@matterbridge/core 3.5.3

package/dist/cliHistory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cliHistory.js","sourceRoot":"","sources":["../src/cliHistory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,sCAAsC;AACtC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;IAAE,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;AAEpI,OAAO,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AAEzB,OAAO,EAAE,OAAO,EAAmB,MAAM,qBAAqB,CAAC;AAmB/D;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,UAAsC,EAAE;IAC1E,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,mCAAmC,CAAC;IAC3E,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC;IACnD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC;IAEhG,MAAM,iBAAiB,GAAsB,EAAE,CAAC;IAEhD,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,MAAM,IAAI,CAAC,EAAE,CAAC;QAC/D,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,YAAY,GAAG,MAAM,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC;QACpE,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS,KAAK,CAAC;YAAE,SAAS;QAC9C,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAED,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IAChG,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;IAC/G,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1F,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzG,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;IAC5G,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzG,MAAM,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,gBAAgB,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;IACrH,MAAM,cAAc,GAAG,iBAAiB,CAAC,CAAC,CAAC,EAAE,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACrE,MAAM,aAAa,GAAG,iBAAiB,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IAE/F,MAAM,OAAO,GAAG;QACd,OAAO,EAAE,iBAAiB,CAAC,MAAM;QACjC,SAAS,EAAE,GAAG,IAAI,IAAI,CAAC,cAAc,CAAC,CAAC,cAAc,EAAE,MAAM,IAAI,IAAI,CAAC,aAAa,CAAC,CAAC,cAAc,EAAE,EAAE;QACvG,SAAS;QACT,cAAc;QACd,OAAO;QACP,YAAY;QACZ,aAAa;QACb,YAAY;QACZ,gBAAgB;KACjB,CAAC;IAEF,MAAM,IAAI,GAAG;;;;;;;aAOF,UAAU,CAAC,SAAS,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cA0JpB,UAAU,CAAC,SAAS,CAAC;uBACZ,UAAU,CAAC,QAAQ,CAAC;wBACnB,IAAI,IAAI,EAAE,CAAC,cAAc,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;6BAqDtB,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC;6BACjC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QA2gB5C,CAAC;IAEP,aAAa,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IAEvD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;GAKG;AACH,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACjI,CAAC"}

package/dist/clusters/export.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=export.d.ts.map

package/dist/clusters/export.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"export.d.ts","sourceRoot":"","sources":["../../src/clusters/export.ts"],"names":[],"mappings":""}

package/dist/clusters/export.js

@@ -0,0 +1,3 @@
+export {};
+// Nothing to export right now, but this file is here to make it easier to add exports in the future
+//# sourceMappingURL=export.js.map

package/dist/clusters/export.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"export.js","sourceRoot":"","sources":["../../src/clusters/export.ts"],"names":[],"mappings":";AAAA,oGAAoG"}

package/dist/crypto/attestationDecoder.d.ts

@@ -0,0 +1,180 @@
+/**
+ * This file contains the Device Attestation Certificate (DAC) functions.
+ *
+ * @file attestationDecoder.ts
+ * @author Luca Liguori
+ * @created 2025-05-08
+ * @version 1.0.0
+ * @license Apache-2.0
+ *
+ * Copyright 2025, 2026, 2027 Luca Liguori.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License. *
+ */
+/**
+6.2.2. Device Attestation Certificate (DAC)
+All commissionable Matter Nodes SHALL include a Device Attestation Certificate (DAC) and corresponding
+private key, unique to that Device. The DAC is used in the Device Attestation process, as
+part of Commissioning a Commissionee into a Fabric. The DAC SHALL be a DER-encoded X.509v3-
+compliant certificate as defined in RFC 5280 and SHALL be issued by a Product Attestation Intermediate
+(PAI) that chains directly to an approved Product Attestation Authority (PAA), and therefore
+SHALL have a certification path length of 2.
+ */
+/**
+ * Matter R1.4 — “Certificate Common Conventions” (Table 62)
+ * ---------------------------------------------------------
+ * Object identifiers for the Matter–specific Relative-Distinguished-Name (RDN)
+ * attributes that may appear in X.509 Subject / Issuer DNs as UTF8String or
+ * PrintableString encoded scalars.
+ */
+export interface MatterOidInfo {
+    /** Dot-notation OID, e.g. "1.3.6.1.4.1.37244.4.1.1" */
+    readonly oid: string;
+    /** Maximum scalar length in *octets* (see Matter 1.4, §6.1.1) */
+    readonly maxOctets: number;
+    /** Fixed string length in the DN (hexadecimal, upper-case) */
+    readonly dnStringLen: number;
+    /** Allowed ASN.1 string types when encoded in DER */
+    readonly asn1Types: readonly ('UTF8String' | 'PrintableString')[];
+}
+export declare const MatterOids: {
+    /** 17 — matter-node-id */
+    readonly nodeId: {
+        readonly oid: "1.3.6.1.4.1.37244.4.1.1";
+        readonly maxOctets: 8;
+        readonly dnStringLen: 16;
+        readonly asn1Types: readonly ["UTF8String"];
+    };
+    /** 18 — matter-firmware-signing-id */
+    readonly firmwareSigningId: {
+        readonly oid: "1.3.6.1.4.1.37244.4.1.2";
+        readonly maxOctets: 8;
+        readonly dnStringLen: 16;
+        readonly asn1Types: readonly ["UTF8String"];
+    };
+    /** 19 — matter-icac-id */
+    readonly icacId: {
+        readonly oid: "1.3.6.1.4.1.37244.4.1.3";
+        readonly maxOctets: 8;
+        readonly dnStringLen: 16;
+        readonly asn1Types: readonly ["UTF8String"];
+    };
+    /** 20 — matter-rcac-id */
+    readonly rcacId: {
+        readonly oid: "1.3.6.1.4.1.37244.4.1.4";
+        readonly maxOctets: 8;
+        readonly dnStringLen: 16;
+        readonly asn1Types: readonly ["UTF8String"];
+    };
+    /** 21 — matter-fabric-id */
+    readonly fabricId: {
+        readonly oid: "1.3.6.1.4.1.37244.4.1.5";
+        readonly maxOctets: 8;
+        readonly dnStringLen: 16;
+        readonly asn1Types: readonly ["UTF8String"];
+    };
+    /** 22 — matter-noc-cat */
+    readonly nocCat: {
+        readonly oid: "1.3.6.1.4.1.37244.4.1.6";
+        readonly maxOctets: 4;
+        readonly dnStringLen: 8;
+        readonly asn1Types: readonly ["UTF8String"];
+    };
+    /** matter-oid-vid (Vendor ID) */
+    readonly vendorId: {
+        readonly oid: "1.3.6.1.4.1.37244.2.1";
+        readonly maxOctets: 2;
+        readonly dnStringLen: 4;
+        readonly asn1Types: readonly ["UTF8String", "PrintableString"];
+    };
+    /** matter-oid-pid (Product ID) */
+    readonly productId: {
+        readonly oid: "1.3.6.1.4.1.37244.2.2";
+        readonly maxOctets: 2;
+        readonly dnStringLen: 4;
+        readonly asn1Types: readonly ["UTF8String", "PrintableString"];
+    };
+};
+export declare const oid2Key: Record<string, keyof typeof MatterOids>;
+/**
+ * Return the canonical Matter key (e.g. `"nodeId"`) for an arbitrary OID string,
+ * or `undefined` if the OID is not part of the Matter RDN set.
+ *
+ * @param {string} oid  The OID string to look up (e.g. "1.3.6.1.4.1.37244.4.1.1")
+ *
+ * @returns {keyof typeof MatterOids | undefined}  The corresponding Matter key, or `undefined` if not found
+ */
+export declare function matterKeyFromOid(oid: string): keyof typeof MatterOids | undefined;
+type DistinguishedName = Record<string, string>;
+type Hex = string;
+export interface DecodedCertificate {
+    /** Subject — e.g. { CN: "Matter Test PAA", O: "…" } */
+    subject: DistinguishedName;
+    /** Issuer — usually identical for a self-signed root */
+    issuer: DistinguishedName;
+    /** Serial number as hexadecimal (uppercase, no “0x” prefix) */
+    serialNumber: string;
+    /** UTC “not before” date */
+    notBefore: Date;
+    /** UTC “not after” date */
+    notAfter: Date;
+    /** Public key (SPKI) in PEM form */
+    publicKeyPEM: string;
+    fingerprintSHA256?: Hex;
+    signatureAlgorithm?: string;
+    keyUsage?: string[];
+    basicConstraints?: {
+        ca: boolean;
+        pathLen?: number;
+    };
+    authorityKeyId?: Hex;
+    subjectKeyId?: Hex;
+    rawDER?: Buffer;
+}
+/**
+ * Decode a PEM-encoded X.509 certificate and return the most useful fields.
+ *
+ * @param {string} pem  X.509 certificate in PEM form (may contain other PEM blocks)
+ * @param {string} [debug]  Optional debug label for logging
+ * @throws {Error}      If no CERTIFICATE block is found or the input is invalid
+ * @returns {DecodedCertificate} An object with the decoded certificate information:
+ */
+export declare function decodeX509Certificate(pem: string, debug?: string): DecodedCertificate;
+export interface DecodedEcPrivateKey {
+    /** PEM block exactly as supplied (useful for re-export) */
+    pem: string;
+    /** Curve name, e.g. 'prime256v1' (secp256r1) */
+    curve: string;
+    /** Private scalar *d* in hex (uppercase, no “0x”) */
+    dHex: string;
+    /** Public key derived from the private part, SPKI/PEM form */
+    publicKeyPEM: string;
+}
+/**
+ * Decode an EC private key PEM (PKCS#8 or SEC1) and expose the essentials.
+ *
+ * @param {string} pem  The key in PEM form (may contain extra blocks)
+ * @returns {DecodedEcPrivateKey} An object with the decoded key information:
+ * @throws {Error}      If no EC PRIVATE KEY / PRIVATE KEY block is found
+ */
+export declare function decodeEcPrivateKey(pem: string): DecodedEcPrivateKey;
+/**
+ * Convert a DER-encoded certificate (hex or base64) to PEM format.
+ *
+ * @param {string} hex  DER-encoded certificate in hex or base64 form
+ * @throws {Error}      If the input is not valid DER
+ * @returns {string}    PEM-encoded certificate
+ */
+export declare function derHexToPem(hex: string): string;
+export {};
+//# sourceMappingURL=attestationDecoder.d.ts.map

package/dist/crypto/attestationDecoder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attestationDecoder.d.ts","sourceRoot":"","sources":["../../src/crypto/attestationDecoder.ts"],"names":[],"mappings":"AACA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAIH;;;;;;;;GAQG;AAEH;;;;;;GAMG;AAEH,MAAM,WAAW,aAAa;IAC5B,uDAAuD;IACvD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,iEAAiE;IACjE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,8DAA8D;IAC9D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,qDAAqD;IACrD,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC,YAAY,GAAG,iBAAiB,CAAC,EAAE,CAAC;CACnE;AAGD,eAAO,MAAM,UAAU;IACrB,0BAA0B;;;;;;;IAE1B,sCAAsC;;;;;;;IAEtC,0BAA0B;;;;;;;IAE1B,0BAA0B;;;;;;;IAE1B,4BAA4B;;;;;;;IAE5B,0BAA0B;;;;;;;IAE1B,iCAAiC;;;;;;;IAEjC,kCAAkC;;;;;;;CAEc,CAAC;AAMnD,eAAO,MAAM,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,OAAO,UAAU,CAO3D,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,OAAO,UAAU,GAAG,SAAS,CAEjF;AAED,KAAK,iBAAiB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAChD,KAAK,GAAG,GAAG,MAAM,CAAC;AAElB,MAAM,WAAW,kBAAkB;IACjC,uDAAuD;IACvD,OAAO,EAAE,iBAAiB,CAAC;IAC3B,wDAAwD;IACxD,MAAM,EAAE,iBAAiB,CAAC;IAC1B,+DAA+D;IAC/D,YAAY,EAAE,MAAM,CAAC;IACrB,4BAA4B;IAC5B,SAAS,EAAE,IAAI,CAAC;IAChB,2BAA2B;IAC3B,QAAQ,EAAE,IAAI,CAAC;IACf,oCAAoC;IACpC,YAAY,EAAE,MAAM,CAAC;IAGrB,iBAAiB,CAAC,EAAE,GAAG,CAAC;IACxB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,gBAAgB,CAAC,EAAE;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACrD,cAAc,CAAC,EAAE,GAAG,CAAC;IACrB,YAAY,CAAC,EAAE,GAAG,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AA4BD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,kBAAkB,CAyBrF;AAED,MAAM,WAAW,mBAAmB;IAClC,2DAA2D;IAC3D,GAAG,EAAE,MAAM,CAAC;IACZ,gDAAgD;IAChD,KAAK,EAAE,MAAM,CAAC;IACd,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAC;IACb,8DAA8D;IAC9D,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,mBAAmB,CA4BnE;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAmB/C"}

package/dist/crypto/attestationDecoder.js

@@ -0,0 +1,176 @@
+/* eslint-disable no-console */
+/**
+ * This file contains the Device Attestation Certificate (DAC) functions.
+ *
+ * @file attestationDecoder.ts
+ * @author Luca Liguori
+ * @created 2025-05-08
+ * @version 1.0.0
+ * @license Apache-2.0
+ *
+ * Copyright 2025, 2026, 2027 Luca Liguori.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License. *
+ */
+import { X509Certificate, createPrivateKey, createPublicKey } from 'node:crypto';
+/* prettier-ignore */
+export const MatterOids = {
+    /** 17 — matter-node-id */
+    nodeId: { oid: '1.3.6.1.4.1.37244.4.1.1', maxOctets: 8, dnStringLen: 16, asn1Types: ['UTF8String'] },
+    /** 18 — matter-firmware-signing-id */
+    firmwareSigningId: { oid: '1.3.6.1.4.1.37244.4.1.2', maxOctets: 8, dnStringLen: 16, asn1Types: ['UTF8String'] },
+    /** 19 — matter-icac-id */
+    icacId: { oid: '1.3.6.1.4.1.37244.4.1.3', maxOctets: 8, dnStringLen: 16, asn1Types: ['UTF8String'] },
+    /** 20 — matter-rcac-id */
+    rcacId: { oid: '1.3.6.1.4.1.37244.4.1.4', maxOctets: 8, dnStringLen: 16, asn1Types: ['UTF8String'] },
+    /** 21 — matter-fabric-id */
+    fabricId: { oid: '1.3.6.1.4.1.37244.4.1.5', maxOctets: 8, dnStringLen: 16, asn1Types: ['UTF8String'] },
+    /** 22 — matter-noc-cat */
+    nocCat: { oid: '1.3.6.1.4.1.37244.4.1.6', maxOctets: 4, dnStringLen: 8, asn1Types: ['UTF8String'] },
+    /** matter-oid-vid (Vendor ID) */
+    vendorId: { oid: '1.3.6.1.4.1.37244.2.1', maxOctets: 2, dnStringLen: 4, asn1Types: ['UTF8String', 'PrintableString'] },
+    /** matter-oid-pid (Product ID) */
+    productId: { oid: '1.3.6.1.4.1.37244.2.2', maxOctets: 2, dnStringLen: 4, asn1Types: ['UTF8String', 'PrintableString'] },
+};
+/* ──────────────────────────────────────────────────────────────────────────
+ * Quick look-up: OID → canonical Matter key (e.g. "1.3.6.1.4.1.37244.4.1.1"
+ * ⇒ "nodeId").
+ * ------------------------------------------------------------------------- */
+export const oid2Key = Object.keys(MatterOids).reduce((acc, key) => {
+    const oid = MatterOids[key].oid;
+    acc[oid] = key;
+    return acc;
+}, {});
+/**
+ * Return the canonical Matter key (e.g. `"nodeId"`) for an arbitrary OID string,
+ * or `undefined` if the OID is not part of the Matter RDN set.
+ *
+ * @param {string} oid  The OID string to look up (e.g. "1.3.6.1.4.1.37244.4.1.1")
+ *
+ * @returns {keyof typeof MatterOids | undefined}  The corresponding Matter key, or `undefined` if not found
+ */
+export function matterKeyFromOid(oid) {
+    return oid2Key[oid];
+}
+/**
+ *
+ * Parse a Distinguished Name (DN) string into a structured object.
+ *
+ *  @param {string} dn  The DN string to parse (e.g. "CN=Test, O=Example")
+ *  @returns {DistinguishedName}  An object mapping attribute names to their values
+ */
+function parseDN(dn) {
+    // split on comma **or** newline, skip empty fragments
+    const rdns = dn.split(/\s*(?:,|\n)+\s*/).filter(Boolean);
+    const entries = rdns.map((rdn) => {
+        const [attr, ...rest] = rdn.split('=');
+        return [attr.trim(), rest.join('=').trim()];
+    });
+    const obj = Object.fromEntries(entries);
+    // Map Matter-specific OIDs to their canonical keys (vid, pid, …)
+    for (const [attr, value] of entries) {
+        const mk = matterKeyFromOid(attr);
+        if (mk)
+            obj[mk] = value;
+    }
+    return obj;
+}
+/**
+ * Decode a PEM-encoded X.509 certificate and return the most useful fields.
+ *
+ * @param {string} pem  X.509 certificate in PEM form (may contain other PEM blocks)
+ * @param {string} [debug]  Optional debug label for logging
+ * @throws {Error}      If no CERTIFICATE block is found or the input is invalid
+ * @returns {DecodedCertificate} An object with the decoded certificate information:
+ */
+export function decodeX509Certificate(pem, debug) {
+    // Extract the first CERTIFICATE block we find
+    const block = /-----BEGIN CERTIFICATE-----[^-]+-----END CERTIFICATE-----/s.exec(pem);
+    if (!block)
+        throw new Error('No CERTIFICATE block found in the supplied PEM data');
+    // Let 'node:crypto' do the magic
+    const cert = new X509Certificate(block[0]);
+    // Re-encode the public key as PEM so we can re-use it easily
+    const publicKeyPEM = cert.publicKey.export({
+        type: 'spki',
+        format: 'pem',
+    });
+    const decoded = {
+        subject: parseDN(cert.subject),
+        issuer: parseDN(cert.issuer),
+        serialNumber: cert.serialNumber.toUpperCase(),
+        notBefore: new Date(cert.validFrom),
+        notAfter: new Date(cert.validTo),
+        publicKeyPEM,
+        // fingerprintSHA256: cert.fingerprint256.replace(/:/g, ''),
+    };
+    if (debug)
+        console.log(`Decoded ${debug}:\n`, decoded);
+    return decoded;
+}
+/**
+ * Decode an EC private key PEM (PKCS#8 or SEC1) and expose the essentials.
+ *
+ * @param {string} pem  The key in PEM form (may contain extra blocks)
+ * @returns {DecodedEcPrivateKey} An object with the decoded key information:
+ * @throws {Error}      If no EC PRIVATE KEY / PRIVATE KEY block is found
+ */
+export function decodeEcPrivateKey(pem) {
+    const keyBlock = /-----BEGIN (?:EC )?PRIVATE KEY-----[^-]+-----END (?:EC )?PRIVATE KEY-----/s.exec(pem);
+    if (!keyBlock)
+        throw new Error('No EC PRIVATE KEY block found in the supplied PEM');
+    // -- Private key material ---------------------------------------------------
+    const priv = createPrivateKey(keyBlock[0]);
+    const curve = priv.asymmetricKeyDetails.namedCurve;
+    // Grab the raw 32-byte scalar “d” (works for P-256)
+    const pkcs8Der = priv.export({ format: 'der', type: 'pkcs8' });
+    const d = pkcs8Der
+        .subarray(pkcs8Der.length - 32)
+        .toString('hex')
+        .toUpperCase();
+    // -- Derive & export the matching public key --------------------------------
+    const publicKeyPEM = createPublicKey(priv).export({
+        format: 'pem',
+        type: 'spki',
+    });
+    return {
+        pem: keyBlock[0],
+        curve,
+        dHex: d,
+        publicKeyPEM,
+    };
+}
+/**
+ * Convert a DER-encoded certificate (hex or base64) to PEM format.
+ *
+ * @param {string} hex  DER-encoded certificate in hex or base64 form
+ * @throws {Error}      If the input is not valid DER
+ * @returns {string}    PEM-encoded certificate
+ */
+export function derHexToPem(hex) {
+    // 1️⃣  sanitise → drop whitespace & optional “0x”
+    const clean = hex.replace(/[^0-9a-f]/gi, '');
+    if (clean.length % 2 !== 0) {
+        throw new Error('Hex string has an odd length — not valid DER');
+    }
+    // 2️⃣  hex → Buffer
+    const der = Buffer.from(clean, 'hex');
+    // 3️⃣  Buffer → Base64 → insert \n every 64 chars (RFC 7468)
+    const b64Wrapped = der
+        .toString('base64')
+        .replace(/(.{64})/g, '$1\n')
+        .replace(/\n+$/, ''); // strip trailing newline
+    // 4️⃣  wrap with PEM armor
+    return `-----BEGIN CERTIFICATE-----\n${b64Wrapped}\n-----END CERTIFICATE-----\n`;
+}
+//# sourceMappingURL=attestationDecoder.js.map

package/dist/crypto/attestationDecoder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attestationDecoder.js","sourceRoot":"","sources":["../../src/crypto/attestationDecoder.ts"],"names":[],"mappings":"AAAA,+BAA+B;AAC/B;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,eAAe,EAAa,gBAAgB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AA+B5F,qBAAqB;AACrB,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,0BAA0B;IAC1B,MAAM,EAAY,EAAE,GAAG,EAAE,yBAAyB,EAAE,SAAS,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,YAAY,CAAC,EAAE;IAC9G,sCAAsC;IACtC,iBAAiB,EAAC,EAAE,GAAG,EAAE,yBAAyB,EAAE,SAAS,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,YAAY,CAAC,EAAE;IAC9G,0BAA0B;IAC1B,MAAM,EAAY,EAAE,GAAG,EAAE,yBAAyB,EAAE,SAAS,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,YAAY,CAAC,EAAE;IAC9G,0BAA0B;IAC1B,MAAM,EAAY,EAAE,GAAG,EAAE,yBAAyB,EAAE,SAAS,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,YAAY,CAAC,EAAE;IAC9G,4BAA4B;IAC5B,QAAQ,EAAU,EAAE,GAAG,EAAE,yBAAyB,EAAE,SAAS,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,YAAY,CAAC,EAAE;IAC9G,0BAA0B;IAC1B,MAAM,EAAY,EAAE,GAAG,EAAE,yBAAyB,EAAE,SAAS,EAAE,CAAC,EAAE,WAAW,EAAG,CAAC,EAAE,SAAS,EAAE,CAAC,YAAY,CAAC,EAAE;IAC9G,iCAAiC;IACjC,QAAQ,EAAU,EAAE,GAAG,EAAE,uBAAuB,EAAE,SAAS,EAAE,CAAC,EAAE,WAAW,EAAG,CAAC,EAAE,SAAS,EAAE,CAAC,YAAY,EAAC,iBAAiB,CAAC,EAAE;IAC9H,kCAAkC;IAClC,SAAS,EAAS,EAAE,GAAG,EAAE,uBAAuB,EAAE,SAAS,EAAE,CAAC,EAAE,WAAW,EAAG,CAAC,EAAE,SAAS,EAAE,CAAC,YAAY,EAAC,iBAAiB,CAAC,EAAE;CAC9E,CAAC;AAEnD;;;+EAG+E;AAC/E,MAAM,CAAC,MAAM,OAAO,GAA4C,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,CAC5F,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;IACX,MAAM,GAAG,GAAG,UAAU,CAAC,GAA8B,CAAC,CAAC,GAAG,CAAC;IAC3D,GAAG,CAAC,GAAG,CAAC,GAAG,GAA8B,CAAC;IAC1C,OAAO,GAAG,CAAC;AACb,CAAC,EACD,EAA6C,CAC9C,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;AACtB,CAAC;AA6BD;;;;;;GAMG;AACH,SAAS,OAAO,CAAC,EAAU;IACzB,sDAAsD;IACtD,MAAM,IAAI,GAAG,EAAE,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAEzD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QAC/B,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACvC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAqB,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,MAAM,GAAG,GAA2B,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IAEhE,iEAAiE;IACjE,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;QACpC,MAAM,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,EAAE;YAAE,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC;IAC1B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAW,EAAE,KAAc;IAC/D,8CAA8C;IAC9C,MAAM,KAAK,GAAG,4DAA4D,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrF,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IAEnF,iCAAiC;IACjC,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAE3C,6DAA6D;IAC7D,MAAM,YAAY,GAAI,IAAI,CAAC,SAAuB,CAAC,MAAM,CAAC;QACxD,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,KAAK;KACd,CAAW,CAAC;IAEb,MAAM,OAAO,GAAG;QACd,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;QAC9B,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;QAC5B,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE;QAC7C,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;QACnC,QAAQ,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;QAChC,YAAY;QACZ,4DAA4D;KAC7D,CAAC;IACF,IAAI,KAAK;QAAE,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,KAAK,EAAE,OAAO,CAAC,CAAC;IACvD,OAAO,OAAO,CAAC;AACjB,CAAC;AAaD;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,MAAM,QAAQ,GAAG,4EAA4E,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxG,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IAEpF,8EAA8E;IAC9E,MAAM,IAAI,GAAc,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAEtD,MAAM,KAAK,GAAI,IAAI,CAAC,oBAA+C,CAAC,UAAU,CAAC;IAE/E,oDAAoD;IACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAW,CAAC;IACzE,MAAM,CAAC,GAAG,QAAQ;SACf,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,EAAE,CAAC;SAC9B,QAAQ,CAAC,KAAK,CAAC;SACf,WAAW,EAAE,CAAC;IAEjB,8EAA8E;IAC9E,MAAM,YAAY,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;QAChD,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,MAAM;KACb,CAAW,CAAC;IAEb,OAAO;QACL,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;QAChB,KAAK;QACL,IAAI,EAAE,CAAC;QACP,YAAY;KACb,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,kDAAkD;IAClD,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IAE7C,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IAED,oBAAoB;IACpB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAEtC,6DAA6D;IAC7D,MAAM,UAAU,GAAG,GAAG;SACnB,QAAQ,CAAC,QAAQ,CAAC;SAClB,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC;SAC3B,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,yBAAyB;IAEjD,2BAA2B;IAC3B,OAAO,gCAAgC,UAAU,+BAA+B,CAAC;AACnF,CAAC"}

package/dist/crypto/declarationDecoder.d.ts

@@ -0,0 +1,72 @@
+/**
+ * This file contains the Certification Declaration functions.
+ *
+ * @file certificate.ts
+ * @author Luca Liguori
+ * created 2025-05-08
+ * version 1.0.0
+ *
+ * Copyright 2025, 2026, 2027 Luca Liguori.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License. *
+ */
+/**
+ * Decode a Matter Certification Declaration (CD) without external deps.
+ *
+ * Works on:
+ *  • raw DER   (Buffer or Uint8Array)
+ *  • base-64   string
+ *  • hex       string            (whitespace / “0x” are tolerated)
+ *
+ * Returns only the TLV payload.  Does **NOT** verify the CMS signature.
+ *
+ * Connectivity Standards Alliance — Matter 1.4, § 6.3
+ * --------------------------------------------------------------------
+ */
+/**
+ * Decode a Matter Certification-Declaration (CMS Signed-Data → TLV payload)
+ * without external dependencies.
+ *
+ * © 2025 Luca Liguori – Apache-2.0
+ */
+export interface CertificationDeclaration {
+    formatVersion: number;
+    vendorId: number;
+    productIds: number[];
+    deviceTypeId: number;
+    certificateId: string;
+    securityLevel: number;
+    securityInformation: number;
+    versionNumber: number;
+    certificationType: number;
+    dacOriginVid?: number;
+    dacOriginPid?: number;
+    authorizedPaaList?: string[];
+}
+/**
+ * Parse the Matter-TLV payload according to spec §6.3.
+ *
+ * @param {Buffer} tlv - The TLV payload to decode.
+ * @param {boolean} [debug] - Enable debug output.
+ * @returns {CertificationDeclaration} The decoded Certification Declaration.
+ */
+export declare function decodeCdTlv(tlv: Buffer, debug?: boolean): CertificationDeclaration;
+/**
+ * Decode a Matter Certification-Declaration.
+ *
+ * @param {Buffer | Uint8Array | string} src - The source data to decode.
+ * @param {boolean} [debug] - Enable debug output.
+ * @returns {CertificationDeclaration} The decoded Certification Declaration.
+ */
+export declare function decodeCertificationDeclaration(src: Buffer | Uint8Array | string, debug?: boolean): CertificationDeclaration;
+//# sourceMappingURL=declarationDecoder.d.ts.map

package/dist/crypto/declarationDecoder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"declarationDecoder.d.ts","sourceRoot":"","sources":["../../src/crypto/declarationDecoder.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAyEH;;;;;;;;;;;;GAYG;AAKH;;;;;GAKG;AAEH,MAAM,WAAW,wBAAwB;IACvC,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC9B;AA6ED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,UAAQ,GAAG,wBAAwB,CA6GhF;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,EAAE,KAAK,UAAQ,GAAG,wBAAwB,CAUzH"}