@zwave-js/cc 14.1.0 → 14.3.0

package/build/cjs/cc/SecurityCC.d.ts

@@ -59,6 +59,7 @@ export type SecurityCCCommandEncapsulationOptions = {
 export declare class SecurityCCCommandEncapsulation extends SecurityCC {
     constructor(options: WithAddress<SecurityCCCommandEncapsulationOptions>);
     static from(raw: CCRaw, ctx: CCParsingContext): SecurityCCCommandEncapsulation;
+    static fromAsync(raw: CCRaw, ctx: CCParsingContext): Promise<SecurityCCCommandEncapsulation>;
     private sequenced;
     private secondFrame;
     private sequenceCounter;
@@ -73,8 +74,12 @@ export declare class SecurityCCCommandEncapsulation extends SecurityCC {
     private ciphertext?;
     getPartialCCSessionId(): Record<string, any> | undefined;
     expectMoreMessages(): boolean;
+    /** @deprecated Use {@link mergePartialCCsAsync} instead */
     mergePartialCCs(partials: SecurityCCCommandEncapsulation[], ctx: CCParsingContext): void;
+    mergePartialCCsAsync(partials: SecurityCCCommandEncapsulation[], ctx: CCParsingContext): Promise<void>;
+    /** @deprecated Use {@link serializeAsync} instead */
     serialize(ctx: CCEncodingContext): Bytes;
+    serializeAsync(ctx: CCEncodingContext): Promise<Bytes>;
     protected computeEncapsulationOverhead(): number;
     toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry;
 }
@@ -118,7 +123,9 @@ export declare class SecurityCCCommandsSupportedReport extends SecurityCC {
     controlledCCs: CommandClasses[];
     getPartialCCSessionId(): Record<string, any> | undefined;
     expectMoreMessages(): boolean;
+    /** @deprecated Use {@link mergePartialCCsAsync} instead */
     mergePartialCCs(partials: SecurityCCCommandsSupportedReport[]): void;
+    mergePartialCCsAsync(partials: SecurityCCCommandsSupportedReport[]): Promise<void>;
     serialize(ctx: CCEncodingContext): Bytes;
     toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry;
 }

package/build/cjs/cc/SecurityCC.js

@@ -544,9 +544,51 @@ let SecurityCCCommandEncapsulation = (() => {
       }
       ctx.securityManager.deleteNonce(nonceId);
       const authData = getAuthenticationData(iv, nonce, import_Types.SecurityCommand.CommandEncapsulation, ctx.sourceNodeId, ctx.ownNodeId, encryptedPayload);
-      const expectedAuthCode = (0, import_core.computeMAC)(authData, ctx.securityManager.authKey);
+      const expectedAuthCode = (0, import_core.computeMACSync)(
+        authData,
+        // eslint-disable-next-line @typescript-eslint/no-deprecated
+        ctx.securityManager.authKey
+      );
       import_core.validatePayload.withReason("Invalid auth code, won't accept security encapsulated command.")(authCode.equals(expectedAuthCode));
-      const frameControlAndDecryptedCC = (0, import_core.decryptAES128OFB)(encryptedPayload, ctx.securityManager.encryptionKey, import_safe.Bytes.concat([iv, nonce]));
+      const frameControlAndDecryptedCC = (0, import_core.decryptAES128OFBSync)(
+        encryptedPayload,
+        // eslint-disable-next-line @typescript-eslint/no-deprecated
+        ctx.securityManager.encryptionKey,
+        import_safe.Bytes.concat([iv, nonce])
+      );
+      const frameControl = frameControlAndDecryptedCC[0];
+      const sequenceCounter = frameControl & 15;
+      const sequenced = !!(frameControl & 16);
+      const secondFrame = !!(frameControl & 32);
+      const decryptedCCBytes = frameControlAndDecryptedCC.subarray(1);
+      const ret = new SecurityCCCommandEncapsulation2({
+        nodeId: ctx.sourceNodeId,
+        sequenceCounter,
+        sequenced,
+        secondFrame,
+        decryptedCCBytes
+      });
+      ret.authData = authData;
+      ret.authCode = authCode;
+      ret.iv = iv;
+      return ret;
+    }
+    static async fromAsync(raw, ctx) {
+      assertSecurityRX(ctx);
+      (0, import_core.validatePayload)(raw.payload.length >= HALF_NONCE_SIZE + 1 + 1 + 1 + 8);
+      const iv = raw.payload.subarray(0, HALF_NONCE_SIZE);
+      const encryptedPayload = raw.payload.subarray(HALF_NONCE_SIZE, -9);
+      const nonceId = raw.payload.at(-9);
+      const authCode = raw.payload.subarray(-8);
+      const nonce = ctx.securityManager.getNonce(nonceId);
+      if (!nonce) {
+        import_core.validatePayload.fail(`Nonce ${(0, import_safe2.num2hex)(nonceId)} expired, cannot decode security encapsulated command.`);
+      }
+      ctx.securityManager.deleteNonce(nonceId);
+      const authData = getAuthenticationData(iv, nonce, import_Types.SecurityCommand.CommandEncapsulation, ctx.sourceNodeId, ctx.ownNodeId, encryptedPayload);
+      const expectedAuthCode = await (0, import_core.computeMACAsync)(authData, await ctx.securityManager.getAuthKey());
+      import_core.validatePayload.withReason("Invalid auth code, won't accept security encapsulated command.")(authCode.equals(expectedAuthCode));
+      const frameControlAndDecryptedCC = await (0, import_core.decryptAES128OFBAsync)(encryptedPayload, await ctx.securityManager.getEncryptionKey(), import_safe.Bytes.concat([iv, nonce]));
       const frameControl = frameControlAndDecryptedCC[0];
       const sequenceCounter = frameControl & 15;
       const sequenced = !!(frameControl & 16);
@@ -596,12 +638,20 @@ let SecurityCCCommandEncapsulation = (() => {
     expectMoreMessages() {
       return !!this.sequenced && !this.secondFrame;
     }
+    /** @deprecated Use {@link mergePartialCCsAsync} instead */
     mergePartialCCs(partials, ctx) {
       this.decryptedCCBytes = import_safe.Bytes.concat([...partials, this].map((cc) => cc.decryptedCCBytes));
       (0, import_core.validatePayload)(this.decryptedCCBytes.length >= 2);
       this.encapsulated = import_CommandClass.CommandClass.parse(this.decryptedCCBytes, ctx);
       this.encapsulated.encapsulatingCC = this;
     }
+    async mergePartialCCsAsync(partials, ctx) {
+      this.decryptedCCBytes = import_safe.Bytes.concat([...partials, this].map((cc) => cc.decryptedCCBytes));
+      (0, import_core.validatePayload)(this.decryptedCCBytes.length >= 2);
+      this.encapsulated = await import_CommandClass.CommandClass.parseAsync(this.decryptedCCBytes, ctx);
+      this.encapsulated.encapsulatingCC = this;
+    }
+    /** @deprecated Use {@link serializeAsync} instead */
     serialize(ctx) {
       if (!this.nonce)
         throwNoNonce();
@@ -612,8 +662,8 @@ let SecurityCCCommandEncapsulation = (() => {
       let authKey;
       let encryptionKey;
       if (this.alternativeNetworkKey) {
-        authKey = (0, import_core.generateAuthKey)(this.alternativeNetworkKey);
-        encryptionKey = (0, import_core.generateEncryptionKey)(this.alternativeNetworkKey);
+        authKey = (0, import_core.generateAuthKeySync)(this.alternativeNetworkKey);
+        encryptionKey = (0, import_core.generateEncryptionKeySync)(this.alternativeNetworkKey);
       } else {
         authKey = ctx.securityManager.authKey;
         encryptionKey = ctx.securityManager.encryptionKey;
@@ -626,9 +676,9 @@ let SecurityCCCommandEncapsulation = (() => {
       ]);
       const senderNonce = (0, import_node_crypto.randomBytes)(HALF_NONCE_SIZE);
       const iv = import_safe.Bytes.concat([senderNonce, this.nonce]);
-      const ciphertext = (0, import_core.encryptAES128OFB)(plaintext, encryptionKey, iv);
+      const ciphertext = (0, import_core.encryptAES128OFBSync)(plaintext, encryptionKey, iv);
       const authData = getAuthenticationData(senderNonce, this.nonce, this.ccCommand, ctx.ownNodeId, this.nodeId, ciphertext);
-      const authCode = (0, import_core.computeMAC)(authData, authKey);
+      const authCode = (0, import_core.computeMACSync)(authData, authKey);
       this.iv = iv;
       this.authData = authData;
       this.authCode = authCode;
@@ -641,6 +691,45 @@ let SecurityCCCommandEncapsulation = (() => {
       ]);
       return super.serialize(ctx);
     }
+    async serializeAsync(ctx) {
+      if (!this.nonce)
+        throwNoNonce();
+      if (this.nonce.length !== HALF_NONCE_SIZE) {
+        throwNoNonce("Invalid nonce size");
+      }
+      assertSecurityTX(ctx);
+      let authKey;
+      let encryptionKey;
+      if (this.alternativeNetworkKey) {
+        authKey = await (0, import_core.generateAuthKeyAsync)(this.alternativeNetworkKey);
+        encryptionKey = await (0, import_core.generateEncryptionKeyAsync)(this.alternativeNetworkKey);
+      } else {
+        authKey = await ctx.securityManager.getAuthKey();
+        encryptionKey = await ctx.securityManager.getEncryptionKey();
+      }
+      const serializedCC = await this.encapsulated.serializeAsync(ctx);
+      const plaintext = import_safe.Bytes.concat([
+        import_safe.Bytes.from([0]),
+        // TODO: frame control
+        serializedCC
+      ]);
+      const senderNonce = (0, import_node_crypto.randomBytes)(HALF_NONCE_SIZE);
+      const iv = import_safe.Bytes.concat([senderNonce, this.nonce]);
+      const ciphertext = await (0, import_core.encryptAES128OFBAsync)(plaintext, encryptionKey, iv);
+      const authData = getAuthenticationData(senderNonce, this.nonce, this.ccCommand, ctx.ownNodeId, this.nodeId, ciphertext);
+      const authCode = await (0, import_core.computeMACAsync)(authData, authKey);
+      this.iv = iv;
+      this.authData = authData;
+      this.authCode = authCode;
+      this.ciphertext = ciphertext;
+      this.payload = import_safe.Bytes.concat([
+        senderNonce,
+        ciphertext,
+        import_safe.Bytes.from([this.nonceId]),
+        authCode
+      ]);
+      return super.serializeAsync(ctx);
+    }
     computeEncapsulationOverhead() {
       return super.computeEncapsulationOverhead() + 18;
     }
@@ -912,10 +1001,16 @@ let SecurityCCCommandsSupportedReport = (() => {
     expectMoreMessages() {
       return this.reportsToFollow > 0;
     }
+    /** @deprecated Use {@link mergePartialCCsAsync} instead */
     mergePartialCCs(partials) {
       this.supportedCCs = [...partials, this].map((report) => report.supportedCCs).reduce((prev, cur) => prev.concat(...cur), []);
       this.controlledCCs = [...partials, this].map((report) => report.controlledCCs).reduce((prev, cur) => prev.concat(...cur), []);
     }
+    mergePartialCCsAsync(partials) {
+      this.supportedCCs = [...partials, this].map((report) => report.supportedCCs).reduce((prev, cur) => prev.concat(...cur), []);
+      this.controlledCCs = [...partials, this].map((report) => report.controlledCCs).reduce((prev, cur) => prev.concat(...cur), []);
+      return Promise.resolve();
+    }
     serialize(ctx) {
       this.payload = import_safe.Bytes.concat([
         import_safe.Bytes.from([this.reportsToFollow]),

package/build/cjs/cc/SecurityCC.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/cc/SecurityCC.ts"],
-  "sourcesContent": ["import {\n\tCommandClasses,\n\tEncapsulationFlags,\n\ttype MessageOrCCLogEntry,\n\tMessagePriority,\n\ttype MessageRecord,\n\tSecurityClass,\n\ttype SecurityManager,\n\tTransmitOptions,\n\ttype WithAddress,\n\tZWaveError,\n\tZWaveErrorCodes,\n\tcomputeMAC,\n\tdecryptAES128OFB,\n\tencodeCCList,\n\tencryptAES128OFB,\n\tgenerateAuthKey,\n\tgenerateEncryptionKey,\n\tgetCCName,\n\tisTransmissionError,\n\tparseCCList,\n\tvalidatePayload,\n} from \"@zwave-js/core\";\nimport { type MaybeNotKnown } from \"@zwave-js/core/safe\";\nimport type {\n\tCCEncodingContext,\n\tCCParsingContext,\n\tGetValueDB,\n} from \"@zwave-js/host/safe\";\nimport { Bytes } from \"@zwave-js/shared/safe\";\nimport { buffer2hex, num2hex, pick } from \"@zwave-js/shared/safe\";\nimport { wait } from \"alcalzone-shared/async\";\nimport { randomBytes } from \"node:crypto\";\nimport { CCAPI, PhysicalCCAPI } from \"../lib/API.js\";\nimport {\n\ttype CCRaw,\n\tCommandClass,\n\ttype InterviewContext,\n} from \"../lib/CommandClass.js\";\nimport {\n\tAPI,\n\tCCCommand,\n\tcommandClass,\n\texpectedCCResponse,\n\timplementedVersion,\n} from \"../lib/CommandClassDecorators.js\";\nimport { SecurityCommand } from \"../lib/_Types.js\";\nimport { CRC16CC } from \"./CRC16CC.js\";\nimport { Security2CC } from \"./Security2CC.js\";\nimport { TransportServiceCC } from \"./TransportServiceCC.js\";\n\n// @noSetValueAPI This is an encapsulation CC\n\nfunction getAuthenticationData(\n\tsenderNonce: Uint8Array,\n\treceiverNonce: Uint8Array,\n\tccCommand: SecurityCommand,\n\tsendingNodeId: number,\n\treceivingNodeId: number,\n\tencryptedPayload: Uint8Array,\n): Uint8Array {\n\treturn Bytes.concat([\n\t\tsenderNonce,\n\t\treceiverNonce,\n\t\tBytes.from([\n\t\t\tccCommand,\n\t\t\tsendingNodeId,\n\t\t\treceivingNodeId,\n\t\t\tencryptedPayload.length,\n\t\t]),\n\t\tencryptedPayload,\n\t]);\n}\n\nfunction throwNoNonce(reason?: string): never {\n\tlet message = `Security CC requires a nonce to be sent!`;\n\tif (reason) message += ` Reason: ${reason}`;\n\tthrow new ZWaveError(message, ZWaveErrorCodes.SecurityCC_NoNonce);\n}\n\nconst HALF_NONCE_SIZE = 8;\n\nfunction assertSecurityRX(\n\tctx: CCParsingContext,\n): asserts ctx is CCParsingContext & { securityManager: SecurityManager } {\n\tif (!ctx.ownNodeId) {\n\t\tthrow new ZWaveError(\n\t\t\t`Secure commands (S0) can only be decoded when the controller's node id is known!`,\n\t\t\tZWaveErrorCodes.Driver_NotReady,\n\t\t);\n\t}\n\n\tif (!ctx.securityManager) {\n\t\tthrow new ZWaveError(\n\t\t\t`Secure commands (S0) can only be decoded when the security manager is set up!`,\n\t\t\tZWaveErrorCodes.Driver_NoSecurity,\n\t\t);\n\t}\n}\n\nfunction assertSecurityTX(\n\tctx: CCEncodingContext,\n): asserts ctx is CCEncodingContext & { securityManager: SecurityManager } {\n\tif (!ctx.ownNodeId) {\n\t\tthrow new ZWaveError(\n\t\t\t`Secure commands (S0) can only be sent when the controller's node id is known!`,\n\t\t\tZWaveErrorCodes.Driver_NotReady,\n\t\t);\n\t}\n\n\tif (!ctx.securityManager) {\n\t\tthrow new ZWaveError(\n\t\t\t`Secure commands (S0) can only be sent when the security manager is set up!`,\n\t\t\tZWaveErrorCodes.Driver_NoSecurity,\n\t\t);\n\t}\n}\n\n// TODO: Ignore commands if received via multicast\n\n// Encapsulation CCs are used internally and too frequently that we\n// want to pay the cost of validating each call\n/* eslint-disable @zwave-js/ccapi-validate-args */\n\n@API(CommandClasses.Security)\nexport class SecurityCCAPI extends PhysicalCCAPI {\n\tpublic supportsCommand(_cmd: SecurityCommand): MaybeNotKnown<boolean> {\n\t\t// All commands are mandatory\n\t\treturn true;\n\t}\n\n\tpublic async sendEncapsulated(\n\t\tencapsulated: CommandClass,\n\t\trequestNextNonce: boolean = false,\n\t): Promise<void> {\n\t\tif (requestNextNonce) {\n\t\t\tthis.assertSupportsCommand(\n\t\t\t\tSecurityCommand,\n\t\t\t\tSecurityCommand.CommandEncapsulation,\n\t\t\t);\n\t\t} else {\n\t\t\tthis.assertSupportsCommand(\n\t\t\t\tSecurityCommand,\n\t\t\t\tSecurityCommand.CommandEncapsulationNonceGet,\n\t\t\t);\n\t\t}\n\n\t\tconst cc = new (\n\t\t\trequestNextNonce\n\t\t\t\t? SecurityCCCommandEncapsulationNonceGet\n\t\t\t\t: SecurityCCCommandEncapsulation\n\t\t)({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tencapsulated,\n\t\t});\n\t\tawait this.host.sendCommand(cc, this.commandOptions);\n\t}\n\n\t/**\n\t * Requests a new nonce for Security CC encapsulation which is not directly linked to a specific command.\n\t */\n\tpublic async getNonce(): Promise<Uint8Array | undefined> {\n\t\tthis.assertSupportsCommand(SecurityCommand, SecurityCommand.NonceGet);\n\n\t\tconst cc = new SecurityCCNonceGet({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t});\n\t\tconst response = await this.host.sendCommand<SecurityCCNonceReport>(\n\t\t\tcc,\n\t\t\t{\n\t\t\t\t...this.commandOptions,\n\t\t\t\t// Only try getting a nonce once\n\t\t\t\tmaxSendAttempts: 1,\n\t\t\t},\n\t\t);\n\t\tif (!response) return;\n\n\t\tconst nonce = response.nonce;\n\t\tconst secMan = this.host.securityManager!;\n\t\tsecMan.setNonce(\n\t\t\t{\n\t\t\t\tissuer: this.endpoint.nodeId,\n\t\t\t\tnonceId: secMan.getNonceId(nonce),\n\t\t\t},\n\t\t\t{ nonce, receiver: this.host.ownNodeId },\n\t\t\t{ free: true },\n\t\t);\n\t\treturn nonce;\n\t}\n\n\t/**\n\t * Responds to a NonceGet request. The message is sent without any retransmission etc.\n\t * The return value indicates whether a nonce was successfully sent\n\t */\n\tpublic async sendNonce(): Promise<boolean> {\n\t\tthis.assertSupportsCommand(\n\t\t\tSecurityCommand,\n\t\t\tSecurityCommand.NonceReport,\n\t\t);\n\n\t\tif (!this.host.securityManager) {\n\t\t\tthrow new ZWaveError(\n\t\t\t\t`Nonces can only be sent if secure communication is set up!`,\n\t\t\t\tZWaveErrorCodes.Driver_NoSecurity,\n\t\t\t);\n\t\t}\n\n\t\tconst nonce = this.host.securityManager.generateNonce(\n\t\t\tthis.endpoint.nodeId,\n\t\t\tHALF_NONCE_SIZE,\n\t\t);\n\t\tconst nonceId = this.host.securityManager.getNonceId(nonce);\n\n\t\tconst cc = new SecurityCCNonceReport({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t\tnonce,\n\t\t});\n\n\t\ttry {\n\t\t\tawait this.host.sendCommand(cc, {\n\t\t\t\t...this.commandOptions,\n\t\t\t\t// Seems we need these options or some nodes won't accept the nonce\n\t\t\t\ttransmitOptions: TransmitOptions.ACK\n\t\t\t\t\t| TransmitOptions.AutoRoute,\n\t\t\t\t// Only try sending a nonce once\n\t\t\t\tmaxSendAttempts: 1,\n\t\t\t\t// Nonce requests must be handled immediately\n\t\t\t\tpriority: MessagePriority.Immediate,\n\t\t\t\t// We don't want failures causing us to treat the node as asleep or dead\n\t\t\t\tchangeNodeStatusOnMissingACK: false,\n\t\t\t});\n\t\t} catch (e) {\n\t\t\tif (isTransmissionError(e)) {\n\t\t\t\t// The nonce could not be sent, invalidate it\n\t\t\t\tthis.host.securityManager.deleteNonce(nonceId);\n\t\t\t\treturn false;\n\t\t\t} else {\n\t\t\t\t// Pass other errors through\n\t\t\t\tthrow e;\n\t\t\t}\n\t\t}\n\t\treturn true;\n\t}\n\n\tpublic async getSecurityScheme(): Promise<[0]> {\n\t\tthis.assertSupportsCommand(SecurityCommand, SecurityCommand.SchemeGet);\n\n\t\tconst cc = new SecurityCCSchemeGet({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t});\n\t\tawait this.host.sendCommand(cc, this.commandOptions);\n\t\t// There is only one scheme, so we hardcode it\n\t\treturn [0];\n\t}\n\n\tpublic async reportSecurityScheme(encapsulated: boolean): Promise<void> {\n\t\tthis.assertSupportsCommand(\n\t\t\tSecurityCommand,\n\t\t\tSecurityCommand.SchemeReport,\n\t\t);\n\n\t\tlet cc: CommandClass = new SecurityCCSchemeReport({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t});\n\t\tif (encapsulated) {\n\t\t\tcc = new SecurityCCCommandEncapsulation({\n\t\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\t\tendpointIndex: this.endpoint.index,\n\t\t\t\tencapsulated: cc,\n\t\t\t});\n\t\t}\n\t\tawait this.host.sendCommand(cc, this.commandOptions);\n\t}\n\n\tpublic async inheritSecurityScheme(): Promise<void> {\n\t\tthis.assertSupportsCommand(\n\t\t\tSecurityCommand,\n\t\t\tSecurityCommand.SchemeInherit,\n\t\t);\n\n\t\tconst cc = new SecurityCCSchemeInherit({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t});\n\t\tawait this.host.sendCommand(cc, this.commandOptions);\n\t\t// There is only one scheme, so we don't return anything here\n\t}\n\n\tpublic async setNetworkKey(networkKey: Uint8Array): Promise<void> {\n\t\tthis.assertSupportsCommand(\n\t\t\tSecurityCommand,\n\t\t\tSecurityCommand.NetworkKeySet,\n\t\t);\n\n\t\tconst keySet = new SecurityCCNetworkKeySet({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t\tnetworkKey,\n\t\t});\n\t\tconst cc = new SecurityCCCommandEncapsulation({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t\tencapsulated: keySet,\n\t\t\talternativeNetworkKey: new Uint8Array(16).fill(0),\n\t\t});\n\t\tawait this.host.sendCommand(cc, this.commandOptions);\n\t}\n\n\tpublic async verifyNetworkKey(): Promise<void> {\n\t\tthis.assertSupportsCommand(\n\t\t\tSecurityCommand,\n\t\t\tSecurityCommand.NetworkKeyVerify,\n\t\t);\n\n\t\tconst cc = new SecurityCCNetworkKeyVerify({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t});\n\t\tawait this.host.sendCommand(cc, this.commandOptions);\n\t}\n\n\t// eslint-disable-next-line @typescript-eslint/explicit-module-boundary-types\n\tpublic async getSupportedCommands() {\n\t\tthis.assertSupportsCommand(\n\t\t\tSecurityCommand,\n\t\t\tSecurityCommand.CommandsSupportedGet,\n\t\t);\n\n\t\tconst cc = new SecurityCCCommandsSupportedGet({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t});\n\t\tconst response = await this.host.sendCommand<\n\t\t\tSecurityCCCommandsSupportedReport\n\t\t>(\n\t\t\tcc,\n\t\t\tthis.commandOptions,\n\t\t);\n\t\tif (response) {\n\t\t\treturn pick(response, [\"supportedCCs\", \"controlledCCs\"]);\n\t\t}\n\t}\n\n\tpublic async reportSupportedCommands(\n\t\tsupportedCCs: CommandClasses[],\n\t\tcontrolledCCs: CommandClasses[],\n\t): Promise<void> {\n\t\tthis.assertSupportsCommand(\n\t\t\tSecurityCommand,\n\t\t\tSecurityCommand.CommandsSupportedReport,\n\t\t);\n\n\t\tconst cc = new SecurityCCCommandsSupportedReport({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t\tsupportedCCs,\n\t\t\tcontrolledCCs,\n\t\t\treportsToFollow: 0,\n\t\t});\n\t\tawait this.host.sendCommand(cc, this.commandOptions);\n\t}\n}\n\n@commandClass(CommandClasses.Security)\n@implementedVersion(1)\nexport class SecurityCC extends CommandClass {\n\tdeclare ccCommand: SecurityCommand;\n\t// Force singlecast for the Security CC\n\tdeclare nodeId: number;\n\n\tpublic async interview(\n\t\tctx: InterviewContext,\n\t): Promise<void> {\n\t\tconst node = this.getNode(ctx)!;\n\t\tconst endpoint = this.getEndpoint(ctx)!;\n\t\tconst api = CCAPI.create(\n\t\t\tCommandClasses.Security,\n\t\t\tctx,\n\t\t\tendpoint,\n\t\t).withOptions({\n\t\t\tpriority: MessagePriority.NodeQuery,\n\t\t});\n\n\t\tctx.logNode(node.id, {\n\t\t\tmessage: \"Querying securely supported commands (S0)...\",\n\t\t\tdirection: \"outbound\",\n\t\t});\n\n\t\tlet supportedCCs: CommandClasses[] | undefined;\n\t\tlet controlledCCs: CommandClasses[] | undefined;\n\n\t\t// Try up to 3 times on the root device. We REALLY don't want a spurious timeout or collision to cause us to discard a known good security class\n\t\tconst MAX_ATTEMPTS = this.endpointIndex === 0 ? 3 : 1;\n\t\tfor (let attempts = 1; attempts <= MAX_ATTEMPTS; attempts++) {\n\t\t\tconst resp = await api.getSupportedCommands();\n\t\t\tif (resp) {\n\t\t\t\tsupportedCCs = resp.supportedCCs;\n\t\t\t\tcontrolledCCs = resp.controlledCCs;\n\t\t\t\tbreak;\n\t\t\t} else if (attempts < MAX_ATTEMPTS) {\n\t\t\t\tctx.logNode(node.id, {\n\t\t\t\t\tendpoint: this.endpointIndex,\n\t\t\t\t\tmessage:\n\t\t\t\t\t\t`Querying securely supported commands (S0), attempt ${attempts}/${MAX_ATTEMPTS} failed. Retrying in 500ms...`,\n\t\t\t\t\tlevel: \"warn\",\n\t\t\t\t});\n\t\t\t\tawait wait(500);\n\t\t\t}\n\t\t}\n\n\t\tif (!supportedCCs || !controlledCCs) {\n\t\t\tif (node.hasSecurityClass(SecurityClass.S0_Legacy) === true) {\n\t\t\t\tctx.logNode(node.id, {\n\t\t\t\t\tendpoint: this.endpointIndex,\n\t\t\t\t\tmessage: \"Querying securely supported commands (S0) failed\",\n\t\t\t\t\tlevel: \"warn\",\n\t\t\t\t});\n\t\t\t\t// TODO: Abort interview?\n\t\t\t} else {\n\t\t\t\t// We didn't know if the node was secure and it didn't respond,\n\t\t\t\t// assume that it doesn't have the S0 security class\n\t\t\t\tctx.logNode(\n\t\t\t\t\tnode.id,\n\t\t\t\t\t`The node was not granted the S0 security class. Continuing interview non-securely.`,\n\t\t\t\t);\n\t\t\t\tnode.setSecurityClass(SecurityClass.S0_Legacy, false);\n\t\t\t}\n\t\t\treturn;\n\t\t}\n\n\t\tconst logLines: string[] = [\n\t\t\t\"received secure commands (S0)\",\n\t\t\t\"supported CCs:\",\n\t\t];\n\t\tfor (const cc of supportedCCs) {\n\t\t\tlogLines.push(`\u00B7 ${getCCName(cc)}`);\n\t\t}\n\t\tlogLines.push(\"controlled CCs:\");\n\t\tfor (const cc of controlledCCs) {\n\t\t\tlogLines.push(`\u00B7 ${getCCName(cc)}`);\n\t\t}\n\t\tctx.logNode(node.id, {\n\t\t\tmessage: logLines.join(\"\\n\"),\n\t\t\tdirection: \"inbound\",\n\t\t});\n\n\t\t// Remember which commands are supported securely\n\t\tfor (const cc of supportedCCs) {\n\t\t\t// Basic CC has special rules for when it is considered supported\n\t\t\t// Therefore we mark all other CCs as supported, but not Basic CC,\n\t\t\t// for which support is determined later.\n\t\t\tif (cc === CommandClasses.Basic) {\n\t\t\t\tendpoint.addCC(cc, { secure: true });\n\t\t\t} else {\n\t\t\t\tendpoint.addCC(cc, {\n\t\t\t\t\tisSupported: true,\n\t\t\t\t\tsecure: true,\n\t\t\t\t});\n\t\t\t}\n\t\t}\n\t\tfor (const cc of controlledCCs) {\n\t\t\t// Basic CC has special rules for when it is considered supported\n\t\t\t// Therefore we mark all other CCs as supported, but not Basic CC,\n\t\t\t// for which support is determined later.\n\t\t\tif (cc === CommandClasses.Basic) {\n\t\t\t\tendpoint.addCC(cc, { secure: true });\n\t\t\t} else {\n\t\t\t\tendpoint.addCC(cc, {\n\t\t\t\t\tisControlled: true,\n\t\t\t\t\tsecure: true,\n\t\t\t\t});\n\t\t\t}\n\t\t}\n\n\t\t// We know for sure that the node is included securely\n\t\tif (node.hasSecurityClass(SecurityClass.S0_Legacy) !== true) {\n\t\t\tnode.setSecurityClass(SecurityClass.S0_Legacy, true);\n\t\t\tctx.logNode(\n\t\t\t\tnode.id,\n\t\t\t\t`The node was granted the S0 security class`,\n\t\t\t);\n\t\t}\n\n\t\t// Remember that the interview is complete\n\t\tthis.setInterviewComplete(ctx, true);\n\t}\n\n\t/** Tests if a command should be sent secure and thus requires encapsulation */\n\tpublic static requiresEncapsulation(cc: CommandClass): boolean {\n\t\t// No security flag -> no encapsulation\n\t\tif (!(cc.encapsulationFlags & EncapsulationFlags.Security)) {\n\t\t\treturn false;\n\t\t}\n\n\t\t// S2, CRC16, Transport Service -> no S2 encapsulation\n\t\tif (\n\t\t\tcc instanceof Security2CC\n\t\t\t|| cc instanceof CRC16CC\n\t\t\t|| cc instanceof TransportServiceCC\n\t\t) {\n\t\t\treturn false;\n\t\t}\n\n\t\t// S0: check command\n\t\tif (cc instanceof SecurityCC) {\n\t\t\tswitch (cc.ccCommand) {\n\t\t\t\t// Already encapsulated\n\t\t\t\tcase SecurityCommand.CommandEncapsulation:\n\t\t\t\tcase SecurityCommand.CommandEncapsulationNonceGet:\n\t\t\t\t// Cannot be sent encapsulated:\n\t\t\t\tcase SecurityCommand.NonceGet:\n\t\t\t\tcase SecurityCommand.NonceReport:\n\t\t\t\tcase SecurityCommand.SchemeGet:\n\t\t\t\tcase SecurityCommand.SchemeReport:\n\t\t\t\t\treturn false;\n\n\t\t\t\tdefault:\n\t\t\t\t\t// All other commands must be encapsulated\n\t\t\t\t\treturn true;\n\t\t\t}\n\t\t}\n\n\t\t// Everything else needs to be encapsulated if the CC is secure\n\t\treturn true;\n\t}\n\n\t/** Encapsulates a command that should be sent encrypted */\n\tpublic static encapsulate(\n\t\townNodeId: number,\n\t\tsecurityManager: SecurityManager,\n\t\tcc: CommandClass,\n\t): SecurityCCCommandEncapsulation {\n\t\t// TODO: When to return a SecurityCCCommandEncapsulationNonceGet?\n\t\tconst ret = new SecurityCCCommandEncapsulation({\n\t\t\tnodeId: cc.nodeId,\n\t\t\tencapsulated: cc,\n\t\t});\n\n\t\t// Copy the encapsulation flags from the encapsulated command\n\t\t// but omit Security, since we're doing that right now\n\t\tret.encapsulationFlags = cc.encapsulationFlags\n\t\t\t& ~EncapsulationFlags.Security;\n\n\t\treturn ret;\n\t}\n}\n\ninterface SecurityCCNonceReportOptions {\n\tnonce: Uint8Array;\n}\n\n@CCCommand(SecurityCommand.NonceReport)\nexport class SecurityCCNonceReport extends SecurityCC {\n\tconstructor(\n\t\toptions: WithAddress<SecurityCCNonceReportOptions>,\n\t) {\n\t\tsuper(options);\n\t\tif (options.nonce.length !== HALF_NONCE_SIZE) {\n\t\t\tthrow new ZWaveError(\n\t\t\t\t`Nonce must have length ${HALF_NONCE_SIZE}!`,\n\t\t\t\tZWaveErrorCodes.Argument_Invalid,\n\t\t\t);\n\t\t}\n\t\tthis.nonce = options.nonce;\n\t}\n\n\tpublic static from(\n\t\traw: CCRaw,\n\t\tctx: CCParsingContext,\n\t): SecurityCCNonceReport {\n\t\tvalidatePayload.withReason(\"Invalid nonce length\")(\n\t\t\traw.payload.length === HALF_NONCE_SIZE,\n\t\t);\n\n\t\treturn new this({\n\t\t\tnodeId: ctx.sourceNodeId,\n\t\t\tnonce: raw.payload,\n\t\t});\n\t}\n\n\tpublic nonce: Uint8Array;\n\n\tpublic serialize(ctx: CCEncodingContext): Bytes {\n\t\tthis.payload = Bytes.view(this.nonce);\n\t\treturn super.serialize(ctx);\n\t}\n\n\tpublic toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry {\n\t\treturn {\n\t\t\t...super.toLogEntry(ctx),\n\t\t\tmessage: { nonce: buffer2hex(this.nonce) },\n\t\t};\n\t}\n}\n\n@CCCommand(SecurityCommand.NonceGet)\n@expectedCCResponse(SecurityCCNonceReport)\nexport class SecurityCCNonceGet extends SecurityCC {}\n\n// @publicAPI\nexport type SecurityCCCommandEncapsulationOptions =\n\t& {\n\t\talternativeNetworkKey?: Uint8Array;\n\t}\n\t& ({\n\t\tencapsulated: CommandClass;\n\t} | {\n\t\tdecryptedCCBytes: Uint8Array;\n\t\tsequenced: boolean;\n\t\tsecondFrame: boolean;\n\t\tsequenceCounter: number;\n\t});\n\nfunction getCCResponseForCommandEncapsulation(\n\tsent: SecurityCCCommandEncapsulation,\n) {\n\tif (sent.encapsulated.expectsCCResponse()) {\n\t\treturn SecurityCCCommandEncapsulation;\n\t}\n}\n\n@CCCommand(SecurityCommand.CommandEncapsulation)\n@expectedCCResponse(\n\tgetCCResponseForCommandEncapsulation,\n\t() => \"checkEncapsulated\",\n)\nexport class SecurityCCCommandEncapsulation extends SecurityCC {\n\tpublic constructor(\n\t\toptions: WithAddress<SecurityCCCommandEncapsulationOptions>,\n\t) {\n\t\tsuper(options);\n\n\t\tif (\"encapsulated\" in options) {\n\t\t\tthis.encapsulated = options.encapsulated;\n\t\t\tthis.encapsulated.encapsulatingCC = this as any;\n\t\t} else {\n\t\t\tthis.decryptedCCBytes = options.decryptedCCBytes;\n\t\t\tthis.sequenced = options.sequenced;\n\t\t\tthis.secondFrame = options.secondFrame;\n\t\t\tthis.sequenceCounter = options.sequenceCounter;\n\t\t}\n\t\tthis.alternativeNetworkKey = options.alternativeNetworkKey;\n\t}\n\n\tpublic static from(\n\t\traw: CCRaw,\n\t\tctx: CCParsingContext,\n\t): SecurityCCCommandEncapsulation {\n\t\tassertSecurityRX(ctx);\n\n\t\t// HALF_NONCE_SIZE bytes iv, 1 byte frame control, at least 1 CC byte, 1 byte nonce id, 8 bytes auth code\n\t\tvalidatePayload(\n\t\t\traw.payload.length >= HALF_NONCE_SIZE + 1 + 1 + 1 + 8,\n\t\t);\n\t\tconst iv = raw.payload.subarray(0, HALF_NONCE_SIZE);\n\t\tconst encryptedPayload = raw.payload.subarray(HALF_NONCE_SIZE, -9);\n\t\tconst nonceId = raw.payload.at(-9)!;\n\t\tconst authCode = raw.payload.subarray(-8);\n\n\t\t// Retrieve the used nonce from the nonce store\n\t\tconst nonce = ctx.securityManager.getNonce(nonceId);\n\t\t// Only accept the message if the nonce hasn't expired\n\t\tif (!nonce) {\n\t\t\tvalidatePayload.fail(\n\t\t\t\t`Nonce ${\n\t\t\t\t\tnum2hex(\n\t\t\t\t\t\tnonceId,\n\t\t\t\t\t)\n\t\t\t\t} expired, cannot decode security encapsulated command.`,\n\t\t\t);\n\t\t}\n\t\t// and mark the nonce as used\n\t\tctx.securityManager.deleteNonce(nonceId);\n\n\t\t// Validate the encrypted data\n\t\tconst authData = getAuthenticationData(\n\t\t\tiv,\n\t\t\tnonce,\n\t\t\tSecurityCommand.CommandEncapsulation,\n\t\t\tctx.sourceNodeId,\n\t\t\tctx.ownNodeId,\n\t\t\tencryptedPayload,\n\t\t);\n\t\tconst expectedAuthCode = computeMAC(\n\t\t\tauthData,\n\t\t\tctx.securityManager.authKey,\n\t\t);\n\t\t// Only accept messages with a correct auth code\n\t\tvalidatePayload.withReason(\n\t\t\t\"Invalid auth code, won't accept security encapsulated command.\",\n\t\t)(authCode.equals(expectedAuthCode));\n\n\t\t// Decrypt the encapsulated CC\n\t\tconst frameControlAndDecryptedCC = decryptAES128OFB(\n\t\t\tencryptedPayload,\n\t\t\tctx.securityManager.encryptionKey,\n\t\t\tBytes.concat([iv, nonce]),\n\t\t);\n\t\tconst frameControl = frameControlAndDecryptedCC[0];\n\t\tconst sequenceCounter = frameControl & 0b1111;\n\t\tconst sequenced = !!(frameControl & 0b1_0000);\n\t\tconst secondFrame = !!(frameControl & 0b10_0000);\n\t\tconst decryptedCCBytes: Uint8Array | undefined =\n\t\t\tframeControlAndDecryptedCC\n\t\t\t\t.subarray(1);\n\n\t\tconst ret = new SecurityCCCommandEncapsulation({\n\t\t\tnodeId: ctx.sourceNodeId,\n\t\t\tsequenceCounter,\n\t\t\tsequenced,\n\t\t\tsecondFrame,\n\t\t\tdecryptedCCBytes,\n\t\t});\n\n\t\tret.authData = authData;\n\t\tret.authCode = authCode;\n\t\tret.iv = iv;\n\n\t\treturn ret;\n\t}\n\n\tprivate sequenced: boolean | undefined;\n\tprivate secondFrame: boolean | undefined;\n\tprivate sequenceCounter: number | undefined;\n\n\tprivate decryptedCCBytes: Uint8Array | undefined;\n\tpublic encapsulated!: CommandClass;\n\n\tprivate alternativeNetworkKey?: Uint8Array;\n\n\tpublic get nonceId(): number | undefined {\n\t\treturn this.nonce?.[0];\n\t}\n\tpublic nonce: Uint8Array | undefined;\n\n\t// Only used testing/for debugging purposes\n\tprivate iv?: Uint8Array;\n\tprivate authData?: Uint8Array;\n\tprivate authCode?: Uint8Array;\n\tprivate ciphertext?: Uint8Array;\n\n\tpublic getPartialCCSessionId(): Record<string, any> | undefined {\n\t\tif (this.sequenced) {\n\t\t\treturn {\n\t\t\t\t// Treat Encapsulation and EncapsulationNonceGet as one\n\t\t\t\tccCommand: undefined,\n\t\t\t\tsequence: this.sequenceCounter,\n\t\t\t};\n\t\t} else {\n\t\t\treturn {\n\t\t\t\t// Treat Encapsulation and EncapsulationNonceGet as one\n\t\t\t\tccCommand: undefined,\n\t\t\t};\n\t\t}\n\t}\n\n\tpublic expectMoreMessages(): boolean {\n\t\treturn !!this.sequenced && !this.secondFrame;\n\t}\n\n\tpublic mergePartialCCs(\n\t\tpartials: SecurityCCCommandEncapsulation[],\n\t\tctx: CCParsingContext,\n\t): void {\n\t\t// Concat the CC buffers\n\t\tthis.decryptedCCBytes = Bytes.concat(\n\t\t\t[...partials, this].map((cc) => cc.decryptedCCBytes!),\n\t\t);\n\t\t// make sure this contains a complete CC command that's worth splitting\n\t\tvalidatePayload(this.decryptedCCBytes.length >= 2);\n\t\t// and deserialize the CC\n\t\tthis.encapsulated = CommandClass.parse(this.decryptedCCBytes, ctx);\n\t\tthis.encapsulated.encapsulatingCC = this as any;\n\t}\n\n\tpublic serialize(ctx: CCEncodingContext): Bytes {\n\t\tif (!this.nonce) throwNoNonce();\n\t\tif (this.nonce.length !== HALF_NONCE_SIZE) {\n\t\t\tthrowNoNonce(\"Invalid nonce size\");\n\t\t}\n\t\tassertSecurityTX(ctx);\n\n\t\tlet authKey: Uint8Array;\n\t\tlet encryptionKey: Uint8Array;\n\t\tif (this.alternativeNetworkKey) {\n\t\t\tauthKey = generateAuthKey(this.alternativeNetworkKey);\n\t\t\tencryptionKey = generateEncryptionKey(\n\t\t\t\tthis.alternativeNetworkKey,\n\t\t\t);\n\t\t} else {\n\t\t\tauthKey = ctx.securityManager.authKey;\n\t\t\tencryptionKey = ctx.securityManager.encryptionKey;\n\t\t}\n\n\t\tconst serializedCC = this.encapsulated.serialize(ctx);\n\t\tconst plaintext = Bytes.concat([\n\t\t\tBytes.from([0]), // TODO: frame control\n\t\t\tserializedCC,\n\t\t]);\n\t\t// Encrypt the payload\n\t\tconst senderNonce = randomBytes(HALF_NONCE_SIZE);\n\t\tconst iv = Bytes.concat([senderNonce, this.nonce]);\n\t\tconst ciphertext = encryptAES128OFB(plaintext, encryptionKey, iv);\n\t\t// And generate the auth code\n\t\tconst authData = getAuthenticationData(\n\t\t\tsenderNonce,\n\t\t\tthis.nonce,\n\t\t\tthis.ccCommand,\n\t\t\tctx.ownNodeId,\n\t\t\tthis.nodeId,\n\t\t\tciphertext,\n\t\t);\n\t\tconst authCode = computeMAC(authData, authKey);\n\n\t\t// Remember for debugging purposes\n\t\tthis.iv = iv;\n\t\tthis.authData = authData;\n\t\tthis.authCode = authCode;\n\t\tthis.ciphertext = ciphertext;\n\n\t\tthis.payload = Bytes.concat([\n\t\t\tsenderNonce,\n\t\t\tciphertext,\n\t\t\tBytes.from([this.nonceId!]),\n\t\t\tauthCode,\n\t\t]);\n\t\treturn super.serialize(ctx);\n\t}\n\n\tprotected computeEncapsulationOverhead(): number {\n\t\t// Security CC adds 8 bytes IV, 1 byte frame control, 1 byte nonce ID, 8 bytes MAC\n\t\treturn super.computeEncapsulationOverhead() + 18;\n\t}\n\n\tpublic toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry {\n\t\tconst message: MessageRecord = {};\n\t\tif (this.nonceId != undefined) {\n\t\t\tmessage[\"nonce id\"] = this.nonceId;\n\t\t}\n\t\tif (this.sequenced != undefined) {\n\t\t\tmessage.sequenced = this.sequenced;\n\t\t\tif (this.sequenced) {\n\t\t\t\tif (this.secondFrame != undefined) {\n\t\t\t\t\tmessage[\"second frame\"] = this.secondFrame;\n\t\t\t\t}\n\t\t\t\tif (this.sequenceCounter != undefined) {\n\t\t\t\t\tmessage[\"sequence counter\"] = this.sequenceCounter;\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\t// Log the plaintext in integration tests and development mode\n\t\tif (\n\t\t\tprocess.env.NODE_ENV === \"test\"\n\t\t\t|| process.env.NODE_ENV === \"development\"\n\t\t) {\n\t\t\tif (this.iv) {\n\t\t\t\tmessage.IV = buffer2hex(this.iv);\n\t\t\t}\n\t\t\tif (this.ciphertext) {\n\t\t\t\tmessage.ciphertext = buffer2hex(this.ciphertext);\n\t\t\t} else if (this.decryptedCCBytes) {\n\t\t\t\tmessage.plaintext = buffer2hex(this.decryptedCCBytes);\n\t\t\t}\n\t\t\tif (this.authData) {\n\t\t\t\tmessage[\"auth data\"] = buffer2hex(this.authData);\n\t\t\t}\n\t\t\tif (this.authCode) {\n\t\t\t\tmessage[\"auth code\"] = buffer2hex(this.authCode);\n\t\t\t}\n\t\t}\n\t\treturn {\n\t\t\t...super.toLogEntry(ctx),\n\t\t\tmessage,\n\t\t};\n\t}\n}\n\n// This is the same message, but with another CC command\n@CCCommand(SecurityCommand.CommandEncapsulationNonceGet)\nexport class SecurityCCCommandEncapsulationNonceGet\n\textends SecurityCCCommandEncapsulation\n{}\n\n@CCCommand(SecurityCommand.SchemeReport)\nexport class SecurityCCSchemeReport extends SecurityCC {\n\tpublic static from(\n\t\traw: CCRaw,\n\t\tctx: CCParsingContext,\n\t): SecurityCCSchemeReport {\n\t\tvalidatePayload(raw.payload.length >= 1);\n\t\t// The including controller MUST NOT perform any validation of the Supported Security Schemes byte\n\t\treturn new this({\n\t\t\tnodeId: ctx.sourceNodeId,\n\t\t});\n\t}\n\n\tpublic serialize(ctx: CCEncodingContext): Bytes {\n\t\t// Since it is unlikely that any more schemes will be added to S0, we hardcode the default scheme here (bit 0 = 0)\n\t\tthis.payload = Bytes.from([0]);\n\t\treturn super.serialize(ctx);\n\t}\n\n\tpublic toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry {\n\t\treturn {\n\t\t\t...super.toLogEntry(ctx),\n\t\t\t// Hide the default payload line\n\t\t\tmessage: undefined,\n\t\t};\n\t}\n}\n\n@CCCommand(SecurityCommand.SchemeGet)\n@expectedCCResponse(SecurityCCSchemeReport)\nexport class SecurityCCSchemeGet extends SecurityCC {\n\tpublic serialize(ctx: CCEncodingContext): Bytes {\n\t\t// Since it is unlikely that any more schemes will be added to S0, we hardcode the default scheme here (bit 0 = 0)\n\t\tthis.payload = Bytes.from([0]);\n\t\treturn super.serialize(ctx);\n\t}\n\n\tpublic toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry {\n\t\treturn {\n\t\t\t...super.toLogEntry(ctx),\n\t\t\t// Hide the default payload line\n\t\t\tmessage: undefined,\n\t\t};\n\t}\n}\n\n@CCCommand(SecurityCommand.SchemeInherit)\n@expectedCCResponse(SecurityCCSchemeReport)\nexport class SecurityCCSchemeInherit extends SecurityCC {\n\tpublic serialize(ctx: CCEncodingContext): Bytes {\n\t\t// Since it is unlikely that any more schemes will be added to S0, we hardcode the default scheme here (bit 0 = 0)\n\t\tthis.payload = Bytes.from([0]);\n\t\treturn super.serialize(ctx);\n\t}\n\n\tpublic toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry {\n\t\treturn {\n\t\t\t...super.toLogEntry(ctx),\n\t\t\t// Hide the default payload line\n\t\t\tmessage: undefined,\n\t\t};\n\t}\n}\n\n@CCCommand(SecurityCommand.NetworkKeyVerify)\nexport class SecurityCCNetworkKeyVerify extends SecurityCC {}\n\n// @publicAPI\nexport interface SecurityCCNetworkKeySetOptions {\n\tnetworkKey: Uint8Array;\n}\n\n@CCCommand(SecurityCommand.NetworkKeySet)\n@expectedCCResponse(SecurityCCNetworkKeyVerify)\nexport class SecurityCCNetworkKeySet extends SecurityCC {\n\tpublic constructor(\n\t\toptions: WithAddress<SecurityCCNetworkKeySetOptions>,\n\t) {\n\t\tsuper(options);\n\t\tif (options.networkKey.length !== 16) {\n\t\t\tthrow new ZWaveError(\n\t\t\t\t`The network key must have length 16!`,\n\t\t\t\tZWaveErrorCodes.Argument_Invalid,\n\t\t\t);\n\t\t}\n\t\tthis.networkKey = options.networkKey;\n\t}\n\n\tpublic static from(\n\t\traw: CCRaw,\n\t\tctx: CCParsingContext,\n\t): SecurityCCNetworkKeySet {\n\t\tvalidatePayload(raw.payload.length >= 16);\n\t\tconst networkKey: Uint8Array = raw.payload.subarray(0, 16);\n\n\t\treturn new this({\n\t\t\tnodeId: ctx.sourceNodeId,\n\t\t\tnetworkKey,\n\t\t});\n\t}\n\n\tpublic networkKey: Uint8Array;\n\n\tpublic serialize(ctx: CCEncodingContext): Bytes {\n\t\tthis.payload = Bytes.view(this.networkKey);\n\t\treturn super.serialize(ctx);\n\t}\n\n\tpublic toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry {\n\t\t// The network key shouldn't be logged, so users can safely post their logs online\n\t\tconst { message, ...log } = super.toLogEntry(ctx);\n\t\treturn log;\n\t}\n}\n\n// @publicAPI\nexport interface SecurityCCCommandsSupportedReportOptions {\n\treportsToFollow?: number;\n\tsupportedCCs: CommandClasses[];\n\tcontrolledCCs: CommandClasses[];\n}\n\n@CCCommand(SecurityCommand.CommandsSupportedReport)\nexport class SecurityCCCommandsSupportedReport extends SecurityCC {\n\tpublic constructor(\n\t\toptions: WithAddress<SecurityCCCommandsSupportedReportOptions>,\n\t) {\n\t\tsuper(options);\n\n\t\tthis.supportedCCs = options.supportedCCs;\n\t\tthis.controlledCCs = options.controlledCCs;\n\t\t// TODO: properly split the CCs into multiple reports\n\t\tthis.reportsToFollow = options.reportsToFollow ?? 0;\n\t}\n\n\tpublic static from(\n\t\traw: CCRaw,\n\t\tctx: CCParsingContext,\n\t): SecurityCCCommandsSupportedReport {\n\t\tvalidatePayload(raw.payload.length >= 1);\n\t\tconst reportsToFollow = raw.payload[0];\n\t\tconst list = parseCCList(raw.payload.subarray(1));\n\t\tconst supportedCCs: CommandClasses[] = list.supportedCCs;\n\t\tconst controlledCCs: CommandClasses[] = list.controlledCCs;\n\n\t\treturn new this({\n\t\t\tnodeId: ctx.sourceNodeId,\n\t\t\treportsToFollow,\n\t\t\tsupportedCCs,\n\t\t\tcontrolledCCs,\n\t\t});\n\t}\n\n\tpublic reportsToFollow: number;\n\tpublic supportedCCs: CommandClasses[];\n\tpublic controlledCCs: CommandClasses[];\n\n\tpublic getPartialCCSessionId(): Record<string, any> | undefined {\n\t\t// Nothing special we can distinguish sessions with\n\t\treturn {};\n\t}\n\n\tpublic expectMoreMessages(): boolean {\n\t\treturn this.reportsToFollow > 0;\n\t}\n\n\tpublic mergePartialCCs(\n\t\tpartials: SecurityCCCommandsSupportedReport[],\n\t): void {\n\t\t// Concat the lists of CCs\n\t\tthis.supportedCCs = [...partials, this]\n\t\t\t.map((report) => report.supportedCCs)\n\t\t\t.reduce((prev, cur) => prev.concat(...cur), []);\n\t\tthis.controlledCCs = [...partials, this]\n\t\t\t.map((report) => report.controlledCCs)\n\t\t\t.reduce((prev, cur) => prev.concat(...cur), []);\n\t}\n\n\tpublic serialize(ctx: CCEncodingContext): Bytes {\n\t\tthis.payload = Bytes.concat([\n\t\t\tBytes.from([this.reportsToFollow]),\n\t\t\tencodeCCList(this.supportedCCs, this.controlledCCs),\n\t\t]);\n\t\treturn super.serialize(ctx);\n\t}\n\n\tpublic toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry {\n\t\treturn {\n\t\t\t...super.toLogEntry(ctx),\n\t\t\tmessage: {\n\t\t\t\treportsToFollow: this.reportsToFollow,\n\t\t\t\tsupportedCCs: this.supportedCCs\n\t\t\t\t\t.map((cc) => getCCName(cc))\n\t\t\t\t\t.map((cc) => `\\n\u00B7 ${cc}`)\n\t\t\t\t\t.join(\"\"),\n\t\t\t\tcontrolledCCs: this.controlledCCs\n\t\t\t\t\t.map((cc) => getCCName(cc))\n\t\t\t\t\t.map((cc) => `\\n\u00B7 ${cc}`)\n\t\t\t\t\t.join(\"\"),\n\t\t\t},\n\t\t};\n\t}\n}\n\n@CCCommand(SecurityCommand.CommandsSupportedGet)\n@expectedCCResponse(SecurityCCCommandsSupportedReport)\nexport class SecurityCCCommandsSupportedGet extends SecurityCC {}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,kBAsBO;AAOP,kBAAsB;AACtB,IAAAA,eAA0C;AAC1C,mBAAqB;AACrB,yBAA4B;AAC5B,iBAAqC;AACrC,0BAIO;AACP,oCAMO;AACP,mBAAgC;AAChC,qBAAwB;AACxB,yBAA4B;AAC5B,gCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAInC,SAAS,sBACR,aACA,eACA,WACA,eACA,iBACA,kBAA4B;AAE5B,SAAO,kBAAM,OAAO;IACnB;IACA;IACA,kBAAM,KAAK;MACV;MACA;MACA;MACA,iBAAiB;KACjB;IACD;GACA;AACF;AAEA,SAAS,aAAa,QAAe;AACpC,MAAI,UAAU;AACd,MAAI;AAAQ,eAAW,YAAY,MAAM;AACzC,QAAM,IAAI,uBAAW,SAAS,4BAAgB,kBAAkB;AACjE;AAEA,MAAM,kBAAkB;AAExB,SAAS,iBACR,KAAqB;AAErB,MAAI,CAAC,IAAI,WAAW;AACnB,UAAM,IAAI,uBACT,oFACA,4BAAgB,eAAe;EAEjC;AAEA,MAAI,CAAC,IAAI,iBAAiB;AACzB,UAAM,IAAI,uBACT,iFACA,4BAAgB,iBAAiB;EAEnC;AACD;AAEA,SAAS,iBACR,KAAsB;AAEtB,MAAI,CAAC,IAAI,WAAW;AACnB,UAAM,IAAI,uBACT,iFACA,4BAAgB,eAAe;EAEjC;AAEA,MAAI,CAAC,IAAI,iBAAiB;AACzB,UAAM,IAAI,uBACT,8EACA,4BAAgB,iBAAiB;EAEnC;AACD;IASa,iBAAa,MAAA;8BADzB,mCAAI,2BAAe,QAAQ,CAAC;;;;oBACM;qCAAA,YAAa;;;;;;AAAhD,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;IACL,gBAAgB,MAAqB;AAE3C,aAAO;IACR;IAEO,MAAM,iBACZ,cACA,mBAA4B,OAAK;AAEjC,UAAI,kBAAkB;AACrB,aAAK,sBACJ,8BACA,6BAAgB,oBAAoB;MAEtC,OAAO;AACN,aAAK,sBACJ,8BACA,6BAAgB,4BAA4B;MAE9C;AAEA,YAAM,KAAK,KACV,mBACG,yCACA,gCACF;QACD,QAAQ,KAAK,SAAS;QACtB;OACA;AACD,YAAM,KAAK,KAAK,YAAY,IAAI,KAAK,cAAc;IACpD;;;;IAKO,MAAM,WAAQ;AACpB,WAAK,sBAAsB,8BAAiB,6BAAgB,QAAQ;AAEpE,YAAM,KAAK,IAAI,mBAAmB;QACjC,QAAQ,KAAK,SAAS;QACtB,eAAe,KAAK,SAAS;OAC7B;AACD,YAAM,WAAW,MAAM,KAAK,KAAK,YAChC,IACA;QACC,GAAG,KAAK;;QAER,iBAAiB;OACjB;AAEF,UAAI,CAAC;AAAU;AAEf,YAAM,QAAQ,SAAS;AACvB,YAAM,SAAS,KAAK,KAAK;AACzB,aAAO,SACN;QACC,QAAQ,KAAK,SAAS;QACtB,SAAS,OAAO,WAAW,KAAK;SAEjC,EAAE,OAAO,UAAU,KAAK,KAAK,UAAS,GACtC,EAAE,MAAM,KAAI,CAAE;AAEf,aAAO;IACR;;;;;IAMO,MAAM,YAAS;AACrB,WAAK,sBACJ,8BACA,6BAAgB,WAAW;AAG5B,UAAI,CAAC,KAAK,KAAK,iBAAiB;AAC/B,cAAM,IAAI,uBACT,8DACA,4BAAgB,iBAAiB;MAEnC;AAEA,YAAM,QAAQ,KAAK,KAAK,gBAAgB,cACvC,KAAK,SAAS,QACd,eAAe;AAEhB,YAAM,UAAU,KAAK,KAAK,gBAAgB,WAAW,KAAK;AAE1D,YAAM,KAAK,IAAI,sBAAsB;QACpC,QAAQ,KAAK,SAAS;QACtB,eAAe,KAAK,SAAS;QAC7B;OACA;AAED,UAAI;AACH,cAAM,KAAK,KAAK,YAAY,IAAI;UAC/B,GAAG,KAAK;;UAER,iBAAiB,4BAAgB,MAC9B,4BAAgB;;UAEnB,iBAAiB;;UAEjB,UAAU,4BAAgB;;UAE1B,8BAA8B;SAC9B;MACF,SAAS,GAAG;AACX,gBAAI,iCAAoB,CAAC,GAAG;AAE3B,eAAK,KAAK,gBAAgB,YAAY,OAAO;AAC7C,iBAAO;QACR,OAAO;AAEN,gBAAM;QACP;MACD;AACA,aAAO;IACR;IAEO,MAAM,oBAAiB;AAC7B,WAAK,sBAAsB,8BAAiB,6BAAgB,SAAS;AAErE,YAAM,KAAK,IAAI,oBAAoB;QAClC,QAAQ,KAAK,SAAS;QACtB,eAAe,KAAK,SAAS;OAC7B;AACD,YAAM,KAAK,KAAK,YAAY,IAAI,KAAK,cAAc;AAEnD,aAAO,CAAC,CAAC;IACV;IAEO,MAAM,qBAAqB,cAAqB;AACtD,WAAK,sBACJ,8BACA,6BAAgB,YAAY;AAG7B,UAAI,KAAmB,IAAI,uBAAuB;QACjD,QAAQ,KAAK,SAAS;QACtB,eAAe,KAAK,SAAS;OAC7B;AACD,UAAI,cAAc;AACjB,aAAK,IAAI,+BAA+B;UACvC,QAAQ,KAAK,SAAS;UACtB,eAAe,KAAK,SAAS;UAC7B,cAAc;SACd;MACF;AACA,YAAM,KAAK,KAAK,YAAY,IAAI,KAAK,cAAc;IACpD;IAEO,MAAM,wBAAqB;AACjC,WAAK,sBACJ,8BACA,6BAAgB,aAAa;AAG9B,YAAM,KAAK,IAAI,wBAAwB;QACtC,QAAQ,KAAK,SAAS;QACtB,eAAe,KAAK,SAAS;OAC7B;AACD,YAAM,KAAK,KAAK,YAAY,IAAI,KAAK,cAAc;IAEpD;IAEO,MAAM,cAAc,YAAsB;AAChD,WAAK,sBACJ,8BACA,6BAAgB,aAAa;AAG9B,YAAM,SAAS,IAAI,wBAAwB;QAC1C,QAAQ,KAAK,SAAS;QACtB,eAAe,KAAK,SAAS;QAC7B;OACA;AACD,YAAM,KAAK,IAAI,+BAA+B;QAC7C,QAAQ,KAAK,SAAS;QACtB,eAAe,KAAK,SAAS;QAC7B,cAAc;QACd,uBAAuB,IAAI,WAAW,EAAE,EAAE,KAAK,CAAC;OAChD;AACD,YAAM,KAAK,KAAK,YAAY,IAAI,KAAK,cAAc;IACpD;IAEO,MAAM,mBAAgB;AAC5B,WAAK,sBACJ,8BACA,6BAAgB,gBAAgB;AAGjC,YAAM,KAAK,IAAI,2BAA2B;QACzC,QAAQ,KAAK,SAAS;QACtB,eAAe,KAAK,SAAS;OAC7B;AACD,YAAM,KAAK,KAAK,YAAY,IAAI,KAAK,cAAc;IACpD;;IAGO,MAAM,uBAAoB;AAChC,WAAK,sBACJ,8BACA,6BAAgB,oBAAoB;AAGrC,YAAM,KAAK,IAAI,+BAA+B;QAC7C,QAAQ,KAAK,SAAS;QACtB,eAAe,KAAK,SAAS;OAC7B;AACD,YAAM,WAAW,MAAM,KAAK,KAAK,YAGhC,IACA,KAAK,cAAc;AAEpB,UAAI,UAAU;AACb,mBAAO,mBAAK,UAAU,CAAC,gBAAgB,eAAe,CAAC;MACxD;IACD;IAEO,MAAM,wBACZ,cACA,eAA+B;AAE/B,WAAK,sBACJ,8BACA,6BAAgB,uBAAuB;AAGxC,YAAM,KAAK,IAAI,kCAAkC;QAChD,QAAQ,KAAK,SAAS;QACtB,eAAe,KAAK,SAAS;QAC7B;QACA;QACA,iBAAiB;OACjB;AACD,YAAM,KAAK,KAAK,YAAY,IAAI,KAAK,cAAc;IACpD;;;;IAKY,cAAU,MAAA;8BAFtB,4CAAa,2BAAe,QAAQ,OACpC,kDAAmB,CAAC,CAAC;;;;oBACU;kCAAA,YAAY;;;;;;AAA5C,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;IAKL,MAAM,UACZ,KAAqB;AAErB,YAAM,OAAO,KAAK,QAAQ,GAAG;AAC7B,YAAM,WAAW,KAAK,YAAY,GAAG;AACrC,YAAM,MAAM,iBAAM,OACjB,2BAAe,UACf,KACA,QAAQ,EACP,YAAY;QACb,UAAU,4BAAgB;OAC1B;AAED,UAAI,QAAQ,KAAK,IAAI;QACpB,SAAS;QACT,WAAW;OACX;AAED,UAAI;AACJ,UAAI;AAGJ,YAAM,eAAe,KAAK,kBAAkB,IAAI,IAAI;AACpD,eAAS,WAAW,GAAG,YAAY,cAAc,YAAY;AAC5D,cAAM,OAAO,MAAM,IAAI,qBAAoB;AAC3C,YAAI,MAAM;AACT,yBAAe,KAAK;AACpB,0BAAgB,KAAK;AACrB;QACD,WAAW,WAAW,cAAc;AACnC,cAAI,QAAQ,KAAK,IAAI;YACpB,UAAU,KAAK;YACf,SACC,sDAAsD,QAAQ,IAAI,YAAY;YAC/E,OAAO;WACP;AACD,oBAAM,mBAAK,GAAG;QACf;MACD;AAEA,UAAI,CAAC,gBAAgB,CAAC,eAAe;AACpC,YAAI,KAAK,iBAAiB,0BAAc,SAAS,MAAM,MAAM;AAC5D,cAAI,QAAQ,KAAK,IAAI;YACpB,UAAU,KAAK;YACf,SAAS;YACT,OAAO;WACP;QAEF,OAAO;AAGN,cAAI,QACH,KAAK,IACL,oFAAoF;AAErF,eAAK,iBAAiB,0BAAc,WAAW,KAAK;QACrD;AACA;MACD;AAEA,YAAM,WAAqB;QAC1B;QACA;;AAED,iBAAW,MAAM,cAAc;AAC9B,iBAAS,KAAK,YAAK,uBAAU,EAAE,CAAC,EAAE;MACnC;AACA,eAAS,KAAK,iBAAiB;AAC/B,iBAAW,MAAM,eAAe;AAC/B,iBAAS,KAAK,YAAK,uBAAU,EAAE,CAAC,EAAE;MACnC;AACA,UAAI,QAAQ,KAAK,IAAI;QACpB,SAAS,SAAS,KAAK,IAAI;QAC3B,WAAW;OACX;AAGD,iBAAW,MAAM,cAAc;AAI9B,YAAI,OAAO,2BAAe,OAAO;AAChC,mBAAS,MAAM,IAAI,EAAE,QAAQ,KAAI,CAAE;QACpC,OAAO;AACN,mBAAS,MAAM,IAAI;YAClB,aAAa;YACb,QAAQ;WACR;QACF;MACD;AACA,iBAAW,MAAM,eAAe;AAI/B,YAAI,OAAO,2BAAe,OAAO;AAChC,mBAAS,MAAM,IAAI,EAAE,QAAQ,KAAI,CAAE;QACpC,OAAO;AACN,mBAAS,MAAM,IAAI;YAClB,cAAc;YACd,QAAQ;WACR;QACF;MACD;AAGA,UAAI,KAAK,iBAAiB,0BAAc,SAAS,MAAM,MAAM;AAC5D,aAAK,iBAAiB,0BAAc,WAAW,IAAI;AACnD,YAAI,QACH,KAAK,IACL,4CAA4C;MAE9C;AAGA,WAAK,qBAAqB,KAAK,IAAI;IACpC;;IAGO,OAAO,sBAAsB,IAAgB;AAEnD,UAAI,EAAE,GAAG,qBAAqB,+BAAmB,WAAW;AAC3D,eAAO;MACR;AAGA,UACC,cAAc,kCACX,cAAc,0BACd,cAAc,8CAChB;AACD,eAAO;MACR;AAGA,UAAI,cAAcC,aAAY;AAC7B,gBAAQ,GAAG,WAAW;;UAErB,KAAK,6BAAgB;UACrB,KAAK,6BAAgB;;UAErB,KAAK,6BAAgB;UACrB,KAAK,6BAAgB;UACrB,KAAK,6BAAgB;UACrB,KAAK,6BAAgB;AACpB,mBAAO;UAER;AAEC,mBAAO;QACT;MACD;AAGA,aAAO;IACR;;IAGO,OAAO,YACb,WACA,iBACA,IAAgB;AAGhB,YAAM,MAAM,IAAI,+BAA+B;QAC9C,QAAQ,GAAG;QACX,cAAc;OACd;AAID,UAAI,qBAAqB,GAAG,qBACzB,CAAC,+BAAmB;AAEvB,aAAO;IACR;;;;IAQY,yBAAqB,MAAA;8BADjC,yCAAU,6BAAgB,WAAW,CAAC;;;;oBACI;6CAAA,YAAU;;;;;;AAArD,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;IACZ,YACC,SAAkD;AAElD,YAAM,OAAO;AACb,UAAI,QAAQ,MAAM,WAAW,iBAAiB;AAC7C,cAAM,IAAI,uBACT,0BAA0B,eAAe,KACzC,4BAAgB,gBAAgB;MAElC;AACA,WAAK,QAAQ,QAAQ;IACtB;IAEO,OAAO,KACb,KACA,KAAqB;AAErB,kCAAgB,WAAW,sBAAsB,EAChD,IAAI,QAAQ,WAAW,eAAe;AAGvC,aAAO,IAAI,KAAK;QACf,QAAQ,IAAI;QACZ,OAAO,IAAI;OACX;IACF;IAEO;IAEA,UAAU,KAAsB;AACtC,WAAK,UAAU,kBAAM,KAAK,KAAK,KAAK;AACpC,aAAO,MAAM,UAAU,GAAG;IAC3B;IAEO,WAAW,KAAgB;AACjC,aAAO;QACN,GAAG,MAAM,WAAW,GAAG;QACvB,SAAS,EAAE,WAAO,yBAAW,KAAK,KAAK,EAAC;;IAE1C;;;;IAKY,sBAAkB,MAAA;8BAF9B,yCAAU,6BAAgB,QAAQ,OAClC,kDAAmB,qBAAqB,CAAC;;;;oBACF;0CAAA,YAAU;;;;;;AAAlD,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;;;;AAgBb,SAAS,qCACR,MAAoC;AAEpC,MAAI,KAAK,aAAa,kBAAiB,GAAI;AAC1C,WAAO;EACR;AACD;IAOa,kCAA8B,MAAA;8BAL1C,yCAAU,6BAAgB,oBAAoB,OAC9C,kDACA,sCACA,MAAM,mBAAmB,CACzB;;;;oBACmD;sDAAA,YAAU;;;;;;AAA9D,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;IACZ,YACC,SAA2D;AAE3D,YAAM,OAAO;AAEb,UAAI,kBAAkB,SAAS;AAC9B,aAAK,eAAe,QAAQ;AAC5B,aAAK,aAAa,kBAAkB;MACrC,OAAO;AACN,aAAK,mBAAmB,QAAQ;AAChC,aAAK,YAAY,QAAQ;AACzB,aAAK,cAAc,QAAQ;AAC3B,aAAK,kBAAkB,QAAQ;MAChC;AACA,WAAK,wBAAwB,QAAQ;IACtC;IAEO,OAAO,KACb,KACA,KAAqB;AAErB,uBAAiB,GAAG;AAGpB,uCACC,IAAI,QAAQ,UAAU,kBAAkB,IAAI,IAAI,IAAI,CAAC;AAEtD,YAAM,KAAK,IAAI,QAAQ,SAAS,GAAG,eAAe;AAClD,YAAM,mBAAmB,IAAI,QAAQ,SAAS,iBAAiB,EAAE;AACjE,YAAM,UAAU,IAAI,QAAQ,GAAG,EAAE;AACjC,YAAM,WAAW,IAAI,QAAQ,SAAS,EAAE;AAGxC,YAAM,QAAQ,IAAI,gBAAgB,SAAS,OAAO;AAElD,UAAI,CAAC,OAAO;AACX,oCAAgB,KACf,aACC,sBACC,OAAO,CAET,wDAAwD;MAE1D;AAEA,UAAI,gBAAgB,YAAY,OAAO;AAGvC,YAAM,WAAW,sBAChB,IACA,OACA,6BAAgB,sBAChB,IAAI,cACJ,IAAI,WACJ,gBAAgB;AAEjB,YAAM,uBAAmB,wBACxB,UACA,IAAI,gBAAgB,OAAO;AAG5B,kCAAgB,WACf,gEAAgE,EAC/D,SAAS,OAAO,gBAAgB,CAAC;AAGnC,YAAM,iCAA6B,8BAClC,kBACA,IAAI,gBAAgB,eACpB,kBAAM,OAAO,CAAC,IAAI,KAAK,CAAC,CAAC;AAE1B,YAAM,eAAe,2BAA2B,CAAC;AACjD,YAAM,kBAAkB,eAAe;AACvC,YAAM,YAAY,CAAC,EAAE,eAAe;AACpC,YAAM,cAAc,CAAC,EAAE,eAAe;AACtC,YAAM,mBACL,2BACE,SAAS,CAAC;AAEb,YAAM,MAAM,IAAIC,gCAA+B;QAC9C,QAAQ,IAAI;QACZ;QACA;QACA;QACA;OACA;AAED,UAAI,WAAW;AACf,UAAI,WAAW;AACf,UAAI,KAAK;AAET,aAAO;IACR;IAEQ;IACA;IACA;IAEA;IACD;IAEC;IAER,IAAW,UAAO;AACjB,aAAO,KAAK,QAAQ,CAAC;IACtB;IACO;;IAGC;IACA;IACA;IACA;IAED,wBAAqB;AAC3B,UAAI,KAAK,WAAW;AACnB,eAAO;;UAEN,WAAW;UACX,UAAU,KAAK;;MAEjB,OAAO;AACN,eAAO;;UAEN,WAAW;;MAEb;IACD;IAEO,qBAAkB;AACxB,aAAO,CAAC,CAAC,KAAK,aAAa,CAAC,KAAK;IAClC;IAEO,gBACN,UACA,KAAqB;AAGrB,WAAK,mBAAmB,kBAAM,OAC7B,CAAC,GAAG,UAAU,IAAI,EAAE,IAAI,CAAC,OAAO,GAAG,gBAAiB,CAAC;AAGtD,uCAAgB,KAAK,iBAAiB,UAAU,CAAC;AAEjD,WAAK,eAAe,iCAAa,MAAM,KAAK,kBAAkB,GAAG;AACjE,WAAK,aAAa,kBAAkB;IACrC;IAEO,UAAU,KAAsB;AACtC,UAAI,CAAC,KAAK;AAAO,qBAAY;AAC7B,UAAI,KAAK,MAAM,WAAW,iBAAiB;AAC1C,qBAAa,oBAAoB;MAClC;AACA,uBAAiB,GAAG;AAEpB,UAAI;AACJ,UAAI;AACJ,UAAI,KAAK,uBAAuB;AAC/B,sBAAU,6BAAgB,KAAK,qBAAqB;AACpD,4BAAgB,mCACf,KAAK,qBAAqB;MAE5B,OAAO;AACN,kBAAU,IAAI,gBAAgB;AAC9B,wBAAgB,IAAI,gBAAgB;MACrC;AAEA,YAAM,eAAe,KAAK,aAAa,UAAU,GAAG;AACpD,YAAM,YAAY,kBAAM,OAAO;QAC9B,kBAAM,KAAK,CAAC,CAAC,CAAC;;QACd;OACA;AAED,YAAM,kBAAc,gCAAY,eAAe;AAC/C,YAAM,KAAK,kBAAM,OAAO,CAAC,aAAa,KAAK,KAAK,CAAC;AACjD,YAAM,iBAAa,8BAAiB,WAAW,eAAe,EAAE;AAEhE,YAAM,WAAW,sBAChB,aACA,KAAK,OACL,KAAK,WACL,IAAI,WACJ,KAAK,QACL,UAAU;AAEX,YAAM,eAAW,wBAAW,UAAU,OAAO;AAG7C,WAAK,KAAK;AACV,WAAK,WAAW;AAChB,WAAK,WAAW;AAChB,WAAK,aAAa;AAElB,WAAK,UAAU,kBAAM,OAAO;QAC3B;QACA;QACA,kBAAM,KAAK,CAAC,KAAK,OAAQ,CAAC;QAC1B;OACA;AACD,aAAO,MAAM,UAAU,GAAG;IAC3B;IAEU,+BAA4B;AAErC,aAAO,MAAM,6BAA4B,IAAK;IAC/C;IAEO,WAAW,KAAgB;AACjC,YAAM,UAAyB,CAAA;AAC/B,UAAI,KAAK,WAAW,QAAW;AAC9B,gBAAQ,UAAU,IAAI,KAAK;MAC5B;AACA,UAAI,KAAK,aAAa,QAAW;AAChC,gBAAQ,YAAY,KAAK;AACzB,YAAI,KAAK,WAAW;AACnB,cAAI,KAAK,eAAe,QAAW;AAClC,oBAAQ,cAAc,IAAI,KAAK;UAChC;AACA,cAAI,KAAK,mBAAmB,QAAW;AACtC,oBAAQ,kBAAkB,IAAI,KAAK;UACpC;QACD;MACD;AAEA,UACC,QAAQ,IAAI,aAAa,UACtB,QAAQ,IAAI,aAAa,eAC3B;AACD,YAAI,KAAK,IAAI;AACZ,kBAAQ,SAAK,yBAAW,KAAK,EAAE;QAChC;AACA,YAAI,KAAK,YAAY;AACpB,kBAAQ,iBAAa,yBAAW,KAAK,UAAU;QAChD,WAAW,KAAK,kBAAkB;AACjC,kBAAQ,gBAAY,yBAAW,KAAK,gBAAgB;QACrD;AACA,YAAI,KAAK,UAAU;AAClB,kBAAQ,WAAW,QAAI,yBAAW,KAAK,QAAQ;QAChD;AACA,YAAI,KAAK,UAAU;AAClB,kBAAQ,WAAW,QAAI,yBAAW,KAAK,QAAQ;QAChD;MACD;AACA,aAAO;QACN,GAAG,MAAM,WAAW,GAAG;QACvB;;IAEF;;;;IAKY,0CAAsC,MAAA;8BADlD,yCAAU,6BAAgB,4BAA4B,CAAC;;;;oBAE/C;8DAAA,YAA8B;;;;;;AADvC,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;;;;IAKA,0BAAsB,MAAA;8BADlC,yCAAU,6BAAgB,YAAY,CAAC;;;;oBACI;8CAAA,YAAU;;;;;;AAAtD,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;IACL,OAAO,KACb,KACA,KAAqB;AAErB,uCAAgB,IAAI,QAAQ,UAAU,CAAC;AAEvC,aAAO,IAAI,KAAK;QACf,QAAQ,IAAI;OACZ;IACF;IAEO,UAAU,KAAsB;AAEtC,WAAK,UAAU,kBAAM,KAAK,CAAC,CAAC,CAAC;AAC7B,aAAO,MAAM,UAAU,GAAG;IAC3B;IAEO,WAAW,KAAgB;AACjC,aAAO;QACN,GAAG,MAAM,WAAW,GAAG;;QAEvB,SAAS;;IAEX;;;;IAKY,uBAAmB,MAAA;8BAF/B,yCAAU,6BAAgB,SAAS,OACnC,kDAAmB,sBAAsB,CAAC;;;;oBACF;2CAAA,YAAU;;;;;;AAAnD,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;IACL,UAAU,KAAsB;AAEtC,WAAK,UAAU,kBAAM,KAAK,CAAC,CAAC,CAAC;AAC7B,aAAO,MAAM,UAAU,GAAG;IAC3B;IAEO,WAAW,KAAgB;AACjC,aAAO;QACN,GAAG,MAAM,WAAW,GAAG;;QAEvB,SAAS;;IAEX;;;;IAKY,2BAAuB,MAAA;8BAFnC,yCAAU,6BAAgB,aAAa,OACvC,kDAAmB,sBAAsB,CAAC;;;;oBACE;+CAAA,YAAU;;;;;;AAAvD,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;IACL,UAAU,KAAsB;AAEtC,WAAK,UAAU,kBAAM,KAAK,CAAC,CAAC,CAAC;AAC7B,aAAO,MAAM,UAAU,GAAG;IAC3B;IAEO,WAAW,KAAgB;AACjC,aAAO;QACN,GAAG,MAAM,WAAW,GAAG;;QAEvB,SAAS;;IAEX;;;;IAIY,8BAA0B,MAAA;8BADtC,yCAAU,6BAAgB,gBAAgB,CAAC;;;;oBACI;kDAAA,YAAU;;;;;;AAA1D,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;;;;IASA,2BAAuB,MAAA;8BAFnC,yCAAU,6BAAgB,aAAa,OACvC,kDAAmB,0BAA0B,CAAC;;;;oBACF;+CAAA,YAAU;;;;;;AAAvD,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;IACZ,YACC,SAAoD;AAEpD,YAAM,OAAO;AACb,UAAI,QAAQ,WAAW,WAAW,IAAI;AACrC,cAAM,IAAI,uBACT,wCACA,4BAAgB,gBAAgB;MAElC;AACA,WAAK,aAAa,QAAQ;IAC3B;IAEO,OAAO,KACb,KACA,KAAqB;AAErB,uCAAgB,IAAI,QAAQ,UAAU,EAAE;AACxC,YAAM,aAAyB,IAAI,QAAQ,SAAS,GAAG,EAAE;AAEzD,aAAO,IAAI,KAAK;QACf,QAAQ,IAAI;QACZ;OACA;IACF;IAEO;IAEA,UAAU,KAAsB;AACtC,WAAK,UAAU,kBAAM,KAAK,KAAK,UAAU;AACzC,aAAO,MAAM,UAAU,GAAG;IAC3B;IAEO,WAAW,KAAgB;AAEjC,YAAM,EAAE,SAAS,GAAG,IAAG,IAAK,MAAM,WAAW,GAAG;AAChD,aAAO;IACR;;;;IAWY,qCAAiC,MAAA;8BAD7C,yCAAU,6BAAgB,uBAAuB,CAAC;;;;oBACI;yDAAA,YAAU;;;;;;AAAjE,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;IACZ,YACC,SAA8D;AAE9D,YAAM,OAAO;AAEb,WAAK,eAAe,QAAQ;AAC5B,WAAK,gBAAgB,QAAQ;AAE7B,WAAK,kBAAkB,QAAQ,mBAAmB;IACnD;IAEO,OAAO,KACb,KACA,KAAqB;AAErB,uCAAgB,IAAI,QAAQ,UAAU,CAAC;AACvC,YAAM,kBAAkB,IAAI,QAAQ,CAAC;AACrC,YAAM,WAAO,yBAAY,IAAI,QAAQ,SAAS,CAAC,CAAC;AAChD,YAAM,eAAiC,KAAK;AAC5C,YAAM,gBAAkC,KAAK;AAE7C,aAAO,IAAI,KAAK;QACf,QAAQ,IAAI;QACZ;QACA;QACA;OACA;IACF;IAEO;IACA;IACA;IAEA,wBAAqB;AAE3B,aAAO,CAAA;IACR;IAEO,qBAAkB;AACxB,aAAO,KAAK,kBAAkB;IAC/B;IAEO,gBACN,UAA6C;AAG7C,WAAK,eAAe,CAAC,GAAG,UAAU,IAAI,EACpC,IAAI,CAAC,WAAW,OAAO,YAAY,EACnC,OAAO,CAAC,MAAM,QAAQ,KAAK,OAAO,GAAG,GAAG,GAAG,CAAA,CAAE;AAC/C,WAAK,gBAAgB,CAAC,GAAG,UAAU,IAAI,EACrC,IAAI,CAAC,WAAW,OAAO,aAAa,EACpC,OAAO,CAAC,MAAM,QAAQ,KAAK,OAAO,GAAG,GAAG,GAAG,CAAA,CAAE;IAChD;IAEO,UAAU,KAAsB;AACtC,WAAK,UAAU,kBAAM,OAAO;QAC3B,kBAAM,KAAK,CAAC,KAAK,eAAe,CAAC;YACjC,0BAAa,KAAK,cAAc,KAAK,aAAa;OAClD;AACD,aAAO,MAAM,UAAU,GAAG;IAC3B;IAEO,WAAW,KAAgB;AACjC,aAAO;QACN,GAAG,MAAM,WAAW,GAAG;QACvB,SAAS;UACR,iBAAiB,KAAK;UACtB,cAAc,KAAK,aACjB,IAAI,CAAC,WAAO,uBAAU,EAAE,CAAC,EACzB,IAAI,CAAC,OAAO;OAAO,EAAE,EAAE,EACvB,KAAK,EAAE;UACT,eAAe,KAAK,cAClB,IAAI,CAAC,WAAO,uBAAU,EAAE,CAAC,EACzB,IAAI,CAAC,OAAO;OAAO,EAAE,EAAE,EACvB,KAAK,EAAE;;;IAGZ;;;;IAKY,kCAA8B,MAAA;8BAF1C,yCAAU,6BAAgB,oBAAoB,OAC9C,kDAAmB,iCAAiC,CAAC;;;;oBACF;sDAAA,YAAU;;;;;;AAA9D,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;;;;",
+  "sourcesContent": ["import {\n\tCommandClasses,\n\tEncapsulationFlags,\n\ttype MessageOrCCLogEntry,\n\tMessagePriority,\n\ttype MessageRecord,\n\tSecurityClass,\n\ttype SecurityManager,\n\tTransmitOptions,\n\ttype WithAddress,\n\tZWaveError,\n\tZWaveErrorCodes,\n\tcomputeMACAsync,\n\tcomputeMACSync,\n\tdecryptAES128OFBAsync,\n\tdecryptAES128OFBSync,\n\tencodeCCList,\n\tencryptAES128OFBAsync,\n\tencryptAES128OFBSync,\n\tgenerateAuthKeyAsync,\n\tgenerateAuthKeySync,\n\tgenerateEncryptionKeyAsync,\n\tgenerateEncryptionKeySync,\n\tgetCCName,\n\tisTransmissionError,\n\tparseCCList,\n\tvalidatePayload,\n} from \"@zwave-js/core\";\nimport { type MaybeNotKnown } from \"@zwave-js/core/safe\";\nimport type {\n\tCCEncodingContext,\n\tCCParsingContext,\n\tGetValueDB,\n} from \"@zwave-js/host/safe\";\nimport { Bytes } from \"@zwave-js/shared/safe\";\nimport { buffer2hex, num2hex, pick } from \"@zwave-js/shared/safe\";\nimport { wait } from \"alcalzone-shared/async\";\nimport { randomBytes } from \"node:crypto\";\nimport { CCAPI, PhysicalCCAPI } from \"../lib/API.js\";\nimport {\n\ttype CCRaw,\n\tCommandClass,\n\ttype InterviewContext,\n} from \"../lib/CommandClass.js\";\nimport {\n\tAPI,\n\tCCCommand,\n\tcommandClass,\n\texpectedCCResponse,\n\timplementedVersion,\n} from \"../lib/CommandClassDecorators.js\";\nimport { SecurityCommand } from \"../lib/_Types.js\";\nimport { CRC16CC } from \"./CRC16CC.js\";\nimport { Security2CC } from \"./Security2CC.js\";\nimport { TransportServiceCC } from \"./TransportServiceCC.js\";\n\n// @noSetValueAPI This is an encapsulation CC\n\nfunction getAuthenticationData(\n\tsenderNonce: Uint8Array,\n\treceiverNonce: Uint8Array,\n\tccCommand: SecurityCommand,\n\tsendingNodeId: number,\n\treceivingNodeId: number,\n\tencryptedPayload: Uint8Array,\n): Uint8Array {\n\treturn Bytes.concat([\n\t\tsenderNonce,\n\t\treceiverNonce,\n\t\tBytes.from([\n\t\t\tccCommand,\n\t\t\tsendingNodeId,\n\t\t\treceivingNodeId,\n\t\t\tencryptedPayload.length,\n\t\t]),\n\t\tencryptedPayload,\n\t]);\n}\n\nfunction throwNoNonce(reason?: string): never {\n\tlet message = `Security CC requires a nonce to be sent!`;\n\tif (reason) message += ` Reason: ${reason}`;\n\tthrow new ZWaveError(message, ZWaveErrorCodes.SecurityCC_NoNonce);\n}\n\nconst HALF_NONCE_SIZE = 8;\n\nfunction assertSecurityRX(\n\tctx: CCParsingContext,\n): asserts ctx is CCParsingContext & { securityManager: SecurityManager } {\n\tif (!ctx.ownNodeId) {\n\t\tthrow new ZWaveError(\n\t\t\t`Secure commands (S0) can only be decoded when the controller's node id is known!`,\n\t\t\tZWaveErrorCodes.Driver_NotReady,\n\t\t);\n\t}\n\n\tif (!ctx.securityManager) {\n\t\tthrow new ZWaveError(\n\t\t\t`Secure commands (S0) can only be decoded when the security manager is set up!`,\n\t\t\tZWaveErrorCodes.Driver_NoSecurity,\n\t\t);\n\t}\n}\n\nfunction assertSecurityTX(\n\tctx: CCEncodingContext,\n): asserts ctx is CCEncodingContext & { securityManager: SecurityManager } {\n\tif (!ctx.ownNodeId) {\n\t\tthrow new ZWaveError(\n\t\t\t`Secure commands (S0) can only be sent when the controller's node id is known!`,\n\t\t\tZWaveErrorCodes.Driver_NotReady,\n\t\t);\n\t}\n\n\tif (!ctx.securityManager) {\n\t\tthrow new ZWaveError(\n\t\t\t`Secure commands (S0) can only be sent when the security manager is set up!`,\n\t\t\tZWaveErrorCodes.Driver_NoSecurity,\n\t\t);\n\t}\n}\n\n// TODO: Ignore commands if received via multicast\n\n// Encapsulation CCs are used internally and too frequently that we\n// want to pay the cost of validating each call\n/* eslint-disable @zwave-js/ccapi-validate-args */\n\n@API(CommandClasses.Security)\nexport class SecurityCCAPI extends PhysicalCCAPI {\n\tpublic supportsCommand(_cmd: SecurityCommand): MaybeNotKnown<boolean> {\n\t\t// All commands are mandatory\n\t\treturn true;\n\t}\n\n\tpublic async sendEncapsulated(\n\t\tencapsulated: CommandClass,\n\t\trequestNextNonce: boolean = false,\n\t): Promise<void> {\n\t\tif (requestNextNonce) {\n\t\t\tthis.assertSupportsCommand(\n\t\t\t\tSecurityCommand,\n\t\t\t\tSecurityCommand.CommandEncapsulation,\n\t\t\t);\n\t\t} else {\n\t\t\tthis.assertSupportsCommand(\n\t\t\t\tSecurityCommand,\n\t\t\t\tSecurityCommand.CommandEncapsulationNonceGet,\n\t\t\t);\n\t\t}\n\n\t\tconst cc = new (\n\t\t\trequestNextNonce\n\t\t\t\t? SecurityCCCommandEncapsulationNonceGet\n\t\t\t\t: SecurityCCCommandEncapsulation\n\t\t)({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tencapsulated,\n\t\t});\n\t\tawait this.host.sendCommand(cc, this.commandOptions);\n\t}\n\n\t/**\n\t * Requests a new nonce for Security CC encapsulation which is not directly linked to a specific command.\n\t */\n\tpublic async getNonce(): Promise<Uint8Array | undefined> {\n\t\tthis.assertSupportsCommand(SecurityCommand, SecurityCommand.NonceGet);\n\n\t\tconst cc = new SecurityCCNonceGet({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t});\n\t\tconst response = await this.host.sendCommand<SecurityCCNonceReport>(\n\t\t\tcc,\n\t\t\t{\n\t\t\t\t...this.commandOptions,\n\t\t\t\t// Only try getting a nonce once\n\t\t\t\tmaxSendAttempts: 1,\n\t\t\t},\n\t\t);\n\t\tif (!response) return;\n\n\t\tconst nonce = response.nonce;\n\t\tconst secMan = this.host.securityManager!;\n\t\tsecMan.setNonce(\n\t\t\t{\n\t\t\t\tissuer: this.endpoint.nodeId,\n\t\t\t\tnonceId: secMan.getNonceId(nonce),\n\t\t\t},\n\t\t\t{ nonce, receiver: this.host.ownNodeId },\n\t\t\t{ free: true },\n\t\t);\n\t\treturn nonce;\n\t}\n\n\t/**\n\t * Responds to a NonceGet request. The message is sent without any retransmission etc.\n\t * The return value indicates whether a nonce was successfully sent\n\t */\n\tpublic async sendNonce(): Promise<boolean> {\n\t\tthis.assertSupportsCommand(\n\t\t\tSecurityCommand,\n\t\t\tSecurityCommand.NonceReport,\n\t\t);\n\n\t\tif (!this.host.securityManager) {\n\t\t\tthrow new ZWaveError(\n\t\t\t\t`Nonces can only be sent if secure communication is set up!`,\n\t\t\t\tZWaveErrorCodes.Driver_NoSecurity,\n\t\t\t);\n\t\t}\n\n\t\tconst nonce = this.host.securityManager.generateNonce(\n\t\t\tthis.endpoint.nodeId,\n\t\t\tHALF_NONCE_SIZE,\n\t\t);\n\t\tconst nonceId = this.host.securityManager.getNonceId(nonce);\n\n\t\tconst cc = new SecurityCCNonceReport({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t\tnonce,\n\t\t});\n\n\t\ttry {\n\t\t\tawait this.host.sendCommand(cc, {\n\t\t\t\t...this.commandOptions,\n\t\t\t\t// Seems we need these options or some nodes won't accept the nonce\n\t\t\t\ttransmitOptions: TransmitOptions.ACK\n\t\t\t\t\t| TransmitOptions.AutoRoute,\n\t\t\t\t// Only try sending a nonce once\n\t\t\t\tmaxSendAttempts: 1,\n\t\t\t\t// Nonce requests must be handled immediately\n\t\t\t\tpriority: MessagePriority.Immediate,\n\t\t\t\t// We don't want failures causing us to treat the node as asleep or dead\n\t\t\t\tchangeNodeStatusOnMissingACK: false,\n\t\t\t});\n\t\t} catch (e) {\n\t\t\tif (isTransmissionError(e)) {\n\t\t\t\t// The nonce could not be sent, invalidate it\n\t\t\t\tthis.host.securityManager.deleteNonce(nonceId);\n\t\t\t\treturn false;\n\t\t\t} else {\n\t\t\t\t// Pass other errors through\n\t\t\t\tthrow e;\n\t\t\t}\n\t\t}\n\t\treturn true;\n\t}\n\n\tpublic async getSecurityScheme(): Promise<[0]> {\n\t\tthis.assertSupportsCommand(SecurityCommand, SecurityCommand.SchemeGet);\n\n\t\tconst cc = new SecurityCCSchemeGet({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t});\n\t\tawait this.host.sendCommand(cc, this.commandOptions);\n\t\t// There is only one scheme, so we hardcode it\n\t\treturn [0];\n\t}\n\n\tpublic async reportSecurityScheme(encapsulated: boolean): Promise<void> {\n\t\tthis.assertSupportsCommand(\n\t\t\tSecurityCommand,\n\t\t\tSecurityCommand.SchemeReport,\n\t\t);\n\n\t\tlet cc: CommandClass = new SecurityCCSchemeReport({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t});\n\t\tif (encapsulated) {\n\t\t\tcc = new SecurityCCCommandEncapsulation({\n\t\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\t\tendpointIndex: this.endpoint.index,\n\t\t\t\tencapsulated: cc,\n\t\t\t});\n\t\t}\n\t\tawait this.host.sendCommand(cc, this.commandOptions);\n\t}\n\n\tpublic async inheritSecurityScheme(): Promise<void> {\n\t\tthis.assertSupportsCommand(\n\t\t\tSecurityCommand,\n\t\t\tSecurityCommand.SchemeInherit,\n\t\t);\n\n\t\tconst cc = new SecurityCCSchemeInherit({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t});\n\t\tawait this.host.sendCommand(cc, this.commandOptions);\n\t\t// There is only one scheme, so we don't return anything here\n\t}\n\n\tpublic async setNetworkKey(networkKey: Uint8Array): Promise<void> {\n\t\tthis.assertSupportsCommand(\n\t\t\tSecurityCommand,\n\t\t\tSecurityCommand.NetworkKeySet,\n\t\t);\n\n\t\tconst keySet = new SecurityCCNetworkKeySet({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t\tnetworkKey,\n\t\t});\n\t\tconst cc = new SecurityCCCommandEncapsulation({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t\tencapsulated: keySet,\n\t\t\talternativeNetworkKey: new Uint8Array(16).fill(0),\n\t\t});\n\t\tawait this.host.sendCommand(cc, this.commandOptions);\n\t}\n\n\tpublic async verifyNetworkKey(): Promise<void> {\n\t\tthis.assertSupportsCommand(\n\t\t\tSecurityCommand,\n\t\t\tSecurityCommand.NetworkKeyVerify,\n\t\t);\n\n\t\tconst cc = new SecurityCCNetworkKeyVerify({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t});\n\t\tawait this.host.sendCommand(cc, this.commandOptions);\n\t}\n\n\t// eslint-disable-next-line @typescript-eslint/explicit-module-boundary-types\n\tpublic async getSupportedCommands() {\n\t\tthis.assertSupportsCommand(\n\t\t\tSecurityCommand,\n\t\t\tSecurityCommand.CommandsSupportedGet,\n\t\t);\n\n\t\tconst cc = new SecurityCCCommandsSupportedGet({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t});\n\t\tconst response = await this.host.sendCommand<\n\t\t\tSecurityCCCommandsSupportedReport\n\t\t>(\n\t\t\tcc,\n\t\t\tthis.commandOptions,\n\t\t);\n\t\tif (response) {\n\t\t\treturn pick(response, [\"supportedCCs\", \"controlledCCs\"]);\n\t\t}\n\t}\n\n\tpublic async reportSupportedCommands(\n\t\tsupportedCCs: CommandClasses[],\n\t\tcontrolledCCs: CommandClasses[],\n\t): Promise<void> {\n\t\tthis.assertSupportsCommand(\n\t\t\tSecurityCommand,\n\t\t\tSecurityCommand.CommandsSupportedReport,\n\t\t);\n\n\t\tconst cc = new SecurityCCCommandsSupportedReport({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t\tsupportedCCs,\n\t\t\tcontrolledCCs,\n\t\t\treportsToFollow: 0,\n\t\t});\n\t\tawait this.host.sendCommand(cc, this.commandOptions);\n\t}\n}\n\n@commandClass(CommandClasses.Security)\n@implementedVersion(1)\nexport class SecurityCC extends CommandClass {\n\tdeclare ccCommand: SecurityCommand;\n\t// Force singlecast for the Security CC\n\tdeclare nodeId: number;\n\n\tpublic async interview(\n\t\tctx: InterviewContext,\n\t): Promise<void> {\n\t\tconst node = this.getNode(ctx)!;\n\t\tconst endpoint = this.getEndpoint(ctx)!;\n\t\tconst api = CCAPI.create(\n\t\t\tCommandClasses.Security,\n\t\t\tctx,\n\t\t\tendpoint,\n\t\t).withOptions({\n\t\t\tpriority: MessagePriority.NodeQuery,\n\t\t});\n\n\t\tctx.logNode(node.id, {\n\t\t\tmessage: \"Querying securely supported commands (S0)...\",\n\t\t\tdirection: \"outbound\",\n\t\t});\n\n\t\tlet supportedCCs: CommandClasses[] | undefined;\n\t\tlet controlledCCs: CommandClasses[] | undefined;\n\n\t\t// Try up to 3 times on the root device. We REALLY don't want a spurious timeout or collision to cause us to discard a known good security class\n\t\tconst MAX_ATTEMPTS = this.endpointIndex === 0 ? 3 : 1;\n\t\tfor (let attempts = 1; attempts <= MAX_ATTEMPTS; attempts++) {\n\t\t\tconst resp = await api.getSupportedCommands();\n\t\t\tif (resp) {\n\t\t\t\tsupportedCCs = resp.supportedCCs;\n\t\t\t\tcontrolledCCs = resp.controlledCCs;\n\t\t\t\tbreak;\n\t\t\t} else if (attempts < MAX_ATTEMPTS) {\n\t\t\t\tctx.logNode(node.id, {\n\t\t\t\t\tendpoint: this.endpointIndex,\n\t\t\t\t\tmessage:\n\t\t\t\t\t\t`Querying securely supported commands (S0), attempt ${attempts}/${MAX_ATTEMPTS} failed. Retrying in 500ms...`,\n\t\t\t\t\tlevel: \"warn\",\n\t\t\t\t});\n\t\t\t\tawait wait(500);\n\t\t\t}\n\t\t}\n\n\t\tif (!supportedCCs || !controlledCCs) {\n\t\t\tif (node.hasSecurityClass(SecurityClass.S0_Legacy) === true) {\n\t\t\t\tctx.logNode(node.id, {\n\t\t\t\t\tendpoint: this.endpointIndex,\n\t\t\t\t\tmessage: \"Querying securely supported commands (S0) failed\",\n\t\t\t\t\tlevel: \"warn\",\n\t\t\t\t});\n\t\t\t\t// TODO: Abort interview?\n\t\t\t} else {\n\t\t\t\t// We didn't know if the node was secure and it didn't respond,\n\t\t\t\t// assume that it doesn't have the S0 security class\n\t\t\t\tctx.logNode(\n\t\t\t\t\tnode.id,\n\t\t\t\t\t`The node was not granted the S0 security class. Continuing interview non-securely.`,\n\t\t\t\t);\n\t\t\t\tnode.setSecurityClass(SecurityClass.S0_Legacy, false);\n\t\t\t}\n\t\t\treturn;\n\t\t}\n\n\t\tconst logLines: string[] = [\n\t\t\t\"received secure commands (S0)\",\n\t\t\t\"supported CCs:\",\n\t\t];\n\t\tfor (const cc of supportedCCs) {\n\t\t\tlogLines.push(`\u00B7 ${getCCName(cc)}`);\n\t\t}\n\t\tlogLines.push(\"controlled CCs:\");\n\t\tfor (const cc of controlledCCs) {\n\t\t\tlogLines.push(`\u00B7 ${getCCName(cc)}`);\n\t\t}\n\t\tctx.logNode(node.id, {\n\t\t\tmessage: logLines.join(\"\\n\"),\n\t\t\tdirection: \"inbound\",\n\t\t});\n\n\t\t// Remember which commands are supported securely\n\t\tfor (const cc of supportedCCs) {\n\t\t\t// Basic CC has special rules for when it is considered supported\n\t\t\t// Therefore we mark all other CCs as supported, but not Basic CC,\n\t\t\t// for which support is determined later.\n\t\t\tif (cc === CommandClasses.Basic) {\n\t\t\t\tendpoint.addCC(cc, { secure: true });\n\t\t\t} else {\n\t\t\t\tendpoint.addCC(cc, {\n\t\t\t\t\tisSupported: true,\n\t\t\t\t\tsecure: true,\n\t\t\t\t});\n\t\t\t}\n\t\t}\n\t\tfor (const cc of controlledCCs) {\n\t\t\t// Basic CC has special rules for when it is considered supported\n\t\t\t// Therefore we mark all other CCs as supported, but not Basic CC,\n\t\t\t// for which support is determined later.\n\t\t\tif (cc === CommandClasses.Basic) {\n\t\t\t\tendpoint.addCC(cc, { secure: true });\n\t\t\t} else {\n\t\t\t\tendpoint.addCC(cc, {\n\t\t\t\t\tisControlled: true,\n\t\t\t\t\tsecure: true,\n\t\t\t\t});\n\t\t\t}\n\t\t}\n\n\t\t// We know for sure that the node is included securely\n\t\tif (node.hasSecurityClass(SecurityClass.S0_Legacy) !== true) {\n\t\t\tnode.setSecurityClass(SecurityClass.S0_Legacy, true);\n\t\t\tctx.logNode(\n\t\t\t\tnode.id,\n\t\t\t\t`The node was granted the S0 security class`,\n\t\t\t);\n\t\t}\n\n\t\t// Remember that the interview is complete\n\t\tthis.setInterviewComplete(ctx, true);\n\t}\n\n\t/** Tests if a command should be sent secure and thus requires encapsulation */\n\tpublic static requiresEncapsulation(cc: CommandClass): boolean {\n\t\t// No security flag -> no encapsulation\n\t\tif (!(cc.encapsulationFlags & EncapsulationFlags.Security)) {\n\t\t\treturn false;\n\t\t}\n\n\t\t// S2, CRC16, Transport Service -> no S2 encapsulation\n\t\tif (\n\t\t\tcc instanceof Security2CC\n\t\t\t|| cc instanceof CRC16CC\n\t\t\t|| cc instanceof TransportServiceCC\n\t\t) {\n\t\t\treturn false;\n\t\t}\n\n\t\t// S0: check command\n\t\tif (cc instanceof SecurityCC) {\n\t\t\tswitch (cc.ccCommand) {\n\t\t\t\t// Already encapsulated\n\t\t\t\tcase SecurityCommand.CommandEncapsulation:\n\t\t\t\tcase SecurityCommand.CommandEncapsulationNonceGet:\n\t\t\t\t// Cannot be sent encapsulated:\n\t\t\t\tcase SecurityCommand.NonceGet:\n\t\t\t\tcase SecurityCommand.NonceReport:\n\t\t\t\tcase SecurityCommand.SchemeGet:\n\t\t\t\tcase SecurityCommand.SchemeReport:\n\t\t\t\t\treturn false;\n\n\t\t\t\tdefault:\n\t\t\t\t\t// All other commands must be encapsulated\n\t\t\t\t\treturn true;\n\t\t\t}\n\t\t}\n\n\t\t// Everything else needs to be encapsulated if the CC is secure\n\t\treturn true;\n\t}\n\n\t/** Encapsulates a command that should be sent encrypted */\n\tpublic static encapsulate(\n\t\townNodeId: number,\n\t\tsecurityManager: SecurityManager,\n\t\tcc: CommandClass,\n\t): SecurityCCCommandEncapsulation {\n\t\t// TODO: When to return a SecurityCCCommandEncapsulationNonceGet?\n\t\tconst ret = new SecurityCCCommandEncapsulation({\n\t\t\tnodeId: cc.nodeId,\n\t\t\tencapsulated: cc,\n\t\t});\n\n\t\t// Copy the encapsulation flags from the encapsulated command\n\t\t// but omit Security, since we're doing that right now\n\t\tret.encapsulationFlags = cc.encapsulationFlags\n\t\t\t& ~EncapsulationFlags.Security;\n\n\t\treturn ret;\n\t}\n}\n\ninterface SecurityCCNonceReportOptions {\n\tnonce: Uint8Array;\n}\n\n@CCCommand(SecurityCommand.NonceReport)\nexport class SecurityCCNonceReport extends SecurityCC {\n\tconstructor(\n\t\toptions: WithAddress<SecurityCCNonceReportOptions>,\n\t) {\n\t\tsuper(options);\n\t\tif (options.nonce.length !== HALF_NONCE_SIZE) {\n\t\t\tthrow new ZWaveError(\n\t\t\t\t`Nonce must have length ${HALF_NONCE_SIZE}!`,\n\t\t\t\tZWaveErrorCodes.Argument_Invalid,\n\t\t\t);\n\t\t}\n\t\tthis.nonce = options.nonce;\n\t}\n\n\tpublic static from(\n\t\traw: CCRaw,\n\t\tctx: CCParsingContext,\n\t): SecurityCCNonceReport {\n\t\tvalidatePayload.withReason(\"Invalid nonce length\")(\n\t\t\traw.payload.length === HALF_NONCE_SIZE,\n\t\t);\n\n\t\treturn new this({\n\t\t\tnodeId: ctx.sourceNodeId,\n\t\t\tnonce: raw.payload,\n\t\t});\n\t}\n\n\tpublic nonce: Uint8Array;\n\n\tpublic serialize(ctx: CCEncodingContext): Bytes {\n\t\tthis.payload = Bytes.view(this.nonce);\n\t\t// eslint-disable-next-line @typescript-eslint/no-deprecated\n\t\treturn super.serialize(ctx);\n\t}\n\n\tpublic toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry {\n\t\treturn {\n\t\t\t...super.toLogEntry(ctx),\n\t\t\tmessage: { nonce: buffer2hex(this.nonce) },\n\t\t};\n\t}\n}\n\n@CCCommand(SecurityCommand.NonceGet)\n@expectedCCResponse(SecurityCCNonceReport)\nexport class SecurityCCNonceGet extends SecurityCC {}\n\n// @publicAPI\nexport type SecurityCCCommandEncapsulationOptions =\n\t& {\n\t\talternativeNetworkKey?: Uint8Array;\n\t}\n\t& ({\n\t\tencapsulated: CommandClass;\n\t} | {\n\t\tdecryptedCCBytes: Uint8Array;\n\t\tsequenced: boolean;\n\t\tsecondFrame: boolean;\n\t\tsequenceCounter: number;\n\t});\n\nfunction getCCResponseForCommandEncapsulation(\n\tsent: SecurityCCCommandEncapsulation,\n) {\n\tif (sent.encapsulated.expectsCCResponse()) {\n\t\treturn SecurityCCCommandEncapsulation;\n\t}\n}\n\n@CCCommand(SecurityCommand.CommandEncapsulation)\n@expectedCCResponse(\n\tgetCCResponseForCommandEncapsulation,\n\t() => \"checkEncapsulated\",\n)\nexport class SecurityCCCommandEncapsulation extends SecurityCC {\n\tpublic constructor(\n\t\toptions: WithAddress<SecurityCCCommandEncapsulationOptions>,\n\t) {\n\t\tsuper(options);\n\n\t\tif (\"encapsulated\" in options) {\n\t\t\tthis.encapsulated = options.encapsulated;\n\t\t\tthis.encapsulated.encapsulatingCC = this as any;\n\t\t} else {\n\t\t\tthis.decryptedCCBytes = options.decryptedCCBytes;\n\t\t\tthis.sequenced = options.sequenced;\n\t\t\tthis.secondFrame = options.secondFrame;\n\t\t\tthis.sequenceCounter = options.sequenceCounter;\n\t\t}\n\t\tthis.alternativeNetworkKey = options.alternativeNetworkKey;\n\t}\n\n\tpublic static from(\n\t\traw: CCRaw,\n\t\tctx: CCParsingContext,\n\t): SecurityCCCommandEncapsulation {\n\t\tassertSecurityRX(ctx);\n\n\t\t// HALF_NONCE_SIZE bytes iv, 1 byte frame control, at least 1 CC byte, 1 byte nonce id, 8 bytes auth code\n\t\tvalidatePayload(\n\t\t\traw.payload.length >= HALF_NONCE_SIZE + 1 + 1 + 1 + 8,\n\t\t);\n\t\tconst iv = raw.payload.subarray(0, HALF_NONCE_SIZE);\n\t\tconst encryptedPayload = raw.payload.subarray(HALF_NONCE_SIZE, -9);\n\t\tconst nonceId = raw.payload.at(-9)!;\n\t\tconst authCode = raw.payload.subarray(-8);\n\n\t\t// Retrieve the used nonce from the nonce store\n\t\tconst nonce = ctx.securityManager.getNonce(nonceId);\n\t\t// Only accept the message if the nonce hasn't expired\n\t\tif (!nonce) {\n\t\t\tvalidatePayload.fail(\n\t\t\t\t`Nonce ${\n\t\t\t\t\tnum2hex(\n\t\t\t\t\t\tnonceId,\n\t\t\t\t\t)\n\t\t\t\t} expired, cannot decode security encapsulated command.`,\n\t\t\t);\n\t\t}\n\t\t// and mark the nonce as used\n\t\tctx.securityManager.deleteNonce(nonceId);\n\n\t\t// Validate the encrypted data\n\t\tconst authData = getAuthenticationData(\n\t\t\tiv,\n\t\t\tnonce,\n\t\t\tSecurityCommand.CommandEncapsulation,\n\t\t\tctx.sourceNodeId,\n\t\t\tctx.ownNodeId,\n\t\t\tencryptedPayload,\n\t\t);\n\t\t// eslint-disable-next-line @typescript-eslint/no-deprecated\n\t\tconst expectedAuthCode = computeMACSync(\n\t\t\tauthData,\n\t\t\t// eslint-disable-next-line @typescript-eslint/no-deprecated\n\t\t\tctx.securityManager.authKey,\n\t\t);\n\t\t// Only accept messages with a correct auth code\n\t\tvalidatePayload.withReason(\n\t\t\t\"Invalid auth code, won't accept security encapsulated command.\",\n\t\t)(authCode.equals(expectedAuthCode));\n\n\t\t// Decrypt the encapsulated CC\n\t\t// eslint-disable-next-line @typescript-eslint/no-deprecated\n\t\tconst frameControlAndDecryptedCC = decryptAES128OFBSync(\n\t\t\tencryptedPayload,\n\t\t\t// eslint-disable-next-line @typescript-eslint/no-deprecated\n\t\t\tctx.securityManager.encryptionKey,\n\t\t\tBytes.concat([iv, nonce]),\n\t\t);\n\t\tconst frameControl = frameControlAndDecryptedCC[0];\n\t\tconst sequenceCounter = frameControl & 0b1111;\n\t\tconst sequenced = !!(frameControl & 0b1_0000);\n\t\tconst secondFrame = !!(frameControl & 0b10_0000);\n\t\tconst decryptedCCBytes: Uint8Array | undefined =\n\t\t\tframeControlAndDecryptedCC\n\t\t\t\t.subarray(1);\n\n\t\tconst ret = new SecurityCCCommandEncapsulation({\n\t\t\tnodeId: ctx.sourceNodeId,\n\t\t\tsequenceCounter,\n\t\t\tsequenced,\n\t\t\tsecondFrame,\n\t\t\tdecryptedCCBytes,\n\t\t});\n\n\t\tret.authData = authData;\n\t\tret.authCode = authCode;\n\t\tret.iv = iv;\n\n\t\treturn ret;\n\t}\n\n\tpublic static async fromAsync(\n\t\traw: CCRaw,\n\t\tctx: CCParsingContext,\n\t): Promise<SecurityCCCommandEncapsulation> {\n\t\tassertSecurityRX(ctx);\n\n\t\t// HALF_NONCE_SIZE bytes iv, 1 byte frame control, at least 1 CC byte, 1 byte nonce id, 8 bytes auth code\n\t\tvalidatePayload(\n\t\t\traw.payload.length >= HALF_NONCE_SIZE + 1 + 1 + 1 + 8,\n\t\t);\n\t\tconst iv = raw.payload.subarray(0, HALF_NONCE_SIZE);\n\t\tconst encryptedPayload = raw.payload.subarray(HALF_NONCE_SIZE, -9);\n\t\tconst nonceId = raw.payload.at(-9)!;\n\t\tconst authCode = raw.payload.subarray(-8);\n\n\t\t// Retrieve the used nonce from the nonce store\n\t\tconst nonce = ctx.securityManager.getNonce(nonceId);\n\t\t// Only accept the message if the nonce hasn't expired\n\t\tif (!nonce) {\n\t\t\tvalidatePayload.fail(\n\t\t\t\t`Nonce ${\n\t\t\t\t\tnum2hex(\n\t\t\t\t\t\tnonceId,\n\t\t\t\t\t)\n\t\t\t\t} expired, cannot decode security encapsulated command.`,\n\t\t\t);\n\t\t}\n\t\t// and mark the nonce as used\n\t\tctx.securityManager.deleteNonce(nonceId);\n\n\t\t// Validate the encrypted data\n\t\tconst authData = getAuthenticationData(\n\t\t\tiv,\n\t\t\tnonce,\n\t\t\tSecurityCommand.CommandEncapsulation,\n\t\t\tctx.sourceNodeId,\n\t\t\tctx.ownNodeId,\n\t\t\tencryptedPayload,\n\t\t);\n\t\tconst expectedAuthCode = await computeMACAsync(\n\t\t\tauthData,\n\t\t\tawait ctx.securityManager.getAuthKey(),\n\t\t);\n\t\t// Only accept messages with a correct auth code\n\t\tvalidatePayload.withReason(\n\t\t\t\"Invalid auth code, won't accept security encapsulated command.\",\n\t\t)(authCode.equals(expectedAuthCode));\n\n\t\t// Decrypt the encapsulated CC\n\t\tconst frameControlAndDecryptedCC = await decryptAES128OFBAsync(\n\t\t\tencryptedPayload,\n\t\t\tawait ctx.securityManager.getEncryptionKey(),\n\t\t\tBytes.concat([iv, nonce]),\n\t\t);\n\t\tconst frameControl = frameControlAndDecryptedCC[0];\n\t\tconst sequenceCounter = frameControl & 0b1111;\n\t\tconst sequenced = !!(frameControl & 0b1_0000);\n\t\tconst secondFrame = !!(frameControl & 0b10_0000);\n\t\tconst decryptedCCBytes: Uint8Array | undefined =\n\t\t\tframeControlAndDecryptedCC\n\t\t\t\t.subarray(1);\n\n\t\tconst ret = new SecurityCCCommandEncapsulation({\n\t\t\tnodeId: ctx.sourceNodeId,\n\t\t\tsequenceCounter,\n\t\t\tsequenced,\n\t\t\tsecondFrame,\n\t\t\tdecryptedCCBytes,\n\t\t});\n\n\t\tret.authData = authData;\n\t\tret.authCode = authCode;\n\t\tret.iv = iv;\n\n\t\treturn ret;\n\t}\n\n\tprivate sequenced: boolean | undefined;\n\tprivate secondFrame: boolean | undefined;\n\tprivate sequenceCounter: number | undefined;\n\n\tprivate decryptedCCBytes: Uint8Array | undefined;\n\tpublic encapsulated!: CommandClass;\n\n\tprivate alternativeNetworkKey?: Uint8Array;\n\n\tpublic get nonceId(): number | undefined {\n\t\treturn this.nonce?.[0];\n\t}\n\tpublic nonce: Uint8Array | undefined;\n\n\t// Only used testing/for debugging purposes\n\tprivate iv?: Uint8Array;\n\tprivate authData?: Uint8Array;\n\tprivate authCode?: Uint8Array;\n\tprivate ciphertext?: Uint8Array;\n\n\tpublic getPartialCCSessionId(): Record<string, any> | undefined {\n\t\tif (this.sequenced) {\n\t\t\treturn {\n\t\t\t\t// Treat Encapsulation and EncapsulationNonceGet as one\n\t\t\t\tccCommand: undefined,\n\t\t\t\tsequence: this.sequenceCounter,\n\t\t\t};\n\t\t} else {\n\t\t\treturn {\n\t\t\t\t// Treat Encapsulation and EncapsulationNonceGet as one\n\t\t\t\tccCommand: undefined,\n\t\t\t};\n\t\t}\n\t}\n\n\tpublic expectMoreMessages(): boolean {\n\t\treturn !!this.sequenced && !this.secondFrame;\n\t}\n\n\t/** @deprecated Use {@link mergePartialCCsAsync} instead */\n\tpublic mergePartialCCs(\n\t\tpartials: SecurityCCCommandEncapsulation[],\n\t\tctx: CCParsingContext,\n\t): void {\n\t\t// Concat the CC buffers\n\t\tthis.decryptedCCBytes = Bytes.concat(\n\t\t\t[...partials, this].map((cc) => cc.decryptedCCBytes!),\n\t\t);\n\t\t// make sure this contains a complete CC command that's worth splitting\n\t\tvalidatePayload(this.decryptedCCBytes.length >= 2);\n\t\t// and deserialize the CC\n\t\t// eslint-disable-next-line @typescript-eslint/no-deprecated\n\t\tthis.encapsulated = CommandClass.parse(this.decryptedCCBytes, ctx);\n\t\tthis.encapsulated.encapsulatingCC = this as any;\n\t}\n\n\tpublic async mergePartialCCsAsync(\n\t\tpartials: SecurityCCCommandEncapsulation[],\n\t\tctx: CCParsingContext,\n\t): Promise<void> {\n\t\t// Concat the CC buffers\n\t\tthis.decryptedCCBytes = Bytes.concat(\n\t\t\t[...partials, this].map((cc) => cc.decryptedCCBytes!),\n\t\t);\n\t\t// make sure this contains a complete CC command that's worth splitting\n\t\tvalidatePayload(this.decryptedCCBytes.length >= 2);\n\t\t// and deserialize the CC\n\t\tthis.encapsulated = await CommandClass.parseAsync(\n\t\t\tthis.decryptedCCBytes,\n\t\t\tctx,\n\t\t);\n\t\tthis.encapsulated.encapsulatingCC = this as any;\n\t}\n\n\t/** @deprecated Use {@link serializeAsync} instead */\n\tpublic serialize(ctx: CCEncodingContext): Bytes {\n\t\tif (!this.nonce) throwNoNonce();\n\t\tif (this.nonce.length !== HALF_NONCE_SIZE) {\n\t\t\tthrowNoNonce(\"Invalid nonce size\");\n\t\t}\n\t\tassertSecurityTX(ctx);\n\n\t\tlet authKey: Uint8Array;\n\t\tlet encryptionKey: Uint8Array;\n\t\tif (this.alternativeNetworkKey) {\n\t\t\t// eslint-disable-next-line @typescript-eslint/no-deprecated\n\t\t\tauthKey = generateAuthKeySync(this.alternativeNetworkKey);\n\t\t\t// eslint-disable-next-line @typescript-eslint/no-deprecated\n\t\t\tencryptionKey = generateEncryptionKeySync(\n\t\t\t\tthis.alternativeNetworkKey,\n\t\t\t);\n\t\t} else {\n\t\t\t// eslint-disable-next-line @typescript-eslint/no-deprecated\n\t\t\tauthKey = ctx.securityManager.authKey;\n\t\t\t// eslint-disable-next-line @typescript-eslint/no-deprecated\n\t\t\tencryptionKey = ctx.securityManager.encryptionKey;\n\t\t}\n\n\t\t// eslint-disable-next-line @typescript-eslint/no-deprecated\n\t\tconst serializedCC = this.encapsulated.serialize(ctx);\n\t\tconst plaintext = Bytes.concat([\n\t\t\tBytes.from([0]), // TODO: frame control\n\t\t\tserializedCC,\n\t\t]);\n\t\t// Encrypt the payload\n\t\tconst senderNonce = randomBytes(HALF_NONCE_SIZE);\n\t\tconst iv = Bytes.concat([senderNonce, this.nonce]);\n\t\t// eslint-disable-next-line @typescript-eslint/no-deprecated\n\t\tconst ciphertext = encryptAES128OFBSync(plaintext, encryptionKey, iv);\n\t\t// And generate the auth code\n\t\tconst authData = getAuthenticationData(\n\t\t\tsenderNonce,\n\t\t\tthis.nonce,\n\t\t\tthis.ccCommand,\n\t\t\tctx.ownNodeId,\n\t\t\tthis.nodeId,\n\t\t\tciphertext,\n\t\t);\n\t\t// eslint-disable-next-line @typescript-eslint/no-deprecated\n\t\tconst authCode = computeMACSync(authData, authKey);\n\n\t\t// Remember for debugging purposes\n\t\tthis.iv = iv;\n\t\tthis.authData = authData;\n\t\tthis.authCode = authCode;\n\t\tthis.ciphertext = ciphertext;\n\n\t\tthis.payload = Bytes.concat([\n\t\t\tsenderNonce,\n\t\t\tciphertext,\n\t\t\tBytes.from([this.nonceId!]),\n\t\t\tauthCode,\n\t\t]);\n\t\t// eslint-disable-next-line @typescript-eslint/no-deprecated\n\t\treturn super.serialize(ctx);\n\t}\n\n\tpublic async serializeAsync(ctx: CCEncodingContext): Promise<Bytes> {\n\t\tif (!this.nonce) throwNoNonce();\n\t\tif (this.nonce.length !== HALF_NONCE_SIZE) {\n\t\t\tthrowNoNonce(\"Invalid nonce size\");\n\t\t}\n\t\tassertSecurityTX(ctx);\n\n\t\tlet authKey: Uint8Array;\n\t\tlet encryptionKey: Uint8Array;\n\t\tif (this.alternativeNetworkKey) {\n\t\t\tauthKey = await generateAuthKeyAsync(this.alternativeNetworkKey);\n\t\t\tencryptionKey = await generateEncryptionKeyAsync(\n\t\t\t\tthis.alternativeNetworkKey,\n\t\t\t);\n\t\t} else {\n\t\t\tauthKey = await ctx.securityManager.getAuthKey();\n\t\t\tencryptionKey = await ctx.securityManager.getEncryptionKey();\n\t\t}\n\n\t\tconst serializedCC = await this.encapsulated.serializeAsync(ctx);\n\t\tconst plaintext = Bytes.concat([\n\t\t\tBytes.from([0]), // TODO: frame control\n\t\t\tserializedCC,\n\t\t]);\n\t\t// Encrypt the payload\n\t\tconst senderNonce = randomBytes(HALF_NONCE_SIZE);\n\t\tconst iv = Bytes.concat([senderNonce, this.nonce]);\n\t\tconst ciphertext = await encryptAES128OFBAsync(\n\t\t\tplaintext,\n\t\t\tencryptionKey,\n\t\t\tiv,\n\t\t);\n\t\t// And generate the auth code\n\t\tconst authData = getAuthenticationData(\n\t\t\tsenderNonce,\n\t\t\tthis.nonce,\n\t\t\tthis.ccCommand,\n\t\t\tctx.ownNodeId,\n\t\t\tthis.nodeId,\n\t\t\tciphertext,\n\t\t);\n\t\tconst authCode = await computeMACAsync(authData, authKey);\n\n\t\t// Remember for debugging purposes\n\t\tthis.iv = iv;\n\t\tthis.authData = authData;\n\t\tthis.authCode = authCode;\n\t\tthis.ciphertext = ciphertext;\n\n\t\tthis.payload = Bytes.concat([\n\t\t\tsenderNonce,\n\t\t\tciphertext,\n\t\t\tBytes.from([this.nonceId!]),\n\t\t\tauthCode,\n\t\t]);\n\t\treturn super.serializeAsync(ctx);\n\t}\n\n\tprotected computeEncapsulationOverhead(): number {\n\t\t// Security CC adds 8 bytes IV, 1 byte frame control, 1 byte nonce ID, 8 bytes MAC\n\t\treturn super.computeEncapsulationOverhead() + 18;\n\t}\n\n\tpublic toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry {\n\t\tconst message: MessageRecord = {};\n\t\tif (this.nonceId != undefined) {\n\t\t\tmessage[\"nonce id\"] = this.nonceId;\n\t\t}\n\t\tif (this.sequenced != undefined) {\n\t\t\tmessage.sequenced = this.sequenced;\n\t\t\tif (this.sequenced) {\n\t\t\t\tif (this.secondFrame != undefined) {\n\t\t\t\t\tmessage[\"second frame\"] = this.secondFrame;\n\t\t\t\t}\n\t\t\t\tif (this.sequenceCounter != undefined) {\n\t\t\t\t\tmessage[\"sequence counter\"] = this.sequenceCounter;\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\t// Log the plaintext in integration tests and development mode\n\t\tif (\n\t\t\tprocess.env.NODE_ENV === \"test\"\n\t\t\t|| process.env.NODE_ENV === \"development\"\n\t\t) {\n\t\t\tif (this.iv) {\n\t\t\t\tmessage.IV = buffer2hex(this.iv);\n\t\t\t}\n\t\t\tif (this.ciphertext) {\n\t\t\t\tmessage.ciphertext = buffer2hex(this.ciphertext);\n\t\t\t} else if (this.decryptedCCBytes) {\n\t\t\t\tmessage.plaintext = buffer2hex(this.decryptedCCBytes);\n\t\t\t}\n\t\t\tif (this.authData) {\n\t\t\t\tmessage[\"auth data\"] = buffer2hex(this.authData);\n\t\t\t}\n\t\t\tif (this.authCode) {\n\t\t\t\tmessage[\"auth code\"] = buffer2hex(this.authCode);\n\t\t\t}\n\t\t}\n\t\treturn {\n\t\t\t...super.toLogEntry(ctx),\n\t\t\tmessage,\n\t\t};\n\t}\n}\n\n// This is the same message, but with another CC command\n@CCCommand(SecurityCommand.CommandEncapsulationNonceGet)\nexport class SecurityCCCommandEncapsulationNonceGet\n\textends SecurityCCCommandEncapsulation\n{}\n\n@CCCommand(SecurityCommand.SchemeReport)\nexport class SecurityCCSchemeReport extends SecurityCC {\n\tpublic static from(\n\t\traw: CCRaw,\n\t\tctx: CCParsingContext,\n\t): SecurityCCSchemeReport {\n\t\tvalidatePayload(raw.payload.length >= 1);\n\t\t// The including controller MUST NOT perform any validation of the Supported Security Schemes byte\n\t\treturn new this({\n\t\t\tnodeId: ctx.sourceNodeId,\n\t\t});\n\t}\n\n\tpublic serialize(ctx: CCEncodingContext): Bytes {\n\t\t// Since it is unlikely that any more schemes will be added to S0, we hardcode the default scheme here (bit 0 = 0)\n\t\tthis.payload = Bytes.from([0]);\n\t\t// eslint-disable-next-line @typescript-eslint/no-deprecated\n\t\treturn super.serialize(ctx);\n\t}\n\n\tpublic toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry {\n\t\treturn {\n\t\t\t...super.toLogEntry(ctx),\n\t\t\t// Hide the default payload line\n\t\t\tmessage: undefined,\n\t\t};\n\t}\n}\n\n@CCCommand(SecurityCommand.SchemeGet)\n@expectedCCResponse(SecurityCCSchemeReport)\nexport class SecurityCCSchemeGet extends SecurityCC {\n\tpublic serialize(ctx: CCEncodingContext): Bytes {\n\t\t// Since it is unlikely that any more schemes will be added to S0, we hardcode the default scheme here (bit 0 = 0)\n\t\tthis.payload = Bytes.from([0]);\n\t\t// eslint-disable-next-line @typescript-eslint/no-deprecated\n\t\treturn super.serialize(ctx);\n\t}\n\n\tpublic toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry {\n\t\treturn {\n\t\t\t...super.toLogEntry(ctx),\n\t\t\t// Hide the default payload line\n\t\t\tmessage: undefined,\n\t\t};\n\t}\n}\n\n@CCCommand(SecurityCommand.SchemeInherit)\n@expectedCCResponse(SecurityCCSchemeReport)\nexport class SecurityCCSchemeInherit extends SecurityCC {\n\tpublic serialize(ctx: CCEncodingContext): Bytes {\n\t\t// Since it is unlikely that any more schemes will be added to S0, we hardcode the default scheme here (bit 0 = 0)\n\t\tthis.payload = Bytes.from([0]);\n\t\t// eslint-disable-next-line @typescript-eslint/no-deprecated\n\t\treturn super.serialize(ctx);\n\t}\n\n\tpublic toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry {\n\t\treturn {\n\t\t\t...super.toLogEntry(ctx),\n\t\t\t// Hide the default payload line\n\t\t\tmessage: undefined,\n\t\t};\n\t}\n}\n\n@CCCommand(SecurityCommand.NetworkKeyVerify)\nexport class SecurityCCNetworkKeyVerify extends SecurityCC {}\n\n// @publicAPI\nexport interface SecurityCCNetworkKeySetOptions {\n\tnetworkKey: Uint8Array;\n}\n\n@CCCommand(SecurityCommand.NetworkKeySet)\n@expectedCCResponse(SecurityCCNetworkKeyVerify)\nexport class SecurityCCNetworkKeySet extends SecurityCC {\n\tpublic constructor(\n\t\toptions: WithAddress<SecurityCCNetworkKeySetOptions>,\n\t) {\n\t\tsuper(options);\n\t\tif (options.networkKey.length !== 16) {\n\t\t\tthrow new ZWaveError(\n\t\t\t\t`The network key must have length 16!`,\n\t\t\t\tZWaveErrorCodes.Argument_Invalid,\n\t\t\t);\n\t\t}\n\t\tthis.networkKey = options.networkKey;\n\t}\n\n\tpublic static from(\n\t\traw: CCRaw,\n\t\tctx: CCParsingContext,\n\t): SecurityCCNetworkKeySet {\n\t\tvalidatePayload(raw.payload.length >= 16);\n\t\tconst networkKey: Uint8Array = raw.payload.subarray(0, 16);\n\n\t\treturn new this({\n\t\t\tnodeId: ctx.sourceNodeId,\n\t\t\tnetworkKey,\n\t\t});\n\t}\n\n\tpublic networkKey: Uint8Array;\n\n\tpublic serialize(ctx: CCEncodingContext): Bytes {\n\t\tthis.payload = Bytes.view(this.networkKey);\n\t\t// eslint-disable-next-line @typescript-eslint/no-deprecated\n\t\treturn super.serialize(ctx);\n\t}\n\n\tpublic toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry {\n\t\t// The network key shouldn't be logged, so users can safely post their logs online\n\t\tconst { message, ...log } = super.toLogEntry(ctx);\n\t\treturn log;\n\t}\n}\n\n// @publicAPI\nexport interface SecurityCCCommandsSupportedReportOptions {\n\treportsToFollow?: number;\n\tsupportedCCs: CommandClasses[];\n\tcontrolledCCs: CommandClasses[];\n}\n\n@CCCommand(SecurityCommand.CommandsSupportedReport)\nexport class SecurityCCCommandsSupportedReport extends SecurityCC {\n\tpublic constructor(\n\t\toptions: WithAddress<SecurityCCCommandsSupportedReportOptions>,\n\t) {\n\t\tsuper(options);\n\n\t\tthis.supportedCCs = options.supportedCCs;\n\t\tthis.controlledCCs = options.controlledCCs;\n\t\t// TODO: properly split the CCs into multiple reports\n\t\tthis.reportsToFollow = options.reportsToFollow ?? 0;\n\t}\n\n\tpublic static from(\n\t\traw: CCRaw,\n\t\tctx: CCParsingContext,\n\t): SecurityCCCommandsSupportedReport {\n\t\tvalidatePayload(raw.payload.length >= 1);\n\t\tconst reportsToFollow = raw.payload[0];\n\t\tconst list = parseCCList(raw.payload.subarray(1));\n\t\tconst supportedCCs: CommandClasses[] = list.supportedCCs;\n\t\tconst controlledCCs: CommandClasses[] = list.controlledCCs;\n\n\t\treturn new this({\n\t\t\tnodeId: ctx.sourceNodeId,\n\t\t\treportsToFollow,\n\t\t\tsupportedCCs,\n\t\t\tcontrolledCCs,\n\t\t});\n\t}\n\n\tpublic reportsToFollow: number;\n\tpublic supportedCCs: CommandClasses[];\n\tpublic controlledCCs: CommandClasses[];\n\n\tpublic getPartialCCSessionId(): Record<string, any> | undefined {\n\t\t// Nothing special we can distinguish sessions with\n\t\treturn {};\n\t}\n\n\tpublic expectMoreMessages(): boolean {\n\t\treturn this.reportsToFollow > 0;\n\t}\n\n\t/** @deprecated Use {@link mergePartialCCsAsync} instead */\n\tpublic mergePartialCCs(\n\t\tpartials: SecurityCCCommandsSupportedReport[],\n\t): void {\n\t\t// Concat the lists of CCs\n\t\tthis.supportedCCs = [...partials, this]\n\t\t\t.map((report) => report.supportedCCs)\n\t\t\t.reduce((prev, cur) => prev.concat(...cur), []);\n\t\tthis.controlledCCs = [...partials, this]\n\t\t\t.map((report) => report.controlledCCs)\n\t\t\t.reduce((prev, cur) => prev.concat(...cur), []);\n\t}\n\n\tpublic mergePartialCCsAsync(\n\t\tpartials: SecurityCCCommandsSupportedReport[],\n\t): Promise<void> {\n\t\t// Concat the lists of CCs\n\t\tthis.supportedCCs = [...partials, this]\n\t\t\t.map((report) => report.supportedCCs)\n\t\t\t.reduce((prev, cur) => prev.concat(...cur), []);\n\t\tthis.controlledCCs = [...partials, this]\n\t\t\t.map((report) => report.controlledCCs)\n\t\t\t.reduce((prev, cur) => prev.concat(...cur), []);\n\t\treturn Promise.resolve();\n\t}\n\n\tpublic serialize(ctx: CCEncodingContext): Bytes {\n\t\tthis.payload = Bytes.concat([\n\t\t\tBytes.from([this.reportsToFollow]),\n\t\t\tencodeCCList(this.supportedCCs, this.controlledCCs),\n\t\t]);\n\t\t// eslint-disable-next-line @typescript-eslint/no-deprecated\n\t\treturn super.serialize(ctx);\n\t}\n\n\tpublic toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry {\n\t\treturn {\n\t\t\t...super.toLogEntry(ctx),\n\t\t\tmessage: {\n\t\t\t\treportsToFollow: this.reportsToFollow,\n\t\t\t\tsupportedCCs: this.supportedCCs\n\t\t\t\t\t.map((cc) => getCCName(cc))\n\t\t\t\t\t.map((cc) => `\\n\u00B7 ${cc}`)\n\t\t\t\t\t.join(\"\"),\n\t\t\t\tcontrolledCCs: this.controlledCCs\n\t\t\t\t\t.map((cc) => getCCName(cc))\n\t\t\t\t\t.map((cc) => `\\n\u00B7 ${cc}`)\n\t\t\t\t\t.join(\"\"),\n\t\t\t},\n\t\t};\n\t}\n}\n\n@CCCommand(SecurityCommand.CommandsSupportedGet)\n@expectedCCResponse(SecurityCCCommandsSupportedReport)\nexport class SecurityCCCommandsSupportedGet extends SecurityCC {}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,kBA2BO;AAOP,kBAAsB;AACtB,IAAAA,eAA0C;AAC1C,mBAAqB;AACrB,yBAA4B;AAC5B,iBAAqC;AACrC,0BAIO;AACP,oCAMO;AACP,mBAAgC;AAChC,qBAAwB;AACxB,yBAA4B;AAC5B,gCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAInC,SAAS,sBACR,aACA,eACA,WACA,eACA,iBACA,kBAA4B;AAE5B,SAAO,kBAAM,OAAO;IACnB;IACA;IACA,kBAAM,KAAK;MACV;MACA;MACA;MACA,iBAAiB;KACjB;IACD;GACA;AACF;AAEA,SAAS,aAAa,QAAe;AACpC,MAAI,UAAU;AACd,MAAI;AAAQ,eAAW,YAAY,MAAM;AACzC,QAAM,IAAI,uBAAW,SAAS,4BAAgB,kBAAkB;AACjE;AAEA,MAAM,kBAAkB;AAExB,SAAS,iBACR,KAAqB;AAErB,MAAI,CAAC,IAAI,WAAW;AACnB,UAAM,IAAI,uBACT,oFACA,4BAAgB,eAAe;EAEjC;AAEA,MAAI,CAAC,IAAI,iBAAiB;AACzB,UAAM,IAAI,uBACT,iFACA,4BAAgB,iBAAiB;EAEnC;AACD;AAEA,SAAS,iBACR,KAAsB;AAEtB,MAAI,CAAC,IAAI,WAAW;AACnB,UAAM,IAAI,uBACT,iFACA,4BAAgB,eAAe;EAEjC;AAEA,MAAI,CAAC,IAAI,iBAAiB;AACzB,UAAM,IAAI,uBACT,8EACA,4BAAgB,iBAAiB;EAEnC;AACD;IASa,iBAAa,MAAA;8BADzB,mCAAI,2BAAe,QAAQ,CAAC;;;;oBACM;qCAAA,YAAa;;;;;;AAAhD,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;IACL,gBAAgB,MAAqB;AAE3C,aAAO;IACR;IAEO,MAAM,iBACZ,cACA,mBAA4B,OAAK;AAEjC,UAAI,kBAAkB;AACrB,aAAK,sBACJ,8BACA,6BAAgB,oBAAoB;MAEtC,OAAO;AACN,aAAK,sBACJ,8BACA,6BAAgB,4BAA4B;MAE9C;AAEA,YAAM,KAAK,KACV,mBACG,yCACA,gCACF;QACD,QAAQ,KAAK,SAAS;QACtB;OACA;AACD,YAAM,KAAK,KAAK,YAAY,IAAI,KAAK,cAAc;IACpD;;;;IAKO,MAAM,WAAQ;AACpB,WAAK,sBAAsB,8BAAiB,6BAAgB,QAAQ;AAEpE,YAAM,KAAK,IAAI,mBAAmB;QACjC,QAAQ,KAAK,SAAS;QACtB,eAAe,KAAK,SAAS;OAC7B;AACD,YAAM,WAAW,MAAM,KAAK,KAAK,YAChC,IACA;QACC,GAAG,KAAK;;QAER,iBAAiB;OACjB;AAEF,UAAI,CAAC;AAAU;AAEf,YAAM,QAAQ,SAAS;AACvB,YAAM,SAAS,KAAK,KAAK;AACzB,aAAO,SACN;QACC,QAAQ,KAAK,SAAS;QACtB,SAAS,OAAO,WAAW,KAAK;SAEjC,EAAE,OAAO,UAAU,KAAK,KAAK,UAAS,GACtC,EAAE,MAAM,KAAI,CAAE;AAEf,aAAO;IACR;;;;;IAMO,MAAM,YAAS;AACrB,WAAK,sBACJ,8BACA,6BAAgB,WAAW;AAG5B,UAAI,CAAC,KAAK,KAAK,iBAAiB;AAC/B,cAAM,IAAI,uBACT,8DACA,4BAAgB,iBAAiB;MAEnC;AAEA,YAAM,QAAQ,KAAK,KAAK,gBAAgB,cACvC,KAAK,SAAS,QACd,eAAe;AAEhB,YAAM,UAAU,KAAK,KAAK,gBAAgB,WAAW,KAAK;AAE1D,YAAM,KAAK,IAAI,sBAAsB;QACpC,QAAQ,KAAK,SAAS;QACtB,eAAe,KAAK,SAAS;QAC7B;OACA;AAED,UAAI;AACH,cAAM,KAAK,KAAK,YAAY,IAAI;UAC/B,GAAG,KAAK;;UAER,iBAAiB,4BAAgB,MAC9B,4BAAgB;;UAEnB,iBAAiB;;UAEjB,UAAU,4BAAgB;;UAE1B,8BAA8B;SAC9B;MACF,SAAS,GAAG;AACX,gBAAI,iCAAoB,CAAC,GAAG;AAE3B,eAAK,KAAK,gBAAgB,YAAY,OAAO;AAC7C,iBAAO;QACR,OAAO;AAEN,gBAAM;QACP;MACD;AACA,aAAO;IACR;IAEO,MAAM,oBAAiB;AAC7B,WAAK,sBAAsB,8BAAiB,6BAAgB,SAAS;AAErE,YAAM,KAAK,IAAI,oBAAoB;QAClC,QAAQ,KAAK,SAAS;QACtB,eAAe,KAAK,SAAS;OAC7B;AACD,YAAM,KAAK,KAAK,YAAY,IAAI,KAAK,cAAc;AAEnD,aAAO,CAAC,CAAC;IACV;IAEO,MAAM,qBAAqB,cAAqB;AACtD,WAAK,sBACJ,8BACA,6BAAgB,YAAY;AAG7B,UAAI,KAAmB,IAAI,uBAAuB;QACjD,QAAQ,KAAK,SAAS;QACtB,eAAe,KAAK,SAAS;OAC7B;AACD,UAAI,cAAc;AACjB,aAAK,IAAI,+BAA+B;UACvC,QAAQ,KAAK,SAAS;UACtB,eAAe,KAAK,SAAS;UAC7B,cAAc;SACd;MACF;AACA,YAAM,KAAK,KAAK,YAAY,IAAI,KAAK,cAAc;IACpD;IAEO,MAAM,wBAAqB;AACjC,WAAK,sBACJ,8BACA,6BAAgB,aAAa;AAG9B,YAAM,KAAK,IAAI,wBAAwB;QACtC,QAAQ,KAAK,SAAS;QACtB,eAAe,KAAK,SAAS;OAC7B;AACD,YAAM,KAAK,KAAK,YAAY,IAAI,KAAK,cAAc;IAEpD;IAEO,MAAM,cAAc,YAAsB;AAChD,WAAK,sBACJ,8BACA,6BAAgB,aAAa;AAG9B,YAAM,SAAS,IAAI,wBAAwB;QAC1C,QAAQ,KAAK,SAAS;QACtB,eAAe,KAAK,SAAS;QAC7B;OACA;AACD,YAAM,KAAK,IAAI,+BAA+B;QAC7C,QAAQ,KAAK,SAAS;QACtB,eAAe,KAAK,SAAS;QAC7B,cAAc;QACd,uBAAuB,IAAI,WAAW,EAAE,EAAE,KAAK,CAAC;OAChD;AACD,YAAM,KAAK,KAAK,YAAY,IAAI,KAAK,cAAc;IACpD;IAEO,MAAM,mBAAgB;AAC5B,WAAK,sBACJ,8BACA,6BAAgB,gBAAgB;AAGjC,YAAM,KAAK,IAAI,2BAA2B;QACzC,QAAQ,KAAK,SAAS;QACtB,eAAe,KAAK,SAAS;OAC7B;AACD,YAAM,KAAK,KAAK,YAAY,IAAI,KAAK,cAAc;IACpD;;IAGO,MAAM,uBAAoB;AAChC,WAAK,sBACJ,8BACA,6BAAgB,oBAAoB;AAGrC,YAAM,KAAK,IAAI,+BAA+B;QAC7C,QAAQ,KAAK,SAAS;QACtB,eAAe,KAAK,SAAS;OAC7B;AACD,YAAM,WAAW,MAAM,KAAK,KAAK,YAGhC,IACA,KAAK,cAAc;AAEpB,UAAI,UAAU;AACb,mBAAO,mBAAK,UAAU,CAAC,gBAAgB,eAAe,CAAC;MACxD;IACD;IAEO,MAAM,wBACZ,cACA,eAA+B;AAE/B,WAAK,sBACJ,8BACA,6BAAgB,uBAAuB;AAGxC,YAAM,KAAK,IAAI,kCAAkC;QAChD,QAAQ,KAAK,SAAS;QACtB,eAAe,KAAK,SAAS;QAC7B;QACA;QACA,iBAAiB;OACjB;AACD,YAAM,KAAK,KAAK,YAAY,IAAI,KAAK,cAAc;IACpD;;;;IAKY,cAAU,MAAA;8BAFtB,4CAAa,2BAAe,QAAQ,OACpC,kDAAmB,CAAC,CAAC;;;;oBACU;kCAAA,YAAY;;;;;;AAA5C,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;IAKL,MAAM,UACZ,KAAqB;AAErB,YAAM,OAAO,KAAK,QAAQ,GAAG;AAC7B,YAAM,WAAW,KAAK,YAAY,GAAG;AACrC,YAAM,MAAM,iBAAM,OACjB,2BAAe,UACf,KACA,QAAQ,EACP,YAAY;QACb,UAAU,4BAAgB;OAC1B;AAED,UAAI,QAAQ,KAAK,IAAI;QACpB,SAAS;QACT,WAAW;OACX;AAED,UAAI;AACJ,UAAI;AAGJ,YAAM,eAAe,KAAK,kBAAkB,IAAI,IAAI;AACpD,eAAS,WAAW,GAAG,YAAY,cAAc,YAAY;AAC5D,cAAM,OAAO,MAAM,IAAI,qBAAoB;AAC3C,YAAI,MAAM;AACT,yBAAe,KAAK;AACpB,0BAAgB,KAAK;AACrB;QACD,WAAW,WAAW,cAAc;AACnC,cAAI,QAAQ,KAAK,IAAI;YACpB,UAAU,KAAK;YACf,SACC,sDAAsD,QAAQ,IAAI,YAAY;YAC/E,OAAO;WACP;AACD,oBAAM,mBAAK,GAAG;QACf;MACD;AAEA,UAAI,CAAC,gBAAgB,CAAC,eAAe;AACpC,YAAI,KAAK,iBAAiB,0BAAc,SAAS,MAAM,MAAM;AAC5D,cAAI,QAAQ,KAAK,IAAI;YACpB,UAAU,KAAK;YACf,SAAS;YACT,OAAO;WACP;QAEF,OAAO;AAGN,cAAI,QACH,KAAK,IACL,oFAAoF;AAErF,eAAK,iBAAiB,0BAAc,WAAW,KAAK;QACrD;AACA;MACD;AAEA,YAAM,WAAqB;QAC1B;QACA;;AAED,iBAAW,MAAM,cAAc;AAC9B,iBAAS,KAAK,YAAK,uBAAU,EAAE,CAAC,EAAE;MACnC;AACA,eAAS,KAAK,iBAAiB;AAC/B,iBAAW,MAAM,eAAe;AAC/B,iBAAS,KAAK,YAAK,uBAAU,EAAE,CAAC,EAAE;MACnC;AACA,UAAI,QAAQ,KAAK,IAAI;QACpB,SAAS,SAAS,KAAK,IAAI;QAC3B,WAAW;OACX;AAGD,iBAAW,MAAM,cAAc;AAI9B,YAAI,OAAO,2BAAe,OAAO;AAChC,mBAAS,MAAM,IAAI,EAAE,QAAQ,KAAI,CAAE;QACpC,OAAO;AACN,mBAAS,MAAM,IAAI;YAClB,aAAa;YACb,QAAQ;WACR;QACF;MACD;AACA,iBAAW,MAAM,eAAe;AAI/B,YAAI,OAAO,2BAAe,OAAO;AAChC,mBAAS,MAAM,IAAI,EAAE,QAAQ,KAAI,CAAE;QACpC,OAAO;AACN,mBAAS,MAAM,IAAI;YAClB,cAAc;YACd,QAAQ;WACR;QACF;MACD;AAGA,UAAI,KAAK,iBAAiB,0BAAc,SAAS,MAAM,MAAM;AAC5D,aAAK,iBAAiB,0BAAc,WAAW,IAAI;AACnD,YAAI,QACH,KAAK,IACL,4CAA4C;MAE9C;AAGA,WAAK,qBAAqB,KAAK,IAAI;IACpC;;IAGO,OAAO,sBAAsB,IAAgB;AAEnD,UAAI,EAAE,GAAG,qBAAqB,+BAAmB,WAAW;AAC3D,eAAO;MACR;AAGA,UACC,cAAc,kCACX,cAAc,0BACd,cAAc,8CAChB;AACD,eAAO;MACR;AAGA,UAAI,cAAcC,aAAY;AAC7B,gBAAQ,GAAG,WAAW;;UAErB,KAAK,6BAAgB;UACrB,KAAK,6BAAgB;;UAErB,KAAK,6BAAgB;UACrB,KAAK,6BAAgB;UACrB,KAAK,6BAAgB;UACrB,KAAK,6BAAgB;AACpB,mBAAO;UAER;AAEC,mBAAO;QACT;MACD;AAGA,aAAO;IACR;;IAGO,OAAO,YACb,WACA,iBACA,IAAgB;AAGhB,YAAM,MAAM,IAAI,+BAA+B;QAC9C,QAAQ,GAAG;QACX,cAAc;OACd;AAID,UAAI,qBAAqB,GAAG,qBACzB,CAAC,+BAAmB;AAEvB,aAAO;IACR;;;;IAQY,yBAAqB,MAAA;8BADjC,yCAAU,6BAAgB,WAAW,CAAC;;;;oBACI;6CAAA,YAAU;;;;;;AAArD,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;IACZ,YACC,SAAkD;AAElD,YAAM,OAAO;AACb,UAAI,QAAQ,MAAM,WAAW,iBAAiB;AAC7C,cAAM,IAAI,uBACT,0BAA0B,eAAe,KACzC,4BAAgB,gBAAgB;MAElC;AACA,WAAK,QAAQ,QAAQ;IACtB;IAEO,OAAO,KACb,KACA,KAAqB;AAErB,kCAAgB,WAAW,sBAAsB,EAChD,IAAI,QAAQ,WAAW,eAAe;AAGvC,aAAO,IAAI,KAAK;QACf,QAAQ,IAAI;QACZ,OAAO,IAAI;OACX;IACF;IAEO;IAEA,UAAU,KAAsB;AACtC,WAAK,UAAU,kBAAM,KAAK,KAAK,KAAK;AAEpC,aAAO,MAAM,UAAU,GAAG;IAC3B;IAEO,WAAW,KAAgB;AACjC,aAAO;QACN,GAAG,MAAM,WAAW,GAAG;QACvB,SAAS,EAAE,WAAO,yBAAW,KAAK,KAAK,EAAC;;IAE1C;;;;IAKY,sBAAkB,MAAA;8BAF9B,yCAAU,6BAAgB,QAAQ,OAClC,kDAAmB,qBAAqB,CAAC;;;;oBACF;0CAAA,YAAU;;;;;;AAAlD,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;;;;AAgBb,SAAS,qCACR,MAAoC;AAEpC,MAAI,KAAK,aAAa,kBAAiB,GAAI;AAC1C,WAAO;EACR;AACD;IAOa,kCAA8B,MAAA;8BAL1C,yCAAU,6BAAgB,oBAAoB,OAC9C,kDACA,sCACA,MAAM,mBAAmB,CACzB;;;;oBACmD;sDAAA,YAAU;;;;;;AAA9D,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;IACZ,YACC,SAA2D;AAE3D,YAAM,OAAO;AAEb,UAAI,kBAAkB,SAAS;AAC9B,aAAK,eAAe,QAAQ;AAC5B,aAAK,aAAa,kBAAkB;MACrC,OAAO;AACN,aAAK,mBAAmB,QAAQ;AAChC,aAAK,YAAY,QAAQ;AACzB,aAAK,cAAc,QAAQ;AAC3B,aAAK,kBAAkB,QAAQ;MAChC;AACA,WAAK,wBAAwB,QAAQ;IACtC;IAEO,OAAO,KACb,KACA,KAAqB;AAErB,uBAAiB,GAAG;AAGpB,uCACC,IAAI,QAAQ,UAAU,kBAAkB,IAAI,IAAI,IAAI,CAAC;AAEtD,YAAM,KAAK,IAAI,QAAQ,SAAS,GAAG,eAAe;AAClD,YAAM,mBAAmB,IAAI,QAAQ,SAAS,iBAAiB,EAAE;AACjE,YAAM,UAAU,IAAI,QAAQ,GAAG,EAAE;AACjC,YAAM,WAAW,IAAI,QAAQ,SAAS,EAAE;AAGxC,YAAM,QAAQ,IAAI,gBAAgB,SAAS,OAAO;AAElD,UAAI,CAAC,OAAO;AACX,oCAAgB,KACf,aACC,sBACC,OAAO,CAET,wDAAwD;MAE1D;AAEA,UAAI,gBAAgB,YAAY,OAAO;AAGvC,YAAM,WAAW,sBAChB,IACA,OACA,6BAAgB,sBAChB,IAAI,cACJ,IAAI,WACJ,gBAAgB;AAGjB,YAAM,uBAAmB;QACxB;;QAEA,IAAI,gBAAgB;MAAO;AAG5B,kCAAgB,WACf,gEAAgE,EAC/D,SAAS,OAAO,gBAAgB,CAAC;AAInC,YAAM,iCAA6B;QAClC;;QAEA,IAAI,gBAAgB;QACpB,kBAAM,OAAO,CAAC,IAAI,KAAK,CAAC;MAAC;AAE1B,YAAM,eAAe,2BAA2B,CAAC;AACjD,YAAM,kBAAkB,eAAe;AACvC,YAAM,YAAY,CAAC,EAAE,eAAe;AACpC,YAAM,cAAc,CAAC,EAAE,eAAe;AACtC,YAAM,mBACL,2BACE,SAAS,CAAC;AAEb,YAAM,MAAM,IAAIC,gCAA+B;QAC9C,QAAQ,IAAI;QACZ;QACA;QACA;QACA;OACA;AAED,UAAI,WAAW;AACf,UAAI,WAAW;AACf,UAAI,KAAK;AAET,aAAO;IACR;IAEO,aAAa,UACnB,KACA,KAAqB;AAErB,uBAAiB,GAAG;AAGpB,uCACC,IAAI,QAAQ,UAAU,kBAAkB,IAAI,IAAI,IAAI,CAAC;AAEtD,YAAM,KAAK,IAAI,QAAQ,SAAS,GAAG,eAAe;AAClD,YAAM,mBAAmB,IAAI,QAAQ,SAAS,iBAAiB,EAAE;AACjE,YAAM,UAAU,IAAI,QAAQ,GAAG,EAAE;AACjC,YAAM,WAAW,IAAI,QAAQ,SAAS,EAAE;AAGxC,YAAM,QAAQ,IAAI,gBAAgB,SAAS,OAAO;AAElD,UAAI,CAAC,OAAO;AACX,oCAAgB,KACf,aACC,sBACC,OAAO,CAET,wDAAwD;MAE1D;AAEA,UAAI,gBAAgB,YAAY,OAAO;AAGvC,YAAM,WAAW,sBAChB,IACA,OACA,6BAAgB,sBAChB,IAAI,cACJ,IAAI,WACJ,gBAAgB;AAEjB,YAAM,mBAAmB,UAAM,6BAC9B,UACA,MAAM,IAAI,gBAAgB,WAAU,CAAE;AAGvC,kCAAgB,WACf,gEAAgE,EAC/D,SAAS,OAAO,gBAAgB,CAAC;AAGnC,YAAM,6BAA6B,UAAM,mCACxC,kBACA,MAAM,IAAI,gBAAgB,iBAAgB,GAC1C,kBAAM,OAAO,CAAC,IAAI,KAAK,CAAC,CAAC;AAE1B,YAAM,eAAe,2BAA2B,CAAC;AACjD,YAAM,kBAAkB,eAAe;AACvC,YAAM,YAAY,CAAC,EAAE,eAAe;AACpC,YAAM,cAAc,CAAC,EAAE,eAAe;AACtC,YAAM,mBACL,2BACE,SAAS,CAAC;AAEb,YAAM,MAAM,IAAIA,gCAA+B;QAC9C,QAAQ,IAAI;QACZ;QACA;QACA;QACA;OACA;AAED,UAAI,WAAW;AACf,UAAI,WAAW;AACf,UAAI,KAAK;AAET,aAAO;IACR;IAEQ;IACA;IACA;IAEA;IACD;IAEC;IAER,IAAW,UAAO;AACjB,aAAO,KAAK,QAAQ,CAAC;IACtB;IACO;;IAGC;IACA;IACA;IACA;IAED,wBAAqB;AAC3B,UAAI,KAAK,WAAW;AACnB,eAAO;;UAEN,WAAW;UACX,UAAU,KAAK;;MAEjB,OAAO;AACN,eAAO;;UAEN,WAAW;;MAEb;IACD;IAEO,qBAAkB;AACxB,aAAO,CAAC,CAAC,KAAK,aAAa,CAAC,KAAK;IAClC;;IAGO,gBACN,UACA,KAAqB;AAGrB,WAAK,mBAAmB,kBAAM,OAC7B,CAAC,GAAG,UAAU,IAAI,EAAE,IAAI,CAAC,OAAO,GAAG,gBAAiB,CAAC;AAGtD,uCAAgB,KAAK,iBAAiB,UAAU,CAAC;AAGjD,WAAK,eAAe,iCAAa,MAAM,KAAK,kBAAkB,GAAG;AACjE,WAAK,aAAa,kBAAkB;IACrC;IAEO,MAAM,qBACZ,UACA,KAAqB;AAGrB,WAAK,mBAAmB,kBAAM,OAC7B,CAAC,GAAG,UAAU,IAAI,EAAE,IAAI,CAAC,OAAO,GAAG,gBAAiB,CAAC;AAGtD,uCAAgB,KAAK,iBAAiB,UAAU,CAAC;AAEjD,WAAK,eAAe,MAAM,iCAAa,WACtC,KAAK,kBACL,GAAG;AAEJ,WAAK,aAAa,kBAAkB;IACrC;;IAGO,UAAU,KAAsB;AACtC,UAAI,CAAC,KAAK;AAAO,qBAAY;AAC7B,UAAI,KAAK,MAAM,WAAW,iBAAiB;AAC1C,qBAAa,oBAAoB;MAClC;AACA,uBAAiB,GAAG;AAEpB,UAAI;AACJ,UAAI;AACJ,UAAI,KAAK,uBAAuB;AAE/B,sBAAU,iCAAoB,KAAK,qBAAqB;AAExD,4BAAgB,uCACf,KAAK,qBAAqB;MAE5B,OAAO;AAEN,kBAAU,IAAI,gBAAgB;AAE9B,wBAAgB,IAAI,gBAAgB;MACrC;AAGA,YAAM,eAAe,KAAK,aAAa,UAAU,GAAG;AACpD,YAAM,YAAY,kBAAM,OAAO;QAC9B,kBAAM,KAAK,CAAC,CAAC,CAAC;;QACd;OACA;AAED,YAAM,kBAAc,gCAAY,eAAe;AAC/C,YAAM,KAAK,kBAAM,OAAO,CAAC,aAAa,KAAK,KAAK,CAAC;AAEjD,YAAM,iBAAa,kCAAqB,WAAW,eAAe,EAAE;AAEpE,YAAM,WAAW,sBAChB,aACA,KAAK,OACL,KAAK,WACL,IAAI,WACJ,KAAK,QACL,UAAU;AAGX,YAAM,eAAW,4BAAe,UAAU,OAAO;AAGjD,WAAK,KAAK;AACV,WAAK,WAAW;AAChB,WAAK,WAAW;AAChB,WAAK,aAAa;AAElB,WAAK,UAAU,kBAAM,OAAO;QAC3B;QACA;QACA,kBAAM,KAAK,CAAC,KAAK,OAAQ,CAAC;QAC1B;OACA;AAED,aAAO,MAAM,UAAU,GAAG;IAC3B;IAEO,MAAM,eAAe,KAAsB;AACjD,UAAI,CAAC,KAAK;AAAO,qBAAY;AAC7B,UAAI,KAAK,MAAM,WAAW,iBAAiB;AAC1C,qBAAa,oBAAoB;MAClC;AACA,uBAAiB,GAAG;AAEpB,UAAI;AACJ,UAAI;AACJ,UAAI,KAAK,uBAAuB;AAC/B,kBAAU,UAAM,kCAAqB,KAAK,qBAAqB;AAC/D,wBAAgB,UAAM,wCACrB,KAAK,qBAAqB;MAE5B,OAAO;AACN,kBAAU,MAAM,IAAI,gBAAgB,WAAU;AAC9C,wBAAgB,MAAM,IAAI,gBAAgB,iBAAgB;MAC3D;AAEA,YAAM,eAAe,MAAM,KAAK,aAAa,eAAe,GAAG;AAC/D,YAAM,YAAY,kBAAM,OAAO;QAC9B,kBAAM,KAAK,CAAC,CAAC,CAAC;;QACd;OACA;AAED,YAAM,kBAAc,gCAAY,eAAe;AAC/C,YAAM,KAAK,kBAAM,OAAO,CAAC,aAAa,KAAK,KAAK,CAAC;AACjD,YAAM,aAAa,UAAM,mCACxB,WACA,eACA,EAAE;AAGH,YAAM,WAAW,sBAChB,aACA,KAAK,OACL,KAAK,WACL,IAAI,WACJ,KAAK,QACL,UAAU;AAEX,YAAM,WAAW,UAAM,6BAAgB,UAAU,OAAO;AAGxD,WAAK,KAAK;AACV,WAAK,WAAW;AAChB,WAAK,WAAW;AAChB,WAAK,aAAa;AAElB,WAAK,UAAU,kBAAM,OAAO;QAC3B;QACA;QACA,kBAAM,KAAK,CAAC,KAAK,OAAQ,CAAC;QAC1B;OACA;AACD,aAAO,MAAM,eAAe,GAAG;IAChC;IAEU,+BAA4B;AAErC,aAAO,MAAM,6BAA4B,IAAK;IAC/C;IAEO,WAAW,KAAgB;AACjC,YAAM,UAAyB,CAAA;AAC/B,UAAI,KAAK,WAAW,QAAW;AAC9B,gBAAQ,UAAU,IAAI,KAAK;MAC5B;AACA,UAAI,KAAK,aAAa,QAAW;AAChC,gBAAQ,YAAY,KAAK;AACzB,YAAI,KAAK,WAAW;AACnB,cAAI,KAAK,eAAe,QAAW;AAClC,oBAAQ,cAAc,IAAI,KAAK;UAChC;AACA,cAAI,KAAK,mBAAmB,QAAW;AACtC,oBAAQ,kBAAkB,IAAI,KAAK;UACpC;QACD;MACD;AAEA,UACC,QAAQ,IAAI,aAAa,UACtB,QAAQ,IAAI,aAAa,eAC3B;AACD,YAAI,KAAK,IAAI;AACZ,kBAAQ,SAAK,yBAAW,KAAK,EAAE;QAChC;AACA,YAAI,KAAK,YAAY;AACpB,kBAAQ,iBAAa,yBAAW,KAAK,UAAU;QAChD,WAAW,KAAK,kBAAkB;AACjC,kBAAQ,gBAAY,yBAAW,KAAK,gBAAgB;QACrD;AACA,YAAI,KAAK,UAAU;AAClB,kBAAQ,WAAW,QAAI,yBAAW,KAAK,QAAQ;QAChD;AACA,YAAI,KAAK,UAAU;AAClB,kBAAQ,WAAW,QAAI,yBAAW,KAAK,QAAQ;QAChD;MACD;AACA,aAAO;QACN,GAAG,MAAM,WAAW,GAAG;QACvB;;IAEF;;;;IAKY,0CAAsC,MAAA;8BADlD,yCAAU,6BAAgB,4BAA4B,CAAC;;;;oBAE/C;8DAAA,YAA8B;;;;;;AADvC,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;;;;IAKA,0BAAsB,MAAA;8BADlC,yCAAU,6BAAgB,YAAY,CAAC;;;;oBACI;8CAAA,YAAU;;;;;;AAAtD,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;IACL,OAAO,KACb,KACA,KAAqB;AAErB,uCAAgB,IAAI,QAAQ,UAAU,CAAC;AAEvC,aAAO,IAAI,KAAK;QACf,QAAQ,IAAI;OACZ;IACF;IAEO,UAAU,KAAsB;AAEtC,WAAK,UAAU,kBAAM,KAAK,CAAC,CAAC,CAAC;AAE7B,aAAO,MAAM,UAAU,GAAG;IAC3B;IAEO,WAAW,KAAgB;AACjC,aAAO;QACN,GAAG,MAAM,WAAW,GAAG;;QAEvB,SAAS;;IAEX;;;;IAKY,uBAAmB,MAAA;8BAF/B,yCAAU,6BAAgB,SAAS,OACnC,kDAAmB,sBAAsB,CAAC;;;;oBACF;2CAAA,YAAU;;;;;;AAAnD,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;IACL,UAAU,KAAsB;AAEtC,WAAK,UAAU,kBAAM,KAAK,CAAC,CAAC,CAAC;AAE7B,aAAO,MAAM,UAAU,GAAG;IAC3B;IAEO,WAAW,KAAgB;AACjC,aAAO;QACN,GAAG,MAAM,WAAW,GAAG;;QAEvB,SAAS;;IAEX;;;;IAKY,2BAAuB,MAAA;8BAFnC,yCAAU,6BAAgB,aAAa,OACvC,kDAAmB,sBAAsB,CAAC;;;;oBACE;+CAAA,YAAU;;;;;;AAAvD,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;IACL,UAAU,KAAsB;AAEtC,WAAK,UAAU,kBAAM,KAAK,CAAC,CAAC,CAAC;AAE7B,aAAO,MAAM,UAAU,GAAG;IAC3B;IAEO,WAAW,KAAgB;AACjC,aAAO;QACN,GAAG,MAAM,WAAW,GAAG;;QAEvB,SAAS;;IAEX;;;;IAIY,8BAA0B,MAAA;8BADtC,yCAAU,6BAAgB,gBAAgB,CAAC;;;;oBACI;kDAAA,YAAU;;;;;;AAA1D,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;;;;IASA,2BAAuB,MAAA;8BAFnC,yCAAU,6BAAgB,aAAa,OACvC,kDAAmB,0BAA0B,CAAC;;;;oBACF;+CAAA,YAAU;;;;;;AAAvD,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;IACZ,YACC,SAAoD;AAEpD,YAAM,OAAO;AACb,UAAI,QAAQ,WAAW,WAAW,IAAI;AACrC,cAAM,IAAI,uBACT,wCACA,4BAAgB,gBAAgB;MAElC;AACA,WAAK,aAAa,QAAQ;IAC3B;IAEO,OAAO,KACb,KACA,KAAqB;AAErB,uCAAgB,IAAI,QAAQ,UAAU,EAAE;AACxC,YAAM,aAAyB,IAAI,QAAQ,SAAS,GAAG,EAAE;AAEzD,aAAO,IAAI,KAAK;QACf,QAAQ,IAAI;QACZ;OACA;IACF;IAEO;IAEA,UAAU,KAAsB;AACtC,WAAK,UAAU,kBAAM,KAAK,KAAK,UAAU;AAEzC,aAAO,MAAM,UAAU,GAAG;IAC3B;IAEO,WAAW,KAAgB;AAEjC,YAAM,EAAE,SAAS,GAAG,IAAG,IAAK,MAAM,WAAW,GAAG;AAChD,aAAO;IACR;;;;IAWY,qCAAiC,MAAA;8BAD7C,yCAAU,6BAAgB,uBAAuB,CAAC;;;;oBACI;yDAAA,YAAU;;;;;;AAAjE,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;IACZ,YACC,SAA8D;AAE9D,YAAM,OAAO;AAEb,WAAK,eAAe,QAAQ;AAC5B,WAAK,gBAAgB,QAAQ;AAE7B,WAAK,kBAAkB,QAAQ,mBAAmB;IACnD;IAEO,OAAO,KACb,KACA,KAAqB;AAErB,uCAAgB,IAAI,QAAQ,UAAU,CAAC;AACvC,YAAM,kBAAkB,IAAI,QAAQ,CAAC;AACrC,YAAM,WAAO,yBAAY,IAAI,QAAQ,SAAS,CAAC,CAAC;AAChD,YAAM,eAAiC,KAAK;AAC5C,YAAM,gBAAkC,KAAK;AAE7C,aAAO,IAAI,KAAK;QACf,QAAQ,IAAI;QACZ;QACA;QACA;OACA;IACF;IAEO;IACA;IACA;IAEA,wBAAqB;AAE3B,aAAO,CAAA;IACR;IAEO,qBAAkB;AACxB,aAAO,KAAK,kBAAkB;IAC/B;;IAGO,gBACN,UAA6C;AAG7C,WAAK,eAAe,CAAC,GAAG,UAAU,IAAI,EACpC,IAAI,CAAC,WAAW,OAAO,YAAY,EACnC,OAAO,CAAC,MAAM,QAAQ,KAAK,OAAO,GAAG,GAAG,GAAG,CAAA,CAAE;AAC/C,WAAK,gBAAgB,CAAC,GAAG,UAAU,IAAI,EACrC,IAAI,CAAC,WAAW,OAAO,aAAa,EACpC,OAAO,CAAC,MAAM,QAAQ,KAAK,OAAO,GAAG,GAAG,GAAG,CAAA,CAAE;IAChD;IAEO,qBACN,UAA6C;AAG7C,WAAK,eAAe,CAAC,GAAG,UAAU,IAAI,EACpC,IAAI,CAAC,WAAW,OAAO,YAAY,EACnC,OAAO,CAAC,MAAM,QAAQ,KAAK,OAAO,GAAG,GAAG,GAAG,CAAA,CAAE;AAC/C,WAAK,gBAAgB,CAAC,GAAG,UAAU,IAAI,EACrC,IAAI,CAAC,WAAW,OAAO,aAAa,EACpC,OAAO,CAAC,MAAM,QAAQ,KAAK,OAAO,GAAG,GAAG,GAAG,CAAA,CAAE;AAC/C,aAAO,QAAQ,QAAO;IACvB;IAEO,UAAU,KAAsB;AACtC,WAAK,UAAU,kBAAM,OAAO;QAC3B,kBAAM,KAAK,CAAC,KAAK,eAAe,CAAC;YACjC,0BAAa,KAAK,cAAc,KAAK,aAAa;OAClD;AAED,aAAO,MAAM,UAAU,GAAG;IAC3B;IAEO,WAAW,KAAgB;AACjC,aAAO;QACN,GAAG,MAAM,WAAW,GAAG;QACvB,SAAS;UACR,iBAAiB,KAAK;UACtB,cAAc,KAAK,aACjB,IAAI,CAAC,WAAO,uBAAU,EAAE,CAAC,EACzB,IAAI,CAAC,OAAO;OAAO,EAAE,EAAE,EACvB,KAAK,EAAE;UACT,eAAe,KAAK,cAClB,IAAI,CAAC,WAAO,uBAAU,EAAE,CAAC,EACzB,IAAI,CAAC,OAAO;OAAO,EAAE,EAAE,EACvB,KAAK,EAAE;;;IAGZ;;;;IAKY,kCAA8B,MAAA;8BAF1C,yCAAU,6BAAgB,oBAAoB,OAC9C,kDAAmB,iCAAiC,CAAC;;;;oBACF;sDAAA,YAAU;;;;;;AAA9D,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;;;;",
   "names": ["import_safe", "SecurityCC", "SecurityCCCommandEncapsulation"]
 }