAAE;AAAA,IAC9G;AAEA,QAAI;AACJ,QAAI,UAAU,GAAG;AACb,iBAAW,MAAM,MAAM,iBAAiB,KAAK;AAAA,IACjD,OAAO;AACH,UAAI,UAAU,QAAW;AACrB,cAAM,IAAI,cAAc,wBAAwB,KAAK,wBAAwB;AAAA,MACjF;AACA,UAAI,SAAS,oBAAoB;AAC7B,cAAM,IAAI;AAAA,UACN,2BAA2B,MAAM,YAAY,kBAAkB;AAAA,QACnE;AAAA,MACJ;AAEA,YAAM,gBAAgB,MAAM,SAAS,iBAAiB,kBAAkB,CAAC;AACzE,YAAM,gBAAgB,MAAM,SAAS,kBAAkB,GAAG,KAAK;AAC/D,YAAM,eAAe,cAAc,SAAS;AAE5C,YAAM,EAAE,KAAK,KAAK,IAAI,MAAM,cAAc;AAC1C,YAAM,YAAa,cAAc,CAAC,KAAK,IAAK,cAAc,CAAC;AAC3D,UAAI,UAAU;AACd,eAAS,IAAI,GAAG,IAAI,GAAG,KAAK;AACxB,kBAAW,WAAW,KAAM,OAAO,cAAc,CAAC,CAAC;AAAA,MACvD;AACA,UAAI,cAAc,SAAS,YAAY,gBAAgB;AACnD,cAAM,IAAI;AAAA,UACN,uBAAuB,SAAS,IAAI,OAAO,0BAA0B,KAAK,IAAI,cAAc;AAAA,QAChG;AAAA,MACJ;AACA,YAAM,QAAQ,MAAM,SAAS,MAAM,OAAO,cAAc;AACxD,YAAM,MAAM,MAAM,OAAO,MAAM,OAAO,gBAAgB,YAAY;AAClE,iBAAW,QAAQ,QAAQ,EAAE,KAAK,OAAO,KAAK,mBAAmB,cAAc,CAAC;AAGhF,UAAI,MAAM,mBAAmB,UAAa,CAAC,MAAM,eAAe,OAAO,cAAc,GAAG;AACpF,cAAM,IAAI,gBAAgB,OAAO,cAAc;AAAA,MACnD;AAAA,IACJ;AAEA,WAAO;AAAA,MACH,QAAQ,EAAE,MAAM,OAAO,gBAAgB,SAAS;AAAA,MAChD,UAAU;AAAA,IACd;AAAA,EACJ;AApEO,EAAAA,YAAS;AAAA,GA3DH;",
+  "names": ["DtlsRecord"]
+}

package/dist/esm/dtls/record/index.d.ts

@@ -0,0 +1,15 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * DTLS 1.2 record layer for `TLS_ECJPAKE_WITH_AES_128_CCM_8`. Internal to `dtls/`;
+ * not re-exported from the package public API surface until the {@link DtlsChannel}
+ * interface ships in sub-batch 5.
+ */
+export { AntiReplayWindow } from "./AntiReplayWindow.js";
+export { ContentType, isContentType } from "./ContentType.js";
+export { DtlsCipherState, type DtlsCipherStateInputs } from "./DtlsCipherState.js";
+export { DTLS_1_2_VERSION, DTLS_AEAD_OVERHEAD, DTLS_HEADER_LEN, DTLS_MAX_FRAGMENT_LEN, DtlsRecord, DtlsReplayError, type DtlsRecordCipherState, } from "./DtlsRecord.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/dtls/record/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/dtls/record/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;GAIG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,KAAK,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EACH,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,qBAAqB,EACrB,UAAU,EACV,eAAe,EACf,KAAK,qBAAqB,GAC7B,MAAM,iBAAiB,CAAC"}

package/dist/esm/dtls/record/index.js

@@ -0,0 +1,29 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { AntiReplayWindow } from "./AntiReplayWindow.js";
+import { ContentType, isContentType } from "./ContentType.js";
+import { DtlsCipherState } from "./DtlsCipherState.js";
+import {
+  DTLS_1_2_VERSION,
+  DTLS_AEAD_OVERHEAD,
+  DTLS_HEADER_LEN,
+  DTLS_MAX_FRAGMENT_LEN,
+  DtlsRecord,
+  DtlsReplayError
+} from "./DtlsRecord.js";
+export {
+  AntiReplayWindow,
+  ContentType,
+  DTLS_1_2_VERSION,
+  DTLS_AEAD_OVERHEAD,
+  DTLS_HEADER_LEN,
+  DTLS_MAX_FRAGMENT_LEN,
+  DtlsCipherState,
+  DtlsRecord,
+  DtlsReplayError,
+  isContentType
+};
+//# sourceMappingURL=index.js.map

package/dist/esm/dtls/record/index.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/dtls/record/index.ts"],
+  "mappings": "AAAA;AAAA;AAAA;AAAA;AAAA;AAYA,SAAS,wBAAwB;AACjC,SAAS,aAAa,qBAAqB;AAC3C,SAAS,uBAAmD;AAC5D;AAAA,EACI;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEG;",
+  "names": []
+}

package/dist/esm/index.d.ts

@@ -0,0 +1,32 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * `@matter/thread-br-client` — Thread Border Router discovery, dataset codec, and
+ * read-only network diagnostics (MeshCoP/CoAP over DTLS-EC-JPAKE, and OTBR REST).
+ * See the package README for a consumer getting-started.
+ */
+export { BorderRouterRegistry } from "./discovery/index.js";
+export type { BorderRouterEntry } from "./discovery/index.js";
+export { MeshCopTlvType, MeshCopTlvTypeName, OperationalDataset, SecurityPolicy, ThreadDatasetError, } from "./dataset/index.js";
+export { ThreadCredentialsRegistry } from "./credentials/index.js";
+export type { ThreadNetworkCredentials } from "./credentials/index.js";
+export { ThreadTlvError } from "./tlv/BasicTlvCodec.js";
+export { NetworkDiagTlvType, NetworkDiagTlvTypeName } from "./tlv/networkDiagTlvTypes.js";
+export { ALL_THREAD_NODES_REALM_LOCAL, ALL_THREAD_ROUTERS_REALM_LOCAL, deriveMeshLocalAddress, formatIp6, } from "./util/meshLocalAddr.js";
+export { DefaultTlvSet, MeshCopDiagnosticSource, ThreadDiagError, connectMeshcop } from "./diagnostic/index.js";
+export type { ConnectMeshcopOpts, DiagnosticResponse, DiagnosticSource, EnergyScanEntry, EnergyScanOpts, MeshcopHandle, PanIdConflict, PanIdQueryOpts, QueryMulticastHandle, QueryMulticastOptions, } from "./diagnostic/index.js";
+export type { ChildTableEntry, Connectivity, LeaderData, MacCounters, MleCounters, Mode, ParentPriority, Route64, Route64Entry, } from "./tlv/diag/index.js";
+export { Pskc } from "./crypto/index.js";
+export { DtlsError, connectDtls } from "./dtls/channel/index.js";
+export type { DtlsChannel, DtlsConnectOpts } from "./dtls/channel/index.js";
+export { Commissioner, CommissionerKeepAliveError, CommissionerProtocolError, CommissionerRejectedError, CommissionerTimeoutError, } from "./commissioner/index.js";
+export type { CommissionerOpts } from "./commissioner/index.js";
+export { CoapTimeoutError } from "./coap/index.js";
+export { OtbrRestClient, OtbrRestDiagnosticSource, OtbrRestError, OtbrRestProbe } from "./otbr-rest/index.js";
+export type { OtbrDatasetHex, OtbrJoiner, OtbrLeaderData, OtbrNodeInfo, OtbrRestCapability, OtbrRestClientOptions, OtbrRestErrorCode, OtbrRestErrorOptions, } from "./otbr-rest/index.js";
+export { ExtPanIdLockManager, decodeStateBitmap, rankBrs, selectBr, selectSource } from "./selection/index.js";
+export type { DecodedStateBitmap, SelectSourceOpts } from "./selection/index.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;GAIG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,YAAY,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAE9D,OAAO,EACH,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EAClB,cAAc,EACd,kBAAkB,GACrB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACnE,YAAY,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAEvE,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAE1F,OAAO,EACH,4BAA4B,EAC5B,8BAA8B,EAC9B,sBAAsB,EACtB,SAAS,GACZ,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EAAE,aAAa,EAAE,uBAAuB,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAChH,YAAY,EACR,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,cAAc,EACd,aAAa,EACb,aAAa,EACb,cAAc,EACd,oBAAoB,EACpB,qBAAqB,GACxB,MAAM,uBAAuB,CAAC;AAG/B,YAAY,EACR,eAAe,EACf,YAAY,EACZ,UAAU,EACV,WAAW,EACX,WAAW,EACX,IAAI,EACJ,cAAc,EACd,OAAO,EACP,YAAY,GACf,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAEzC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACjE,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE5E,OAAO,EACH,YAAY,EACZ,0BAA0B,EAC1B,yBAAyB,EACzB,yBAAyB,EACzB,wBAAwB,GAC3B,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAEhE,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD,OAAO,EAAE,cAAc,EAAE,wBAAwB,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC9G,YAAY,EACR,cAAc,EACd,UAAU,EACV,cAAc,EACd,YAAY,EACZ,kBAAkB,EAClB,qBAAqB,EACrB,iBAAiB,EACjB,oBAAoB,GACvB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAC/G,YAAY,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/esm/index.js

@@ -0,0 +1,74 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { BorderRouterRegistry } from "./discovery/index.js";
+import {
+  MeshCopTlvType,
+  MeshCopTlvTypeName,
+  OperationalDataset,
+  SecurityPolicy,
+  ThreadDatasetError
+} from "./dataset/index.js";
+import { ThreadCredentialsRegistry } from "./credentials/index.js";
+import { ThreadTlvError } from "./tlv/BasicTlvCodec.js";
+import { NetworkDiagTlvType, NetworkDiagTlvTypeName } from "./tlv/networkDiagTlvTypes.js";
+import {
+  ALL_THREAD_NODES_REALM_LOCAL,
+  ALL_THREAD_ROUTERS_REALM_LOCAL,
+  deriveMeshLocalAddress,
+  formatIp6
+} from "./util/meshLocalAddr.js";
+import { DefaultTlvSet, MeshCopDiagnosticSource, ThreadDiagError, connectMeshcop } from "./diagnostic/index.js";
+import { Pskc } from "./crypto/index.js";
+import { DtlsError, connectDtls } from "./dtls/channel/index.js";
+import {
+  Commissioner,
+  CommissionerKeepAliveError,
+  CommissionerProtocolError,
+  CommissionerRejectedError,
+  CommissionerTimeoutError
+} from "./commissioner/index.js";
+import { CoapTimeoutError } from "./coap/index.js";
+import { OtbrRestClient, OtbrRestDiagnosticSource, OtbrRestError, OtbrRestProbe } from "./otbr-rest/index.js";
+import { ExtPanIdLockManager, decodeStateBitmap, rankBrs, selectBr, selectSource } from "./selection/index.js";
+export {
+  ALL_THREAD_NODES_REALM_LOCAL,
+  ALL_THREAD_ROUTERS_REALM_LOCAL,
+  BorderRouterRegistry,
+  CoapTimeoutError,
+  Commissioner,
+  CommissionerKeepAliveError,
+  CommissionerProtocolError,
+  CommissionerRejectedError,
+  CommissionerTimeoutError,
+  DefaultTlvSet,
+  DtlsError,
+  ExtPanIdLockManager,
+  MeshCopDiagnosticSource,
+  MeshCopTlvType,
+  MeshCopTlvTypeName,
+  NetworkDiagTlvType,
+  NetworkDiagTlvTypeName,
+  OperationalDataset,
+  OtbrRestClient,
+  OtbrRestDiagnosticSource,
+  OtbrRestError,
+  OtbrRestProbe,
+  Pskc,
+  SecurityPolicy,
+  ThreadCredentialsRegistry,
+  ThreadDatasetError,
+  ThreadDiagError,
+  ThreadTlvError,
+  connectDtls,
+  connectMeshcop,
+  decodeStateBitmap,
+  deriveMeshLocalAddress,
+  formatIp6,
+  rankBrs,
+  selectBr,
+  selectSource
+};
+//# sourceMappingURL=index.js.map

package/dist/esm/index.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": ["../../src/index.ts"],
+  "mappings": "AAAA;AAAA;AAAA;AAAA;AAAA;AAWA,SAAS,4BAA4B;AAGrC;AAAA,EACI;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACG;AAEP,SAAS,iCAAiC;AAG1C,SAAS,sBAAsB;AAC/B,SAAS,oBAAoB,8BAA8B;AAE3D;AAAA,EACI;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACG;AAGP,SAAS,eAAe,yBAAyB,iBAAiB,sBAAsB;AA2BxF,SAAS,YAAY;AAErB,SAAS,WAAW,mBAAmB;AAGvC;AAAA,EACI;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACG;AAGP,SAAS,wBAAwB;AAEjC,SAAS,gBAAgB,0BAA0B,eAAe,qBAAqB;AAYvF,SAAS,qBAAqB,mBAAmB,SAAS,UAAU,oBAAoB;",
+  "names": []
+}

package/dist/esm/otbr-rest/OtbrRestCapability.d.ts

@@ -0,0 +1,22 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * Snapshot of an OTBR REST endpoint as observed by {@link OtbrRestProbe}.
+ *
+ * `keyFormat` reflects the case convention the BR's REST surface uses on the
+ * wire (older OTBR builds = pascal, post-2024 builds = camel). The probe
+ * detects this from the presence/absence of `/api/actions` — see
+ * python-otbr-api `_async_detect_case`.
+ */
+export interface OtbrRestCapability {
+    baseUrl: string;
+    keyFormat: "camel" | "pascal";
+    apiVersion?: string;
+    probedAt: number;
+    networkName: string;
+    extPanId: Uint8Array;
+}
+//# sourceMappingURL=OtbrRestCapability.d.ts.map

package/dist/esm/otbr-rest/OtbrRestCapability.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"OtbrRestCapability.d.ts","sourceRoot":"","sources":["../../../src/otbr-rest/OtbrRestCapability.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,OAAO,GAAG,QAAQ,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,UAAU,CAAC;CACxB"}

package/dist/esm/otbr-rest/OtbrRestCapability.js

@@ -0,0 +1,6 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+//# sourceMappingURL=OtbrRestCapability.js.map