@zwave-js/cc 13.10.1 → 14.0.0-beta.0

package/build/cc/Security2CC.js

@@ -5,7 +5,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
     else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var Security2CC_1;
+var Security2CC_1, Security2CCMessageEncapsulation_1, Security2CCNonceReport_1, Security2CCNonceGet_1, Security2CCKEXReport_1, Security2CCKEXSet_1, Security2CCKEXFail_1, Security2CCPublicKeyReport_1, Security2CCNetworkKeyReport_1, Security2CCNetworkKeyGet_1, Security2CCTransferEnd_1, Security2CCCommandsSupportedReport_1;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Security2CCCommandsSupportedGet = exports.Security2CCCommandsSupportedReport = exports.Security2CCTransferEnd = exports.Security2CCNetworkKeyVerify = exports.Security2CCNetworkKeyGet = exports.Security2CCNetworkKeyReport = exports.Security2CCPublicKeyReport = exports.Security2CCKEXFail = exports.Security2CCKEXSet = exports.Security2CCKEXGet = exports.Security2CCKEXReport = exports.Security2CCNonceGet = exports.Security2CCNonceReport = exports.Security2CCMessageEncapsulation = exports.Security2CC = exports.Security2CCAPI = void 0;
 const core_1 = require("@zwave-js/core");
@@ -49,32 +49,201 @@ function getAuthenticationData(sendingNodeId, destination, homeId, commandLength
     unencryptedPayload.copy(ret, offset, 0);
     return ret;
 }
-function getSecurityManager(host, destination) {
-    const longRange = (0, core_1.isLongRangeNodeId)(host.ownNodeId)
-        || (0, core_1.isLongRangeNodeId)((0, typeguards_1.isArray)(destination) ? destination[0] : destination);
+function getSecurityManager(ownNodeId, securityManagers, otherNodeId) {
+    const longRange = (0, core_1.isLongRangeNodeId)(ownNodeId)
+        || (0, core_1.isLongRangeNodeId)((0, typeguards_1.isArray)(otherNodeId) ? otherNodeId[0] : otherNodeId);
     return longRange
-        ? host.securityManagerLR
-        : host.securityManager2;
+        ? securityManagers.securityManagerLR
+        : securityManagers.securityManager2;
 }
 /** Validates that a sequence number is not a duplicate and updates the SPAN table if it is accepted. Returns the previous sequence number if there is one. */
-function validateSequenceNumber(sequenceNumber) {
-    const securityManager = getSecurityManager(this.host, this.nodeId);
-    core_1.validatePayload.withReason(`Duplicate command (sequence number ${sequenceNumber})`)(!securityManager.isDuplicateSinglecast(this.nodeId, sequenceNumber));
+function validateSequenceNumber(securityManager, sourceNodeId, sequenceNumber) {
+    core_1.validatePayload.withReason(`Duplicate command (sequence number ${sequenceNumber})`)(!securityManager.isDuplicateSinglecast(sourceNodeId, sequenceNumber));
     // Not a duplicate, store it
-    return securityManager.storeSequenceNumber(this.nodeId, sequenceNumber);
-}
-function assertSecurity(options) {
-    const verb = (0, CommandClass_1.gotDeserializationOptions)(options) ? "decoded" : "sent";
-    if (!this.host.ownNodeId) {
-        throw new core_1.ZWaveError(`Secure commands (S2) can only be ${verb} when the controller's node id is known!`, core_1.ZWaveErrorCodes.Driver_NotReady);
-    }
-    else if (!getSecurityManager(this.host, this.nodeId)) {
-        throw new core_1.ZWaveError(`Secure commands (S2) can only be ${verb} when the network keys are configured!`, core_1.ZWaveErrorCodes.Driver_NoSecurity);
-    }
+    return securityManager.storeSequenceNumber(sourceNodeId, sequenceNumber);
 }
 const MAX_DECRYPT_ATTEMPTS_SINGLECAST = 5;
 const MAX_DECRYPT_ATTEMPTS_MULTICAST = 5;
 const MAX_DECRYPT_ATTEMPTS_SC_FOLLOWUP = 1;
+function assertSecurityRX(ctx) {
+    if (!ctx.ownNodeId) {
+        throw new core_1.ZWaveError(`Secure commands (S2) can only be decoded when the controller's node id is known!`, core_1.ZWaveErrorCodes.Driver_NotReady);
+    }
+    const ret = getSecurityManager(ctx.ownNodeId, ctx, ctx.sourceNodeId);
+    if (!ret) {
+        throw new core_1.ZWaveError(`Secure commands (S2) can only be decoded when the security manager is set up!`, core_1.ZWaveErrorCodes.Driver_NoSecurity);
+    }
+    return ret;
+}
+function assertSecurityTX(ctx, destination) {
+    if (!ctx.ownNodeId) {
+        throw new core_1.ZWaveError(`Secure commands (S2) can only be sent when the controller's node id is known!`, core_1.ZWaveErrorCodes.Driver_NotReady);
+    }
+    const ret = getSecurityManager(ctx.ownNodeId, ctx, destination);
+    if (!ret) {
+        throw new core_1.ZWaveError(`Secure commands (S2) can only be sent when the security manager is set up!`, core_1.ZWaveErrorCodes.Driver_NoSecurity);
+    }
+    return ret;
+}
+function decryptSinglecast(ctx, securityManager, sendingNodeId, curSequenceNumber, prevSequenceNumber, ciphertext, authData, authTag, spanState, extensions) {
+    const decryptWithNonce = (nonce) => {
+        const { keyCCM: key } = securityManager.getKeysForNode(sendingNodeId);
+        const iv = nonce;
+        return {
+            key,
+            iv,
+            ...(0, core_1.decryptAES128CCM)(key, iv, ciphertext, authData, authTag),
+        };
+    };
+    const getNonceAndDecrypt = () => {
+        const iv = securityManager.nextNonce(sendingNodeId);
+        return decryptWithNonce(iv);
+    };
+    if (spanState.type === core_1.SPANState.SPAN) {
+        // There SHOULD be a shared SPAN between both parties. But experience has shown that both could have
+        // sent a command at roughly the same time, using the same SPAN for encryption.
+        // To avoid a nasty desync and both nodes trying to resync at the same time, causing message loss,
+        // we accept commands encrypted with the previous SPAN under very specific circumstances:
+        if (
+        // The previous SPAN is still known, i.e. the node didn't send another command that was successfully decrypted
+        !!spanState.currentSPAN
+            // it is still valid
+            && spanState.currentSPAN.expires > (0, core_1.highResTimestamp)()
+            // The received command is exactly the next, expected one
+            && prevSequenceNumber != undefined
+            && curSequenceNumber === ((prevSequenceNumber + 1) & 0xff)
+            // And in case of a mock-based test, do this only on the controller
+            && !ctx.__internalIsMockNode) {
+            const nonce = spanState.currentSPAN.nonce;
+            spanState.currentSPAN = undefined;
+            // If we could decrypt this way, we're done...
+            const result = decryptWithNonce(nonce);
+            if (result.authOK) {
+                return {
+                    ...result,
+                    securityClass: spanState.securityClass,
+                };
+            }
+            // ...otherwise, we need to try the normal way
+        }
+        else {
+            // forgetting the current SPAN shouldn't be necessary but better be safe than sorry
+            spanState.currentSPAN = undefined;
+        }
+        // This can only happen if the security class is known
+        return {
+            ...getNonceAndDecrypt(),
+            securityClass: spanState.securityClass,
+        };
+    }
+    else if (spanState.type === core_1.SPANState.LocalEI) {
+        // We've sent the other our receiver's EI and received its sender's EI,
+        // meaning we can now establish an SPAN
+        const senderEI = getSenderEI(extensions);
+        if (!senderEI)
+            failNoSPAN();
+        const receiverEI = spanState.receiverEI;
+        // How we do this depends on whether we know the security class of the other node
+        const isBootstrappingNode = securityManager.tempKeys.has(sendingNodeId);
+        if (isBootstrappingNode) {
+            // We're currently bootstrapping the node, it might be using a temporary key
+            securityManager.initializeTempSPAN(sendingNodeId, senderEI, receiverEI);
+            const ret = getNonceAndDecrypt();
+            // Decryption with the temporary key worked
+            if (ret.authOK) {
+                return {
+                    ...ret,
+                    securityClass: core_1.SecurityClass.Temporary,
+                };
+            }
+            // Reset the SPAN state and try with the recently granted security class
+            securityManager.setSPANState(sendingNodeId, spanState);
+        }
+        // When ending up here, one of two situations has occured:
+        // a) We've taken over an existing network and do not know the node's security class
+        // b) We know the security class, but we're about to establish a new SPAN. This may happen at a lower
+        //    security class than the one the node normally uses, e.g. when we're being queried for securely
+        //    supported CCs.
+        // In both cases, we should simply try decoding with multiple security classes, starting from the highest one.
+        // If this fails, we restore the previous (partial) SPAN state.
+        // Try all security classes where we do not definitely know that it was not granted
+        // While bootstrapping a node, we consider the key that is being exchanged (including S0) to be the highest. No need to look at others
+        const possibleSecurityClasses = isBootstrappingNode
+            ? [ctx.getHighestSecurityClass(sendingNodeId)]
+            : core_1.securityClassOrder.filter((s) => ctx.hasSecurityClass(sendingNodeId, s)
+                !== false);
+        for (const secClass of possibleSecurityClasses) {
+            // Skip security classes we don't have keys for
+            if (!securityManager.hasKeysForSecurityClass(secClass)) {
+                continue;
+            }
+            // Initialize an SPAN with that security class
+            securityManager.initializeSPAN(sendingNodeId, secClass, senderEI, receiverEI);
+            const ret = getNonceAndDecrypt();
+            // It worked, return the result
+            if (ret.authOK) {
+                // Also if we weren't sure before, we now know that the security class is granted
+                if (ctx.hasSecurityClass(sendingNodeId, secClass)
+                    === undefined) {
+                    ctx.setSecurityClass(sendingNodeId, secClass, true);
+                }
+                return {
+                    ...ret,
+                    securityClass: secClass,
+                };
+            }
+            else {
+                // Reset the SPAN state and try with the next security class
+                securityManager.setSPANState(sendingNodeId, spanState);
+            }
+        }
+    }
+    // Nothing worked, fail the decryption
+    return {
+        plaintext: Buffer.from([]),
+        authOK: false,
+        securityClass: undefined,
+    };
+}
+function decryptMulticast(sendingNodeId, securityManager, groupId, ciphertext, authData, authTag) {
+    const iv = securityManager.nextPeerMPAN(sendingNodeId, groupId);
+    const { keyCCM: key } = securityManager.getKeysForNode(sendingNodeId);
+    return {
+        key,
+        iv,
+        ...(0, core_1.decryptAES128CCM)(key, iv, ciphertext, authData, authTag),
+        // The security class is irrelevant when decrypting multicast commands
+        securityClass: undefined,
+    };
+}
+function getDestinationIDTX() {
+    if (this.isSinglecast())
+        return this.nodeId;
+    const ret = getMulticastGroupId(this.extensions);
+    if (ret == undefined) {
+        throw new core_1.ZWaveError("Multicast Security S2 encapsulation requires the MGRP extension", core_1.ZWaveErrorCodes.Security2CC_MissingExtension);
+    }
+    return ret;
+}
+function getDestinationIDRX(ctx, extensions) {
+    if (ctx.frameType === "singlecast") {
+        return ctx.ownNodeId;
+    }
+    const ret = getMulticastGroupId(extensions);
+    if (ret == undefined) {
+        throw new core_1.ZWaveError("Multicast Security S2 encapsulation requires the MGRP extension", core_1.ZWaveErrorCodes.Security2CC_MissingExtension);
+    }
+    return ret;
+}
+function getMulticastGroupId(extensions) {
+    const mgrpExtension = extensions.find((e) => e instanceof Extension_1.MGRPExtension);
+    return mgrpExtension?.groupId;
+}
+/** Returns the Sender's Entropy Input if this command contains an SPAN extension */
+function getSenderEI(extensions) {
+    const spanExtension = extensions.find((e) => e instanceof Extension_1.SPANExtension);
+    return spanExtension?.senderEI;
+}
 // Encapsulation CCs are used internally and too frequently that we
 // want to pay the cost of validating each call
 /* eslint-disable @zwave-js/ccapi-validate-args */
@@ -90,20 +259,20 @@ let Security2CCAPI = class Security2CCAPI extends API_1.CCAPI {
     async sendNonce() {
         this.assertSupportsCommand(_Types_1.Security2Command, _Types_1.Security2Command.NonceReport);
         this.assertPhysicalEndpoint(this.endpoint);
-        const securityManager = getSecurityManager(this.applHost, this.endpoint.nodeId);
+        const securityManager = getSecurityManager(this.host.ownNodeId, this.host, this.endpoint.nodeId);
         if (!securityManager) {
             throw new core_1.ZWaveError(`Nonces can only be sent if secure communication is set up!`, core_1.ZWaveErrorCodes.Driver_NoSecurity);
         }
         const receiverEI = securityManager.generateNonce(this.endpoint.nodeId);
-        const cc = new Security2CCNonceReport(this.applHost, {
+        const cc = new Security2CCNonceReport({
             nodeId: this.endpoint.nodeId,
-            endpoint: this.endpoint.index,
+            endpointIndex: this.endpoint.index,
             SOS: true,
             MOS: false,
             receiverEI,
         });
         try {
-            await this.applHost.sendCommand(cc, {
+            await this.host.sendCommand(cc, {
                 ...this.commandOptions,
                 // Seems we need these options or some nodes won't accept the nonce
                 transmitOptions: core_1.TransmitOptions.ACK
@@ -134,14 +303,14 @@ let Security2CCAPI = class Security2CCAPI extends API_1.CCAPI {
     async sendMOS() {
         this.assertSupportsCommand(_Types_1.Security2Command, _Types_1.Security2Command.NonceReport);
         this.assertPhysicalEndpoint(this.endpoint);
-        const cc = new Security2CCNonceReport(this.applHost, {
+        const cc = new Security2CCNonceReport({
             nodeId: this.endpoint.nodeId,
-            endpoint: this.endpoint.index,
+            endpointIndex: this.endpoint.index,
             SOS: false,
             MOS: true,
         });
         try {
-            await this.applHost.sendCommand(cc, {
+            await this.host.sendCommand(cc, {
                 ...this.commandOptions,
                 // Seems we need these options or some nodes won't accept the nonce
                 transmitOptions: core_1.TransmitOptions.ACK
@@ -169,9 +338,9 @@ let Security2CCAPI = class Security2CCAPI extends API_1.CCAPI {
     async sendMPAN(groupId, innerMPANState) {
         this.assertSupportsCommand(_Types_1.Security2Command, _Types_1.Security2Command.MessageEncapsulation);
         this.assertPhysicalEndpoint(this.endpoint);
-        const cc = new Security2CCMessageEncapsulation(this.applHost, {
+        const cc = new Security2CCMessageEncapsulation({
             nodeId: this.endpoint.nodeId,
-            endpoint: this.endpoint.index,
+            endpointIndex: this.endpoint.index,
             extensions: [
                 new Extension_1.MPANExtension({
                     groupId,
@@ -180,7 +349,7 @@ let Security2CCAPI = class Security2CCAPI extends API_1.CCAPI {
             ],
         });
         try {
-            await this.applHost.sendCommand(cc, {
+            await this.host.sendCommand(cc, {
                 ...this.commandOptions,
                 // Seems we need these options or some nodes won't accept the nonce
                 transmitOptions: core_1.TransmitOptions.ACK
@@ -210,18 +379,21 @@ let Security2CCAPI = class Security2CCAPI extends API_1.CCAPI {
      */
     async getSupportedCommands(securityClass) {
         this.assertSupportsCommand(_Types_1.Security2Command, _Types_1.Security2Command.CommandsSupportedGet);
-        let cc = new Security2CCCommandsSupportedGet(this.applHost, {
+        let cc = new Security2CCCommandsSupportedGet({
             nodeId: this.endpoint.nodeId,
-            endpoint: this.endpoint.index,
+            endpointIndex: this.endpoint.index,
         });
         // Security2CCCommandsSupportedGet is special because we cannot reply on the applHost to do the automatic
         // encapsulation because it would use a different security class. Therefore the entire possible stack
         // of encapsulation needs to be done here
         if (MultiChannelCC_1.MultiChannelCC.requiresEncapsulation(cc)) {
-            cc = MultiChannelCC_1.MultiChannelCC.encapsulate(this.applHost, cc);
+            const multiChannelCCVersion = this.host.getSupportedCCVersion(core_1.CommandClasses["Multi Channel"], this.endpoint.nodeId);
+            cc = multiChannelCCVersion === 1
+                ? MultiChannelCC_1.MultiChannelCC.encapsulateV1(cc)
+                : MultiChannelCC_1.MultiChannelCC.encapsulate(cc);
         }
-        cc = Security2CC.encapsulate(this.applHost, cc, { securityClass });
-        const response = await this.applHost.sendCommand(cc, {
+        cc = Security2CC.encapsulate(cc, this.host.ownNodeId, this.host, { securityClass });
+        const response = await this.host.sendCommand(cc, {
             ...this.commandOptions,
             autoEncapsulate: false,
         });
@@ -229,21 +401,21 @@ let Security2CCAPI = class Security2CCAPI extends API_1.CCAPI {
     }
     async reportSupportedCommands(supportedCCs) {
         this.assertSupportsCommand(_Types_1.Security2Command, _Types_1.Security2Command.CommandsSupportedReport);
-        const cc = new Security2CCCommandsSupportedReport(this.applHost, {
+        const cc = new Security2CCCommandsSupportedReport({
             nodeId: this.endpoint.nodeId,
-            endpoint: this.endpoint.index,
+            endpointIndex: this.endpoint.index,
             supportedCCs,
         });
-        await this.applHost.sendCommand(cc, this.commandOptions);
+        await this.host.sendCommand(cc, this.commandOptions);
     }
     // eslint-disable-next-line @typescript-eslint/explicit-module-boundary-types
     async getKeyExchangeParameters() {
         this.assertSupportsCommand(_Types_1.Security2Command, _Types_1.Security2Command.KEXGet);
-        const cc = new Security2CCKEXGet(this.applHost, {
+        const cc = new Security2CCKEXGet({
             nodeId: this.endpoint.nodeId,
-            endpoint: this.endpoint.index,
+            endpointIndex: this.endpoint.index,
         });
-        const response = await this.applHost.sendCommand(cc, this.commandOptions);
+        const response = await this.host.sendCommand(cc, this.commandOptions);
         if (response) {
             return (0, safe_2.pick)(response, [
                 "requestCSA",
@@ -258,103 +430,103 @@ let Security2CCAPI = class Security2CCAPI extends API_1.CCAPI {
     /** Requests the given keys from an including node */
     async requestKeys(params) {
         this.assertSupportsCommand(_Types_1.Security2Command, _Types_1.Security2Command.KEXReport);
-        const cc = new Security2CCKEXReport(this.applHost, {
+        const cc = new Security2CCKEXReport({
             nodeId: this.endpoint.nodeId,
-            endpoint: this.endpoint.index,
+            endpointIndex: this.endpoint.index,
             ...params,
             echo: false,
         });
-        await this.applHost.sendCommand(cc, this.commandOptions);
+        await this.host.sendCommand(cc, this.commandOptions);
     }
     /** Grants the joining node the given keys */
     async grantKeys(params) {
         this.assertSupportsCommand(_Types_1.Security2Command, _Types_1.Security2Command.KEXSet);
-        const cc = new Security2CCKEXSet(this.applHost, {
+        const cc = new Security2CCKEXSet({
             nodeId: this.endpoint.nodeId,
-            endpoint: this.endpoint.index,
+            endpointIndex: this.endpoint.index,
             ...params,
             echo: false,
         });
-        await this.applHost.sendCommand(cc, this.commandOptions);
+        await this.host.sendCommand(cc, this.commandOptions);
     }
     /** Confirms the keys that were requested by a node */
     async confirmRequestedKeys(params) {
         this.assertSupportsCommand(_Types_1.Security2Command, _Types_1.Security2Command.KEXReport);
-        const cc = new Security2CCKEXReport(this.applHost, {
+        const cc = new Security2CCKEXReport({
             nodeId: this.endpoint.nodeId,
-            endpoint: this.endpoint.index,
+            endpointIndex: this.endpoint.index,
             ...params,
             echo: true,
         });
-        await this.applHost.sendCommand(cc, this.commandOptions);
+        await this.host.sendCommand(cc, this.commandOptions);
     }
     /** Confirms the keys that were granted by the including node */
     async confirmGrantedKeys(params) {
         this.assertSupportsCommand(_Types_1.Security2Command, _Types_1.Security2Command.KEXSet);
-        const cc = new Security2CCKEXSet(this.applHost, {
+        const cc = new Security2CCKEXSet({
             nodeId: this.endpoint.nodeId,
-            endpoint: this.endpoint.index,
+            endpointIndex: this.endpoint.index,
             ...params,
             echo: true,
         });
-        return this.applHost.sendCommand(cc, this.commandOptions);
+        return this.host.sendCommand(cc, this.commandOptions);
     }
     /** Notifies the other node that the ongoing key exchange was aborted */
     async abortKeyExchange(failType) {
         this.assertSupportsCommand(_Types_1.Security2Command, _Types_1.Security2Command.KEXFail);
-        const cc = new Security2CCKEXFail(this.applHost, {
+        const cc = new Security2CCKEXFail({
             nodeId: this.endpoint.nodeId,
-            endpoint: this.endpoint.index,
+            endpointIndex: this.endpoint.index,
             failType,
         });
-        await this.applHost.sendCommand(cc, this.commandOptions);
+        await this.host.sendCommand(cc, this.commandOptions);
     }
     async sendPublicKey(publicKey, includingNode = true) {
         this.assertSupportsCommand(_Types_1.Security2Command, _Types_1.Security2Command.PublicKeyReport);
-        const cc = new Security2CCPublicKeyReport(this.applHost, {
+        const cc = new Security2CCPublicKeyReport({
             nodeId: this.endpoint.nodeId,
-            endpoint: this.endpoint.index,
+            endpointIndex: this.endpoint.index,
             includingNode,
             publicKey,
         });
-        await this.applHost.sendCommand(cc, this.commandOptions);
+        await this.host.sendCommand(cc, this.commandOptions);
     }
     async requestNetworkKey(securityClass) {
         this.assertSupportsCommand(_Types_1.Security2Command, _Types_1.Security2Command.NetworkKeyGet);
-        const cc = new Security2CCNetworkKeyGet(this.applHost, {
+        const cc = new Security2CCNetworkKeyGet({
             nodeId: this.endpoint.nodeId,
-            endpoint: this.endpoint.index,
+            endpointIndex: this.endpoint.index,
             requestedKey: securityClass,
         });
-        await this.applHost.sendCommand(cc, this.commandOptions);
+        await this.host.sendCommand(cc, this.commandOptions);
     }
     async sendNetworkKey(securityClass, networkKey) {
         this.assertSupportsCommand(_Types_1.Security2Command, _Types_1.Security2Command.NetworkKeyReport);
-        const cc = new Security2CCNetworkKeyReport(this.applHost, {
+        const cc = new Security2CCNetworkKeyReport({
             nodeId: this.endpoint.nodeId,
-            endpoint: this.endpoint.index,
+            endpointIndex: this.endpoint.index,
             grantedKey: securityClass,
             networkKey,
         });
-        await this.applHost.sendCommand(cc, this.commandOptions);
+        await this.host.sendCommand(cc, this.commandOptions);
     }
     async verifyNetworkKey() {
         this.assertSupportsCommand(_Types_1.Security2Command, _Types_1.Security2Command.NetworkKeyVerify);
-        const cc = new Security2CCNetworkKeyVerify(this.applHost, {
+        const cc = new Security2CCNetworkKeyVerify({
             nodeId: this.endpoint.nodeId,
-            endpoint: this.endpoint.index,
+            endpointIndex: this.endpoint.index,
         });
-        await this.applHost.sendCommand(cc, this.commandOptions);
+        await this.host.sendCommand(cc, this.commandOptions);
     }
     async confirmKeyVerification() {
         this.assertSupportsCommand(_Types_1.Security2Command, _Types_1.Security2Command.TransferEnd);
-        const cc = new Security2CCTransferEnd(this.applHost, {
+        const cc = new Security2CCTransferEnd({
             nodeId: this.endpoint.nodeId,
-            endpoint: this.endpoint.index,
+            endpointIndex: this.endpoint.index,
             keyVerified: true,
             keyRequestComplete: false,
         });
-        await this.applHost.sendCommand(cc, {
+        await this.host.sendCommand(cc, {
             ...this.commandOptions,
             // Don't wait for an ACK from the node
             transmitOptions: core_1.TransmitOptions.DEFAULT & ~core_1.TransmitOptions.ACK,
@@ -362,13 +534,13 @@ let Security2CCAPI = class Security2CCAPI extends API_1.CCAPI {
     }
     async endKeyExchange() {
         this.assertSupportsCommand(_Types_1.Security2Command, _Types_1.Security2Command.TransferEnd);
-        const cc = new Security2CCTransferEnd(this.applHost, {
+        const cc = new Security2CCTransferEnd({
             nodeId: this.endpoint.nodeId,
-            endpoint: this.endpoint.index,
+            endpointIndex: this.endpoint.index,
             keyVerified: false,
             keyRequestComplete: true,
         });
-        await this.applHost.sendCommand(cc, this.commandOptions);
+        await this.host.sendCommand(cc, this.commandOptions);
     }
 };
 exports.Security2CCAPI = Security2CCAPI;
@@ -376,13 +548,13 @@ exports.Security2CCAPI = Security2CCAPI = __decorate([
     (0, CommandClassDecorators_1.API)(core_1.CommandClasses["Security 2"])
 ], Security2CCAPI);
 let Security2CC = Security2CC_1 = class Security2CC extends CommandClass_1.CommandClass {
-    async interview(applHost) {
-        const node = this.getNode(applHost);
-        const endpoint = this.getEndpoint(applHost);
-        const api = API_1.CCAPI.create(core_1.CommandClasses["Security 2"], applHost, endpoint).withOptions({
+    async interview(ctx) {
+        const securityManager = getSecurityManager(ctx.ownNodeId, ctx, this.nodeId);
+        const node = this.getNode(ctx);
+        const endpoint = this.getEndpoint(ctx);
+        const api = API_1.CCAPI.create(core_1.CommandClasses["Security 2"], ctx, endpoint).withOptions({
             priority: core_1.MessagePriority.NodeQuery,
         });
-        const securityManager = getSecurityManager(applHost, node.id);
         // Only on the highest security class the response includes the supported commands
         const secClass = node.getHighestSecurityClass();
         let hasReceivedSecureCommands = false;
@@ -402,7 +574,7 @@ let Security2CC = Security2CC_1 = class Security2CC extends CommandClass_1.Comma
         }
         else {
             // For endpoint interviews, the security class MUST be known
-            applHost.controllerLog.logNode(node.id, {
+            ctx.logNode(node.id, {
                 endpoint: endpoint.index,
                 message: `Cannot query securely supported commands for endpoint because the node's security class isn't known...`,
                 level: "error",
@@ -420,14 +592,14 @@ let Security2CC = Security2CC_1 = class Security2CC extends CommandClass_1.Comma
                 continue;
             // If no key is configured for this security class, skip it
             if (!securityManager?.hasKeysForSecurityClass(secClass)) {
-                applHost.controllerLog.logNode(node.id, {
+                ctx.logNode(node.id, {
                     endpoint: endpoint.index,
                     message: `Cannot query securely supported commands (${(0, safe_2.getEnumMemberName)(core_1.SecurityClass, secClass)}) - network key is not configured...`,
                     level: "warn",
                 });
                 continue;
             }
-            applHost.controllerLog.logNode(node.id, {
+            ctx.logNode(node.id, {
                 endpoint: endpoint.index,
                 message: `Querying securely supported commands (${(0, safe_2.getEnumMemberName)(core_1.SecurityClass, secClass)})...`,
                 direction: "outbound",
@@ -455,7 +627,7 @@ let Security2CC = Security2CC_1 = class Security2CC extends CommandClass_1.Comma
                     && possibleSecurityClasses.length === 1) {
                     if (attempts < MAX_ATTEMPTS) {
                         // We definitely know the highest security class
-                        applHost.controllerLog.logNode(node.id, {
+                        ctx.logNode(node.id, {
                             endpoint: endpoint.index,
                             message: `Querying securely supported commands (${(0, safe_2.getEnumMemberName)(core_1.SecurityClass, secClass)}), attempt ${attempts}/${MAX_ATTEMPTS} failed. Retrying in 500ms...`,
                             level: "warn",
@@ -464,7 +636,7 @@ let Security2CC = Security2CC_1 = class Security2CC extends CommandClass_1.Comma
                         continue;
                     }
                     else if (endpoint.index > 0) {
-                        applHost.controllerLog.logNode(node.id, {
+                        ctx.logNode(node.id, {
                             endpoint: endpoint.index,
                             message: `Querying securely supported commands (${(0, safe_2.getEnumMemberName)(core_1.SecurityClass, secClass)}) failed. Assuming the endpoint supports all its mandatory CCs securely...`,
                             level: "warn",
@@ -477,7 +649,7 @@ let Security2CC = Security2CC_1 = class Security2CC extends CommandClass_1.Comma
                         break;
                     }
                     else {
-                        applHost.controllerLog.logNode(node.id, {
+                        ctx.logNode(node.id, {
                             endpoint: endpoint.index,
                             message: `Querying securely supported commands (${(0, safe_2.getEnumMemberName)(core_1.SecurityClass, secClass)}) failed. Let's hope for the best...`,
                             level: "warn",
@@ -496,7 +668,7 @@ let Security2CC = Security2CC_1 = class Security2CC extends CommandClass_1.Comma
                     // No supported commands found, mark the security class as not granted
                     // unless we were sure about the security class
                     node.setSecurityClass(secClass, false);
-                    applHost.controllerLog.logNode(node.id, {
+                    ctx.logNode(node.id, {
                         message: `The node was NOT granted the security class ${(0, safe_2.getEnumMemberName)(core_1.SecurityClass, secClass)}`,
                         direction: "inbound",
                     });
@@ -506,7 +678,7 @@ let Security2CC = Security2CC_1 = class Security2CC extends CommandClass_1.Comma
             if (endpoint.index === 0 && possibleSecurityClasses.length > 1) {
                 // Mark the security class as granted unless we were sure about the security class
                 node.setSecurityClass(secClass, true);
-                applHost.controllerLog.logNode(node.id, {
+                ctx.logNode(node.id, {
                     message: `The node was granted the security class ${(0, safe_2.getEnumMemberName)(core_1.SecurityClass, secClass)}`,
                     direction: "inbound",
                 });
@@ -520,7 +692,7 @@ let Security2CC = Security2CC_1 = class Security2CC extends CommandClass_1.Comma
                 for (const cc of supportedCCs) {
                     logLines.push(`· ${(0, core_1.getCCName)(cc)}`);
                 }
-                applHost.controllerLog.logNode(node.id, {
+                ctx.logNode(node.id, {
                     endpoint: endpoint.index,
                     message: logLines.join("\n"),
                     direction: "inbound",
@@ -543,7 +715,7 @@ let Security2CC = Security2CC_1 = class Security2CC extends CommandClass_1.Comma
             }
         }
         // Remember that the interview is complete
-        this.setInterviewComplete(applHost, true);
+        this.setInterviewComplete(ctx, true);
     }
     /** Tests if a command should be sent secure and thus requires encapsulation */
     static requiresEncapsulation(cc) {
@@ -591,7 +763,7 @@ let Security2CC = Security2CC_1 = class Security2CC extends CommandClass_1.Comma
         return true;
     }
     /** Encapsulates a command that should be sent encrypted */
-    static encapsulate(host, cc, options) {
+    static encapsulate(cc, ownNodeId, securityManagers, options) {
         // Determine which extensions must be used on the command
         const extensions = [];
         if (options?.multicastOutOfSync) {
@@ -614,7 +786,7 @@ let Security2CC = Security2CC_1 = class Security2CC extends CommandClass_1.Comma
         else {
             nodeId = cc.nodeId;
         }
-        const ret = new Security2CCMessageEncapsulation(host, {
+        const ret = new Security2CCMessageEncapsulation({
             nodeId,
             encapsulated: cc,
             securityClass: options?.securityClass,
@@ -633,6 +805,12 @@ exports.Security2CC = Security2CC = Security2CC_1 = __decorate([
     (0, CommandClassDecorators_1.commandClass)(core_1.CommandClasses["Security 2"]),
     (0, CommandClassDecorators_1.implementedVersion)(1)
 ], Security2CC);
+function failNoSPAN() {
+    core_1.validatePayload.fail(core_1.ZWaveErrorCodes.Security2CC_NoSPAN);
+}
+function failNoMPAN() {
+    core_1.validatePayload.fail(core_1.ZWaveErrorCodes.Security2CC_NoMPAN);
+}
 // An S2 encapsulated command may result in a NonceReport to be sent by the node if it couldn't decrypt the message
 function getCCResponseForMessageEncapsulation(sent) {
     if (sent.encapsulated?.expectsCCResponse()) {
@@ -661,258 +839,251 @@ function testCCResponseForMessageEncapsulation(sent, received) {
         return received.SOS && !!received.receiverEI;
     }
 }
-function failNoSPAN() {
-    core_1.validatePayload.fail(core_1.ZWaveErrorCodes.Security2CC_NoSPAN);
-}
-function failNoMPAN() {
-    core_1.validatePayload.fail(core_1.ZWaveErrorCodes.Security2CC_NoMPAN);
-}
-let Security2CCMessageEncapsulation = class Security2CCMessageEncapsulation extends Security2CC {
-    constructor(host, options) {
-        super(host, options);
-        // Make sure that we can send/receive secure commands
-        assertSecurity.call(this, options);
-        this.securityManager = getSecurityManager(host, this.nodeId);
-        if ((0, CommandClass_1.gotDeserializationOptions)(options)) {
-            (0, core_1.validatePayload)(this.payload.length >= 2);
-            // Check the sequence number to avoid duplicates
-            this._sequenceNumber = this.payload[0];
-            const sendingNodeId = this.nodeId;
-            // Ensure the node has a security class
-            const securityClass = this.host.getHighestSecurityClass(sendingNodeId);
-            core_1.validatePayload.withReason("No security class granted")(securityClass !== core_1.SecurityClass.None);
-            const hasExtensions = !!(this.payload[1] & 0b1);
-            const hasEncryptedExtensions = !!(this.payload[1] & 0b10);
-            let offset = 2;
-            this.extensions = [];
-            let mustDiscardCommand = false;
-            const parseExtensions = (buffer, wasEncrypted) => {
-                while (true) {
-                    if (buffer.length < offset + 2) {
-                        // An S2 extension was expected, but the buffer is too short
-                        mustDiscardCommand = true;
-                        return;
-                    }
-                    // The length field could be too large, which would cause part of the actual ciphertext
-                    // to be ignored. Try to avoid this for known extensions by checking the actual and expected length.
-                    const { actual: actualLength, expected: expectedLength } = Extension_1.Security2Extension
-                        .getExtensionLength(buffer.subarray(offset));
-                    // Parse the extension using the expected length if possible
-                    const extensionLength = expectedLength ?? actualLength;
-                    if (extensionLength < 2) {
-                        // An S2 extension was expected, but the length is too short
-                        mustDiscardCommand = true;
-                        return;
-                    }
-                    else if (extensionLength
-                        > buffer.length
-                            - offset
-                            - (wasEncrypted
-                                ? 0
-                                : core_1.SECURITY_S2_AUTH_TAG_LENGTH)) {
-                        // The supposed length is longer than the space the extensions may occupy
-                        mustDiscardCommand = true;
-                        return;
-                    }
-                    const extensionData = buffer.subarray(offset, offset + extensionLength);
-                    offset += extensionLength;
-                    const ext = Extension_1.Security2Extension.from(extensionData);
-                    switch ((0, Extension_1.validateS2Extension)(ext, wasEncrypted)) {
-                        case Extension_1.ValidateS2ExtensionResult.OK:
-                            if (expectedLength != undefined
-                                && actualLength !== expectedLength) {
-                                // The extension length field does not match, ignore the extension
-                            }
-                            else {
-                                this.extensions.push(ext);
-                            }
-                            break;
-                        case Extension_1.ValidateS2ExtensionResult.DiscardExtension:
-                            // Do nothing
-                            break;
-                        case Extension_1.ValidateS2ExtensionResult.DiscardCommand:
-                            mustDiscardCommand = true;
-                            break;
-                    }
-                    // Check if that was the last extension
-                    if (!ext.moreToFollow)
-                        break;
-                }
-            };
-            if (hasExtensions)
-                parseExtensions(this.payload, false);
-            const ctx = (() => {
-                const multicastGroupId = this.getMulticastGroupId();
-                if (options.frameType === "multicast"
-                    || options.frameType === "broadcast") {
-                    if (multicastGroupId == undefined) {
-                        core_1.validatePayload.fail("Multicast frames without MGRP extension");
-                    }
-                    return {
-                        isMulticast: true,
-                        groupId: multicastGroupId,
-                    };
-                }
-                else {
-                    return { isMulticast: false, groupId: multicastGroupId };
+let Security2CCMessageEncapsulation = Security2CCMessageEncapsulation_1 = class Security2CCMessageEncapsulation extends Security2CC {
+    constructor(options) {
+        super(options);
+        if (!options.encapsulated && !options.extensions?.length) {
+            throw new core_1.ZWaveError("Security S2 encapsulation requires an encapsulated CC and/or extensions", core_1.ZWaveErrorCodes.Argument_Invalid);
+        }
+        this.sequenceNumber = options.sequenceNumber;
+        this.securityClass = options.securityClass;
+        if (options.encapsulated) {
+            this.encapsulated = options.encapsulated;
+            options.encapsulated.encapsulatingCC = this;
+        }
+        this.verifyDelivery = options.verifyDelivery !== false;
+        this.extensions = options.extensions ?? [];
+        if (typeof this.nodeId !== "number"
+            && !this.extensions.some((e) => e instanceof Extension_1.MGRPExtension)) {
+            throw new core_1.ZWaveError("Multicast Security S2 encapsulation requires the MGRP extension", core_1.ZWaveErrorCodes.Security2CC_MissingExtension);
+        }
+    }
+    static from(raw, ctx) {
+        const securityManager = assertSecurityRX(ctx);
+        (0, core_1.validatePayload)(raw.payload.length >= 2);
+        // Check the sequence number to avoid duplicates
+        const sequenceNumber = raw.payload[0];
+        // Ensure the node has a security class
+        core_1.validatePayload.withReason("No security class granted")(ctx.getHighestSecurityClass(ctx.sourceNodeId) !== core_1.SecurityClass.None);
+        const hasExtensions = !!(raw.payload[1] & 0b1);
+        const hasEncryptedExtensions = !!(raw.payload[1] & 0b10);
+        let offset = 2;
+        const extensions = [];
+        let mustDiscardCommand = false;
+        const parseExtensions = (buffer, wasEncrypted) => {
+            while (true) {
+                if (buffer.length < offset + 2) {
+                    // An S2 extension was expected, but the buffer is too short
+                    mustDiscardCommand = true;
+                    return;
                 }
-            })();
-            // If a command is to be discarded before decryption,
-            // we still need to increment the SPAN or MPAN state
-            if (mustDiscardCommand) {
-                if (ctx.isMulticast) {
-                    this.securityManager.nextPeerMPAN(sendingNodeId, ctx.groupId);
+                // The length field could be too large, which would cause part of the actual ciphertext
+                // to be ignored. Try to avoid this for known extensions by checking the actual and expected length.
+                const { actual: actualLength, expected: expectedLength } = Extension_1.Security2Extension
+                    .getExtensionLength(buffer.subarray(offset));
+                // Parse the extension using the expected length if possible
+                const extensionLength = expectedLength ?? actualLength;
+                if (extensionLength < 2) {
+                    // An S2 extension was expected, but the length is too short
+                    mustDiscardCommand = true;
+                    return;
                 }
-                else {
-                    this.securityManager.nextNonce(sendingNodeId);
+                else if (extensionLength
+                    > buffer.length
+                        - offset
+                        - (wasEncrypted
+                            ? 0
+                            : core_1.SECURITY_S2_AUTH_TAG_LENGTH)) {
+                    // The supposed length is longer than the space the extensions may occupy
+                    mustDiscardCommand = true;
+                    return;
                 }
-                core_1.validatePayload.fail("Invalid S2 extension");
-            }
-            let prevSequenceNumber;
-            let mpanState;
-            if (ctx.isMulticast) {
-                mpanState = this.securityManager.getPeerMPAN(sendingNodeId, ctx.groupId);
-            }
-            else {
-                // Don't accept duplicate Singlecast commands
-                prevSequenceNumber = validateSequenceNumber.call(this, this._sequenceNumber);
-                // When a node receives a singlecast message after a multicast group was marked out of sync,
-                // it must forget about the group.
-                if (ctx.groupId == undefined) {
-                    this.securityManager.resetOutOfSyncMPANs(sendingNodeId);
+                const extensionData = buffer.subarray(offset, offset + extensionLength);
+                offset += extensionLength;
+                const ext = Extension_1.Security2Extension.from(extensionData);
+                switch ((0, Extension_1.validateS2Extension)(ext, wasEncrypted)) {
+                    case Extension_1.ValidateS2ExtensionResult.OK:
+                        if (expectedLength != undefined
+                            && actualLength !== expectedLength) {
+                            // The extension length field does not match, ignore the extension
+                        }
+                        else {
+                            extensions.push(ext);
+                        }
+                        break;
+                    case Extension_1.ValidateS2ExtensionResult.DiscardExtension:
+                        // Do nothing
+                        break;
+                    case Extension_1.ValidateS2ExtensionResult.DiscardCommand:
+                        mustDiscardCommand = true;
+                        break;
                 }
+                // Check if that was the last extension
+                if (!ext.moreToFollow)
+                    break;
             }
-            const unencryptedPayload = this.payload.subarray(0, offset);
-            const ciphertext = this.payload.subarray(offset, -core_1.SECURITY_S2_AUTH_TAG_LENGTH);
-            const authTag = this.payload.subarray(-core_1.SECURITY_S2_AUTH_TAG_LENGTH);
-            this.authTag = authTag;
-            const messageLength = super.computeEncapsulationOverhead()
-                + this.payload.length;
-            const authData = getAuthenticationData(sendingNodeId, this.getDestinationIDRX(), this.host.homeId, messageLength, unencryptedPayload);
-            let decrypt;
-            if (ctx.isMulticast) {
-                // For incoming multicast commands, make sure we have an MPAN
-                if (mpanState?.type !== core_1.MPANState.MPAN) {
-                    // If we don't, mark the MPAN as out of sync, so we can respond accordingly on the singlecast followup
-                    this.securityManager.storePeerMPAN(sendingNodeId, ctx.groupId, { type: core_1.MPANState.OutOfSync });
-                    failNoMPAN();
+        };
+        if (hasExtensions)
+            parseExtensions(raw.payload, false);
+        const mcctx = (() => {
+            const multicastGroupId = getMulticastGroupId(extensions);
+            if (ctx.frameType === "multicast" || ctx.frameType === "broadcast") {
+                if (multicastGroupId == undefined) {
+                    core_1.validatePayload.fail("Multicast frames without MGRP extension");
                 }
-                decrypt = () => this.decryptMulticast(sendingNodeId, ctx.groupId, ciphertext, authData, authTag);
+                return {
+                    isMulticast: true,
+                    groupId: multicastGroupId,
+                };
             }
             else {
-                // Decrypt payload and verify integrity
-                const spanState = this.securityManager.getSPANState(sendingNodeId);
-                // If we are not able to establish an SPAN yet, fail the decryption
-                if (spanState.type === core_1.SPANState.None) {
-                    failNoSPAN();
-                }
-                else if (spanState.type === core_1.SPANState.RemoteEI) {
-                    // TODO: The specs are not clear how to handle this case
-                    // For now, do the same as if we didn't have any EI
-                    failNoSPAN();
-                }
-                decrypt = () => this.decryptSinglecast(sendingNodeId, prevSequenceNumber, ciphertext, authData, authTag, spanState);
+                return { isMulticast: false, groupId: multicastGroupId };
             }
-            let plaintext;
-            let authOK = false;
-            let key;
-            let iv;
-            let decryptionSecurityClass;
-            // If the Receiver is unable to authenticate the singlecast message with the current SPAN,
-            // the Receiver SHOULD try decrypting the message with one or more of the following SPAN values,
-            // stopping when decryption is successful or the maximum number of iterations is reached.
-            // If the Receiver is unable to decrypt the S2 MC frame with the current MPAN, the Receiver MAY try
-            // decrypting the frame with one or more of the subsequent MPAN values, stopping when decryption is
-            // successful or the maximum number of iterations is reached.
-            const decryptAttempts = ctx.isMulticast
-                ? MAX_DECRYPT_ATTEMPTS_MULTICAST
-                : ctx.groupId != undefined
-                    ? MAX_DECRYPT_ATTEMPTS_SC_FOLLOWUP
-                    : MAX_DECRYPT_ATTEMPTS_SINGLECAST;
-            for (let i = 0; i < decryptAttempts; i++) {
-                ({
-                    plaintext,
-                    authOK,
-                    key,
-                    iv,
-                    securityClass: decryptionSecurityClass,
-                } = decrypt());
-                if (!!authOK && !!plaintext)
-                    break;
-                // No need to try further SPANs if we just got the sender's EI
-                if (!!this.getSenderEI())
-                    break;
+        })();
+        // If a command is to be discarded before decryption,
+        // we still need to increment the SPAN or MPAN state
+        if (mustDiscardCommand) {
+            if (mcctx.isMulticast) {
+                securityManager.nextPeerMPAN(ctx.sourceNodeId, mcctx.groupId);
             }
-            // If authentication fails, do so with an error code that instructs the
-            // applHost to tell the node we have no nonce
-            if (!authOK || !plaintext) {
-                if (ctx.isMulticast) {
-                    // Mark the MPAN as out of sync
-                    this.securityManager.storePeerMPAN(sendingNodeId, ctx.groupId, { type: core_1.MPANState.OutOfSync });
-                    core_1.validatePayload.fail(core_1.ZWaveErrorCodes.Security2CC_CannotDecodeMulticast);
-                }
-                else {
-                    core_1.validatePayload.fail(core_1.ZWaveErrorCodes.Security2CC_CannotDecode);
-                }
+            else {
+                securityManager.nextNonce(ctx.sourceNodeId);
             }
-            else if (!ctx.isMulticast && ctx.groupId != undefined) {
-                // After reception of a singlecast followup, the MPAN state must be increased
-                this.securityManager.tryIncrementPeerMPAN(sendingNodeId, ctx.groupId);
+            core_1.validatePayload.fail("Invalid S2 extension");
+        }
+        let prevSequenceNumber;
+        let mpanState;
+        if (mcctx.isMulticast) {
+            mpanState = securityManager.getPeerMPAN(ctx.sourceNodeId, mcctx.groupId);
+        }
+        else {
+            // Don't accept duplicate Singlecast commands
+            prevSequenceNumber = validateSequenceNumber(securityManager, ctx.sourceNodeId, sequenceNumber);
+            // When a node receives a singlecast message after a multicast group was marked out of sync,
+            // it must forget about the group.
+            if (mcctx.groupId == undefined) {
+                securityManager.resetOutOfSyncMPANs(ctx.sourceNodeId);
             }
-            // Remember which security class was used to decrypt this message, so we can discard it later
-            this.securityClass = decryptionSecurityClass;
-            offset = 0;
-            if (hasEncryptedExtensions)
-                parseExtensions(plaintext, true);
-            // Before we can continue, check if the command must be discarded
-            if (mustDiscardCommand) {
-                core_1.validatePayload.fail("Invalid extension");
+        }
+        const unencryptedPayload = raw.payload.subarray(0, offset);
+        const ciphertext = raw.payload.subarray(offset, -core_1.SECURITY_S2_AUTH_TAG_LENGTH);
+        const authTag = raw.payload.subarray(-core_1.SECURITY_S2_AUTH_TAG_LENGTH);
+        const messageLength = 2 /* CommandClass.computeEncapsulationOverhead() */
+            + raw.payload.length;
+        const authData = getAuthenticationData(ctx.sourceNodeId, getDestinationIDRX(ctx, extensions), ctx.homeId, messageLength, unencryptedPayload);
+        let decrypt;
+        if (mcctx.isMulticast) {
+            // For incoming multicast commands, make sure we have an MPAN
+            if (mpanState?.type !== core_1.MPANState.MPAN) {
+                // If we don't, mark the MPAN as out of sync, so we can respond accordingly on the singlecast followup
+                securityManager.storePeerMPAN(ctx.sourceNodeId, mcctx.groupId, { type: core_1.MPANState.OutOfSync });
+                failNoMPAN();
             }
-            // If the MPAN extension was received, store the MPAN
-            if (!ctx.isMulticast) {
-                const mpanExtension = this.getMPANExtension();
-                if (mpanExtension) {
-                    this.securityManager.storePeerMPAN(sendingNodeId, mpanExtension.groupId, {
-                        type: core_1.MPANState.MPAN,
-                        currentMPAN: mpanExtension.innerMPANState,
-                    });
-                }
+            decrypt = () => decryptMulticast(ctx.sourceNodeId, securityManager, mcctx.groupId, ciphertext, authData, authTag);
+        }
+        else {
+            // Decrypt payload and verify integrity
+            const spanState = securityManager.getSPANState(ctx.sourceNodeId);
+            // If we are not able to establish an SPAN yet, fail the decryption
+            if (spanState.type === core_1.SPANState.None) {
+                failNoSPAN();
             }
-            // Not every S2 message includes an encapsulated CC
-            const decryptedCCBytes = plaintext.subarray(offset);
-            if (decryptedCCBytes.length > 0) {
-                // make sure this contains a complete CC command that's worth splitting
-                (0, core_1.validatePayload)(decryptedCCBytes.length >= 2);
-                // and deserialize the CC
-                this.encapsulated = CommandClass_1.CommandClass.from(this.host, {
-                    data: decryptedCCBytes,
-                    fromEncapsulation: true,
-                    encapCC: this,
-                    frameType: options.frameType,
-                });
+            else if (spanState.type === core_1.SPANState.RemoteEI) {
+                // TODO: The specs are not clear how to handle this case
+                // For now, do the same as if we didn't have any EI
+                failNoSPAN();
             }
-            this.plaintext = decryptedCCBytes;
-            this.key = key;
-            this.iv = iv;
+            decrypt = () => decryptSinglecast(ctx, securityManager, ctx.sourceNodeId, sequenceNumber, prevSequenceNumber, ciphertext, authData, authTag, spanState, extensions);
         }
-        else {
-            if (!options.encapsulated && !options.extensions?.length) {
-                throw new core_1.ZWaveError("Security S2 encapsulation requires an encapsulated CC and/or extensions", core_1.ZWaveErrorCodes.Argument_Invalid);
+        let plaintext;
+        let authOK = false;
+        let key;
+        let iv;
+        let decryptionSecurityClass;
+        // If the Receiver is unable to authenticate the singlecast message with the current SPAN,
+        // the Receiver SHOULD try decrypting the message with one or more of the following SPAN values,
+        // stopping when decryption is successful or the maximum number of iterations is reached.
+        // If the Receiver is unable to decrypt the S2 MC frame with the current MPAN, the Receiver MAY try
+        // decrypting the frame with one or more of the subsequent MPAN values, stopping when decryption is
+        // successful or the maximum number of iterations is reached.
+        const decryptAttempts = mcctx.isMulticast
+            ? MAX_DECRYPT_ATTEMPTS_MULTICAST
+            : mcctx.groupId != undefined
+                ? MAX_DECRYPT_ATTEMPTS_SC_FOLLOWUP
+                : MAX_DECRYPT_ATTEMPTS_SINGLECAST;
+        for (let i = 0; i < decryptAttempts; i++) {
+            ({
+                plaintext,
+                authOK,
+                key,
+                iv,
+                securityClass: decryptionSecurityClass,
+            } = decrypt());
+            if (!!authOK && !!plaintext)
+                break;
+            // No need to try further SPANs if we just got the sender's EI
+            if (!!getSenderEI(extensions))
+                break;
+        }
+        // If authentication fails, do so with an error code that instructs the
+        // applHost to tell the node we have no nonce
+        if (!authOK || !plaintext) {
+            if (mcctx.isMulticast) {
+                // Mark the MPAN as out of sync
+                securityManager.storePeerMPAN(ctx.sourceNodeId, mcctx.groupId, { type: core_1.MPANState.OutOfSync });
+                core_1.validatePayload.fail(core_1.ZWaveErrorCodes.Security2CC_CannotDecodeMulticast);
             }
-            this.securityClass = options.securityClass;
-            if (options.encapsulated) {
-                this.encapsulated = options.encapsulated;
-                options.encapsulated.encapsulatingCC = this;
+            else {
+                core_1.validatePayload.fail(core_1.ZWaveErrorCodes.Security2CC_CannotDecode);
             }
-            this.verifyDelivery = options.verifyDelivery !== false;
-            this.extensions = options.extensions ?? [];
-            if (typeof this.nodeId !== "number"
-                && !this.extensions.some((e) => e instanceof Extension_1.MGRPExtension)) {
-                throw new core_1.ZWaveError("Multicast Security S2 encapsulation requires the MGRP extension", core_1.ZWaveErrorCodes.Security2CC_MissingExtension);
+        }
+        else if (!mcctx.isMulticast && mcctx.groupId != undefined) {
+            // After reception of a singlecast followup, the MPAN state must be increased
+            securityManager.tryIncrementPeerMPAN(ctx.sourceNodeId, mcctx.groupId);
+        }
+        // Remember which security class was used to decrypt this message, so we can discard it later
+        const securityClass = decryptionSecurityClass;
+        offset = 0;
+        if (hasEncryptedExtensions)
+            parseExtensions(plaintext, true);
+        // Before we can continue, check if the command must be discarded
+        if (mustDiscardCommand) {
+            core_1.validatePayload.fail("Invalid extension");
+        }
+        // If the MPAN extension was received, store the MPAN
+        if (!mcctx.isMulticast) {
+            const mpanExtension = extensions.find((e) => e instanceof Extension_1.MPANExtension);
+            if (mpanExtension) {
+                securityManager.storePeerMPAN(ctx.sourceNodeId, mpanExtension.groupId, {
+                    type: core_1.MPANState.MPAN,
+                    currentMPAN: mpanExtension.innerMPANState,
+                });
             }
         }
+        // Not every S2 message includes an encapsulated CC
+        const decryptedCCBytes = plaintext.subarray(offset);
+        let encapsulated;
+        if (decryptedCCBytes.length > 0) {
+            // make sure this contains a complete CC command that's worth splitting
+            (0, core_1.validatePayload)(decryptedCCBytes.length >= 2);
+            // and deserialize the CC
+            encapsulated = CommandClass_1.CommandClass.parse(decryptedCCBytes, ctx);
+        }
+        const ret = new Security2CCMessageEncapsulation_1({
+            nodeId: ctx.sourceNodeId,
+            sequenceNumber,
+            securityClass,
+            extensions,
+            encapsulated,
+        });
+        // Remember for debugging purposes
+        ret.key = key;
+        ret.iv = iv;
+        ret.authData = authData;
+        ret.authTag = authTag;
+        ret.plaintext = decryptedCCBytes;
+        return ret;
     }
-    securityManager;
     securityClass;
     // Only used for testing/debugging purposes
     key;
@@ -922,73 +1093,41 @@ let Security2CCMessageEncapsulation = class Security2CCMessageEncapsulation exte
     ciphertext;
     plaintext;
     verifyDelivery = true;
-    _sequenceNumber;
-    /**
-     * Return the sequence number of this command.
-     *
-     * **WARNING:** If the sequence number hasn't been set before, this will create a new one.
-     * When sending messages, this should only happen immediately before serializing.
-     */
-    get sequenceNumber() {
-        if (this._sequenceNumber == undefined) {
+    sequenceNumber;
+    ensureSequenceNumber(securityManager) {
+        if (this.sequenceNumber == undefined) {
             if (this.isSinglecast()) {
-                this._sequenceNumber = this.securityManager
-                    .nextSequenceNumber(this.nodeId);
+                this.sequenceNumber = securityManager.nextSequenceNumber(this.nodeId);
             }
             else {
-                const groupId = this.getDestinationIDTX();
-                return this.securityManager.nextMulticastSequenceNumber(groupId);
+                const groupId = getDestinationIDTX.call(this);
+                this.sequenceNumber = securityManager
+                    .nextMulticastSequenceNumber(groupId);
             }
         }
-        return this._sequenceNumber;
     }
     encapsulated;
     extensions;
     prepareRetransmission() {
         super.prepareRetransmission();
-        this._sequenceNumber = undefined;
-    }
-    getDestinationIDTX() {
-        if (this.isSinglecast())
-            return this.nodeId;
-        const ret = this.getMulticastGroupId();
-        if (ret == undefined) {
-            throw new core_1.ZWaveError("Multicast Security S2 encapsulation requires the MGRP extension", core_1.ZWaveErrorCodes.Security2CC_MissingExtension);
-        }
-        return ret;
-    }
-    getDestinationIDRX() {
-        if (this.isSinglecast())
-            return this.host.ownNodeId;
-        const ret = this.getMulticastGroupId();
-        if (ret == undefined) {
-            throw new core_1.ZWaveError("Multicast Security S2 encapsulation requires the MGRP extension", core_1.ZWaveErrorCodes.Security2CC_MissingExtension);
-        }
-        return ret;
-    }
-    getMGRPExtension() {
-        return this.extensions.find((e) => e instanceof Extension_1.MGRPExtension);
-    }
-    getMulticastGroupId() {
-        const mgrpExtension = this.getMGRPExtension();
-        return mgrpExtension?.groupId;
-    }
-    getMPANExtension() {
-        return this.extensions.find((e) => e instanceof Extension_1.MPANExtension);
+        this.sequenceNumber = undefined;
     }
     hasMOSExtension() {
         return this.extensions.some((e) => e instanceof Extension_1.MOSExtension);
     }
     /** Returns the Sender's Entropy Input if this command contains an SPAN extension */
     getSenderEI() {
-        const spanExtension = this.extensions.find((e) => e instanceof Extension_1.SPANExtension);
-        return spanExtension?.senderEI;
+        return getSenderEI(this.extensions);
+    }
+    /** Returns the multicast group ID if this command contains an MGRP extension */
+    getMulticastGroupId() {
+        return getMulticastGroupId(this.extensions);
     }
-    maybeAddSPANExtension() {
+    maybeAddSPANExtension(ctx, securityManager) {
         if (!this.isSinglecast())
             return;
         const receiverNodeId = this.nodeId;
-        const spanState = this.securityManager.getSPANState(receiverNodeId);
+        const spanState = securityManager.getSPANState(receiverNodeId);
         if (spanState.type === core_1.SPANState.None
             || spanState.type === core_1.SPANState.LocalEI) {
             // Can't do anything here if we don't have the receiver's EI
@@ -997,21 +1136,21 @@ let Security2CCMessageEncapsulation = class Security2CCMessageEncapsulation exte
         else if (spanState.type === core_1.SPANState.RemoteEI) {
             // We have the receiver's EI, generate our input and send it over
             // With both, we can create an SPAN
-            const senderEI = this.securityManager.generateNonce(undefined);
+            const senderEI = securityManager.generateNonce(undefined);
             const receiverEI = spanState.receiverEI;
             // While bootstrapping a node, prefer the temporary key, unless the
             // specific command specifies a security class
             if (this.securityClass == undefined
-                && this.securityManager.tempKeys.has(receiverNodeId)) {
-                this.securityManager.initializeTempSPAN(receiverNodeId, senderEI, receiverEI);
+                && securityManager.tempKeys.has(receiverNodeId)) {
+                securityManager.initializeTempSPAN(receiverNodeId, senderEI, receiverEI);
             }
             else {
                 const securityClass = this.securityClass
-                    ?? this.host.getHighestSecurityClass(receiverNodeId);
+                    ?? ctx.getHighestSecurityClass(receiverNodeId);
                 if (securityClass == undefined) {
                     throw new core_1.ZWaveError("No security class defined for this command!", core_1.ZWaveErrorCodes.Security2CC_NoSPAN);
                 }
-                this.securityManager.initializeSPAN(receiverNodeId, securityClass, senderEI, receiverEI);
+                securityManager.initializeSPAN(receiverNodeId, securityClass, senderEI, receiverEI);
             }
             // Add or update the SPAN extension
             let spanExtension = this.extensions.find((e) => e instanceof Extension_1.SPANExtension);
@@ -1024,9 +1163,11 @@ let Security2CCMessageEncapsulation = class Security2CCMessageEncapsulation exte
             }
         }
     }
-    serialize() {
+    serialize(ctx) {
+        const securityManager = assertSecurityTX(ctx, this.nodeId);
+        this.ensureSequenceNumber(securityManager);
         // Include Sender EI in the command if we only have the receiver's EI
-        this.maybeAddSPANExtension();
+        this.maybeAddSPANExtension(ctx, securityManager);
         const unencryptedExtensions = this.extensions.filter((e) => !e.isEncrypted());
         const encryptedExtensions = this.extensions.filter((e) => e.isEncrypted());
         const unencryptedPayload = Buffer.concat([
@@ -1037,33 +1178,34 @@ let Security2CCMessageEncapsulation = class Security2CCMessageEncapsulation exte
             ]),
             ...unencryptedExtensions.map((e, index) => e.serialize(index < unencryptedExtensions.length - 1)),
         ]);
-        const serializedCC = this.encapsulated?.serialize() ?? Buffer.from([]);
+        const serializedCC = this.encapsulated?.serialize(ctx)
+            ?? Buffer.from([]);
         const plaintextPayload = Buffer.concat([
             ...encryptedExtensions.map((e, index) => e.serialize(index < encryptedExtensions.length - 1)),
             serializedCC,
         ]);
         // Generate the authentication data for CCM encryption
-        const destinationTag = this.getDestinationIDTX();
+        const destinationTag = getDestinationIDTX.call(this);
         const messageLength = this.computeEncapsulationOverhead()
             + serializedCC.length;
-        const authData = getAuthenticationData(this.host.ownNodeId, destinationTag, this.host.homeId, messageLength, unencryptedPayload);
+        const authData = getAuthenticationData(ctx.ownNodeId, destinationTag, ctx.homeId, messageLength, unencryptedPayload);
         let key;
         let iv;
         if (this.isSinglecast()) {
             // Singlecast:
             // Generate a nonce for encryption, and remember it to attempt decryption
             // of potential in-flight messages from the target node.
-            iv = this.securityManager.nextNonce(this.nodeId, true);
+            iv = securityManager.nextNonce(this.nodeId, true);
             const { keyCCM } = 
             // Prefer the overridden security class if it was given
             this.securityClass != undefined
-                ? this.securityManager.getKeysForSecurityClass(this.securityClass)
-                : this.securityManager.getKeysForNode(this.nodeId);
+                ? securityManager.getKeysForSecurityClass(this.securityClass)
+                : securityManager.getKeysForNode(this.nodeId);
             key = keyCCM;
         }
         else {
             // Multicast:
-            const keyAndIV = this.securityManager.getMulticastKeyAndIV(destinationTag);
+            const keyAndIV = securityManager.getMulticastKeyAndIV(destinationTag);
             key = keyAndIV.key;
             iv = keyAndIV.iv;
         }
@@ -1079,7 +1221,7 @@ let Security2CCMessageEncapsulation = class Security2CCMessageEncapsulation exte
             ciphertextPayload,
             authTag,
         ]);
-        return super.serialize();
+        return super.serialize(ctx);
     }
     computeEncapsulationOverhead() {
         // Security S2 adds:
@@ -1095,9 +1237,9 @@ let Security2CCMessageEncapsulation = class Security2CCMessageEncapsulation exte
             + core_1.SECURITY_S2_AUTH_TAG_LENGTH
             + extensionBytes);
     }
-    toLogEntry(host) {
+    toLogEntry(ctx) {
         const message = {
-            "sequence number": this.sequenceNumber,
+            "sequence number": this.sequenceNumber ?? "(not set)",
         };
         if (this.extensions.length > 0) {
             message.extensions = this.extensions
@@ -1126,210 +1268,77 @@ let Security2CCMessageEncapsulation = class Security2CCMessageEncapsulation exte
                 message["auth tag"] = (0, safe_2.buffer2hex)(this.authTag);
             }
         }
-        if (this.isSinglecast()) {
-            // TODO: This is ugly, we should probably do this in the constructor or so
-            let securityClass = this.securityClass;
-            if (securityClass == undefined) {
-                const spanState = this.securityManager.getSPANState(this.nodeId);
-                if (spanState.type === core_1.SPANState.SPAN) {
-                    securityClass = spanState.securityClass;
-                }
-            }
-            if (securityClass != undefined) {
-                message["security class"] = (0, safe_2.getEnumMemberName)(core_1.SecurityClass, securityClass);
-            }
+        if (this.securityClass != undefined) {
+            message["security class"] = (0, safe_2.getEnumMemberName)(core_1.SecurityClass, this.securityClass);
         }
         return {
-            ...super.toLogEntry(host),
+            ...super.toLogEntry(ctx),
             message,
         };
     }
-    decryptSinglecast(sendingNodeId, prevSequenceNumber, ciphertext, authData, authTag, spanState) {
-        const decryptWithNonce = (nonce) => {
-            const { keyCCM: key } = this.securityManager.getKeysForNode(sendingNodeId);
-            const iv = nonce;
-            return {
-                key,
-                iv,
-                ...(0, core_1.decryptAES128CCM)(key, iv, ciphertext, authData, authTag),
-            };
-        };
-        const getNonceAndDecrypt = () => {
-            const iv = this.securityManager.nextNonce(sendingNodeId);
-            return decryptWithNonce(iv);
-        };
-        if (spanState.type === core_1.SPANState.SPAN) {
-            // There SHOULD be a shared SPAN between both parties. But experience has shown that both could have
-            // sent a command at roughly the same time, using the same SPAN for encryption.
-            // To avoid a nasty desync and both nodes trying to resync at the same time, causing message loss,
-            // we accept commands encrypted with the previous SPAN under very specific circumstances:
-            if (
-            // The previous SPAN is still known, i.e. the node didn't send another command that was successfully decrypted
-            !!spanState.currentSPAN
-                // it is still valid
-                && spanState.currentSPAN.expires > (0, core_1.highResTimestamp)()
-                // The received command is exactly the next, expected one
-                && prevSequenceNumber != undefined
-                && this["_sequenceNumber"] === ((prevSequenceNumber + 1) & 0xff)
-                // And in case of a mock-based test, do this only on the controller
-                && !this.host.__internalIsMockNode) {
-                const nonce = spanState.currentSPAN.nonce;
-                spanState.currentSPAN = undefined;
-                // If we could decrypt this way, we're done...
-                const result = decryptWithNonce(nonce);
-                if (result.authOK) {
-                    return {
-                        ...result,
-                        securityClass: spanState.securityClass,
-                    };
-                }
-                // ...otherwise, we need to try the normal way
-            }
-            else {
-                // forgetting the current SPAN shouldn't be necessary but better be safe than sorry
-                spanState.currentSPAN = undefined;
-            }
-            // This can only happen if the security class is known
-            return {
-                ...getNonceAndDecrypt(),
-                securityClass: spanState.securityClass,
-            };
-        }
-        else if (spanState.type === core_1.SPANState.LocalEI) {
-            // We've sent the other our receiver's EI and received its sender's EI,
-            // meaning we can now establish an SPAN
-            const senderEI = this.getSenderEI();
-            if (!senderEI)
-                failNoSPAN();
-            const receiverEI = spanState.receiverEI;
-            // How we do this depends on whether we know the security class of the other node
-            const isBootstrappingNode = this.securityManager.tempKeys.has(sendingNodeId);
-            if (isBootstrappingNode) {
-                // We're currently bootstrapping the node, it might be using a temporary key
-                this.securityManager.initializeTempSPAN(sendingNodeId, senderEI, receiverEI);
-                const ret = getNonceAndDecrypt();
-                // Decryption with the temporary key worked
-                if (ret.authOK) {
-                    return {
-                        ...ret,
-                        securityClass: core_1.SecurityClass.Temporary,
-                    };
-                }
-                // Reset the SPAN state and try with the recently granted security class
-                this.securityManager.setSPANState(sendingNodeId, spanState);
-            }
-            // When ending up here, one of two situations has occured:
-            // a) We've taken over an existing network and do not know the node's security class
-            // b) We know the security class, but we're about to establish a new SPAN. This may happen at a lower
-            //    security class than the one the node normally uses, e.g. when we're being queried for securely
-            //    supported CCs.
-            // In both cases, we should simply try decoding with multiple security classes, starting from the highest one.
-            // If this fails, we restore the previous (partial) SPAN state.
-            // Try all security classes where we do not definitely know that it was not granted
-            // While bootstrapping a node, we consider the key that is being exchanged (including S0) to be the highest. No need to look at others
-            const possibleSecurityClasses = isBootstrappingNode
-                ? [this.host.getHighestSecurityClass(sendingNodeId)]
-                : core_1.securityClassOrder.filter((s) => this.host.hasSecurityClass(sendingNodeId, s)
-                    !== false);
-            for (const secClass of possibleSecurityClasses) {
-                // Skip security classes we don't have keys for
-                if (!this.securityManager.hasKeysForSecurityClass(secClass)) {
-                    continue;
-                }
-                // Initialize an SPAN with that security class
-                this.securityManager.initializeSPAN(sendingNodeId, secClass, senderEI, receiverEI);
-                const ret = getNonceAndDecrypt();
-                // It worked, return the result
-                if (ret.authOK) {
-                    // Also if we weren't sure before, we now know that the security class is granted
-                    if (this.host.hasSecurityClass(sendingNodeId, secClass)
-                        === undefined) {
-                        this.host.setSecurityClass(sendingNodeId, secClass, true);
-                    }
-                    return {
-                        ...ret,
-                        securityClass: secClass,
-                    };
-                }
-                else {
-                    // Reset the SPAN state and try with the next security class
-                    this.securityManager.setSPANState(sendingNodeId, spanState);
-                }
-            }
-        }
-        // Nothing worked, fail the decryption
-        return {
-            plaintext: Buffer.from([]),
-            authOK: false,
-            securityClass: undefined,
-        };
-    }
-    decryptMulticast(sendingNodeId, groupId, ciphertext, authData, authTag) {
-        const iv = this.securityManager.nextPeerMPAN(sendingNodeId, groupId);
-        const { keyCCM: key } = this.securityManager.getKeysForNode(sendingNodeId);
-        return {
-            key,
-            iv,
-            ...(0, core_1.decryptAES128CCM)(key, iv, ciphertext, authData, authTag),
-            // The security class is irrelevant when decrypting multicast commands
-            securityClass: undefined,
-        };
-    }
 };
 exports.Security2CCMessageEncapsulation = Security2CCMessageEncapsulation;
-exports.Security2CCMessageEncapsulation = Security2CCMessageEncapsulation = __decorate([
+exports.Security2CCMessageEncapsulation = Security2CCMessageEncapsulation = Security2CCMessageEncapsulation_1 = __decorate([
     (0, CommandClassDecorators_1.CCCommand)(_Types_1.Security2Command.MessageEncapsulation),
     (0, CommandClassDecorators_1.expectedCCResponse)(getCCResponseForMessageEncapsulation, testCCResponseForMessageEncapsulation)
 ], Security2CCMessageEncapsulation);
-let Security2CCNonceReport = class Security2CCNonceReport extends Security2CC {
-    constructor(host, options) {
-        super(host, options);
+let Security2CCNonceReport = Security2CCNonceReport_1 = class Security2CCNonceReport extends Security2CC {
+    constructor(options) {
+        super(options);
+        this.SOS = options.SOS;
+        this.MOS = options.MOS;
+        this.sequenceNumber = options.sequenceNumber;
+        if (options.SOS)
+            this.receiverEI = options.receiverEI;
+    }
+    static from(raw, ctx) {
         // Make sure that we can send/receive secure commands
-        assertSecurity.call(this, options);
-        this.securityManager = getSecurityManager(host, this.nodeId);
-        if ((0, CommandClass_1.gotDeserializationOptions)(options)) {
-            (0, core_1.validatePayload)(this.payload.length >= 2);
-            this._sequenceNumber = this.payload[0];
-            // Don't accept duplicate commands
-            validateSequenceNumber.call(this, this._sequenceNumber);
-            this.MOS = !!(this.payload[1] & 0b10);
-            this.SOS = !!(this.payload[1] & 0b1);
-            (0, core_1.validatePayload)(this.MOS || this.SOS);
-            if (this.SOS) {
-                // If the SOS flag is set, the REI field MUST be included in the command
-                (0, core_1.validatePayload)(this.payload.length >= 18);
-                this.receiverEI = this.payload.subarray(2, 18);
-                // In that case we also need to store it, so the next sent command
-                // can use it for encryption
-                this.securityManager.storeRemoteEI(this.nodeId, this.receiverEI);
-            }
+        const securityManager = assertSecurityRX(ctx);
+        (0, core_1.validatePayload)(raw.payload.length >= 2);
+        const sequenceNumber = raw.payload[0];
+        // Don't accept duplicate commands
+        validateSequenceNumber(securityManager, ctx.sourceNodeId, sequenceNumber);
+        const MOS = !!(raw.payload[1] & 0b10);
+        const SOS = !!(raw.payload[1] & 0b1);
+        if (SOS) {
+            // If the SOS flag is set, the REI field MUST be included in the command
+            (0, core_1.validatePayload)(raw.payload.length >= 18);
+            const receiverEI = raw.payload.subarray(2, 18);
+            // In that case we also need to store it, so the next sent command
+            // can use it for encryption
+            securityManager.storeRemoteEI(ctx.sourceNodeId, receiverEI);
+            return new Security2CCNonceReport_1({
+                nodeId: ctx.sourceNodeId,
+                sequenceNumber,
+                MOS,
+                SOS,
+                receiverEI,
+            });
+        }
+        else if (MOS) {
+            return new Security2CCNonceReport_1({
+                nodeId: ctx.sourceNodeId,
+                sequenceNumber,
+                MOS,
+                SOS: false,
+            });
         }
         else {
-            this.SOS = options.SOS;
-            this.MOS = options.MOS;
-            if (options.SOS)
-                this.receiverEI = options.receiverEI;
+            core_1.validatePayload.fail("Either MOS or SOS must be set");
         }
     }
-    securityManager;
-    _sequenceNumber;
-    /**
-     * Return the sequence number of this command.
-     *
-     * **WARNING:** If the sequence number hasn't been set before, this will create a new one.
-     * When sending messages, this should only happen immediately before serializing.
-     */
-    get sequenceNumber() {
-        if (this._sequenceNumber == undefined) {
-            this._sequenceNumber = this.securityManager
-                .nextSequenceNumber(this.nodeId);
+    sequenceNumber;
+    ensureSequenceNumber(securityManager) {
+        if (this.sequenceNumber == undefined) {
+            this.sequenceNumber = securityManager.nextSequenceNumber(this.nodeId);
         }
-        return this._sequenceNumber;
     }
     SOS;
     MOS;
     receiverEI;
-    serialize() {
+    serialize(ctx) {
+        const securityManager = assertSecurityTX(ctx, this.nodeId);
+        this.ensureSequenceNumber(securityManager);
         this.payload = Buffer.from([
             this.sequenceNumber,
             (this.MOS ? 0b10 : 0) + (this.SOS ? 0b1 : 0),
@@ -1337,11 +1346,11 @@ let Security2CCNonceReport = class Security2CCNonceReport extends Security2CC {
         if (this.SOS) {
             this.payload = Buffer.concat([this.payload, this.receiverEI]);
         }
-        return super.serialize();
+        return super.serialize(ctx);
     }
-    toLogEntry(host) {
+    toLogEntry(ctx) {
         const message = {
-            "sequence number": this.sequenceNumber,
+            "sequence number": this.sequenceNumber ?? "(not set)",
             SOS: this.SOS,
             MOS: this.MOS,
         };
@@ -1349,86 +1358,88 @@ let Security2CCNonceReport = class Security2CCNonceReport extends Security2CC {
             message["receiver entropy"] = (0, safe_2.buffer2hex)(this.receiverEI);
         }
         return {
-            ...super.toLogEntry(host),
+            ...super.toLogEntry(ctx),
             message,
         };
     }
 };
 exports.Security2CCNonceReport = Security2CCNonceReport;
-exports.Security2CCNonceReport = Security2CCNonceReport = __decorate([
+exports.Security2CCNonceReport = Security2CCNonceReport = Security2CCNonceReport_1 = __decorate([
     (0, CommandClassDecorators_1.CCCommand)(_Types_1.Security2Command.NonceReport)
 ], Security2CCNonceReport);
-let Security2CCNonceGet = class Security2CCNonceGet extends Security2CC {
+let Security2CCNonceGet = Security2CCNonceGet_1 = class Security2CCNonceGet extends Security2CC {
     // TODO: A node sending this command MUST accept a delay up to <Previous Round-trip-time to peer node> +
     // 250 ms before receiving the Security 2 Nonce Report Command.
-    constructor(host, options) {
-        super(host, options);
-        // Make sure that we can send/receive secure commands
-        assertSecurity.call(this, options);
-        this.securityManager = getSecurityManager(host, this.nodeId);
-        if ((0, CommandClass_1.gotDeserializationOptions)(options)) {
-            (0, core_1.validatePayload)(this.payload.length >= 1);
-            this._sequenceNumber = this.payload[0];
-            // Don't accept duplicate commands
-            validateSequenceNumber.call(this, this._sequenceNumber);
-        }
-        else {
-            // No options here
-        }
+    constructor(options) {
+        super(options);
+        this.sequenceNumber = options.sequenceNumber;
+    }
+    static from(raw, ctx) {
+        const securityManager = assertSecurityRX(ctx);
+        (0, core_1.validatePayload)(raw.payload.length >= 1);
+        const sequenceNumber = raw.payload[0];
+        // Don't accept duplicate commands
+        validateSequenceNumber(securityManager, ctx.sourceNodeId, sequenceNumber);
+        return new Security2CCNonceGet_1({
+            nodeId: ctx.sourceNodeId,
+            sequenceNumber,
+        });
     }
-    securityManager;
-    _sequenceNumber;
-    /**
-     * Return the sequence number of this command.
-     *
-     * **WARNING:** If the sequence number hasn't been set before, this will create a new one.
-     * When sending messages, this should only happen immediately before serializing.
-     */
-    get sequenceNumber() {
-        if (this._sequenceNumber == undefined) {
-            this._sequenceNumber = this.securityManager
-                .nextSequenceNumber(this.nodeId);
+    sequenceNumber;
+    ensureSequenceNumber(securityManager) {
+        if (this.sequenceNumber == undefined) {
+            this.sequenceNumber = securityManager.nextSequenceNumber(this.nodeId);
         }
-        return this._sequenceNumber;
     }
-    serialize() {
+    serialize(ctx) {
+        const securityManager = assertSecurityTX(ctx, this.nodeId);
+        this.ensureSequenceNumber(securityManager);
         this.payload = Buffer.from([this.sequenceNumber]);
-        return super.serialize();
+        return super.serialize(ctx);
     }
-    toLogEntry(host) {
+    toLogEntry(ctx) {
         return {
-            ...super.toLogEntry(host),
-            message: { "sequence number": this.sequenceNumber },
+            ...super.toLogEntry(ctx),
+            message: {
+                "sequence number": this.sequenceNumber ?? "(not set)",
+            },
         };
     }
 };
 exports.Security2CCNonceGet = Security2CCNonceGet;
-exports.Security2CCNonceGet = Security2CCNonceGet = __decorate([
+exports.Security2CCNonceGet = Security2CCNonceGet = Security2CCNonceGet_1 = __decorate([
     (0, CommandClassDecorators_1.CCCommand)(_Types_1.Security2Command.NonceGet),
     (0, CommandClassDecorators_1.expectedCCResponse)(Security2CCNonceReport)
 ], Security2CCNonceGet);
-let Security2CCKEXReport = class Security2CCKEXReport extends Security2CC {
-    constructor(host, options) {
-        super(host, options);
-        if ((0, CommandClass_1.gotDeserializationOptions)(options)) {
-            (0, core_1.validatePayload)(this.payload.length >= 4);
-            this.requestCSA = !!(this.payload[0] & 0b10);
-            this.echo = !!(this.payload[0] & 0b1);
-            // Remember the reserved bits for the echo
-            this._reserved = this.payload[0] & 0b1111_1100;
-            // The bit mask starts at 0, but bit 0 is not used
-            this.supportedKEXSchemes = (0, core_1.parseBitMask)(this.payload.subarray(1, 2), 0).filter((s) => s !== 0);
-            this.supportedECDHProfiles = (0, core_1.parseBitMask)(this.payload.subarray(2, 3), shared_1.ECDHProfiles.Curve25519);
-            this.requestedKeys = (0, core_1.parseBitMask)(this.payload.subarray(3, 4), core_1.SecurityClass.S2_Unauthenticated);
-        }
-        else {
-            this.requestCSA = options.requestCSA;
-            this.echo = options.echo;
-            this._reserved = options._reserved ?? 0;
-            this.supportedKEXSchemes = options.supportedKEXSchemes;
-            this.supportedECDHProfiles = options.supportedECDHProfiles;
-            this.requestedKeys = options.requestedKeys;
-        }
+let Security2CCKEXReport = Security2CCKEXReport_1 = class Security2CCKEXReport extends Security2CC {
+    constructor(options) {
+        super(options);
+        this.requestCSA = options.requestCSA;
+        this.echo = options.echo;
+        this._reserved = options._reserved ?? 0;
+        this.supportedKEXSchemes = options.supportedKEXSchemes;
+        this.supportedECDHProfiles = options.supportedECDHProfiles;
+        this.requestedKeys = options.requestedKeys;
+    }
+    static from(raw, ctx) {
+        (0, core_1.validatePayload)(raw.payload.length >= 4);
+        const requestCSA = !!(raw.payload[0] & 0b10);
+        const echo = !!(raw.payload[0] & 0b1);
+        // Remember the reserved bits for the echo
+        const _reserved = raw.payload[0] & 0b1111_1100;
+        // The bit mask starts at 0, but bit 0 is not used
+        const supportedKEXSchemes = (0, core_1.parseBitMask)(raw.payload.subarray(1, 2), 0).filter((s) => s !== 0);
+        const supportedECDHProfiles = (0, core_1.parseBitMask)(raw.payload.subarray(2, 3), shared_1.ECDHProfiles.Curve25519);
+        const requestedKeys = (0, core_1.parseBitMask)(raw.payload.subarray(3, 4), core_1.SecurityClass.S2_Unauthenticated);
+        return new Security2CCKEXReport_1({
+            nodeId: ctx.sourceNodeId,
+            requestCSA,
+            echo,
+            _reserved,
+            supportedKEXSchemes,
+            supportedECDHProfiles,
+            requestedKeys,
+        });
     }
     _reserved;
     requestCSA;
@@ -1436,7 +1447,7 @@ let Security2CCKEXReport = class Security2CCKEXReport extends Security2CC {
     supportedKEXSchemes;
     supportedECDHProfiles;
     requestedKeys;
-    serialize() {
+    serialize(ctx) {
         this.payload = Buffer.concat([
             Buffer.from([
                 this._reserved
@@ -1448,11 +1459,11 @@ let Security2CCKEXReport = class Security2CCKEXReport extends Security2CC {
             (0, core_1.encodeBitMask)(this.supportedECDHProfiles, 7, shared_1.ECDHProfiles.Curve25519),
             (0, core_1.encodeBitMask)(this.requestedKeys, core_1.SecurityClass.S0_Legacy, core_1.SecurityClass.S2_Unauthenticated),
         ]);
-        return super.serialize();
+        return super.serialize(ctx);
     }
-    toLogEntry(host) {
+    toLogEntry(ctx) {
         return {
-            ...super.toLogEntry(host),
+            ...super.toLogEntry(ctx),
             message: {
                 echo: this.echo,
                 "supported schemes": this.supportedKEXSchemes
@@ -1470,7 +1481,7 @@ let Security2CCKEXReport = class Security2CCKEXReport extends Security2CC {
     }
 };
 exports.Security2CCKEXReport = Security2CCKEXReport;
-exports.Security2CCKEXReport = Security2CCKEXReport = __decorate([
+exports.Security2CCKEXReport = Security2CCKEXReport = Security2CCKEXReport_1 = __decorate([
     (0, CommandClassDecorators_1.CCCommand)(_Types_1.Security2Command.KEXReport)
 ], Security2CCKEXReport);
 let Security2CCKEXGet = class Security2CCKEXGet extends Security2CC {
@@ -1499,31 +1510,38 @@ function testExpectedResponseForKEXSet(sent, received) {
     }
     return false;
 }
-let Security2CCKEXSet = class Security2CCKEXSet extends Security2CC {
-    constructor(host, options) {
-        super(host, options);
-        if ((0, CommandClass_1.gotDeserializationOptions)(options)) {
-            (0, core_1.validatePayload)(this.payload.length >= 4);
-            this._reserved = this.payload[0] & 0b1111_1100;
-            this.permitCSA = !!(this.payload[0] & 0b10);
-            this.echo = !!(this.payload[0] & 0b1);
-            // The bit mask starts at 0, but bit 0 is not used
-            const selectedKEXSchemes = (0, core_1.parseBitMask)(this.payload.subarray(1, 2), 0).filter((s) => s !== 0);
-            (0, core_1.validatePayload)(selectedKEXSchemes.length === 1);
-            this.selectedKEXScheme = selectedKEXSchemes[0];
-            const selectedECDHProfiles = (0, core_1.parseBitMask)(this.payload.subarray(2, 3), shared_1.ECDHProfiles.Curve25519);
-            (0, core_1.validatePayload)(selectedECDHProfiles.length === 1);
-            this.selectedECDHProfile = selectedECDHProfiles[0];
-            this.grantedKeys = (0, core_1.parseBitMask)(this.payload.subarray(3, 4), core_1.SecurityClass.S2_Unauthenticated);
-        }
-        else {
-            this.permitCSA = options.permitCSA;
-            this.echo = options.echo;
-            this._reserved = options._reserved ?? 0;
-            this.selectedKEXScheme = options.selectedKEXScheme;
-            this.selectedECDHProfile = options.selectedECDHProfile;
-            this.grantedKeys = options.grantedKeys;
-        }
+let Security2CCKEXSet = Security2CCKEXSet_1 = class Security2CCKEXSet extends Security2CC {
+    constructor(options) {
+        super(options);
+        this.permitCSA = options.permitCSA;
+        this.echo = options.echo;
+        this._reserved = options._reserved ?? 0;
+        this.selectedKEXScheme = options.selectedKEXScheme;
+        this.selectedECDHProfile = options.selectedECDHProfile;
+        this.grantedKeys = options.grantedKeys;
+    }
+    static from(raw, ctx) {
+        (0, core_1.validatePayload)(raw.payload.length >= 4);
+        const _reserved = raw.payload[0] & 0b1111_1100;
+        const permitCSA = !!(raw.payload[0] & 0b10);
+        const echo = !!(raw.payload[0] & 0b1);
+        // The bit mask starts at 0, but bit 0 is not used
+        const selectedKEXSchemes = (0, core_1.parseBitMask)(raw.payload.subarray(1, 2), 0).filter((s) => s !== 0);
+        (0, core_1.validatePayload)(selectedKEXSchemes.length === 1);
+        const selectedKEXScheme = selectedKEXSchemes[0];
+        const selectedECDHProfiles = (0, core_1.parseBitMask)(raw.payload.subarray(2, 3), shared_1.ECDHProfiles.Curve25519);
+        (0, core_1.validatePayload)(selectedECDHProfiles.length === 1);
+        const selectedECDHProfile = selectedECDHProfiles[0];
+        const grantedKeys = (0, core_1.parseBitMask)(raw.payload.subarray(3, 4), core_1.SecurityClass.S2_Unauthenticated);
+        return new Security2CCKEXSet_1({
+            nodeId: ctx.sourceNodeId,
+            _reserved,
+            permitCSA,
+            echo,
+            selectedKEXScheme,
+            selectedECDHProfile,
+            grantedKeys,
+        });
     }
     _reserved;
     permitCSA;
@@ -1531,7 +1549,7 @@ let Security2CCKEXSet = class Security2CCKEXSet extends Security2CC {
     selectedKEXScheme;
     selectedECDHProfile;
     grantedKeys;
-    serialize() {
+    serialize(ctx) {
         this.payload = Buffer.concat([
             Buffer.from([
                 this._reserved
@@ -1543,11 +1561,11 @@ let Security2CCKEXSet = class Security2CCKEXSet extends Security2CC {
             (0, core_1.encodeBitMask)([this.selectedECDHProfile], 7, shared_1.ECDHProfiles.Curve25519),
             (0, core_1.encodeBitMask)(this.grantedKeys, core_1.SecurityClass.S0_Legacy, core_1.SecurityClass.S2_Unauthenticated),
         ]);
-        return super.serialize();
+        return super.serialize(ctx);
     }
-    toLogEntry(host) {
+    toLogEntry(ctx) {
         return {
-            ...super.toLogEntry(host),
+            ...super.toLogEntry(ctx),
             message: {
                 echo: this.echo,
                 "selected scheme": (0, safe_2.getEnumMemberName)(shared_1.KEXSchemes, this.selectedKEXScheme),
@@ -1561,62 +1579,67 @@ let Security2CCKEXSet = class Security2CCKEXSet extends Security2CC {
     }
 };
 exports.Security2CCKEXSet = Security2CCKEXSet;
-exports.Security2CCKEXSet = Security2CCKEXSet = __decorate([
+exports.Security2CCKEXSet = Security2CCKEXSet = Security2CCKEXSet_1 = __decorate([
     (0, CommandClassDecorators_1.CCCommand)(_Types_1.Security2Command.KEXSet),
     (0, CommandClassDecorators_1.expectedCCResponse)(getExpectedResponseForKEXSet, testExpectedResponseForKEXSet)
 ], Security2CCKEXSet);
-let Security2CCKEXFail = class Security2CCKEXFail extends Security2CC {
-    constructor(host, options) {
-        super(host, options);
-        if ((0, CommandClass_1.gotDeserializationOptions)(options)) {
-            (0, core_1.validatePayload)(this.payload.length >= 1);
-            this.failType = this.payload[0];
-        }
-        else {
-            this.failType = options.failType;
-        }
+let Security2CCKEXFail = Security2CCKEXFail_1 = class Security2CCKEXFail extends Security2CC {
+    constructor(options) {
+        super(options);
+        this.failType = options.failType;
+    }
+    static from(raw, ctx) {
+        (0, core_1.validatePayload)(raw.payload.length >= 1);
+        const failType = raw.payload[0];
+        return new Security2CCKEXFail_1({
+            nodeId: ctx.sourceNodeId,
+            failType,
+        });
     }
     failType;
-    serialize() {
+    serialize(ctx) {
         this.payload = Buffer.from([this.failType]);
-        return super.serialize();
+        return super.serialize(ctx);
     }
-    toLogEntry(host) {
+    toLogEntry(ctx) {
         return {
-            ...super.toLogEntry(host),
+            ...super.toLogEntry(ctx),
             message: { reason: (0, safe_2.getEnumMemberName)(shared_1.KEXFailType, this.failType) },
         };
     }
 };
 exports.Security2CCKEXFail = Security2CCKEXFail;
-exports.Security2CCKEXFail = Security2CCKEXFail = __decorate([
+exports.Security2CCKEXFail = Security2CCKEXFail = Security2CCKEXFail_1 = __decorate([
     (0, CommandClassDecorators_1.CCCommand)(_Types_1.Security2Command.KEXFail)
 ], Security2CCKEXFail);
-let Security2CCPublicKeyReport = class Security2CCPublicKeyReport extends Security2CC {
-    constructor(host, options) {
-        super(host, options);
-        if ((0, CommandClass_1.gotDeserializationOptions)(options)) {
-            (0, core_1.validatePayload)(this.payload.length >= 17);
-            this.includingNode = !!(this.payload[0] & 0b1);
-            this.publicKey = this.payload.subarray(1);
-        }
-        else {
-            this.includingNode = options.includingNode;
-            this.publicKey = options.publicKey;
-        }
+let Security2CCPublicKeyReport = Security2CCPublicKeyReport_1 = class Security2CCPublicKeyReport extends Security2CC {
+    constructor(options) {
+        super(options);
+        this.includingNode = options.includingNode;
+        this.publicKey = options.publicKey;
+    }
+    static from(raw, ctx) {
+        (0, core_1.validatePayload)(raw.payload.length >= 17);
+        const includingNode = !!(raw.payload[0] & 0b1);
+        const publicKey = raw.payload.subarray(1);
+        return new Security2CCPublicKeyReport_1({
+            nodeId: ctx.sourceNodeId,
+            includingNode,
+            publicKey,
+        });
     }
     includingNode;
     publicKey;
-    serialize() {
+    serialize(ctx) {
         this.payload = Buffer.concat([
             Buffer.from([this.includingNode ? 1 : 0]),
             this.publicKey,
         ]);
-        return super.serialize();
+        return super.serialize(ctx);
     }
-    toLogEntry(host) {
+    toLogEntry(ctx) {
         return {
-            ...super.toLogEntry(host),
+            ...super.toLogEntry(ctx),
             message: {
                 "is including node": this.includingNode,
                 "public key": (0, safe_2.buffer2hex)(this.publicKey),
@@ -1625,34 +1648,37 @@ let Security2CCPublicKeyReport = class Security2CCPublicKeyReport extends Securi
     }
 };
 exports.Security2CCPublicKeyReport = Security2CCPublicKeyReport;
-exports.Security2CCPublicKeyReport = Security2CCPublicKeyReport = __decorate([
+exports.Security2CCPublicKeyReport = Security2CCPublicKeyReport = Security2CCPublicKeyReport_1 = __decorate([
     (0, CommandClassDecorators_1.CCCommand)(_Types_1.Security2Command.PublicKeyReport)
 ], Security2CCPublicKeyReport);
-let Security2CCNetworkKeyReport = class Security2CCNetworkKeyReport extends Security2CC {
-    constructor(host, options) {
-        super(host, options);
-        if ((0, CommandClass_1.gotDeserializationOptions)(options)) {
-            (0, core_1.validatePayload)(this.payload.length >= 17);
-            this.grantedKey = bitMaskToSecurityClass(this.payload, 0);
-            this.networkKey = this.payload.subarray(1, 17);
-        }
-        else {
-            this.grantedKey = options.grantedKey;
-            this.networkKey = options.networkKey;
-        }
+let Security2CCNetworkKeyReport = Security2CCNetworkKeyReport_1 = class Security2CCNetworkKeyReport extends Security2CC {
+    constructor(options) {
+        super(options);
+        this.grantedKey = options.grantedKey;
+        this.networkKey = options.networkKey;
+    }
+    static from(raw, ctx) {
+        (0, core_1.validatePayload)(raw.payload.length >= 17);
+        const grantedKey = bitMaskToSecurityClass(raw.payload, 0);
+        const networkKey = raw.payload.subarray(1, 17);
+        return new Security2CCNetworkKeyReport_1({
+            nodeId: ctx.sourceNodeId,
+            grantedKey,
+            networkKey,
+        });
     }
     grantedKey;
     networkKey;
-    serialize() {
+    serialize(ctx) {
         this.payload = Buffer.concat([
             securityClassToBitMask(this.grantedKey),
             this.networkKey,
         ]);
-        return super.serialize();
+        return super.serialize(ctx);
     }
-    toLogEntry(host) {
+    toLogEntry(ctx) {
         return {
-            ...super.toLogEntry(host),
+            ...super.toLogEntry(ctx),
             message: {
                 "security class": (0, safe_2.getEnumMemberName)(core_1.SecurityClass, this.grantedKey),
                 // This shouldn't be logged, so users can safely post their logs online
@@ -1662,28 +1688,30 @@ let Security2CCNetworkKeyReport = class Security2CCNetworkKeyReport extends Secu
     }
 };
 exports.Security2CCNetworkKeyReport = Security2CCNetworkKeyReport;
-exports.Security2CCNetworkKeyReport = Security2CCNetworkKeyReport = __decorate([
+exports.Security2CCNetworkKeyReport = Security2CCNetworkKeyReport = Security2CCNetworkKeyReport_1 = __decorate([
     (0, CommandClassDecorators_1.CCCommand)(_Types_1.Security2Command.NetworkKeyReport)
 ], Security2CCNetworkKeyReport);
-let Security2CCNetworkKeyGet = class Security2CCNetworkKeyGet extends Security2CC {
-    constructor(host, options) {
-        super(host, options);
-        if ((0, CommandClass_1.gotDeserializationOptions)(options)) {
-            (0, core_1.validatePayload)(this.payload.length >= 1);
-            this.requestedKey = bitMaskToSecurityClass(this.payload, 0);
-        }
-        else {
-            this.requestedKey = options.requestedKey;
-        }
+let Security2CCNetworkKeyGet = Security2CCNetworkKeyGet_1 = class Security2CCNetworkKeyGet extends Security2CC {
+    constructor(options) {
+        super(options);
+        this.requestedKey = options.requestedKey;
+    }
+    static from(raw, ctx) {
+        (0, core_1.validatePayload)(raw.payload.length >= 1);
+        const requestedKey = bitMaskToSecurityClass(raw.payload, 0);
+        return new Security2CCNetworkKeyGet_1({
+            nodeId: ctx.sourceNodeId,
+            requestedKey,
+        });
     }
     requestedKey;
-    serialize() {
+    serialize(ctx) {
         this.payload = securityClassToBitMask(this.requestedKey);
-        return super.serialize();
+        return super.serialize(ctx);
     }
-    toLogEntry(host) {
+    toLogEntry(ctx) {
         return {
-            ...super.toLogEntry(host),
+            ...super.toLogEntry(ctx),
             message: {
                 "security class": (0, safe_2.getEnumMemberName)(core_1.SecurityClass, this.requestedKey),
             },
@@ -1691,7 +1719,7 @@ let Security2CCNetworkKeyGet = class Security2CCNetworkKeyGet extends Security2C
     }
 };
 exports.Security2CCNetworkKeyGet = Security2CCNetworkKeyGet;
-exports.Security2CCNetworkKeyGet = Security2CCNetworkKeyGet = __decorate([
+exports.Security2CCNetworkKeyGet = Security2CCNetworkKeyGet = Security2CCNetworkKeyGet_1 = __decorate([
     (0, CommandClassDecorators_1.CCCommand)(_Types_1.Security2Command.NetworkKeyGet)
     // Don't expect a response - we need to distinguish between Report and Fail
     // FIXME: maybe use the dynamic @expectedCCResponse instead?
@@ -1702,30 +1730,33 @@ exports.Security2CCNetworkKeyVerify = Security2CCNetworkKeyVerify;
 exports.Security2CCNetworkKeyVerify = Security2CCNetworkKeyVerify = __decorate([
     (0, CommandClassDecorators_1.CCCommand)(_Types_1.Security2Command.NetworkKeyVerify)
 ], Security2CCNetworkKeyVerify);
-let Security2CCTransferEnd = class Security2CCTransferEnd extends Security2CC {
-    constructor(host, options) {
-        super(host, options);
-        if ((0, CommandClass_1.gotDeserializationOptions)(options)) {
-            (0, core_1.validatePayload)(this.payload.length >= 1);
-            this.keyVerified = !!(this.payload[0] & 0b10);
-            this.keyRequestComplete = !!(this.payload[0] & 0b1);
-        }
-        else {
-            this.keyVerified = options.keyVerified;
-            this.keyRequestComplete = options.keyRequestComplete;
-        }
+let Security2CCTransferEnd = Security2CCTransferEnd_1 = class Security2CCTransferEnd extends Security2CC {
+    constructor(options) {
+        super(options);
+        this.keyVerified = options.keyVerified;
+        this.keyRequestComplete = options.keyRequestComplete;
+    }
+    static from(raw, ctx) {
+        (0, core_1.validatePayload)(raw.payload.length >= 1);
+        const keyVerified = !!(raw.payload[0] & 0b10);
+        const keyRequestComplete = !!(raw.payload[0] & 0b1);
+        return new Security2CCTransferEnd_1({
+            nodeId: ctx.sourceNodeId,
+            keyVerified,
+            keyRequestComplete,
+        });
     }
     keyVerified;
     keyRequestComplete;
-    serialize() {
+    serialize(ctx) {
         this.payload = Buffer.from([
             (this.keyVerified ? 0b10 : 0) + (this.keyRequestComplete ? 0b1 : 0),
         ]);
-        return super.serialize();
+        return super.serialize(ctx);
     }
-    toLogEntry(host) {
+    toLogEntry(ctx) {
         return {
-            ...super.toLogEntry(host),
+            ...super.toLogEntry(ctx),
             message: {
                 "key verified": this.keyVerified,
                 "request complete": this.keyRequestComplete,
@@ -1734,32 +1765,34 @@ let Security2CCTransferEnd = class Security2CCTransferEnd extends Security2CC {
     }
 };
 exports.Security2CCTransferEnd = Security2CCTransferEnd;
-exports.Security2CCTransferEnd = Security2CCTransferEnd = __decorate([
+exports.Security2CCTransferEnd = Security2CCTransferEnd = Security2CCTransferEnd_1 = __decorate([
     (0, CommandClassDecorators_1.CCCommand)(_Types_1.Security2Command.TransferEnd)
 ], Security2CCTransferEnd);
-let Security2CCCommandsSupportedReport = class Security2CCCommandsSupportedReport extends Security2CC {
-    constructor(host, options) {
-        super(host, options);
-        if ((0, CommandClass_1.gotDeserializationOptions)(options)) {
-            const CCs = (0, core_1.parseCCList)(this.payload);
-            // SDS13783: A sending node MAY terminate the list of supported command classes with the
-            // COMMAND_CLASS_MARK command class identifier.
-            // A receiving node MUST stop parsing the list of supported command classes if it detects the
-            // COMMAND_CLASS_MARK command class identifier in the Security 2 Commands Supported Report
-            this.supportedCCs = CCs.supportedCCs;
-        }
-        else {
-            this.supportedCCs = options.supportedCCs;
-        }
+let Security2CCCommandsSupportedReport = Security2CCCommandsSupportedReport_1 = class Security2CCCommandsSupportedReport extends Security2CC {
+    constructor(options) {
+        super(options);
+        this.supportedCCs = options.supportedCCs;
+    }
+    static from(raw, ctx) {
+        const CCs = (0, core_1.parseCCList)(raw.payload);
+        // SDS13783: A sending node MAY terminate the list of supported command classes with the
+        // COMMAND_CLASS_MARK command class identifier.
+        // A receiving node MUST stop parsing the list of supported command classes if it detects the
+        // COMMAND_CLASS_MARK command class identifier in the Security 2 Commands Supported Report
+        const supportedCCs = CCs.supportedCCs;
+        return new Security2CCCommandsSupportedReport_1({
+            nodeId: ctx.sourceNodeId,
+            supportedCCs,
+        });
     }
     supportedCCs;
-    serialize() {
+    serialize(ctx) {
         this.payload = (0, safe_1.encodeCCList)(this.supportedCCs, []);
-        return super.serialize();
+        return super.serialize(ctx);
     }
-    toLogEntry(host) {
+    toLogEntry(ctx) {
         return {
-            ...super.toLogEntry(host),
+            ...super.toLogEntry(ctx),
             message: {
                 "supported CCs": this.supportedCCs
                     .map((cc) => (0, core_1.getCCName)(cc))
@@ -1770,7 +1803,7 @@ let Security2CCCommandsSupportedReport = class Security2CCCommandsSupportedRepor
     }
 };
 exports.Security2CCCommandsSupportedReport = Security2CCCommandsSupportedReport;
-exports.Security2CCCommandsSupportedReport = Security2CCCommandsSupportedReport = __decorate([
+exports.Security2CCCommandsSupportedReport = Security2CCCommandsSupportedReport = Security2CCCommandsSupportedReport_1 = __decorate([
     (0, CommandClassDecorators_1.CCCommand)(_Types_1.Security2Command.CommandsSupportedReport)
 ], Security2CCCommandsSupportedReport);
 let Security2CCCommandsSupportedGet = class Security2CCCommandsSupportedGet extends Security2CC {