@zwave-js/cc 13.10.1 → 14.0.0-beta.0

package/build/cc/SecurityCC.js

@@ -5,7 +5,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
     else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var SecurityCC_1;
+var SecurityCC_1, SecurityCCNonceReport_1, SecurityCCCommandEncapsulation_1, SecurityCCSchemeReport_1, SecurityCCNetworkKeySet_1, SecurityCCCommandsSupportedReport_1;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SecurityCCCommandsSupportedGet = exports.SecurityCCCommandsSupportedReport = exports.SecurityCCNetworkKeySet = exports.SecurityCCNetworkKeyVerify = exports.SecurityCCSchemeInherit = exports.SecurityCCSchemeGet = exports.SecurityCCSchemeReport = exports.SecurityCCCommandEncapsulationNonceGet = exports.SecurityCCCommandEncapsulation = exports.SecurityCCNonceGet = exports.SecurityCCNonceReport = exports.SecurityCC = exports.SecurityCCAPI = void 0;
 const core_1 = require("@zwave-js/core");
@@ -40,6 +40,22 @@ function throwNoNonce(reason) {
     throw new core_1.ZWaveError(message, core_1.ZWaveErrorCodes.SecurityCC_NoNonce);
 }
 const HALF_NONCE_SIZE = 8;
+function assertSecurityRX(ctx) {
+    if (!ctx.ownNodeId) {
+        throw new core_1.ZWaveError(`Secure commands (S0) can only be decoded when the controller's node id is known!`, core_1.ZWaveErrorCodes.Driver_NotReady);
+    }
+    if (!ctx.securityManager) {
+        throw new core_1.ZWaveError(`Secure commands (S0) can only be decoded when the security manager is set up!`, core_1.ZWaveErrorCodes.Driver_NoSecurity);
+    }
+}
+function assertSecurityTX(ctx) {
+    if (!ctx.ownNodeId) {
+        throw new core_1.ZWaveError(`Secure commands (S0) can only be sent when the controller's node id is known!`, core_1.ZWaveErrorCodes.Driver_NotReady);
+    }
+    if (!ctx.securityManager) {
+        throw new core_1.ZWaveError(`Secure commands (S0) can only be sent when the security manager is set up!`, core_1.ZWaveErrorCodes.Driver_NoSecurity);
+    }
+}
 // TODO: Ignore commands if received via multicast
 // Encapsulation CCs are used internally and too frequently that we
 // want to pay the cost of validating each call
@@ -58,22 +74,22 @@ let SecurityCCAPI = class SecurityCCAPI extends API_1.PhysicalCCAPI {
         }
         const cc = new (requestNextNonce
             ? SecurityCCCommandEncapsulationNonceGet
-            : SecurityCCCommandEncapsulation)(this.applHost, {
+            : SecurityCCCommandEncapsulation)({
             nodeId: this.endpoint.nodeId,
             encapsulated,
         });
-        await this.applHost.sendCommand(cc, this.commandOptions);
+        await this.host.sendCommand(cc, this.commandOptions);
     }
     /**
      * Requests a new nonce for Security CC encapsulation which is not directly linked to a specific command.
      */
     async getNonce() {
         this.assertSupportsCommand(_Types_1.SecurityCommand, _Types_1.SecurityCommand.NonceGet);
-        const cc = new SecurityCCNonceGet(this.applHost, {
+        const cc = new SecurityCCNonceGet({
             nodeId: this.endpoint.nodeId,
-            endpoint: this.endpoint.index,
+            endpointIndex: this.endpoint.index,
         });
-        const response = await this.applHost.sendCommand(cc, {
+        const response = await this.host.sendCommand(cc, {
             ...this.commandOptions,
             // Only try getting a nonce once
             maxSendAttempts: 1,
@@ -81,11 +97,11 @@ let SecurityCCAPI = class SecurityCCAPI extends API_1.PhysicalCCAPI {
         if (!response)
             return;
         const nonce = response.nonce;
-        const secMan = this.applHost.securityManager;
+        const secMan = this.host.securityManager;
         secMan.setNonce({
             issuer: this.endpoint.nodeId,
             nonceId: secMan.getNonceId(nonce),
-        }, { nonce, receiver: this.applHost.ownNodeId }, { free: true });
+        }, { nonce, receiver: this.host.ownNodeId }, { free: true });
         return nonce;
     }
     /**
@@ -94,18 +110,18 @@ let SecurityCCAPI = class SecurityCCAPI extends API_1.PhysicalCCAPI {
      */
     async sendNonce() {
         this.assertSupportsCommand(_Types_1.SecurityCommand, _Types_1.SecurityCommand.NonceReport);
-        if (!this.applHost.securityManager) {
+        if (!this.host.securityManager) {
             throw new core_1.ZWaveError(`Nonces can only be sent if secure communication is set up!`, core_1.ZWaveErrorCodes.Driver_NoSecurity);
         }
-        const nonce = this.applHost.securityManager.generateNonce(this.endpoint.nodeId, HALF_NONCE_SIZE);
-        const nonceId = this.applHost.securityManager.getNonceId(nonce);
-        const cc = new SecurityCCNonceReport(this.applHost, {
+        const nonce = this.host.securityManager.generateNonce(this.endpoint.nodeId, HALF_NONCE_SIZE);
+        const nonceId = this.host.securityManager.getNonceId(nonce);
+        const cc = new SecurityCCNonceReport({
             nodeId: this.endpoint.nodeId,
-            endpoint: this.endpoint.index,
+            endpointIndex: this.endpoint.index,
             nonce,
         });
         try {
-            await this.applHost.sendCommand(cc, {
+            await this.host.sendCommand(cc, {
                 ...this.commandOptions,
                 // Seems we need these options or some nodes won't accept the nonce
                 transmitOptions: core_1.TransmitOptions.ACK
@@ -121,7 +137,7 @@ let SecurityCCAPI = class SecurityCCAPI extends API_1.PhysicalCCAPI {
         catch (e) {
             if ((0, core_1.isTransmissionError)(e)) {
                 // The nonce could not be sent, invalidate it
-                this.applHost.securityManager.deleteNonce(nonceId);
+                this.host.securityManager.deleteNonce(nonceId);
                 return false;
             }
             else {
@@ -133,82 +149,83 @@ let SecurityCCAPI = class SecurityCCAPI extends API_1.PhysicalCCAPI {
     }
     async getSecurityScheme() {
         this.assertSupportsCommand(_Types_1.SecurityCommand, _Types_1.SecurityCommand.SchemeGet);
-        const cc = new SecurityCCSchemeGet(this.applHost, {
+        const cc = new SecurityCCSchemeGet({
             nodeId: this.endpoint.nodeId,
-            endpoint: this.endpoint.index,
+            endpointIndex: this.endpoint.index,
         });
-        await this.applHost.sendCommand(cc, this.commandOptions);
+        await this.host.sendCommand(cc, this.commandOptions);
         // There is only one scheme, so we hardcode it
         return [0];
     }
     async reportSecurityScheme(encapsulated) {
         this.assertSupportsCommand(_Types_1.SecurityCommand, _Types_1.SecurityCommand.SchemeReport);
-        let cc = new SecurityCCSchemeReport(this.applHost, {
+        let cc = new SecurityCCSchemeReport({
             nodeId: this.endpoint.nodeId,
-            endpoint: this.endpoint.index,
+            endpointIndex: this.endpoint.index,
         });
         if (encapsulated) {
-            cc = new SecurityCCCommandEncapsulation(this.applHost, {
+            cc = new SecurityCCCommandEncapsulation({
                 nodeId: this.endpoint.nodeId,
-                endpoint: this.endpoint.index,
+                endpointIndex: this.endpoint.index,
                 encapsulated: cc,
             });
         }
-        await this.applHost.sendCommand(cc, this.commandOptions);
+        await this.host.sendCommand(cc, this.commandOptions);
     }
     async inheritSecurityScheme() {
         this.assertSupportsCommand(_Types_1.SecurityCommand, _Types_1.SecurityCommand.SchemeInherit);
-        const cc = new SecurityCCSchemeInherit(this.applHost, {
+        const cc = new SecurityCCSchemeInherit({
             nodeId: this.endpoint.nodeId,
-            endpoint: this.endpoint.index,
+            endpointIndex: this.endpoint.index,
         });
-        await this.applHost.sendCommand(cc, this.commandOptions);
+        await this.host.sendCommand(cc, this.commandOptions);
         // There is only one scheme, so we don't return anything here
     }
     async setNetworkKey(networkKey) {
         this.assertSupportsCommand(_Types_1.SecurityCommand, _Types_1.SecurityCommand.NetworkKeySet);
-        const keySet = new SecurityCCNetworkKeySet(this.applHost, {
+        const keySet = new SecurityCCNetworkKeySet({
             nodeId: this.endpoint.nodeId,
-            endpoint: this.endpoint.index,
+            endpointIndex: this.endpoint.index,
             networkKey,
         });
-        const cc = new SecurityCCCommandEncapsulation(this.applHost, {
+        const cc = new SecurityCCCommandEncapsulation({
             nodeId: this.endpoint.nodeId,
-            endpoint: this.endpoint.index,
+            endpointIndex: this.endpoint.index,
             encapsulated: keySet,
             alternativeNetworkKey: Buffer.alloc(16, 0),
         });
-        await this.applHost.sendCommand(cc, this.commandOptions);
+        await this.host.sendCommand(cc, this.commandOptions);
     }
     async verifyNetworkKey() {
         this.assertSupportsCommand(_Types_1.SecurityCommand, _Types_1.SecurityCommand.NetworkKeyVerify);
-        const cc = new SecurityCCNetworkKeyVerify(this.applHost, {
+        const cc = new SecurityCCNetworkKeyVerify({
             nodeId: this.endpoint.nodeId,
-            endpoint: this.endpoint.index,
+            endpointIndex: this.endpoint.index,
         });
-        await this.applHost.sendCommand(cc, this.commandOptions);
+        await this.host.sendCommand(cc, this.commandOptions);
     }
     // eslint-disable-next-line @typescript-eslint/explicit-module-boundary-types
     async getSupportedCommands() {
         this.assertSupportsCommand(_Types_1.SecurityCommand, _Types_1.SecurityCommand.CommandsSupportedGet);
-        const cc = new SecurityCCCommandsSupportedGet(this.applHost, {
+        const cc = new SecurityCCCommandsSupportedGet({
             nodeId: this.endpoint.nodeId,
-            endpoint: this.endpoint.index,
+            endpointIndex: this.endpoint.index,
         });
-        const response = await this.applHost.sendCommand(cc, this.commandOptions);
+        const response = await this.host.sendCommand(cc, this.commandOptions);
         if (response) {
             return (0, safe_1.pick)(response, ["supportedCCs", "controlledCCs"]);
         }
     }
     async reportSupportedCommands(supportedCCs, controlledCCs) {
         this.assertSupportsCommand(_Types_1.SecurityCommand, _Types_1.SecurityCommand.CommandsSupportedReport);
-        const cc = new SecurityCCCommandsSupportedReport(this.applHost, {
+        const cc = new SecurityCCCommandsSupportedReport({
             nodeId: this.endpoint.nodeId,
-            endpoint: this.endpoint.index,
+            endpointIndex: this.endpoint.index,
             supportedCCs,
             controlledCCs,
+            reportsToFollow: 0,
         });
-        await this.applHost.sendCommand(cc, this.commandOptions);
+        await this.host.sendCommand(cc, this.commandOptions);
     }
 };
 exports.SecurityCCAPI = SecurityCCAPI;
@@ -216,13 +233,13 @@ exports.SecurityCCAPI = SecurityCCAPI = __decorate([
     (0, CommandClassDecorators_1.API)(core_1.CommandClasses.Security)
 ], SecurityCCAPI);
 let SecurityCC = SecurityCC_1 = class SecurityCC extends CommandClass_1.CommandClass {
-    async interview(applHost) {
-        const node = this.getNode(applHost);
-        const endpoint = this.getEndpoint(applHost);
-        const api = API_1.CCAPI.create(core_1.CommandClasses.Security, applHost, endpoint).withOptions({
+    async interview(ctx) {
+        const node = this.getNode(ctx);
+        const endpoint = this.getEndpoint(ctx);
+        const api = API_1.CCAPI.create(core_1.CommandClasses.Security, ctx, endpoint).withOptions({
             priority: core_1.MessagePriority.NodeQuery,
         });
-        applHost.controllerLog.logNode(node.id, {
+        ctx.logNode(node.id, {
             message: "Querying securely supported commands (S0)...",
             direction: "outbound",
         });
@@ -238,7 +255,7 @@ let SecurityCC = SecurityCC_1 = class SecurityCC extends CommandClass_1.CommandC
                 break;
             }
             else if (attempts < MAX_ATTEMPTS) {
-                applHost.controllerLog.logNode(node.id, {
+                ctx.logNode(node.id, {
                     endpoint: this.endpointIndex,
                     message: `Querying securely supported commands (S0), attempt ${attempts}/${MAX_ATTEMPTS} failed. Retrying in 500ms...`,
                     level: "warn",
@@ -248,7 +265,7 @@ let SecurityCC = SecurityCC_1 = class SecurityCC extends CommandClass_1.CommandC
         }
         if (!supportedCCs || !controlledCCs) {
             if (node.hasSecurityClass(core_1.SecurityClass.S0_Legacy) === true) {
-                applHost.controllerLog.logNode(node.id, {
+                ctx.logNode(node.id, {
                     endpoint: this.endpointIndex,
                     message: "Querying securely supported commands (S0) failed",
                     level: "warn",
@@ -258,7 +275,7 @@ let SecurityCC = SecurityCC_1 = class SecurityCC extends CommandClass_1.CommandC
             else {
                 // We didn't know if the node was secure and it didn't respond,
                 // assume that it doesn't have the S0 security class
-                applHost.controllerLog.logNode(node.id, `The node was not granted the S0 security class. Continuing interview non-securely.`);
+                ctx.logNode(node.id, `The node was not granted the S0 security class. Continuing interview non-securely.`);
                 node.setSecurityClass(core_1.SecurityClass.S0_Legacy, false);
             }
             return;
@@ -274,7 +291,7 @@ let SecurityCC = SecurityCC_1 = class SecurityCC extends CommandClass_1.CommandC
         for (const cc of controlledCCs) {
             logLines.push(`· ${(0, core_1.getCCName)(cc)}`);
         }
-        applHost.controllerLog.logNode(node.id, {
+        ctx.logNode(node.id, {
             message: logLines.join("\n"),
             direction: "inbound",
         });
@@ -310,10 +327,10 @@ let SecurityCC = SecurityCC_1 = class SecurityCC extends CommandClass_1.CommandC
         // We know for sure that the node is included securely
         if (node.hasSecurityClass(core_1.SecurityClass.S0_Legacy) !== true) {
             node.setSecurityClass(core_1.SecurityClass.S0_Legacy, true);
-            applHost.controllerLog.logNode(node.id, `The node was granted the S0 security class`);
+            ctx.logNode(node.id, `The node was granted the S0 security class`);
         }
         // Remember that the interview is complete
-        this.setInterviewComplete(applHost, true);
+        this.setInterviewComplete(ctx, true);
     }
     /** Tests if a command should be sent secure and thus requires encapsulation */
     static requiresEncapsulation(cc) {
@@ -348,9 +365,9 @@ let SecurityCC = SecurityCC_1 = class SecurityCC extends CommandClass_1.CommandC
         return true;
     }
     /** Encapsulates a command that should be sent encrypted */
-    static encapsulate(host, cc) {
+    static encapsulate(ownNodeId, securityManager, cc) {
         // TODO: When to return a SecurityCCCommandEncapsulationNonceGet?
-        const ret = new SecurityCCCommandEncapsulation(host, {
+        const ret = new SecurityCCCommandEncapsulation({
             nodeId: cc.nodeId,
             encapsulated: cc,
         });
@@ -366,34 +383,35 @@ exports.SecurityCC = SecurityCC = SecurityCC_1 = __decorate([
     (0, CommandClassDecorators_1.commandClass)(core_1.CommandClasses.Security),
     (0, CommandClassDecorators_1.implementedVersion)(1)
 ], SecurityCC);
-let SecurityCCNonceReport = class SecurityCCNonceReport extends SecurityCC {
-    constructor(host, options) {
-        super(host, options);
-        if ((0, CommandClass_1.gotDeserializationOptions)(options)) {
-            core_1.validatePayload.withReason("Invalid nonce length")(this.payload.length === HALF_NONCE_SIZE);
-            this.nonce = this.payload;
-        }
-        else {
-            if (options.nonce.length !== HALF_NONCE_SIZE) {
-                throw new core_1.ZWaveError(`Nonce must have length ${HALF_NONCE_SIZE}!`, core_1.ZWaveErrorCodes.Argument_Invalid);
-            }
-            this.nonce = options.nonce;
-        }
+let SecurityCCNonceReport = SecurityCCNonceReport_1 = class SecurityCCNonceReport extends SecurityCC {
+    constructor(options) {
+        super(options);
+        if (options.nonce.length !== HALF_NONCE_SIZE) {
+            throw new core_1.ZWaveError(`Nonce must have length ${HALF_NONCE_SIZE}!`, core_1.ZWaveErrorCodes.Argument_Invalid);
+        }
+        this.nonce = options.nonce;
+    }
+    static from(raw, ctx) {
+        core_1.validatePayload.withReason("Invalid nonce length")(raw.payload.length === HALF_NONCE_SIZE);
+        return new SecurityCCNonceReport_1({
+            nodeId: ctx.sourceNodeId,
+            nonce: raw.payload,
+        });
     }
     nonce;
-    serialize() {
+    serialize(ctx) {
         this.payload = this.nonce;
-        return super.serialize();
+        return super.serialize(ctx);
     }
-    toLogEntry(host) {
+    toLogEntry(ctx) {
         return {
-            ...super.toLogEntry(host),
+            ...super.toLogEntry(ctx),
             message: { nonce: (0, safe_1.buffer2hex)(this.nonce) },
         };
     }
 };
 exports.SecurityCCNonceReport = SecurityCCNonceReport;
-exports.SecurityCCNonceReport = SecurityCCNonceReport = __decorate([
+exports.SecurityCCNonceReport = SecurityCCNonceReport = SecurityCCNonceReport_1 = __decorate([
     (0, CommandClassDecorators_1.CCCommand)(_Types_1.SecurityCommand.NonceReport)
 ], SecurityCCNonceReport);
 let SecurityCCNonceGet = class SecurityCCNonceGet extends SecurityCC {
@@ -408,72 +426,70 @@ function getCCResponseForCommandEncapsulation(sent) {
         return SecurityCCCommandEncapsulation;
     }
 }
-let SecurityCCCommandEncapsulation = class SecurityCCCommandEncapsulation extends SecurityCC {
-    constructor(host, options) {
-        super(host, options);
-        const verb = (0, CommandClass_1.gotDeserializationOptions)(options) ? "decoded" : "sent";
-        if (!this.host.ownNodeId) {
-            throw new core_1.ZWaveError(`Secure commands (S0) can only be ${verb} when the controller's node id is known!`, core_1.ZWaveErrorCodes.Driver_NotReady);
-        }
-        else if (!this.host.securityManager) {
-            throw new core_1.ZWaveError(`Secure commands (S0) can only be ${verb} when the network key for the applHost is set`, core_1.ZWaveErrorCodes.Driver_NoSecurity);
-        }
-        if ((0, CommandClass_1.gotDeserializationOptions)(options)) {
-            // HALF_NONCE_SIZE bytes iv, 1 byte frame control, at least 1 CC byte, 1 byte nonce id, 8 bytes auth code
-            (0, core_1.validatePayload)(this.payload.length >= HALF_NONCE_SIZE + 1 + 1 + 1 + 8);
-            const iv = this.payload.subarray(0, HALF_NONCE_SIZE);
-            const encryptedPayload = this.payload.subarray(HALF_NONCE_SIZE, -9);
-            const nonceId = this.payload.at(-9);
-            const authCode = this.payload.subarray(-8);
-            // Retrieve the used nonce from the nonce store
-            const nonce = this.host.securityManager.getNonce(nonceId);
-            // Only accept the message if the nonce hasn't expired
-            core_1.validatePayload.withReason(`Nonce ${(0, safe_1.num2hex)(nonceId)} expired, cannot decode security encapsulated command.`)(!!nonce);
-            // and mark the nonce as used
-            this.host.securityManager.deleteNonce(nonceId);
-            this.authKey = this.host.securityManager.authKey;
-            this.encryptionKey = this.host.securityManager.encryptionKey;
-            // Validate the encrypted data
-            const authData = getAuthenticationData(iv, nonce, this.ccCommand, this.nodeId, this.host.ownNodeId, encryptedPayload);
-            const expectedAuthCode = (0, core_1.computeMAC)(authData, this.authKey);
-            // Only accept messages with a correct auth code
-            core_1.validatePayload.withReason("Invalid auth code, won't accept security encapsulated command.")(authCode.equals(expectedAuthCode));
-            // Decrypt the encapsulated CC
-            const frameControlAndDecryptedCC = (0, core_1.decryptAES128OFB)(encryptedPayload, this.encryptionKey, Buffer.concat([iv, nonce]));
-            const frameControl = frameControlAndDecryptedCC[0];
-            this.sequenceCounter = frameControl & 0b1111;
-            this.sequenced = !!(frameControl & 0b1_0000);
-            this.secondFrame = !!(frameControl & 0b10_0000);
-            this.decryptedCCBytes = frameControlAndDecryptedCC.subarray(1);
-            // Remember for debugging purposes
-            this.authData = authData;
-            this.authCode = authCode;
-            this.iv = iv;
-        }
-        else {
+let SecurityCCCommandEncapsulation = SecurityCCCommandEncapsulation_1 = class SecurityCCCommandEncapsulation extends SecurityCC {
+    constructor(options) {
+        super(options);
+        if ("encapsulated" in options) {
             this.encapsulated = options.encapsulated;
-            options.encapsulated.encapsulatingCC = this;
-            if (options.alternativeNetworkKey) {
-                this.authKey = (0, core_1.generateAuthKey)(options.alternativeNetworkKey);
-                this.encryptionKey = (0, core_1.generateEncryptionKey)(options.alternativeNetworkKey);
-            }
-            else {
-                this.authKey = this.host.securityManager.authKey;
-                this.encryptionKey = this.host.securityManager.encryptionKey;
-            }
+            this.encapsulated.encapsulatingCC = this;
         }
+        else {
+            this.decryptedCCBytes = options.decryptedCCBytes;
+            this.sequenced = options.sequenced;
+            this.secondFrame = options.secondFrame;
+            this.sequenceCounter = options.sequenceCounter;
+        }
+        this.alternativeNetworkKey = options.alternativeNetworkKey;
+    }
+    static from(raw, ctx) {
+        assertSecurityRX(ctx);
+        // HALF_NONCE_SIZE bytes iv, 1 byte frame control, at least 1 CC byte, 1 byte nonce id, 8 bytes auth code
+        (0, core_1.validatePayload)(raw.payload.length >= HALF_NONCE_SIZE + 1 + 1 + 1 + 8);
+        const iv = raw.payload.subarray(0, HALF_NONCE_SIZE);
+        const encryptedPayload = raw.payload.subarray(HALF_NONCE_SIZE, -9);
+        const nonceId = raw.payload.at(-9);
+        const authCode = raw.payload.subarray(-8);
+        // Retrieve the used nonce from the nonce store
+        const nonce = ctx.securityManager.getNonce(nonceId);
+        // Only accept the message if the nonce hasn't expired
+        if (!nonce) {
+            core_1.validatePayload.fail(`Nonce ${(0, safe_1.num2hex)(nonceId)} expired, cannot decode security encapsulated command.`);
+        }
+        // and mark the nonce as used
+        ctx.securityManager.deleteNonce(nonceId);
+        // Validate the encrypted data
+        const authData = getAuthenticationData(iv, nonce, _Types_1.SecurityCommand.CommandEncapsulation, ctx.sourceNodeId, ctx.ownNodeId, encryptedPayload);
+        const expectedAuthCode = (0, core_1.computeMAC)(authData, ctx.securityManager.authKey);
+        // Only accept messages with a correct auth code
+        core_1.validatePayload.withReason("Invalid auth code, won't accept security encapsulated command.")(authCode.equals(expectedAuthCode));
+        // Decrypt the encapsulated CC
+        const frameControlAndDecryptedCC = (0, core_1.decryptAES128OFB)(encryptedPayload, ctx.securityManager.encryptionKey, Buffer.concat([iv, nonce]));
+        const frameControl = frameControlAndDecryptedCC[0];
+        const sequenceCounter = frameControl & 0b1111;
+        const sequenced = !!(frameControl & 0b1_0000);
+        const secondFrame = !!(frameControl & 0b10_0000);
+        const decryptedCCBytes = frameControlAndDecryptedCC
+            .subarray(1);
+        const ret = new SecurityCCCommandEncapsulation_1({
+            nodeId: ctx.sourceNodeId,
+            sequenceCounter,
+            sequenced,
+            secondFrame,
+            decryptedCCBytes,
+        });
+        ret.authData = authData;
+        ret.authCode = authCode;
+        ret.iv = iv;
+        return ret;
     }
     sequenced;
     secondFrame;
     sequenceCounter;
     decryptedCCBytes;
     encapsulated;
-    authKey;
-    encryptionKey;
+    alternativeNetworkKey;
     get nonceId() {
-        if (!this.nonce)
-            return undefined;
-        return this.host.securityManager.getNonceId(this.nonce);
+        return this.nonce?.[0];
     }
     nonce;
     // Only used testing/for debugging purposes
@@ -499,25 +515,33 @@ let SecurityCCCommandEncapsulation = class SecurityCCCommandEncapsulation extend
     expectMoreMessages() {
         return !!this.sequenced && !this.secondFrame;
     }
-    mergePartialCCs(applHost, partials) {
+    mergePartialCCs(partials, ctx) {
         // Concat the CC buffers
         this.decryptedCCBytes = Buffer.concat([...partials, this].map((cc) => cc.decryptedCCBytes));
         // make sure this contains a complete CC command that's worth splitting
         (0, core_1.validatePayload)(this.decryptedCCBytes.length >= 2);
         // and deserialize the CC
-        this.encapsulated = CommandClass_1.CommandClass.from(this.host, {
-            data: this.decryptedCCBytes,
-            fromEncapsulation: true,
-            encapCC: this,
-        });
+        this.encapsulated = CommandClass_1.CommandClass.parse(this.decryptedCCBytes, ctx);
+        this.encapsulated.encapsulatingCC = this;
     }
-    serialize() {
+    serialize(ctx) {
         if (!this.nonce)
             throwNoNonce();
         if (this.nonce.length !== HALF_NONCE_SIZE) {
             throwNoNonce("Invalid nonce size");
         }
-        const serializedCC = this.encapsulated.serialize();
+        assertSecurityTX(ctx);
+        let authKey;
+        let encryptionKey;
+        if (this.alternativeNetworkKey) {
+            authKey = (0, core_1.generateAuthKey)(this.alternativeNetworkKey);
+            encryptionKey = (0, core_1.generateEncryptionKey)(this.alternativeNetworkKey);
+        }
+        else {
+            authKey = ctx.securityManager.authKey;
+            encryptionKey = ctx.securityManager.encryptionKey;
+        }
+        const serializedCC = this.encapsulated.serialize(ctx);
         const plaintext = Buffer.concat([
             Buffer.from([0]), // TODO: frame control
             serializedCC,
@@ -525,10 +549,10 @@ let SecurityCCCommandEncapsulation = class SecurityCCCommandEncapsulation extend
         // Encrypt the payload
         const senderNonce = (0, node_crypto_1.randomBytes)(HALF_NONCE_SIZE);
         const iv = Buffer.concat([senderNonce, this.nonce]);
-        const ciphertext = (0, core_1.encryptAES128OFB)(plaintext, this.encryptionKey, iv);
+        const ciphertext = (0, core_1.encryptAES128OFB)(plaintext, encryptionKey, iv);
         // And generate the auth code
-        const authData = getAuthenticationData(senderNonce, this.nonce, this.ccCommand, this.host.ownNodeId, this.nodeId, ciphertext);
-        const authCode = (0, core_1.computeMAC)(authData, this.authKey);
+        const authData = getAuthenticationData(senderNonce, this.nonce, this.ccCommand, ctx.ownNodeId, this.nodeId, ciphertext);
+        const authCode = (0, core_1.computeMAC)(authData, authKey);
         // Remember for debugging purposes
         this.iv = iv;
         this.authData = authData;
@@ -540,13 +564,13 @@ let SecurityCCCommandEncapsulation = class SecurityCCCommandEncapsulation extend
             Buffer.from([this.nonceId]),
             authCode,
         ]);
-        return super.serialize();
+        return super.serialize(ctx);
     }
     computeEncapsulationOverhead() {
         // Security CC adds 8 bytes IV, 1 byte frame control, 1 byte nonce ID, 8 bytes MAC
         return super.computeEncapsulationOverhead() + 18;
     }
-    toLogEntry(host) {
+    toLogEntry(ctx) {
         const message = {};
         if (this.nonceId != undefined) {
             message["nonce id"] = this.nonceId;
@@ -582,13 +606,13 @@ let SecurityCCCommandEncapsulation = class SecurityCCCommandEncapsulation extend
             }
         }
         return {
-            ...super.toLogEntry(host),
+            ...super.toLogEntry(ctx),
             message,
         };
     }
 };
 exports.SecurityCCCommandEncapsulation = SecurityCCCommandEncapsulation;
-exports.SecurityCCCommandEncapsulation = SecurityCCCommandEncapsulation = __decorate([
+exports.SecurityCCCommandEncapsulation = SecurityCCCommandEncapsulation = SecurityCCCommandEncapsulation_1 = __decorate([
     (0, CommandClassDecorators_1.CCCommand)(_Types_1.SecurityCommand.CommandEncapsulation),
     (0, CommandClassDecorators_1.expectedCCResponse)(getCCResponseForCommandEncapsulation, () => "checkEncapsulated")
 ], SecurityCCCommandEncapsulation);
@@ -599,44 +623,40 @@ exports.SecurityCCCommandEncapsulationNonceGet = SecurityCCCommandEncapsulationN
 exports.SecurityCCCommandEncapsulationNonceGet = SecurityCCCommandEncapsulationNonceGet = __decorate([
     (0, CommandClassDecorators_1.CCCommand)(_Types_1.SecurityCommand.CommandEncapsulationNonceGet)
 ], SecurityCCCommandEncapsulationNonceGet);
-let SecurityCCSchemeReport = class SecurityCCSchemeReport extends SecurityCC {
-    constructor(host, options) {
-        super(host, options);
-        if ((0, CommandClass_1.gotDeserializationOptions)(options)) {
-            (0, core_1.validatePayload)(this.payload.length >= 1);
-            // The including controller MUST NOT perform any validation of the Supported Security Schemes byte
-        }
+let SecurityCCSchemeReport = SecurityCCSchemeReport_1 = class SecurityCCSchemeReport extends SecurityCC {
+    static from(raw, ctx) {
+        (0, core_1.validatePayload)(raw.payload.length >= 1);
+        // The including controller MUST NOT perform any validation of the Supported Security Schemes byte
+        return new SecurityCCSchemeReport_1({
+            nodeId: ctx.sourceNodeId,
+        });
     }
-    serialize() {
+    serialize(ctx) {
         // Since it is unlikely that any more schemes will be added to S0, we hardcode the default scheme here (bit 0 = 0)
         this.payload = Buffer.from([0]);
-        return super.serialize();
+        return super.serialize(ctx);
     }
-    toLogEntry(host) {
+    toLogEntry(ctx) {
         return {
-            ...super.toLogEntry(host),
+            ...super.toLogEntry(ctx),
             // Hide the default payload line
             message: undefined,
         };
     }
 };
 exports.SecurityCCSchemeReport = SecurityCCSchemeReport;
-exports.SecurityCCSchemeReport = SecurityCCSchemeReport = __decorate([
+exports.SecurityCCSchemeReport = SecurityCCSchemeReport = SecurityCCSchemeReport_1 = __decorate([
     (0, CommandClassDecorators_1.CCCommand)(_Types_1.SecurityCommand.SchemeReport)
 ], SecurityCCSchemeReport);
 let SecurityCCSchemeGet = class SecurityCCSchemeGet extends SecurityCC {
-    constructor(host, options) {
-        super(host, options);
-        // Don't care, we won't get sent this and we have no options
-    }
-    serialize() {
+    serialize(ctx) {
         // Since it is unlikely that any more schemes will be added to S0, we hardcode the default scheme here (bit 0 = 0)
         this.payload = Buffer.from([0]);
-        return super.serialize();
+        return super.serialize(ctx);
     }
-    toLogEntry(host) {
+    toLogEntry(ctx) {
         return {
-            ...super.toLogEntry(host),
+            ...super.toLogEntry(ctx),
             // Hide the default payload line
             message: undefined,
         };
@@ -648,18 +668,14 @@ exports.SecurityCCSchemeGet = SecurityCCSchemeGet = __decorate([
     (0, CommandClassDecorators_1.expectedCCResponse)(SecurityCCSchemeReport)
 ], SecurityCCSchemeGet);
 let SecurityCCSchemeInherit = class SecurityCCSchemeInherit extends SecurityCC {
-    constructor(host, options) {
-        super(host, options);
-        // Don't care, we won't get sent this and we have no options
-    }
-    serialize() {
+    serialize(ctx) {
         // Since it is unlikely that any more schemes will be added to S0, we hardcode the default scheme here (bit 0 = 0)
         this.payload = Buffer.from([0]);
-        return super.serialize();
+        return super.serialize(ctx);
     }
-    toLogEntry(host) {
+    toLogEntry(ctx) {
         return {
-            ...super.toLogEntry(host),
+            ...super.toLogEntry(ctx),
             // Hide the default payload line
             message: undefined,
         };
@@ -676,61 +692,62 @@ exports.SecurityCCNetworkKeyVerify = SecurityCCNetworkKeyVerify;
 exports.SecurityCCNetworkKeyVerify = SecurityCCNetworkKeyVerify = __decorate([
     (0, CommandClassDecorators_1.CCCommand)(_Types_1.SecurityCommand.NetworkKeyVerify)
 ], SecurityCCNetworkKeyVerify);
-let SecurityCCNetworkKeySet = class SecurityCCNetworkKeySet extends SecurityCC {
-    constructor(host, options) {
-        super(host, options);
-        if ((0, CommandClass_1.gotDeserializationOptions)(options)) {
-            (0, core_1.validatePayload)(this.payload.length >= 16);
-            this.networkKey = this.payload.subarray(0, 16);
-        }
-        else {
-            if (options.networkKey.length !== 16) {
-                throw new core_1.ZWaveError(`The network key must have length 16!`, core_1.ZWaveErrorCodes.Argument_Invalid);
-            }
-            this.networkKey = options.networkKey;
-        }
+let SecurityCCNetworkKeySet = SecurityCCNetworkKeySet_1 = class SecurityCCNetworkKeySet extends SecurityCC {
+    constructor(options) {
+        super(options);
+        if (options.networkKey.length !== 16) {
+            throw new core_1.ZWaveError(`The network key must have length 16!`, core_1.ZWaveErrorCodes.Argument_Invalid);
+        }
+        this.networkKey = options.networkKey;
+    }
+    static from(raw, ctx) {
+        (0, core_1.validatePayload)(raw.payload.length >= 16);
+        const networkKey = raw.payload.subarray(0, 16);
+        return new SecurityCCNetworkKeySet_1({
+            nodeId: ctx.sourceNodeId,
+            networkKey,
+        });
     }
     networkKey;
-    serialize() {
+    serialize(ctx) {
         this.payload = this.networkKey;
-        return super.serialize();
+        return super.serialize(ctx);
     }
-    toLogEntry(applHost) {
+    toLogEntry(ctx) {
         // The network key shouldn't be logged, so users can safely post their logs online
-        const { message, ...log } = super.toLogEntry(applHost);
+        const { message, ...log } = super.toLogEntry(ctx);
         return log;
     }
 };
 exports.SecurityCCNetworkKeySet = SecurityCCNetworkKeySet;
-exports.SecurityCCNetworkKeySet = SecurityCCNetworkKeySet = __decorate([
+exports.SecurityCCNetworkKeySet = SecurityCCNetworkKeySet = SecurityCCNetworkKeySet_1 = __decorate([
     (0, CommandClassDecorators_1.CCCommand)(_Types_1.SecurityCommand.NetworkKeySet),
     (0, CommandClassDecorators_1.expectedCCResponse)(SecurityCCNetworkKeyVerify)
 ], SecurityCCNetworkKeySet);
-let SecurityCCCommandsSupportedReport = class SecurityCCCommandsSupportedReport extends SecurityCC {
-    constructor(host, options) {
-        super(host, options);
-        if ((0, CommandClass_1.gotDeserializationOptions)(options)) {
-            (0, core_1.validatePayload)(this.payload.length >= 1);
-            this.reportsToFollow = this.payload[0];
-            const list = (0, core_1.parseCCList)(this.payload.subarray(1));
-            this.supportedCCs = list.supportedCCs;
-            this.controlledCCs = list.controlledCCs;
-        }
-        else {
-            this.supportedCCs = options.supportedCCs;
-            this.controlledCCs = options.controlledCCs;
-            // TODO: properly split the CCs into multiple reports
-            this.reportsToFollow = 0;
-        }
+let SecurityCCCommandsSupportedReport = SecurityCCCommandsSupportedReport_1 = class SecurityCCCommandsSupportedReport extends SecurityCC {
+    constructor(options) {
+        super(options);
+        this.supportedCCs = options.supportedCCs;
+        this.controlledCCs = options.controlledCCs;
+        // TODO: properly split the CCs into multiple reports
+        this.reportsToFollow = options.reportsToFollow ?? 0;
+    }
+    static from(raw, ctx) {
+        (0, core_1.validatePayload)(raw.payload.length >= 1);
+        const reportsToFollow = raw.payload[0];
+        const list = (0, core_1.parseCCList)(raw.payload.subarray(1));
+        const supportedCCs = list.supportedCCs;
+        const controlledCCs = list.controlledCCs;
+        return new SecurityCCCommandsSupportedReport_1({
+            nodeId: ctx.sourceNodeId,
+            reportsToFollow,
+            supportedCCs,
+            controlledCCs,
+        });
     }
     reportsToFollow;
-    serialize() {
-        this.payload = Buffer.concat([
-            Buffer.from([this.reportsToFollow]),
-            (0, core_1.encodeCCList)(this.supportedCCs, this.controlledCCs),
-        ]);
-        return super.serialize();
-    }
+    supportedCCs;
+    controlledCCs;
     getPartialCCSessionId() {
         // Nothing special we can distinguish sessions with
         return {};
@@ -738,9 +755,7 @@ let SecurityCCCommandsSupportedReport = class SecurityCCCommandsSupportedReport
     expectMoreMessages() {
         return this.reportsToFollow > 0;
     }
-    supportedCCs;
-    controlledCCs;
-    mergePartialCCs(applHost, partials) {
+    mergePartialCCs(partials) {
         // Concat the lists of CCs
         this.supportedCCs = [...partials, this]
             .map((report) => report.supportedCCs)
@@ -749,9 +764,16 @@ let SecurityCCCommandsSupportedReport = class SecurityCCCommandsSupportedReport
             .map((report) => report.controlledCCs)
             .reduce((prev, cur) => prev.concat(...cur), []);
     }
-    toLogEntry(host) {
+    serialize(ctx) {
+        this.payload = Buffer.concat([
+            Buffer.from([this.reportsToFollow]),
+            (0, core_1.encodeCCList)(this.supportedCCs, this.controlledCCs),
+        ]);
+        return super.serialize(ctx);
+    }
+    toLogEntry(ctx) {
         return {
-            ...super.toLogEntry(host),
+            ...super.toLogEntry(ctx),
             message: {
                 reportsToFollow: this.reportsToFollow,
                 supportedCCs: this.supportedCCs
@@ -767,7 +789,7 @@ let SecurityCCCommandsSupportedReport = class SecurityCCCommandsSupportedReport
     }
 };
 exports.SecurityCCCommandsSupportedReport = SecurityCCCommandsSupportedReport;
-exports.SecurityCCCommandsSupportedReport = SecurityCCCommandsSupportedReport = __decorate([
+exports.SecurityCCCommandsSupportedReport = SecurityCCCommandsSupportedReport = SecurityCCCommandsSupportedReport_1 = __decorate([
     (0, CommandClassDecorators_1.CCCommand)(_Types_1.SecurityCommand.CommandsSupportedReport)
 ], SecurityCCCommandsSupportedReport);
 let SecurityCCCommandsSupportedGet = class SecurityCCCommandsSupportedGet extends SecurityCC {