@zwave-js/cc 14.0.0-beta.1 → 14.0.0-beta.4

package/build/esm/cc/SecurityCC.js

@@ -0,0 +1,800 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var SecurityCC_1, SecurityCCNonceReport_1, SecurityCCCommandEncapsulation_1, SecurityCCSchemeReport_1, SecurityCCNetworkKeySet_1, SecurityCCCommandsSupportedReport_1;
+import { CommandClasses, EncapsulationFlags, MessagePriority, SecurityClass, TransmitOptions, ZWaveError, ZWaveErrorCodes, computeMAC, decryptAES128OFB, encodeCCList, encryptAES128OFB, generateAuthKey, generateEncryptionKey, getCCName, isTransmissionError, parseCCList, validatePayload, } from "@zwave-js/core";
+import { Bytes } from "@zwave-js/shared/safe";
+import { buffer2hex, num2hex, pick } from "@zwave-js/shared/safe";
+import { wait } from "alcalzone-shared/async/index.js";
+import { randomBytes } from "node:crypto";
+import { CCAPI, PhysicalCCAPI } from "../lib/API.js";
+import { CommandClass, } from "../lib/CommandClass.js";
+import { API, CCCommand, commandClass, expectedCCResponse, implementedVersion, } from "../lib/CommandClassDecorators.js";
+import { SecurityCommand } from "../lib/_Types.js";
+import { CRC16CC } from "./CRC16CC.js";
+import { Security2CC } from "./Security2CC.js";
+import { TransportServiceCC } from "./TransportServiceCC.js";
+// @noSetValueAPI This is an encapsulation CC
+function getAuthenticationData(senderNonce, receiverNonce, ccCommand, sendingNodeId, receivingNodeId, encryptedPayload) {
+    return Bytes.concat([
+        senderNonce,
+        receiverNonce,
+        Bytes.from([
+            ccCommand,
+            sendingNodeId,
+            receivingNodeId,
+            encryptedPayload.length,
+        ]),
+        encryptedPayload,
+    ]);
+}
+function throwNoNonce(reason) {
+    let message = `Security CC requires a nonce to be sent!`;
+    if (reason)
+        message += ` Reason: ${reason}`;
+    throw new ZWaveError(message, ZWaveErrorCodes.SecurityCC_NoNonce);
+}
+const HALF_NONCE_SIZE = 8;
+function assertSecurityRX(ctx) {
+    if (!ctx.ownNodeId) {
+        throw new ZWaveError(`Secure commands (S0) can only be decoded when the controller's node id is known!`, ZWaveErrorCodes.Driver_NotReady);
+    }
+    if (!ctx.securityManager) {
+        throw new ZWaveError(`Secure commands (S0) can only be decoded when the security manager is set up!`, ZWaveErrorCodes.Driver_NoSecurity);
+    }
+}
+function assertSecurityTX(ctx) {
+    if (!ctx.ownNodeId) {
+        throw new ZWaveError(`Secure commands (S0) can only be sent when the controller's node id is known!`, ZWaveErrorCodes.Driver_NotReady);
+    }
+    if (!ctx.securityManager) {
+        throw new ZWaveError(`Secure commands (S0) can only be sent when the security manager is set up!`, ZWaveErrorCodes.Driver_NoSecurity);
+    }
+}
+// TODO: Ignore commands if received via multicast
+// Encapsulation CCs are used internally and too frequently that we
+// want to pay the cost of validating each call
+/* eslint-disable @zwave-js/ccapi-validate-args */
+let SecurityCCAPI = class SecurityCCAPI extends PhysicalCCAPI {
+    supportsCommand(_cmd) {
+        // All commands are mandatory
+        return true;
+    }
+    async sendEncapsulated(encapsulated, requestNextNonce = false) {
+        if (requestNextNonce) {
+            this.assertSupportsCommand(SecurityCommand, SecurityCommand.CommandEncapsulation);
+        }
+        else {
+            this.assertSupportsCommand(SecurityCommand, SecurityCommand.CommandEncapsulationNonceGet);
+        }
+        const cc = new (requestNextNonce
+            ? SecurityCCCommandEncapsulationNonceGet
+            : SecurityCCCommandEncapsulation)({
+            nodeId: this.endpoint.nodeId,
+            encapsulated,
+        });
+        await this.host.sendCommand(cc, this.commandOptions);
+    }
+    /**
+     * Requests a new nonce for Security CC encapsulation which is not directly linked to a specific command.
+     */
+    async getNonce() {
+        this.assertSupportsCommand(SecurityCommand, SecurityCommand.NonceGet);
+        const cc = new SecurityCCNonceGet({
+            nodeId: this.endpoint.nodeId,
+            endpointIndex: this.endpoint.index,
+        });
+        const response = await this.host.sendCommand(cc, {
+            ...this.commandOptions,
+            // Only try getting a nonce once
+            maxSendAttempts: 1,
+        });
+        if (!response)
+            return;
+        const nonce = response.nonce;
+        const secMan = this.host.securityManager;
+        secMan.setNonce({
+            issuer: this.endpoint.nodeId,
+            nonceId: secMan.getNonceId(nonce),
+        }, { nonce, receiver: this.host.ownNodeId }, { free: true });
+        return nonce;
+    }
+    /**
+     * Responds to a NonceGet request. The message is sent without any retransmission etc.
+     * The return value indicates whether a nonce was successfully sent
+     */
+    async sendNonce() {
+        this.assertSupportsCommand(SecurityCommand, SecurityCommand.NonceReport);
+        if (!this.host.securityManager) {
+            throw new ZWaveError(`Nonces can only be sent if secure communication is set up!`, ZWaveErrorCodes.Driver_NoSecurity);
+        }
+        const nonce = this.host.securityManager.generateNonce(this.endpoint.nodeId, HALF_NONCE_SIZE);
+        const nonceId = this.host.securityManager.getNonceId(nonce);
+        const cc = new SecurityCCNonceReport({
+            nodeId: this.endpoint.nodeId,
+            endpointIndex: this.endpoint.index,
+            nonce,
+        });
+        try {
+            await this.host.sendCommand(cc, {
+                ...this.commandOptions,
+                // Seems we need these options or some nodes won't accept the nonce
+                transmitOptions: TransmitOptions.ACK
+                    | TransmitOptions.AutoRoute,
+                // Only try sending a nonce once
+                maxSendAttempts: 1,
+                // Nonce requests must be handled immediately
+                priority: MessagePriority.Immediate,
+                // We don't want failures causing us to treat the node as asleep or dead
+                changeNodeStatusOnMissingACK: false,
+            });
+        }
+        catch (e) {
+            if (isTransmissionError(e)) {
+                // The nonce could not be sent, invalidate it
+                this.host.securityManager.deleteNonce(nonceId);
+                return false;
+            }
+            else {
+                // Pass other errors through
+                throw e;
+            }
+        }
+        return true;
+    }
+    async getSecurityScheme() {
+        this.assertSupportsCommand(SecurityCommand, SecurityCommand.SchemeGet);
+        const cc = new SecurityCCSchemeGet({
+            nodeId: this.endpoint.nodeId,
+            endpointIndex: this.endpoint.index,
+        });
+        await this.host.sendCommand(cc, this.commandOptions);
+        // There is only one scheme, so we hardcode it
+        return [0];
+    }
+    async reportSecurityScheme(encapsulated) {
+        this.assertSupportsCommand(SecurityCommand, SecurityCommand.SchemeReport);
+        let cc = new SecurityCCSchemeReport({
+            nodeId: this.endpoint.nodeId,
+            endpointIndex: this.endpoint.index,
+        });
+        if (encapsulated) {
+            cc = new SecurityCCCommandEncapsulation({
+                nodeId: this.endpoint.nodeId,
+                endpointIndex: this.endpoint.index,
+                encapsulated: cc,
+            });
+        }
+        await this.host.sendCommand(cc, this.commandOptions);
+    }
+    async inheritSecurityScheme() {
+        this.assertSupportsCommand(SecurityCommand, SecurityCommand.SchemeInherit);
+        const cc = new SecurityCCSchemeInherit({
+            nodeId: this.endpoint.nodeId,
+            endpointIndex: this.endpoint.index,
+        });
+        await this.host.sendCommand(cc, this.commandOptions);
+        // There is only one scheme, so we don't return anything here
+    }
+    async setNetworkKey(networkKey) {
+        this.assertSupportsCommand(SecurityCommand, SecurityCommand.NetworkKeySet);
+        const keySet = new SecurityCCNetworkKeySet({
+            nodeId: this.endpoint.nodeId,
+            endpointIndex: this.endpoint.index,
+            networkKey,
+        });
+        const cc = new SecurityCCCommandEncapsulation({
+            nodeId: this.endpoint.nodeId,
+            endpointIndex: this.endpoint.index,
+            encapsulated: keySet,
+            alternativeNetworkKey: new Uint8Array(16).fill(0),
+        });
+        await this.host.sendCommand(cc, this.commandOptions);
+    }
+    async verifyNetworkKey() {
+        this.assertSupportsCommand(SecurityCommand, SecurityCommand.NetworkKeyVerify);
+        const cc = new SecurityCCNetworkKeyVerify({
+            nodeId: this.endpoint.nodeId,
+            endpointIndex: this.endpoint.index,
+        });
+        await this.host.sendCommand(cc, this.commandOptions);
+    }
+    // eslint-disable-next-line @typescript-eslint/explicit-module-boundary-types
+    async getSupportedCommands() {
+        this.assertSupportsCommand(SecurityCommand, SecurityCommand.CommandsSupportedGet);
+        const cc = new SecurityCCCommandsSupportedGet({
+            nodeId: this.endpoint.nodeId,
+            endpointIndex: this.endpoint.index,
+        });
+        const response = await this.host.sendCommand(cc, this.commandOptions);
+        if (response) {
+            return pick(response, ["supportedCCs", "controlledCCs"]);
+        }
+    }
+    async reportSupportedCommands(supportedCCs, controlledCCs) {
+        this.assertSupportsCommand(SecurityCommand, SecurityCommand.CommandsSupportedReport);
+        const cc = new SecurityCCCommandsSupportedReport({
+            nodeId: this.endpoint.nodeId,
+            endpointIndex: this.endpoint.index,
+            supportedCCs,
+            controlledCCs,
+            reportsToFollow: 0,
+        });
+        await this.host.sendCommand(cc, this.commandOptions);
+    }
+};
+SecurityCCAPI = __decorate([
+    API(CommandClasses.Security)
+], SecurityCCAPI);
+export { SecurityCCAPI };
+let SecurityCC = SecurityCC_1 = class SecurityCC extends CommandClass {
+    async interview(ctx) {
+        const node = this.getNode(ctx);
+        const endpoint = this.getEndpoint(ctx);
+        const api = CCAPI.create(CommandClasses.Security, ctx, endpoint).withOptions({
+            priority: MessagePriority.NodeQuery,
+        });
+        ctx.logNode(node.id, {
+            message: "Querying securely supported commands (S0)...",
+            direction: "outbound",
+        });
+        let supportedCCs;
+        let controlledCCs;
+        // Try up to 3 times on the root device. We REALLY don't want a spurious timeout or collision to cause us to discard a known good security class
+        const MAX_ATTEMPTS = this.endpointIndex === 0 ? 3 : 1;
+        for (let attempts = 1; attempts <= MAX_ATTEMPTS; attempts++) {
+            const resp = await api.getSupportedCommands();
+            if (resp) {
+                supportedCCs = resp.supportedCCs;
+                controlledCCs = resp.controlledCCs;
+                break;
+            }
+            else if (attempts < MAX_ATTEMPTS) {
+                ctx.logNode(node.id, {
+                    endpoint: this.endpointIndex,
+                    message: `Querying securely supported commands (S0), attempt ${attempts}/${MAX_ATTEMPTS} failed. Retrying in 500ms...`,
+                    level: "warn",
+                });
+                await wait(500);
+            }
+        }
+        if (!supportedCCs || !controlledCCs) {
+            if (node.hasSecurityClass(SecurityClass.S0_Legacy) === true) {
+                ctx.logNode(node.id, {
+                    endpoint: this.endpointIndex,
+                    message: "Querying securely supported commands (S0) failed",
+                    level: "warn",
+                });
+                // TODO: Abort interview?
+            }
+            else {
+                // We didn't know if the node was secure and it didn't respond,
+                // assume that it doesn't have the S0 security class
+                ctx.logNode(node.id, `The node was not granted the S0 security class. Continuing interview non-securely.`);
+                node.setSecurityClass(SecurityClass.S0_Legacy, false);
+            }
+            return;
+        }
+        const logLines = [
+            "received secure commands (S0)",
+            "supported CCs:",
+        ];
+        for (const cc of supportedCCs) {
+            logLines.push(`· ${getCCName(cc)}`);
+        }
+        logLines.push("controlled CCs:");
+        for (const cc of controlledCCs) {
+            logLines.push(`· ${getCCName(cc)}`);
+        }
+        ctx.logNode(node.id, {
+            message: logLines.join("\n"),
+            direction: "inbound",
+        });
+        // Remember which commands are supported securely
+        for (const cc of supportedCCs) {
+            // Basic CC has special rules for when it is considered supported
+            // Therefore we mark all other CCs as supported, but not Basic CC,
+            // for which support is determined later.
+            if (cc === CommandClasses.Basic) {
+                endpoint.addCC(cc, { secure: true });
+            }
+            else {
+                endpoint.addCC(cc, {
+                    isSupported: true,
+                    secure: true,
+                });
+            }
+        }
+        for (const cc of controlledCCs) {
+            // Basic CC has special rules for when it is considered supported
+            // Therefore we mark all other CCs as supported, but not Basic CC,
+            // for which support is determined later.
+            if (cc === CommandClasses.Basic) {
+                endpoint.addCC(cc, { secure: true });
+            }
+            else {
+                endpoint.addCC(cc, {
+                    isControlled: true,
+                    secure: true,
+                });
+            }
+        }
+        // We know for sure that the node is included securely
+        if (node.hasSecurityClass(SecurityClass.S0_Legacy) !== true) {
+            node.setSecurityClass(SecurityClass.S0_Legacy, true);
+            ctx.logNode(node.id, `The node was granted the S0 security class`);
+        }
+        // Remember that the interview is complete
+        this.setInterviewComplete(ctx, true);
+    }
+    /** Tests if a command should be sent secure and thus requires encapsulation */
+    static requiresEncapsulation(cc) {
+        // No security flag -> no encapsulation
+        if (!(cc.encapsulationFlags & EncapsulationFlags.Security)) {
+            return false;
+        }
+        // S2, CRC16, Transport Service -> no S2 encapsulation
+        if (cc instanceof Security2CC
+            || cc instanceof CRC16CC
+            || cc instanceof TransportServiceCC) {
+            return false;
+        }
+        // S0: check command
+        if (cc instanceof SecurityCC_1) {
+            switch (cc.ccCommand) {
+                // Already encapsulated
+                case SecurityCommand.CommandEncapsulation:
+                case SecurityCommand.CommandEncapsulationNonceGet:
+                // Cannot be sent encapsulated:
+                case SecurityCommand.NonceGet:
+                case SecurityCommand.NonceReport:
+                case SecurityCommand.SchemeGet:
+                case SecurityCommand.SchemeReport:
+                    return false;
+                default:
+                    // All other commands must be encapsulated
+                    return true;
+            }
+        }
+        // Everything else needs to be encapsulated if the CC is secure
+        return true;
+    }
+    /** Encapsulates a command that should be sent encrypted */
+    static encapsulate(ownNodeId, securityManager, cc) {
+        // TODO: When to return a SecurityCCCommandEncapsulationNonceGet?
+        const ret = new SecurityCCCommandEncapsulation({
+            nodeId: cc.nodeId,
+            encapsulated: cc,
+        });
+        // Copy the encapsulation flags from the encapsulated command
+        // but omit Security, since we're doing that right now
+        ret.encapsulationFlags = cc.encapsulationFlags
+            & ~EncapsulationFlags.Security;
+        return ret;
+    }
+};
+SecurityCC = SecurityCC_1 = __decorate([
+    commandClass(CommandClasses.Security),
+    implementedVersion(1)
+], SecurityCC);
+export { SecurityCC };
+let SecurityCCNonceReport = SecurityCCNonceReport_1 = class SecurityCCNonceReport extends SecurityCC {
+    constructor(options) {
+        super(options);
+        if (options.nonce.length !== HALF_NONCE_SIZE) {
+            throw new ZWaveError(`Nonce must have length ${HALF_NONCE_SIZE}!`, ZWaveErrorCodes.Argument_Invalid);
+        }
+        this.nonce = options.nonce;
+    }
+    static from(raw, ctx) {
+        validatePayload.withReason("Invalid nonce length")(raw.payload.length === HALF_NONCE_SIZE);
+        return new SecurityCCNonceReport_1({
+            nodeId: ctx.sourceNodeId,
+            nonce: raw.payload,
+        });
+    }
+    nonce;
+    serialize(ctx) {
+        this.payload = Bytes.view(this.nonce);
+        return super.serialize(ctx);
+    }
+    toLogEntry(ctx) {
+        return {
+            ...super.toLogEntry(ctx),
+            message: { nonce: buffer2hex(this.nonce) },
+        };
+    }
+};
+SecurityCCNonceReport = SecurityCCNonceReport_1 = __decorate([
+    CCCommand(SecurityCommand.NonceReport)
+], SecurityCCNonceReport);
+export { SecurityCCNonceReport };
+let SecurityCCNonceGet = class SecurityCCNonceGet extends SecurityCC {
+};
+SecurityCCNonceGet = __decorate([
+    CCCommand(SecurityCommand.NonceGet),
+    expectedCCResponse(SecurityCCNonceReport)
+], SecurityCCNonceGet);
+export { SecurityCCNonceGet };
+function getCCResponseForCommandEncapsulation(sent) {
+    if (sent.encapsulated.expectsCCResponse()) {
+        return SecurityCCCommandEncapsulation;
+    }
+}
+let SecurityCCCommandEncapsulation = SecurityCCCommandEncapsulation_1 = class SecurityCCCommandEncapsulation extends SecurityCC {
+    constructor(options) {
+        super(options);
+        if ("encapsulated" in options) {
+            this.encapsulated = options.encapsulated;
+            this.encapsulated.encapsulatingCC = this;
+        }
+        else {
+            this.decryptedCCBytes = options.decryptedCCBytes;
+            this.sequenced = options.sequenced;
+            this.secondFrame = options.secondFrame;
+            this.sequenceCounter = options.sequenceCounter;
+        }
+        this.alternativeNetworkKey = options.alternativeNetworkKey;
+    }
+    static from(raw, ctx) {
+        assertSecurityRX(ctx);
+        // HALF_NONCE_SIZE bytes iv, 1 byte frame control, at least 1 CC byte, 1 byte nonce id, 8 bytes auth code
+        validatePayload(raw.payload.length >= HALF_NONCE_SIZE + 1 + 1 + 1 + 8);
+        const iv = raw.payload.subarray(0, HALF_NONCE_SIZE);
+        const encryptedPayload = raw.payload.subarray(HALF_NONCE_SIZE, -9);
+        const nonceId = raw.payload.at(-9);
+        const authCode = raw.payload.subarray(-8);
+        // Retrieve the used nonce from the nonce store
+        const nonce = ctx.securityManager.getNonce(nonceId);
+        // Only accept the message if the nonce hasn't expired
+        if (!nonce) {
+            validatePayload.fail(`Nonce ${num2hex(nonceId)} expired, cannot decode security encapsulated command.`);
+        }
+        // and mark the nonce as used
+        ctx.securityManager.deleteNonce(nonceId);
+        // Validate the encrypted data
+        const authData = getAuthenticationData(iv, nonce, SecurityCommand.CommandEncapsulation, ctx.sourceNodeId, ctx.ownNodeId, encryptedPayload);
+        const expectedAuthCode = computeMAC(authData, ctx.securityManager.authKey);
+        // Only accept messages with a correct auth code
+        validatePayload.withReason("Invalid auth code, won't accept security encapsulated command.")(authCode.equals(expectedAuthCode));
+        // Decrypt the encapsulated CC
+        const frameControlAndDecryptedCC = decryptAES128OFB(encryptedPayload, ctx.securityManager.encryptionKey, Bytes.concat([iv, nonce]));
+        const frameControl = frameControlAndDecryptedCC[0];
+        const sequenceCounter = frameControl & 0b1111;
+        const sequenced = !!(frameControl & 0b1_0000);
+        const secondFrame = !!(frameControl & 0b10_0000);
+        const decryptedCCBytes = frameControlAndDecryptedCC
+            .subarray(1);
+        const ret = new SecurityCCCommandEncapsulation_1({
+            nodeId: ctx.sourceNodeId,
+            sequenceCounter,
+            sequenced,
+            secondFrame,
+            decryptedCCBytes,
+        });
+        ret.authData = authData;
+        ret.authCode = authCode;
+        ret.iv = iv;
+        return ret;
+    }
+    sequenced;
+    secondFrame;
+    sequenceCounter;
+    decryptedCCBytes;
+    encapsulated;
+    alternativeNetworkKey;
+    get nonceId() {
+        return this.nonce?.[0];
+    }
+    nonce;
+    // Only used testing/for debugging purposes
+    iv;
+    authData;
+    authCode;
+    ciphertext;
+    getPartialCCSessionId() {
+        if (this.sequenced) {
+            return {
+                // Treat Encapsulation and EncapsulationNonceGet as one
+                ccCommand: undefined,
+                sequence: this.sequenceCounter,
+            };
+        }
+        else {
+            return {
+                // Treat Encapsulation and EncapsulationNonceGet as one
+                ccCommand: undefined,
+            };
+        }
+    }
+    expectMoreMessages() {
+        return !!this.sequenced && !this.secondFrame;
+    }
+    mergePartialCCs(partials, ctx) {
+        // Concat the CC buffers
+        this.decryptedCCBytes = Bytes.concat([...partials, this].map((cc) => cc.decryptedCCBytes));
+        // make sure this contains a complete CC command that's worth splitting
+        validatePayload(this.decryptedCCBytes.length >= 2);
+        // and deserialize the CC
+        this.encapsulated = CommandClass.parse(this.decryptedCCBytes, ctx);
+        this.encapsulated.encapsulatingCC = this;
+    }
+    serialize(ctx) {
+        if (!this.nonce)
+            throwNoNonce();
+        if (this.nonce.length !== HALF_NONCE_SIZE) {
+            throwNoNonce("Invalid nonce size");
+        }
+        assertSecurityTX(ctx);
+        let authKey;
+        let encryptionKey;
+        if (this.alternativeNetworkKey) {
+            authKey = generateAuthKey(this.alternativeNetworkKey);
+            encryptionKey = generateEncryptionKey(this.alternativeNetworkKey);
+        }
+        else {
+            authKey = ctx.securityManager.authKey;
+            encryptionKey = ctx.securityManager.encryptionKey;
+        }
+        const serializedCC = this.encapsulated.serialize(ctx);
+        const plaintext = Bytes.concat([
+            Bytes.from([0]), // TODO: frame control
+            serializedCC,
+        ]);
+        // Encrypt the payload
+        const senderNonce = randomBytes(HALF_NONCE_SIZE);
+        const iv = Bytes.concat([senderNonce, this.nonce]);
+        const ciphertext = encryptAES128OFB(plaintext, encryptionKey, iv);
+        // And generate the auth code
+        const authData = getAuthenticationData(senderNonce, this.nonce, this.ccCommand, ctx.ownNodeId, this.nodeId, ciphertext);
+        const authCode = computeMAC(authData, authKey);
+        // Remember for debugging purposes
+        this.iv = iv;
+        this.authData = authData;
+        this.authCode = authCode;
+        this.ciphertext = ciphertext;
+        this.payload = Bytes.concat([
+            senderNonce,
+            ciphertext,
+            Bytes.from([this.nonceId]),
+            authCode,
+        ]);
+        return super.serialize(ctx);
+    }
+    computeEncapsulationOverhead() {
+        // Security CC adds 8 bytes IV, 1 byte frame control, 1 byte nonce ID, 8 bytes MAC
+        return super.computeEncapsulationOverhead() + 18;
+    }
+    toLogEntry(ctx) {
+        const message = {};
+        if (this.nonceId != undefined) {
+            message["nonce id"] = this.nonceId;
+        }
+        if (this.sequenced != undefined) {
+            message.sequenced = this.sequenced;
+            if (this.sequenced) {
+                if (this.secondFrame != undefined) {
+                    message["second frame"] = this.secondFrame;
+                }
+                if (this.sequenceCounter != undefined) {
+                    message["sequence counter"] = this.sequenceCounter;
+                }
+            }
+        }
+        // Log the plaintext in integration tests and development mode
+        if (process.env.NODE_ENV === "test"
+            || process.env.NODE_ENV === "development") {
+            if (this.iv) {
+                message.IV = buffer2hex(this.iv);
+            }
+            if (this.ciphertext) {
+                message.ciphertext = buffer2hex(this.ciphertext);
+            }
+            else if (this.decryptedCCBytes) {
+                message.plaintext = buffer2hex(this.decryptedCCBytes);
+            }
+            if (this.authData) {
+                message["auth data"] = buffer2hex(this.authData);
+            }
+            if (this.authCode) {
+                message["auth code"] = buffer2hex(this.authCode);
+            }
+        }
+        return {
+            ...super.toLogEntry(ctx),
+            message,
+        };
+    }
+};
+SecurityCCCommandEncapsulation = SecurityCCCommandEncapsulation_1 = __decorate([
+    CCCommand(SecurityCommand.CommandEncapsulation),
+    expectedCCResponse(getCCResponseForCommandEncapsulation, () => "checkEncapsulated")
+], SecurityCCCommandEncapsulation);
+export { SecurityCCCommandEncapsulation };
+// This is the same message, but with another CC command
+let SecurityCCCommandEncapsulationNonceGet = class SecurityCCCommandEncapsulationNonceGet extends SecurityCCCommandEncapsulation {
+};
+SecurityCCCommandEncapsulationNonceGet = __decorate([
+    CCCommand(SecurityCommand.CommandEncapsulationNonceGet)
+], SecurityCCCommandEncapsulationNonceGet);
+export { SecurityCCCommandEncapsulationNonceGet };
+let SecurityCCSchemeReport = SecurityCCSchemeReport_1 = class SecurityCCSchemeReport extends SecurityCC {
+    static from(raw, ctx) {
+        validatePayload(raw.payload.length >= 1);
+        // The including controller MUST NOT perform any validation of the Supported Security Schemes byte
+        return new SecurityCCSchemeReport_1({
+            nodeId: ctx.sourceNodeId,
+        });
+    }
+    serialize(ctx) {
+        // Since it is unlikely that any more schemes will be added to S0, we hardcode the default scheme here (bit 0 = 0)
+        this.payload = Bytes.from([0]);
+        return super.serialize(ctx);
+    }
+    toLogEntry(ctx) {
+        return {
+            ...super.toLogEntry(ctx),
+            // Hide the default payload line
+            message: undefined,
+        };
+    }
+};
+SecurityCCSchemeReport = SecurityCCSchemeReport_1 = __decorate([
+    CCCommand(SecurityCommand.SchemeReport)
+], SecurityCCSchemeReport);
+export { SecurityCCSchemeReport };
+let SecurityCCSchemeGet = class SecurityCCSchemeGet extends SecurityCC {
+    serialize(ctx) {
+        // Since it is unlikely that any more schemes will be added to S0, we hardcode the default scheme here (bit 0 = 0)
+        this.payload = Bytes.from([0]);
+        return super.serialize(ctx);
+    }
+    toLogEntry(ctx) {
+        return {
+            ...super.toLogEntry(ctx),
+            // Hide the default payload line
+            message: undefined,
+        };
+    }
+};
+SecurityCCSchemeGet = __decorate([
+    CCCommand(SecurityCommand.SchemeGet),
+    expectedCCResponse(SecurityCCSchemeReport)
+], SecurityCCSchemeGet);
+export { SecurityCCSchemeGet };
+let SecurityCCSchemeInherit = class SecurityCCSchemeInherit extends SecurityCC {
+    serialize(ctx) {
+        // Since it is unlikely that any more schemes will be added to S0, we hardcode the default scheme here (bit 0 = 0)
+        this.payload = Bytes.from([0]);
+        return super.serialize(ctx);
+    }
+    toLogEntry(ctx) {
+        return {
+            ...super.toLogEntry(ctx),
+            // Hide the default payload line
+            message: undefined,
+        };
+    }
+};
+SecurityCCSchemeInherit = __decorate([
+    CCCommand(SecurityCommand.SchemeInherit),
+    expectedCCResponse(SecurityCCSchemeReport)
+], SecurityCCSchemeInherit);
+export { SecurityCCSchemeInherit };
+let SecurityCCNetworkKeyVerify = class SecurityCCNetworkKeyVerify extends SecurityCC {
+};
+SecurityCCNetworkKeyVerify = __decorate([
+    CCCommand(SecurityCommand.NetworkKeyVerify)
+], SecurityCCNetworkKeyVerify);
+export { SecurityCCNetworkKeyVerify };
+let SecurityCCNetworkKeySet = SecurityCCNetworkKeySet_1 = class SecurityCCNetworkKeySet extends SecurityCC {
+    constructor(options) {
+        super(options);
+        if (options.networkKey.length !== 16) {
+            throw new ZWaveError(`The network key must have length 16!`, ZWaveErrorCodes.Argument_Invalid);
+        }
+        this.networkKey = options.networkKey;
+    }
+    static from(raw, ctx) {
+        validatePayload(raw.payload.length >= 16);
+        const networkKey = raw.payload.subarray(0, 16);
+        return new SecurityCCNetworkKeySet_1({
+            nodeId: ctx.sourceNodeId,
+            networkKey,
+        });
+    }
+    networkKey;
+    serialize(ctx) {
+        this.payload = Bytes.view(this.networkKey);
+        return super.serialize(ctx);
+    }
+    toLogEntry(ctx) {
+        // The network key shouldn't be logged, so users can safely post their logs online
+        const { message, ...log } = super.toLogEntry(ctx);
+        return log;
+    }
+};
+SecurityCCNetworkKeySet = SecurityCCNetworkKeySet_1 = __decorate([
+    CCCommand(SecurityCommand.NetworkKeySet),
+    expectedCCResponse(SecurityCCNetworkKeyVerify)
+], SecurityCCNetworkKeySet);
+export { SecurityCCNetworkKeySet };
+let SecurityCCCommandsSupportedReport = SecurityCCCommandsSupportedReport_1 = class SecurityCCCommandsSupportedReport extends SecurityCC {
+    constructor(options) {
+        super(options);
+        this.supportedCCs = options.supportedCCs;
+        this.controlledCCs = options.controlledCCs;
+        // TODO: properly split the CCs into multiple reports
+        this.reportsToFollow = options.reportsToFollow ?? 0;
+    }
+    static from(raw, ctx) {
+        validatePayload(raw.payload.length >= 1);
+        const reportsToFollow = raw.payload[0];
+        const list = parseCCList(raw.payload.subarray(1));
+        const supportedCCs = list.supportedCCs;
+        const controlledCCs = list.controlledCCs;
+        return new SecurityCCCommandsSupportedReport_1({
+            nodeId: ctx.sourceNodeId,
+            reportsToFollow,
+            supportedCCs,
+            controlledCCs,
+        });
+    }
+    reportsToFollow;
+    supportedCCs;
+    controlledCCs;
+    getPartialCCSessionId() {
+        // Nothing special we can distinguish sessions with
+        return {};
+    }
+    expectMoreMessages() {
+        return this.reportsToFollow > 0;
+    }
+    mergePartialCCs(partials) {
+        // Concat the lists of CCs
+        this.supportedCCs = [...partials, this]
+            .map((report) => report.supportedCCs)
+            .reduce((prev, cur) => prev.concat(...cur), []);
+        this.controlledCCs = [...partials, this]
+            .map((report) => report.controlledCCs)
+            .reduce((prev, cur) => prev.concat(...cur), []);
+    }
+    serialize(ctx) {
+        this.payload = Bytes.concat([
+            Bytes.from([this.reportsToFollow]),
+            encodeCCList(this.supportedCCs, this.controlledCCs),
+        ]);
+        return super.serialize(ctx);
+    }
+    toLogEntry(ctx) {
+        return {
+            ...super.toLogEntry(ctx),
+            message: {
+                reportsToFollow: this.reportsToFollow,
+                supportedCCs: this.supportedCCs
+                    .map((cc) => getCCName(cc))
+                    .map((cc) => `\n· ${cc}`)
+                    .join(""),
+                controlledCCs: this.controlledCCs
+                    .map((cc) => getCCName(cc))
+                    .map((cc) => `\n· ${cc}`)
+                    .join(""),
+            },
+        };
+    }
+};
+SecurityCCCommandsSupportedReport = SecurityCCCommandsSupportedReport_1 = __decorate([
+    CCCommand(SecurityCommand.CommandsSupportedReport)
+], SecurityCCCommandsSupportedReport);
+export { SecurityCCCommandsSupportedReport };
+let SecurityCCCommandsSupportedGet = class SecurityCCCommandsSupportedGet extends SecurityCC {
+};
+SecurityCCCommandsSupportedGet = __decorate([
+    CCCommand(SecurityCommand.CommandsSupportedGet),
+    expectedCCResponse(SecurityCCCommandsSupportedReport)
+], SecurityCCCommandsSupportedGet);
+export { SecurityCCCommandsSupportedGet };
+//# sourceMappingURL=SecurityCC.js.map