@zwave-js/cc 14.0.0-beta.1 → 14.0.0-beta.4

package/build/cjs/cc/Security2CC.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/cc/Security2CC.ts"],
+  "sourcesContent": ["import {\n\tCommandClasses,\n\tMPANState,\n\ttype MessageOrCCLogEntry,\n\tMessagePriority,\n\ttype MessageRecord,\n\ttype MulticastDestination,\n\ttype S2SecurityClass,\n\tSECURITY_S2_AUTH_TAG_LENGTH,\n\tSPANState,\n\ttype SPANTableEntry,\n\tSecurityClass,\n\ttype SecurityManager2,\n\tTransmitOptions,\n\ttype WithAddress,\n\tZWaveError,\n\tZWaveErrorCodes,\n\tdecryptAES128CCM,\n\tencodeBitMask,\n\tencryptAES128CCM,\n\tgetCCName,\n\thighResTimestamp,\n\tisLongRangeNodeId,\n\tisTransmissionError,\n\tisZWaveError,\n\tparseBitMask,\n\tparseCCList,\n\tsecurityClassIsS2,\n\tsecurityClassOrder,\n\tvalidatePayload,\n} from \"@zwave-js/core\";\nimport {\n\tEncapsulationFlags,\n\ttype MaybeNotKnown,\n\tNODE_ID_BROADCAST,\n\tNODE_ID_BROADCAST_LR,\n\ttype SecurityManagers,\n\tencodeCCList,\n} from \"@zwave-js/core/safe\";\nimport type {\n\tCCEncodingContext,\n\tCCParsingContext,\n\tGetValueDB,\n} from \"@zwave-js/host/safe\";\nimport { Bytes } from \"@zwave-js/shared/safe\";\nimport { buffer2hex, getEnumMemberName, pick } from \"@zwave-js/shared/safe\";\nimport { wait } from \"alcalzone-shared/async/index.js\";\nimport { isArray } from \"alcalzone-shared/typeguards/index.js\";\nimport { CCAPI } from \"../lib/API.js\";\nimport {\n\ttype CCRaw,\n\ttype CCResponseRole,\n\tCommandClass,\n\ttype InterviewContext,\n} from \"../lib/CommandClass.js\";\nimport {\n\tAPI,\n\tCCCommand,\n\tcommandClass,\n\texpectedCCResponse,\n\timplementedVersion,\n} from \"../lib/CommandClassDecorators.js\";\nimport {\n\tMGRPExtension,\n\tMOSExtension,\n\tMPANExtension,\n\tSPANExtension,\n\tSecurity2Extension,\n\tValidateS2ExtensionResult,\n\tvalidateS2Extension,\n} from \"../lib/Security2/Extension.js\";\nimport {\n\tECDHProfiles,\n\tKEXFailType,\n\tKEXSchemes,\n} from \"../lib/Security2/shared.js\";\nimport { Security2Command } from \"../lib/_Types.js\";\nimport { CRC16CC } from \"./CRC16CC.js\";\nimport { MultiChannelCC } from \"./MultiChannelCC.js\";\nimport { SecurityCC } from \"./SecurityCC.js\";\nimport { TransportServiceCC } from \"./TransportServiceCC.js\";\n\nfunction securityClassToBitMask(key: SecurityClass): Bytes {\n\treturn encodeBitMask(\n\t\t[key],\n\t\tSecurityClass.S0_Legacy,\n\t\tSecurityClass.S2_Unauthenticated,\n\t);\n}\n\nfunction bitMaskToSecurityClass(\n\tbuffer: Uint8Array,\n\toffset: number,\n): SecurityClass {\n\tconst keys = parseBitMask(\n\t\tbuffer.subarray(offset, offset + 1),\n\t\tSecurityClass.S2_Unauthenticated,\n\t);\n\tvalidatePayload(keys.length === 1);\n\treturn keys[0];\n}\n\nfunction getAuthenticationData(\n\tsendingNodeId: number,\n\tdestination: number,\n\thomeId: number,\n\tcommandLength: number,\n\tunencryptedPayload: Uint8Array,\n): Uint8Array {\n\tconst nodeIdSize =\n\t\tisLongRangeNodeId(sendingNodeId) || isLongRangeNodeId(destination)\n\t\t\t? 2\n\t\t\t: 1;\n\tconst ret = new Bytes(\n\t\t2 * nodeIdSize + 6 + unencryptedPayload.length,\n\t);\n\tlet offset = 0;\n\tret.writeUIntBE(sendingNodeId, offset, nodeIdSize);\n\toffset += nodeIdSize;\n\tret.writeUIntBE(destination, offset, nodeIdSize);\n\toffset += nodeIdSize;\n\tret.writeUInt32BE(homeId, offset);\n\toffset += 4;\n\tret.writeUInt16BE(commandLength, offset);\n\toffset += 2;\n\t// This includes the sequence number and all unencrypted extensions\n\tret.set(unencryptedPayload, offset);\n\treturn ret;\n}\nfunction getSecurityManager(\n\townNodeId: number,\n\tsecurityManagers: SecurityManagers,\n\totherNodeId: MulticastDestination | number,\n): SecurityManager2 | undefined {\n\tconst longRange = isLongRangeNodeId(ownNodeId)\n\t\t|| isLongRangeNodeId(\n\t\t\tisArray(otherNodeId) ? otherNodeId[0] : otherNodeId,\n\t\t);\n\treturn longRange\n\t\t? securityManagers.securityManagerLR\n\t\t: securityManagers.securityManager2;\n}\n\n/** Validates that a sequence number is not a duplicate and updates the SPAN table if it is accepted. Returns the previous sequence number if there is one. */\nfunction validateSequenceNumber(\n\tsecurityManager: SecurityManager2,\n\tsourceNodeId: number,\n\tsequenceNumber: number,\n): number | undefined {\n\tvalidatePayload.withReason(\n\t\t`Duplicate command (sequence number ${sequenceNumber})`,\n\t)(\n\t\t!securityManager.isDuplicateSinglecast(\n\t\t\tsourceNodeId,\n\t\t\tsequenceNumber,\n\t\t),\n\t);\n\t// Not a duplicate, store it\n\treturn securityManager.storeSequenceNumber(\n\t\tsourceNodeId,\n\t\tsequenceNumber,\n\t);\n}\n\nconst MAX_DECRYPT_ATTEMPTS_SINGLECAST = 5;\nconst MAX_DECRYPT_ATTEMPTS_MULTICAST = 5;\nconst MAX_DECRYPT_ATTEMPTS_SC_FOLLOWUP = 1;\n\n// @publicAPI\nexport interface DecryptionResult {\n\tplaintext: Uint8Array;\n\tauthOK: boolean;\n\tkey?: Uint8Array;\n\tiv?: Uint8Array;\n\tsecurityClass: SecurityClass | undefined;\n}\n\nfunction assertSecurityRX(\n\tctx: CCParsingContext,\n): SecurityManager2 {\n\tif (!ctx.ownNodeId) {\n\t\tthrow new ZWaveError(\n\t\t\t`Secure commands (S2) can only be decoded when the controller's node id is known!`,\n\t\t\tZWaveErrorCodes.Driver_NotReady,\n\t\t);\n\t}\n\n\tconst ret = getSecurityManager(ctx.ownNodeId, ctx, ctx.sourceNodeId);\n\n\tif (!ret) {\n\t\tthrow new ZWaveError(\n\t\t\t`Secure commands (S2) can only be decoded when the security manager is set up!`,\n\t\t\tZWaveErrorCodes.Driver_NoSecurity,\n\t\t);\n\t}\n\n\treturn ret;\n}\n\nfunction assertSecurityTX(\n\tctx: CCEncodingContext,\n\tdestination: MulticastDestination | number,\n): SecurityManager2 {\n\tif (!ctx.ownNodeId) {\n\t\tthrow new ZWaveError(\n\t\t\t`Secure commands (S2) can only be sent when the controller's node id is known!`,\n\t\t\tZWaveErrorCodes.Driver_NotReady,\n\t\t);\n\t}\n\n\tconst ret = getSecurityManager(ctx.ownNodeId, ctx, destination);\n\n\tif (!ret) {\n\t\tthrow new ZWaveError(\n\t\t\t`Secure commands (S2) can only be sent when the security manager is set up!`,\n\t\t\tZWaveErrorCodes.Driver_NoSecurity,\n\t\t);\n\t}\n\n\treturn ret;\n}\n\nfunction decryptSinglecast(\n\tctx: CCParsingContext,\n\tsecurityManager: SecurityManager2,\n\tsendingNodeId: number,\n\tcurSequenceNumber: number,\n\tprevSequenceNumber: number,\n\tciphertext: Uint8Array,\n\tauthData: Uint8Array,\n\tauthTag: Uint8Array,\n\tspanState: SPANTableEntry & {\n\t\ttype: SPANState.SPAN | SPANState.LocalEI;\n\t},\n\textensions: Security2Extension[],\n): DecryptionResult {\n\tconst decryptWithNonce = (nonce: Uint8Array) => {\n\t\tconst { keyCCM: key } = securityManager.getKeysForNode(\n\t\t\tsendingNodeId,\n\t\t);\n\n\t\tconst iv = nonce;\n\t\treturn {\n\t\t\tkey,\n\t\t\tiv,\n\t\t\t...decryptAES128CCM(key, iv, ciphertext, authData, authTag),\n\t\t};\n\t};\n\tconst getNonceAndDecrypt = () => {\n\t\tconst iv = securityManager.nextNonce(sendingNodeId);\n\t\treturn decryptWithNonce(iv);\n\t};\n\n\tif (spanState.type === SPANState.SPAN) {\n\t\t// There SHOULD be a shared SPAN between both parties. But experience has shown that both could have\n\t\t// sent a command at roughly the same time, using the same SPAN for encryption.\n\t\t// To avoid a nasty desync and both nodes trying to resync at the same time, causing message loss,\n\t\t// we accept commands encrypted with the previous SPAN under very specific circumstances:\n\t\tif (\n\t\t\t// The previous SPAN is still known, i.e. the node didn't send another command that was successfully decrypted\n\t\t\t!!spanState.currentSPAN\n\t\t\t// it is still valid\n\t\t\t&& spanState.currentSPAN.expires > highResTimestamp()\n\t\t\t// The received command is exactly the next, expected one\n\t\t\t&& prevSequenceNumber != undefined\n\t\t\t&& curSequenceNumber === ((prevSequenceNumber + 1) & 0xff)\n\t\t\t// And in case of a mock-based test, do this only on the controller\n\t\t\t&& !ctx.__internalIsMockNode\n\t\t) {\n\t\t\tconst nonce = spanState.currentSPAN.nonce;\n\t\t\tspanState.currentSPAN = undefined;\n\n\t\t\t// If we could decrypt this way, we're done...\n\t\t\tconst result = decryptWithNonce(nonce);\n\t\t\tif (result.authOK) {\n\t\t\t\treturn {\n\t\t\t\t\t...result,\n\t\t\t\t\tsecurityClass: spanState.securityClass,\n\t\t\t\t};\n\t\t\t}\n\t\t\t// ...otherwise, we need to try the normal way\n\t\t} else {\n\t\t\t// forgetting the current SPAN shouldn't be necessary but better be safe than sorry\n\t\t\tspanState.currentSPAN = undefined;\n\t\t}\n\n\t\t// This can only happen if the security class is known\n\t\treturn {\n\t\t\t...getNonceAndDecrypt(),\n\t\t\tsecurityClass: spanState.securityClass,\n\t\t};\n\t} else if (spanState.type === SPANState.LocalEI) {\n\t\t// We've sent the other our receiver's EI and received its sender's EI,\n\t\t// meaning we can now establish an SPAN\n\t\tconst senderEI = getSenderEI(extensions);\n\t\tif (!senderEI) failNoSPAN();\n\t\tconst receiverEI = spanState.receiverEI;\n\n\t\t// How we do this depends on whether we know the security class of the other node\n\t\tconst isBootstrappingNode = securityManager.tempKeys.has(\n\t\t\tsendingNodeId,\n\t\t);\n\t\tif (isBootstrappingNode) {\n\t\t\t// We're currently bootstrapping the node, it might be using a temporary key\n\t\t\tsecurityManager.initializeTempSPAN(\n\t\t\t\tsendingNodeId,\n\t\t\t\tsenderEI,\n\t\t\t\treceiverEI,\n\t\t\t);\n\n\t\t\tconst ret = getNonceAndDecrypt();\n\t\t\t// Decryption with the temporary key worked\n\t\t\tif (ret.authOK) {\n\t\t\t\treturn {\n\t\t\t\t\t...ret,\n\t\t\t\t\tsecurityClass: SecurityClass.Temporary,\n\t\t\t\t};\n\t\t\t}\n\n\t\t\t// Reset the SPAN state and try with the recently granted security class\n\t\t\tsecurityManager.setSPANState(\n\t\t\t\tsendingNodeId,\n\t\t\t\tspanState,\n\t\t\t);\n\t\t}\n\n\t\t// When ending up here, one of two situations has occured:\n\t\t// a) We've taken over an existing network and do not know the node's security class\n\t\t// b) We know the security class, but we're about to establish a new SPAN. This may happen at a lower\n\t\t//    security class than the one the node normally uses, e.g. when we're being queried for securely\n\t\t//    supported CCs.\n\t\t// In both cases, we should simply try decoding with multiple security classes, starting from the highest one.\n\t\t// If this fails, we restore the previous (partial) SPAN state.\n\n\t\t// Try all security classes where we do not definitely know that it was not granted\n\t\t// While bootstrapping a node, we consider the key that is being exchanged (including S0) to be the highest. No need to look at others\n\t\tconst possibleSecurityClasses = isBootstrappingNode\n\t\t\t? [ctx.getHighestSecurityClass(sendingNodeId)!]\n\t\t\t: securityClassOrder.filter(\n\t\t\t\t(s) =>\n\t\t\t\t\tctx.hasSecurityClass(sendingNodeId, s)\n\t\t\t\t\t\t!== false,\n\t\t\t);\n\n\t\tfor (const secClass of possibleSecurityClasses) {\n\t\t\t// Skip security classes we don't have keys for\n\t\t\tif (\n\t\t\t\t!securityManager.hasKeysForSecurityClass(\n\t\t\t\t\tsecClass,\n\t\t\t\t)\n\t\t\t) {\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\t// Initialize an SPAN with that security class\n\t\t\tsecurityManager.initializeSPAN(\n\t\t\t\tsendingNodeId,\n\t\t\t\tsecClass,\n\t\t\t\tsenderEI,\n\t\t\t\treceiverEI,\n\t\t\t);\n\t\t\tconst ret = getNonceAndDecrypt();\n\n\t\t\t// It worked, return the result\n\t\t\tif (ret.authOK) {\n\t\t\t\t// Also if we weren't sure before, we now know that the security class is granted\n\t\t\t\tif (\n\t\t\t\t\tctx.hasSecurityClass(sendingNodeId, secClass)\n\t\t\t\t\t\t=== undefined\n\t\t\t\t) {\n\t\t\t\t\tctx.setSecurityClass(sendingNodeId, secClass, true);\n\t\t\t\t}\n\t\t\t\treturn {\n\t\t\t\t\t...ret,\n\t\t\t\t\tsecurityClass: secClass,\n\t\t\t\t};\n\t\t\t} else {\n\t\t\t\t// Reset the SPAN state and try with the next security class\n\t\t\t\tsecurityManager.setSPANState(\n\t\t\t\t\tsendingNodeId,\n\t\t\t\t\tspanState,\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\t}\n\n\t// Nothing worked, fail the decryption\n\treturn {\n\t\tplaintext: new Uint8Array(),\n\t\tauthOK: false,\n\t\tsecurityClass: undefined,\n\t};\n}\n\nfunction decryptMulticast(\n\tsendingNodeId: number,\n\tsecurityManager: SecurityManager2,\n\tgroupId: number,\n\tciphertext: Uint8Array,\n\tauthData: Uint8Array,\n\tauthTag: Uint8Array,\n): DecryptionResult {\n\tconst iv = securityManager.nextPeerMPAN(\n\t\tsendingNodeId,\n\t\tgroupId,\n\t);\n\tconst { keyCCM: key } = securityManager.getKeysForNode(\n\t\tsendingNodeId,\n\t);\n\treturn {\n\t\tkey,\n\t\tiv,\n\t\t...decryptAES128CCM(key, iv, ciphertext, authData, authTag),\n\t\t// The security class is irrelevant when decrypting multicast commands\n\t\tsecurityClass: undefined,\n\t};\n}\n\nfunction getDestinationIDTX(\n\tthis: Security2CC & { extensions: Security2Extension[] },\n): number {\n\tif (this.isSinglecast()) return this.nodeId;\n\n\tconst ret = getMulticastGroupId(this.extensions);\n\tif (ret == undefined) {\n\t\tthrow new ZWaveError(\n\t\t\t\"Multicast Security S2 encapsulation requires the MGRP extension\",\n\t\t\tZWaveErrorCodes.Security2CC_MissingExtension,\n\t\t);\n\t}\n\treturn ret;\n}\n\nfunction getDestinationIDRX(\n\tctx: CCParsingContext,\n\textensions: Security2Extension[],\n): number {\n\tif (ctx.frameType === \"singlecast\") {\n\t\treturn ctx.ownNodeId;\n\t}\n\n\tconst ret = getMulticastGroupId(extensions);\n\tif (ret == undefined) {\n\t\tthrow new ZWaveError(\n\t\t\t\"Multicast Security S2 encapsulation requires the MGRP extension\",\n\t\t\tZWaveErrorCodes.Security2CC_MissingExtension,\n\t\t);\n\t}\n\treturn ret;\n}\n\nfunction getMulticastGroupId(\n\textensions: Security2Extension[],\n): number | undefined {\n\tconst mgrpExtension = extensions.find(\n\t\t(e) => e instanceof MGRPExtension,\n\t);\n\treturn mgrpExtension?.groupId;\n}\n\n/** Returns the Sender's Entropy Input if this command contains an SPAN extension */\nfunction getSenderEI(extensions: Security2Extension[]): Uint8Array | undefined {\n\tconst spanExtension = extensions.find(\n\t\t(e) => e instanceof SPANExtension,\n\t);\n\treturn spanExtension?.senderEI;\n}\n\n// Encapsulation CCs are used internally and too frequently that we\n// want to pay the cost of validating each call\n/* eslint-disable @zwave-js/ccapi-validate-args */\n\n@API(CommandClasses[\"Security 2\"])\nexport class Security2CCAPI extends CCAPI {\n\tpublic supportsCommand(_cmd: Security2Command): MaybeNotKnown<boolean> {\n\t\t// All commands are mandatory\n\t\treturn true;\n\t}\n\n\t/**\n\t * Sends a nonce to the node, either in response to a NonceGet request or a message that failed to decrypt. The message is sent without any retransmission etc.\n\t * The return value indicates whether a nonce was successfully sent\n\t */\n\tpublic async sendNonce(): Promise<boolean> {\n\t\tthis.assertSupportsCommand(\n\t\t\tSecurity2Command,\n\t\t\tSecurity2Command.NonceReport,\n\t\t);\n\n\t\tthis.assertPhysicalEndpoint(this.endpoint);\n\n\t\tconst securityManager = getSecurityManager(\n\t\t\tthis.host.ownNodeId,\n\t\t\tthis.host,\n\t\t\tthis.endpoint.nodeId,\n\t\t);\n\n\t\tif (!securityManager) {\n\t\t\tthrow new ZWaveError(\n\t\t\t\t`Nonces can only be sent if secure communication is set up!`,\n\t\t\t\tZWaveErrorCodes.Driver_NoSecurity,\n\t\t\t);\n\t\t}\n\n\t\tconst receiverEI = securityManager.generateNonce(\n\t\t\tthis.endpoint.nodeId,\n\t\t);\n\n\t\tconst cc = new Security2CCNonceReport({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t\tSOS: true,\n\t\t\tMOS: false,\n\t\t\treceiverEI,\n\t\t});\n\n\t\ttry {\n\t\t\tawait this.host.sendCommand(cc, {\n\t\t\t\t...this.commandOptions,\n\t\t\t\t// Seems we need these options or some nodes won't accept the nonce\n\t\t\t\ttransmitOptions: TransmitOptions.ACK\n\t\t\t\t\t| TransmitOptions.AutoRoute,\n\t\t\t\t// Only try sending a nonce once\n\t\t\t\tmaxSendAttempts: 1,\n\t\t\t\t// Nonce requests must be handled immediately\n\t\t\t\tpriority: MessagePriority.Immediate,\n\t\t\t\t// We don't want failures causing us to treat the node as asleep or dead\n\t\t\t\tchangeNodeStatusOnMissingACK: false,\n\t\t\t\t// And we need to react to\n\t\t\t});\n\t\t} catch (e) {\n\t\t\tif (isTransmissionError(e)) {\n\t\t\t\t// The nonce could not be sent, invalidate it\n\t\t\t\tsecurityManager.deleteNonce(\n\t\t\t\t\tthis.endpoint.nodeId,\n\t\t\t\t);\n\t\t\t\treturn false;\n\t\t\t} else {\n\t\t\t\t// Pass other errors through\n\t\t\t\tthrow e;\n\t\t\t}\n\t\t}\n\t\treturn true;\n\t}\n\n\t/** Notifies the target node that the MPAN state is out of sync */\n\tpublic async sendMOS(): Promise<boolean> {\n\t\tthis.assertSupportsCommand(\n\t\t\tSecurity2Command,\n\t\t\tSecurity2Command.NonceReport,\n\t\t);\n\n\t\tthis.assertPhysicalEndpoint(this.endpoint);\n\n\t\tconst cc = new Security2CCNonceReport({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t\tSOS: false,\n\t\t\tMOS: true,\n\t\t});\n\n\t\ttry {\n\t\t\tawait this.host.sendCommand(cc, {\n\t\t\t\t...this.commandOptions,\n\t\t\t\t// Seems we need these options or some nodes won't accept the nonce\n\t\t\t\ttransmitOptions: TransmitOptions.ACK\n\t\t\t\t\t| TransmitOptions.AutoRoute,\n\t\t\t\t// Only try sending a nonce once\n\t\t\t\tmaxSendAttempts: 1,\n\t\t\t\t// Nonce requests must be handled immediately\n\t\t\t\tpriority: MessagePriority.Immediate,\n\t\t\t\t// We don't want failures causing us to treat the node as asleep or dead\n\t\t\t\tchangeNodeStatusOnMissingACK: false,\n\t\t\t});\n\t\t} catch (e) {\n\t\t\tif (isTransmissionError(e)) {\n\t\t\t\treturn false;\n\t\t\t} else {\n\t\t\t\t// Pass other errors through\n\t\t\t\tthrow e;\n\t\t\t}\n\t\t}\n\t\treturn true;\n\t}\n\n\t/** Sends the given MPAN to the node */\n\tpublic async sendMPAN(\n\t\tgroupId: number,\n\t\tinnerMPANState: Uint8Array,\n\t): Promise<boolean> {\n\t\tthis.assertSupportsCommand(\n\t\t\tSecurity2Command,\n\t\t\tSecurity2Command.MessageEncapsulation,\n\t\t);\n\n\t\tthis.assertPhysicalEndpoint(this.endpoint);\n\n\t\tconst cc = new Security2CCMessageEncapsulation({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t\textensions: [\n\t\t\t\tnew MPANExtension({\n\t\t\t\t\tgroupId,\n\t\t\t\t\tinnerMPANState,\n\t\t\t\t}),\n\t\t\t],\n\t\t});\n\n\t\ttry {\n\t\t\tawait this.host.sendCommand(cc, {\n\t\t\t\t...this.commandOptions,\n\t\t\t\t// Seems we need these options or some nodes won't accept the nonce\n\t\t\t\ttransmitOptions: TransmitOptions.ACK\n\t\t\t\t\t| TransmitOptions.AutoRoute,\n\t\t\t\t// Only try sending a nonce once\n\t\t\t\tmaxSendAttempts: 1,\n\t\t\t\t// Nonce requests must be handled immediately\n\t\t\t\tpriority: MessagePriority.Immediate,\n\t\t\t\t// We don't want failures causing us to treat the node as asleep or dead\n\t\t\t\tchangeNodeStatusOnMissingACK: false,\n\t\t\t});\n\t\t} catch (e) {\n\t\t\tif (isTransmissionError(e)) {\n\t\t\t\treturn false;\n\t\t\t} else {\n\t\t\t\t// Pass other errors through\n\t\t\t\tthrow e;\n\t\t\t}\n\t\t}\n\t\treturn true;\n\t}\n\n\t/**\n\t * Queries the securely supported commands for the current security class\n\t * @param securityClass Can be used to overwrite the security class to use. If this doesn't match the current one, new nonces will need to be exchanged.\n\t */\n\tpublic async getSupportedCommands(\n\t\tsecurityClass:\n\t\t\t| SecurityClass.S2_AccessControl\n\t\t\t| SecurityClass.S2_Authenticated\n\t\t\t| SecurityClass.S2_Unauthenticated,\n\t): Promise<MaybeNotKnown<CommandClasses[]>> {\n\t\tthis.assertSupportsCommand(\n\t\t\tSecurity2Command,\n\t\t\tSecurity2Command.CommandsSupportedGet,\n\t\t);\n\n\t\tlet cc: CommandClass = new Security2CCCommandsSupportedGet({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t});\n\t\t// Security2CCCommandsSupportedGet is special because we cannot reply on the applHost to do the automatic\n\t\t// encapsulation because it would use a different security class. Therefore the entire possible stack\n\t\t// of encapsulation needs to be done here\n\t\tif (MultiChannelCC.requiresEncapsulation(cc)) {\n\t\t\tconst multiChannelCCVersion = this.host.getSupportedCCVersion(\n\t\t\t\tCommandClasses[\"Multi Channel\"],\n\t\t\t\tthis.endpoint.nodeId as number,\n\t\t\t);\n\n\t\t\tcc = multiChannelCCVersion === 1\n\t\t\t\t? MultiChannelCC.encapsulateV1(cc)\n\t\t\t\t: MultiChannelCC.encapsulate(cc);\n\t\t}\n\t\tcc = Security2CC.encapsulate(\n\t\t\tcc,\n\t\t\tthis.host.ownNodeId,\n\t\t\tthis.host,\n\t\t\t{ securityClass },\n\t\t);\n\n\t\tconst response = await this.host.sendCommand<\n\t\t\tSecurity2CCCommandsSupportedReport\n\t\t>(\n\t\t\tcc,\n\t\t\t{\n\t\t\t\t...this.commandOptions,\n\t\t\t\tautoEncapsulate: false,\n\t\t\t},\n\t\t);\n\t\treturn response?.supportedCCs;\n\t}\n\n\tpublic async reportSupportedCommands(\n\t\tsupportedCCs: CommandClasses[],\n\t): Promise<void> {\n\t\tthis.assertSupportsCommand(\n\t\t\tSecurity2Command,\n\t\t\tSecurity2Command.CommandsSupportedReport,\n\t\t);\n\n\t\tconst cc = new Security2CCCommandsSupportedReport({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t\tsupportedCCs,\n\t\t});\n\t\tawait this.host.sendCommand(cc, this.commandOptions);\n\t}\n\n\t// eslint-disable-next-line @typescript-eslint/explicit-module-boundary-types\n\tpublic async getKeyExchangeParameters() {\n\t\tthis.assertSupportsCommand(Security2Command, Security2Command.KEXGet);\n\n\t\tconst cc = new Security2CCKEXGet({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t});\n\t\tconst response = await this.host.sendCommand<Security2CCKEXReport>(\n\t\t\tcc,\n\t\t\tthis.commandOptions,\n\t\t);\n\t\tif (response) {\n\t\t\treturn pick(response, [\n\t\t\t\t\"requestCSA\",\n\t\t\t\t\"echo\",\n\t\t\t\t\"supportedKEXSchemes\",\n\t\t\t\t\"supportedECDHProfiles\",\n\t\t\t\t\"requestedKeys\",\n\t\t\t\t\"_reserved\",\n\t\t\t]);\n\t\t}\n\t}\n\n\t/** Requests the given keys from an including node */\n\tpublic async requestKeys(\n\t\tparams: Omit<Security2CCKEXReportOptions, \"echo\">,\n\t): Promise<void> {\n\t\tthis.assertSupportsCommand(\n\t\t\tSecurity2Command,\n\t\t\tSecurity2Command.KEXReport,\n\t\t);\n\n\t\tconst cc = new Security2CCKEXReport({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t\t...params,\n\t\t\techo: false,\n\t\t});\n\t\tawait this.host.sendCommand(cc, this.commandOptions);\n\t}\n\n\t/** Grants the joining node the given keys */\n\tpublic async grantKeys(\n\t\tparams: Omit<Security2CCKEXSetOptions, \"echo\">,\n\t): Promise<void> {\n\t\tthis.assertSupportsCommand(Security2Command, Security2Command.KEXSet);\n\n\t\tconst cc = new Security2CCKEXSet({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t\t...params,\n\t\t\techo: false,\n\t\t});\n\t\tawait this.host.sendCommand(cc, this.commandOptions);\n\t}\n\n\t/** Confirms the keys that were requested by a node */\n\tpublic async confirmRequestedKeys(\n\t\tparams: Omit<Security2CCKEXReportOptions, \"echo\">,\n\t): Promise<void> {\n\t\tthis.assertSupportsCommand(\n\t\t\tSecurity2Command,\n\t\t\tSecurity2Command.KEXReport,\n\t\t);\n\n\t\tconst cc = new Security2CCKEXReport({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t\t...params,\n\t\t\techo: true,\n\t\t});\n\t\tawait this.host.sendCommand(cc, this.commandOptions);\n\t}\n\n\t/** Confirms the keys that were granted by the including node */\n\tpublic async confirmGrantedKeys(\n\t\tparams: Omit<Security2CCKEXSetOptions, \"echo\">,\n\t): Promise<Security2CCKEXReport | Security2CCKEXFail | undefined> {\n\t\tthis.assertSupportsCommand(\n\t\t\tSecurity2Command,\n\t\t\tSecurity2Command.KEXSet,\n\t\t);\n\n\t\tconst cc = new Security2CCKEXSet({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t\t...params,\n\t\t\techo: true,\n\t\t});\n\t\treturn this.host.sendCommand(cc, this.commandOptions);\n\t}\n\n\t/** Notifies the other node that the ongoing key exchange was aborted */\n\tpublic async abortKeyExchange(failType: KEXFailType): Promise<void> {\n\t\tthis.assertSupportsCommand(Security2Command, Security2Command.KEXFail);\n\n\t\tconst cc = new Security2CCKEXFail({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t\tfailType,\n\t\t});\n\t\tawait this.host.sendCommand(cc, this.commandOptions);\n\t}\n\n\tpublic async sendPublicKey(\n\t\tpublicKey: Uint8Array,\n\t\tincludingNode: boolean = true,\n\t): Promise<void> {\n\t\tthis.assertSupportsCommand(\n\t\t\tSecurity2Command,\n\t\t\tSecurity2Command.PublicKeyReport,\n\t\t);\n\n\t\tconst cc = new Security2CCPublicKeyReport({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t\tincludingNode,\n\t\t\tpublicKey,\n\t\t});\n\t\tawait this.host.sendCommand(cc, this.commandOptions);\n\t}\n\n\tpublic async requestNetworkKey(\n\t\tsecurityClass: SecurityClass,\n\t): Promise<void> {\n\t\tthis.assertSupportsCommand(\n\t\t\tSecurity2Command,\n\t\t\tSecurity2Command.NetworkKeyGet,\n\t\t);\n\n\t\tconst cc = new Security2CCNetworkKeyGet({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t\trequestedKey: securityClass,\n\t\t});\n\t\tawait this.host.sendCommand(cc, this.commandOptions);\n\t}\n\n\tpublic async sendNetworkKey(\n\t\tsecurityClass: SecurityClass,\n\t\tnetworkKey: Uint8Array,\n\t): Promise<void> {\n\t\tthis.assertSupportsCommand(\n\t\t\tSecurity2Command,\n\t\t\tSecurity2Command.NetworkKeyReport,\n\t\t);\n\n\t\tconst cc = new Security2CCNetworkKeyReport({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t\tgrantedKey: securityClass,\n\t\t\tnetworkKey,\n\t\t});\n\t\tawait this.host.sendCommand(cc, this.commandOptions);\n\t}\n\n\tpublic async verifyNetworkKey(): Promise<void> {\n\t\tthis.assertSupportsCommand(\n\t\t\tSecurity2Command,\n\t\t\tSecurity2Command.NetworkKeyVerify,\n\t\t);\n\n\t\tconst cc = new Security2CCNetworkKeyVerify({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t});\n\t\tawait this.host.sendCommand(cc, this.commandOptions);\n\t}\n\n\tpublic async confirmKeyVerification(): Promise<void> {\n\t\tthis.assertSupportsCommand(\n\t\t\tSecurity2Command,\n\t\t\tSecurity2Command.TransferEnd,\n\t\t);\n\n\t\tconst cc = new Security2CCTransferEnd({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t\tkeyVerified: true,\n\t\t\tkeyRequestComplete: false,\n\t\t});\n\t\tawait this.host.sendCommand(cc, {\n\t\t\t...this.commandOptions,\n\t\t\t// Don't wait for an ACK from the node\n\t\t\ttransmitOptions: TransmitOptions.DEFAULT & ~TransmitOptions.ACK,\n\t\t});\n\t}\n\n\tpublic async endKeyExchange(): Promise<void> {\n\t\tthis.assertSupportsCommand(\n\t\t\tSecurity2Command,\n\t\t\tSecurity2Command.TransferEnd,\n\t\t);\n\n\t\tconst cc = new Security2CCTransferEnd({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t\tkeyVerified: false,\n\t\t\tkeyRequestComplete: true,\n\t\t});\n\t\tawait this.host.sendCommand(cc, this.commandOptions);\n\t}\n}\n\n@commandClass(CommandClasses[\"Security 2\"])\n@implementedVersion(1)\nexport class Security2CC extends CommandClass {\n\tdeclare ccCommand: Security2Command;\n\n\tpublic async interview(\n\t\tctx: InterviewContext,\n\t): Promise<void> {\n\t\tconst securityManager = getSecurityManager(\n\t\t\tctx.ownNodeId,\n\t\t\tctx,\n\t\t\tthis.nodeId,\n\t\t);\n\n\t\tconst node = this.getNode(ctx)!;\n\t\tconst endpoint = this.getEndpoint(ctx)!;\n\t\tconst api = CCAPI.create(\n\t\t\tCommandClasses[\"Security 2\"],\n\t\t\tctx,\n\t\t\tendpoint,\n\t\t).withOptions({\n\t\t\tpriority: MessagePriority.NodeQuery,\n\t\t});\n\t\t// Only on the highest security class the response includes the supported commands\n\t\tconst secClass = node.getHighestSecurityClass();\n\t\tlet hasReceivedSecureCommands = false;\n\n\t\tlet possibleSecurityClasses: S2SecurityClass[];\n\t\tif (securityClassIsS2(secClass)) {\n\t\t\t// The highest security class is known to be S2, only query that one\n\t\t\tpossibleSecurityClasses = [secClass];\n\t\t} else if (endpoint.index === 0) {\n\t\t\t// If the highest security class isn't known, query all possible security classes\n\t\t\t// but only on the root device\n\t\t\tpossibleSecurityClasses = [\n\t\t\t\tSecurityClass.S2_Unauthenticated,\n\t\t\t\tSecurityClass.S2_Authenticated,\n\t\t\t\tSecurityClass.S2_AccessControl,\n\t\t\t];\n\t\t} else {\n\t\t\t// For endpoint interviews, the security class MUST be known\n\t\t\tctx.logNode(node.id, {\n\t\t\t\tendpoint: endpoint.index,\n\t\t\t\tmessage:\n\t\t\t\t\t`Cannot query securely supported commands for endpoint because the node's security class isn't known...`,\n\t\t\t\tlevel: \"error\",\n\t\t\t});\n\t\t\treturn;\n\t\t}\n\n\t\tfor (const secClass of possibleSecurityClasses) {\n\t\t\t// We might not know all assigned security classes yet, so we work our way up from low to high and try to request the supported commands.\n\t\t\t// This way, each command is encrypted with the security class we're currently testing.\n\n\t\t\t// If the node does not respond, it wasn't assigned the security class.\n\t\t\t// If it responds with a non-empty list, we know this is the highest class it supports.\n\t\t\t// If the list is empty, the security class is still supported.\n\n\t\t\t// If we already know the class is not supported, skip it\n\t\t\tif (node.hasSecurityClass(secClass) === false) continue;\n\n\t\t\t// If no key is configured for this security class, skip it\n\t\t\tif (\n\t\t\t\t!securityManager?.hasKeysForSecurityClass(secClass)\n\t\t\t) {\n\t\t\t\tctx.logNode(node.id, {\n\t\t\t\t\tendpoint: endpoint.index,\n\t\t\t\t\tmessage: `Cannot query securely supported commands (${\n\t\t\t\t\t\tgetEnumMemberName(\n\t\t\t\t\t\t\tSecurityClass,\n\t\t\t\t\t\t\tsecClass,\n\t\t\t\t\t\t)\n\t\t\t\t\t}) - network key is not configured...`,\n\t\t\t\t\tlevel: \"warn\",\n\t\t\t\t});\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\tctx.logNode(node.id, {\n\t\t\t\tendpoint: endpoint.index,\n\t\t\t\tmessage: `Querying securely supported commands (${\n\t\t\t\t\tgetEnumMemberName(\n\t\t\t\t\t\tSecurityClass,\n\t\t\t\t\t\tsecClass,\n\t\t\t\t\t)\n\t\t\t\t})...`,\n\t\t\t\tdirection: \"outbound\",\n\t\t\t});\n\n\t\t\t// Query the supported commands but avoid remembering the wrong security class in case of a failure\n\t\t\tlet supportedCCs: CommandClasses[] | undefined;\n\t\t\t// Try up to 3 times on the root device. We REALLY don't want a spurious timeout or collision to cause us to discard a known good security class\n\t\t\tconst MAX_ATTEMPTS = this.endpointIndex === 0 ? 3 : 1;\n\t\t\tfor (let attempts = 1; attempts <= MAX_ATTEMPTS; attempts++) {\n\t\t\t\ttry {\n\t\t\t\t\tsupportedCCs = await api.getSupportedCommands(secClass);\n\t\t\t\t} catch (e) {\n\t\t\t\t\tif (\n\t\t\t\t\t\tisZWaveError(e)\n\t\t\t\t\t\t&& e.code === ZWaveErrorCodes.Security2CC_CannotDecode\n\t\t\t\t\t) {\n\t\t\t\t\t\t// Either we were using a non-granted security class,\n\t\t\t\t\t\t// or querying with the known highest security class had an issue\n\t\t\t\t\t\tsupportedCCs = undefined;\n\t\t\t\t\t} else {\n\t\t\t\t\t\tthrow e;\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tif (\n\t\t\t\t\tsupportedCCs == undefined\n\t\t\t\t\t&& possibleSecurityClasses.length === 1\n\t\t\t\t) {\n\t\t\t\t\tif (attempts < MAX_ATTEMPTS) {\n\t\t\t\t\t\t// We definitely know the highest security class\n\t\t\t\t\t\tctx.logNode(node.id, {\n\t\t\t\t\t\t\tendpoint: endpoint.index,\n\t\t\t\t\t\t\tmessage: `Querying securely supported commands (${\n\t\t\t\t\t\t\t\tgetEnumMemberName(\n\t\t\t\t\t\t\t\t\tSecurityClass,\n\t\t\t\t\t\t\t\t\tsecClass,\n\t\t\t\t\t\t\t\t)\n\t\t\t\t\t\t\t}), attempt ${attempts}/${MAX_ATTEMPTS} failed. Retrying in 500ms...`,\n\t\t\t\t\t\t\tlevel: \"warn\",\n\t\t\t\t\t\t});\n\t\t\t\t\t\tawait wait(500);\n\t\t\t\t\t\tcontinue;\n\t\t\t\t\t} else if (endpoint.index > 0) {\n\t\t\t\t\t\tctx.logNode(node.id, {\n\t\t\t\t\t\t\tendpoint: endpoint.index,\n\t\t\t\t\t\t\tmessage: `Querying securely supported commands (${\n\t\t\t\t\t\t\t\tgetEnumMemberName(\n\t\t\t\t\t\t\t\t\tSecurityClass,\n\t\t\t\t\t\t\t\t\tsecClass,\n\t\t\t\t\t\t\t\t)\n\t\t\t\t\t\t\t}) failed. Assuming the endpoint supports all its mandatory CCs securely...`,\n\t\t\t\t\t\t\tlevel: \"warn\",\n\t\t\t\t\t\t});\n\n\t\t\t\t\t\t// Just mark all endpoint CCs as secure. Without this we would attempt\n\t\t\t\t\t\t// unencrypted communication with the endpoint, which will likely fail.\n\t\t\t\t\t\tfor (const [ccId] of endpoint.getCCs()) {\n\t\t\t\t\t\t\tendpoint.addCC(ccId, { secure: true });\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\tbreak;\n\t\t\t\t\t} else {\n\t\t\t\t\t\tctx.logNode(node.id, {\n\t\t\t\t\t\t\tendpoint: endpoint.index,\n\t\t\t\t\t\t\tmessage: `Querying securely supported commands (${\n\t\t\t\t\t\t\t\tgetEnumMemberName(\n\t\t\t\t\t\t\t\t\tSecurityClass,\n\t\t\t\t\t\t\t\t\tsecClass,\n\t\t\t\t\t\t\t\t)\n\t\t\t\t\t\t\t}) failed. Let's hope for the best...`,\n\t\t\t\t\t\t\tlevel: \"warn\",\n\t\t\t\t\t\t});\n\t\t\t\t\t\tbreak;\n\t\t\t\t\t}\n\t\t\t\t} else {\n\t\t\t\t\t// In any other case, we can stop trying\n\t\t\t\t\tbreak;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (supportedCCs == undefined) {\n\t\t\t\tif (\n\t\t\t\t\tendpoint.index === 0\n\t\t\t\t\t&& possibleSecurityClasses.length > 1\n\t\t\t\t) {\n\t\t\t\t\t// No supported commands found, mark the security class as not granted\n\t\t\t\t\t// unless we were sure about the security class\n\t\t\t\t\tnode.setSecurityClass(secClass, false);\n\n\t\t\t\t\tctx.logNode(node.id, {\n\t\t\t\t\t\tmessage: `The node was NOT granted the security class ${\n\t\t\t\t\t\t\tgetEnumMemberName(\n\t\t\t\t\t\t\t\tSecurityClass,\n\t\t\t\t\t\t\t\tsecClass,\n\t\t\t\t\t\t\t)\n\t\t\t\t\t\t}`,\n\t\t\t\t\t\tdirection: \"inbound\",\n\t\t\t\t\t});\n\t\t\t\t}\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\tif (endpoint.index === 0 && possibleSecurityClasses.length > 1) {\n\t\t\t\t// Mark the security class as granted unless we were sure about the security class\n\t\t\t\tnode.setSecurityClass(secClass, true);\n\n\t\t\t\tctx.logNode(node.id, {\n\t\t\t\t\tmessage: `The node was granted the security class ${\n\t\t\t\t\t\tgetEnumMemberName(\n\t\t\t\t\t\t\tSecurityClass,\n\t\t\t\t\t\t\tsecClass,\n\t\t\t\t\t\t)\n\t\t\t\t\t}`,\n\t\t\t\t\tdirection: \"inbound\",\n\t\t\t\t});\n\t\t\t}\n\n\t\t\tif (!hasReceivedSecureCommands && supportedCCs.length > 0) {\n\t\t\t\thasReceivedSecureCommands = true;\n\n\t\t\t\tconst logLines: string[] = [\n\t\t\t\t\t`received secure commands (${\n\t\t\t\t\t\tgetEnumMemberName(\n\t\t\t\t\t\t\tSecurityClass,\n\t\t\t\t\t\t\tsecClass,\n\t\t\t\t\t\t)\n\t\t\t\t\t})`,\n\t\t\t\t\t\"supported CCs:\",\n\t\t\t\t];\n\t\t\t\tfor (const cc of supportedCCs) {\n\t\t\t\t\tlogLines.push(`\u00B7 ${getCCName(cc)}`);\n\t\t\t\t}\n\t\t\t\tctx.logNode(node.id, {\n\t\t\t\t\tendpoint: endpoint.index,\n\t\t\t\t\tmessage: logLines.join(\"\\n\"),\n\t\t\t\t\tdirection: \"inbound\",\n\t\t\t\t});\n\n\t\t\t\t// Remember which commands are supported securely\n\t\t\t\tfor (const cc of supportedCCs) {\n\t\t\t\t\t// Basic CC has special rules for when it is considered supported\n\t\t\t\t\t// Therefore we mark all other CCs as supported, but not Basic CC,\n\t\t\t\t\t// for which support is determined later.\n\t\t\t\t\tif (cc === CommandClasses.Basic) {\n\t\t\t\t\t\tendpoint.addCC(cc, { secure: true });\n\t\t\t\t\t} else {\n\t\t\t\t\t\tendpoint.addCC(cc, {\n\t\t\t\t\t\t\tisSupported: true,\n\t\t\t\t\t\t\tsecure: true,\n\t\t\t\t\t\t});\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\t// Remember that the interview is complete\n\t\tthis.setInterviewComplete(ctx, true);\n\t}\n\n\t/** Tests if a command should be sent secure and thus requires encapsulation */\n\tpublic static requiresEncapsulation(cc: CommandClass): boolean {\n\t\t// No security flag -> no encapsulation\n\t\tif (!(cc.encapsulationFlags & EncapsulationFlags.Security)) {\n\t\t\treturn false;\n\t\t}\n\t\t// S0, CRC16, Transport Service -> no S2 encapsulation\n\t\tif (\n\t\t\tcc instanceof SecurityCC\n\t\t\t|| cc instanceof CRC16CC\n\t\t\t|| cc instanceof TransportServiceCC\n\t\t) {\n\t\t\treturn false;\n\t\t}\n\t\t// S2: check command\n\t\tif (cc instanceof Security2CC) {\n\t\t\t// These S2 commands need additional encapsulation\n\t\t\tswitch (cc.ccCommand) {\n\t\t\t\tcase Security2Command.CommandsSupportedGet:\n\t\t\t\tcase Security2Command.CommandsSupportedReport:\n\t\t\t\tcase Security2Command.NetworkKeyGet:\n\t\t\t\tcase Security2Command.NetworkKeyReport:\n\t\t\t\tcase Security2Command.NetworkKeyVerify:\n\t\t\t\tcase Security2Command.TransferEnd:\n\t\t\t\t\treturn true;\n\n\t\t\t\tcase Security2Command.KEXSet:\n\t\t\t\tcase Security2Command.KEXReport:\n\t\t\t\t\t// KEXSet/Report need to be encrypted for the confirmation only\n\t\t\t\t\treturn (cc as Security2CCKEXSet | Security2CCKEXReport)\n\t\t\t\t\t\t.echo;\n\n\t\t\t\tcase Security2Command.KEXFail: {\n\t\t\t\t\tswitch ((cc as Security2CCKEXFail).failType) {\n\t\t\t\t\t\tcase KEXFailType.Decrypt:\n\t\t\t\t\t\tcase KEXFailType.WrongSecurityLevel:\n\t\t\t\t\t\tcase KEXFailType.KeyNotGranted:\n\t\t\t\t\t\tcase KEXFailType.NoVerify:\n\t\t\t\t\t\t\treturn true;\n\t\t\t\t\t\tdefault:\n\t\t\t\t\t\t\treturn false;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn false;\n\t\t}\n\n\t\t// Everything else needs to be encapsulated if the CC is secure\n\t\treturn true;\n\t}\n\n\t/** Encapsulates a command that should be sent encrypted */\n\tpublic static encapsulate(\n\t\tcc: CommandClass,\n\t\townNodeId: number,\n\t\tsecurityManagers: SecurityManagers,\n\t\toptions?: {\n\t\t\tsecurityClass?: SecurityClass;\n\t\t\tmulticastOutOfSync?: boolean;\n\t\t\tmulticastGroupId?: number;\n\t\t\tverifyDelivery?: boolean;\n\t\t},\n\t): Security2CCMessageEncapsulation {\n\t\t// Determine which extensions must be used on the command\n\t\tconst extensions: Security2Extension[] = [];\n\t\tif (options?.multicastOutOfSync) {\n\t\t\textensions.push(new MOSExtension());\n\t\t}\n\t\tif (options?.multicastGroupId != undefined) {\n\t\t\textensions.push(\n\t\t\t\tnew MGRPExtension({ groupId: options.multicastGroupId }),\n\t\t\t);\n\t\t}\n\n\t\t// Make sure that S2 multicast uses broadcasts. While the specs mention that both multicast and broadcast\n\t\t// are possible, it has been found that devices treat multicasts like singlecast followups and respond incorrectly.\n\t\tlet nodeId: number;\n\t\tif (cc.isMulticast()) {\n\t\t\tif (cc.nodeId.some((nodeId) => isLongRangeNodeId(nodeId))) {\n\t\t\t\tnodeId = NODE_ID_BROADCAST_LR;\n\t\t\t} else {\n\t\t\t\tnodeId = NODE_ID_BROADCAST;\n\t\t\t}\n\t\t} else {\n\t\t\tnodeId = cc.nodeId as number;\n\t\t}\n\n\t\tconst ret = new Security2CCMessageEncapsulation({\n\t\t\tnodeId,\n\t\t\tencapsulated: cc,\n\t\t\tsecurityClass: options?.securityClass,\n\t\t\textensions,\n\t\t\tverifyDelivery: options?.verifyDelivery,\n\t\t});\n\n\t\t// Copy the encapsulation flags from the encapsulated command\n\t\t// but omit Security, since we're doing that right now\n\t\tret.encapsulationFlags = cc.encapsulationFlags\n\t\t\t& ~EncapsulationFlags.Security;\n\n\t\treturn ret;\n\t}\n}\n\nfunction failNoSPAN(): never {\n\tvalidatePayload.fail(ZWaveErrorCodes.Security2CC_NoSPAN);\n}\n\nfunction failNoMPAN(): never {\n\tvalidatePayload.fail(ZWaveErrorCodes.Security2CC_NoMPAN);\n}\n\n// @publicAPI\nexport type MulticastContext =\n\t| {\n\t\tisMulticast: true;\n\t\tgroupId: number;\n\t}\n\t| {\n\t\tisMulticast: false;\n\t\tgroupId?: number;\n\t};\n\n// @publicAPI\nexport interface Security2CCMessageEncapsulationOptions {\n\tsequenceNumber?: number;\n\t/** Can be used to override the default security class for the command */\n\tsecurityClass?: SecurityClass;\n\textensions?: Security2Extension[];\n\tencapsulated?: CommandClass;\n\tverifyDelivery?: boolean;\n}\n\n// An S2 encapsulated command may result in a NonceReport to be sent by the node if it couldn't decrypt the message\nfunction getCCResponseForMessageEncapsulation(\n\tsent: Security2CCMessageEncapsulation,\n) {\n\tif (sent.encapsulated?.expectsCCResponse()) {\n\t\tconst ret = [\n\t\t\tSecurity2CCMessageEncapsulation as any,\n\t\t\tSecurity2CCNonceReport as any,\n\t\t];\n\n\t\tif (\n\t\t\tsent.encapsulated instanceof Security2CCKEXSet\n\t\t\t|| sent.encapsulated instanceof Security2CCKEXReport\n\t\t\t|| sent.encapsulated instanceof Security2CCNetworkKeyGet\n\t\t\t|| sent.encapsulated instanceof Security2CCNetworkKeyReport\n\t\t\t|| sent.encapsulated instanceof Security2CCNetworkKeyVerify\n\t\t) {\n\t\t\tret.push(Security2CCKEXFail as any);\n\t\t}\n\n\t\treturn ret;\n\t}\n}\n\nfunction testCCResponseForMessageEncapsulation(\n\tsent: Security2CCMessageEncapsulation,\n\treceived:\n\t\t| Security2CCMessageEncapsulation\n\t\t| Security2CCNonceReport\n\t\t| Security2CCKEXFail,\n) {\n\tif (received instanceof Security2CCMessageEncapsulation) {\n\t\treturn \"checkEncapsulated\";\n\t} else if (received instanceof Security2CCKEXFail) {\n\t\treturn true;\n\t} else {\n\t\treturn received.SOS && !!received.receiverEI;\n\t}\n}\n\n@CCCommand(Security2Command.MessageEncapsulation)\n@expectedCCResponse(\n\tgetCCResponseForMessageEncapsulation,\n\ttestCCResponseForMessageEncapsulation,\n)\nexport class Security2CCMessageEncapsulation extends Security2CC {\n\tpublic constructor(\n\t\toptions: WithAddress<Security2CCMessageEncapsulationOptions>,\n\t) {\n\t\tsuper(options);\n\n\t\tif (!options.encapsulated && !options.extensions?.length) {\n\t\t\tthrow new ZWaveError(\n\t\t\t\t\"Security S2 encapsulation requires an encapsulated CC and/or extensions\",\n\t\t\t\tZWaveErrorCodes.Argument_Invalid,\n\t\t\t);\n\t\t}\n\n\t\tthis.sequenceNumber = options.sequenceNumber;\n\n\t\tthis.securityClass = options.securityClass;\n\t\tif (options.encapsulated) {\n\t\t\tthis.encapsulated = options.encapsulated;\n\t\t\toptions.encapsulated.encapsulatingCC = this as any;\n\t\t}\n\n\t\tthis.verifyDelivery = options.verifyDelivery !== false;\n\n\t\tthis.extensions = options.extensions ?? [];\n\t\tif (\n\t\t\ttypeof this.nodeId !== \"number\"\n\t\t\t&& !this.extensions.some((e) => e instanceof MGRPExtension)\n\t\t) {\n\t\t\tthrow new ZWaveError(\n\t\t\t\t\"Multicast Security S2 encapsulation requires the MGRP extension\",\n\t\t\t\tZWaveErrorCodes.Security2CC_MissingExtension,\n\t\t\t);\n\t\t}\n\t}\n\n\tpublic static from(\n\t\traw: CCRaw,\n\t\tctx: CCParsingContext,\n\t): Security2CCMessageEncapsulation {\n\t\tconst securityManager = assertSecurityRX(ctx);\n\n\t\tvalidatePayload(raw.payload.length >= 2);\n\t\t// Check the sequence number to avoid duplicates\n\t\tconst sequenceNumber: number | undefined = raw.payload[0];\n\n\t\t// Ensure the node has a security class\n\t\tvalidatePayload.withReason(\"No security class granted\")(\n\t\t\tctx.getHighestSecurityClass(\n\t\t\t\tctx.sourceNodeId,\n\t\t\t) !== SecurityClass.None,\n\t\t);\n\n\t\tconst hasExtensions = !!(raw.payload[1] & 0b1);\n\t\tconst hasEncryptedExtensions = !!(raw.payload[1] & 0b10);\n\n\t\tlet offset = 2;\n\t\tconst extensions: Security2Extension[] = [];\n\t\tlet mustDiscardCommand = false;\n\n\t\tconst parseExtensions = (buffer: Uint8Array, wasEncrypted: boolean) => {\n\t\t\twhile (true) {\n\t\t\t\tif (buffer.length < offset + 2) {\n\t\t\t\t\t// An S2 extension was expected, but the buffer is too short\n\t\t\t\t\tmustDiscardCommand = true;\n\t\t\t\t\treturn;\n\t\t\t\t}\n\n\t\t\t\t// The length field could be too large, which would cause part of the actual ciphertext\n\t\t\t\t// to be ignored. Try to avoid this for known extensions by checking the actual and expected length.\n\t\t\t\tconst { actual: actualLength, expected: expectedLength } =\n\t\t\t\t\tSecurity2Extension\n\t\t\t\t\t\t.getExtensionLength(\n\t\t\t\t\t\t\tbuffer.subarray(offset),\n\t\t\t\t\t\t);\n\n\t\t\t\t// Parse the extension using the expected length if possible\n\t\t\t\tconst extensionLength = expectedLength ?? actualLength;\n\t\t\t\tif (extensionLength < 2) {\n\t\t\t\t\t// An S2 extension was expected, but the length is too short\n\t\t\t\t\tmustDiscardCommand = true;\n\t\t\t\t\treturn;\n\t\t\t\t} else if (\n\t\t\t\t\textensionLength\n\t\t\t\t\t\t> buffer.length\n\t\t\t\t\t\t\t- offset\n\t\t\t\t\t\t\t- (wasEncrypted\n\t\t\t\t\t\t\t\t? 0\n\t\t\t\t\t\t\t\t: SECURITY_S2_AUTH_TAG_LENGTH)\n\t\t\t\t) {\n\t\t\t\t\t// The supposed length is longer than the space the extensions may occupy\n\t\t\t\t\tmustDiscardCommand = true;\n\t\t\t\t\treturn;\n\t\t\t\t}\n\n\t\t\t\tconst extensionData = buffer.subarray(\n\t\t\t\t\toffset,\n\t\t\t\t\toffset + extensionLength,\n\t\t\t\t);\n\t\t\t\toffset += extensionLength;\n\n\t\t\t\tconst ext = Security2Extension.parse(extensionData);\n\n\t\t\t\tswitch (validateS2Extension(ext, wasEncrypted)) {\n\t\t\t\t\tcase ValidateS2ExtensionResult.OK:\n\t\t\t\t\t\tif (\n\t\t\t\t\t\t\texpectedLength != undefined\n\t\t\t\t\t\t\t&& actualLength !== expectedLength\n\t\t\t\t\t\t) {\n\t\t\t\t\t\t\t// The extension length field does not match, ignore the extension\n\t\t\t\t\t\t} else {\n\t\t\t\t\t\t\textensions.push(ext);\n\t\t\t\t\t\t}\n\t\t\t\t\t\tbreak;\n\t\t\t\t\tcase ValidateS2ExtensionResult.DiscardExtension:\n\t\t\t\t\t\t// Do nothing\n\t\t\t\t\t\tbreak;\n\t\t\t\t\tcase ValidateS2ExtensionResult.DiscardCommand:\n\t\t\t\t\t\tmustDiscardCommand = true;\n\t\t\t\t\t\tbreak;\n\t\t\t\t}\n\n\t\t\t\t// Check if that was the last extension\n\t\t\t\tif (!ext.moreToFollow) break;\n\t\t\t}\n\t\t};\n\t\tif (hasExtensions) parseExtensions(raw.payload, false);\n\n\t\tconst mcctx = ((): MulticastContext => {\n\t\t\tconst multicastGroupId = getMulticastGroupId(extensions);\n\t\t\tif (\n\t\t\t\tctx.frameType === \"multicast\" || ctx.frameType === \"broadcast\"\n\t\t\t) {\n\t\t\t\tif (multicastGroupId == undefined) {\n\t\t\t\t\tvalidatePayload.fail(\n\t\t\t\t\t\t\"Multicast frames without MGRP extension\",\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\treturn {\n\t\t\t\t\tisMulticast: true,\n\t\t\t\t\tgroupId: multicastGroupId,\n\t\t\t\t};\n\t\t\t} else {\n\t\t\t\treturn { isMulticast: false, groupId: multicastGroupId };\n\t\t\t}\n\t\t})();\n\n\t\t// If a command is to be discarded before decryption,\n\t\t// we still need to increment the SPAN or MPAN state\n\t\tif (mustDiscardCommand) {\n\t\t\tif (mcctx.isMulticast) {\n\t\t\t\tsecurityManager.nextPeerMPAN(\n\t\t\t\t\tctx.sourceNodeId,\n\t\t\t\t\tmcctx.groupId,\n\t\t\t\t);\n\t\t\t} else {\n\t\t\t\tsecurityManager.nextNonce(ctx.sourceNodeId);\n\t\t\t}\n\t\t\tvalidatePayload.fail(\n\t\t\t\t\"Invalid S2 extension\",\n\t\t\t);\n\t\t}\n\n\t\tlet prevSequenceNumber: number | undefined;\n\t\tlet mpanState:\n\t\t\t| ReturnType<SecurityManager2[\"getPeerMPAN\"]>\n\t\t\t| undefined;\n\t\tif (mcctx.isMulticast) {\n\t\t\tmpanState = securityManager.getPeerMPAN(\n\t\t\t\tctx.sourceNodeId,\n\t\t\t\tmcctx.groupId,\n\t\t\t);\n\t\t} else {\n\t\t\t// Don't accept duplicate Singlecast commands\n\t\t\tprevSequenceNumber = validateSequenceNumber(\n\t\t\t\tsecurityManager,\n\t\t\t\tctx.sourceNodeId,\n\t\t\t\tsequenceNumber,\n\t\t\t);\n\n\t\t\t// When a node receives a singlecast message after a multicast group was marked out of sync,\n\t\t\t// it must forget about the group.\n\t\t\tif (mcctx.groupId == undefined) {\n\t\t\t\tsecurityManager.resetOutOfSyncMPANs(\n\t\t\t\t\tctx.sourceNodeId,\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\n\t\tconst unencryptedPayload = raw.payload.subarray(0, offset);\n\t\tconst ciphertext = raw.payload.subarray(\n\t\t\toffset,\n\t\t\t-SECURITY_S2_AUTH_TAG_LENGTH,\n\t\t);\n\t\tconst authTag = raw.payload.subarray(-SECURITY_S2_AUTH_TAG_LENGTH);\n\t\tconst messageLength =\n\t\t\t2 /* CommandClass.computeEncapsulationOverhead() */\n\t\t\t+ raw.payload.length;\n\n\t\tconst authData = getAuthenticationData(\n\t\t\tctx.sourceNodeId,\n\t\t\tgetDestinationIDRX(ctx, extensions),\n\t\t\tctx.homeId,\n\t\t\tmessageLength,\n\t\t\tunencryptedPayload,\n\t\t);\n\n\t\tlet decrypt: () => DecryptionResult;\n\t\tif (mcctx.isMulticast) {\n\t\t\t// For incoming multicast commands, make sure we have an MPAN\n\t\t\tif (mpanState?.type !== MPANState.MPAN) {\n\t\t\t\t// If we don't, mark the MPAN as out of sync, so we can respond accordingly on the singlecast followup\n\t\t\t\tsecurityManager.storePeerMPAN(\n\t\t\t\t\tctx.sourceNodeId,\n\t\t\t\t\tmcctx.groupId,\n\t\t\t\t\t{ type: MPANState.OutOfSync },\n\t\t\t\t);\n\t\t\t\tfailNoMPAN();\n\t\t\t}\n\n\t\t\tdecrypt = () =>\n\t\t\t\tdecryptMulticast(\n\t\t\t\t\tctx.sourceNodeId,\n\t\t\t\t\tsecurityManager,\n\t\t\t\t\tmcctx.groupId,\n\t\t\t\t\tciphertext,\n\t\t\t\t\tauthData,\n\t\t\t\t\tauthTag,\n\t\t\t\t);\n\t\t} else {\n\t\t\t// Decrypt payload and verify integrity\n\t\t\tconst spanState = securityManager.getSPANState(\n\t\t\t\tctx.sourceNodeId,\n\t\t\t);\n\n\t\t\t// If we are not able to establish an SPAN yet, fail the decryption\n\t\t\tif (spanState.type === SPANState.None) {\n\t\t\t\tfailNoSPAN();\n\t\t\t} else if (spanState.type === SPANState.RemoteEI) {\n\t\t\t\t// TODO: The specs are not clear how to handle this case\n\t\t\t\t// For now, do the same as if we didn't have any EI\n\t\t\t\tfailNoSPAN();\n\t\t\t}\n\n\t\t\tdecrypt = () =>\n\t\t\t\tdecryptSinglecast(\n\t\t\t\t\tctx,\n\t\t\t\t\tsecurityManager,\n\t\t\t\t\tctx.sourceNodeId,\n\t\t\t\t\tsequenceNumber,\n\t\t\t\t\tprevSequenceNumber!,\n\t\t\t\t\tciphertext,\n\t\t\t\t\tauthData,\n\t\t\t\t\tauthTag,\n\t\t\t\t\tspanState,\n\t\t\t\t\textensions,\n\t\t\t\t);\n\t\t}\n\n\t\tlet plaintext: Uint8Array | undefined;\n\t\tlet authOK = false;\n\t\tlet key: Uint8Array | undefined;\n\t\tlet iv: Uint8Array | undefined;\n\t\tlet decryptionSecurityClass: SecurityClass | undefined;\n\n\t\t// If the Receiver is unable to authenticate the singlecast message with the current SPAN,\n\t\t// the Receiver SHOULD try decrypting the message with one or more of the following SPAN values,\n\t\t// stopping when decryption is successful or the maximum number of iterations is reached.\n\n\t\t// If the Receiver is unable to decrypt the S2 MC frame with the current MPAN, the Receiver MAY try\n\t\t// decrypting the frame with one or more of the subsequent MPAN values, stopping when decryption is\n\t\t// successful or the maximum number of iterations is reached.\n\t\tconst decryptAttempts = mcctx.isMulticast\n\t\t\t? MAX_DECRYPT_ATTEMPTS_MULTICAST\n\t\t\t: mcctx.groupId != undefined\n\t\t\t? MAX_DECRYPT_ATTEMPTS_SC_FOLLOWUP\n\t\t\t: MAX_DECRYPT_ATTEMPTS_SINGLECAST;\n\n\t\tfor (let i = 0; i < decryptAttempts; i++) {\n\t\t\t({\n\t\t\t\tplaintext,\n\t\t\t\tauthOK,\n\t\t\t\tkey,\n\t\t\t\tiv,\n\t\t\t\tsecurityClass: decryptionSecurityClass,\n\t\t\t} = decrypt());\n\t\t\tif (!!authOK && !!plaintext) break;\n\t\t\t// No need to try further SPANs if we just got the sender's EI\n\t\t\tif (!!getSenderEI(extensions)) break;\n\t\t}\n\n\t\t// If authentication fails, do so with an error code that instructs the\n\t\t// applHost to tell the node we have no nonce\n\t\tif (!authOK || !plaintext) {\n\t\t\tif (mcctx.isMulticast) {\n\t\t\t\t// Mark the MPAN as out of sync\n\t\t\t\tsecurityManager.storePeerMPAN(\n\t\t\t\t\tctx.sourceNodeId,\n\t\t\t\t\tmcctx.groupId,\n\t\t\t\t\t{ type: MPANState.OutOfSync },\n\t\t\t\t);\n\t\t\t\tvalidatePayload.fail(\n\t\t\t\t\tZWaveErrorCodes.Security2CC_CannotDecodeMulticast,\n\t\t\t\t);\n\t\t\t} else {\n\t\t\t\tvalidatePayload.fail(\n\t\t\t\t\tZWaveErrorCodes.Security2CC_CannotDecode,\n\t\t\t\t);\n\t\t\t}\n\t\t} else if (!mcctx.isMulticast && mcctx.groupId != undefined) {\n\t\t\t// After reception of a singlecast followup, the MPAN state must be increased\n\t\t\tsecurityManager.tryIncrementPeerMPAN(\n\t\t\t\tctx.sourceNodeId,\n\t\t\t\tmcctx.groupId,\n\t\t\t);\n\t\t}\n\n\t\t// Remember which security class was used to decrypt this message, so we can discard it later\n\t\tconst securityClass: SecurityClass | undefined =\n\t\t\tdecryptionSecurityClass;\n\n\t\toffset = 0;\n\t\tif (hasEncryptedExtensions) parseExtensions(plaintext, true);\n\n\t\t// Before we can continue, check if the command must be discarded\n\t\tif (mustDiscardCommand) {\n\t\t\tvalidatePayload.fail(\"Invalid extension\");\n\t\t}\n\n\t\t// If the MPAN extension was received, store the MPAN\n\t\tif (!mcctx.isMulticast) {\n\t\t\tconst mpanExtension = extensions.find((e) =>\n\t\t\t\te instanceof MPANExtension\n\t\t\t);\n\t\t\tif (mpanExtension) {\n\t\t\t\tsecurityManager.storePeerMPAN(\n\t\t\t\t\tctx.sourceNodeId,\n\t\t\t\t\tmpanExtension.groupId,\n\t\t\t\t\t{\n\t\t\t\t\t\ttype: MPANState.MPAN,\n\t\t\t\t\t\tcurrentMPAN: mpanExtension.innerMPANState,\n\t\t\t\t\t},\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\n\t\t// Not every S2 message includes an encapsulated CC\n\t\tconst decryptedCCBytes = plaintext.subarray(offset);\n\t\tlet encapsulated: CommandClass | undefined;\n\t\tif (decryptedCCBytes.length > 0) {\n\t\t\t// make sure this contains a complete CC command that's worth splitting\n\t\t\tvalidatePayload(decryptedCCBytes.length >= 2);\n\t\t\t// and deserialize the CC\n\t\t\tencapsulated = CommandClass.parse(decryptedCCBytes, ctx);\n\t\t}\n\n\t\tconst ret = new Security2CCMessageEncapsulation({\n\t\t\tnodeId: ctx.sourceNodeId,\n\t\t\tsequenceNumber,\n\t\t\tsecurityClass,\n\t\t\textensions,\n\t\t\tencapsulated,\n\t\t});\n\n\t\t// Remember for debugging purposes\n\t\tret.key = key;\n\t\tret.iv = iv;\n\t\tret.authData = authData;\n\t\tret.authTag = authTag;\n\t\tret.plaintext = decryptedCCBytes;\n\n\t\treturn ret;\n\t}\n\n\tpublic readonly securityClass?: SecurityClass;\n\n\t// Only used for testing/debugging purposes\n\tprivate key?: Uint8Array;\n\tprivate iv?: Uint8Array;\n\tprivate authData?: Uint8Array;\n\tprivate authTag?: Uint8Array;\n\tprivate ciphertext?: Uint8Array;\n\tprivate plaintext?: Uint8Array;\n\n\tpublic readonly verifyDelivery: boolean = true;\n\n\tpublic sequenceNumber: number | undefined;\n\tprivate ensureSequenceNumber(\n\t\tsecurityManager: SecurityManager2,\n\t): asserts this is this & {\n\t\tsequenceNumber: number;\n\t} {\n\t\tif (this.sequenceNumber == undefined) {\n\t\t\tif (this.isSinglecast()) {\n\t\t\t\tthis.sequenceNumber = securityManager.nextSequenceNumber(\n\t\t\t\t\tthis.nodeId,\n\t\t\t\t);\n\t\t\t} else {\n\t\t\t\tconst groupId = getDestinationIDTX.call(this);\n\t\t\t\tthis.sequenceNumber = securityManager\n\t\t\t\t\t.nextMulticastSequenceNumber(\n\t\t\t\t\t\tgroupId,\n\t\t\t\t\t);\n\t\t\t}\n\t\t}\n\t}\n\n\tpublic encapsulated?: CommandClass;\n\tpublic extensions: Security2Extension[];\n\n\tpublic override prepareRetransmission(): void {\n\t\tsuper.prepareRetransmission();\n\t\tthis.sequenceNumber = undefined;\n\t}\n\n\tpublic hasMOSExtension(): boolean {\n\t\treturn this.extensions.some((e) => e instanceof MOSExtension);\n\t}\n\n\t/** Returns the Sender's Entropy Input if this command contains an SPAN extension */\n\tpublic getSenderEI(): Uint8Array | undefined {\n\t\treturn getSenderEI(this.extensions);\n\t}\n\n\t/** Returns the multicast group ID if this command contains an MGRP extension */\n\tpublic getMulticastGroupId(): number | undefined {\n\t\treturn getMulticastGroupId(this.extensions);\n\t}\n\n\tprivate maybeAddSPANExtension(\n\t\tctx: CCEncodingContext,\n\t\tsecurityManager: SecurityManager2,\n\t): void {\n\t\tif (!this.isSinglecast()) return;\n\n\t\tconst receiverNodeId: number = this.nodeId;\n\t\tconst spanState = securityManager.getSPANState(\n\t\t\treceiverNodeId,\n\t\t);\n\t\tif (\n\t\t\tspanState.type === SPANState.None\n\t\t\t|| spanState.type === SPANState.LocalEI\n\t\t) {\n\t\t\t// Can't do anything here if we don't have the receiver's EI\n\t\t\tthrow new ZWaveError(\n\t\t\t\t`Security S2 CC requires the receiver's nonce to be sent!`,\n\t\t\t\tZWaveErrorCodes.Security2CC_NoSPAN,\n\t\t\t);\n\t\t} else if (spanState.type === SPANState.RemoteEI) {\n\t\t\t// We have the receiver's EI, generate our input and send it over\n\t\t\t// With both, we can create an SPAN\n\t\t\tconst senderEI = securityManager.generateNonce(\n\t\t\t\tundefined,\n\t\t\t);\n\t\t\tconst receiverEI = spanState.receiverEI;\n\n\t\t\t// While bootstrapping a node, prefer the temporary key, unless the\n\t\t\t// specific command specifies a security class\n\t\t\tif (\n\t\t\t\tthis.securityClass == undefined\n\t\t\t\t&& securityManager.tempKeys.has(receiverNodeId)\n\t\t\t) {\n\t\t\t\tsecurityManager.initializeTempSPAN(\n\t\t\t\t\treceiverNodeId,\n\t\t\t\t\tsenderEI,\n\t\t\t\t\treceiverEI,\n\t\t\t\t);\n\t\t\t} else {\n\t\t\t\tconst securityClass = this.securityClass\n\t\t\t\t\t?? ctx.getHighestSecurityClass(receiverNodeId);\n\n\t\t\t\tif (securityClass == undefined) {\n\t\t\t\t\tthrow new ZWaveError(\n\t\t\t\t\t\t\"No security class defined for this command!\",\n\t\t\t\t\t\tZWaveErrorCodes.Security2CC_NoSPAN,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tsecurityManager.initializeSPAN(\n\t\t\t\t\treceiverNodeId,\n\t\t\t\t\tsecurityClass,\n\t\t\t\t\tsenderEI,\n\t\t\t\t\treceiverEI,\n\t\t\t\t);\n\t\t\t}\n\n\t\t\t// Add or update the SPAN extension\n\t\t\tlet spanExtension = this.extensions.find(\n\t\t\t\t(e) => e instanceof SPANExtension,\n\t\t\t);\n\t\t\tif (spanExtension) {\n\t\t\t\tspanExtension.senderEI = senderEI;\n\t\t\t} else {\n\t\t\t\tspanExtension = new SPANExtension({ senderEI });\n\t\t\t\tthis.extensions.push(spanExtension);\n\t\t\t}\n\t\t}\n\t}\n\n\tpublic serialize(ctx: CCEncodingContext): Bytes {\n\t\tconst securityManager = assertSecurityTX(ctx, this.nodeId);\n\t\tthis.ensureSequenceNumber(securityManager);\n\n\t\t// Include Sender EI in the command if we only have the receiver's EI\n\t\tthis.maybeAddSPANExtension(ctx, securityManager);\n\n\t\tconst unencryptedExtensions = this.extensions.filter(\n\t\t\t(e) => !e.isEncrypted(),\n\t\t);\n\t\tconst encryptedExtensions = this.extensions.filter((e) =>\n\t\t\te.isEncrypted()\n\t\t);\n\n\t\tconst unencryptedPayload = Bytes.concat([\n\t\t\tBytes.from([\n\t\t\t\tthis.sequenceNumber,\n\t\t\t\t(encryptedExtensions.length > 0 ? 0b10 : 0)\n\t\t\t\t| (unencryptedExtensions.length > 0 ? 1 : 0),\n\t\t\t]),\n\t\t\t...unencryptedExtensions.map((e, index) =>\n\t\t\t\te.serialize(index < unencryptedExtensions.length - 1)\n\t\t\t),\n\t\t]);\n\t\tconst serializedCC = this.encapsulated?.serialize(ctx)\n\t\t\t?? new Bytes();\n\t\tconst plaintextPayload = Bytes.concat([\n\t\t\t...encryptedExtensions.map((e, index) =>\n\t\t\t\te.serialize(index < encryptedExtensions.length - 1)\n\t\t\t),\n\t\t\tserializedCC,\n\t\t]);\n\n\t\t// Generate the authentication data for CCM encryption\n\t\tconst destinationTag = getDestinationIDTX.call(\n\t\t\tthis as Security2CCMessageEncapsulation,\n\t\t);\n\t\tconst messageLength = this.computeEncapsulationOverhead()\n\t\t\t+ serializedCC.length;\n\t\tconst authData = getAuthenticationData(\n\t\t\tctx.ownNodeId,\n\t\t\tdestinationTag,\n\t\t\tctx.homeId,\n\t\t\tmessageLength,\n\t\t\tunencryptedPayload,\n\t\t);\n\n\t\tlet key: Uint8Array;\n\t\tlet iv: Uint8Array;\n\n\t\tif (this.isSinglecast()) {\n\t\t\t// Singlecast:\n\t\t\t// Generate a nonce for encryption, and remember it to attempt decryption\n\t\t\t// of potential in-flight messages from the target node.\n\t\t\tiv = securityManager.nextNonce(this.nodeId, true);\n\t\t\tconst { keyCCM } =\n\t\t\t\t// Prefer the overridden security class if it was given\n\t\t\t\tthis.securityClass != undefined\n\t\t\t\t\t? securityManager.getKeysForSecurityClass(\n\t\t\t\t\t\tthis.securityClass,\n\t\t\t\t\t)\n\t\t\t\t\t: securityManager.getKeysForNode(this.nodeId);\n\t\t\tkey = keyCCM;\n\t\t} else {\n\t\t\t// Multicast:\n\t\t\tconst keyAndIV = securityManager.getMulticastKeyAndIV(\n\t\t\t\tdestinationTag,\n\t\t\t);\n\t\t\tkey = keyAndIV.key;\n\t\t\tiv = keyAndIV.iv;\n\t\t}\n\n\t\tconst { ciphertext: ciphertextPayload, authTag } = encryptAES128CCM(\n\t\t\tkey,\n\t\t\tiv,\n\t\t\tplaintextPayload,\n\t\t\tauthData,\n\t\t\tSECURITY_S2_AUTH_TAG_LENGTH,\n\t\t);\n\n\t\t// Remember key and IV for debugging purposes\n\t\tthis.key = key;\n\t\tthis.iv = iv;\n\t\tthis.authData = authData;\n\t\tthis.authTag = authTag;\n\t\tthis.ciphertext = ciphertextPayload;\n\n\t\tthis.payload = Bytes.concat([\n\t\t\tunencryptedPayload,\n\t\t\tciphertextPayload,\n\t\t\tauthTag,\n\t\t]);\n\t\treturn super.serialize(ctx);\n\t}\n\n\tprotected computeEncapsulationOverhead(): number {\n\t\t// Security S2 adds:\n\t\t// * 1 byte sequence number\n\t\t// * 1 byte control\n\t\t// * N bytes extensions\n\t\t// * SECURITY_S2_AUTH_TAG_LENGTH bytes auth tag\n\t\tconst extensionBytes = this.extensions\n\t\t\t.map((e) => e.computeLength())\n\t\t\t.reduce((a, b) => a + b, 0);\n\n\t\treturn (\n\t\t\tsuper.computeEncapsulationOverhead()\n\t\t\t+ 2\n\t\t\t+ SECURITY_S2_AUTH_TAG_LENGTH\n\t\t\t+ extensionBytes\n\t\t);\n\t}\n\n\tpublic toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry {\n\t\tconst message: MessageRecord = {\n\t\t\t\"sequence number\": this.sequenceNumber ?? \"(not set)\",\n\t\t};\n\t\tif (this.extensions.length > 0) {\n\t\t\tmessage.extensions = this.extensions\n\t\t\t\t.map((e) => e.toLogEntry())\n\t\t\t\t.join(\"\");\n\t\t}\n\t\t// Log the used keys in integration tests\n\t\tif (\n\t\t\tprocess.env.NODE_ENV === \"test\"\n\t\t\t|| process.env.NODE_ENV === \"development\"\n\t\t) {\n\t\t\tif (this.key) {\n\t\t\t\tmessage.key = buffer2hex(this.key);\n\t\t\t}\n\t\t\tif (this.iv) {\n\t\t\t\tmessage.IV = buffer2hex(this.iv);\n\t\t\t}\n\t\t\tif (this.ciphertext) {\n\t\t\t\tmessage.ciphertext = buffer2hex(this.ciphertext);\n\t\t\t} else if (this.plaintext) {\n\t\t\t\tmessage.plaintext = buffer2hex(this.plaintext);\n\t\t\t}\n\t\t\tif (this.authData) {\n\t\t\t\tmessage[\"auth data\"] = buffer2hex(this.authData);\n\t\t\t}\n\t\t\tif (this.authTag) {\n\t\t\t\tmessage[\"auth tag\"] = buffer2hex(this.authTag);\n\t\t\t}\n\t\t}\n\n\t\tif (this.securityClass != undefined) {\n\t\t\tmessage[\"security class\"] = getEnumMemberName(\n\t\t\t\tSecurityClass,\n\t\t\t\tthis.securityClass,\n\t\t\t);\n\t\t}\n\n\t\treturn {\n\t\t\t...super.toLogEntry(ctx),\n\t\t\tmessage,\n\t\t};\n\t}\n}\n\n// @publicAPI\nexport type Security2CCNonceReportOptions =\n\t& {\n\t\tsequenceNumber?: number;\n\t}\n\t& (\n\t\t| {\n\t\t\tMOS: boolean;\n\t\t\tSOS: true;\n\t\t\treceiverEI: Uint8Array;\n\t\t}\n\t\t| {\n\t\t\tMOS: true;\n\t\t\tSOS: false;\n\t\t\treceiverEI?: undefined;\n\t\t}\n\t);\n\n@CCCommand(Security2Command.NonceReport)\nexport class Security2CCNonceReport extends Security2CC {\n\tpublic constructor(\n\t\toptions: WithAddress<Security2CCNonceReportOptions>,\n\t) {\n\t\tsuper(options);\n\n\t\tthis.SOS = options.SOS;\n\t\tthis.MOS = options.MOS;\n\t\tthis.sequenceNumber = options.sequenceNumber;\n\t\tif (options.SOS) this.receiverEI = options.receiverEI;\n\t}\n\n\tpublic static from(\n\t\traw: CCRaw,\n\t\tctx: CCParsingContext,\n\t): Security2CCNonceReport {\n\t\t// Make sure that we can send/receive secure commands\n\t\tconst securityManager = assertSecurityRX(ctx);\n\n\t\tvalidatePayload(raw.payload.length >= 2);\n\t\tconst sequenceNumber = raw.payload[0];\n\n\t\t// Don't accept duplicate commands\n\t\tvalidateSequenceNumber(\n\t\t\tsecurityManager,\n\t\t\tctx.sourceNodeId,\n\t\t\tsequenceNumber,\n\t\t);\n\t\tconst MOS = !!(raw.payload[1] & 0b10);\n\t\tconst SOS = !!(raw.payload[1] & 0b1);\n\n\t\tif (SOS) {\n\t\t\t// If the SOS flag is set, the REI field MUST be included in the command\n\t\t\tvalidatePayload(raw.payload.length >= 18);\n\t\t\tconst receiverEI = raw.payload.subarray(2, 18);\n\n\t\t\t// In that case we also need to store it, so the next sent command\n\t\t\t// can use it for encryption\n\t\t\tsecurityManager.storeRemoteEI(\n\t\t\t\tctx.sourceNodeId,\n\t\t\t\treceiverEI,\n\t\t\t);\n\n\t\t\treturn new Security2CCNonceReport({\n\t\t\t\tnodeId: ctx.sourceNodeId,\n\t\t\t\tsequenceNumber,\n\t\t\t\tMOS,\n\t\t\t\tSOS,\n\t\t\t\treceiverEI,\n\t\t\t});\n\t\t} else if (MOS) {\n\t\t\treturn new Security2CCNonceReport({\n\t\t\t\tnodeId: ctx.sourceNodeId,\n\t\t\t\tsequenceNumber,\n\t\t\t\tMOS,\n\t\t\t\tSOS: false,\n\t\t\t});\n\t\t} else {\n\t\t\tvalidatePayload.fail(\"Either MOS or SOS must be set\");\n\t\t}\n\t}\n\n\tpublic sequenceNumber: number | undefined;\n\tprivate ensureSequenceNumber(\n\t\tsecurityManager: SecurityManager2,\n\t): asserts this is this & {\n\t\tsequenceNumber: number;\n\t} {\n\t\tif (this.sequenceNumber == undefined) {\n\t\t\tthis.sequenceNumber = securityManager.nextSequenceNumber(\n\t\t\t\tthis.nodeId as number,\n\t\t\t);\n\t\t}\n\t}\n\n\tpublic readonly SOS: boolean;\n\tpublic readonly MOS: boolean;\n\tpublic readonly receiverEI?: Uint8Array;\n\n\tpublic serialize(ctx: CCEncodingContext): Bytes {\n\t\tconst securityManager = assertSecurityTX(ctx, this.nodeId);\n\t\tthis.ensureSequenceNumber(securityManager);\n\n\t\tthis.payload = Bytes.from([\n\t\t\tthis.sequenceNumber,\n\t\t\t(this.MOS ? 0b10 : 0) + (this.SOS ? 0b1 : 0),\n\t\t]);\n\t\tif (this.SOS) {\n\t\t\tthis.payload = Bytes.concat([this.payload, this.receiverEI!]);\n\t\t}\n\t\treturn super.serialize(ctx);\n\t}\n\n\tpublic toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry {\n\t\tconst message: MessageRecord = {\n\t\t\t\"sequence number\": this.sequenceNumber ?? \"(not set)\",\n\t\t\tSOS: this.SOS,\n\t\t\tMOS: this.MOS,\n\t\t};\n\t\tif (this.receiverEI) {\n\t\t\tmessage[\"receiver entropy\"] = buffer2hex(this.receiverEI);\n\t\t}\n\t\treturn {\n\t\t\t...super.toLogEntry(ctx),\n\t\t\tmessage,\n\t\t};\n\t}\n}\n\n// @publicAPI\nexport interface Security2CCNonceGetOptions {\n\tsequenceNumber?: number;\n}\n\n@CCCommand(Security2Command.NonceGet)\n@expectedCCResponse(Security2CCNonceReport)\nexport class Security2CCNonceGet extends Security2CC {\n\t// TODO: A node sending this command MUST accept a delay up to <Previous Round-trip-time to peer node> +\n\t// 250 ms before receiving the Security 2 Nonce Report Command.\n\n\tpublic constructor(\n\t\toptions: WithAddress<Security2CCNonceGetOptions>,\n\t) {\n\t\tsuper(options);\n\t\tthis.sequenceNumber = options.sequenceNumber;\n\t}\n\n\tpublic static from(raw: CCRaw, ctx: CCParsingContext): Security2CCNonceGet {\n\t\tconst securityManager = assertSecurityRX(ctx);\n\n\t\tvalidatePayload(raw.payload.length >= 1);\n\t\tconst sequenceNumber = raw.payload[0];\n\n\t\t// Don't accept duplicate commands\n\t\tvalidateSequenceNumber(\n\t\t\tsecurityManager,\n\t\t\tctx.sourceNodeId,\n\t\t\tsequenceNumber,\n\t\t);\n\n\t\treturn new Security2CCNonceGet({\n\t\t\tnodeId: ctx.sourceNodeId,\n\t\t\tsequenceNumber,\n\t\t});\n\t}\n\n\tpublic sequenceNumber: number | undefined;\n\tprivate ensureSequenceNumber(\n\t\tsecurityManager: SecurityManager2,\n\t): asserts this is this & {\n\t\tsequenceNumber: number;\n\t} {\n\t\tif (this.sequenceNumber == undefined) {\n\t\t\tthis.sequenceNumber = securityManager.nextSequenceNumber(\n\t\t\t\tthis.nodeId as number,\n\t\t\t);\n\t\t}\n\t}\n\n\tpublic serialize(ctx: CCEncodingContext): Bytes {\n\t\tconst securityManager = assertSecurityTX(ctx, this.nodeId);\n\t\tthis.ensureSequenceNumber(securityManager);\n\n\t\tthis.payload = Bytes.from([this.sequenceNumber]);\n\t\treturn super.serialize(ctx);\n\t}\n\n\tpublic toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry {\n\t\treturn {\n\t\t\t...super.toLogEntry(ctx),\n\t\t\tmessage: {\n\t\t\t\t\"sequence number\": this.sequenceNumber ?? \"(not set)\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n// @publicAPI\nexport interface Security2CCKEXReportOptions {\n\trequestCSA: boolean;\n\techo: boolean;\n\t_reserved?: number;\n\tsupportedKEXSchemes: KEXSchemes[];\n\tsupportedECDHProfiles: ECDHProfiles[];\n\trequestedKeys: SecurityClass[];\n}\n\n@CCCommand(Security2Command.KEXReport)\nexport class Security2CCKEXReport extends Security2CC {\n\tpublic constructor(\n\t\toptions: WithAddress<Security2CCKEXReportOptions>,\n\t) {\n\t\tsuper(options);\n\t\tthis.requestCSA = options.requestCSA;\n\t\tthis.echo = options.echo;\n\t\tthis._reserved = options._reserved ?? 0;\n\t\tthis.supportedKEXSchemes = options.supportedKEXSchemes;\n\t\tthis.supportedECDHProfiles = options.supportedECDHProfiles;\n\t\tthis.requestedKeys = options.requestedKeys;\n\t}\n\n\tpublic static from(\n\t\traw: CCRaw,\n\t\tctx: CCParsingContext,\n\t): Security2CCKEXReport {\n\t\tvalidatePayload(raw.payload.length >= 4);\n\t\tconst requestCSA = !!(raw.payload[0] & 0b10);\n\t\tconst echo = !!(raw.payload[0] & 0b1);\n\n\t\t// Remember the reserved bits for the echo\n\t\tconst _reserved = raw.payload[0] & 0b1111_1100;\n\n\t\t// The bit mask starts at 0, but bit 0 is not used\n\t\tconst supportedKEXSchemes: KEXSchemes[] = parseBitMask(\n\t\t\traw.payload.subarray(1, 2),\n\t\t\t0,\n\t\t).filter((s) => s !== 0);\n\t\tconst supportedECDHProfiles: ECDHProfiles[] = parseBitMask(\n\t\t\traw.payload.subarray(2, 3),\n\t\t\tECDHProfiles.Curve25519,\n\t\t);\n\t\tconst requestedKeys: SecurityClass[] = parseBitMask(\n\t\t\traw.payload.subarray(3, 4),\n\t\t\tSecurityClass.S2_Unauthenticated,\n\t\t);\n\n\t\treturn new Security2CCKEXReport({\n\t\t\tnodeId: ctx.sourceNodeId,\n\t\t\trequestCSA,\n\t\t\techo,\n\t\t\t_reserved,\n\t\t\tsupportedKEXSchemes,\n\t\t\tsupportedECDHProfiles,\n\t\t\trequestedKeys,\n\t\t});\n\t}\n\n\tpublic readonly _reserved: number;\n\tpublic readonly requestCSA: boolean;\n\tpublic readonly echo: boolean;\n\tpublic readonly supportedKEXSchemes: readonly KEXSchemes[];\n\tpublic readonly supportedECDHProfiles: readonly ECDHProfiles[];\n\tpublic readonly requestedKeys: readonly SecurityClass[];\n\n\tpublic serialize(ctx: CCEncodingContext): Bytes {\n\t\tthis.payload = Bytes.concat([\n\t\t\tBytes.from([\n\t\t\t\tthis._reserved\n\t\t\t\t+ (this.requestCSA ? 0b10 : 0)\n\t\t\t\t+ (this.echo ? 0b1 : 0),\n\t\t\t]),\n\t\t\t// The bit mask starts at 0, but bit 0 is not used\n\t\t\tencodeBitMask(this.supportedKEXSchemes, 7, 0),\n\t\t\tencodeBitMask(\n\t\t\t\tthis.supportedECDHProfiles,\n\t\t\t\t7,\n\t\t\t\tECDHProfiles.Curve25519,\n\t\t\t),\n\t\t\tencodeBitMask(\n\t\t\t\tthis.requestedKeys,\n\t\t\t\tSecurityClass.S0_Legacy,\n\t\t\t\tSecurityClass.S2_Unauthenticated,\n\t\t\t),\n\t\t]);\n\t\treturn super.serialize(ctx);\n\t}\n\n\tpublic toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry {\n\t\treturn {\n\t\t\t...super.toLogEntry(ctx),\n\t\t\tmessage: {\n\t\t\t\techo: this.echo,\n\t\t\t\t\"supported schemes\": this.supportedKEXSchemes\n\t\t\t\t\t.map((s) => `\\n\u00B7 ${getEnumMemberName(KEXSchemes, s)}`)\n\t\t\t\t\t.join(\"\"),\n\t\t\t\t\"supported ECDH profiles\": this.supportedECDHProfiles\n\t\t\t\t\t.map((s) => `\\n\u00B7 ${getEnumMemberName(ECDHProfiles, s)}`)\n\t\t\t\t\t.join(\"\"),\n\t\t\t\t\"CSA requested\": this.requestCSA,\n\t\t\t\t\"requested security classes\": this.requestedKeys\n\t\t\t\t\t.map((s) => `\\n\u00B7 ${getEnumMemberName(SecurityClass, s)}`)\n\t\t\t\t\t.join(\"\"),\n\t\t\t},\n\t\t};\n\t}\n}\n\n@CCCommand(Security2Command.KEXGet)\n@expectedCCResponse(Security2CCKEXReport)\nexport class Security2CCKEXGet extends Security2CC {}\n\n// @publicAPI\nexport interface Security2CCKEXSetOptions {\n\tpermitCSA: boolean;\n\techo: boolean;\n\t_reserved?: number;\n\tselectedKEXScheme: KEXSchemes;\n\tselectedECDHProfile: ECDHProfiles;\n\tgrantedKeys: SecurityClass[];\n}\n\nfunction getExpectedResponseForKEXSet(sent: Security2CCKEXSet) {\n\tif (sent.echo) {\n\t\treturn [Security2CCKEXReport, Security2CCKEXFail];\n\t} else {\n\t\treturn undefined;\n\t}\n}\n\nfunction testExpectedResponseForKEXSet(\n\tsent: Security2CCKEXSet,\n\treceived: any,\n): CCResponseRole {\n\tif (sent.echo) {\n\t\tif (received instanceof Security2CCKEXReport) {\n\t\t\treturn received.echo;\n\t\t} else if (received instanceof Security2CCKEXFail) {\n\t\t\treturn true;\n\t\t}\n\t}\n\treturn false;\n}\n\n@CCCommand(Security2Command.KEXSet)\n@expectedCCResponse(getExpectedResponseForKEXSet, testExpectedResponseForKEXSet)\nexport class Security2CCKEXSet extends Security2CC {\n\tpublic constructor(\n\t\toptions: WithAddress<Security2CCKEXSetOptions>,\n\t) {\n\t\tsuper(options);\n\t\tthis.permitCSA = options.permitCSA;\n\t\tthis.echo = options.echo;\n\t\tthis._reserved = options._reserved ?? 0;\n\t\tthis.selectedKEXScheme = options.selectedKEXScheme;\n\t\tthis.selectedECDHProfile = options.selectedECDHProfile;\n\t\tthis.grantedKeys = options.grantedKeys;\n\t}\n\n\tpublic static from(raw: CCRaw, ctx: CCParsingContext): Security2CCKEXSet {\n\t\tvalidatePayload(raw.payload.length >= 4);\n\t\tconst _reserved = raw.payload[0] & 0b1111_1100;\n\t\tconst permitCSA = !!(raw.payload[0] & 0b10);\n\t\tconst echo = !!(raw.payload[0] & 0b1);\n\n\t\t// The bit mask starts at 0, but bit 0 is not used\n\t\tconst selectedKEXSchemes = parseBitMask(\n\t\t\traw.payload.subarray(1, 2),\n\t\t\t0,\n\t\t).filter((s) => s !== 0);\n\t\tvalidatePayload(selectedKEXSchemes.length === 1);\n\t\tconst selectedKEXScheme: KEXSchemes = selectedKEXSchemes[0];\n\t\tconst selectedECDHProfiles = parseBitMask(\n\t\t\traw.payload.subarray(2, 3),\n\t\t\tECDHProfiles.Curve25519,\n\t\t);\n\t\tvalidatePayload(selectedECDHProfiles.length === 1);\n\t\tconst selectedECDHProfile: ECDHProfiles = selectedECDHProfiles[0];\n\t\tconst grantedKeys: SecurityClass[] = parseBitMask(\n\t\t\traw.payload.subarray(3, 4),\n\t\t\tSecurityClass.S2_Unauthenticated,\n\t\t);\n\n\t\treturn new Security2CCKEXSet({\n\t\t\tnodeId: ctx.sourceNodeId,\n\t\t\t_reserved,\n\t\t\tpermitCSA,\n\t\t\techo,\n\t\t\tselectedKEXScheme,\n\t\t\tselectedECDHProfile,\n\t\t\tgrantedKeys,\n\t\t});\n\t}\n\n\tpublic readonly _reserved: number;\n\tpublic permitCSA: boolean;\n\tpublic echo: boolean;\n\tpublic selectedKEXScheme: KEXSchemes;\n\tpublic selectedECDHProfile: ECDHProfiles;\n\tpublic grantedKeys: SecurityClass[];\n\n\tpublic serialize(ctx: CCEncodingContext): Bytes {\n\t\tthis.payload = Bytes.concat([\n\t\t\tBytes.from([\n\t\t\t\tthis._reserved\n\t\t\t\t+ (this.permitCSA ? 0b10 : 0)\n\t\t\t\t+ (this.echo ? 0b1 : 0),\n\t\t\t]),\n\t\t\t// The bit mask starts at 0, but bit 0 is not used\n\t\t\tencodeBitMask([this.selectedKEXScheme], 7, 0),\n\t\t\tencodeBitMask(\n\t\t\t\t[this.selectedECDHProfile],\n\t\t\t\t7,\n\t\t\t\tECDHProfiles.Curve25519,\n\t\t\t),\n\t\t\tencodeBitMask(\n\t\t\t\tthis.grantedKeys,\n\t\t\t\tSecurityClass.S0_Legacy,\n\t\t\t\tSecurityClass.S2_Unauthenticated,\n\t\t\t),\n\t\t]);\n\t\treturn super.serialize(ctx);\n\t}\n\n\tpublic toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry {\n\t\treturn {\n\t\t\t...super.toLogEntry(ctx),\n\t\t\tmessage: {\n\t\t\t\techo: this.echo,\n\t\t\t\t\"selected scheme\": getEnumMemberName(\n\t\t\t\t\tKEXSchemes,\n\t\t\t\t\tthis.selectedKEXScheme,\n\t\t\t\t),\n\t\t\t\t\"selected ECDH profile\": getEnumMemberName(\n\t\t\t\t\tECDHProfiles,\n\t\t\t\t\tthis.selectedECDHProfile,\n\t\t\t\t),\n\t\t\t\t\"CSA permitted\": this.permitCSA,\n\t\t\t\t\"granted security classes\": this.grantedKeys\n\t\t\t\t\t.map((s) => `\\n\u00B7 ${getEnumMemberName(SecurityClass, s)}`)\n\t\t\t\t\t.join(\"\"),\n\t\t\t},\n\t\t};\n\t}\n}\n\n// @publicAPI\nexport interface Security2CCKEXFailOptions {\n\tfailType: KEXFailType;\n}\n\n@CCCommand(Security2Command.KEXFail)\nexport class Security2CCKEXFail extends Security2CC {\n\tpublic constructor(\n\t\toptions: WithAddress<Security2CCKEXFailOptions>,\n\t) {\n\t\tsuper(options);\n\t\tthis.failType = options.failType;\n\t}\n\n\tpublic static from(raw: CCRaw, ctx: CCParsingContext): Security2CCKEXFail {\n\t\tvalidatePayload(raw.payload.length >= 1);\n\t\tconst failType: KEXFailType = raw.payload[0];\n\n\t\treturn new Security2CCKEXFail({\n\t\t\tnodeId: ctx.sourceNodeId,\n\t\t\tfailType,\n\t\t});\n\t}\n\n\tpublic failType: KEXFailType;\n\n\tpublic serialize(ctx: CCEncodingContext): Bytes {\n\t\tthis.payload = Bytes.from([this.failType]);\n\t\treturn super.serialize(ctx);\n\t}\n\n\tpublic toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry {\n\t\treturn {\n\t\t\t...super.toLogEntry(ctx),\n\t\t\tmessage: { reason: getEnumMemberName(KEXFailType, this.failType) },\n\t\t};\n\t}\n}\n\n// @publicAPI\nexport interface Security2CCPublicKeyReportOptions {\n\tincludingNode: boolean;\n\tpublicKey: Uint8Array;\n}\n\n@CCCommand(Security2Command.PublicKeyReport)\nexport class Security2CCPublicKeyReport extends Security2CC {\n\tpublic constructor(\n\t\toptions: WithAddress<Security2CCPublicKeyReportOptions>,\n\t) {\n\t\tsuper(options);\n\t\tthis.includingNode = options.includingNode;\n\t\tthis.publicKey = options.publicKey;\n\t}\n\n\tpublic static from(\n\t\traw: CCRaw,\n\t\tctx: CCParsingContext,\n\t): Security2CCPublicKeyReport {\n\t\tvalidatePayload(raw.payload.length >= 17);\n\t\tconst includingNode = !!(raw.payload[0] & 0b1);\n\t\tconst publicKey: Uint8Array = raw.payload.subarray(1);\n\n\t\treturn new Security2CCPublicKeyReport({\n\t\t\tnodeId: ctx.sourceNodeId,\n\t\t\tincludingNode,\n\t\t\tpublicKey,\n\t\t});\n\t}\n\n\tpublic includingNode: boolean;\n\tpublic publicKey: Uint8Array;\n\n\tpublic serialize(ctx: CCEncodingContext): Bytes {\n\t\tthis.payload = Bytes.concat([\n\t\t\tBytes.from([this.includingNode ? 1 : 0]),\n\t\t\tthis.publicKey,\n\t\t]);\n\t\treturn super.serialize(ctx);\n\t}\n\n\tpublic toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry {\n\t\treturn {\n\t\t\t...super.toLogEntry(ctx),\n\t\t\tmessage: {\n\t\t\t\t\"is including node\": this.includingNode,\n\t\t\t\t\"public key\": buffer2hex(this.publicKey),\n\t\t\t},\n\t\t};\n\t}\n}\n\n// @publicAPI\nexport interface Security2CCNetworkKeyReportOptions {\n\tgrantedKey: SecurityClass;\n\tnetworkKey: Uint8Array;\n}\n\n@CCCommand(Security2Command.NetworkKeyReport)\nexport class Security2CCNetworkKeyReport extends Security2CC {\n\tpublic constructor(\n\t\toptions: WithAddress<Security2CCNetworkKeyReportOptions>,\n\t) {\n\t\tsuper(options);\n\t\tthis.grantedKey = options.grantedKey;\n\t\tthis.networkKey = options.networkKey;\n\t}\n\n\tpublic static from(\n\t\traw: CCRaw,\n\t\tctx: CCParsingContext,\n\t): Security2CCNetworkKeyReport {\n\t\tvalidatePayload(raw.payload.length >= 17);\n\t\tconst grantedKey: SecurityClass = bitMaskToSecurityClass(\n\t\t\traw.payload,\n\t\t\t0,\n\t\t);\n\t\tconst networkKey = raw.payload.subarray(1, 17);\n\n\t\treturn new Security2CCNetworkKeyReport({\n\t\t\tnodeId: ctx.sourceNodeId,\n\t\t\tgrantedKey,\n\t\t\tnetworkKey,\n\t\t});\n\t}\n\n\tpublic grantedKey: SecurityClass;\n\tpublic networkKey: Uint8Array;\n\n\tpublic serialize(ctx: CCEncodingContext): Bytes {\n\t\tthis.payload = Bytes.concat([\n\t\t\tsecurityClassToBitMask(this.grantedKey),\n\t\t\tthis.networkKey,\n\t\t]);\n\t\treturn super.serialize(ctx);\n\t}\n\n\tpublic toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry {\n\t\treturn {\n\t\t\t...super.toLogEntry(ctx),\n\t\t\tmessage: {\n\t\t\t\t\"security class\": getEnumMemberName(\n\t\t\t\t\tSecurityClass,\n\t\t\t\t\tthis.grantedKey,\n\t\t\t\t),\n\t\t\t\t// This shouldn't be logged, so users can safely post their logs online\n\t\t\t\t// \"network key\": buffer2hex(this.networkKey),\n\t\t\t},\n\t\t};\n\t}\n}\n\n// @publicAPI\nexport interface Security2CCNetworkKeyGetOptions {\n\trequestedKey: SecurityClass;\n}\n\n@CCCommand(Security2Command.NetworkKeyGet)\n// Don't expect a response - we need to distinguish between Report and Fail\n// FIXME: maybe use the dynamic @expectedCCResponse instead?\nexport class Security2CCNetworkKeyGet extends Security2CC {\n\tpublic constructor(\n\t\toptions: WithAddress<Security2CCNetworkKeyGetOptions>,\n\t) {\n\t\tsuper(options);\n\t\tthis.requestedKey = options.requestedKey;\n\t}\n\n\tpublic static from(\n\t\traw: CCRaw,\n\t\tctx: CCParsingContext,\n\t): Security2CCNetworkKeyGet {\n\t\tvalidatePayload(raw.payload.length >= 1);\n\t\tconst requestedKey: SecurityClass = bitMaskToSecurityClass(\n\t\t\traw.payload,\n\t\t\t0,\n\t\t);\n\n\t\treturn new Security2CCNetworkKeyGet({\n\t\t\tnodeId: ctx.sourceNodeId,\n\t\t\trequestedKey,\n\t\t});\n\t}\n\n\tpublic requestedKey: SecurityClass;\n\n\tpublic serialize(ctx: CCEncodingContext): Bytes {\n\t\tthis.payload = securityClassToBitMask(this.requestedKey);\n\t\treturn super.serialize(ctx);\n\t}\n\n\tpublic toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry {\n\t\treturn {\n\t\t\t...super.toLogEntry(ctx),\n\t\t\tmessage: {\n\t\t\t\t\"security class\": getEnumMemberName(\n\t\t\t\t\tSecurityClass,\n\t\t\t\t\tthis.requestedKey,\n\t\t\t\t),\n\t\t\t},\n\t\t};\n\t}\n}\n\n@CCCommand(Security2Command.NetworkKeyVerify)\nexport class Security2CCNetworkKeyVerify extends Security2CC {}\n\n// @publicAPI\nexport interface Security2CCTransferEndOptions {\n\tkeyVerified: boolean;\n\tkeyRequestComplete: boolean;\n}\n\n@CCCommand(Security2Command.TransferEnd)\nexport class Security2CCTransferEnd extends Security2CC {\n\tpublic constructor(\n\t\toptions: WithAddress<Security2CCTransferEndOptions>,\n\t) {\n\t\tsuper(options);\n\t\tthis.keyVerified = options.keyVerified;\n\t\tthis.keyRequestComplete = options.keyRequestComplete;\n\t}\n\n\tpublic static from(\n\t\traw: CCRaw,\n\t\tctx: CCParsingContext,\n\t): Security2CCTransferEnd {\n\t\tvalidatePayload(raw.payload.length >= 1);\n\t\tconst keyVerified = !!(raw.payload[0] & 0b10);\n\t\tconst keyRequestComplete = !!(raw.payload[0] & 0b1);\n\n\t\treturn new Security2CCTransferEnd({\n\t\t\tnodeId: ctx.sourceNodeId,\n\t\t\tkeyVerified,\n\t\t\tkeyRequestComplete,\n\t\t});\n\t}\n\n\tpublic keyVerified: boolean;\n\tpublic keyRequestComplete: boolean;\n\n\tpublic serialize(ctx: CCEncodingContext): Bytes {\n\t\tthis.payload = Bytes.from([\n\t\t\t(this.keyVerified ? 0b10 : 0) + (this.keyRequestComplete ? 0b1 : 0),\n\t\t]);\n\t\treturn super.serialize(ctx);\n\t}\n\n\tpublic toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry {\n\t\treturn {\n\t\t\t...super.toLogEntry(ctx),\n\t\t\tmessage: {\n\t\t\t\t\"key verified\": this.keyVerified,\n\t\t\t\t\"request complete\": this.keyRequestComplete,\n\t\t\t},\n\t\t};\n\t}\n}\n\n// @publicAPI\nexport interface Security2CCCommandsSupportedReportOptions {\n\tsupportedCCs: CommandClasses[];\n}\n\n@CCCommand(Security2Command.CommandsSupportedReport)\nexport class Security2CCCommandsSupportedReport extends Security2CC {\n\tpublic constructor(\n\t\toptions: WithAddress<Security2CCCommandsSupportedReportOptions>,\n\t) {\n\t\tsuper(options);\n\t\tthis.supportedCCs = options.supportedCCs;\n\t}\n\n\tpublic static from(\n\t\traw: CCRaw,\n\t\tctx: CCParsingContext,\n\t): Security2CCCommandsSupportedReport {\n\t\tconst CCs = parseCCList(raw.payload);\n\t\t// SDS13783: A sending node MAY terminate the list of supported command classes with the\n\t\t// COMMAND_CLASS_MARK command class identifier.\n\t\t// A receiving node MUST stop parsing the list of supported command classes if it detects the\n\t\t// COMMAND_CLASS_MARK command class identifier in the Security 2 Commands Supported Report\n\t\tconst supportedCCs = CCs.supportedCCs;\n\n\t\treturn new Security2CCCommandsSupportedReport({\n\t\t\tnodeId: ctx.sourceNodeId,\n\t\t\tsupportedCCs,\n\t\t});\n\t}\n\n\tpublic readonly supportedCCs: CommandClasses[];\n\n\tpublic serialize(ctx: CCEncodingContext): Bytes {\n\t\tthis.payload = encodeCCList(this.supportedCCs, []);\n\t\treturn super.serialize(ctx);\n\t}\n\n\tpublic toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry {\n\t\treturn {\n\t\t\t...super.toLogEntry(ctx),\n\t\t\tmessage: {\n\t\t\t\t\"supported CCs\": this.supportedCCs\n\t\t\t\t\t.map((cc) => getCCName(cc))\n\t\t\t\t\t.map((cc) => `\\n\u00B7 ${cc}`)\n\t\t\t\t\t.join(\"\"),\n\t\t\t},\n\t\t};\n\t}\n}\n\n@CCCommand(Security2Command.CommandsSupportedGet)\n@expectedCCResponse(Security2CCCommandsSupportedReport)\nexport class Security2CCCommandsSupportedGet extends Security2CC {}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,kBA8BO;AACP,kBAOO;AAMP,IAAAA,eAAsB;AACtB,IAAAA,eAAoD;AACpD,mBAAqB;AACrB,wBAAwB;AACxB,iBAAsB;AACtB,0BAKO;AACP,oCAMO;AACP,uBAQO;AACP,oBAIO;AACP,mBAAiC;AACjC,qBAAwB;AACxB,4BAA+B;AAC/B,wBAA2B;AAC3B,gCAAmC;;;;;;;;AAEnC,SAAS,uBAAuB,KAAkB;AACjD,aAAO,2BACN,CAAC,GAAG,GACJ,0BAAc,WACd,0BAAc,kBAAkB;AAElC;AAEA,SAAS,uBACR,QACA,QAAc;AAEd,QAAM,WAAO,0BACZ,OAAO,SAAS,QAAQ,SAAS,CAAC,GAClC,0BAAc,kBAAkB;AAEjC,mCAAgB,KAAK,WAAW,CAAC;AACjC,SAAO,KAAK,CAAC;AACd;AAEA,SAAS,sBACR,eACA,aACA,QACA,eACA,oBAA8B;AAE9B,QAAM,iBACL,+BAAkB,aAAa,SAAK,+BAAkB,WAAW,IAC9D,IACA;AACJ,QAAM,MAAM,IAAI,mBACf,IAAI,aAAa,IAAI,mBAAmB,MAAM;AAE/C,MAAI,SAAS;AACb,MAAI,YAAY,eAAe,QAAQ,UAAU;AACjD,YAAU;AACV,MAAI,YAAY,aAAa,QAAQ,UAAU;AAC/C,YAAU;AACV,MAAI,cAAc,QAAQ,MAAM;AAChC,YAAU;AACV,MAAI,cAAc,eAAe,MAAM;AACvC,YAAU;AAEV,MAAI,IAAI,oBAAoB,MAAM;AAClC,SAAO;AACR;AACA,SAAS,mBACR,WACA,kBACA,aAA0C;AAE1C,QAAM,gBAAY,+BAAkB,SAAS,SACzC,mCACF,2BAAQ,WAAW,IAAI,YAAY,CAAC,IAAI,WAAW;AAErD,SAAO,YACJ,iBAAiB,oBACjB,iBAAiB;AACrB;AAGA,SAAS,uBACR,iBACA,cACA,gBAAsB;AAEtB,8BAAgB,WACf,sCAAsC,cAAc,GAAG,EAEvD,CAAC,gBAAgB,sBAChB,cACA,cAAc,CACd;AAGF,SAAO,gBAAgB,oBACtB,cACA,cAAc;AAEhB;AAEA,MAAM,kCAAkC;AACxC,MAAM,iCAAiC;AACvC,MAAM,mCAAmC;AAWzC,SAAS,iBACR,KAAqB;AAErB,MAAI,CAAC,IAAI,WAAW;AACnB,UAAM,IAAI,uBACT,oFACA,4BAAgB,eAAe;EAEjC;AAEA,QAAM,MAAM,mBAAmB,IAAI,WAAW,KAAK,IAAI,YAAY;AAEnE,MAAI,CAAC,KAAK;AACT,UAAM,IAAI,uBACT,iFACA,4BAAgB,iBAAiB;EAEnC;AAEA,SAAO;AACR;AAEA,SAAS,iBACR,KACA,aAA0C;AAE1C,MAAI,CAAC,IAAI,WAAW;AACnB,UAAM,IAAI,uBACT,iFACA,4BAAgB,eAAe;EAEjC;AAEA,QAAM,MAAM,mBAAmB,IAAI,WAAW,KAAK,WAAW;AAE9D,MAAI,CAAC,KAAK;AACT,UAAM,IAAI,uBACT,8EACA,4BAAgB,iBAAiB;EAEnC;AAEA,SAAO;AACR;AAEA,SAAS,kBACR,KACA,iBACA,eACA,mBACA,oBACA,YACA,UACA,SACA,WAGA,YAAgC;AAEhC,QAAM,mBAAmB,CAAC,UAAqB;AAC9C,UAAM,EAAE,QAAQ,IAAG,IAAK,gBAAgB,eACvC,aAAa;AAGd,UAAM,KAAK;AACX,WAAO;MACN;MACA;MACA,OAAG,8BAAiB,KAAK,IAAI,YAAY,UAAU,OAAO;;EAE5D;AACA,QAAM,qBAAqB,MAAK;AAC/B,UAAM,KAAK,gBAAgB,UAAU,aAAa;AAClD,WAAO,iBAAiB,EAAE;EAC3B;AAEA,MAAI,UAAU,SAAS,sBAAU,MAAM;AAKtC;;MAEC,CAAC,CAAC,UAAU,eAET,UAAU,YAAY,cAAU,8BAAgB,KAEhD,sBAAsB,UACtB,uBAAwB,qBAAqB,IAAK,QAElD,CAAC,IAAI;MACP;AACD,YAAM,QAAQ,UAAU,YAAY;AACpC,gBAAU,cAAc;AAGxB,YAAM,SAAS,iBAAiB,KAAK;AACrC,UAAI,OAAO,QAAQ;AAClB,eAAO;UACN,GAAG;UACH,eAAe,UAAU;;MAE3B;IAED,OAAO;AAEN,gBAAU,cAAc;IACzB;AAGA,WAAO;MACN,GAAG,mBAAkB;MACrB,eAAe,UAAU;;EAE3B,WAAW,UAAU,SAAS,sBAAU,SAAS;AAGhD,UAAM,WAAW,YAAY,UAAU;AACvC,QAAI,CAAC;AAAU,iBAAU;AACzB,UAAM,aAAa,UAAU;AAG7B,UAAM,sBAAsB,gBAAgB,SAAS,IACpD,aAAa;AAEd,QAAI,qBAAqB;AAExB,sBAAgB,mBACf,eACA,UACA,UAAU;AAGX,YAAM,MAAM,mBAAkB;AAE9B,UAAI,IAAI,QAAQ;AACf,eAAO;UACN,GAAG;UACH,eAAe,0BAAc;;MAE/B;AAGA,sBAAgB,aACf,eACA,SAAS;IAEX;AAYA,UAAM,0BAA0B,sBAC7B,CAAC,IAAI,wBAAwB,aAAa,CAAE,IAC5C,+BAAmB,OACpB,CAAC,MACA,IAAI,iBAAiB,eAAe,CAAC,MAChC,KAAK;AAGb,eAAW,YAAY,yBAAyB;AAE/C,UACC,CAAC,gBAAgB,wBAChB,QAAQ,GAER;AACD;MACD;AAGA,sBAAgB,eACf,eACA,UACA,UACA,UAAU;AAEX,YAAM,MAAM,mBAAkB;AAG9B,UAAI,IAAI,QAAQ;AAEf,YACC,IAAI,iBAAiB,eAAe,QAAQ,MACvC,QACJ;AACD,cAAI,iBAAiB,eAAe,UAAU,IAAI;QACnD;AACA,eAAO;UACN,GAAG;UACH,eAAe;;MAEjB,OAAO;AAEN,wBAAgB,aACf,eACA,SAAS;MAEX;IACD;EACD;AAGA,SAAO;IACN,WAAW,IAAI,WAAU;IACzB,QAAQ;IACR,eAAe;;AAEjB;AAEA,SAAS,iBACR,eACA,iBACA,SACA,YACA,UACA,SAAmB;AAEnB,QAAM,KAAK,gBAAgB,aAC1B,eACA,OAAO;AAER,QAAM,EAAE,QAAQ,IAAG,IAAK,gBAAgB,eACvC,aAAa;AAEd,SAAO;IACN;IACA;IACA,OAAG,8BAAiB,KAAK,IAAI,YAAY,UAAU,OAAO;;IAE1D,eAAe;;AAEjB;AAEA,SAAS,qBAAkB;AAG1B,MAAI,KAAK,aAAY;AAAI,WAAO,KAAK;AAErC,QAAM,MAAM,oBAAoB,KAAK,UAAU;AAC/C,MAAI,OAAO,QAAW;AACrB,UAAM,IAAI,uBACT,mEACA,4BAAgB,4BAA4B;EAE9C;AACA,SAAO;AACR;AAEA,SAAS,mBACR,KACA,YAAgC;AAEhC,MAAI,IAAI,cAAc,cAAc;AACnC,WAAO,IAAI;EACZ;AAEA,QAAM,MAAM,oBAAoB,UAAU;AAC1C,MAAI,OAAO,QAAW;AACrB,UAAM,IAAI,uBACT,mEACA,4BAAgB,4BAA4B;EAE9C;AACA,SAAO;AACR;AAEA,SAAS,oBACR,YAAgC;AAEhC,QAAM,gBAAgB,WAAW,KAChC,CAAC,MAAM,aAAa,8BAAa;AAElC,SAAO,eAAe;AACvB;AAGA,SAAS,YAAY,YAAgC;AACpD,QAAM,gBAAgB,WAAW,KAChC,CAAC,MAAM,aAAa,8BAAa;AAElC,SAAO,eAAe;AACvB;AAOO,IAAM,iBAAN,MAAMC,wBAAuB,iBAAK;EACjC,gBAAgB,MAAsB;AAE5C,WAAO;EACR;;;;;EAMO,MAAM,YAAS;AACrB,SAAK,sBACJ,+BACA,8BAAiB,WAAW;AAG7B,SAAK,uBAAuB,KAAK,QAAQ;AAEzC,UAAM,kBAAkB,mBACvB,KAAK,KAAK,WACV,KAAK,MACL,KAAK,SAAS,MAAM;AAGrB,QAAI,CAAC,iBAAiB;AACrB,YAAM,IAAI,uBACT,8DACA,4BAAgB,iBAAiB;IAEnC;AAEA,UAAM,aAAa,gBAAgB,cAClC,KAAK,SAAS,MAAM;AAGrB,UAAM,KAAK,IAAI,uBAAuB;MACrC,QAAQ,KAAK,SAAS;MACtB,eAAe,KAAK,SAAS;MAC7B,KAAK;MACL,KAAK;MACL;KACA;AAED,QAAI;AACH,YAAM,KAAK,KAAK,YAAY,IAAI;QAC/B,GAAG,KAAK;;QAER,iBAAiB,4BAAgB,MAC9B,4BAAgB;;QAEnB,iBAAiB;;QAEjB,UAAU,4BAAgB;;QAE1B,8BAA8B;;OAE9B;IACF,SAAS,GAAG;AACX,cAAI,iCAAoB,CAAC,GAAG;AAE3B,wBAAgB,YACf,KAAK,SAAS,MAAM;AAErB,eAAO;MACR,OAAO;AAEN,cAAM;MACP;IACD;AACA,WAAO;EACR;;EAGO,MAAM,UAAO;AACnB,SAAK,sBACJ,+BACA,8BAAiB,WAAW;AAG7B,SAAK,uBAAuB,KAAK,QAAQ;AAEzC,UAAM,KAAK,IAAI,uBAAuB;MACrC,QAAQ,KAAK,SAAS;MACtB,eAAe,KAAK,SAAS;MAC7B,KAAK;MACL,KAAK;KACL;AAED,QAAI;AACH,YAAM,KAAK,KAAK,YAAY,IAAI;QAC/B,GAAG,KAAK;;QAER,iBAAiB,4BAAgB,MAC9B,4BAAgB;;QAEnB,iBAAiB;;QAEjB,UAAU,4BAAgB;;QAE1B,8BAA8B;OAC9B;IACF,SAAS,GAAG;AACX,cAAI,iCAAoB,CAAC,GAAG;AAC3B,eAAO;MACR,OAAO;AAEN,cAAM;MACP;IACD;AACA,WAAO;EACR;;EAGO,MAAM,SACZ,SACA,gBAA0B;AAE1B,SAAK,sBACJ,+BACA,8BAAiB,oBAAoB;AAGtC,SAAK,uBAAuB,KAAK,QAAQ;AAEzC,UAAM,KAAK,IAAI,gCAAgC;MAC9C,QAAQ,KAAK,SAAS;MACtB,eAAe,KAAK,SAAS;MAC7B,YAAY;QACX,IAAI,+BAAc;UACjB;UACA;SACA;;KAEF;AAED,QAAI;AACH,YAAM,KAAK,KAAK,YAAY,IAAI;QAC/B,GAAG,KAAK;;QAER,iBAAiB,4BAAgB,MAC9B,4BAAgB;;QAEnB,iBAAiB;;QAEjB,UAAU,4BAAgB;;QAE1B,8BAA8B;OAC9B;IACF,SAAS,GAAG;AACX,cAAI,iCAAoB,CAAC,GAAG;AAC3B,eAAO;MACR,OAAO;AAEN,cAAM;MACP;IACD;AACA,WAAO;EACR;;;;;EAMO,MAAM,qBACZ,eAGmC;AAEnC,SAAK,sBACJ,+BACA,8BAAiB,oBAAoB;AAGtC,QAAI,KAAmB,IAAI,gCAAgC;MAC1D,QAAQ,KAAK,SAAS;MACtB,eAAe,KAAK,SAAS;KAC7B;AAID,QAAI,qCAAe,sBAAsB,EAAE,GAAG;AAC7C,YAAM,wBAAwB,KAAK,KAAK,sBACvC,2BAAe,eAAe,GAC9B,KAAK,SAAS,MAAgB;AAG/B,WAAK,0BAA0B,IAC5B,qCAAe,cAAc,EAAE,IAC/B,qCAAe,YAAY,EAAE;IACjC;AACA,SAAK,YAAY,YAChB,IACA,KAAK,KAAK,WACV,KAAK,MACL,EAAE,cAAa,CAAE;AAGlB,UAAM,WAAW,MAAM,KAAK,KAAK,YAGhC,IACA;MACC,GAAG,KAAK;MACR,iBAAiB;KACjB;AAEF,WAAO,UAAU;EAClB;EAEO,MAAM,wBACZ,cAA8B;AAE9B,SAAK,sBACJ,+BACA,8BAAiB,uBAAuB;AAGzC,UAAM,KAAK,IAAI,mCAAmC;MACjD,QAAQ,KAAK,SAAS;MACtB,eAAe,KAAK,SAAS;MAC7B;KACA;AACD,UAAM,KAAK,KAAK,YAAY,IAAI,KAAK,cAAc;EACpD;;EAGO,MAAM,2BAAwB;AACpC,SAAK,sBAAsB,+BAAkB,8BAAiB,MAAM;AAEpE,UAAM,KAAK,IAAI,kBAAkB;MAChC,QAAQ,KAAK,SAAS;MACtB,eAAe,KAAK,SAAS;KAC7B;AACD,UAAM,WAAW,MAAM,KAAK,KAAK,YAChC,IACA,KAAK,cAAc;AAEpB,QAAI,UAAU;AACb,iBAAO,mBAAK,UAAU;QACrB;QACA;QACA;QACA;QACA;QACA;OACA;IACF;EACD;;EAGO,MAAM,YACZ,QAAiD;AAEjD,SAAK,sBACJ,+BACA,8BAAiB,SAAS;AAG3B,UAAM,KAAK,IAAI,qBAAqB;MACnC,QAAQ,KAAK,SAAS;MACtB,eAAe,KAAK,SAAS;MAC7B,GAAG;MACH,MAAM;KACN;AACD,UAAM,KAAK,KAAK,YAAY,IAAI,KAAK,cAAc;EACpD;;EAGO,MAAM,UACZ,QAA8C;AAE9C,SAAK,sBAAsB,+BAAkB,8BAAiB,MAAM;AAEpE,UAAM,KAAK,IAAI,kBAAkB;MAChC,QAAQ,KAAK,SAAS;MACtB,eAAe,KAAK,SAAS;MAC7B,GAAG;MACH,MAAM;KACN;AACD,UAAM,KAAK,KAAK,YAAY,IAAI,KAAK,cAAc;EACpD;;EAGO,MAAM,qBACZ,QAAiD;AAEjD,SAAK,sBACJ,+BACA,8BAAiB,SAAS;AAG3B,UAAM,KAAK,IAAI,qBAAqB;MACnC,QAAQ,KAAK,SAAS;MACtB,eAAe,KAAK,SAAS;MAC7B,GAAG;MACH,MAAM;KACN;AACD,UAAM,KAAK,KAAK,YAAY,IAAI,KAAK,cAAc;EACpD;;EAGO,MAAM,mBACZ,QAA8C;AAE9C,SAAK,sBACJ,+BACA,8BAAiB,MAAM;AAGxB,UAAM,KAAK,IAAI,kBAAkB;MAChC,QAAQ,KAAK,SAAS;MACtB,eAAe,KAAK,SAAS;MAC7B,GAAG;MACH,MAAM;KACN;AACD,WAAO,KAAK,KAAK,YAAY,IAAI,KAAK,cAAc;EACrD;;EAGO,MAAM,iBAAiB,UAAqB;AAClD,SAAK,sBAAsB,+BAAkB,8BAAiB,OAAO;AAErE,UAAM,KAAK,IAAI,mBAAmB;MACjC,QAAQ,KAAK,SAAS;MACtB,eAAe,KAAK,SAAS;MAC7B;KACA;AACD,UAAM,KAAK,KAAK,YAAY,IAAI,KAAK,cAAc;EACpD;EAEO,MAAM,cACZ,WACA,gBAAyB,MAAI;AAE7B,SAAK,sBACJ,+BACA,8BAAiB,eAAe;AAGjC,UAAM,KAAK,IAAI,2BAA2B;MACzC,QAAQ,KAAK,SAAS;MACtB,eAAe,KAAK,SAAS;MAC7B;MACA;KACA;AACD,UAAM,KAAK,KAAK,YAAY,IAAI,KAAK,cAAc;EACpD;EAEO,MAAM,kBACZ,eAA4B;AAE5B,SAAK,sBACJ,+BACA,8BAAiB,aAAa;AAG/B,UAAM,KAAK,IAAI,yBAAyB;MACvC,QAAQ,KAAK,SAAS;MACtB,eAAe,KAAK,SAAS;MAC7B,cAAc;KACd;AACD,UAAM,KAAK,KAAK,YAAY,IAAI,KAAK,cAAc;EACpD;EAEO,MAAM,eACZ,eACA,YAAsB;AAEtB,SAAK,sBACJ,+BACA,8BAAiB,gBAAgB;AAGlC,UAAM,KAAK,IAAI,4BAA4B;MAC1C,QAAQ,KAAK,SAAS;MACtB,eAAe,KAAK,SAAS;MAC7B,YAAY;MACZ;KACA;AACD,UAAM,KAAK,KAAK,YAAY,IAAI,KAAK,cAAc;EACpD;EAEO,MAAM,mBAAgB;AAC5B,SAAK,sBACJ,+BACA,8BAAiB,gBAAgB;AAGlC,UAAM,KAAK,IAAI,4BAA4B;MAC1C,QAAQ,KAAK,SAAS;MACtB,eAAe,KAAK,SAAS;KAC7B;AACD,UAAM,KAAK,KAAK,YAAY,IAAI,KAAK,cAAc;EACpD;EAEO,MAAM,yBAAsB;AAClC,SAAK,sBACJ,+BACA,8BAAiB,WAAW;AAG7B,UAAM,KAAK,IAAI,uBAAuB;MACrC,QAAQ,KAAK,SAAS;MACtB,eAAe,KAAK,SAAS;MAC7B,aAAa;MACb,oBAAoB;KACpB;AACD,UAAM,KAAK,KAAK,YAAY,IAAI;MAC/B,GAAG,KAAK;;MAER,iBAAiB,4BAAgB,UAAU,CAAC,4BAAgB;KAC5D;EACF;EAEO,MAAM,iBAAc;AAC1B,SAAK,sBACJ,+BACA,8BAAiB,WAAW;AAG7B,UAAM,KAAK,IAAI,uBAAuB;MACrC,QAAQ,KAAK,SAAS;MACtB,eAAe,KAAK,SAAS;MAC7B,aAAa;MACb,oBAAoB;KACpB;AACD,UAAM,KAAK,KAAK,YAAY,IAAI,KAAK,cAAc;EACpD;;AA5aY,iBAAc,WAAA;MAD1B,mCAAI,2BAAe,YAAY,CAAC;GACpB,cAAc;AAibpB,IAAM,cAAW,gBAAjB,MAAMC,qBAAoB,iCAAY;EAGrC,MAAM,UACZ,KAAqB;AAErB,UAAM,kBAAkB,mBACvB,IAAI,WACJ,KACA,KAAK,MAAM;AAGZ,UAAM,OAAO,KAAK,QAAQ,GAAG;AAC7B,UAAM,WAAW,KAAK,YAAY,GAAG;AACrC,UAAM,MAAM,iBAAM,OACjB,2BAAe,YAAY,GAC3B,KACA,QAAQ,EACP,YAAY;MACb,UAAU,4BAAgB;KAC1B;AAED,UAAM,WAAW,KAAK,wBAAuB;AAC7C,QAAI,4BAA4B;AAEhC,QAAI;AACJ,YAAI,+BAAkB,QAAQ,GAAG;AAEhC,gCAA0B,CAAC,QAAQ;IACpC,WAAW,SAAS,UAAU,GAAG;AAGhC,gCAA0B;QACzB,0BAAc;QACd,0BAAc;QACd,0BAAc;;IAEhB,OAAO;AAEN,UAAI,QAAQ,KAAK,IAAI;QACpB,UAAU,SAAS;QACnB,SACC;QACD,OAAO;OACP;AACD;IACD;AAEA,eAAWC,aAAY,yBAAyB;AAS/C,UAAI,KAAK,iBAAiBA,SAAQ,MAAM;AAAO;AAG/C,UACC,CAAC,iBAAiB,wBAAwBA,SAAQ,GACjD;AACD,YAAI,QAAQ,KAAK,IAAI;UACpB,UAAU,SAAS;UACnB,SAAS,iDACR,gCACC,2BACAA,SAAQ,CAEV;UACA,OAAO;SACP;AACD;MACD;AAEA,UAAI,QAAQ,KAAK,IAAI;QACpB,UAAU,SAAS;QACnB,SAAS,6CACR,gCACC,2BACAA,SAAQ,CAEV;QACA,WAAW;OACX;AAGD,UAAI;AAEJ,YAAM,eAAe,KAAK,kBAAkB,IAAI,IAAI;AACpD,eAAS,WAAW,GAAG,YAAY,cAAc,YAAY;AAC5D,YAAI;AACH,yBAAe,MAAM,IAAI,qBAAqBA,SAAQ;QACvD,SAAS,GAAG;AACX,kBACC,0BAAa,CAAC,KACX,EAAE,SAAS,4BAAgB,0BAC7B;AAGD,2BAAe;UAChB,OAAO;AACN,kBAAM;UACP;QACD;AAEA,YACC,gBAAgB,UACb,wBAAwB,WAAW,GACrC;AACD,cAAI,WAAW,cAAc;AAE5B,gBAAI,QAAQ,KAAK,IAAI;cACpB,UAAU,SAAS;cACnB,SAAS,6CACR,gCACC,2BACAA,SAAQ,CAEV,cAAc,QAAQ,IAAI,YAAY;cACtC,OAAO;aACP;AACD,sBAAM,mBAAK,GAAG;AACd;UACD,WAAW,SAAS,QAAQ,GAAG;AAC9B,gBAAI,QAAQ,KAAK,IAAI;cACpB,UAAU,SAAS;cACnB,SAAS,6CACR,gCACC,2BACAA,SAAQ,CAEV;cACA,OAAO;aACP;AAID,uBAAW,CAAC,IAAI,KAAK,SAAS,OAAM,GAAI;AACvC,uBAAS,MAAM,MAAM,EAAE,QAAQ,KAAI,CAAE;YACtC;AAEA;UACD,OAAO;AACN,gBAAI,QAAQ,KAAK,IAAI;cACpB,UAAU,SAAS;cACnB,SAAS,6CACR,gCACC,2BACAA,SAAQ,CAEV;cACA,OAAO;aACP;AACD;UACD;QACD,OAAO;AAEN;QACD;MACD;AAEA,UAAI,gBAAgB,QAAW;AAC9B,YACC,SAAS,UAAU,KAChB,wBAAwB,SAAS,GACnC;AAGD,eAAK,iBAAiBA,WAAU,KAAK;AAErC,cAAI,QAAQ,KAAK,IAAI;YACpB,SAAS,mDACR,gCACC,2BACAA,SAAQ,CAEV;YACA,WAAW;WACX;QACF;AACA;MACD;AAEA,UAAI,SAAS,UAAU,KAAK,wBAAwB,SAAS,GAAG;AAE/D,aAAK,iBAAiBA,WAAU,IAAI;AAEpC,YAAI,QAAQ,KAAK,IAAI;UACpB,SAAS,+CACR,gCACC,2BACAA,SAAQ,CAEV;UACA,WAAW;SACX;MACF;AAEA,UAAI,CAAC,6BAA6B,aAAa,SAAS,GAAG;AAC1D,oCAA4B;AAE5B,cAAM,WAAqB;UAC1B,iCACC,gCACC,2BACAA,SAAQ,CAEV;UACA;;AAED,mBAAW,MAAM,cAAc;AAC9B,mBAAS,KAAK,YAAK,uBAAU,EAAE,CAAC,EAAE;QACnC;AACA,YAAI,QAAQ,KAAK,IAAI;UACpB,UAAU,SAAS;UACnB,SAAS,SAAS,KAAK,IAAI;UAC3B,WAAW;SACX;AAGD,mBAAW,MAAM,cAAc;AAI9B,cAAI,OAAO,2BAAe,OAAO;AAChC,qBAAS,MAAM,IAAI,EAAE,QAAQ,KAAI,CAAE;UACpC,OAAO;AACN,qBAAS,MAAM,IAAI;cAClB,aAAa;cACb,QAAQ;aACR;UACF;QACD;MACD;IACD;AAGA,SAAK,qBAAqB,KAAK,IAAI;EACpC;;EAGO,OAAO,sBAAsB,IAAgB;AAEnD,QAAI,EAAE,GAAG,qBAAqB,+BAAmB,WAAW;AAC3D,aAAO;IACR;AAEA,QACC,cAAc,gCACX,cAAc,0BACd,cAAc,8CAChB;AACD,aAAO;IACR;AAEA,QAAI,cAAc,eAAa;AAE9B,cAAQ,GAAG,WAAW;QACrB,KAAK,8BAAiB;QACtB,KAAK,8BAAiB;QACtB,KAAK,8BAAiB;QACtB,KAAK,8BAAiB;QACtB,KAAK,8BAAiB;QACtB,KAAK,8BAAiB;AACrB,iBAAO;QAER,KAAK,8BAAiB;QACtB,KAAK,8BAAiB;AAErB,iBAAQ,GACN;QAEH,KAAK,8BAAiB,SAAS;AAC9B,kBAAS,GAA0B,UAAU;YAC5C,KAAK,0BAAY;YACjB,KAAK,0BAAY;YACjB,KAAK,0BAAY;YACjB,KAAK,0BAAY;AAChB,qBAAO;YACR;AACC,qBAAO;UACT;QACD;MACD;AACA,aAAO;IACR;AAGA,WAAO;EACR;;EAGO,OAAO,YACb,IACA,WACA,kBACA,SAKC;AAGD,UAAM,aAAmC,CAAA;AACzC,QAAI,SAAS,oBAAoB;AAChC,iBAAW,KAAK,IAAI,8BAAY,CAAE;IACnC;AACA,QAAI,SAAS,oBAAoB,QAAW;AAC3C,iBAAW,KACV,IAAI,+BAAc,EAAE,SAAS,QAAQ,iBAAgB,CAAE,CAAC;IAE1D;AAIA,QAAI;AACJ,QAAI,GAAG,YAAW,GAAI;AACrB,UAAI,GAAG,OAAO,KAAK,CAACC,gBAAW,+BAAkBA,OAAM,CAAC,GAAG;AAC1D,iBAAS;MACV,OAAO;AACN,iBAAS;MACV;IACD,OAAO;AACN,eAAS,GAAG;IACb;AAEA,UAAM,MAAM,IAAI,gCAAgC;MAC/C;MACA,cAAc;MACd,eAAe,SAAS;MACxB;MACA,gBAAgB,SAAS;KACzB;AAID,QAAI,qBAAqB,GAAG,qBACzB,CAAC,+BAAmB;AAEvB,WAAO;EACR;;AAvVY,cAAW,gBAAA,WAAA;MAFvB,4CAAa,2BAAe,YAAY,CAAC;MACzC,kDAAmB,CAAC;GACR,WAAW;AA0VxB,SAAS,aAAU;AAClB,8BAAgB,KAAK,4BAAgB,kBAAkB;AACxD;AAEA,SAAS,aAAU;AAClB,8BAAgB,KAAK,4BAAgB,kBAAkB;AACxD;AAwBA,SAAS,qCACR,MAAqC;AAErC,MAAI,KAAK,cAAc,kBAAiB,GAAI;AAC3C,UAAM,MAAM;MACX;MACA;;AAGD,QACC,KAAK,wBAAwB,qBAC1B,KAAK,wBAAwB,wBAC7B,KAAK,wBAAwB,4BAC7B,KAAK,wBAAwB,+BAC7B,KAAK,wBAAwB,6BAC/B;AACD,UAAI,KAAK,kBAAyB;IACnC;AAEA,WAAO;EACR;AACD;AAEA,SAAS,sCACR,MACA,UAGqB;AAErB,MAAI,oBAAoB,iCAAiC;AACxD,WAAO;EACR,WAAW,oBAAoB,oBAAoB;AAClD,WAAO;EACR,OAAO;AACN,WAAO,SAAS,OAAO,CAAC,CAAC,SAAS;EACnC;AACD;AAOO,IAAM,kCAA+B,oCAArC,MAAMC,yCAAwC,YAAW;EAC/D,YACC,SAA4D;AAE5D,UAAM,OAAO;AAEb,QAAI,CAAC,QAAQ,gBAAgB,CAAC,QAAQ,YAAY,QAAQ;AACzD,YAAM,IAAI,uBACT,2EACA,4BAAgB,gBAAgB;IAElC;AAEA,SAAK,iBAAiB,QAAQ;AAE9B,SAAK,gBAAgB,QAAQ;AAC7B,QAAI,QAAQ,cAAc;AACzB,WAAK,eAAe,QAAQ;AAC5B,cAAQ,aAAa,kBAAkB;IACxC;AAEA,SAAK,iBAAiB,QAAQ,mBAAmB;AAEjD,SAAK,aAAa,QAAQ,cAAc,CAAA;AACxC,QACC,OAAO,KAAK,WAAW,YACpB,CAAC,KAAK,WAAW,KAAK,CAAC,MAAM,aAAa,8BAAa,GACzD;AACD,YAAM,IAAI,uBACT,mEACA,4BAAgB,4BAA4B;IAE9C;EACD;EAEO,OAAO,KACb,KACA,KAAqB;AAErB,UAAM,kBAAkB,iBAAiB,GAAG;AAE5C,qCAAgB,IAAI,QAAQ,UAAU,CAAC;AAEvC,UAAM,iBAAqC,IAAI,QAAQ,CAAC;AAGxD,gCAAgB,WAAW,2BAA2B,EACrD,IAAI,wBACH,IAAI,YAAY,MACX,0BAAc,IAAI;AAGzB,UAAM,gBAAgB,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI;AAC1C,UAAM,yBAAyB,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI;AAEnD,QAAI,SAAS;AACb,UAAM,aAAmC,CAAA;AACzC,QAAI,qBAAqB;AAEzB,UAAM,kBAAkB,CAAC,QAAoB,iBAAyB;AACrE,aAAO,MAAM;AACZ,YAAI,OAAO,SAAS,SAAS,GAAG;AAE/B,+BAAqB;AACrB;QACD;AAIA,cAAM,EAAE,QAAQ,cAAc,UAAU,eAAc,IACrD,oCACE,mBACA,OAAO,SAAS,MAAM,CAAC;AAI1B,cAAM,kBAAkB,kBAAkB;AAC1C,YAAI,kBAAkB,GAAG;AAExB,+BAAqB;AACrB;QACD,WACC,kBACG,OAAO,SACN,UACC,eACA,IACA,0CACJ;AAED,+BAAqB;AACrB;QACD;AAEA,cAAM,gBAAgB,OAAO,SAC5B,QACA,SAAS,eAAe;AAEzB,kBAAU;AAEV,cAAM,MAAM,oCAAmB,MAAM,aAAa;AAElD,oBAAQ,sCAAoB,KAAK,YAAY,GAAG;UAC/C,KAAK,2CAA0B;AAC9B,gBACC,kBAAkB,UACf,iBAAiB,gBACnB;YAEF,OAAO;AACN,yBAAW,KAAK,GAAG;YACpB;AACA;UACD,KAAK,2CAA0B;AAE9B;UACD,KAAK,2CAA0B;AAC9B,iCAAqB;AACrB;QACF;AAGA,YAAI,CAAC,IAAI;AAAc;MACxB;IACD;AACA,QAAI;AAAe,sBAAgB,IAAI,SAAS,KAAK;AAErD,UAAM,SAAS,MAAuB;AACrC,YAAM,mBAAmB,oBAAoB,UAAU;AACvD,UACC,IAAI,cAAc,eAAe,IAAI,cAAc,aAClD;AACD,YAAI,oBAAoB,QAAW;AAClC,sCAAgB,KACf,yCAAyC;QAE3C;AACA,eAAO;UACN,aAAa;UACb,SAAS;;MAEX,OAAO;AACN,eAAO,EAAE,aAAa,OAAO,SAAS,iBAAgB;MACvD;IACD,GAAE;AAIF,QAAI,oBAAoB;AACvB,UAAI,MAAM,aAAa;AACtB,wBAAgB,aACf,IAAI,cACJ,MAAM,OAAO;MAEf,OAAO;AACN,wBAAgB,UAAU,IAAI,YAAY;MAC3C;AACA,kCAAgB,KACf,sBAAsB;IAExB;AAEA,QAAI;AACJ,QAAI;AAGJ,QAAI,MAAM,aAAa;AACtB,kBAAY,gBAAgB,YAC3B,IAAI,cACJ,MAAM,OAAO;IAEf,OAAO;AAEN,2BAAqB,uBACpB,iBACA,IAAI,cACJ,cAAc;AAKf,UAAI,MAAM,WAAW,QAAW;AAC/B,wBAAgB,oBACf,IAAI,YAAY;MAElB;IACD;AAEA,UAAM,qBAAqB,IAAI,QAAQ,SAAS,GAAG,MAAM;AACzD,UAAM,aAAa,IAAI,QAAQ,SAC9B,QACA,CAAC,uCAA2B;AAE7B,UAAM,UAAU,IAAI,QAAQ,SAAS,CAAC,uCAA2B;AACjE,UAAM,gBACL,IACE,IAAI,QAAQ;AAEf,UAAM,WAAW,sBAChB,IAAI,cACJ,mBAAmB,KAAK,UAAU,GAClC,IAAI,QACJ,eACA,kBAAkB;AAGnB,QAAI;AACJ,QAAI,MAAM,aAAa;AAEtB,UAAI,WAAW,SAAS,sBAAU,MAAM;AAEvC,wBAAgB,cACf,IAAI,cACJ,MAAM,SACN,EAAE,MAAM,sBAAU,UAAS,CAAE;AAE9B,mBAAU;MACX;AAEA,gBAAU,MACT,iBACC,IAAI,cACJ,iBACA,MAAM,SACN,YACA,UACA,OAAO;IAEV,OAAO;AAEN,YAAM,YAAY,gBAAgB,aACjC,IAAI,YAAY;AAIjB,UAAI,UAAU,SAAS,sBAAU,MAAM;AACtC,mBAAU;MACX,WAAW,UAAU,SAAS,sBAAU,UAAU;AAGjD,mBAAU;MACX;AAEA,gBAAU,MACT,kBACC,KACA,iBACA,IAAI,cACJ,gBACA,oBACA,YACA,UACA,SACA,WACA,UAAU;IAEb;AAEA,QAAI;AACJ,QAAI,SAAS;AACb,QAAI;AACJ,QAAI;AACJ,QAAI;AASJ,UAAM,kBAAkB,MAAM,cAC3B,iCACA,MAAM,WAAW,SACjB,mCACA;AAEH,aAAS,IAAI,GAAG,IAAI,iBAAiB,KAAK;AACzC,OAAC;QACA;QACA;QACA;QACA;QACA,eAAe;UACZ,QAAO;AACX,UAAI,CAAC,CAAC,UAAU,CAAC,CAAC;AAAW;AAE7B,UAAI,CAAC,CAAC,YAAY,UAAU;AAAG;IAChC;AAIA,QAAI,CAAC,UAAU,CAAC,WAAW;AAC1B,UAAI,MAAM,aAAa;AAEtB,wBAAgB,cACf,IAAI,cACJ,MAAM,SACN,EAAE,MAAM,sBAAU,UAAS,CAAE;AAE9B,oCAAgB,KACf,4BAAgB,iCAAiC;MAEnD,OAAO;AACN,oCAAgB,KACf,4BAAgB,wBAAwB;MAE1C;IACD,WAAW,CAAC,MAAM,eAAe,MAAM,WAAW,QAAW;AAE5D,sBAAgB,qBACf,IAAI,cACJ,MAAM,OAAO;IAEf;AAGA,UAAM,gBACL;AAED,aAAS;AACT,QAAI;AAAwB,sBAAgB,WAAW,IAAI;AAG3D,QAAI,oBAAoB;AACvB,kCAAgB,KAAK,mBAAmB;IACzC;AAGA,QAAI,CAAC,MAAM,aAAa;AACvB,YAAM,gBAAgB,WAAW,KAAK,CAAC,MACtC,aAAa,8BAAa;AAE3B,UAAI,eAAe;AAClB,wBAAgB,cACf,IAAI,cACJ,cAAc,SACd;UACC,MAAM,sBAAU;UAChB,aAAa,cAAc;SAC3B;MAEH;IACD;AAGA,UAAM,mBAAmB,UAAU,SAAS,MAAM;AAClD,QAAI;AACJ,QAAI,iBAAiB,SAAS,GAAG;AAEhC,uCAAgB,iBAAiB,UAAU,CAAC;AAE5C,qBAAe,iCAAa,MAAM,kBAAkB,GAAG;IACxD;AAEA,UAAM,MAAM,IAAI,kCAAgC;MAC/C,QAAQ,IAAI;MACZ;MACA;MACA;MACA;KACA;AAGD,QAAI,MAAM;AACV,QAAI,KAAK;AACT,QAAI,WAAW;AACf,QAAI,UAAU;AACd,QAAI,YAAY;AAEhB,WAAO;EACR;EAEgB;;EAGR;EACA;EACA;EACA;EACA;EACA;EAEQ,iBAA0B;EAEnC;EACC,qBACP,iBAAiC;AAIjC,QAAI,KAAK,kBAAkB,QAAW;AACrC,UAAI,KAAK,aAAY,GAAI;AACxB,aAAK,iBAAiB,gBAAgB,mBACrC,KAAK,MAAM;MAEb,OAAO;AACN,cAAM,UAAU,mBAAmB,KAAK,IAAI;AAC5C,aAAK,iBAAiB,gBACpB,4BACA,OAAO;MAEV;IACD;EACD;EAEO;EACA;EAES,wBAAqB;AACpC,UAAM,sBAAqB;AAC3B,SAAK,iBAAiB;EACvB;EAEO,kBAAe;AACrB,WAAO,KAAK,WAAW,KAAK,CAAC,MAAM,aAAa,6BAAY;EAC7D;;EAGO,cAAW;AACjB,WAAO,YAAY,KAAK,UAAU;EACnC;;EAGO,sBAAmB;AACzB,WAAO,oBAAoB,KAAK,UAAU;EAC3C;EAEQ,sBACP,KACA,iBAAiC;AAEjC,QAAI,CAAC,KAAK,aAAY;AAAI;AAE1B,UAAM,iBAAyB,KAAK;AACpC,UAAM,YAAY,gBAAgB,aACjC,cAAc;AAEf,QACC,UAAU,SAAS,sBAAU,QAC1B,UAAU,SAAS,sBAAU,SAC/B;AAED,YAAM,IAAI,uBACT,4DACA,4BAAgB,kBAAkB;IAEpC,WAAW,UAAU,SAAS,sBAAU,UAAU;AAGjD,YAAM,WAAW,gBAAgB,cAChC,MAAS;AAEV,YAAM,aAAa,UAAU;AAI7B,UACC,KAAK,iBAAiB,UACnB,gBAAgB,SAAS,IAAI,cAAc,GAC7C;AACD,wBAAgB,mBACf,gBACA,UACA,UAAU;MAEZ,OAAO;AACN,cAAM,gBAAgB,KAAK,iBACvB,IAAI,wBAAwB,cAAc;AAE9C,YAAI,iBAAiB,QAAW;AAC/B,gBAAM,IAAI,uBACT,+CACA,4BAAgB,kBAAkB;QAEpC;AACA,wBAAgB,eACf,gBACA,eACA,UACA,UAAU;MAEZ;AAGA,UAAI,gBAAgB,KAAK,WAAW,KACnC,CAAC,MAAM,aAAa,8BAAa;AAElC,UAAI,eAAe;AAClB,sBAAc,WAAW;MAC1B,OAAO;AACN,wBAAgB,IAAI,+BAAc,EAAE,SAAQ,CAAE;AAC9C,aAAK,WAAW,KAAK,aAAa;MACnC;IACD;EACD;EAEO,UAAU,KAAsB;AACtC,UAAM,kBAAkB,iBAAiB,KAAK,KAAK,MAAM;AACzD,SAAK,qBAAqB,eAAe;AAGzC,SAAK,sBAAsB,KAAK,eAAe;AAE/C,UAAM,wBAAwB,KAAK,WAAW,OAC7C,CAAC,MAAM,CAAC,EAAE,YAAW,CAAE;AAExB,UAAM,sBAAsB,KAAK,WAAW,OAAO,CAAC,MACnD,EAAE,YAAW,CAAE;AAGhB,UAAM,qBAAqB,mBAAM,OAAO;MACvC,mBAAM,KAAK;QACV,KAAK;SACJ,oBAAoB,SAAS,IAAI,IAAO,MACtC,sBAAsB,SAAS,IAAI,IAAI;OAC1C;MACD,GAAG,sBAAsB,IAAI,CAAC,GAAG,UAChC,EAAE,UAAU,QAAQ,sBAAsB,SAAS,CAAC,CAAC;KAEtD;AACD,UAAM,eAAe,KAAK,cAAc,UAAU,GAAG,KACjD,IAAI,mBAAK;AACb,UAAM,mBAAmB,mBAAM,OAAO;MACrC,GAAG,oBAAoB,IAAI,CAAC,GAAG,UAC9B,EAAE,UAAU,QAAQ,oBAAoB,SAAS,CAAC,CAAC;MAEpD;KACA;AAGD,UAAM,iBAAiB,mBAAmB,KACzC,IAAuC;AAExC,UAAM,gBAAgB,KAAK,6BAA4B,IACpD,aAAa;AAChB,UAAM,WAAW,sBAChB,IAAI,WACJ,gBACA,IAAI,QACJ,eACA,kBAAkB;AAGnB,QAAI;AACJ,QAAI;AAEJ,QAAI,KAAK,aAAY,GAAI;AAIxB,WAAK,gBAAgB,UAAU,KAAK,QAAQ,IAAI;AAChD,YAAM,EAAE,OAAM;;QAEb,KAAK,iBAAiB,SACnB,gBAAgB,wBACjB,KAAK,aAAa,IAEjB,gBAAgB,eAAe,KAAK,MAAM;;AAC9C,YAAM;IACP,OAAO;AAEN,YAAM,WAAW,gBAAgB,qBAChC,cAAc;AAEf,YAAM,SAAS;AACf,WAAK,SAAS;IACf;AAEA,UAAM,EAAE,YAAY,mBAAmB,QAAO,QAAK,8BAClD,KACA,IACA,kBACA,UACA,uCAA2B;AAI5B,SAAK,MAAM;AACX,SAAK,KAAK;AACV,SAAK,WAAW;AAChB,SAAK,UAAU;AACf,SAAK,aAAa;AAElB,SAAK,UAAU,mBAAM,OAAO;MAC3B;MACA;MACA;KACA;AACD,WAAO,MAAM,UAAU,GAAG;EAC3B;EAEU,+BAA4B;AAMrC,UAAM,iBAAiB,KAAK,WAC1B,IAAI,CAAC,MAAM,EAAE,cAAa,CAAE,EAC5B,OAAO,CAAC,GAAG,MAAM,IAAI,GAAG,CAAC;AAE3B,WACC,MAAM,6BAA4B,IAChC,IACA,0CACA;EAEJ;EAEO,WAAW,KAAgB;AACjC,UAAM,UAAyB;MAC9B,mBAAmB,KAAK,kBAAkB;;AAE3C,QAAI,KAAK,WAAW,SAAS,GAAG;AAC/B,cAAQ,aAAa,KAAK,WACxB,IAAI,CAAC,MAAM,EAAE,WAAU,CAAE,EACzB,KAAK,EAAE;IACV;AAEA,QACC,QAAQ,IAAI,aAAa,UACtB,QAAQ,IAAI,aAAa,eAC3B;AACD,UAAI,KAAK,KAAK;AACb,gBAAQ,UAAM,yBAAW,KAAK,GAAG;MAClC;AACA,UAAI,KAAK,IAAI;AACZ,gBAAQ,SAAK,yBAAW,KAAK,EAAE;MAChC;AACA,UAAI,KAAK,YAAY;AACpB,gBAAQ,iBAAa,yBAAW,KAAK,UAAU;MAChD,WAAW,KAAK,WAAW;AAC1B,gBAAQ,gBAAY,yBAAW,KAAK,SAAS;MAC9C;AACA,UAAI,KAAK,UAAU;AAClB,gBAAQ,WAAW,QAAI,yBAAW,KAAK,QAAQ;MAChD;AACA,UAAI,KAAK,SAAS;AACjB,gBAAQ,UAAU,QAAI,yBAAW,KAAK,OAAO;MAC9C;IACD;AAEA,QAAI,KAAK,iBAAiB,QAAW;AACpC,cAAQ,gBAAgB,QAAI,gCAC3B,2BACA,KAAK,aAAa;IAEpB;AAEA,WAAO;MACN,GAAG,MAAM,WAAW,GAAG;MACvB;;EAEF;;AA9oBY,kCAA+B,oCAAA,WAAA;MAL3C,yCAAU,8BAAiB,oBAAoB;MAC/C,kDACA,sCACA,qCAAqC;GAEzB,+BAA+B;AAoqBrC,IAAM,yBAAsB,2BAA5B,MAAMC,gCAA+B,YAAW;EACtD,YACC,SAAmD;AAEnD,UAAM,OAAO;AAEb,SAAK,MAAM,QAAQ;AACnB,SAAK,MAAM,QAAQ;AACnB,SAAK,iBAAiB,QAAQ;AAC9B,QAAI,QAAQ;AAAK,WAAK,aAAa,QAAQ;EAC5C;EAEO,OAAO,KACb,KACA,KAAqB;AAGrB,UAAM,kBAAkB,iBAAiB,GAAG;AAE5C,qCAAgB,IAAI,QAAQ,UAAU,CAAC;AACvC,UAAM,iBAAiB,IAAI,QAAQ,CAAC;AAGpC,2BACC,iBACA,IAAI,cACJ,cAAc;AAEf,UAAM,MAAM,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI;AAChC,UAAM,MAAM,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI;AAEhC,QAAI,KAAK;AAER,uCAAgB,IAAI,QAAQ,UAAU,EAAE;AACxC,YAAM,aAAa,IAAI,QAAQ,SAAS,GAAG,EAAE;AAI7C,sBAAgB,cACf,IAAI,cACJ,UAAU;AAGX,aAAO,IAAI,yBAAuB;QACjC,QAAQ,IAAI;QACZ;QACA;QACA;QACA;OACA;IACF,WAAW,KAAK;AACf,aAAO,IAAI,yBAAuB;QACjC,QAAQ,IAAI;QACZ;QACA;QACA,KAAK;OACL;IACF,OAAO;AACN,kCAAgB,KAAK,+BAA+B;IACrD;EACD;EAEO;EACC,qBACP,iBAAiC;AAIjC,QAAI,KAAK,kBAAkB,QAAW;AACrC,WAAK,iBAAiB,gBAAgB,mBACrC,KAAK,MAAgB;IAEvB;EACD;EAEgB;EACA;EACA;EAET,UAAU,KAAsB;AACtC,UAAM,kBAAkB,iBAAiB,KAAK,KAAK,MAAM;AACzD,SAAK,qBAAqB,eAAe;AAEzC,SAAK,UAAU,mBAAM,KAAK;MACzB,KAAK;OACJ,KAAK,MAAM,IAAO,MAAM,KAAK,MAAM,IAAM;KAC1C;AACD,QAAI,KAAK,KAAK;AACb,WAAK,UAAU,mBAAM,OAAO,CAAC,KAAK,SAAS,KAAK,UAAW,CAAC;IAC7D;AACA,WAAO,MAAM,UAAU,GAAG;EAC3B;EAEO,WAAW,KAAgB;AACjC,UAAM,UAAyB;MAC9B,mBAAmB,KAAK,kBAAkB;MAC1C,KAAK,KAAK;MACV,KAAK,KAAK;;AAEX,QAAI,KAAK,YAAY;AACpB,cAAQ,kBAAkB,QAAI,yBAAW,KAAK,UAAU;IACzD;AACA,WAAO;MACN,GAAG,MAAM,WAAW,GAAG;MACvB;;EAEF;;AA1GY,yBAAsB,2BAAA,WAAA;MADlC,yCAAU,8BAAiB,WAAW;GAC1B,sBAAsB;AAoH5B,IAAM,sBAAmB,wBAAzB,MAAMC,6BAA4B,YAAW;;;EAInD,YACC,SAAgD;AAEhD,UAAM,OAAO;AACb,SAAK,iBAAiB,QAAQ;EAC/B;EAEO,OAAO,KAAK,KAAY,KAAqB;AACnD,UAAM,kBAAkB,iBAAiB,GAAG;AAE5C,qCAAgB,IAAI,QAAQ,UAAU,CAAC;AACvC,UAAM,iBAAiB,IAAI,QAAQ,CAAC;AAGpC,2BACC,iBACA,IAAI,cACJ,cAAc;AAGf,WAAO,IAAI,sBAAoB;MAC9B,QAAQ,IAAI;MACZ;KACA;EACF;EAEO;EACC,qBACP,iBAAiC;AAIjC,QAAI,KAAK,kBAAkB,QAAW;AACrC,WAAK,iBAAiB,gBAAgB,mBACrC,KAAK,MAAgB;IAEvB;EACD;EAEO,UAAU,KAAsB;AACtC,UAAM,kBAAkB,iBAAiB,KAAK,KAAK,MAAM;AACzD,SAAK,qBAAqB,eAAe;AAEzC,SAAK,UAAU,mBAAM,KAAK,CAAC,KAAK,cAAc,CAAC;AAC/C,WAAO,MAAM,UAAU,GAAG;EAC3B;EAEO,WAAW,KAAgB;AACjC,WAAO;MACN,GAAG,MAAM,WAAW,GAAG;MACvB,SAAS;QACR,mBAAmB,KAAK,kBAAkB;;;EAG7C;;AA1DY,sBAAmB,wBAAA,WAAA;MAF/B,yCAAU,8BAAiB,QAAQ;MACnC,kDAAmB,sBAAsB;GAC7B,mBAAmB;AAwEzB,IAAM,uBAAoB,yBAA1B,MAAMC,8BAA6B,YAAW;EACpD,YACC,SAAiD;AAEjD,UAAM,OAAO;AACb,SAAK,aAAa,QAAQ;AAC1B,SAAK,OAAO,QAAQ;AACpB,SAAK,YAAY,QAAQ,aAAa;AACtC,SAAK,sBAAsB,QAAQ;AACnC,SAAK,wBAAwB,QAAQ;AACrC,SAAK,gBAAgB,QAAQ;EAC9B;EAEO,OAAO,KACb,KACA,KAAqB;AAErB,qCAAgB,IAAI,QAAQ,UAAU,CAAC;AACvC,UAAM,aAAa,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI;AACvC,UAAM,OAAO,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI;AAGjC,UAAM,YAAY,IAAI,QAAQ,CAAC,IAAI;AAGnC,UAAM,0BAAoC,0BACzC,IAAI,QAAQ,SAAS,GAAG,CAAC,GACzB,CAAC,EACA,OAAO,CAAC,MAAM,MAAM,CAAC;AACvB,UAAM,4BAAwC,0BAC7C,IAAI,QAAQ,SAAS,GAAG,CAAC,GACzB,2BAAa,UAAU;AAExB,UAAM,oBAAiC,0BACtC,IAAI,QAAQ,SAAS,GAAG,CAAC,GACzB,0BAAc,kBAAkB;AAGjC,WAAO,IAAI,uBAAqB;MAC/B,QAAQ,IAAI;MACZ;MACA;MACA;MACA;MACA;MACA;KACA;EACF;EAEgB;EACA;EACA;EACA;EACA;EACA;EAET,UAAU,KAAsB;AACtC,SAAK,UAAU,mBAAM,OAAO;MAC3B,mBAAM,KAAK;QACV,KAAK,aACF,KAAK,aAAa,IAAO,MACzB,KAAK,OAAO,IAAM;OACrB;;UAED,2BAAc,KAAK,qBAAqB,GAAG,CAAC;UAC5C,2BACC,KAAK,uBACL,GACA,2BAAa,UAAU;UAExB,2BACC,KAAK,eACL,0BAAc,WACd,0BAAc,kBAAkB;KAEjC;AACD,WAAO,MAAM,UAAU,GAAG;EAC3B;EAEO,WAAW,KAAgB;AACjC,WAAO;MACN,GAAG,MAAM,WAAW,GAAG;MACvB,SAAS;QACR,MAAM,KAAK;QACX,qBAAqB,KAAK,oBACxB,IAAI,CAAC,MAAM;WAAO,gCAAkB,0BAAY,CAAC,CAAC,EAAE,EACpD,KAAK,EAAE;QACT,2BAA2B,KAAK,sBAC9B,IAAI,CAAC,MAAM;WAAO,gCAAkB,4BAAc,CAAC,CAAC,EAAE,EACtD,KAAK,EAAE;QACT,iBAAiB,KAAK;QACtB,8BAA8B,KAAK,cACjC,IAAI,CAAC,MAAM;WAAO,gCAAkB,2BAAe,CAAC,CAAC,EAAE,EACvD,KAAK,EAAE;;;EAGZ;;AAhGY,uBAAoB,yBAAA,WAAA;MADhC,yCAAU,8BAAiB,SAAS;GACxB,oBAAoB;AAqG1B,IAAM,oBAAN,MAAMC,2BAA0B,YAAW;;AAArC,oBAAiB,WAAA;MAF7B,yCAAU,8BAAiB,MAAM;MACjC,kDAAmB,oBAAoB;GAC3B,iBAAiB;AAY9B,SAAS,6BAA6B,MAAuB;AAC5D,MAAI,KAAK,MAAM;AACd,WAAO,CAAC,sBAAsB,kBAAkB;EACjD,OAAO;AACN,WAAO;EACR;AACD;AAEA,SAAS,8BACR,MACA,UAAa;AAEb,MAAI,KAAK,MAAM;AACd,QAAI,oBAAoB,sBAAsB;AAC7C,aAAO,SAAS;IACjB,WAAW,oBAAoB,oBAAoB;AAClD,aAAO;IACR;EACD;AACA,SAAO;AACR;AAIO,IAAM,oBAAiB,sBAAvB,MAAMC,2BAA0B,YAAW;EACjD,YACC,SAA8C;AAE9C,UAAM,OAAO;AACb,SAAK,YAAY,QAAQ;AACzB,SAAK,OAAO,QAAQ;AACpB,SAAK,YAAY,QAAQ,aAAa;AACtC,SAAK,oBAAoB,QAAQ;AACjC,SAAK,sBAAsB,QAAQ;AACnC,SAAK,cAAc,QAAQ;EAC5B;EAEO,OAAO,KAAK,KAAY,KAAqB;AACnD,qCAAgB,IAAI,QAAQ,UAAU,CAAC;AACvC,UAAM,YAAY,IAAI,QAAQ,CAAC,IAAI;AACnC,UAAM,YAAY,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI;AACtC,UAAM,OAAO,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI;AAGjC,UAAM,yBAAqB,0BAC1B,IAAI,QAAQ,SAAS,GAAG,CAAC,GACzB,CAAC,EACA,OAAO,CAAC,MAAM,MAAM,CAAC;AACvB,qCAAgB,mBAAmB,WAAW,CAAC;AAC/C,UAAM,oBAAgC,mBAAmB,CAAC;AAC1D,UAAM,2BAAuB,0BAC5B,IAAI,QAAQ,SAAS,GAAG,CAAC,GACzB,2BAAa,UAAU;AAExB,qCAAgB,qBAAqB,WAAW,CAAC;AACjD,UAAM,sBAAoC,qBAAqB,CAAC;AAChE,UAAM,kBAA+B,0BACpC,IAAI,QAAQ,SAAS,GAAG,CAAC,GACzB,0BAAc,kBAAkB;AAGjC,WAAO,IAAI,oBAAkB;MAC5B,QAAQ,IAAI;MACZ;MACA;MACA;MACA;MACA;MACA;KACA;EACF;EAEgB;EACT;EACA;EACA;EACA;EACA;EAEA,UAAU,KAAsB;AACtC,SAAK,UAAU,mBAAM,OAAO;MAC3B,mBAAM,KAAK;QACV,KAAK,aACF,KAAK,YAAY,IAAO,MACxB,KAAK,OAAO,IAAM;OACrB;;UAED,2BAAc,CAAC,KAAK,iBAAiB,GAAG,GAAG,CAAC;UAC5C,2BACC,CAAC,KAAK,mBAAmB,GACzB,GACA,2BAAa,UAAU;UAExB,2BACC,KAAK,aACL,0BAAc,WACd,0BAAc,kBAAkB;KAEjC;AACD,WAAO,MAAM,UAAU,GAAG;EAC3B;EAEO,WAAW,KAAgB;AACjC,WAAO;MACN,GAAG,MAAM,WAAW,GAAG;MACvB,SAAS;QACR,MAAM,KAAK;QACX,uBAAmB,gCAClB,0BACA,KAAK,iBAAiB;QAEvB,6BAAyB,gCACxB,4BACA,KAAK,mBAAmB;QAEzB,iBAAiB,KAAK;QACtB,4BAA4B,KAAK,YAC/B,IAAI,CAAC,MAAM;WAAO,gCAAkB,2BAAe,CAAC,CAAC,EAAE,EACvD,KAAK,EAAE;;;EAGZ;;AAjGY,oBAAiB,sBAAA,WAAA;MAF7B,yCAAU,8BAAiB,MAAM;MACjC,kDAAmB,8BAA8B,6BAA6B;GAClE,iBAAiB;AA0GvB,IAAM,qBAAkB,uBAAxB,MAAMC,4BAA2B,YAAW;EAClD,YACC,SAA+C;AAE/C,UAAM,OAAO;AACb,SAAK,WAAW,QAAQ;EACzB;EAEO,OAAO,KAAK,KAAY,KAAqB;AACnD,qCAAgB,IAAI,QAAQ,UAAU,CAAC;AACvC,UAAM,WAAwB,IAAI,QAAQ,CAAC;AAE3C,WAAO,IAAI,qBAAmB;MAC7B,QAAQ,IAAI;MACZ;KACA;EACF;EAEO;EAEA,UAAU,KAAsB;AACtC,SAAK,UAAU,mBAAM,KAAK,CAAC,KAAK,QAAQ,CAAC;AACzC,WAAO,MAAM,UAAU,GAAG;EAC3B;EAEO,WAAW,KAAgB;AACjC,WAAO;MACN,GAAG,MAAM,WAAW,GAAG;MACvB,SAAS,EAAE,YAAQ,gCAAkB,2BAAa,KAAK,QAAQ,EAAC;;EAElE;;AA9BY,qBAAkB,uBAAA,WAAA;MAD9B,yCAAU,8BAAiB,OAAO;GACtB,kBAAkB;AAwCxB,IAAM,6BAA0B,+BAAhC,MAAMC,oCAAmC,YAAW;EAC1D,YACC,SAAuD;AAEvD,UAAM,OAAO;AACb,SAAK,gBAAgB,QAAQ;AAC7B,SAAK,YAAY,QAAQ;EAC1B;EAEO,OAAO,KACb,KACA,KAAqB;AAErB,qCAAgB,IAAI,QAAQ,UAAU,EAAE;AACxC,UAAM,gBAAgB,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI;AAC1C,UAAM,YAAwB,IAAI,QAAQ,SAAS,CAAC;AAEpD,WAAO,IAAI,6BAA2B;MACrC,QAAQ,IAAI;MACZ;MACA;KACA;EACF;EAEO;EACA;EAEA,UAAU,KAAsB;AACtC,SAAK,UAAU,mBAAM,OAAO;MAC3B,mBAAM,KAAK,CAAC,KAAK,gBAAgB,IAAI,CAAC,CAAC;MACvC,KAAK;KACL;AACD,WAAO,MAAM,UAAU,GAAG;EAC3B;EAEO,WAAW,KAAgB;AACjC,WAAO;MACN,GAAG,MAAM,WAAW,GAAG;MACvB,SAAS;QACR,qBAAqB,KAAK;QAC1B,kBAAc,yBAAW,KAAK,SAAS;;;EAG1C;;AA3CY,6BAA0B,+BAAA,WAAA;MADtC,yCAAU,8BAAiB,eAAe;GAC9B,0BAA0B;AAqDhC,IAAM,8BAA2B,gCAAjC,MAAMC,qCAAoC,YAAW;EAC3D,YACC,SAAwD;AAExD,UAAM,OAAO;AACb,SAAK,aAAa,QAAQ;AAC1B,SAAK,aAAa,QAAQ;EAC3B;EAEO,OAAO,KACb,KACA,KAAqB;AAErB,qCAAgB,IAAI,QAAQ,UAAU,EAAE;AACxC,UAAM,aAA4B,uBACjC,IAAI,SACJ,CAAC;AAEF,UAAM,aAAa,IAAI,QAAQ,SAAS,GAAG,EAAE;AAE7C,WAAO,IAAI,8BAA4B;MACtC,QAAQ,IAAI;MACZ;MACA;KACA;EACF;EAEO;EACA;EAEA,UAAU,KAAsB;AACtC,SAAK,UAAU,mBAAM,OAAO;MAC3B,uBAAuB,KAAK,UAAU;MACtC,KAAK;KACL;AACD,WAAO,MAAM,UAAU,GAAG;EAC3B;EAEO,WAAW,KAAgB;AACjC,WAAO;MACN,GAAG,MAAM,WAAW,GAAG;MACvB,SAAS;QACR,sBAAkB,gCACjB,2BACA,KAAK,UAAU;;;;;EAMnB;;AAlDY,8BAA2B,gCAAA,WAAA;MADvC,yCAAU,8BAAiB,gBAAgB;GAC/B,2BAA2B;AA6DjC,IAAM,2BAAwB,6BAA9B,MAAMC,kCAAiC,YAAW;EACxD,YACC,SAAqD;AAErD,UAAM,OAAO;AACb,SAAK,eAAe,QAAQ;EAC7B;EAEO,OAAO,KACb,KACA,KAAqB;AAErB,qCAAgB,IAAI,QAAQ,UAAU,CAAC;AACvC,UAAM,eAA8B,uBACnC,IAAI,SACJ,CAAC;AAGF,WAAO,IAAI,2BAAyB;MACnC,QAAQ,IAAI;MACZ;KACA;EACF;EAEO;EAEA,UAAU,KAAsB;AACtC,SAAK,UAAU,uBAAuB,KAAK,YAAY;AACvD,WAAO,MAAM,UAAU,GAAG;EAC3B;EAEO,WAAW,KAAgB;AACjC,WAAO;MACN,GAAG,MAAM,WAAW,GAAG;MACvB,SAAS;QACR,sBAAkB,gCACjB,2BACA,KAAK,YAAY;;;EAIrB;;AAzCY,2BAAwB,6BAAA,WAAA;MAHpC,yCAAU,8BAAiB,aAAa;;;GAG5B,wBAAwB;AA6C9B,IAAM,8BAAN,MAAMC,qCAAoC,YAAW;;AAA/C,8BAA2B,WAAA;MADvC,yCAAU,8BAAiB,gBAAgB;GAC/B,2BAA2B;AASjC,IAAM,yBAAsB,2BAA5B,MAAMC,gCAA+B,YAAW;EACtD,YACC,SAAmD;AAEnD,UAAM,OAAO;AACb,SAAK,cAAc,QAAQ;AAC3B,SAAK,qBAAqB,QAAQ;EACnC;EAEO,OAAO,KACb,KACA,KAAqB;AAErB,qCAAgB,IAAI,QAAQ,UAAU,CAAC;AACvC,UAAM,cAAc,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI;AACxC,UAAM,qBAAqB,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI;AAE/C,WAAO,IAAI,yBAAuB;MACjC,QAAQ,IAAI;MACZ;MACA;KACA;EACF;EAEO;EACA;EAEA,UAAU,KAAsB;AACtC,SAAK,UAAU,mBAAM,KAAK;OACxB,KAAK,cAAc,IAAO,MAAM,KAAK,qBAAqB,IAAM;KACjE;AACD,WAAO,MAAM,UAAU,GAAG;EAC3B;EAEO,WAAW,KAAgB;AACjC,WAAO;MACN,GAAG,MAAM,WAAW,GAAG;MACvB,SAAS;QACR,gBAAgB,KAAK;QACrB,oBAAoB,KAAK;;;EAG5B;;AA1CY,yBAAsB,2BAAA,WAAA;MADlC,yCAAU,8BAAiB,WAAW;GAC1B,sBAAsB;AAmD5B,IAAM,qCAAkC,uCAAxC,MAAMC,4CAA2C,YAAW;EAClE,YACC,SAA+D;AAE/D,UAAM,OAAO;AACb,SAAK,eAAe,QAAQ;EAC7B;EAEO,OAAO,KACb,KACA,KAAqB;AAErB,UAAM,UAAM,yBAAY,IAAI,OAAO;AAKnC,UAAM,eAAe,IAAI;AAEzB,WAAO,IAAI,qCAAmC;MAC7C,QAAQ,IAAI;MACZ;KACA;EACF;EAEgB;EAET,UAAU,KAAsB;AACtC,SAAK,cAAU,0BAAa,KAAK,cAAc,CAAA,CAAE;AACjD,WAAO,MAAM,UAAU,GAAG;EAC3B;EAEO,WAAW,KAAgB;AACjC,WAAO;MACN,GAAG,MAAM,WAAW,GAAG;MACvB,SAAS;QACR,iBAAiB,KAAK,aACpB,IAAI,CAAC,WAAO,uBAAU,EAAE,CAAC,EACzB,IAAI,CAAC,OAAO;OAAO,EAAE,EAAE,EACvB,KAAK,EAAE;;;EAGZ;;AA1CY,qCAAkC,uCAAA,WAAA;MAD9C,yCAAU,8BAAiB,uBAAuB;GACtC,kCAAkC;AA+CxC,IAAM,kCAAN,MAAMC,yCAAwC,YAAW;;AAAnD,kCAA+B,WAAA;MAF3C,yCAAU,8BAAiB,oBAAoB;MAC/C,kDAAmB,kCAAkC;GACzC,+BAA+B;",
+  "names": ["import_safe", "Security2CCAPI", "Security2CC", "secClass", "nodeId", "Security2CCMessageEncapsulation", "Security2CCNonceReport", "Security2CCNonceGet", "Security2CCKEXReport", "Security2CCKEXGet", "Security2CCKEXSet", "Security2CCKEXFail", "Security2CCPublicKeyReport", "Security2CCNetworkKeyReport", "Security2CCNetworkKeyGet", "Security2CCNetworkKeyVerify", "Security2CCTransferEnd", "Security2CCCommandsSupportedReport", "Security2CCCommandsSupportedGet"]
+}

package/build/cjs/cc/SecurityCC.d.ts

@@ -0,0 +1,128 @@
+import { CommandClasses, type MessageOrCCLogEntry, type SecurityManager, type WithAddress } from "@zwave-js/core";
+import { type MaybeNotKnown } from "@zwave-js/core/safe";
+import type { CCEncodingContext, CCParsingContext, GetValueDB } from "@zwave-js/host/safe";
+import { Bytes } from "@zwave-js/shared/safe";
+import { PhysicalCCAPI } from "../lib/API.js";
+import { type CCRaw, CommandClass, type InterviewContext } from "../lib/CommandClass.js";
+import { SecurityCommand } from "../lib/_Types.js";
+export declare class SecurityCCAPI extends PhysicalCCAPI {
+    supportsCommand(_cmd: SecurityCommand): MaybeNotKnown<boolean>;
+    sendEncapsulated(encapsulated: CommandClass, requestNextNonce?: boolean): Promise<void>;
+    /**
+     * Requests a new nonce for Security CC encapsulation which is not directly linked to a specific command.
+     */
+    getNonce(): Promise<Uint8Array | undefined>;
+    /**
+     * Responds to a NonceGet request. The message is sent without any retransmission etc.
+     * The return value indicates whether a nonce was successfully sent
+     */
+    sendNonce(): Promise<boolean>;
+    getSecurityScheme(): Promise<[0]>;
+    reportSecurityScheme(encapsulated: boolean): Promise<void>;
+    inheritSecurityScheme(): Promise<void>;
+    setNetworkKey(networkKey: Uint8Array): Promise<void>;
+    verifyNetworkKey(): Promise<void>;
+    getSupportedCommands(): Promise<Pick<SecurityCCCommandsSupportedReport, "supportedCCs" | "controlledCCs"> | undefined>;
+    reportSupportedCommands(supportedCCs: CommandClasses[], controlledCCs: CommandClasses[]): Promise<void>;
+}
+export declare class SecurityCC extends CommandClass {
+    ccCommand: SecurityCommand;
+    nodeId: number;
+    interview(ctx: InterviewContext): Promise<void>;
+    /** Tests if a command should be sent secure and thus requires encapsulation */
+    static requiresEncapsulation(cc: CommandClass): boolean;
+    /** Encapsulates a command that should be sent encrypted */
+    static encapsulate(ownNodeId: number, securityManager: SecurityManager, cc: CommandClass): SecurityCCCommandEncapsulation;
+}
+interface SecurityCCNonceReportOptions {
+    nonce: Uint8Array;
+}
+export declare class SecurityCCNonceReport extends SecurityCC {
+    constructor(options: WithAddress<SecurityCCNonceReportOptions>);
+    static from(raw: CCRaw, ctx: CCParsingContext): SecurityCCNonceReport;
+    nonce: Uint8Array;
+    serialize(ctx: CCEncodingContext): Bytes;
+    toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry;
+}
+export declare class SecurityCCNonceGet extends SecurityCC {
+}
+export type SecurityCCCommandEncapsulationOptions = {
+    alternativeNetworkKey?: Uint8Array;
+} & ({
+    encapsulated: CommandClass;
+} | {
+    decryptedCCBytes: Uint8Array;
+    sequenced: boolean;
+    secondFrame: boolean;
+    sequenceCounter: number;
+});
+export declare class SecurityCCCommandEncapsulation extends SecurityCC {
+    constructor(options: WithAddress<SecurityCCCommandEncapsulationOptions>);
+    static from(raw: CCRaw, ctx: CCParsingContext): SecurityCCCommandEncapsulation;
+    private sequenced;
+    private secondFrame;
+    private sequenceCounter;
+    private decryptedCCBytes;
+    encapsulated: CommandClass;
+    private alternativeNetworkKey?;
+    get nonceId(): number | undefined;
+    nonce: Uint8Array | undefined;
+    private iv?;
+    private authData?;
+    private authCode?;
+    private ciphertext?;
+    getPartialCCSessionId(): Record<string, any> | undefined;
+    expectMoreMessages(): boolean;
+    mergePartialCCs(partials: SecurityCCCommandEncapsulation[], ctx: CCParsingContext): void;
+    serialize(ctx: CCEncodingContext): Bytes;
+    protected computeEncapsulationOverhead(): number;
+    toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry;
+}
+export declare class SecurityCCCommandEncapsulationNonceGet extends SecurityCCCommandEncapsulation {
+}
+export declare class SecurityCCSchemeReport extends SecurityCC {
+    static from(raw: CCRaw, ctx: CCParsingContext): SecurityCCSchemeReport;
+    serialize(ctx: CCEncodingContext): Bytes;
+    toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry;
+}
+export declare class SecurityCCSchemeGet extends SecurityCC {
+    serialize(ctx: CCEncodingContext): Bytes;
+    toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry;
+}
+export declare class SecurityCCSchemeInherit extends SecurityCC {
+    serialize(ctx: CCEncodingContext): Bytes;
+    toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry;
+}
+export declare class SecurityCCNetworkKeyVerify extends SecurityCC {
+}
+export interface SecurityCCNetworkKeySetOptions {
+    networkKey: Uint8Array;
+}
+export declare class SecurityCCNetworkKeySet extends SecurityCC {
+    constructor(options: WithAddress<SecurityCCNetworkKeySetOptions>);
+    static from(raw: CCRaw, ctx: CCParsingContext): SecurityCCNetworkKeySet;
+    networkKey: Uint8Array;
+    serialize(ctx: CCEncodingContext): Bytes;
+    toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry;
+}
+export interface SecurityCCCommandsSupportedReportOptions {
+    reportsToFollow?: number;
+    supportedCCs: CommandClasses[];
+    controlledCCs: CommandClasses[];
+}
+export declare class SecurityCCCommandsSupportedReport extends SecurityCC {
+    constructor(options: WithAddress<SecurityCCCommandsSupportedReportOptions>);
+    static from(raw: CCRaw, ctx: CCParsingContext): SecurityCCCommandsSupportedReport;
+    reportsToFollow: number;
+    supportedCCs: CommandClasses[];
+    controlledCCs: CommandClasses[];
+    getPartialCCSessionId(): Record<string, any> | undefined;
+    expectMoreMessages(): boolean;
+    mergePartialCCs(partials: SecurityCCCommandsSupportedReport[]): void;
+    serialize(ctx: CCEncodingContext): Bytes;
+    toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry;
+}
+export declare class SecurityCCCommandsSupportedGet extends SecurityCC {
+}
+export {};
+//# sourceMappingURL=SecurityCC.d.ts.map