@zwave-js/cc 14.3.10 → 15.0.0-beta.0

package/build/cjs/cc/Security2CC.js

@@ -155,98 +155,18 @@ function assertSecurityTX(ctx, destination) {
   return ret;
 }
 __name(assertSecurityTX, "assertSecurityTX");
-function decryptSinglecastSync(ctx, securityManager, sendingNodeId, curSequenceNumber, prevSequenceNumber, ciphertext, authData, authTag, spanState, extensions) {
-  const decryptWithNonce = /* @__PURE__ */ __name((nonce) => {
-    const { keyCCM: key } = securityManager.getKeysForNode(sendingNodeId);
-    const iv = nonce;
-    return {
-      key,
-      iv,
-      // eslint-disable-next-line @typescript-eslint/no-deprecated
-      ...(0, import_core.decryptAES128CCMSync)(key, iv, ciphertext, authData, authTag)
-    };
-  }, "decryptWithNonce");
-  const getNonceAndDecrypt = /* @__PURE__ */ __name(() => {
-    const iv = securityManager.nextNonce(sendingNodeId);
-    return decryptWithNonce(iv);
-  }, "getNonceAndDecrypt");
-  if (spanState.type === import_core.SPANState.SPAN) {
-    if (
-      // The previous SPAN is still known, i.e. the node didn't send another command that was successfully decrypted
-      !!spanState.currentSPAN && spanState.currentSPAN.expires > (0, import_core.highResTimestamp)() && prevSequenceNumber != void 0 && curSequenceNumber === (prevSequenceNumber + 1 & 255) && !ctx.__internalIsMockNode
-    ) {
-      const nonce = spanState.currentSPAN.nonce;
-      spanState.currentSPAN = void 0;
-      const result = decryptWithNonce(nonce);
-      if (result.authOK) {
-        return {
-          ...result,
-          securityClass: spanState.securityClass
-        };
-      }
-    } else {
-      spanState.currentSPAN = void 0;
-    }
-    return {
-      ...getNonceAndDecrypt(),
-      securityClass: spanState.securityClass
-    };
-  } else if (spanState.type === import_core.SPANState.LocalEI) {
-    const senderEI = getSenderEI(extensions);
-    if (!senderEI)
-      failNoSPAN();
-    const receiverEI = spanState.receiverEI;
-    const isBootstrappingNode = securityManager.tempKeys.has(sendingNodeId);
-    if (isBootstrappingNode) {
-      securityManager.initializeTempSPAN(sendingNodeId, senderEI, receiverEI);
-      const ret = getNonceAndDecrypt();
-      if (ret.authOK) {
-        return {
-          ...ret,
-          securityClass: import_core.SecurityClass.Temporary
-        };
-      }
-      securityManager.setSPANState(sendingNodeId, spanState);
-    }
-    const possibleSecurityClasses = isBootstrappingNode ? [ctx.getHighestSecurityClass(sendingNodeId)] : import_core.securityClassOrder.filter((s) => ctx.hasSecurityClass(sendingNodeId, s) !== false);
-    for (const secClass of possibleSecurityClasses) {
-      if (!securityManager.hasKeysForSecurityClass(secClass)) {
-        continue;
-      }
-      securityManager.initializeSPAN(sendingNodeId, secClass, senderEI, receiverEI);
-      const ret = getNonceAndDecrypt();
-      if (ret.authOK) {
-        if (ctx.hasSecurityClass(sendingNodeId, secClass) === void 0) {
-          ctx.setSecurityClass(sendingNodeId, secClass, true);
-        }
-        return {
-          ...ret,
-          securityClass: secClass
-        };
-      } else {
-        securityManager.setSPANState(sendingNodeId, spanState);
-      }
-    }
-  }
-  return {
-    plaintext: new Uint8Array(),
-    authOK: false,
-    securityClass: void 0
-  };
-}
-__name(decryptSinglecastSync, "decryptSinglecastSync");
-async function decryptSinglecastAsync(ctx, securityManager, sendingNodeId, curSequenceNumber, prevSequenceNumber, ciphertext, authData, authTag, spanState, extensions) {
+async function decryptSinglecast(ctx, securityManager, sendingNodeId, curSequenceNumber, prevSequenceNumber, ciphertext, authData, authTag, spanState, extensions) {
   const decryptWithNonce = /* @__PURE__ */ __name(async (nonce) => {
     const { keyCCM: key } = securityManager.getKeysForNode(sendingNodeId);
     const iv = nonce;
     return {
       key,
       iv,
-      ...await (0, import_core.decryptAES128CCMAsync)(ciphertext, key, iv, authData, authTag)
+      ...await (0, import_core.decryptAES128CCM)(ciphertext, key, iv, authData, authTag)
     };
   }, "decryptWithNonce");
   const getNonceAndDecrypt = /* @__PURE__ */ __name(async () => {
-    const iv = await securityManager.nextNonceAsync(sendingNodeId);
+    const iv = await securityManager.nextNonce(sendingNodeId);
     return decryptWithNonce(iv);
   }, "getNonceAndDecrypt");
   if (spanState.type === import_core.SPANState.SPAN) {
@@ -277,7 +197,7 @@ async function decryptSinglecastAsync(ctx, securityManager, sendingNodeId, curSe
     const receiverEI = spanState.receiverEI;
     const isBootstrappingNode = securityManager.tempKeys.has(sendingNodeId);
     if (isBootstrappingNode) {
-      await securityManager.initializeTempSPANAsync(sendingNodeId, senderEI, receiverEI);
+      await securityManager.initializeTempSPAN(sendingNodeId, senderEI, receiverEI);
       const ret = await getNonceAndDecrypt();
       if (ret.authOK) {
         return {
@@ -292,7 +212,7 @@ async function decryptSinglecastAsync(ctx, securityManager, sendingNodeId, curSe
       if (!securityManager.hasKeysForSecurityClass(secClass)) {
         continue;
       }
-      await securityManager.initializeSPANAsync(sendingNodeId, secClass, senderEI, receiverEI);
+      await securityManager.initializeSPAN(sendingNodeId, secClass, senderEI, receiverEI);
       const ret = await getNonceAndDecrypt();
       if (ret.authOK) {
         if (ctx.hasSecurityClass(sendingNodeId, secClass) === void 0) {
@@ -313,32 +233,19 @@ async function decryptSinglecastAsync(ctx, securityManager, sendingNodeId, curSe
     securityClass: void 0
   };
 }
-__name(decryptSinglecastAsync, "decryptSinglecastAsync");
-function decryptMulticastSync(sendingNodeId, securityManager, groupId, ciphertext, authData, authTag) {
-  const iv = securityManager.nextPeerMPAN(sendingNodeId, groupId);
-  const { keyCCM: key } = securityManager.getKeysForNode(sendingNodeId);
-  return {
-    key,
-    iv,
-    // eslint-disable-next-line @typescript-eslint/no-deprecated
-    ...(0, import_core.decryptAES128CCMSync)(key, iv, ciphertext, authData, authTag),
-    // The security class is irrelevant when decrypting multicast commands
-    securityClass: void 0
-  };
-}
-__name(decryptMulticastSync, "decryptMulticastSync");
-async function decryptMulticastAsync(sendingNodeId, securityManager, groupId, ciphertext, authData, authTag) {
-  const iv = await securityManager.nextPeerMPANAsync(sendingNodeId, groupId);
+__name(decryptSinglecast, "decryptSinglecast");
+async function decryptMulticast(sendingNodeId, securityManager, groupId, ciphertext, authData, authTag) {
+  const iv = await securityManager.nextPeerMPAN(sendingNodeId, groupId);
   const { keyCCM: key } = securityManager.getKeysForNode(sendingNodeId);
   return {
     key,
     iv,
-    ...await (0, import_core.decryptAES128CCMAsync)(ciphertext, key, iv, authData, authTag),
+    ...await (0, import_core.decryptAES128CCM)(ciphertext, key, iv, authData, authTag),
     // The security class is irrelevant when decrypting multicast commands
     securityClass: void 0
   };
 }
-__name(decryptMulticastAsync, "decryptMulticastAsync");
+__name(decryptMulticast, "decryptMulticast");
 function parseExtensions(buffer, wasEncrypted) {
   const extensions = [];
   let mustDiscardCommand = false;
@@ -448,7 +355,7 @@ let Security2CCAPI = (() => {
       if (!securityManager) {
         throw new import_core.ZWaveError(`Nonces can only be sent if secure communication is set up!`, import_core.ZWaveErrorCodes.Driver_NoSecurity);
       }
-      const receiverEI = await securityManager.generateNonceAsync(this.endpoint.nodeId);
+      const receiverEI = await securityManager.generateNonce(this.endpoint.nodeId);
       const cc = new Security2CCNonceReport({
         nodeId: this.endpoint.nodeId,
         endpointIndex: this.endpoint.index,
@@ -998,8 +905,7 @@ let Security2CCMessageEncapsulation = (() => {
         throw new import_core.ZWaveError("Multicast Security S2 encapsulation requires the MGRP extension", import_core.ZWaveErrorCodes.Security2CC_MissingExtension);
       }
     }
-    /** @deprecated Use {@link fromAsync} instead */
-    static from(raw, ctx) {
+    static async from(raw, ctx) {
       const securityManager = assertSecurityRX(ctx);
       (0, import_core.validatePayload)(raw.payload.length >= 2);
       const sequenceNumber = raw.payload[0];
@@ -1031,9 +937,9 @@ let Security2CCMessageEncapsulation = (() => {
       })();
       if (mustDiscardCommand) {
         if (mcctx.isMulticast) {
-          securityManager.nextPeerMPAN(ctx.sourceNodeId, mcctx.groupId);
+          await securityManager.nextPeerMPAN(ctx.sourceNodeId, mcctx.groupId);
         } else {
-          securityManager.nextNonce(ctx.sourceNodeId);
+          await securityManager.nextNonce(ctx.sourceNodeId);
         }
         import_core.validatePayload.fail("Invalid S2 extension");
       }
@@ -1058,10 +964,7 @@ let Security2CCMessageEncapsulation = (() => {
           securityManager.storePeerMPAN(ctx.sourceNodeId, mcctx.groupId, { type: import_core.MPANState.OutOfSync });
           failNoMPAN();
         }
-        decrypt = /* @__PURE__ */ __name(() => (
-          // eslint-disable-next-line @typescript-eslint/no-deprecated
-          decryptMulticastSync(ctx.sourceNodeId, securityManager, mcctx.groupId, ciphertext, authData, authTag)
-        ), "decrypt");
+        decrypt = /* @__PURE__ */ __name(() => decryptMulticast(ctx.sourceNodeId, securityManager, mcctx.groupId, ciphertext, authData, authTag), "decrypt");
       } else {
         const spanState = securityManager.getSPANState(ctx.sourceNodeId);
         if (spanState.type === import_core.SPANState.None) {
@@ -1069,10 +972,7 @@ let Security2CCMessageEncapsulation = (() => {
         } else if (spanState.type === import_core.SPANState.RemoteEI) {
           failNoSPAN();
         }
-        decrypt = /* @__PURE__ */ __name(() => (
-          // eslint-disable-next-line @typescript-eslint/no-deprecated
-          decryptSinglecastSync(ctx, securityManager, ctx.sourceNodeId, sequenceNumber, prevSequenceNumber, ciphertext, authData, authTag, spanState, extensions)
-        ), "decrypt");
+        decrypt = /* @__PURE__ */ __name(() => decryptSinglecast(ctx, securityManager, ctx.sourceNodeId, sequenceNumber, prevSequenceNumber, ciphertext, authData, authTag, spanState, extensions), "decrypt");
       }
       let plaintext;
       let authOK = false;
@@ -1087,7 +987,7 @@ let Security2CCMessageEncapsulation = (() => {
           key,
           iv,
           securityClass: decryptionSecurityClass
-        } = decrypt());
+        } = await decrypt());
         if (!!authOK && !!plaintext)
           break;
         if (!!getSenderEI(extensions))
@@ -1119,10 +1019,11 @@ let Security2CCMessageEncapsulation = (() => {
         import_core.validatePayload.fail("Invalid combination of extensions");
       }
       if (!mcctx.isMulticast) {
-        if (mpanExtension) {
-          securityManager.storePeerMPAN(ctx.sourceNodeId, mpanExtension.groupId, {
+        const mpanExtension2 = extensions.find((e) => e instanceof import_Extension.MPANExtension);
+        if (mpanExtension2) {
+          securityManager.storePeerMPAN(ctx.sourceNodeId, mpanExtension2.groupId, {
             type: import_core.MPANState.MPAN,
-            currentMPAN: mpanExtension.innerMPANState
+            currentMPAN: mpanExtension2.innerMPANState
           });
         }
       }
@@ -1130,145 +1031,7 @@ let Security2CCMessageEncapsulation = (() => {
       let encapsulated;
       if (decryptedCCBytes.length > 0) {
         (0, import_core.validatePayload)(decryptedCCBytes.length >= 2);
-        encapsulated = import_CommandClass.CommandClass.parse(decryptedCCBytes, ctx);
-      }
-      const ret = new Security2CCMessageEncapsulation2({
-        nodeId: ctx.sourceNodeId,
-        sequenceNumber,
-        securityClass,
-        extensions,
-        encapsulated
-      });
-      ret.key = key;
-      ret.iv = iv;
-      ret.authData = authData;
-      ret.authTag = authTag;
-      ret.plaintext = decryptedCCBytes;
-      return ret;
-    }
-    static async fromAsync(raw, ctx) {
-      const securityManager = assertSecurityRX(ctx);
-      (0, import_core.validatePayload)(raw.payload.length >= 2);
-      const sequenceNumber = raw.payload[0];
-      import_core.validatePayload.withReason("No security class granted")(ctx.getHighestSecurityClass(ctx.sourceNodeId) !== import_core.SecurityClass.None);
-      const hasExtensions = !!(raw.payload[1] & 1);
-      const hasEncryptedExtensions = !!(raw.payload[1] & 2);
-      let offset = 2;
-      const extensions = [];
-      let mustDiscardCommand = false;
-      if (hasExtensions) {
-        const parseResult = parseExtensions(raw.payload.subarray(offset), false);
-        extensions.push(...parseResult.extensions);
-        offset += parseResult.bytesRead;
-        mustDiscardCommand = parseResult.mustDiscardCommand;
-      }
-      const mcctx = (() => {
-        const multicastGroupId = getMulticastGroupId(extensions);
-        if (ctx.frameType === "multicast" || ctx.frameType === "broadcast") {
-          if (multicastGroupId == void 0) {
-            import_core.validatePayload.fail("Multicast frames without MGRP extension");
-          }
-          return {
-            isMulticast: true,
-            groupId: multicastGroupId
-          };
-        } else {
-          return { isMulticast: false, groupId: multicastGroupId };
-        }
-      })();
-      if (mustDiscardCommand) {
-        if (mcctx.isMulticast) {
-          await securityManager.nextPeerMPANAsync(ctx.sourceNodeId, mcctx.groupId);
-        } else {
-          await securityManager.nextNonceAsync(ctx.sourceNodeId);
-        }
-        import_core.validatePayload.fail("Invalid S2 extension");
-      }
-      let prevSequenceNumber;
-      let mpanState;
-      if (mcctx.isMulticast) {
-        mpanState = securityManager.getPeerMPAN(ctx.sourceNodeId, mcctx.groupId);
-      } else {
-        prevSequenceNumber = validateSequenceNumber(securityManager, ctx.sourceNodeId, sequenceNumber);
-        if (mcctx.groupId == void 0) {
-          securityManager.resetOutOfSyncMPANs(ctx.sourceNodeId);
-        }
-      }
-      const unencryptedPayload = raw.payload.subarray(0, offset);
-      const ciphertext = raw.payload.subarray(offset, -SECURITY_S2_AUTH_TAG_LENGTH);
-      const authTag = raw.payload.subarray(-SECURITY_S2_AUTH_TAG_LENGTH);
-      const messageLength = 2 + raw.payload.length;
-      const authData = getAuthenticationData(ctx.sourceNodeId, getDestinationIDRX(ctx, extensions), ctx.homeId, messageLength, unencryptedPayload);
-      let decrypt;
-      if (mcctx.isMulticast) {
-        if (mpanState?.type !== import_core.MPANState.MPAN) {
-          securityManager.storePeerMPAN(ctx.sourceNodeId, mcctx.groupId, { type: import_core.MPANState.OutOfSync });
-          failNoMPAN();
-        }
-        decrypt = /* @__PURE__ */ __name(() => decryptMulticastAsync(ctx.sourceNodeId, securityManager, mcctx.groupId, ciphertext, authData, authTag), "decrypt");
-      } else {
-        const spanState = securityManager.getSPANState(ctx.sourceNodeId);
-        if (spanState.type === import_core.SPANState.None) {
-          failNoSPAN();
-        } else if (spanState.type === import_core.SPANState.RemoteEI) {
-          failNoSPAN();
-        }
-        decrypt = /* @__PURE__ */ __name(() => decryptSinglecastAsync(ctx, securityManager, ctx.sourceNodeId, sequenceNumber, prevSequenceNumber, ciphertext, authData, authTag, spanState, extensions), "decrypt");
-      }
-      let plaintext;
-      let authOK = false;
-      let key;
-      let iv;
-      let decryptionSecurityClass;
-      const decryptAttempts = mcctx.isMulticast ? MAX_DECRYPT_ATTEMPTS_MULTICAST : mcctx.groupId != void 0 ? MAX_DECRYPT_ATTEMPTS_SC_FOLLOWUP : MAX_DECRYPT_ATTEMPTS_SINGLECAST;
-      for (let i = 0; i < decryptAttempts; i++) {
-        ({
-          plaintext,
-          authOK,
-          key,
-          iv,
-          securityClass: decryptionSecurityClass
-        } = await decrypt());
-        if (!!authOK && !!plaintext)
-          break;
-        if (!!getSenderEI(extensions))
-          break;
-      }
-      if (!authOK || !plaintext) {
-        if (mcctx.isMulticast) {
-          securityManager.storePeerMPAN(ctx.sourceNodeId, mcctx.groupId, { type: import_core.MPANState.OutOfSync });
-          import_core.validatePayload.fail(import_core.ZWaveErrorCodes.Security2CC_CannotDecodeMulticast);
-        } else {
-          import_core.validatePayload.fail(import_core.ZWaveErrorCodes.Security2CC_CannotDecode);
-        }
-      } else if (!mcctx.isMulticast && mcctx.groupId != void 0) {
-        securityManager.tryIncrementPeerMPAN(ctx.sourceNodeId, mcctx.groupId);
-      }
-      const securityClass = decryptionSecurityClass;
-      offset = 0;
-      if (hasEncryptedExtensions) {
-        const parseResult = parseExtensions(plaintext, true);
-        extensions.push(...parseResult.extensions);
-        offset += parseResult.bytesRead;
-        mustDiscardCommand = parseResult.mustDiscardCommand;
-      }
-      if (mustDiscardCommand) {
-        import_core.validatePayload.fail("Invalid extension");
-      }
-      if (!mcctx.isMulticast) {
-        const mpanExtension = extensions.find((e) => e instanceof import_Extension.MPANExtension);
-        if (mpanExtension) {
-          securityManager.storePeerMPAN(ctx.sourceNodeId, mpanExtension.groupId, {
-            type: import_core.MPANState.MPAN,
-            currentMPAN: mpanExtension.innerMPANState
-          });
-        }
-      }
-      const decryptedCCBytes = plaintext.subarray(offset);
-      let encapsulated;
-      if (decryptedCCBytes.length > 0) {
-        (0, import_core.validatePayload)(decryptedCCBytes.length >= 2);
-        encapsulated = await import_CommandClass.CommandClass.parseAsync(decryptedCCBytes, ctx);
+        encapsulated = await import_CommandClass.CommandClass.parse(decryptedCCBytes, ctx);
       }
       const ret = new Security2CCMessageEncapsulation2({
         nodeId: ctx.sourceNodeId,
@@ -1321,36 +1084,7 @@ let Security2CCMessageEncapsulation = (() => {
     getMulticastGroupId() {
       return getMulticastGroupId(this.extensions);
     }
-    /** @deprecated Use {@link maybeAddSPANExtensionAsync} instead */
-    maybeAddSPANExtensionSync(ctx, securityManager) {
-      if (!this.isSinglecast())
-        return;
-      const receiverNodeId = this.nodeId;
-      const spanState = securityManager.getSPANState(receiverNodeId);
-      if (spanState.type === import_core.SPANState.None || spanState.type === import_core.SPANState.LocalEI) {
-        throw new import_core.ZWaveError(`Security S2 CC requires the receiver's nonce to be sent!`, import_core.ZWaveErrorCodes.Security2CC_NoSPAN);
-      } else if (spanState.type === import_core.SPANState.RemoteEI) {
-        const senderEI = securityManager.generateNonce(void 0);
-        const receiverEI = spanState.receiverEI;
-        if (this.securityClass == void 0 && securityManager.tempKeys.has(receiverNodeId)) {
-          securityManager.initializeTempSPAN(receiverNodeId, senderEI, receiverEI);
-        } else {
-          const securityClass = this.securityClass ?? ctx.getHighestSecurityClass(receiverNodeId);
-          if (securityClass == void 0) {
-            throw new import_core.ZWaveError("No security class defined for this command!", import_core.ZWaveErrorCodes.Security2CC_NoSPAN);
-          }
-          securityManager.initializeSPAN(receiverNodeId, securityClass, senderEI, receiverEI);
-        }
-        let spanExtension = this.extensions.find((e) => e instanceof import_Extension.SPANExtension);
-        if (spanExtension) {
-          spanExtension.senderEI = senderEI;
-        } else {
-          spanExtension = new import_Extension.SPANExtension({ senderEI });
-          this.extensions.push(spanExtension);
-        }
-      }
-    }
-    async maybeAddSPANExtensionAsync(ctx, securityManager) {
+    async maybeAddSPANExtension(ctx, securityManager) {
       if (!this.isSinglecast())
         return;
       const receiverNodeId = this.nodeId;
@@ -1358,16 +1092,16 @@ let Security2CCMessageEncapsulation = (() => {
       if (spanState.type === import_core.SPANState.None || spanState.type === import_core.SPANState.LocalEI) {
         throw new import_core.ZWaveError(`Security S2 CC requires the receiver's nonce to be sent!`, import_core.ZWaveErrorCodes.Security2CC_NoSPAN);
       } else if (spanState.type === import_core.SPANState.RemoteEI) {
-        const senderEI = await securityManager.generateNonceAsync(void 0);
+        const senderEI = await securityManager.generateNonce(void 0);
         const receiverEI = spanState.receiverEI;
         if (this.securityClass == void 0 && securityManager.tempKeys.has(receiverNodeId)) {
-          await securityManager.initializeTempSPANAsync(receiverNodeId, senderEI, receiverEI);
+          await securityManager.initializeTempSPAN(receiverNodeId, senderEI, receiverEI);
         } else {
           const securityClass = this.securityClass ?? ctx.getHighestSecurityClass(receiverNodeId);
           if (securityClass == void 0) {
             throw new import_core.ZWaveError("No security class defined for this command!", import_core.ZWaveErrorCodes.Security2CC_NoSPAN);
           }
-          await securityManager.initializeSPANAsync(receiverNodeId, securityClass, senderEI, receiverEI);
+          await securityManager.initializeSPAN(receiverNodeId, securityClass, senderEI, receiverEI);
         }
         let spanExtension = this.extensions.find((e) => e instanceof import_Extension.SPANExtension);
         if (spanExtension) {
@@ -1378,11 +1112,10 @@ let Security2CCMessageEncapsulation = (() => {
         }
       }
     }
-    /** @deprecated Use {@link serializeAsync} instead */
-    serialize(ctx) {
+    async serialize(ctx) {
       const securityManager = assertSecurityTX(ctx, this.nodeId);
       this.ensureSequenceNumber(securityManager);
-      this.maybeAddSPANExtensionSync(ctx, securityManager);
+      await this.maybeAddSPANExtension(ctx, securityManager);
       const unencryptedExtensions = this.extensions.filter((e) => !e.isEncrypted());
       const encryptedExtensions = this.extensions.filter((e) => e.isEncrypted());
       const unencryptedPayload = import_safe2.Bytes.concat([
@@ -1392,7 +1125,7 @@ let Security2CCMessageEncapsulation = (() => {
         ]),
         ...unencryptedExtensions.map((e, index) => e.serialize(index < unencryptedExtensions.length - 1))
       ]);
-      const serializedCC = this.encapsulated?.serialize(ctx) ?? new import_safe2.Bytes();
+      const serializedCC = await this.encapsulated?.serialize(ctx) ?? new import_safe2.Bytes();
       const plaintextPayload = import_safe2.Bytes.concat([
         ...encryptedExtensions.map((e, index) => e.serialize(index < encryptedExtensions.length - 1)),
         serializedCC
@@ -1403,18 +1136,18 @@ let Security2CCMessageEncapsulation = (() => {
       let key;
       let iv;
       if (this.isSinglecast()) {
-        iv = securityManager.nextNonce(this.nodeId, true);
+        iv = await securityManager.nextNonce(this.nodeId, true);
         const { keyCCM } = (
           // Prefer the overridden security class if it was given
           this.securityClass != void 0 ? securityManager.getKeysForSecurityClass(this.securityClass) : securityManager.getKeysForNode(this.nodeId)
         );
         key = keyCCM;
       } else {
-        const keyAndIV = securityManager.getMulticastKeyAndIV(destinationTag);
+        const keyAndIV = await securityManager.getMulticastKeyAndIV(destinationTag);
         key = keyAndIV.key;
         iv = keyAndIV.iv;
       }
-      const { ciphertext: ciphertextPayload, authTag } = (0, import_core.encryptAES128CCMSync)(key, iv, plaintextPayload, authData, SECURITY_S2_AUTH_TAG_LENGTH);
+      const { ciphertext: ciphertextPayload, authTag } = await (0, import_core.encryptAES128CCM)(plaintextPayload, key, iv, authData, SECURITY_S2_AUTH_TAG_LENGTH);
       this.key = key;
       this.iv = iv;
       this.authData = authData;
@@ -1427,54 +1160,6 @@ let Security2CCMessageEncapsulation = (() => {
       ]);
       return super.serialize(ctx);
     }
-    async serializeAsync(ctx) {
-      const securityManager = assertSecurityTX(ctx, this.nodeId);
-      this.ensureSequenceNumber(securityManager);
-      await this.maybeAddSPANExtensionAsync(ctx, securityManager);
-      const unencryptedExtensions = this.extensions.filter((e) => !e.isEncrypted());
-      const encryptedExtensions = this.extensions.filter((e) => e.isEncrypted());
-      const unencryptedPayload = import_safe2.Bytes.concat([
-        import_safe2.Bytes.from([
-          this.sequenceNumber,
-          (encryptedExtensions.length > 0 ? 2 : 0) | (unencryptedExtensions.length > 0 ? 1 : 0)
-        ]),
-        ...unencryptedExtensions.map((e, index) => e.serialize(index < unencryptedExtensions.length - 1))
-      ]);
-      const serializedCC = await this.encapsulated?.serializeAsync(ctx) ?? new import_safe2.Bytes();
-      const plaintextPayload = import_safe2.Bytes.concat([
-        ...encryptedExtensions.map((e, index) => e.serialize(index < encryptedExtensions.length - 1)),
-        serializedCC
-      ]);
-      const destinationTag = getDestinationIDTX.call(this);
-      const messageLength = this.computeEncapsulationOverhead() + serializedCC.length;
-      const authData = getAuthenticationData(ctx.ownNodeId, destinationTag, ctx.homeId, messageLength, unencryptedPayload);
-      let key;
-      let iv;
-      if (this.isSinglecast()) {
-        iv = await securityManager.nextNonceAsync(this.nodeId, true);
-        const { keyCCM } = (
-          // Prefer the overridden security class if it was given
-          this.securityClass != void 0 ? securityManager.getKeysForSecurityClass(this.securityClass) : securityManager.getKeysForNode(this.nodeId)
-        );
-        key = keyCCM;
-      } else {
-        const keyAndIV = await securityManager.getMulticastKeyAndIVAsync(destinationTag);
-        key = keyAndIV.key;
-        iv = keyAndIV.iv;
-      }
-      const { ciphertext: ciphertextPayload, authTag } = await (0, import_core.encryptAES128CCMAsync)(plaintextPayload, key, iv, authData, SECURITY_S2_AUTH_TAG_LENGTH);
-      this.key = key;
-      this.iv = iv;
-      this.authData = authData;
-      this.authTag = authTag;
-      this.ciphertext = ciphertextPayload;
-      this.payload = import_safe2.Bytes.concat([
-        unencryptedPayload,
-        ciphertextPayload,
-        authTag
-      ]);
-      return super.serializeAsync(ctx);
-    }
     computeEncapsulationOverhead() {
       const extensionBytes = this.extensions.map((e) => e.computeLength()).reduce((a, b) => a + b, 0);
       return super.computeEncapsulationOverhead() + 2 + SECURITY_S2_AUTH_TAG_LENGTH + extensionBytes;