@zwave-js/cc 10.0.0-beta.1 → 10.0.0-beta.11

package/build/cc/Security2CC.js

@@ -9,8 +9,9 @@ var Security2CC_1;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Security2CCCommandsSupportedGet = exports.Security2CCCommandsSupportedReport = exports.Security2CCTransferEnd = exports.Security2CCNetworkKeyVerify = exports.Security2CCNetworkKeyGet = exports.Security2CCNetworkKeyReport = exports.Security2CCPublicKeyReport = exports.Security2CCKEXFail = exports.Security2CCKEXSet = exports.Security2CCKEXGet = exports.Security2CCKEXReport = exports.Security2CCNonceGet = exports.Security2CCNonceReport = exports.Security2CCMessageEncapsulation = exports.Security2CC = exports.Security2CCAPI = void 0;
 const core_1 = require("@zwave-js/core");
-const serial_1 = require("@zwave-js/serial");
-const safe_1 = require("@zwave-js/shared/safe");
+const safe_1 = require("@zwave-js/core/safe");
+const safe_2 = require("@zwave-js/shared/safe");
+const async_1 = require("alcalzone-shared/async");
 const API_1 = require("../lib/API");
 const CommandClass_1 = require("../lib/CommandClass");
 const CommandClassDecorators_1 = require("../lib/CommandClassDecorators");
@@ -36,15 +37,14 @@ function getAuthenticationData(sendingNodeId, destination, homeId, commandLength
     unencryptedPayload.copy(ret, 8, 0);
     return ret;
 }
-/** Validates that a sequence number is not a duplicate and updates the SPAN table if it is accepted */
+/** Validates that a sequence number is not a duplicate and updates the SPAN table if it is accepted. Returns the previous sequence number if there is one. */
 function validateSequenceNumber(sequenceNumber) {
-    const peerNodeID = this.nodeId;
-    core_1.validatePayload.withReason("Duplicate command")(!this.host.securityManager2.isDuplicateSinglecast(peerNodeID, sequenceNumber));
+    core_1.validatePayload.withReason("Duplicate command")(!this.host.securityManager2.isDuplicateSinglecast(this.nodeId, sequenceNumber));
     // Not a duplicate, store it
-    this.host.securityManager2.storeSequenceNumber(peerNodeID, sequenceNumber);
+    return this.host.securityManager2.storeSequenceNumber(this.nodeId, sequenceNumber);
 }
 function assertSecurity(options) {
-    const verb = (0, serial_1.gotDeserializationOptions)(options) ? "decoded" : "sent";
+    const verb = (0, CommandClass_1.gotDeserializationOptions)(options) ? "decoded" : "sent";
     if (!this.host.ownNodeId) {
         throw new core_1.ZWaveError(`Secure commands (S2) can only be ${verb} when the controller's node id is known!`, core_1.ZWaveErrorCodes.Driver_NotReady);
     }
@@ -137,7 +137,7 @@ let Security2CCAPI = class Security2CCAPI extends API_1.CCAPI {
         });
         const response = await this.applHost.sendCommand(cc, this.commandOptions);
         if (response) {
-            return (0, safe_1.pick)(response, [
+            return (0, safe_2.pick)(response, [
                 "requestCSA",
                 "echo",
                 "supportedKEXSchemes",
@@ -224,7 +224,7 @@ let Security2CC = Security2CC_1 = class Security2CC extends CommandClass_1.Comma
         const api = API_1.CCAPI.create(core_1.CommandClasses["Security 2"], applHost, endpoint).withOptions({
             priority: core_1.MessagePriority.NodeQuery,
         });
-        // Only on the highest security class the reponse includes the supported commands
+        // Only on the highest security class the response includes the supported commands
         const secClass = node.getHighestSecurityClass();
         let hasReceivedSecureCommands = false;
         let possibleSecurityClasses;
@@ -263,54 +263,85 @@ let Security2CC = Security2CC_1 = class Security2CC extends CommandClass_1.Comma
             if (!this.host.securityManager2?.hasKeysForSecurityClass(secClass)) {
                 applHost.controllerLog.logNode(node.id, {
                     endpoint: endpoint.index,
-                    message: `Cannot query securely supported commands (${(0, safe_1.getEnumMemberName)(core_1.SecurityClass, secClass)}) - network key is not configured...`,
+                    message: `Cannot query securely supported commands (${(0, safe_2.getEnumMemberName)(core_1.SecurityClass, secClass)}) - network key is not configured...`,
                     level: "warn",
                 });
                 continue;
             }
             applHost.controllerLog.logNode(node.id, {
                 endpoint: endpoint.index,
-                message: `Querying securely supported commands (${(0, safe_1.getEnumMemberName)(core_1.SecurityClass, secClass)})...`,
+                message: `Querying securely supported commands (${(0, safe_2.getEnumMemberName)(core_1.SecurityClass, secClass)})...`,
                 direction: "outbound",
             });
             // Query the supported commands but avoid remembering the wrong security class in case of a failure
             let supportedCCs;
-            try {
-                supportedCCs = await api.getSupportedCommands(secClass);
-            }
-            catch (e) {
-                if ((0, core_1.isZWaveError)(e) &&
-                    e.code === core_1.ZWaveErrorCodes.Security2CC_CannotDecode) {
-                    // This has to be expected when we're using a non-granted security class
-                    supportedCCs = undefined;
+            // Try up to 3 times. We REALLY don't want a spurious timeout or collision to cause us to discard a known good security class
+            for (let attempts = 1; attempts <= 3; attempts++) {
+                try {
+                    supportedCCs = await api.getSupportedCommands(secClass);
+                }
+                catch (e) {
+                    if ((0, core_1.isZWaveError)(e) &&
+                        e.code === core_1.ZWaveErrorCodes.Security2CC_CannotDecode) {
+                        // Either we were using a non-granted security class,
+                        // or querying with the known highest security class had an issue
+                        supportedCCs = undefined;
+                    }
+                    else {
+                        throw e;
+                    }
+                }
+                if (supportedCCs == undefined &&
+                    possibleSecurityClasses.length === 1) {
+                    if (attempts < 3) {
+                        // We definitely know the highest security class
+                        applHost.controllerLog.logNode(node.id, {
+                            endpoint: endpoint.index,
+                            message: `Querying securely supported commands (${(0, safe_2.getEnumMemberName)(core_1.SecurityClass, secClass)}), attempt ${attempts}/3 failed. Retrying in 500ms...`,
+                            level: "warn",
+                        });
+                        await (0, async_1.wait)(500);
+                        continue;
+                    }
+                    else {
+                        applHost.controllerLog.logNode(node.id, {
+                            endpoint: endpoint.index,
+                            message: `Querying securely supported commands (${(0, safe_2.getEnumMemberName)(core_1.SecurityClass, secClass)}) failed. Let's hope for the best...`,
+                            level: "warn",
+                        });
+                        break;
+                    }
                 }
                 else {
-                    throw e;
+                    // In any other case, we can stop trying
+                    break;
                 }
             }
             if (supportedCCs == undefined) {
-                if (endpoint.index === 0) {
+                if (endpoint.index === 0 &&
+                    possibleSecurityClasses.length > 1) {
                     // No supported commands found, mark the security class as not granted
+                    // unless we were sure about the security class
                     node.setSecurityClass(secClass, false);
                     applHost.controllerLog.logNode(node.id, {
-                        message: `The node was NOT granted the security class ${(0, safe_1.getEnumMemberName)(core_1.SecurityClass, secClass)}`,
+                        message: `The node was NOT granted the security class ${(0, safe_2.getEnumMemberName)(core_1.SecurityClass, secClass)}`,
                         direction: "inbound",
                     });
                 }
                 continue;
             }
-            if (endpoint.index === 0) {
-                // Mark the security class as granted
+            if (endpoint.index === 0 && possibleSecurityClasses.length > 1) {
+                // Mark the security class as granted unless we were sure about the security class
                 node.setSecurityClass(secClass, true);
                 applHost.controllerLog.logNode(node.id, {
-                    message: `The node was granted the security class ${(0, safe_1.getEnumMemberName)(core_1.SecurityClass, secClass)}`,
+                    message: `The node was granted the security class ${(0, safe_2.getEnumMemberName)(core_1.SecurityClass, secClass)}`,
                     direction: "inbound",
                 });
             }
             if (!hasReceivedSecureCommands && supportedCCs.length > 0) {
                 hasReceivedSecureCommands = true;
                 const logLines = [
-                    `received secure commands (${(0, safe_1.getEnumMemberName)(core_1.SecurityClass, secClass)})`,
+                    `received secure commands (${(0, safe_2.getEnumMemberName)(core_1.SecurityClass, secClass)})`,
                     "supported CCs:",
                 ];
                 for (const cc of supportedCCs) {
@@ -336,8 +367,9 @@ let Security2CC = Security2CC_1 = class Security2CC extends CommandClass_1.Comma
     /** Tests if a command should be sent secure and thus requires encapsulation */
     static requiresEncapsulation(cc) {
         // Everything that's not an S2 CC needs to be encapsulated if the CC is secure
-        if (!cc.secure)
+        if (!(cc.encapsulationFlags & safe_1.EncapsulationFlags.Security)) {
             return false;
+        }
         if (!(cc instanceof Security2CC_1))
             return true;
         // These S2 commands need additional encapsulation
@@ -369,11 +401,16 @@ let Security2CC = Security2CC_1 = class Security2CC extends CommandClass_1.Comma
     }
     /** Encapsulates a command that should be sent encrypted */
     static encapsulate(host, cc, securityClass) {
-        return new Security2CCMessageEncapsulation(host, {
+        const ret = new Security2CCMessageEncapsulation(host, {
             nodeId: cc.nodeId,
             encapsulated: cc,
             securityClass,
         });
+        // Copy the encapsulation flags from the encapsulated command
+        // but omit Security, since we're doing that right now
+        ret.encapsulationFlags =
+            cc.encapsulationFlags & ~safe_1.EncapsulationFlags.Security;
+        return ret;
     }
 };
 Security2CC = Security2CC_1 = __decorate([
@@ -403,18 +440,18 @@ let Security2CCMessageEncapsulation = class Security2CCMessageEncapsulation exte
         super(host, options);
         // Make sure that we can send/receive secure commands
         assertSecurity.call(this, options);
-        if ((0, serial_1.gotDeserializationOptions)(options)) {
+        if ((0, CommandClass_1.gotDeserializationOptions)(options)) {
             (0, core_1.validatePayload)(this.payload.length >= 2);
             // Check the sequence number to avoid duplicates
             // TODO: distinguish between multicast and singlecast
             this._sequenceNumber = this.payload[0];
+            const sendingNodeId = this.nodeId;
             // Don't accept duplicate commands
-            validateSequenceNumber.call(this, this._sequenceNumber);
+            const prevSequenceNumber = validateSequenceNumber.call(this, this._sequenceNumber);
             // Ensure the node has a security class
-            const peerNodeID = this.nodeId;
             // const node = this.getNode()!;
             // validatePayload.withReason("The node is not included")(!!node);
-            const securityClass = this.host.getHighestSecurityClass(peerNodeID);
+            const securityClass = this.host.getHighestSecurityClass(sendingNodeId);
             core_1.validatePayload.withReason("No security class granted")(securityClass !== core_1.SecurityClass.None);
             const hasExtensions = !!(this.payload[1] & 0b1);
             const hasEncryptedExtensions = !!(this.payload[1] & 0b10);
@@ -440,9 +477,9 @@ let Security2CCMessageEncapsulation = class Security2CCMessageEncapsulation exte
             const ciphertext = this.payload.slice(offset, -core_1.SECURITY_S2_AUTH_TAG_LENGTH);
             const authTag = this.payload.slice(-core_1.SECURITY_S2_AUTH_TAG_LENGTH);
             const messageLength = super.computeEncapsulationOverhead() + this.payload.length;
-            const authData = getAuthenticationData(this.nodeId, this.getDestinationIDRX(), this.host.homeId, messageLength, unencryptedPayload);
+            const authData = getAuthenticationData(sendingNodeId, this.getDestinationIDRX(), this.host.homeId, messageLength, unencryptedPayload);
             // Decrypt payload and verify integrity
-            const spanState = this.host.securityManager2.getSPANState(peerNodeID);
+            const spanState = this.host.securityManager2.getSPANState(sendingNodeId);
             const failNoSPAN = () => {
                 return core_1.validatePayload.fail(core_1.ZWaveErrorCodes.Security2CC_NoSPAN);
             };
@@ -456,15 +493,43 @@ let Security2CCMessageEncapsulation = class Security2CCMessageEncapsulation exte
                 return failNoSPAN();
             }
             const decrypt = () => {
-                const getNonceAndDecrypt = () => {
-                    const iv = this.host.securityManager2.nextNonce(peerNodeID);
-                    const { keyCCM: key } = this.host.securityManager2.getKeysForNode(peerNodeID);
+                const decryptWithNonce = (nonce) => {
+                    const { keyCCM: key } = this.host.securityManager2.getKeysForNode(sendingNodeId);
+                    const iv = nonce;
                     return {
-                        decryptionKey: key,
+                        key,
+                        iv,
                         ...(0, core_1.decryptAES128CCM)(key, iv, ciphertext, authData, authTag),
                     };
                 };
+                const getNonceAndDecrypt = () => {
+                    const iv = this.host.securityManager2.nextNonce(sendingNodeId);
+                    return decryptWithNonce(iv);
+                };
                 if (spanState.type === core_1.SPANState.SPAN) {
+                    // There SHOULD be a shared SPAN between both parties. But experience has shown that both could have
+                    // sent a command at roughly the same time, using the same SPAN for encryption.
+                    // To avoid a nasty desync and both nodes trying to resync at the same time, causing message loss,
+                    // we accept commands encrypted with the previous SPAN under very specific circumstances:
+                    if (
+                    // The previous SPAN is still known, i.e. the node didn't send another command that was successfully decrypted
+                    !!spanState.currentSPAN &&
+                        // it is still valid
+                        spanState.currentSPAN.expires > (0, core_1.highResTimestamp)() &&
+                        // The received command is exactly the next, expected one
+                        prevSequenceNumber != undefined &&
+                        this._sequenceNumber ===
+                            ((prevSequenceNumber + 1) & 0xff) &&
+                        // And in case of a mock-based test, do this only on the controller
+                        !this.host.__internalIsMockNode) {
+                        const nonce = spanState.currentSPAN.nonce;
+                        spanState.currentSPAN = undefined;
+                        return decryptWithNonce(nonce);
+                    }
+                    else {
+                        // forgetting the current SPAN shouldn't be necessary but better be safe than sorry
+                        spanState.currentSPAN = undefined;
+                    }
                     // This can only happen if the security class is known
                     return getNonceAndDecrypt();
                 }
@@ -476,18 +541,18 @@ let Security2CCMessageEncapsulation = class Security2CCMessageEncapsulation exte
                         return failNoSPAN();
                     const receiverEI = spanState.receiverEI;
                     // How we do this depends on whether we know the security class of the other node
-                    if (this.host.securityManager2.tempKeys.has(peerNodeID)) {
+                    if (this.host.securityManager2.tempKeys.has(sendingNodeId)) {
                         // We're currently bootstrapping the node, it might be using a temporary key
-                        this.host.securityManager2.initializeTempSPAN(peerNodeID, senderEI, receiverEI);
+                        this.host.securityManager2.initializeTempSPAN(sendingNodeId, senderEI, receiverEI);
                         const ret = getNonceAndDecrypt();
                         // Decryption with the temporary key worked
                         if (ret.authOK)
                             return ret;
                         // Reset the SPAN state and try with the recently granted security class
-                        this.host.securityManager2.setSPANState(peerNodeID, spanState);
+                        this.host.securityManager2.setSPANState(sendingNodeId, spanState);
                     }
                     if (securityClass != undefined) {
-                        this.host.securityManager2.initializeSPAN(peerNodeID, securityClass, senderEI, receiverEI);
+                        this.host.securityManager2.initializeSPAN(sendingNodeId, securityClass, senderEI, receiverEI);
                         return getNonceAndDecrypt();
                     }
                     else {
@@ -495,18 +560,18 @@ let Security2CCMessageEncapsulation = class Security2CCMessageEncapsulation exte
                         // Try multiple security classes
                         const possibleSecurityClasses = core_1.securityClassOrder
                             .filter((s) => (0, core_1.securityClassIsS2)(s))
-                            .filter((s) => this.host.hasSecurityClass(peerNodeID, s) !== false);
+                            .filter((s) => this.host.hasSecurityClass(sendingNodeId, s) !== false);
                         for (const secClass of possibleSecurityClasses) {
                             // Initialize an SPAN with that security class
-                            this.host.securityManager2.initializeSPAN(peerNodeID, secClass, senderEI, receiverEI);
+                            this.host.securityManager2.initializeSPAN(sendingNodeId, secClass, senderEI, receiverEI);
                             const ret = getNonceAndDecrypt();
                             // It worked, return the result and remember the security class
                             if (ret.authOK) {
-                                this.host.setSecurityClass(peerNodeID, secClass, true);
+                                this.host.setSecurityClass(sendingNodeId, secClass, true);
                                 return ret;
                             }
                             // Reset the SPAN state and try with the next security class
-                            this.host.securityManager2.setSPANState(peerNodeID, spanState);
+                            this.host.securityManager2.setSPANState(sendingNodeId, spanState);
                         }
                     }
                 }
@@ -515,12 +580,13 @@ let Security2CCMessageEncapsulation = class Security2CCMessageEncapsulation exte
             };
             let plaintext;
             let authOK = false;
-            let decryptionKey;
+            let key;
+            let iv;
             // If the Receiver is unable to authenticate the singlecast message with the current SPAN,
             // the Receiver SHOULD try decrypting the message with one or more of the following SPAN values,
             // stopping when decryption is successful or the maximum number of iterations is reached.
             for (let i = 0; i < DECRYPT_ATTEMPTS; i++) {
-                ({ plaintext, authOK, decryptionKey } = decrypt());
+                ({ plaintext, authOK, key, iv } = decrypt());
                 if (!!authOK && !!plaintext)
                     break;
             }
@@ -544,7 +610,8 @@ let Security2CCMessageEncapsulation = class Security2CCMessageEncapsulation exte
                     encapCC: this,
                 });
             }
-            this.decryptionKey = decryptionKey;
+            this.key = key;
+            this.iv = iv;
         }
         else {
             this._securityClass = options.securityClass;
@@ -594,9 +661,9 @@ let Security2CCMessageEncapsulation = class Security2CCMessageEncapsulation exte
     }
     serialize() {
         // TODO: Support Multicast
-        const nodeId = this.nodeId;
         // Include Sender EI in the command if we only have the receiver's EI
-        const spanState = this.host.securityManager2.getSPANState(nodeId);
+        const receiverNodeId = this.getDestinationIDTX();
+        const spanState = this.host.securityManager2.getSPANState(receiverNodeId);
         if (spanState.type === core_1.SPANState.None ||
             spanState.type === core_1.SPANState.LocalEI) {
             // Can't do anything here if we don't have the receiver's EI
@@ -609,16 +676,16 @@ let Security2CCMessageEncapsulation = class Security2CCMessageEncapsulation exte
             const receiverEI = spanState.receiverEI;
             // While bootstrapping a node, the controller only sends commands encrypted
             // with the temporary key
-            if (this.host.securityManager2.tempKeys.has(nodeId)) {
-                this.host.securityManager2.initializeTempSPAN(nodeId, senderEI, receiverEI);
+            if (this.host.securityManager2.tempKeys.has(receiverNodeId)) {
+                this.host.securityManager2.initializeTempSPAN(receiverNodeId, senderEI, receiverEI);
             }
             else {
                 const securityClass = this._securityClass ??
-                    this.host.getHighestSecurityClass(nodeId);
+                    this.host.getHighestSecurityClass(receiverNodeId);
                 if (securityClass == undefined) {
                     throw new core_1.ZWaveError("No security class defined for this command!", core_1.ZWaveErrorCodes.Security2CC_NoSPAN);
                 }
-                this.host.securityManager2.initializeSPAN(nodeId, securityClass, senderEI, receiverEI);
+                this.host.securityManager2.initializeSPAN(receiverNodeId, securityClass, senderEI, receiverEI);
             }
             // Add or update the SPAN extension
             let spanExtension = this.extensions.find((e) => e instanceof Extension_1.SPANExtension);
@@ -647,14 +714,19 @@ let Security2CCMessageEncapsulation = class Security2CCMessageEncapsulation exte
         ]);
         // Generate the authentication data for CCM encryption
         const messageLength = this.computeEncapsulationOverhead() + serializedCC.length;
-        const authData = getAuthenticationData(this.host.ownNodeId, this.getDestinationIDTX(), this.host.homeId, messageLength, unencryptedPayload);
-        const iv = this.host.securityManager2.nextNonce(nodeId);
+        const authData = getAuthenticationData(this.host.ownNodeId, receiverNodeId, this.host.homeId, messageLength, unencryptedPayload);
+        // Generate a nonce for encryption, and remember it to attempt decryption
+        // of potential in-flight messages from the target node.
+        const iv = this.host.securityManager2.nextNonce(receiverNodeId, true);
         const { keyCCM: key } = 
         // Prefer the overridden security class if it was given
         this._securityClass != undefined
             ? this.host.securityManager2.getKeysForSecurityClass(this._securityClass)
-            : this.host.securityManager2.getKeysForNode(nodeId);
+            : this.host.securityManager2.getKeysForNode(receiverNodeId);
         const { ciphertext: ciphertextPayload, authTag } = (0, core_1.encryptAES128CCM)(key, iv, plaintextPayload, authData, core_1.SECURITY_S2_AUTH_TAG_LENGTH);
+        // Remember key and IV for debugging purposes
+        this.key = key;
+        this.iv = iv;
         this.payload = Buffer.concat([
             unencryptedPayload,
             ciphertextPayload,
@@ -685,6 +757,15 @@ let Security2CCMessageEncapsulation = class Security2CCMessageEncapsulation exte
                 .map((e) => e.toLogEntry())
                 .join("");
         }
+        // Log the used keys in integration tests
+        if (process.env.NODE_ENV === "test") {
+            if (this.key) {
+                message.key = (0, safe_2.buffer2hex)(this.key);
+            }
+            if (this.iv) {
+                message.IV = (0, safe_2.buffer2hex)(this.iv);
+            }
+        }
         return {
             ...super.toLogEntry(applHost),
             message,
@@ -701,7 +782,7 @@ let Security2CCNonceReport = class Security2CCNonceReport extends Security2CC {
         super(host, options);
         // Make sure that we can send/receive secure commands
         assertSecurity.call(this, options);
-        if ((0, serial_1.gotDeserializationOptions)(options)) {
+        if ((0, CommandClass_1.gotDeserializationOptions)(options)) {
             (0, core_1.validatePayload)(this.payload.length >= 2);
             this._sequenceNumber = this.payload[0];
             // Don't accept duplicate commands
@@ -755,7 +836,7 @@ let Security2CCNonceReport = class Security2CCNonceReport extends Security2CC {
             MOS: this.MOS,
         };
         if (this.receiverEI) {
-            message["receiver entropy"] = (0, safe_1.buffer2hex)(this.receiverEI);
+            message["receiver entropy"] = (0, safe_2.buffer2hex)(this.receiverEI);
         }
         return {
             ...super.toLogEntry(applHost),
@@ -772,7 +853,7 @@ let Security2CCNonceGet = class Security2CCNonceGet extends Security2CC {
         super(host, options);
         // Make sure that we can send/receive secure commands
         assertSecurity.call(this, options);
-        if ((0, serial_1.gotDeserializationOptions)(options)) {
+        if ((0, CommandClass_1.gotDeserializationOptions)(options)) {
             (0, core_1.validatePayload)(this.payload.length >= 1);
             this._sequenceNumber = this.payload[0];
             // Don't accept duplicate commands
@@ -814,7 +895,7 @@ exports.Security2CCNonceGet = Security2CCNonceGet;
 let Security2CCKEXReport = class Security2CCKEXReport extends Security2CC {
     constructor(host, options) {
         super(host, options);
-        if ((0, serial_1.gotDeserializationOptions)(options)) {
+        if ((0, CommandClass_1.gotDeserializationOptions)(options)) {
             (0, core_1.validatePayload)(this.payload.length >= 4);
             this.requestCSA = !!(this.payload[0] & 0b10);
             this.echo = !!(this.payload[0] & 0b1);
@@ -847,14 +928,14 @@ let Security2CCKEXReport = class Security2CCKEXReport extends Security2CC {
             message: {
                 echo: this.echo,
                 "supported schemes": this.supportedKEXSchemes
-                    .map((s) => `\n· ${(0, safe_1.getEnumMemberName)(shared_1.KEXSchemes, s)}`)
+                    .map((s) => `\n· ${(0, safe_2.getEnumMemberName)(shared_1.KEXSchemes, s)}`)
                     .join(""),
                 "supported ECDH profiles": this.supportedECDHProfiles
-                    .map((s) => `\n· ${(0, safe_1.getEnumMemberName)(shared_1.ECDHProfiles, s)}`)
+                    .map((s) => `\n· ${(0, safe_2.getEnumMemberName)(shared_1.ECDHProfiles, s)}`)
                     .join(""),
                 "CSA requested": this.requestCSA,
                 "requested security classes": this.requestedKeys
-                    .map((s) => `\n· ${(0, safe_1.getEnumMemberName)(core_1.SecurityClass, s)}`)
+                    .map((s) => `\n· ${(0, safe_2.getEnumMemberName)(core_1.SecurityClass, s)}`)
                     .join(""),
             },
         };
@@ -874,7 +955,7 @@ exports.Security2CCKEXGet = Security2CCKEXGet;
 let Security2CCKEXSet = class Security2CCKEXSet extends Security2CC {
     constructor(host, options) {
         super(host, options);
-        if ((0, serial_1.gotDeserializationOptions)(options)) {
+        if ((0, CommandClass_1.gotDeserializationOptions)(options)) {
             (0, core_1.validatePayload)(this.payload.length >= 4);
             this.permitCSA = !!(this.payload[0] & 0b10);
             this.echo = !!(this.payload[0] & 0b1);
@@ -910,11 +991,11 @@ let Security2CCKEXSet = class Security2CCKEXSet extends Security2CC {
             ...super.toLogEntry(applHost),
             message: {
                 echo: this.echo,
-                "selected scheme": (0, safe_1.getEnumMemberName)(shared_1.KEXSchemes, this.selectedKEXScheme),
-                "selected ECDH profile": (0, safe_1.getEnumMemberName)(shared_1.ECDHProfiles, this.selectedECDHProfile),
+                "selected scheme": (0, safe_2.getEnumMemberName)(shared_1.KEXSchemes, this.selectedKEXScheme),
+                "selected ECDH profile": (0, safe_2.getEnumMemberName)(shared_1.ECDHProfiles, this.selectedECDHProfile),
                 "CSA permitted": this.permitCSA,
                 "granted security classes": this.grantedKeys
-                    .map((s) => `\n· ${(0, safe_1.getEnumMemberName)(core_1.SecurityClass, s)}`)
+                    .map((s) => `\n· ${(0, safe_2.getEnumMemberName)(core_1.SecurityClass, s)}`)
                     .join(""),
             },
         };
@@ -927,7 +1008,7 @@ exports.Security2CCKEXSet = Security2CCKEXSet;
 let Security2CCKEXFail = class Security2CCKEXFail extends Security2CC {
     constructor(host, options) {
         super(host, options);
-        if ((0, serial_1.gotDeserializationOptions)(options)) {
+        if ((0, CommandClass_1.gotDeserializationOptions)(options)) {
             (0, core_1.validatePayload)(this.payload.length >= 1);
             this.failType = this.payload[0];
         }
@@ -942,7 +1023,7 @@ let Security2CCKEXFail = class Security2CCKEXFail extends Security2CC {
     toLogEntry(applHost) {
         return {
             ...super.toLogEntry(applHost),
-            message: { reason: (0, safe_1.getEnumMemberName)(shared_1.KEXFailType, this.failType) },
+            message: { reason: (0, safe_2.getEnumMemberName)(shared_1.KEXFailType, this.failType) },
         };
     }
 };
@@ -953,7 +1034,7 @@ exports.Security2CCKEXFail = Security2CCKEXFail;
 let Security2CCPublicKeyReport = class Security2CCPublicKeyReport extends Security2CC {
     constructor(host, options) {
         super(host, options);
-        if ((0, serial_1.gotDeserializationOptions)(options)) {
+        if ((0, CommandClass_1.gotDeserializationOptions)(options)) {
             (0, core_1.validatePayload)(this.payload.length >= 17);
             this.includingNode = !!(this.payload[0] & 0b1);
             this.publicKey = this.payload.slice(1);
@@ -975,7 +1056,7 @@ let Security2CCPublicKeyReport = class Security2CCPublicKeyReport extends Securi
             ...super.toLogEntry(applHost),
             message: {
                 "is including node": this.includingNode,
-                "public key": (0, safe_1.buffer2hex)(this.publicKey),
+                "public key": (0, safe_2.buffer2hex)(this.publicKey),
             },
         };
     }
@@ -987,7 +1068,7 @@ exports.Security2CCPublicKeyReport = Security2CCPublicKeyReport;
 let Security2CCNetworkKeyReport = class Security2CCNetworkKeyReport extends Security2CC {
     constructor(host, options) {
         super(host, options);
-        if ((0, serial_1.gotDeserializationOptions)(options)) {
+        if ((0, CommandClass_1.gotDeserializationOptions)(options)) {
             // TODO: Deserialize payload
             throw new core_1.ZWaveError(`${this.constructor.name}: deserialization not implemented`, core_1.ZWaveErrorCodes.Deserialization_NotImplemented);
         }
@@ -1007,7 +1088,7 @@ let Security2CCNetworkKeyReport = class Security2CCNetworkKeyReport extends Secu
         return {
             ...super.toLogEntry(applHost),
             message: {
-                "security class": (0, safe_1.getEnumMemberName)(core_1.SecurityClass, this.grantedKey),
+                "security class": (0, safe_2.getEnumMemberName)(core_1.SecurityClass, this.grantedKey),
                 // This shouldn't be logged, so users can safely post their logs online
                 // "network key": buffer2hex(this.networkKey),
             },
@@ -1021,7 +1102,7 @@ exports.Security2CCNetworkKeyReport = Security2CCNetworkKeyReport;
 let Security2CCNetworkKeyGet = class Security2CCNetworkKeyGet extends Security2CC {
     constructor(host, options) {
         super(host, options);
-        if ((0, serial_1.gotDeserializationOptions)(options)) {
+        if ((0, CommandClass_1.gotDeserializationOptions)(options)) {
             (0, core_1.validatePayload)(this.payload.length >= 1);
             this.requestedKey = bitMaskToSecurityClass(this.payload, 0);
         }
@@ -1037,7 +1118,7 @@ let Security2CCNetworkKeyGet = class Security2CCNetworkKeyGet extends Security2C
         return {
             ...super.toLogEntry(applHost),
             message: {
-                "security class": (0, safe_1.getEnumMemberName)(core_1.SecurityClass, this.requestedKey),
+                "security class": (0, safe_2.getEnumMemberName)(core_1.SecurityClass, this.requestedKey),
             },
         };
     }
@@ -1056,7 +1137,7 @@ exports.Security2CCNetworkKeyVerify = Security2CCNetworkKeyVerify;
 let Security2CCTransferEnd = class Security2CCTransferEnd extends Security2CC {
     constructor(host, options) {
         super(host, options);
-        if ((0, serial_1.gotDeserializationOptions)(options)) {
+        if ((0, CommandClass_1.gotDeserializationOptions)(options)) {
             (0, core_1.validatePayload)(this.payload.length >= 1);
             this.keyVerified = !!(this.payload[0] & 0b10);
             this.keyRequestComplete = !!(this.payload[0] & 0b1);