@zwave-js/cc 14.0.0-beta.4 → 14.0.0-beta.5

package/build/esm/cc/Security2CC.js

@@ -1,10 +1,37 @@
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
+var __esDecorate = (this && this.__esDecorate) || function (ctor, descriptorIn, decorators, contextIn, initializers, extraInitializers) {
+    function accept(f) { if (f !== void 0 && typeof f !== "function") throw new TypeError("Function expected"); return f; }
+    var kind = contextIn.kind, key = kind === "getter" ? "get" : kind === "setter" ? "set" : "value";
+    var target = !descriptorIn && ctor ? contextIn["static"] ? ctor : ctor.prototype : null;
+    var descriptor = descriptorIn || (target ? Object.getOwnPropertyDescriptor(target, contextIn.name) : {});
+    var _, done = false;
+    for (var i = decorators.length - 1; i >= 0; i--) {
+        var context = {};
+        for (var p in contextIn) context[p] = p === "access" ? {} : contextIn[p];
+        for (var p in contextIn.access) context.access[p] = contextIn.access[p];
+        context.addInitializer = function (f) { if (done) throw new TypeError("Cannot add initializers after decoration has completed"); extraInitializers.push(accept(f || null)); };
+        var result = (0, decorators[i])(kind === "accessor" ? { get: descriptor.get, set: descriptor.set } : descriptor[key], context);
+        if (kind === "accessor") {
+            if (result === void 0) continue;
+            if (result === null || typeof result !== "object") throw new TypeError("Object expected");
+            if (_ = accept(result.get)) descriptor.get = _;
+            if (_ = accept(result.set)) descriptor.set = _;
+            if (_ = accept(result.init)) initializers.unshift(_);
+        }
+        else if (_ = accept(result)) {
+            if (kind === "field") initializers.unshift(_);
+            else descriptor[key] = _;
+        }
+    }
+    if (target) Object.defineProperty(target, contextIn.name, descriptor);
+    done = true;
+};
+var __runInitializers = (this && this.__runInitializers) || function (thisArg, initializers, value) {
+    var useValue = arguments.length > 2;
+    for (var i = 0; i < initializers.length; i++) {
+        value = useValue ? initializers[i].call(thisArg, value) : initializers[i].call(thisArg);
+    }
+    return useValue ? value : void 0;
 };
-var Security2CC_1, Security2CCMessageEncapsulation_1, Security2CCNonceReport_1, Security2CCNonceGet_1, Security2CCKEXReport_1, Security2CCKEXSet_1, Security2CCKEXFail_1, Security2CCPublicKeyReport_1, Security2CCNetworkKeyReport_1, Security2CCNetworkKeyGet_1, Security2CCTransferEnd_1, Security2CCCommandsSupportedReport_1;
 import { CommandClasses, MPANState, MessagePriority, SECURITY_S2_AUTH_TAG_LENGTH, SPANState, SecurityClass, TransmitOptions, ZWaveError, ZWaveErrorCodes, decryptAES128CCM, encodeBitMask, encryptAES128CCM, getCCName, highResTimestamp, isLongRangeNodeId, isTransmissionError, isZWaveError, parseBitMask, parseCCList, securityClassIsS2, securityClassOrder, validatePayload, } from "@zwave-js/core";
 import { EncapsulationFlags, NODE_ID_BROADCAST, NODE_ID_BROADCAST_LR, encodeCCList, } from "@zwave-js/core/safe";
 import { Bytes } from "@zwave-js/shared/safe";
@@ -245,563 +272,588 @@ function getSenderEI(extensions) {
 // Encapsulation CCs are used internally and too frequently that we
 // want to pay the cost of validating each call
 /* eslint-disable @zwave-js/ccapi-validate-args */
-let Security2CCAPI = class Security2CCAPI extends CCAPI {
-    supportsCommand(_cmd) {
-        // All commands are mandatory
-        return true;
-    }
-    /**
-     * Sends a nonce to the node, either in response to a NonceGet request or a message that failed to decrypt. The message is sent without any retransmission etc.
-     * The return value indicates whether a nonce was successfully sent
-     */
-    async sendNonce() {
-        this.assertSupportsCommand(Security2Command, Security2Command.NonceReport);
-        this.assertPhysicalEndpoint(this.endpoint);
-        const securityManager = getSecurityManager(this.host.ownNodeId, this.host, this.endpoint.nodeId);
-        if (!securityManager) {
-            throw new ZWaveError(`Nonces can only be sent if secure communication is set up!`, ZWaveErrorCodes.Driver_NoSecurity);
-        }
-        const receiverEI = securityManager.generateNonce(this.endpoint.nodeId);
-        const cc = new Security2CCNonceReport({
-            nodeId: this.endpoint.nodeId,
-            endpointIndex: this.endpoint.index,
-            SOS: true,
-            MOS: false,
-            receiverEI,
-        });
-        try {
-            await this.host.sendCommand(cc, {
-                ...this.commandOptions,
-                // Seems we need these options or some nodes won't accept the nonce
-                transmitOptions: TransmitOptions.ACK
-                    | TransmitOptions.AutoRoute,
-                // Only try sending a nonce once
-                maxSendAttempts: 1,
-                // Nonce requests must be handled immediately
-                priority: MessagePriority.Immediate,
-                // We don't want failures causing us to treat the node as asleep or dead
-                changeNodeStatusOnMissingACK: false,
-                // And we need to react to
-            });
+let Security2CCAPI = (() => {
+    let _classDecorators = [API(CommandClasses["Security 2"])];
+    let _classDescriptor;
+    let _classExtraInitializers = [];
+    let _classThis;
+    let _classSuper = CCAPI;
+    var Security2CCAPI = class extends _classSuper {
+        static { _classThis = this; }
+        static {
+            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
+            __esDecorate(null, _classDescriptor = { value: _classThis }, _classDecorators, { kind: "class", name: _classThis.name, metadata: _metadata }, null, _classExtraInitializers);
+            Security2CCAPI = _classThis = _classDescriptor.value;
+            if (_metadata) Object.defineProperty(_classThis, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+            __runInitializers(_classThis, _classExtraInitializers);
         }
-        catch (e) {
-            if (isTransmissionError(e)) {
-                // The nonce could not be sent, invalidate it
-                securityManager.deleteNonce(this.endpoint.nodeId);
-                return false;
+        supportsCommand(_cmd) {
+            // All commands are mandatory
+            return true;
+        }
+        /**
+         * Sends a nonce to the node, either in response to a NonceGet request or a message that failed to decrypt. The message is sent without any retransmission etc.
+         * The return value indicates whether a nonce was successfully sent
+         */
+        async sendNonce() {
+            this.assertSupportsCommand(Security2Command, Security2Command.NonceReport);
+            this.assertPhysicalEndpoint(this.endpoint);
+            const securityManager = getSecurityManager(this.host.ownNodeId, this.host, this.endpoint.nodeId);
+            if (!securityManager) {
+                throw new ZWaveError(`Nonces can only be sent if secure communication is set up!`, ZWaveErrorCodes.Driver_NoSecurity);
             }
-            else {
-                // Pass other errors through
-                throw e;
+            const receiverEI = securityManager.generateNonce(this.endpoint.nodeId);
+            const cc = new Security2CCNonceReport({
+                nodeId: this.endpoint.nodeId,
+                endpointIndex: this.endpoint.index,
+                SOS: true,
+                MOS: false,
+                receiverEI,
+            });
+            try {
+                await this.host.sendCommand(cc, {
+                    ...this.commandOptions,
+                    // Seems we need these options or some nodes won't accept the nonce
+                    transmitOptions: TransmitOptions.ACK
+                        | TransmitOptions.AutoRoute,
+                    // Only try sending a nonce once
+                    maxSendAttempts: 1,
+                    // Nonce requests must be handled immediately
+                    priority: MessagePriority.Immediate,
+                    // We don't want failures causing us to treat the node as asleep or dead
+                    changeNodeStatusOnMissingACK: false,
+                    // And we need to react to
+                });
             }
+            catch (e) {
+                if (isTransmissionError(e)) {
+                    // The nonce could not be sent, invalidate it
+                    securityManager.deleteNonce(this.endpoint.nodeId);
+                    return false;
+                }
+                else {
+                    // Pass other errors through
+                    throw e;
+                }
+            }
+            return true;
         }
-        return true;
-    }
-    /** Notifies the target node that the MPAN state is out of sync */
-    async sendMOS() {
-        this.assertSupportsCommand(Security2Command, Security2Command.NonceReport);
-        this.assertPhysicalEndpoint(this.endpoint);
-        const cc = new Security2CCNonceReport({
-            nodeId: this.endpoint.nodeId,
-            endpointIndex: this.endpoint.index,
-            SOS: false,
-            MOS: true,
-        });
-        try {
-            await this.host.sendCommand(cc, {
-                ...this.commandOptions,
-                // Seems we need these options or some nodes won't accept the nonce
-                transmitOptions: TransmitOptions.ACK
-                    | TransmitOptions.AutoRoute,
-                // Only try sending a nonce once
-                maxSendAttempts: 1,
-                // Nonce requests must be handled immediately
-                priority: MessagePriority.Immediate,
-                // We don't want failures causing us to treat the node as asleep or dead
-                changeNodeStatusOnMissingACK: false,
+        /** Notifies the target node that the MPAN state is out of sync */
+        async sendMOS() {
+            this.assertSupportsCommand(Security2Command, Security2Command.NonceReport);
+            this.assertPhysicalEndpoint(this.endpoint);
+            const cc = new Security2CCNonceReport({
+                nodeId: this.endpoint.nodeId,
+                endpointIndex: this.endpoint.index,
+                SOS: false,
+                MOS: true,
             });
+            try {
+                await this.host.sendCommand(cc, {
+                    ...this.commandOptions,
+                    // Seems we need these options or some nodes won't accept the nonce
+                    transmitOptions: TransmitOptions.ACK
+                        | TransmitOptions.AutoRoute,
+                    // Only try sending a nonce once
+                    maxSendAttempts: 1,
+                    // Nonce requests must be handled immediately
+                    priority: MessagePriority.Immediate,
+                    // We don't want failures causing us to treat the node as asleep or dead
+                    changeNodeStatusOnMissingACK: false,
+                });
+            }
+            catch (e) {
+                if (isTransmissionError(e)) {
+                    return false;
+                }
+                else {
+                    // Pass other errors through
+                    throw e;
+                }
+            }
+            return true;
         }
-        catch (e) {
-            if (isTransmissionError(e)) {
-                return false;
+        /** Sends the given MPAN to the node */
+        async sendMPAN(groupId, innerMPANState) {
+            this.assertSupportsCommand(Security2Command, Security2Command.MessageEncapsulation);
+            this.assertPhysicalEndpoint(this.endpoint);
+            const cc = new Security2CCMessageEncapsulation({
+                nodeId: this.endpoint.nodeId,
+                endpointIndex: this.endpoint.index,
+                extensions: [
+                    new MPANExtension({
+                        groupId,
+                        innerMPANState,
+                    }),
+                ],
+            });
+            try {
+                await this.host.sendCommand(cc, {
+                    ...this.commandOptions,
+                    // Seems we need these options or some nodes won't accept the nonce
+                    transmitOptions: TransmitOptions.ACK
+                        | TransmitOptions.AutoRoute,
+                    // Only try sending a nonce once
+                    maxSendAttempts: 1,
+                    // Nonce requests must be handled immediately
+                    priority: MessagePriority.Immediate,
+                    // We don't want failures causing us to treat the node as asleep or dead
+                    changeNodeStatusOnMissingACK: false,
+                });
             }
-            else {
-                // Pass other errors through
-                throw e;
+            catch (e) {
+                if (isTransmissionError(e)) {
+                    return false;
+                }
+                else {
+                    // Pass other errors through
+                    throw e;
+                }
             }
+            return true;
         }
-        return true;
-    }
-    /** Sends the given MPAN to the node */
-    async sendMPAN(groupId, innerMPANState) {
-        this.assertSupportsCommand(Security2Command, Security2Command.MessageEncapsulation);
-        this.assertPhysicalEndpoint(this.endpoint);
-        const cc = new Security2CCMessageEncapsulation({
-            nodeId: this.endpoint.nodeId,
-            endpointIndex: this.endpoint.index,
-            extensions: [
-                new MPANExtension({
-                    groupId,
-                    innerMPANState,
-                }),
-            ],
-        });
-        try {
-            await this.host.sendCommand(cc, {
+        /**
+         * Queries the securely supported commands for the current security class
+         * @param securityClass Can be used to overwrite the security class to use. If this doesn't match the current one, new nonces will need to be exchanged.
+         */
+        async getSupportedCommands(securityClass) {
+            this.assertSupportsCommand(Security2Command, Security2Command.CommandsSupportedGet);
+            let cc = new Security2CCCommandsSupportedGet({
+                nodeId: this.endpoint.nodeId,
+                endpointIndex: this.endpoint.index,
+            });
+            // Security2CCCommandsSupportedGet is special because we cannot reply on the applHost to do the automatic
+            // encapsulation because it would use a different security class. Therefore the entire possible stack
+            // of encapsulation needs to be done here
+            if (MultiChannelCC.requiresEncapsulation(cc)) {
+                const multiChannelCCVersion = this.host.getSupportedCCVersion(CommandClasses["Multi Channel"], this.endpoint.nodeId);
+                cc = multiChannelCCVersion === 1
+                    ? MultiChannelCC.encapsulateV1(cc)
+                    : MultiChannelCC.encapsulate(cc);
+            }
+            cc = Security2CC.encapsulate(cc, this.host.ownNodeId, this.host, { securityClass });
+            const response = await this.host.sendCommand(cc, {
                 ...this.commandOptions,
-                // Seems we need these options or some nodes won't accept the nonce
-                transmitOptions: TransmitOptions.ACK
-                    | TransmitOptions.AutoRoute,
-                // Only try sending a nonce once
-                maxSendAttempts: 1,
-                // Nonce requests must be handled immediately
-                priority: MessagePriority.Immediate,
-                // We don't want failures causing us to treat the node as asleep or dead
-                changeNodeStatusOnMissingACK: false,
+                autoEncapsulate: false,
             });
+            return response?.supportedCCs;
         }
-        catch (e) {
-            if (isTransmissionError(e)) {
-                return false;
-            }
-            else {
-                // Pass other errors through
-                throw e;
+        async reportSupportedCommands(supportedCCs) {
+            this.assertSupportsCommand(Security2Command, Security2Command.CommandsSupportedReport);
+            const cc = new Security2CCCommandsSupportedReport({
+                nodeId: this.endpoint.nodeId,
+                endpointIndex: this.endpoint.index,
+                supportedCCs,
+            });
+            await this.host.sendCommand(cc, this.commandOptions);
+        }
+        // eslint-disable-next-line @typescript-eslint/explicit-module-boundary-types
+        async getKeyExchangeParameters() {
+            this.assertSupportsCommand(Security2Command, Security2Command.KEXGet);
+            const cc = new Security2CCKEXGet({
+                nodeId: this.endpoint.nodeId,
+                endpointIndex: this.endpoint.index,
+            });
+            const response = await this.host.sendCommand(cc, this.commandOptions);
+            if (response) {
+                return pick(response, [
+                    "requestCSA",
+                    "echo",
+                    "supportedKEXSchemes",
+                    "supportedECDHProfiles",
+                    "requestedKeys",
+                    "_reserved",
+                ]);
             }
         }
-        return true;
-    }
-    /**
-     * Queries the securely supported commands for the current security class
-     * @param securityClass Can be used to overwrite the security class to use. If this doesn't match the current one, new nonces will need to be exchanged.
-     */
-    async getSupportedCommands(securityClass) {
-        this.assertSupportsCommand(Security2Command, Security2Command.CommandsSupportedGet);
-        let cc = new Security2CCCommandsSupportedGet({
-            nodeId: this.endpoint.nodeId,
-            endpointIndex: this.endpoint.index,
-        });
-        // Security2CCCommandsSupportedGet is special because we cannot reply on the applHost to do the automatic
-        // encapsulation because it would use a different security class. Therefore the entire possible stack
-        // of encapsulation needs to be done here
-        if (MultiChannelCC.requiresEncapsulation(cc)) {
-            const multiChannelCCVersion = this.host.getSupportedCCVersion(CommandClasses["Multi Channel"], this.endpoint.nodeId);
-            cc = multiChannelCCVersion === 1
-                ? MultiChannelCC.encapsulateV1(cc)
-                : MultiChannelCC.encapsulate(cc);
-        }
-        cc = Security2CC.encapsulate(cc, this.host.ownNodeId, this.host, { securityClass });
-        const response = await this.host.sendCommand(cc, {
-            ...this.commandOptions,
-            autoEncapsulate: false,
-        });
-        return response?.supportedCCs;
-    }
-    async reportSupportedCommands(supportedCCs) {
-        this.assertSupportsCommand(Security2Command, Security2Command.CommandsSupportedReport);
-        const cc = new Security2CCCommandsSupportedReport({
-            nodeId: this.endpoint.nodeId,
-            endpointIndex: this.endpoint.index,
-            supportedCCs,
-        });
-        await this.host.sendCommand(cc, this.commandOptions);
-    }
-    // eslint-disable-next-line @typescript-eslint/explicit-module-boundary-types
-    async getKeyExchangeParameters() {
-        this.assertSupportsCommand(Security2Command, Security2Command.KEXGet);
-        const cc = new Security2CCKEXGet({
-            nodeId: this.endpoint.nodeId,
-            endpointIndex: this.endpoint.index,
-        });
-        const response = await this.host.sendCommand(cc, this.commandOptions);
-        if (response) {
-            return pick(response, [
-                "requestCSA",
-                "echo",
-                "supportedKEXSchemes",
-                "supportedECDHProfiles",
-                "requestedKeys",
-                "_reserved",
-            ]);
+        /** Requests the given keys from an including node */
+        async requestKeys(params) {
+            this.assertSupportsCommand(Security2Command, Security2Command.KEXReport);
+            const cc = new Security2CCKEXReport({
+                nodeId: this.endpoint.nodeId,
+                endpointIndex: this.endpoint.index,
+                ...params,
+                echo: false,
+            });
+            await this.host.sendCommand(cc, this.commandOptions);
         }
-    }
-    /** Requests the given keys from an including node */
-    async requestKeys(params) {
-        this.assertSupportsCommand(Security2Command, Security2Command.KEXReport);
-        const cc = new Security2CCKEXReport({
-            nodeId: this.endpoint.nodeId,
-            endpointIndex: this.endpoint.index,
-            ...params,
-            echo: false,
-        });
-        await this.host.sendCommand(cc, this.commandOptions);
-    }
-    /** Grants the joining node the given keys */
-    async grantKeys(params) {
-        this.assertSupportsCommand(Security2Command, Security2Command.KEXSet);
-        const cc = new Security2CCKEXSet({
-            nodeId: this.endpoint.nodeId,
-            endpointIndex: this.endpoint.index,
-            ...params,
-            echo: false,
-        });
-        await this.host.sendCommand(cc, this.commandOptions);
-    }
-    /** Confirms the keys that were requested by a node */
-    async confirmRequestedKeys(params) {
-        this.assertSupportsCommand(Security2Command, Security2Command.KEXReport);
-        const cc = new Security2CCKEXReport({
-            nodeId: this.endpoint.nodeId,
-            endpointIndex: this.endpoint.index,
-            ...params,
-            echo: true,
-        });
-        await this.host.sendCommand(cc, this.commandOptions);
-    }
-    /** Confirms the keys that were granted by the including node */
-    async confirmGrantedKeys(params) {
-        this.assertSupportsCommand(Security2Command, Security2Command.KEXSet);
-        const cc = new Security2CCKEXSet({
-            nodeId: this.endpoint.nodeId,
-            endpointIndex: this.endpoint.index,
-            ...params,
-            echo: true,
-        });
-        return this.host.sendCommand(cc, this.commandOptions);
-    }
-    /** Notifies the other node that the ongoing key exchange was aborted */
-    async abortKeyExchange(failType) {
-        this.assertSupportsCommand(Security2Command, Security2Command.KEXFail);
-        const cc = new Security2CCKEXFail({
-            nodeId: this.endpoint.nodeId,
-            endpointIndex: this.endpoint.index,
-            failType,
-        });
-        await this.host.sendCommand(cc, this.commandOptions);
-    }
-    async sendPublicKey(publicKey, includingNode = true) {
-        this.assertSupportsCommand(Security2Command, Security2Command.PublicKeyReport);
-        const cc = new Security2CCPublicKeyReport({
-            nodeId: this.endpoint.nodeId,
-            endpointIndex: this.endpoint.index,
-            includingNode,
-            publicKey,
-        });
-        await this.host.sendCommand(cc, this.commandOptions);
-    }
-    async requestNetworkKey(securityClass) {
-        this.assertSupportsCommand(Security2Command, Security2Command.NetworkKeyGet);
-        const cc = new Security2CCNetworkKeyGet({
-            nodeId: this.endpoint.nodeId,
-            endpointIndex: this.endpoint.index,
-            requestedKey: securityClass,
-        });
-        await this.host.sendCommand(cc, this.commandOptions);
-    }
-    async sendNetworkKey(securityClass, networkKey) {
-        this.assertSupportsCommand(Security2Command, Security2Command.NetworkKeyReport);
-        const cc = new Security2CCNetworkKeyReport({
-            nodeId: this.endpoint.nodeId,
-            endpointIndex: this.endpoint.index,
-            grantedKey: securityClass,
-            networkKey,
-        });
-        await this.host.sendCommand(cc, this.commandOptions);
-    }
-    async verifyNetworkKey() {
-        this.assertSupportsCommand(Security2Command, Security2Command.NetworkKeyVerify);
-        const cc = new Security2CCNetworkKeyVerify({
-            nodeId: this.endpoint.nodeId,
-            endpointIndex: this.endpoint.index,
-        });
-        await this.host.sendCommand(cc, this.commandOptions);
-    }
-    async confirmKeyVerification() {
-        this.assertSupportsCommand(Security2Command, Security2Command.TransferEnd);
-        const cc = new Security2CCTransferEnd({
-            nodeId: this.endpoint.nodeId,
-            endpointIndex: this.endpoint.index,
-            keyVerified: true,
-            keyRequestComplete: false,
-        });
-        await this.host.sendCommand(cc, {
-            ...this.commandOptions,
-            // Don't wait for an ACK from the node
-            transmitOptions: TransmitOptions.DEFAULT & ~TransmitOptions.ACK,
-        });
-    }
-    async endKeyExchange() {
-        this.assertSupportsCommand(Security2Command, Security2Command.TransferEnd);
-        const cc = new Security2CCTransferEnd({
-            nodeId: this.endpoint.nodeId,
-            endpointIndex: this.endpoint.index,
-            keyVerified: false,
-            keyRequestComplete: true,
-        });
-        await this.host.sendCommand(cc, this.commandOptions);
-    }
-};
-Security2CCAPI = __decorate([
-    API(CommandClasses["Security 2"])
-], Security2CCAPI);
-export { Security2CCAPI };
-let Security2CC = Security2CC_1 = class Security2CC extends CommandClass {
-    async interview(ctx) {
-        const securityManager = getSecurityManager(ctx.ownNodeId, ctx, this.nodeId);
-        const node = this.getNode(ctx);
-        const endpoint = this.getEndpoint(ctx);
-        const api = CCAPI.create(CommandClasses["Security 2"], ctx, endpoint).withOptions({
-            priority: MessagePriority.NodeQuery,
-        });
-        // Only on the highest security class the response includes the supported commands
-        const secClass = node.getHighestSecurityClass();
-        let hasReceivedSecureCommands = false;
-        let possibleSecurityClasses;
-        if (securityClassIsS2(secClass)) {
-            // The highest security class is known to be S2, only query that one
-            possibleSecurityClasses = [secClass];
-        }
-        else if (endpoint.index === 0) {
-            // If the highest security class isn't known, query all possible security classes
-            // but only on the root device
-            possibleSecurityClasses = [
-                SecurityClass.S2_Unauthenticated,
-                SecurityClass.S2_Authenticated,
-                SecurityClass.S2_AccessControl,
-            ];
+        /** Grants the joining node the given keys */
+        async grantKeys(params) {
+            this.assertSupportsCommand(Security2Command, Security2Command.KEXSet);
+            const cc = new Security2CCKEXSet({
+                nodeId: this.endpoint.nodeId,
+                endpointIndex: this.endpoint.index,
+                ...params,
+                echo: false,
+            });
+            await this.host.sendCommand(cc, this.commandOptions);
         }
-        else {
-            // For endpoint interviews, the security class MUST be known
-            ctx.logNode(node.id, {
-                endpoint: endpoint.index,
-                message: `Cannot query securely supported commands for endpoint because the node's security class isn't known...`,
-                level: "error",
+        /** Confirms the keys that were requested by a node */
+        async confirmRequestedKeys(params) {
+            this.assertSupportsCommand(Security2Command, Security2Command.KEXReport);
+            const cc = new Security2CCKEXReport({
+                nodeId: this.endpoint.nodeId,
+                endpointIndex: this.endpoint.index,
+                ...params,
+                echo: true,
             });
-            return;
+            await this.host.sendCommand(cc, this.commandOptions);
         }
-        for (const secClass of possibleSecurityClasses) {
-            // We might not know all assigned security classes yet, so we work our way up from low to high and try to request the supported commands.
-            // This way, each command is encrypted with the security class we're currently testing.
-            // If the node does not respond, it wasn't assigned the security class.
-            // If it responds with a non-empty list, we know this is the highest class it supports.
-            // If the list is empty, the security class is still supported.
-            // If we already know the class is not supported, skip it
-            if (node.hasSecurityClass(secClass) === false)
-                continue;
-            // If no key is configured for this security class, skip it
-            if (!securityManager?.hasKeysForSecurityClass(secClass)) {
+        /** Confirms the keys that were granted by the including node */
+        async confirmGrantedKeys(params) {
+            this.assertSupportsCommand(Security2Command, Security2Command.KEXSet);
+            const cc = new Security2CCKEXSet({
+                nodeId: this.endpoint.nodeId,
+                endpointIndex: this.endpoint.index,
+                ...params,
+                echo: true,
+            });
+            return this.host.sendCommand(cc, this.commandOptions);
+        }
+        /** Notifies the other node that the ongoing key exchange was aborted */
+        async abortKeyExchange(failType) {
+            this.assertSupportsCommand(Security2Command, Security2Command.KEXFail);
+            const cc = new Security2CCKEXFail({
+                nodeId: this.endpoint.nodeId,
+                endpointIndex: this.endpoint.index,
+                failType,
+            });
+            await this.host.sendCommand(cc, this.commandOptions);
+        }
+        async sendPublicKey(publicKey, includingNode = true) {
+            this.assertSupportsCommand(Security2Command, Security2Command.PublicKeyReport);
+            const cc = new Security2CCPublicKeyReport({
+                nodeId: this.endpoint.nodeId,
+                endpointIndex: this.endpoint.index,
+                includingNode,
+                publicKey,
+            });
+            await this.host.sendCommand(cc, this.commandOptions);
+        }
+        async requestNetworkKey(securityClass) {
+            this.assertSupportsCommand(Security2Command, Security2Command.NetworkKeyGet);
+            const cc = new Security2CCNetworkKeyGet({
+                nodeId: this.endpoint.nodeId,
+                endpointIndex: this.endpoint.index,
+                requestedKey: securityClass,
+            });
+            await this.host.sendCommand(cc, this.commandOptions);
+        }
+        async sendNetworkKey(securityClass, networkKey) {
+            this.assertSupportsCommand(Security2Command, Security2Command.NetworkKeyReport);
+            const cc = new Security2CCNetworkKeyReport({
+                nodeId: this.endpoint.nodeId,
+                endpointIndex: this.endpoint.index,
+                grantedKey: securityClass,
+                networkKey,
+            });
+            await this.host.sendCommand(cc, this.commandOptions);
+        }
+        async verifyNetworkKey() {
+            this.assertSupportsCommand(Security2Command, Security2Command.NetworkKeyVerify);
+            const cc = new Security2CCNetworkKeyVerify({
+                nodeId: this.endpoint.nodeId,
+                endpointIndex: this.endpoint.index,
+            });
+            await this.host.sendCommand(cc, this.commandOptions);
+        }
+        async confirmKeyVerification() {
+            this.assertSupportsCommand(Security2Command, Security2Command.TransferEnd);
+            const cc = new Security2CCTransferEnd({
+                nodeId: this.endpoint.nodeId,
+                endpointIndex: this.endpoint.index,
+                keyVerified: true,
+                keyRequestComplete: false,
+            });
+            await this.host.sendCommand(cc, {
+                ...this.commandOptions,
+                // Don't wait for an ACK from the node
+                transmitOptions: TransmitOptions.DEFAULT & ~TransmitOptions.ACK,
+            });
+        }
+        async endKeyExchange() {
+            this.assertSupportsCommand(Security2Command, Security2Command.TransferEnd);
+            const cc = new Security2CCTransferEnd({
+                nodeId: this.endpoint.nodeId,
+                endpointIndex: this.endpoint.index,
+                keyVerified: false,
+                keyRequestComplete: true,
+            });
+            await this.host.sendCommand(cc, this.commandOptions);
+        }
+    };
+    return Security2CCAPI = _classThis;
+})();
+export { Security2CCAPI };
+let Security2CC = (() => {
+    let _classDecorators = [commandClass(CommandClasses["Security 2"]), implementedVersion(1)];
+    let _classDescriptor;
+    let _classExtraInitializers = [];
+    let _classThis;
+    let _classSuper = CommandClass;
+    var Security2CC = class extends _classSuper {
+        static { _classThis = this; }
+        static {
+            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
+            __esDecorate(null, _classDescriptor = { value: _classThis }, _classDecorators, { kind: "class", name: _classThis.name, metadata: _metadata }, null, _classExtraInitializers);
+            Security2CC = _classThis = _classDescriptor.value;
+            if (_metadata) Object.defineProperty(_classThis, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+            __runInitializers(_classThis, _classExtraInitializers);
+        }
+        async interview(ctx) {
+            const securityManager = getSecurityManager(ctx.ownNodeId, ctx, this.nodeId);
+            const node = this.getNode(ctx);
+            const endpoint = this.getEndpoint(ctx);
+            const api = CCAPI.create(CommandClasses["Security 2"], ctx, endpoint).withOptions({
+                priority: MessagePriority.NodeQuery,
+            });
+            // Only on the highest security class the response includes the supported commands
+            const secClass = node.getHighestSecurityClass();
+            let hasReceivedSecureCommands = false;
+            let possibleSecurityClasses;
+            if (securityClassIsS2(secClass)) {
+                // The highest security class is known to be S2, only query that one
+                possibleSecurityClasses = [secClass];
+            }
+            else if (endpoint.index === 0) {
+                // If the highest security class isn't known, query all possible security classes
+                // but only on the root device
+                possibleSecurityClasses = [
+                    SecurityClass.S2_Unauthenticated,
+                    SecurityClass.S2_Authenticated,
+                    SecurityClass.S2_AccessControl,
+                ];
+            }
+            else {
+                // For endpoint interviews, the security class MUST be known
                 ctx.logNode(node.id, {
                     endpoint: endpoint.index,
-                    message: `Cannot query securely supported commands (${getEnumMemberName(SecurityClass, secClass)}) - network key is not configured...`,
-                    level: "warn",
+                    message: `Cannot query securely supported commands for endpoint because the node's security class isn't known...`,
+                    level: "error",
                 });
-                continue;
+                return;
             }
-            ctx.logNode(node.id, {
-                endpoint: endpoint.index,
-                message: `Querying securely supported commands (${getEnumMemberName(SecurityClass, secClass)})...`,
-                direction: "outbound",
-            });
-            // Query the supported commands but avoid remembering the wrong security class in case of a failure
-            let supportedCCs;
-            // Try up to 3 times on the root device. We REALLY don't want a spurious timeout or collision to cause us to discard a known good security class
-            const MAX_ATTEMPTS = this.endpointIndex === 0 ? 3 : 1;
-            for (let attempts = 1; attempts <= MAX_ATTEMPTS; attempts++) {
-                try {
-                    supportedCCs = await api.getSupportedCommands(secClass);
+            for (const secClass of possibleSecurityClasses) {
+                // We might not know all assigned security classes yet, so we work our way up from low to high and try to request the supported commands.
+                // This way, each command is encrypted with the security class we're currently testing.
+                // If the node does not respond, it wasn't assigned the security class.
+                // If it responds with a non-empty list, we know this is the highest class it supports.
+                // If the list is empty, the security class is still supported.
+                // If we already know the class is not supported, skip it
+                if (node.hasSecurityClass(secClass) === false)
+                    continue;
+                // If no key is configured for this security class, skip it
+                if (!securityManager?.hasKeysForSecurityClass(secClass)) {
+                    ctx.logNode(node.id, {
+                        endpoint: endpoint.index,
+                        message: `Cannot query securely supported commands (${getEnumMemberName(SecurityClass, secClass)}) - network key is not configured...`,
+                        level: "warn",
+                    });
+                    continue;
                 }
-                catch (e) {
-                    if (isZWaveError(e)
-                        && e.code === ZWaveErrorCodes.Security2CC_CannotDecode) {
-                        // Either we were using a non-granted security class,
-                        // or querying with the known highest security class had an issue
-                        supportedCCs = undefined;
-                    }
-                    else {
-                        throw e;
+                ctx.logNode(node.id, {
+                    endpoint: endpoint.index,
+                    message: `Querying securely supported commands (${getEnumMemberName(SecurityClass, secClass)})...`,
+                    direction: "outbound",
+                });
+                // Query the supported commands but avoid remembering the wrong security class in case of a failure
+                let supportedCCs;
+                // Try up to 3 times on the root device. We REALLY don't want a spurious timeout or collision to cause us to discard a known good security class
+                const MAX_ATTEMPTS = this.endpointIndex === 0 ? 3 : 1;
+                for (let attempts = 1; attempts <= MAX_ATTEMPTS; attempts++) {
+                    try {
+                        supportedCCs = await api.getSupportedCommands(secClass);
                     }
-                }
-                if (supportedCCs == undefined
-                    && possibleSecurityClasses.length === 1) {
-                    if (attempts < MAX_ATTEMPTS) {
-                        // We definitely know the highest security class
-                        ctx.logNode(node.id, {
-                            endpoint: endpoint.index,
-                            message: `Querying securely supported commands (${getEnumMemberName(SecurityClass, secClass)}), attempt ${attempts}/${MAX_ATTEMPTS} failed. Retrying in 500ms...`,
-                            level: "warn",
-                        });
-                        await wait(500);
-                        continue;
+                    catch (e) {
+                        if (isZWaveError(e)
+                            && e.code === ZWaveErrorCodes.Security2CC_CannotDecode) {
+                            // Either we were using a non-granted security class,
+                            // or querying with the known highest security class had an issue
+                            supportedCCs = undefined;
+                        }
+                        else {
+                            throw e;
+                        }
                     }
-                    else if (endpoint.index > 0) {
-                        ctx.logNode(node.id, {
-                            endpoint: endpoint.index,
-                            message: `Querying securely supported commands (${getEnumMemberName(SecurityClass, secClass)}) failed. Assuming the endpoint supports all its mandatory CCs securely...`,
-                            level: "warn",
-                        });
-                        // Just mark all endpoint CCs as secure. Without this we would attempt
-                        // unencrypted communication with the endpoint, which will likely fail.
-                        for (const [ccId] of endpoint.getCCs()) {
-                            endpoint.addCC(ccId, { secure: true });
+                    if (supportedCCs == undefined
+                        && possibleSecurityClasses.length === 1) {
+                        if (attempts < MAX_ATTEMPTS) {
+                            // We definitely know the highest security class
+                            ctx.logNode(node.id, {
+                                endpoint: endpoint.index,
+                                message: `Querying securely supported commands (${getEnumMemberName(SecurityClass, secClass)}), attempt ${attempts}/${MAX_ATTEMPTS} failed. Retrying in 500ms...`,
+                                level: "warn",
+                            });
+                            await wait(500);
+                            continue;
+                        }
+                        else if (endpoint.index > 0) {
+                            ctx.logNode(node.id, {
+                                endpoint: endpoint.index,
+                                message: `Querying securely supported commands (${getEnumMemberName(SecurityClass, secClass)}) failed. Assuming the endpoint supports all its mandatory CCs securely...`,
+                                level: "warn",
+                            });
+                            // Just mark all endpoint CCs as secure. Without this we would attempt
+                            // unencrypted communication with the endpoint, which will likely fail.
+                            for (const [ccId] of endpoint.getCCs()) {
+                                endpoint.addCC(ccId, { secure: true });
+                            }
+                            break;
+                        }
+                        else {
+                            ctx.logNode(node.id, {
+                                endpoint: endpoint.index,
+                                message: `Querying securely supported commands (${getEnumMemberName(SecurityClass, secClass)}) failed. Let's hope for the best...`,
+                                level: "warn",
+                            });
+                            break;
                         }
-                        break;
                     }
                     else {
-                        ctx.logNode(node.id, {
-                            endpoint: endpoint.index,
-                            message: `Querying securely supported commands (${getEnumMemberName(SecurityClass, secClass)}) failed. Let's hope for the best...`,
-                            level: "warn",
-                        });
+                        // In any other case, we can stop trying
                         break;
                     }
                 }
-                else {
-                    // In any other case, we can stop trying
-                    break;
+                if (supportedCCs == undefined) {
+                    if (endpoint.index === 0
+                        && possibleSecurityClasses.length > 1) {
+                        // No supported commands found, mark the security class as not granted
+                        // unless we were sure about the security class
+                        node.setSecurityClass(secClass, false);
+                        ctx.logNode(node.id, {
+                            message: `The node was NOT granted the security class ${getEnumMemberName(SecurityClass, secClass)}`,
+                            direction: "inbound",
+                        });
+                    }
+                    continue;
                 }
-            }
-            if (supportedCCs == undefined) {
-                if (endpoint.index === 0
-                    && possibleSecurityClasses.length > 1) {
-                    // No supported commands found, mark the security class as not granted
-                    // unless we were sure about the security class
-                    node.setSecurityClass(secClass, false);
+                if (endpoint.index === 0 && possibleSecurityClasses.length > 1) {
+                    // Mark the security class as granted unless we were sure about the security class
+                    node.setSecurityClass(secClass, true);
                     ctx.logNode(node.id, {
-                        message: `The node was NOT granted the security class ${getEnumMemberName(SecurityClass, secClass)}`,
+                        message: `The node was granted the security class ${getEnumMemberName(SecurityClass, secClass)}`,
                         direction: "inbound",
                     });
                 }
-                continue;
-            }
-            if (endpoint.index === 0 && possibleSecurityClasses.length > 1) {
-                // Mark the security class as granted unless we were sure about the security class
-                node.setSecurityClass(secClass, true);
-                ctx.logNode(node.id, {
-                    message: `The node was granted the security class ${getEnumMemberName(SecurityClass, secClass)}`,
-                    direction: "inbound",
-                });
-            }
-            if (!hasReceivedSecureCommands && supportedCCs.length > 0) {
-                hasReceivedSecureCommands = true;
-                const logLines = [
-                    `received secure commands (${getEnumMemberName(SecurityClass, secClass)})`,
-                    "supported CCs:",
-                ];
-                for (const cc of supportedCCs) {
-                    logLines.push(`· ${getCCName(cc)}`);
-                }
-                ctx.logNode(node.id, {
-                    endpoint: endpoint.index,
-                    message: logLines.join("\n"),
-                    direction: "inbound",
-                });
-                // Remember which commands are supported securely
-                for (const cc of supportedCCs) {
-                    // Basic CC has special rules for when it is considered supported
-                    // Therefore we mark all other CCs as supported, but not Basic CC,
-                    // for which support is determined later.
-                    if (cc === CommandClasses.Basic) {
-                        endpoint.addCC(cc, { secure: true });
+                if (!hasReceivedSecureCommands && supportedCCs.length > 0) {
+                    hasReceivedSecureCommands = true;
+                    const logLines = [
+                        `received secure commands (${getEnumMemberName(SecurityClass, secClass)})`,
+                        "supported CCs:",
+                    ];
+                    for (const cc of supportedCCs) {
+                        logLines.push(`· ${getCCName(cc)}`);
                     }
-                    else {
-                        endpoint.addCC(cc, {
-                            isSupported: true,
-                            secure: true,
-                        });
+                    ctx.logNode(node.id, {
+                        endpoint: endpoint.index,
+                        message: logLines.join("\n"),
+                        direction: "inbound",
+                    });
+                    // Remember which commands are supported securely
+                    for (const cc of supportedCCs) {
+                        // Basic CC has special rules for when it is considered supported
+                        // Therefore we mark all other CCs as supported, but not Basic CC,
+                        // for which support is determined later.
+                        if (cc === CommandClasses.Basic) {
+                            endpoint.addCC(cc, { secure: true });
+                        }
+                        else {
+                            endpoint.addCC(cc, {
+                                isSupported: true,
+                                secure: true,
+                            });
+                        }
                     }
                 }
             }
+            // Remember that the interview is complete
+            this.setInterviewComplete(ctx, true);
         }
-        // Remember that the interview is complete
-        this.setInterviewComplete(ctx, true);
-    }
-    /** Tests if a command should be sent secure and thus requires encapsulation */
-    static requiresEncapsulation(cc) {
-        // No security flag -> no encapsulation
-        if (!(cc.encapsulationFlags & EncapsulationFlags.Security)) {
-            return false;
-        }
-        // S0, CRC16, Transport Service -> no S2 encapsulation
-        if (cc instanceof SecurityCC
-            || cc instanceof CRC16CC
-            || cc instanceof TransportServiceCC) {
-            return false;
-        }
-        // S2: check command
-        if (cc instanceof Security2CC_1) {
-            // These S2 commands need additional encapsulation
-            switch (cc.ccCommand) {
-                case Security2Command.CommandsSupportedGet:
-                case Security2Command.CommandsSupportedReport:
-                case Security2Command.NetworkKeyGet:
-                case Security2Command.NetworkKeyReport:
-                case Security2Command.NetworkKeyVerify:
-                case Security2Command.TransferEnd:
-                    return true;
-                case Security2Command.KEXSet:
-                case Security2Command.KEXReport:
-                    // KEXSet/Report need to be encrypted for the confirmation only
-                    return cc
-                        .echo;
-                case Security2Command.KEXFail: {
-                    switch (cc.failType) {
-                        case KEXFailType.Decrypt:
-                        case KEXFailType.WrongSecurityLevel:
-                        case KEXFailType.KeyNotGranted:
-                        case KEXFailType.NoVerify:
-                            return true;
-                        default:
-                            return false;
+        /** Tests if a command should be sent secure and thus requires encapsulation */
+        static requiresEncapsulation(cc) {
+            // No security flag -> no encapsulation
+            if (!(cc.encapsulationFlags & EncapsulationFlags.Security)) {
+                return false;
+            }
+            // S0, CRC16, Transport Service -> no S2 encapsulation
+            if (cc instanceof SecurityCC
+                || cc instanceof CRC16CC
+                || cc instanceof TransportServiceCC) {
+                return false;
+            }
+            // S2: check command
+            if (cc instanceof Security2CC) {
+                // These S2 commands need additional encapsulation
+                switch (cc.ccCommand) {
+                    case Security2Command.CommandsSupportedGet:
+                    case Security2Command.CommandsSupportedReport:
+                    case Security2Command.NetworkKeyGet:
+                    case Security2Command.NetworkKeyReport:
+                    case Security2Command.NetworkKeyVerify:
+                    case Security2Command.TransferEnd:
+                        return true;
+                    case Security2Command.KEXSet:
+                    case Security2Command.KEXReport:
+                        // KEXSet/Report need to be encrypted for the confirmation only
+                        return cc
+                            .echo;
+                    case Security2Command.KEXFail: {
+                        switch (cc.failType) {
+                            case KEXFailType.Decrypt:
+                            case KEXFailType.WrongSecurityLevel:
+                            case KEXFailType.KeyNotGranted:
+                            case KEXFailType.NoVerify:
+                                return true;
+                            default:
+                                return false;
+                        }
                     }
                 }
+                return false;
             }
-            return false;
+            // Everything else needs to be encapsulated if the CC is secure
+            return true;
         }
-        // Everything else needs to be encapsulated if the CC is secure
-        return true;
-    }
-    /** Encapsulates a command that should be sent encrypted */
-    static encapsulate(cc, ownNodeId, securityManagers, options) {
-        // Determine which extensions must be used on the command
-        const extensions = [];
-        if (options?.multicastOutOfSync) {
-            extensions.push(new MOSExtension());
-        }
-        if (options?.multicastGroupId != undefined) {
-            extensions.push(new MGRPExtension({ groupId: options.multicastGroupId }));
-        }
-        // Make sure that S2 multicast uses broadcasts. While the specs mention that both multicast and broadcast
-        // are possible, it has been found that devices treat multicasts like singlecast followups and respond incorrectly.
-        let nodeId;
-        if (cc.isMulticast()) {
-            if (cc.nodeId.some((nodeId) => isLongRangeNodeId(nodeId))) {
-                nodeId = NODE_ID_BROADCAST_LR;
+        /** Encapsulates a command that should be sent encrypted */
+        static encapsulate(cc, ownNodeId, securityManagers, options) {
+            // Determine which extensions must be used on the command
+            const extensions = [];
+            if (options?.multicastOutOfSync) {
+                extensions.push(new MOSExtension());
+            }
+            if (options?.multicastGroupId != undefined) {
+                extensions.push(new MGRPExtension({ groupId: options.multicastGroupId }));
+            }
+            // Make sure that S2 multicast uses broadcasts. While the specs mention that both multicast and broadcast
+            // are possible, it has been found that devices treat multicasts like singlecast followups and respond incorrectly.
+            let nodeId;
+            if (cc.isMulticast()) {
+                if (cc.nodeId.some((nodeId) => isLongRangeNodeId(nodeId))) {
+                    nodeId = NODE_ID_BROADCAST_LR;
+                }
+                else {
+                    nodeId = NODE_ID_BROADCAST;
+                }
             }
             else {
-                nodeId = NODE_ID_BROADCAST;
+                nodeId = cc.nodeId;
             }
+            const ret = new Security2CCMessageEncapsulation({
+                nodeId,
+                encapsulated: cc,
+                securityClass: options?.securityClass,
+                extensions,
+                verifyDelivery: options?.verifyDelivery,
+            });
+            // Copy the encapsulation flags from the encapsulated command
+            // but omit Security, since we're doing that right now
+            ret.encapsulationFlags = cc.encapsulationFlags
+                & ~EncapsulationFlags.Security;
+            return ret;
         }
-        else {
-            nodeId = cc.nodeId;
-        }
-        const ret = new Security2CCMessageEncapsulation({
-            nodeId,
-            encapsulated: cc,
-            securityClass: options?.securityClass,
-            extensions,
-            verifyDelivery: options?.verifyDelivery,
-        });
-        // Copy the encapsulation flags from the encapsulated command
-        // but omit Security, since we're doing that right now
-        ret.encapsulationFlags = cc.encapsulationFlags
-            & ~EncapsulationFlags.Security;
-        return ret;
-    }
-};
-Security2CC = Security2CC_1 = __decorate([
-    commandClass(CommandClasses["Security 2"]),
-    implementedVersion(1)
-], Security2CC);
+    };
+    return Security2CC = _classThis;
+})();
 export { Security2CC };
 function failNoSPAN() {
     validatePayload.fail(ZWaveErrorCodes.Security2CC_NoSPAN);
@@ -837,657 +889,719 @@ function testCCResponseForMessageEncapsulation(sent, received) {
         return received.SOS && !!received.receiverEI;
     }
 }
-let Security2CCMessageEncapsulation = Security2CCMessageEncapsulation_1 = class Security2CCMessageEncapsulation extends Security2CC {
-    constructor(options) {
-        super(options);
-        if (!options.encapsulated && !options.extensions?.length) {
-            throw new ZWaveError("Security S2 encapsulation requires an encapsulated CC and/or extensions", ZWaveErrorCodes.Argument_Invalid);
-        }
-        this.sequenceNumber = options.sequenceNumber;
-        this.securityClass = options.securityClass;
-        if (options.encapsulated) {
-            this.encapsulated = options.encapsulated;
-            options.encapsulated.encapsulatingCC = this;
-        }
-        this.verifyDelivery = options.verifyDelivery !== false;
-        this.extensions = options.extensions ?? [];
-        if (typeof this.nodeId !== "number"
-            && !this.extensions.some((e) => e instanceof MGRPExtension)) {
-            throw new ZWaveError("Multicast Security S2 encapsulation requires the MGRP extension", ZWaveErrorCodes.Security2CC_MissingExtension);
+let Security2CCMessageEncapsulation = (() => {
+    let _classDecorators = [CCCommand(Security2Command.MessageEncapsulation), expectedCCResponse(getCCResponseForMessageEncapsulation, testCCResponseForMessageEncapsulation)];
+    let _classDescriptor;
+    let _classExtraInitializers = [];
+    let _classThis;
+    let _classSuper = Security2CC;
+    var Security2CCMessageEncapsulation = class extends _classSuper {
+        static { _classThis = this; }
+        static {
+            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
+            __esDecorate(null, _classDescriptor = { value: _classThis }, _classDecorators, { kind: "class", name: _classThis.name, metadata: _metadata }, null, _classExtraInitializers);
+            Security2CCMessageEncapsulation = _classThis = _classDescriptor.value;
+            if (_metadata) Object.defineProperty(_classThis, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+            __runInitializers(_classThis, _classExtraInitializers);
         }
-    }
-    static from(raw, ctx) {
-        const securityManager = assertSecurityRX(ctx);
-        validatePayload(raw.payload.length >= 2);
-        // Check the sequence number to avoid duplicates
-        const sequenceNumber = raw.payload[0];
-        // Ensure the node has a security class
-        validatePayload.withReason("No security class granted")(ctx.getHighestSecurityClass(ctx.sourceNodeId) !== SecurityClass.None);
-        const hasExtensions = !!(raw.payload[1] & 0b1);
-        const hasEncryptedExtensions = !!(raw.payload[1] & 0b10);
-        let offset = 2;
-        const extensions = [];
-        let mustDiscardCommand = false;
-        const parseExtensions = (buffer, wasEncrypted) => {
-            while (true) {
-                if (buffer.length < offset + 2) {
-                    // An S2 extension was expected, but the buffer is too short
-                    mustDiscardCommand = true;
-                    return;
+        constructor(options) {
+            super(options);
+            if (!options.encapsulated && !options.extensions?.length) {
+                throw new ZWaveError("Security S2 encapsulation requires an encapsulated CC and/or extensions", ZWaveErrorCodes.Argument_Invalid);
+            }
+            this.sequenceNumber = options.sequenceNumber;
+            this.securityClass = options.securityClass;
+            if (options.encapsulated) {
+                this.encapsulated = options.encapsulated;
+                options.encapsulated.encapsulatingCC = this;
+            }
+            this.verifyDelivery = options.verifyDelivery !== false;
+            this.extensions = options.extensions ?? [];
+            if (typeof this.nodeId !== "number"
+                && !this.extensions.some((e) => e instanceof MGRPExtension)) {
+                throw new ZWaveError("Multicast Security S2 encapsulation requires the MGRP extension", ZWaveErrorCodes.Security2CC_MissingExtension);
+            }
+        }
+        static from(raw, ctx) {
+            const securityManager = assertSecurityRX(ctx);
+            validatePayload(raw.payload.length >= 2);
+            // Check the sequence number to avoid duplicates
+            const sequenceNumber = raw.payload[0];
+            // Ensure the node has a security class
+            validatePayload.withReason("No security class granted")(ctx.getHighestSecurityClass(ctx.sourceNodeId) !== SecurityClass.None);
+            const hasExtensions = !!(raw.payload[1] & 0b1);
+            const hasEncryptedExtensions = !!(raw.payload[1] & 0b10);
+            let offset = 2;
+            const extensions = [];
+            let mustDiscardCommand = false;
+            const parseExtensions = (buffer, wasEncrypted) => {
+                while (true) {
+                    if (buffer.length < offset + 2) {
+                        // An S2 extension was expected, but the buffer is too short
+                        mustDiscardCommand = true;
+                        return;
+                    }
+                    // The length field could be too large, which would cause part of the actual ciphertext
+                    // to be ignored. Try to avoid this for known extensions by checking the actual and expected length.
+                    const { actual: actualLength, expected: expectedLength } = Security2Extension
+                        .getExtensionLength(buffer.subarray(offset));
+                    // Parse the extension using the expected length if possible
+                    const extensionLength = expectedLength ?? actualLength;
+                    if (extensionLength < 2) {
+                        // An S2 extension was expected, but the length is too short
+                        mustDiscardCommand = true;
+                        return;
+                    }
+                    else if (extensionLength
+                        > buffer.length
+                            - offset
+                            - (wasEncrypted
+                                ? 0
+                                : SECURITY_S2_AUTH_TAG_LENGTH)) {
+                        // The supposed length is longer than the space the extensions may occupy
+                        mustDiscardCommand = true;
+                        return;
+                    }
+                    const extensionData = buffer.subarray(offset, offset + extensionLength);
+                    offset += extensionLength;
+                    const ext = Security2Extension.parse(extensionData);
+                    switch (validateS2Extension(ext, wasEncrypted)) {
+                        case ValidateS2ExtensionResult.OK:
+                            if (expectedLength != undefined
+                                && actualLength !== expectedLength) {
+                                // The extension length field does not match, ignore the extension
+                            }
+                            else {
+                                extensions.push(ext);
+                            }
+                            break;
+                        case ValidateS2ExtensionResult.DiscardExtension:
+                            // Do nothing
+                            break;
+                        case ValidateS2ExtensionResult.DiscardCommand:
+                            mustDiscardCommand = true;
+                            break;
+                    }
+                    // Check if that was the last extension
+                    if (!ext.moreToFollow)
+                        break;
                 }
-                // The length field could be too large, which would cause part of the actual ciphertext
-                // to be ignored. Try to avoid this for known extensions by checking the actual and expected length.
-                const { actual: actualLength, expected: expectedLength } = Security2Extension
-                    .getExtensionLength(buffer.subarray(offset));
-                // Parse the extension using the expected length if possible
-                const extensionLength = expectedLength ?? actualLength;
-                if (extensionLength < 2) {
-                    // An S2 extension was expected, but the length is too short
-                    mustDiscardCommand = true;
-                    return;
+            };
+            if (hasExtensions)
+                parseExtensions(raw.payload, false);
+            const mcctx = (() => {
+                const multicastGroupId = getMulticastGroupId(extensions);
+                if (ctx.frameType === "multicast" || ctx.frameType === "broadcast") {
+                    if (multicastGroupId == undefined) {
+                        validatePayload.fail("Multicast frames without MGRP extension");
+                    }
+                    return {
+                        isMulticast: true,
+                        groupId: multicastGroupId,
+                    };
                 }
-                else if (extensionLength
-                    > buffer.length
-                        - offset
-                        - (wasEncrypted
-                            ? 0
-                            : SECURITY_S2_AUTH_TAG_LENGTH)) {
-                    // The supposed length is longer than the space the extensions may occupy
-                    mustDiscardCommand = true;
-                    return;
+                else {
+                    return { isMulticast: false, groupId: multicastGroupId };
                 }
-                const extensionData = buffer.subarray(offset, offset + extensionLength);
-                offset += extensionLength;
-                const ext = Security2Extension.parse(extensionData);
-                switch (validateS2Extension(ext, wasEncrypted)) {
-                    case ValidateS2ExtensionResult.OK:
-                        if (expectedLength != undefined
-                            && actualLength !== expectedLength) {
-                            // The extension length field does not match, ignore the extension
-                        }
-                        else {
-                            extensions.push(ext);
-                        }
-                        break;
-                    case ValidateS2ExtensionResult.DiscardExtension:
-                        // Do nothing
-                        break;
-                    case ValidateS2ExtensionResult.DiscardCommand:
-                        mustDiscardCommand = true;
-                        break;
+            })();
+            // If a command is to be discarded before decryption,
+            // we still need to increment the SPAN or MPAN state
+            if (mustDiscardCommand) {
+                if (mcctx.isMulticast) {
+                    securityManager.nextPeerMPAN(ctx.sourceNodeId, mcctx.groupId);
                 }
-                // Check if that was the last extension
-                if (!ext.moreToFollow)
-                    break;
-            }
-        };
-        if (hasExtensions)
-            parseExtensions(raw.payload, false);
-        const mcctx = (() => {
-            const multicastGroupId = getMulticastGroupId(extensions);
-            if (ctx.frameType === "multicast" || ctx.frameType === "broadcast") {
-                if (multicastGroupId == undefined) {
-                    validatePayload.fail("Multicast frames without MGRP extension");
+                else {
+                    securityManager.nextNonce(ctx.sourceNodeId);
                 }
-                return {
-                    isMulticast: true,
-                    groupId: multicastGroupId,
-                };
+                validatePayload.fail("Invalid S2 extension");
+            }
+            let prevSequenceNumber;
+            let mpanState;
+            if (mcctx.isMulticast) {
+                mpanState = securityManager.getPeerMPAN(ctx.sourceNodeId, mcctx.groupId);
             }
             else {
-                return { isMulticast: false, groupId: multicastGroupId };
+                // Don't accept duplicate Singlecast commands
+                prevSequenceNumber = validateSequenceNumber(securityManager, ctx.sourceNodeId, sequenceNumber);
+                // When a node receives a singlecast message after a multicast group was marked out of sync,
+                // it must forget about the group.
+                if (mcctx.groupId == undefined) {
+                    securityManager.resetOutOfSyncMPANs(ctx.sourceNodeId);
+                }
             }
-        })();
-        // If a command is to be discarded before decryption,
-        // we still need to increment the SPAN or MPAN state
-        if (mustDiscardCommand) {
+            const unencryptedPayload = raw.payload.subarray(0, offset);
+            const ciphertext = raw.payload.subarray(offset, -SECURITY_S2_AUTH_TAG_LENGTH);
+            const authTag = raw.payload.subarray(-SECURITY_S2_AUTH_TAG_LENGTH);
+            const messageLength = 2 /* CommandClass.computeEncapsulationOverhead() */
+                + raw.payload.length;
+            const authData = getAuthenticationData(ctx.sourceNodeId, getDestinationIDRX(ctx, extensions), ctx.homeId, messageLength, unencryptedPayload);
+            let decrypt;
             if (mcctx.isMulticast) {
-                securityManager.nextPeerMPAN(ctx.sourceNodeId, mcctx.groupId);
+                // For incoming multicast commands, make sure we have an MPAN
+                if (mpanState?.type !== MPANState.MPAN) {
+                    // If we don't, mark the MPAN as out of sync, so we can respond accordingly on the singlecast followup
+                    securityManager.storePeerMPAN(ctx.sourceNodeId, mcctx.groupId, { type: MPANState.OutOfSync });
+                    failNoMPAN();
+                }
+                decrypt = () => decryptMulticast(ctx.sourceNodeId, securityManager, mcctx.groupId, ciphertext, authData, authTag);
             }
             else {
-                securityManager.nextNonce(ctx.sourceNodeId);
+                // Decrypt payload and verify integrity
+                const spanState = securityManager.getSPANState(ctx.sourceNodeId);
+                // If we are not able to establish an SPAN yet, fail the decryption
+                if (spanState.type === SPANState.None) {
+                    failNoSPAN();
+                }
+                else if (spanState.type === SPANState.RemoteEI) {
+                    // TODO: The specs are not clear how to handle this case
+                    // For now, do the same as if we didn't have any EI
+                    failNoSPAN();
+                }
+                decrypt = () => decryptSinglecast(ctx, securityManager, ctx.sourceNodeId, sequenceNumber, prevSequenceNumber, ciphertext, authData, authTag, spanState, extensions);
             }
-            validatePayload.fail("Invalid S2 extension");
-        }
-        let prevSequenceNumber;
-        let mpanState;
-        if (mcctx.isMulticast) {
-            mpanState = securityManager.getPeerMPAN(ctx.sourceNodeId, mcctx.groupId);
-        }
-        else {
-            // Don't accept duplicate Singlecast commands
-            prevSequenceNumber = validateSequenceNumber(securityManager, ctx.sourceNodeId, sequenceNumber);
-            // When a node receives a singlecast message after a multicast group was marked out of sync,
-            // it must forget about the group.
-            if (mcctx.groupId == undefined) {
-                securityManager.resetOutOfSyncMPANs(ctx.sourceNodeId);
+            let plaintext;
+            let authOK = false;
+            let key;
+            let iv;
+            let decryptionSecurityClass;
+            // If the Receiver is unable to authenticate the singlecast message with the current SPAN,
+            // the Receiver SHOULD try decrypting the message with one or more of the following SPAN values,
+            // stopping when decryption is successful or the maximum number of iterations is reached.
+            // If the Receiver is unable to decrypt the S2 MC frame with the current MPAN, the Receiver MAY try
+            // decrypting the frame with one or more of the subsequent MPAN values, stopping when decryption is
+            // successful or the maximum number of iterations is reached.
+            const decryptAttempts = mcctx.isMulticast
+                ? MAX_DECRYPT_ATTEMPTS_MULTICAST
+                : mcctx.groupId != undefined
+                    ? MAX_DECRYPT_ATTEMPTS_SC_FOLLOWUP
+                    : MAX_DECRYPT_ATTEMPTS_SINGLECAST;
+            for (let i = 0; i < decryptAttempts; i++) {
+                ({
+                    plaintext,
+                    authOK,
+                    key,
+                    iv,
+                    securityClass: decryptionSecurityClass,
+                } = decrypt());
+                if (!!authOK && !!plaintext)
+                    break;
+                // No need to try further SPANs if we just got the sender's EI
+                if (!!getSenderEI(extensions))
+                    break;
             }
-        }
-        const unencryptedPayload = raw.payload.subarray(0, offset);
-        const ciphertext = raw.payload.subarray(offset, -SECURITY_S2_AUTH_TAG_LENGTH);
-        const authTag = raw.payload.subarray(-SECURITY_S2_AUTH_TAG_LENGTH);
-        const messageLength = 2 /* CommandClass.computeEncapsulationOverhead() */
-            + raw.payload.length;
-        const authData = getAuthenticationData(ctx.sourceNodeId, getDestinationIDRX(ctx, extensions), ctx.homeId, messageLength, unencryptedPayload);
-        let decrypt;
-        if (mcctx.isMulticast) {
-            // For incoming multicast commands, make sure we have an MPAN
-            if (mpanState?.type !== MPANState.MPAN) {
-                // If we don't, mark the MPAN as out of sync, so we can respond accordingly on the singlecast followup
-                securityManager.storePeerMPAN(ctx.sourceNodeId, mcctx.groupId, { type: MPANState.OutOfSync });
-                failNoMPAN();
+            // If authentication fails, do so with an error code that instructs the
+            // applHost to tell the node we have no nonce
+            if (!authOK || !plaintext) {
+                if (mcctx.isMulticast) {
+                    // Mark the MPAN as out of sync
+                    securityManager.storePeerMPAN(ctx.sourceNodeId, mcctx.groupId, { type: MPANState.OutOfSync });
+                    validatePayload.fail(ZWaveErrorCodes.Security2CC_CannotDecodeMulticast);
+                }
+                else {
+                    validatePayload.fail(ZWaveErrorCodes.Security2CC_CannotDecode);
+                }
             }
-            decrypt = () => decryptMulticast(ctx.sourceNodeId, securityManager, mcctx.groupId, ciphertext, authData, authTag);
-        }
-        else {
-            // Decrypt payload and verify integrity
-            const spanState = securityManager.getSPANState(ctx.sourceNodeId);
-            // If we are not able to establish an SPAN yet, fail the decryption
-            if (spanState.type === SPANState.None) {
-                failNoSPAN();
+            else if (!mcctx.isMulticast && mcctx.groupId != undefined) {
+                // After reception of a singlecast followup, the MPAN state must be increased
+                securityManager.tryIncrementPeerMPAN(ctx.sourceNodeId, mcctx.groupId);
             }
-            else if (spanState.type === SPANState.RemoteEI) {
-                // TODO: The specs are not clear how to handle this case
-                // For now, do the same as if we didn't have any EI
-                failNoSPAN();
+            // Remember which security class was used to decrypt this message, so we can discard it later
+            const securityClass = decryptionSecurityClass;
+            offset = 0;
+            if (hasEncryptedExtensions)
+                parseExtensions(plaintext, true);
+            // Before we can continue, check if the command must be discarded
+            if (mustDiscardCommand) {
+                validatePayload.fail("Invalid extension");
             }
-            decrypt = () => decryptSinglecast(ctx, securityManager, ctx.sourceNodeId, sequenceNumber, prevSequenceNumber, ciphertext, authData, authTag, spanState, extensions);
-        }
-        let plaintext;
-        let authOK = false;
-        let key;
-        let iv;
-        let decryptionSecurityClass;
-        // If the Receiver is unable to authenticate the singlecast message with the current SPAN,
-        // the Receiver SHOULD try decrypting the message with one or more of the following SPAN values,
-        // stopping when decryption is successful or the maximum number of iterations is reached.
-        // If the Receiver is unable to decrypt the S2 MC frame with the current MPAN, the Receiver MAY try
-        // decrypting the frame with one or more of the subsequent MPAN values, stopping when decryption is
-        // successful or the maximum number of iterations is reached.
-        const decryptAttempts = mcctx.isMulticast
-            ? MAX_DECRYPT_ATTEMPTS_MULTICAST
-            : mcctx.groupId != undefined
-                ? MAX_DECRYPT_ATTEMPTS_SC_FOLLOWUP
-                : MAX_DECRYPT_ATTEMPTS_SINGLECAST;
-        for (let i = 0; i < decryptAttempts; i++) {
-            ({
-                plaintext,
-                authOK,
-                key,
-                iv,
-                securityClass: decryptionSecurityClass,
-            } = decrypt());
-            if (!!authOK && !!plaintext)
-                break;
-            // No need to try further SPANs if we just got the sender's EI
-            if (!!getSenderEI(extensions))
-                break;
-        }
-        // If authentication fails, do so with an error code that instructs the
-        // applHost to tell the node we have no nonce
-        if (!authOK || !plaintext) {
-            if (mcctx.isMulticast) {
-                // Mark the MPAN as out of sync
-                securityManager.storePeerMPAN(ctx.sourceNodeId, mcctx.groupId, { type: MPANState.OutOfSync });
-                validatePayload.fail(ZWaveErrorCodes.Security2CC_CannotDecodeMulticast);
+            // If the MPAN extension was received, store the MPAN
+            if (!mcctx.isMulticast) {
+                const mpanExtension = extensions.find((e) => e instanceof MPANExtension);
+                if (mpanExtension) {
+                    securityManager.storePeerMPAN(ctx.sourceNodeId, mpanExtension.groupId, {
+                        type: MPANState.MPAN,
+                        currentMPAN: mpanExtension.innerMPANState,
+                    });
+                }
             }
-            else {
-                validatePayload.fail(ZWaveErrorCodes.Security2CC_CannotDecode);
+            // Not every S2 message includes an encapsulated CC
+            const decryptedCCBytes = plaintext.subarray(offset);
+            let encapsulated;
+            if (decryptedCCBytes.length > 0) {
+                // make sure this contains a complete CC command that's worth splitting
+                validatePayload(decryptedCCBytes.length >= 2);
+                // and deserialize the CC
+                encapsulated = CommandClass.parse(decryptedCCBytes, ctx);
             }
+            const ret = new Security2CCMessageEncapsulation({
+                nodeId: ctx.sourceNodeId,
+                sequenceNumber,
+                securityClass,
+                extensions,
+                encapsulated,
+            });
+            // Remember for debugging purposes
+            ret.key = key;
+            ret.iv = iv;
+            ret.authData = authData;
+            ret.authTag = authTag;
+            ret.plaintext = decryptedCCBytes;
+            return ret;
         }
-        else if (!mcctx.isMulticast && mcctx.groupId != undefined) {
-            // After reception of a singlecast followup, the MPAN state must be increased
-            securityManager.tryIncrementPeerMPAN(ctx.sourceNodeId, mcctx.groupId);
-        }
-        // Remember which security class was used to decrypt this message, so we can discard it later
-        const securityClass = decryptionSecurityClass;
-        offset = 0;
-        if (hasEncryptedExtensions)
-            parseExtensions(plaintext, true);
-        // Before we can continue, check if the command must be discarded
-        if (mustDiscardCommand) {
-            validatePayload.fail("Invalid extension");
-        }
-        // If the MPAN extension was received, store the MPAN
-        if (!mcctx.isMulticast) {
-            const mpanExtension = extensions.find((e) => e instanceof MPANExtension);
-            if (mpanExtension) {
-                securityManager.storePeerMPAN(ctx.sourceNodeId, mpanExtension.groupId, {
-                    type: MPANState.MPAN,
-                    currentMPAN: mpanExtension.innerMPANState,
-                });
+        securityClass;
+        // Only used for testing/debugging purposes
+        key;
+        iv;
+        authData;
+        authTag;
+        ciphertext;
+        plaintext;
+        verifyDelivery = true;
+        sequenceNumber;
+        ensureSequenceNumber(securityManager) {
+            if (this.sequenceNumber == undefined) {
+                if (this.isSinglecast()) {
+                    this.sequenceNumber = securityManager.nextSequenceNumber(this.nodeId);
+                }
+                else {
+                    const groupId = getDestinationIDTX.call(this);
+                    this.sequenceNumber = securityManager
+                        .nextMulticastSequenceNumber(groupId);
+                }
             }
         }
-        // Not every S2 message includes an encapsulated CC
-        const decryptedCCBytes = plaintext.subarray(offset);
-        let encapsulated;
-        if (decryptedCCBytes.length > 0) {
-            // make sure this contains a complete CC command that's worth splitting
-            validatePayload(decryptedCCBytes.length >= 2);
-            // and deserialize the CC
-            encapsulated = CommandClass.parse(decryptedCCBytes, ctx);
-        }
-        const ret = new Security2CCMessageEncapsulation_1({
-            nodeId: ctx.sourceNodeId,
-            sequenceNumber,
-            securityClass,
-            extensions,
-            encapsulated,
-        });
-        // Remember for debugging purposes
-        ret.key = key;
-        ret.iv = iv;
-        ret.authData = authData;
-        ret.authTag = authTag;
-        ret.plaintext = decryptedCCBytes;
-        return ret;
-    }
-    securityClass;
-    // Only used for testing/debugging purposes
-    key;
-    iv;
-    authData;
-    authTag;
-    ciphertext;
-    plaintext;
-    verifyDelivery = true;
-    sequenceNumber;
-    ensureSequenceNumber(securityManager) {
-        if (this.sequenceNumber == undefined) {
+        encapsulated;
+        extensions;
+        prepareRetransmission() {
+            super.prepareRetransmission();
+            this.sequenceNumber = undefined;
+        }
+        hasMOSExtension() {
+            return this.extensions.some((e) => e instanceof MOSExtension);
+        }
+        /** Returns the Sender's Entropy Input if this command contains an SPAN extension */
+        getSenderEI() {
+            return getSenderEI(this.extensions);
+        }
+        /** Returns the multicast group ID if this command contains an MGRP extension */
+        getMulticastGroupId() {
+            return getMulticastGroupId(this.extensions);
+        }
+        maybeAddSPANExtension(ctx, securityManager) {
+            if (!this.isSinglecast())
+                return;
+            const receiverNodeId = this.nodeId;
+            const spanState = securityManager.getSPANState(receiverNodeId);
+            if (spanState.type === SPANState.None
+                || spanState.type === SPANState.LocalEI) {
+                // Can't do anything here if we don't have the receiver's EI
+                throw new ZWaveError(`Security S2 CC requires the receiver's nonce to be sent!`, ZWaveErrorCodes.Security2CC_NoSPAN);
+            }
+            else if (spanState.type === SPANState.RemoteEI) {
+                // We have the receiver's EI, generate our input and send it over
+                // With both, we can create an SPAN
+                const senderEI = securityManager.generateNonce(undefined);
+                const receiverEI = spanState.receiverEI;
+                // While bootstrapping a node, prefer the temporary key, unless the
+                // specific command specifies a security class
+                if (this.securityClass == undefined
+                    && securityManager.tempKeys.has(receiverNodeId)) {
+                    securityManager.initializeTempSPAN(receiverNodeId, senderEI, receiverEI);
+                }
+                else {
+                    const securityClass = this.securityClass
+                        ?? ctx.getHighestSecurityClass(receiverNodeId);
+                    if (securityClass == undefined) {
+                        throw new ZWaveError("No security class defined for this command!", ZWaveErrorCodes.Security2CC_NoSPAN);
+                    }
+                    securityManager.initializeSPAN(receiverNodeId, securityClass, senderEI, receiverEI);
+                }
+                // Add or update the SPAN extension
+                let spanExtension = this.extensions.find((e) => e instanceof SPANExtension);
+                if (spanExtension) {
+                    spanExtension.senderEI = senderEI;
+                }
+                else {
+                    spanExtension = new SPANExtension({ senderEI });
+                    this.extensions.push(spanExtension);
+                }
+            }
+        }
+        serialize(ctx) {
+            const securityManager = assertSecurityTX(ctx, this.nodeId);
+            this.ensureSequenceNumber(securityManager);
+            // Include Sender EI in the command if we only have the receiver's EI
+            this.maybeAddSPANExtension(ctx, securityManager);
+            const unencryptedExtensions = this.extensions.filter((e) => !e.isEncrypted());
+            const encryptedExtensions = this.extensions.filter((e) => e.isEncrypted());
+            const unencryptedPayload = Bytes.concat([
+                Bytes.from([
+                    this.sequenceNumber,
+                    (encryptedExtensions.length > 0 ? 0b10 : 0)
+                        | (unencryptedExtensions.length > 0 ? 1 : 0),
+                ]),
+                ...unencryptedExtensions.map((e, index) => e.serialize(index < unencryptedExtensions.length - 1)),
+            ]);
+            const serializedCC = this.encapsulated?.serialize(ctx)
+                ?? new Bytes();
+            const plaintextPayload = Bytes.concat([
+                ...encryptedExtensions.map((e, index) => e.serialize(index < encryptedExtensions.length - 1)),
+                serializedCC,
+            ]);
+            // Generate the authentication data for CCM encryption
+            const destinationTag = getDestinationIDTX.call(this);
+            const messageLength = this.computeEncapsulationOverhead()
+                + serializedCC.length;
+            const authData = getAuthenticationData(ctx.ownNodeId, destinationTag, ctx.homeId, messageLength, unencryptedPayload);
+            let key;
+            let iv;
             if (this.isSinglecast()) {
-                this.sequenceNumber = securityManager.nextSequenceNumber(this.nodeId);
+                // Singlecast:
+                // Generate a nonce for encryption, and remember it to attempt decryption
+                // of potential in-flight messages from the target node.
+                iv = securityManager.nextNonce(this.nodeId, true);
+                const { keyCCM } = 
+                // Prefer the overridden security class if it was given
+                this.securityClass != undefined
+                    ? securityManager.getKeysForSecurityClass(this.securityClass)
+                    : securityManager.getKeysForNode(this.nodeId);
+                key = keyCCM;
             }
             else {
-                const groupId = getDestinationIDTX.call(this);
-                this.sequenceNumber = securityManager
-                    .nextMulticastSequenceNumber(groupId);
+                // Multicast:
+                const keyAndIV = securityManager.getMulticastKeyAndIV(destinationTag);
+                key = keyAndIV.key;
+                iv = keyAndIV.iv;
             }
+            const { ciphertext: ciphertextPayload, authTag } = encryptAES128CCM(key, iv, plaintextPayload, authData, SECURITY_S2_AUTH_TAG_LENGTH);
+            // Remember key and IV for debugging purposes
+            this.key = key;
+            this.iv = iv;
+            this.authData = authData;
+            this.authTag = authTag;
+            this.ciphertext = ciphertextPayload;
+            this.payload = Bytes.concat([
+                unencryptedPayload,
+                ciphertextPayload,
+                authTag,
+            ]);
+            return super.serialize(ctx);
         }
-    }
-    encapsulated;
-    extensions;
-    prepareRetransmission() {
-        super.prepareRetransmission();
-        this.sequenceNumber = undefined;
-    }
-    hasMOSExtension() {
-        return this.extensions.some((e) => e instanceof MOSExtension);
-    }
-    /** Returns the Sender's Entropy Input if this command contains an SPAN extension */
-    getSenderEI() {
-        return getSenderEI(this.extensions);
-    }
-    /** Returns the multicast group ID if this command contains an MGRP extension */
-    getMulticastGroupId() {
-        return getMulticastGroupId(this.extensions);
-    }
-    maybeAddSPANExtension(ctx, securityManager) {
-        if (!this.isSinglecast())
-            return;
-        const receiverNodeId = this.nodeId;
-        const spanState = securityManager.getSPANState(receiverNodeId);
-        if (spanState.type === SPANState.None
-            || spanState.type === SPANState.LocalEI) {
-            // Can't do anything here if we don't have the receiver's EI
-            throw new ZWaveError(`Security S2 CC requires the receiver's nonce to be sent!`, ZWaveErrorCodes.Security2CC_NoSPAN);
-        }
-        else if (spanState.type === SPANState.RemoteEI) {
-            // We have the receiver's EI, generate our input and send it over
-            // With both, we can create an SPAN
-            const senderEI = securityManager.generateNonce(undefined);
-            const receiverEI = spanState.receiverEI;
-            // While bootstrapping a node, prefer the temporary key, unless the
-            // specific command specifies a security class
-            if (this.securityClass == undefined
-                && securityManager.tempKeys.has(receiverNodeId)) {
-                securityManager.initializeTempSPAN(receiverNodeId, senderEI, receiverEI);
+        computeEncapsulationOverhead() {
+            // Security S2 adds:
+            // * 1 byte sequence number
+            // * 1 byte control
+            // * N bytes extensions
+            // * SECURITY_S2_AUTH_TAG_LENGTH bytes auth tag
+            const extensionBytes = this.extensions
+                .map((e) => e.computeLength())
+                .reduce((a, b) => a + b, 0);
+            return (super.computeEncapsulationOverhead()
+                + 2
+                + SECURITY_S2_AUTH_TAG_LENGTH
+                + extensionBytes);
+        }
+        toLogEntry(ctx) {
+            const message = {
+                "sequence number": this.sequenceNumber ?? "(not set)",
+            };
+            if (this.extensions.length > 0) {
+                message.extensions = this.extensions
+                    .map((e) => e.toLogEntry())
+                    .join("");
             }
-            else {
-                const securityClass = this.securityClass
-                    ?? ctx.getHighestSecurityClass(receiverNodeId);
-                if (securityClass == undefined) {
-                    throw new ZWaveError("No security class defined for this command!", ZWaveErrorCodes.Security2CC_NoSPAN);
+            // Log the used keys in integration tests
+            if (process.env.NODE_ENV === "test"
+                || process.env.NODE_ENV === "development") {
+                if (this.key) {
+                    message.key = buffer2hex(this.key);
+                }
+                if (this.iv) {
+                    message.IV = buffer2hex(this.iv);
+                }
+                if (this.ciphertext) {
+                    message.ciphertext = buffer2hex(this.ciphertext);
+                }
+                else if (this.plaintext) {
+                    message.plaintext = buffer2hex(this.plaintext);
+                }
+                if (this.authData) {
+                    message["auth data"] = buffer2hex(this.authData);
+                }
+                if (this.authTag) {
+                    message["auth tag"] = buffer2hex(this.authTag);
                 }
-                securityManager.initializeSPAN(receiverNodeId, securityClass, senderEI, receiverEI);
-            }
-            // Add or update the SPAN extension
-            let spanExtension = this.extensions.find((e) => e instanceof SPANExtension);
-            if (spanExtension) {
-                spanExtension.senderEI = senderEI;
             }
-            else {
-                spanExtension = new SPANExtension({ senderEI });
-                this.extensions.push(spanExtension);
+            if (this.securityClass != undefined) {
+                message["security class"] = getEnumMemberName(SecurityClass, this.securityClass);
             }
+            return {
+                ...super.toLogEntry(ctx),
+                message,
+            };
         }
-    }
-    serialize(ctx) {
-        const securityManager = assertSecurityTX(ctx, this.nodeId);
-        this.ensureSequenceNumber(securityManager);
-        // Include Sender EI in the command if we only have the receiver's EI
-        this.maybeAddSPANExtension(ctx, securityManager);
-        const unencryptedExtensions = this.extensions.filter((e) => !e.isEncrypted());
-        const encryptedExtensions = this.extensions.filter((e) => e.isEncrypted());
-        const unencryptedPayload = Bytes.concat([
-            Bytes.from([
-                this.sequenceNumber,
-                (encryptedExtensions.length > 0 ? 0b10 : 0)
-                    | (unencryptedExtensions.length > 0 ? 1 : 0),
-            ]),
-            ...unencryptedExtensions.map((e, index) => e.serialize(index < unencryptedExtensions.length - 1)),
-        ]);
-        const serializedCC = this.encapsulated?.serialize(ctx)
-            ?? new Bytes();
-        const plaintextPayload = Bytes.concat([
-            ...encryptedExtensions.map((e, index) => e.serialize(index < encryptedExtensions.length - 1)),
-            serializedCC,
-        ]);
-        // Generate the authentication data for CCM encryption
-        const destinationTag = getDestinationIDTX.call(this);
-        const messageLength = this.computeEncapsulationOverhead()
-            + serializedCC.length;
-        const authData = getAuthenticationData(ctx.ownNodeId, destinationTag, ctx.homeId, messageLength, unencryptedPayload);
-        let key;
-        let iv;
-        if (this.isSinglecast()) {
-            // Singlecast:
-            // Generate a nonce for encryption, and remember it to attempt decryption
-            // of potential in-flight messages from the target node.
-            iv = securityManager.nextNonce(this.nodeId, true);
-            const { keyCCM } = 
-            // Prefer the overridden security class if it was given
-            this.securityClass != undefined
-                ? securityManager.getKeysForSecurityClass(this.securityClass)
-                : securityManager.getKeysForNode(this.nodeId);
-            key = keyCCM;
+    };
+    return Security2CCMessageEncapsulation = _classThis;
+})();
+export { Security2CCMessageEncapsulation };
+let Security2CCNonceReport = (() => {
+    let _classDecorators = [CCCommand(Security2Command.NonceReport)];
+    let _classDescriptor;
+    let _classExtraInitializers = [];
+    let _classThis;
+    let _classSuper = Security2CC;
+    var Security2CCNonceReport = class extends _classSuper {
+        static { _classThis = this; }
+        static {
+            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
+            __esDecorate(null, _classDescriptor = { value: _classThis }, _classDecorators, { kind: "class", name: _classThis.name, metadata: _metadata }, null, _classExtraInitializers);
+            Security2CCNonceReport = _classThis = _classDescriptor.value;
+            if (_metadata) Object.defineProperty(_classThis, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+            __runInitializers(_classThis, _classExtraInitializers);
         }
-        else {
-            // Multicast:
-            const keyAndIV = securityManager.getMulticastKeyAndIV(destinationTag);
-            key = keyAndIV.key;
-            iv = keyAndIV.iv;
-        }
-        const { ciphertext: ciphertextPayload, authTag } = encryptAES128CCM(key, iv, plaintextPayload, authData, SECURITY_S2_AUTH_TAG_LENGTH);
-        // Remember key and IV for debugging purposes
-        this.key = key;
-        this.iv = iv;
-        this.authData = authData;
-        this.authTag = authTag;
-        this.ciphertext = ciphertextPayload;
-        this.payload = Bytes.concat([
-            unencryptedPayload,
-            ciphertextPayload,
-            authTag,
-        ]);
-        return super.serialize(ctx);
-    }
-    computeEncapsulationOverhead() {
-        // Security S2 adds:
-        // * 1 byte sequence number
-        // * 1 byte control
-        // * N bytes extensions
-        // * SECURITY_S2_AUTH_TAG_LENGTH bytes auth tag
-        const extensionBytes = this.extensions
-            .map((e) => e.computeLength())
-            .reduce((a, b) => a + b, 0);
-        return (super.computeEncapsulationOverhead()
-            + 2
-            + SECURITY_S2_AUTH_TAG_LENGTH
-            + extensionBytes);
-    }
-    toLogEntry(ctx) {
-        const message = {
-            "sequence number": this.sequenceNumber ?? "(not set)",
-        };
-        if (this.extensions.length > 0) {
-            message.extensions = this.extensions
-                .map((e) => e.toLogEntry())
-                .join("");
-        }
-        // Log the used keys in integration tests
-        if (process.env.NODE_ENV === "test"
-            || process.env.NODE_ENV === "development") {
-            if (this.key) {
-                message.key = buffer2hex(this.key);
+        constructor(options) {
+            super(options);
+            this.SOS = options.SOS;
+            this.MOS = options.MOS;
+            this.sequenceNumber = options.sequenceNumber;
+            if (options.SOS)
+                this.receiverEI = options.receiverEI;
+        }
+        static from(raw, ctx) {
+            // Make sure that we can send/receive secure commands
+            const securityManager = assertSecurityRX(ctx);
+            validatePayload(raw.payload.length >= 2);
+            const sequenceNumber = raw.payload[0];
+            // Don't accept duplicate commands
+            validateSequenceNumber(securityManager, ctx.sourceNodeId, sequenceNumber);
+            const MOS = !!(raw.payload[1] & 0b10);
+            const SOS = !!(raw.payload[1] & 0b1);
+            if (SOS) {
+                // If the SOS flag is set, the REI field MUST be included in the command
+                validatePayload(raw.payload.length >= 18);
+                const receiverEI = raw.payload.subarray(2, 18);
+                // In that case we also need to store it, so the next sent command
+                // can use it for encryption
+                securityManager.storeRemoteEI(ctx.sourceNodeId, receiverEI);
+                return new this({
+                    nodeId: ctx.sourceNodeId,
+                    sequenceNumber,
+                    MOS,
+                    SOS,
+                    receiverEI,
+                });
             }
-            if (this.iv) {
-                message.IV = buffer2hex(this.iv);
+            else if (MOS) {
+                return new this({
+                    nodeId: ctx.sourceNodeId,
+                    sequenceNumber,
+                    MOS,
+                    SOS: false,
+                });
             }
-            if (this.ciphertext) {
-                message.ciphertext = buffer2hex(this.ciphertext);
+            else {
+                validatePayload.fail("Either MOS or SOS must be set");
             }
-            else if (this.plaintext) {
-                message.plaintext = buffer2hex(this.plaintext);
+        }
+        sequenceNumber;
+        ensureSequenceNumber(securityManager) {
+            if (this.sequenceNumber == undefined) {
+                this.sequenceNumber = securityManager.nextSequenceNumber(this.nodeId);
             }
-            if (this.authData) {
-                message["auth data"] = buffer2hex(this.authData);
+        }
+        SOS;
+        MOS;
+        receiverEI;
+        serialize(ctx) {
+            const securityManager = assertSecurityTX(ctx, this.nodeId);
+            this.ensureSequenceNumber(securityManager);
+            this.payload = Bytes.from([
+                this.sequenceNumber,
+                (this.MOS ? 0b10 : 0) + (this.SOS ? 0b1 : 0),
+            ]);
+            if (this.SOS) {
+                this.payload = Bytes.concat([this.payload, this.receiverEI]);
             }
-            if (this.authTag) {
-                message["auth tag"] = buffer2hex(this.authTag);
+            return super.serialize(ctx);
+        }
+        toLogEntry(ctx) {
+            const message = {
+                "sequence number": this.sequenceNumber ?? "(not set)",
+                SOS: this.SOS,
+                MOS: this.MOS,
+            };
+            if (this.receiverEI) {
+                message["receiver entropy"] = buffer2hex(this.receiverEI);
             }
+            return {
+                ...super.toLogEntry(ctx),
+                message,
+            };
         }
-        if (this.securityClass != undefined) {
-            message["security class"] = getEnumMemberName(SecurityClass, this.securityClass);
+    };
+    return Security2CCNonceReport = _classThis;
+})();
+export { Security2CCNonceReport };
+let Security2CCNonceGet = (() => {
+    let _classDecorators = [CCCommand(Security2Command.NonceGet), expectedCCResponse(Security2CCNonceReport)];
+    let _classDescriptor;
+    let _classExtraInitializers = [];
+    let _classThis;
+    let _classSuper = Security2CC;
+    var Security2CCNonceGet = class extends _classSuper {
+        static { _classThis = this; }
+        static {
+            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
+            __esDecorate(null, _classDescriptor = { value: _classThis }, _classDecorators, { kind: "class", name: _classThis.name, metadata: _metadata }, null, _classExtraInitializers);
+            Security2CCNonceGet = _classThis = _classDescriptor.value;
+            if (_metadata) Object.defineProperty(_classThis, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+            __runInitializers(_classThis, _classExtraInitializers);
         }
-        return {
-            ...super.toLogEntry(ctx),
-            message,
-        };
-    }
-};
-Security2CCMessageEncapsulation = Security2CCMessageEncapsulation_1 = __decorate([
-    CCCommand(Security2Command.MessageEncapsulation),
-    expectedCCResponse(getCCResponseForMessageEncapsulation, testCCResponseForMessageEncapsulation)
-], Security2CCMessageEncapsulation);
-export { Security2CCMessageEncapsulation };
-let Security2CCNonceReport = Security2CCNonceReport_1 = class Security2CCNonceReport extends Security2CC {
-    constructor(options) {
-        super(options);
-        this.SOS = options.SOS;
-        this.MOS = options.MOS;
-        this.sequenceNumber = options.sequenceNumber;
-        if (options.SOS)
-            this.receiverEI = options.receiverEI;
-    }
-    static from(raw, ctx) {
-        // Make sure that we can send/receive secure commands
-        const securityManager = assertSecurityRX(ctx);
-        validatePayload(raw.payload.length >= 2);
-        const sequenceNumber = raw.payload[0];
-        // Don't accept duplicate commands
-        validateSequenceNumber(securityManager, ctx.sourceNodeId, sequenceNumber);
-        const MOS = !!(raw.payload[1] & 0b10);
-        const SOS = !!(raw.payload[1] & 0b1);
-        if (SOS) {
-            // If the SOS flag is set, the REI field MUST be included in the command
-            validatePayload(raw.payload.length >= 18);
-            const receiverEI = raw.payload.subarray(2, 18);
-            // In that case we also need to store it, so the next sent command
-            // can use it for encryption
-            securityManager.storeRemoteEI(ctx.sourceNodeId, receiverEI);
-            return new Security2CCNonceReport_1({
-                nodeId: ctx.sourceNodeId,
-                sequenceNumber,
-                MOS,
-                SOS,
-                receiverEI,
-            });
+        // TODO: A node sending this command MUST accept a delay up to <Previous Round-trip-time to peer node> +
+        // 250 ms before receiving the Security 2 Nonce Report Command.
+        constructor(options) {
+            super(options);
+            this.sequenceNumber = options.sequenceNumber;
         }
-        else if (MOS) {
-            return new Security2CCNonceReport_1({
+        static from(raw, ctx) {
+            const securityManager = assertSecurityRX(ctx);
+            validatePayload(raw.payload.length >= 1);
+            const sequenceNumber = raw.payload[0];
+            // Don't accept duplicate commands
+            validateSequenceNumber(securityManager, ctx.sourceNodeId, sequenceNumber);
+            return new this({
                 nodeId: ctx.sourceNodeId,
                 sequenceNumber,
-                MOS,
-                SOS: false,
             });
         }
-        else {
-            validatePayload.fail("Either MOS or SOS must be set");
-        }
-    }
-    sequenceNumber;
-    ensureSequenceNumber(securityManager) {
-        if (this.sequenceNumber == undefined) {
-            this.sequenceNumber = securityManager.nextSequenceNumber(this.nodeId);
+        sequenceNumber;
+        ensureSequenceNumber(securityManager) {
+            if (this.sequenceNumber == undefined) {
+                this.sequenceNumber = securityManager.nextSequenceNumber(this.nodeId);
+            }
         }
-    }
-    SOS;
-    MOS;
-    receiverEI;
-    serialize(ctx) {
-        const securityManager = assertSecurityTX(ctx, this.nodeId);
-        this.ensureSequenceNumber(securityManager);
-        this.payload = Bytes.from([
-            this.sequenceNumber,
-            (this.MOS ? 0b10 : 0) + (this.SOS ? 0b1 : 0),
-        ]);
-        if (this.SOS) {
-            this.payload = Bytes.concat([this.payload, this.receiverEI]);
-        }
-        return super.serialize(ctx);
-    }
-    toLogEntry(ctx) {
-        const message = {
-            "sequence number": this.sequenceNumber ?? "(not set)",
-            SOS: this.SOS,
-            MOS: this.MOS,
-        };
-        if (this.receiverEI) {
-            message["receiver entropy"] = buffer2hex(this.receiverEI);
+        serialize(ctx) {
+            const securityManager = assertSecurityTX(ctx, this.nodeId);
+            this.ensureSequenceNumber(securityManager);
+            this.payload = Bytes.from([this.sequenceNumber]);
+            return super.serialize(ctx);
         }
-        return {
-            ...super.toLogEntry(ctx),
-            message,
-        };
-    }
-};
-Security2CCNonceReport = Security2CCNonceReport_1 = __decorate([
-    CCCommand(Security2Command.NonceReport)
-], Security2CCNonceReport);
-export { Security2CCNonceReport };
-let Security2CCNonceGet = Security2CCNonceGet_1 = class Security2CCNonceGet extends Security2CC {
-    // TODO: A node sending this command MUST accept a delay up to <Previous Round-trip-time to peer node> +
-    // 250 ms before receiving the Security 2 Nonce Report Command.
-    constructor(options) {
-        super(options);
-        this.sequenceNumber = options.sequenceNumber;
-    }
-    static from(raw, ctx) {
-        const securityManager = assertSecurityRX(ctx);
-        validatePayload(raw.payload.length >= 1);
-        const sequenceNumber = raw.payload[0];
-        // Don't accept duplicate commands
-        validateSequenceNumber(securityManager, ctx.sourceNodeId, sequenceNumber);
-        return new Security2CCNonceGet_1({
-            nodeId: ctx.sourceNodeId,
-            sequenceNumber,
-        });
-    }
-    sequenceNumber;
-    ensureSequenceNumber(securityManager) {
-        if (this.sequenceNumber == undefined) {
-            this.sequenceNumber = securityManager.nextSequenceNumber(this.nodeId);
+        toLogEntry(ctx) {
+            return {
+                ...super.toLogEntry(ctx),
+                message: {
+                    "sequence number": this.sequenceNumber ?? "(not set)",
+                },
+            };
         }
-    }
-    serialize(ctx) {
-        const securityManager = assertSecurityTX(ctx, this.nodeId);
-        this.ensureSequenceNumber(securityManager);
-        this.payload = Bytes.from([this.sequenceNumber]);
-        return super.serialize(ctx);
-    }
-    toLogEntry(ctx) {
-        return {
-            ...super.toLogEntry(ctx),
-            message: {
-                "sequence number": this.sequenceNumber ?? "(not set)",
-            },
-        };
-    }
-};
-Security2CCNonceGet = Security2CCNonceGet_1 = __decorate([
-    CCCommand(Security2Command.NonceGet),
-    expectedCCResponse(Security2CCNonceReport)
-], Security2CCNonceGet);
+    };
+    return Security2CCNonceGet = _classThis;
+})();
 export { Security2CCNonceGet };
-let Security2CCKEXReport = Security2CCKEXReport_1 = class Security2CCKEXReport extends Security2CC {
-    constructor(options) {
-        super(options);
-        this.requestCSA = options.requestCSA;
-        this.echo = options.echo;
-        this._reserved = options._reserved ?? 0;
-        this.supportedKEXSchemes = options.supportedKEXSchemes;
-        this.supportedECDHProfiles = options.supportedECDHProfiles;
-        this.requestedKeys = options.requestedKeys;
-    }
-    static from(raw, ctx) {
-        validatePayload(raw.payload.length >= 4);
-        const requestCSA = !!(raw.payload[0] & 0b10);
-        const echo = !!(raw.payload[0] & 0b1);
-        // Remember the reserved bits for the echo
-        const _reserved = raw.payload[0] & 0b1111_1100;
-        // The bit mask starts at 0, but bit 0 is not used
-        const supportedKEXSchemes = parseBitMask(raw.payload.subarray(1, 2), 0).filter((s) => s !== 0);
-        const supportedECDHProfiles = parseBitMask(raw.payload.subarray(2, 3), ECDHProfiles.Curve25519);
-        const requestedKeys = parseBitMask(raw.payload.subarray(3, 4), SecurityClass.S2_Unauthenticated);
-        return new Security2CCKEXReport_1({
-            nodeId: ctx.sourceNodeId,
-            requestCSA,
-            echo,
-            _reserved,
-            supportedKEXSchemes,
-            supportedECDHProfiles,
-            requestedKeys,
-        });
-    }
-    _reserved;
-    requestCSA;
-    echo;
-    supportedKEXSchemes;
-    supportedECDHProfiles;
-    requestedKeys;
-    serialize(ctx) {
-        this.payload = Bytes.concat([
-            Bytes.from([
-                this._reserved
-                    + (this.requestCSA ? 0b10 : 0)
-                    + (this.echo ? 0b1 : 0),
-            ]),
+let Security2CCKEXReport = (() => {
+    let _classDecorators = [CCCommand(Security2Command.KEXReport)];
+    let _classDescriptor;
+    let _classExtraInitializers = [];
+    let _classThis;
+    let _classSuper = Security2CC;
+    var Security2CCKEXReport = class extends _classSuper {
+        static { _classThis = this; }
+        static {
+            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
+            __esDecorate(null, _classDescriptor = { value: _classThis }, _classDecorators, { kind: "class", name: _classThis.name, metadata: _metadata }, null, _classExtraInitializers);
+            Security2CCKEXReport = _classThis = _classDescriptor.value;
+            if (_metadata) Object.defineProperty(_classThis, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+            __runInitializers(_classThis, _classExtraInitializers);
+        }
+        constructor(options) {
+            super(options);
+            this.requestCSA = options.requestCSA;
+            this.echo = options.echo;
+            this._reserved = options._reserved ?? 0;
+            this.supportedKEXSchemes = options.supportedKEXSchemes;
+            this.supportedECDHProfiles = options.supportedECDHProfiles;
+            this.requestedKeys = options.requestedKeys;
+        }
+        static from(raw, ctx) {
+            validatePayload(raw.payload.length >= 4);
+            const requestCSA = !!(raw.payload[0] & 0b10);
+            const echo = !!(raw.payload[0] & 0b1);
+            // Remember the reserved bits for the echo
+            const _reserved = raw.payload[0] & 0b1111_1100;
             // The bit mask starts at 0, but bit 0 is not used
-            encodeBitMask(this.supportedKEXSchemes, 7, 0),
-            encodeBitMask(this.supportedECDHProfiles, 7, ECDHProfiles.Curve25519),
-            encodeBitMask(this.requestedKeys, SecurityClass.S0_Legacy, SecurityClass.S2_Unauthenticated),
-        ]);
-        return super.serialize(ctx);
-    }
-    toLogEntry(ctx) {
-        return {
-            ...super.toLogEntry(ctx),
-            message: {
-                echo: this.echo,
-                "supported schemes": this.supportedKEXSchemes
-                    .map((s) => `\n· ${getEnumMemberName(KEXSchemes, s)}`)
-                    .join(""),
-                "supported ECDH profiles": this.supportedECDHProfiles
-                    .map((s) => `\n· ${getEnumMemberName(ECDHProfiles, s)}`)
-                    .join(""),
-                "CSA requested": this.requestCSA,
-                "requested security classes": this.requestedKeys
-                    .map((s) => `\n· ${getEnumMemberName(SecurityClass, s)}`)
-                    .join(""),
-            },
-        };
-    }
-};
-Security2CCKEXReport = Security2CCKEXReport_1 = __decorate([
-    CCCommand(Security2Command.KEXReport)
-], Security2CCKEXReport);
+            const supportedKEXSchemes = parseBitMask(raw.payload.subarray(1, 2), 0).filter((s) => s !== 0);
+            const supportedECDHProfiles = parseBitMask(raw.payload.subarray(2, 3), ECDHProfiles.Curve25519);
+            const requestedKeys = parseBitMask(raw.payload.subarray(3, 4), SecurityClass.S2_Unauthenticated);
+            return new this({
+                nodeId: ctx.sourceNodeId,
+                requestCSA,
+                echo,
+                _reserved,
+                supportedKEXSchemes,
+                supportedECDHProfiles,
+                requestedKeys,
+            });
+        }
+        _reserved;
+        requestCSA;
+        echo;
+        supportedKEXSchemes;
+        supportedECDHProfiles;
+        requestedKeys;
+        serialize(ctx) {
+            this.payload = Bytes.concat([
+                Bytes.from([
+                    this._reserved
+                        + (this.requestCSA ? 0b10 : 0)
+                        + (this.echo ? 0b1 : 0),
+                ]),
+                // The bit mask starts at 0, but bit 0 is not used
+                encodeBitMask(this.supportedKEXSchemes, 7, 0),
+                encodeBitMask(this.supportedECDHProfiles, 7, ECDHProfiles.Curve25519),
+                encodeBitMask(this.requestedKeys, SecurityClass.S0_Legacy, SecurityClass.S2_Unauthenticated),
+            ]);
+            return super.serialize(ctx);
+        }
+        toLogEntry(ctx) {
+            return {
+                ...super.toLogEntry(ctx),
+                message: {
+                    echo: this.echo,
+                    "supported schemes": this.supportedKEXSchemes
+                        .map((s) => `\n· ${getEnumMemberName(KEXSchemes, s)}`)
+                        .join(""),
+                    "supported ECDH profiles": this.supportedECDHProfiles
+                        .map((s) => `\n· ${getEnumMemberName(ECDHProfiles, s)}`)
+                        .join(""),
+                    "CSA requested": this.requestCSA,
+                    "requested security classes": this.requestedKeys
+                        .map((s) => `\n· ${getEnumMemberName(SecurityClass, s)}`)
+                        .join(""),
+                },
+            };
+        }
+    };
+    return Security2CCKEXReport = _classThis;
+})();
 export { Security2CCKEXReport };
-let Security2CCKEXGet = class Security2CCKEXGet extends Security2CC {
-};
-Security2CCKEXGet = __decorate([
-    CCCommand(Security2Command.KEXGet),
-    expectedCCResponse(Security2CCKEXReport)
-], Security2CCKEXGet);
+let Security2CCKEXGet = (() => {
+    let _classDecorators = [CCCommand(Security2Command.KEXGet), expectedCCResponse(Security2CCKEXReport)];
+    let _classDescriptor;
+    let _classExtraInitializers = [];
+    let _classThis;
+    let _classSuper = Security2CC;
+    var Security2CCKEXGet = class extends _classSuper {
+        static { _classThis = this; }
+        static {
+            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
+            __esDecorate(null, _classDescriptor = { value: _classThis }, _classDecorators, { kind: "class", name: _classThis.name, metadata: _metadata }, null, _classExtraInitializers);
+            Security2CCKEXGet = _classThis = _classDescriptor.value;
+            if (_metadata) Object.defineProperty(_classThis, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+            __runInitializers(_classThis, _classExtraInitializers);
+        }
+    };
+    return Security2CCKEXGet = _classThis;
+})();
 export { Security2CCKEXGet };
 function getExpectedResponseForKEXSet(sent) {
     if (sent.echo) {
@@ -1508,307 +1622,420 @@ function testExpectedResponseForKEXSet(sent, received) {
     }
     return false;
 }
-let Security2CCKEXSet = Security2CCKEXSet_1 = class Security2CCKEXSet extends Security2CC {
-    constructor(options) {
-        super(options);
-        this.permitCSA = options.permitCSA;
-        this.echo = options.echo;
-        this._reserved = options._reserved ?? 0;
-        this.selectedKEXScheme = options.selectedKEXScheme;
-        this.selectedECDHProfile = options.selectedECDHProfile;
-        this.grantedKeys = options.grantedKeys;
-    }
-    static from(raw, ctx) {
-        validatePayload(raw.payload.length >= 4);
-        const _reserved = raw.payload[0] & 0b1111_1100;
-        const permitCSA = !!(raw.payload[0] & 0b10);
-        const echo = !!(raw.payload[0] & 0b1);
-        // The bit mask starts at 0, but bit 0 is not used
-        const selectedKEXSchemes = parseBitMask(raw.payload.subarray(1, 2), 0).filter((s) => s !== 0);
-        validatePayload(selectedKEXSchemes.length === 1);
-        const selectedKEXScheme = selectedKEXSchemes[0];
-        const selectedECDHProfiles = parseBitMask(raw.payload.subarray(2, 3), ECDHProfiles.Curve25519);
-        validatePayload(selectedECDHProfiles.length === 1);
-        const selectedECDHProfile = selectedECDHProfiles[0];
-        const grantedKeys = parseBitMask(raw.payload.subarray(3, 4), SecurityClass.S2_Unauthenticated);
-        return new Security2CCKEXSet_1({
-            nodeId: ctx.sourceNodeId,
-            _reserved,
-            permitCSA,
-            echo,
-            selectedKEXScheme,
-            selectedECDHProfile,
-            grantedKeys,
-        });
-    }
-    _reserved;
-    permitCSA;
-    echo;
-    selectedKEXScheme;
-    selectedECDHProfile;
-    grantedKeys;
-    serialize(ctx) {
-        this.payload = Bytes.concat([
-            Bytes.from([
-                this._reserved
-                    + (this.permitCSA ? 0b10 : 0)
-                    + (this.echo ? 0b1 : 0),
-            ]),
+let Security2CCKEXSet = (() => {
+    let _classDecorators = [CCCommand(Security2Command.KEXSet), expectedCCResponse(getExpectedResponseForKEXSet, testExpectedResponseForKEXSet)];
+    let _classDescriptor;
+    let _classExtraInitializers = [];
+    let _classThis;
+    let _classSuper = Security2CC;
+    var Security2CCKEXSet = class extends _classSuper {
+        static { _classThis = this; }
+        static {
+            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
+            __esDecorate(null, _classDescriptor = { value: _classThis }, _classDecorators, { kind: "class", name: _classThis.name, metadata: _metadata }, null, _classExtraInitializers);
+            Security2CCKEXSet = _classThis = _classDescriptor.value;
+            if (_metadata) Object.defineProperty(_classThis, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+            __runInitializers(_classThis, _classExtraInitializers);
+        }
+        constructor(options) {
+            super(options);
+            this.permitCSA = options.permitCSA;
+            this.echo = options.echo;
+            this._reserved = options._reserved ?? 0;
+            this.selectedKEXScheme = options.selectedKEXScheme;
+            this.selectedECDHProfile = options.selectedECDHProfile;
+            this.grantedKeys = options.grantedKeys;
+        }
+        static from(raw, ctx) {
+            validatePayload(raw.payload.length >= 4);
+            const _reserved = raw.payload[0] & 0b1111_1100;
+            const permitCSA = !!(raw.payload[0] & 0b10);
+            const echo = !!(raw.payload[0] & 0b1);
             // The bit mask starts at 0, but bit 0 is not used
-            encodeBitMask([this.selectedKEXScheme], 7, 0),
-            encodeBitMask([this.selectedECDHProfile], 7, ECDHProfiles.Curve25519),
-            encodeBitMask(this.grantedKeys, SecurityClass.S0_Legacy, SecurityClass.S2_Unauthenticated),
-        ]);
-        return super.serialize(ctx);
-    }
-    toLogEntry(ctx) {
-        return {
-            ...super.toLogEntry(ctx),
-            message: {
-                echo: this.echo,
-                "selected scheme": getEnumMemberName(KEXSchemes, this.selectedKEXScheme),
-                "selected ECDH profile": getEnumMemberName(ECDHProfiles, this.selectedECDHProfile),
-                "CSA permitted": this.permitCSA,
-                "granted security classes": this.grantedKeys
-                    .map((s) => `\n· ${getEnumMemberName(SecurityClass, s)}`)
-                    .join(""),
-            },
-        };
-    }
-};
-Security2CCKEXSet = Security2CCKEXSet_1 = __decorate([
-    CCCommand(Security2Command.KEXSet),
-    expectedCCResponse(getExpectedResponseForKEXSet, testExpectedResponseForKEXSet)
-], Security2CCKEXSet);
+            const selectedKEXSchemes = parseBitMask(raw.payload.subarray(1, 2), 0).filter((s) => s !== 0);
+            validatePayload(selectedKEXSchemes.length === 1);
+            const selectedKEXScheme = selectedKEXSchemes[0];
+            const selectedECDHProfiles = parseBitMask(raw.payload.subarray(2, 3), ECDHProfiles.Curve25519);
+            validatePayload(selectedECDHProfiles.length === 1);
+            const selectedECDHProfile = selectedECDHProfiles[0];
+            const grantedKeys = parseBitMask(raw.payload.subarray(3, 4), SecurityClass.S2_Unauthenticated);
+            return new this({
+                nodeId: ctx.sourceNodeId,
+                _reserved,
+                permitCSA,
+                echo,
+                selectedKEXScheme,
+                selectedECDHProfile,
+                grantedKeys,
+            });
+        }
+        _reserved;
+        permitCSA;
+        echo;
+        selectedKEXScheme;
+        selectedECDHProfile;
+        grantedKeys;
+        serialize(ctx) {
+            this.payload = Bytes.concat([
+                Bytes.from([
+                    this._reserved
+                        + (this.permitCSA ? 0b10 : 0)
+                        + (this.echo ? 0b1 : 0),
+                ]),
+                // The bit mask starts at 0, but bit 0 is not used
+                encodeBitMask([this.selectedKEXScheme], 7, 0),
+                encodeBitMask([this.selectedECDHProfile], 7, ECDHProfiles.Curve25519),
+                encodeBitMask(this.grantedKeys, SecurityClass.S0_Legacy, SecurityClass.S2_Unauthenticated),
+            ]);
+            return super.serialize(ctx);
+        }
+        toLogEntry(ctx) {
+            return {
+                ...super.toLogEntry(ctx),
+                message: {
+                    echo: this.echo,
+                    "selected scheme": getEnumMemberName(KEXSchemes, this.selectedKEXScheme),
+                    "selected ECDH profile": getEnumMemberName(ECDHProfiles, this.selectedECDHProfile),
+                    "CSA permitted": this.permitCSA,
+                    "granted security classes": this.grantedKeys
+                        .map((s) => `\n· ${getEnumMemberName(SecurityClass, s)}`)
+                        .join(""),
+                },
+            };
+        }
+    };
+    return Security2CCKEXSet = _classThis;
+})();
 export { Security2CCKEXSet };
-let Security2CCKEXFail = Security2CCKEXFail_1 = class Security2CCKEXFail extends Security2CC {
-    constructor(options) {
-        super(options);
-        this.failType = options.failType;
-    }
-    static from(raw, ctx) {
-        validatePayload(raw.payload.length >= 1);
-        const failType = raw.payload[0];
-        return new Security2CCKEXFail_1({
-            nodeId: ctx.sourceNodeId,
-            failType,
-        });
-    }
-    failType;
-    serialize(ctx) {
-        this.payload = Bytes.from([this.failType]);
-        return super.serialize(ctx);
-    }
-    toLogEntry(ctx) {
-        return {
-            ...super.toLogEntry(ctx),
-            message: { reason: getEnumMemberName(KEXFailType, this.failType) },
-        };
-    }
-};
-Security2CCKEXFail = Security2CCKEXFail_1 = __decorate([
-    CCCommand(Security2Command.KEXFail)
-], Security2CCKEXFail);
+let Security2CCKEXFail = (() => {
+    let _classDecorators = [CCCommand(Security2Command.KEXFail)];
+    let _classDescriptor;
+    let _classExtraInitializers = [];
+    let _classThis;
+    let _classSuper = Security2CC;
+    var Security2CCKEXFail = class extends _classSuper {
+        static { _classThis = this; }
+        static {
+            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
+            __esDecorate(null, _classDescriptor = { value: _classThis }, _classDecorators, { kind: "class", name: _classThis.name, metadata: _metadata }, null, _classExtraInitializers);
+            Security2CCKEXFail = _classThis = _classDescriptor.value;
+            if (_metadata) Object.defineProperty(_classThis, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+            __runInitializers(_classThis, _classExtraInitializers);
+        }
+        constructor(options) {
+            super(options);
+            this.failType = options.failType;
+        }
+        static from(raw, ctx) {
+            validatePayload(raw.payload.length >= 1);
+            const failType = raw.payload[0];
+            return new this({
+                nodeId: ctx.sourceNodeId,
+                failType,
+            });
+        }
+        failType;
+        serialize(ctx) {
+            this.payload = Bytes.from([this.failType]);
+            return super.serialize(ctx);
+        }
+        toLogEntry(ctx) {
+            return {
+                ...super.toLogEntry(ctx),
+                message: { reason: getEnumMemberName(KEXFailType, this.failType) },
+            };
+        }
+    };
+    return Security2CCKEXFail = _classThis;
+})();
 export { Security2CCKEXFail };
-let Security2CCPublicKeyReport = Security2CCPublicKeyReport_1 = class Security2CCPublicKeyReport extends Security2CC {
-    constructor(options) {
-        super(options);
-        this.includingNode = options.includingNode;
-        this.publicKey = options.publicKey;
-    }
-    static from(raw, ctx) {
-        validatePayload(raw.payload.length >= 17);
-        const includingNode = !!(raw.payload[0] & 0b1);
-        const publicKey = raw.payload.subarray(1);
-        return new Security2CCPublicKeyReport_1({
-            nodeId: ctx.sourceNodeId,
-            includingNode,
-            publicKey,
-        });
-    }
-    includingNode;
-    publicKey;
-    serialize(ctx) {
-        this.payload = Bytes.concat([
-            Bytes.from([this.includingNode ? 1 : 0]),
-            this.publicKey,
-        ]);
-        return super.serialize(ctx);
-    }
-    toLogEntry(ctx) {
-        return {
-            ...super.toLogEntry(ctx),
-            message: {
-                "is including node": this.includingNode,
-                "public key": buffer2hex(this.publicKey),
-            },
-        };
-    }
-};
-Security2CCPublicKeyReport = Security2CCPublicKeyReport_1 = __decorate([
-    CCCommand(Security2Command.PublicKeyReport)
-], Security2CCPublicKeyReport);
+let Security2CCPublicKeyReport = (() => {
+    let _classDecorators = [CCCommand(Security2Command.PublicKeyReport)];
+    let _classDescriptor;
+    let _classExtraInitializers = [];
+    let _classThis;
+    let _classSuper = Security2CC;
+    var Security2CCPublicKeyReport = class extends _classSuper {
+        static { _classThis = this; }
+        static {
+            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
+            __esDecorate(null, _classDescriptor = { value: _classThis }, _classDecorators, { kind: "class", name: _classThis.name, metadata: _metadata }, null, _classExtraInitializers);
+            Security2CCPublicKeyReport = _classThis = _classDescriptor.value;
+            if (_metadata) Object.defineProperty(_classThis, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+            __runInitializers(_classThis, _classExtraInitializers);
+        }
+        constructor(options) {
+            super(options);
+            this.includingNode = options.includingNode;
+            this.publicKey = options.publicKey;
+        }
+        static from(raw, ctx) {
+            validatePayload(raw.payload.length >= 17);
+            const includingNode = !!(raw.payload[0] & 0b1);
+            const publicKey = raw.payload.subarray(1);
+            return new this({
+                nodeId: ctx.sourceNodeId,
+                includingNode,
+                publicKey,
+            });
+        }
+        includingNode;
+        publicKey;
+        serialize(ctx) {
+            this.payload = Bytes.concat([
+                Bytes.from([this.includingNode ? 1 : 0]),
+                this.publicKey,
+            ]);
+            return super.serialize(ctx);
+        }
+        toLogEntry(ctx) {
+            return {
+                ...super.toLogEntry(ctx),
+                message: {
+                    "is including node": this.includingNode,
+                    "public key": buffer2hex(this.publicKey),
+                },
+            };
+        }
+    };
+    return Security2CCPublicKeyReport = _classThis;
+})();
 export { Security2CCPublicKeyReport };
-let Security2CCNetworkKeyReport = Security2CCNetworkKeyReport_1 = class Security2CCNetworkKeyReport extends Security2CC {
-    constructor(options) {
-        super(options);
-        this.grantedKey = options.grantedKey;
-        this.networkKey = options.networkKey;
-    }
-    static from(raw, ctx) {
-        validatePayload(raw.payload.length >= 17);
-        const grantedKey = bitMaskToSecurityClass(raw.payload, 0);
-        const networkKey = raw.payload.subarray(1, 17);
-        return new Security2CCNetworkKeyReport_1({
-            nodeId: ctx.sourceNodeId,
-            grantedKey,
-            networkKey,
-        });
-    }
-    grantedKey;
-    networkKey;
-    serialize(ctx) {
-        this.payload = Bytes.concat([
-            securityClassToBitMask(this.grantedKey),
-            this.networkKey,
-        ]);
-        return super.serialize(ctx);
-    }
-    toLogEntry(ctx) {
-        return {
-            ...super.toLogEntry(ctx),
-            message: {
-                "security class": getEnumMemberName(SecurityClass, this.grantedKey),
-                // This shouldn't be logged, so users can safely post their logs online
-                // "network key": buffer2hex(this.networkKey),
-            },
-        };
-    }
-};
-Security2CCNetworkKeyReport = Security2CCNetworkKeyReport_1 = __decorate([
-    CCCommand(Security2Command.NetworkKeyReport)
-], Security2CCNetworkKeyReport);
+let Security2CCNetworkKeyReport = (() => {
+    let _classDecorators = [CCCommand(Security2Command.NetworkKeyReport)];
+    let _classDescriptor;
+    let _classExtraInitializers = [];
+    let _classThis;
+    let _classSuper = Security2CC;
+    var Security2CCNetworkKeyReport = class extends _classSuper {
+        static { _classThis = this; }
+        static {
+            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
+            __esDecorate(null, _classDescriptor = { value: _classThis }, _classDecorators, { kind: "class", name: _classThis.name, metadata: _metadata }, null, _classExtraInitializers);
+            Security2CCNetworkKeyReport = _classThis = _classDescriptor.value;
+            if (_metadata) Object.defineProperty(_classThis, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+            __runInitializers(_classThis, _classExtraInitializers);
+        }
+        constructor(options) {
+            super(options);
+            this.grantedKey = options.grantedKey;
+            this.networkKey = options.networkKey;
+        }
+        static from(raw, ctx) {
+            validatePayload(raw.payload.length >= 17);
+            const grantedKey = bitMaskToSecurityClass(raw.payload, 0);
+            const networkKey = raw.payload.subarray(1, 17);
+            return new this({
+                nodeId: ctx.sourceNodeId,
+                grantedKey,
+                networkKey,
+            });
+        }
+        grantedKey;
+        networkKey;
+        serialize(ctx) {
+            this.payload = Bytes.concat([
+                securityClassToBitMask(this.grantedKey),
+                this.networkKey,
+            ]);
+            return super.serialize(ctx);
+        }
+        toLogEntry(ctx) {
+            return {
+                ...super.toLogEntry(ctx),
+                message: {
+                    "security class": getEnumMemberName(SecurityClass, this.grantedKey),
+                    // This shouldn't be logged, so users can safely post their logs online
+                    // "network key": buffer2hex(this.networkKey),
+                },
+            };
+        }
+    };
+    return Security2CCNetworkKeyReport = _classThis;
+})();
 export { Security2CCNetworkKeyReport };
-let Security2CCNetworkKeyGet = Security2CCNetworkKeyGet_1 = class Security2CCNetworkKeyGet extends Security2CC {
-    constructor(options) {
-        super(options);
-        this.requestedKey = options.requestedKey;
-    }
-    static from(raw, ctx) {
-        validatePayload(raw.payload.length >= 1);
-        const requestedKey = bitMaskToSecurityClass(raw.payload, 0);
-        return new Security2CCNetworkKeyGet_1({
-            nodeId: ctx.sourceNodeId,
-            requestedKey,
-        });
-    }
-    requestedKey;
-    serialize(ctx) {
-        this.payload = securityClassToBitMask(this.requestedKey);
-        return super.serialize(ctx);
-    }
-    toLogEntry(ctx) {
-        return {
-            ...super.toLogEntry(ctx),
-            message: {
-                "security class": getEnumMemberName(SecurityClass, this.requestedKey),
-            },
-        };
-    }
-};
-Security2CCNetworkKeyGet = Security2CCNetworkKeyGet_1 = __decorate([
-    CCCommand(Security2Command.NetworkKeyGet)
-    // Don't expect a response - we need to distinguish between Report and Fail
-    // FIXME: maybe use the dynamic @expectedCCResponse instead?
-], Security2CCNetworkKeyGet);
+let Security2CCNetworkKeyGet = (() => {
+    let _classDecorators = [CCCommand(Security2Command.NetworkKeyGet)];
+    let _classDescriptor;
+    let _classExtraInitializers = [];
+    let _classThis;
+    let _classSuper = Security2CC;
+    var Security2CCNetworkKeyGet = class extends _classSuper {
+        static { _classThis = this; }
+        static {
+            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
+            __esDecorate(null, _classDescriptor = { value: _classThis }, _classDecorators, { kind: "class", name: _classThis.name, metadata: _metadata }, null, _classExtraInitializers);
+            Security2CCNetworkKeyGet = _classThis = _classDescriptor.value;
+            if (_metadata) Object.defineProperty(_classThis, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+            __runInitializers(_classThis, _classExtraInitializers);
+        }
+        constructor(options) {
+            super(options);
+            this.requestedKey = options.requestedKey;
+        }
+        static from(raw, ctx) {
+            validatePayload(raw.payload.length >= 1);
+            const requestedKey = bitMaskToSecurityClass(raw.payload, 0);
+            return new this({
+                nodeId: ctx.sourceNodeId,
+                requestedKey,
+            });
+        }
+        requestedKey;
+        serialize(ctx) {
+            this.payload = securityClassToBitMask(this.requestedKey);
+            return super.serialize(ctx);
+        }
+        toLogEntry(ctx) {
+            return {
+                ...super.toLogEntry(ctx),
+                message: {
+                    "security class": getEnumMemberName(SecurityClass, this.requestedKey),
+                },
+            };
+        }
+    };
+    return Security2CCNetworkKeyGet = _classThis;
+})();
 export { Security2CCNetworkKeyGet };
-let Security2CCNetworkKeyVerify = class Security2CCNetworkKeyVerify extends Security2CC {
-};
-Security2CCNetworkKeyVerify = __decorate([
-    CCCommand(Security2Command.NetworkKeyVerify)
-], Security2CCNetworkKeyVerify);
+let Security2CCNetworkKeyVerify = (() => {
+    let _classDecorators = [CCCommand(Security2Command.NetworkKeyVerify)];
+    let _classDescriptor;
+    let _classExtraInitializers = [];
+    let _classThis;
+    let _classSuper = Security2CC;
+    var Security2CCNetworkKeyVerify = class extends _classSuper {
+        static { _classThis = this; }
+        static {
+            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
+            __esDecorate(null, _classDescriptor = { value: _classThis }, _classDecorators, { kind: "class", name: _classThis.name, metadata: _metadata }, null, _classExtraInitializers);
+            Security2CCNetworkKeyVerify = _classThis = _classDescriptor.value;
+            if (_metadata) Object.defineProperty(_classThis, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+            __runInitializers(_classThis, _classExtraInitializers);
+        }
+    };
+    return Security2CCNetworkKeyVerify = _classThis;
+})();
 export { Security2CCNetworkKeyVerify };
-let Security2CCTransferEnd = Security2CCTransferEnd_1 = class Security2CCTransferEnd extends Security2CC {
-    constructor(options) {
-        super(options);
-        this.keyVerified = options.keyVerified;
-        this.keyRequestComplete = options.keyRequestComplete;
-    }
-    static from(raw, ctx) {
-        validatePayload(raw.payload.length >= 1);
-        const keyVerified = !!(raw.payload[0] & 0b10);
-        const keyRequestComplete = !!(raw.payload[0] & 0b1);
-        return new Security2CCTransferEnd_1({
-            nodeId: ctx.sourceNodeId,
-            keyVerified,
-            keyRequestComplete,
-        });
-    }
-    keyVerified;
-    keyRequestComplete;
-    serialize(ctx) {
-        this.payload = Bytes.from([
-            (this.keyVerified ? 0b10 : 0) + (this.keyRequestComplete ? 0b1 : 0),
-        ]);
-        return super.serialize(ctx);
-    }
-    toLogEntry(ctx) {
-        return {
-            ...super.toLogEntry(ctx),
-            message: {
-                "key verified": this.keyVerified,
-                "request complete": this.keyRequestComplete,
-            },
-        };
-    }
-};
-Security2CCTransferEnd = Security2CCTransferEnd_1 = __decorate([
-    CCCommand(Security2Command.TransferEnd)
-], Security2CCTransferEnd);
+let Security2CCTransferEnd = (() => {
+    let _classDecorators = [CCCommand(Security2Command.TransferEnd)];
+    let _classDescriptor;
+    let _classExtraInitializers = [];
+    let _classThis;
+    let _classSuper = Security2CC;
+    var Security2CCTransferEnd = class extends _classSuper {
+        static { _classThis = this; }
+        static {
+            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
+            __esDecorate(null, _classDescriptor = { value: _classThis }, _classDecorators, { kind: "class", name: _classThis.name, metadata: _metadata }, null, _classExtraInitializers);
+            Security2CCTransferEnd = _classThis = _classDescriptor.value;
+            if (_metadata) Object.defineProperty(_classThis, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+            __runInitializers(_classThis, _classExtraInitializers);
+        }
+        constructor(options) {
+            super(options);
+            this.keyVerified = options.keyVerified;
+            this.keyRequestComplete = options.keyRequestComplete;
+        }
+        static from(raw, ctx) {
+            validatePayload(raw.payload.length >= 1);
+            const keyVerified = !!(raw.payload[0] & 0b10);
+            const keyRequestComplete = !!(raw.payload[0] & 0b1);
+            return new this({
+                nodeId: ctx.sourceNodeId,
+                keyVerified,
+                keyRequestComplete,
+            });
+        }
+        keyVerified;
+        keyRequestComplete;
+        serialize(ctx) {
+            this.payload = Bytes.from([
+                (this.keyVerified ? 0b10 : 0) + (this.keyRequestComplete ? 0b1 : 0),
+            ]);
+            return super.serialize(ctx);
+        }
+        toLogEntry(ctx) {
+            return {
+                ...super.toLogEntry(ctx),
+                message: {
+                    "key verified": this.keyVerified,
+                    "request complete": this.keyRequestComplete,
+                },
+            };
+        }
+    };
+    return Security2CCTransferEnd = _classThis;
+})();
 export { Security2CCTransferEnd };
-let Security2CCCommandsSupportedReport = Security2CCCommandsSupportedReport_1 = class Security2CCCommandsSupportedReport extends Security2CC {
-    constructor(options) {
-        super(options);
-        this.supportedCCs = options.supportedCCs;
-    }
-    static from(raw, ctx) {
-        const CCs = parseCCList(raw.payload);
-        // SDS13783: A sending node MAY terminate the list of supported command classes with the
-        // COMMAND_CLASS_MARK command class identifier.
-        // A receiving node MUST stop parsing the list of supported command classes if it detects the
-        // COMMAND_CLASS_MARK command class identifier in the Security 2 Commands Supported Report
-        const supportedCCs = CCs.supportedCCs;
-        return new Security2CCCommandsSupportedReport_1({
-            nodeId: ctx.sourceNodeId,
-            supportedCCs,
-        });
-    }
-    supportedCCs;
-    serialize(ctx) {
-        this.payload = encodeCCList(this.supportedCCs, []);
-        return super.serialize(ctx);
-    }
-    toLogEntry(ctx) {
-        return {
-            ...super.toLogEntry(ctx),
-            message: {
-                "supported CCs": this.supportedCCs
-                    .map((cc) => getCCName(cc))
-                    .map((cc) => `\n· ${cc}`)
-                    .join(""),
-            },
-        };
-    }
-};
-Security2CCCommandsSupportedReport = Security2CCCommandsSupportedReport_1 = __decorate([
-    CCCommand(Security2Command.CommandsSupportedReport)
-], Security2CCCommandsSupportedReport);
+let Security2CCCommandsSupportedReport = (() => {
+    let _classDecorators = [CCCommand(Security2Command.CommandsSupportedReport)];
+    let _classDescriptor;
+    let _classExtraInitializers = [];
+    let _classThis;
+    let _classSuper = Security2CC;
+    var Security2CCCommandsSupportedReport = class extends _classSuper {
+        static { _classThis = this; }
+        static {
+            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
+            __esDecorate(null, _classDescriptor = { value: _classThis }, _classDecorators, { kind: "class", name: _classThis.name, metadata: _metadata }, null, _classExtraInitializers);
+            Security2CCCommandsSupportedReport = _classThis = _classDescriptor.value;
+            if (_metadata) Object.defineProperty(_classThis, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+            __runInitializers(_classThis, _classExtraInitializers);
+        }
+        constructor(options) {
+            super(options);
+            this.supportedCCs = options.supportedCCs;
+        }
+        static from(raw, ctx) {
+            const CCs = parseCCList(raw.payload);
+            // SDS13783: A sending node MAY terminate the list of supported command classes with the
+            // COMMAND_CLASS_MARK command class identifier.
+            // A receiving node MUST stop parsing the list of supported command classes if it detects the
+            // COMMAND_CLASS_MARK command class identifier in the Security 2 Commands Supported Report
+            const supportedCCs = CCs.supportedCCs;
+            return new this({
+                nodeId: ctx.sourceNodeId,
+                supportedCCs,
+            });
+        }
+        supportedCCs;
+        serialize(ctx) {
+            this.payload = encodeCCList(this.supportedCCs, []);
+            return super.serialize(ctx);
+        }
+        toLogEntry(ctx) {
+            return {
+                ...super.toLogEntry(ctx),
+                message: {
+                    "supported CCs": this.supportedCCs
+                        .map((cc) => getCCName(cc))
+                        .map((cc) => `\n· ${cc}`)
+                        .join(""),
+                },
+            };
+        }
+    };
+    return Security2CCCommandsSupportedReport = _classThis;
+})();
 export { Security2CCCommandsSupportedReport };
-let Security2CCCommandsSupportedGet = class Security2CCCommandsSupportedGet extends Security2CC {
-};
-Security2CCCommandsSupportedGet = __decorate([
-    CCCommand(Security2Command.CommandsSupportedGet),
-    expectedCCResponse(Security2CCCommandsSupportedReport)
-], Security2CCCommandsSupportedGet);
+let Security2CCCommandsSupportedGet = (() => {
+    let _classDecorators = [CCCommand(Security2Command.CommandsSupportedGet), expectedCCResponse(Security2CCCommandsSupportedReport)];
+    let _classDescriptor;
+    let _classExtraInitializers = [];
+    let _classThis;
+    let _classSuper = Security2CC;
+    var Security2CCCommandsSupportedGet = class extends _classSuper {
+        static { _classThis = this; }
+        static {
+            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
+            __esDecorate(null, _classDescriptor = { value: _classThis }, _classDecorators, { kind: "class", name: _classThis.name, metadata: _metadata }, null, _classExtraInitializers);
+            Security2CCCommandsSupportedGet = _classThis = _classDescriptor.value;
+            if (_metadata) Object.defineProperty(_classThis, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+            __runInitializers(_classThis, _classExtraInitializers);
+        }
+    };
+    return Security2CCCommandsSupportedGet = _classThis;
+})();
 export { Security2CCCommandsSupportedGet };
 //# sourceMappingURL=Security2CC.js.map