@zwave-js/cc 15.20.0 → 15.21.0

package/build/cjs/cc/Security2CC.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
-  "sources": ["../../../src/cc/Security2CC.ts"],
-  "sourcesContent": ["import type { CCEncodingContext, CCParsingContext } from \"@zwave-js/cc\";\nimport {\n\tCommandClasses,\n\tEncapsulationFlags,\n\ttype GetNode,\n\ttype GetValueDB,\n\tMPANState,\n\ttype MaybeNotKnown,\n\ttype MessageOrCCLogEntry,\n\tMessagePriority,\n\ttype MessageRecord,\n\ttype MulticastDestination,\n\tNODE_ID_BROADCAST,\n\tNODE_ID_BROADCAST_LR,\n\ttype NodeId,\n\ttype S2SecurityClass,\n\tSPANState,\n\ttype SPANTableEntry,\n\tSecurityClass,\n\ttype SecurityManager2,\n\ttype SecurityManagers,\n\ttype SupportsCC,\n\tTransmitOptions,\n\ttype WithAddress,\n\tZWaveError,\n\tZWaveErrorCodes,\n\tdecryptAES128CCM,\n\tencodeBitMask,\n\tencodeCCList,\n\tencryptAES128CCM,\n\tgetCCName,\n\thighResTimestamp,\n\tisLongRangeNodeId,\n\tisTransmissionError,\n\tisZWaveError,\n\tparseBitMask,\n\tparseCCList,\n\tsecurityClassIsS2,\n\tsecurityClassOrder,\n\tvalidatePayload,\n} from \"@zwave-js/core\";\nimport {\n\tBytes,\n\ttype BytesView,\n\tbuffer2hex,\n\tgetEnumMemberName,\n\tpick,\n} from \"@zwave-js/shared\";\nimport { wait } from \"alcalzone-shared/async\";\nimport { isArray } from \"alcalzone-shared/typeguards\";\nimport { CCAPI } from \"../lib/API.js\";\nimport {\n\ttype CCRaw,\n\ttype CCResponseRole,\n\tCommandClass,\n\ttype InterviewContext,\n} from \"../lib/CommandClass.js\";\nimport {\n\tAPI,\n\tCCCommand,\n\tcommandClass,\n\texpectedCCResponse,\n\timplementedVersion,\n} from \"../lib/CommandClassDecorators.js\";\nimport {\n\tMGRPExtension,\n\tMOSExtension,\n\tMPANExtension,\n\tSPANExtension,\n\tSecurity2Extension,\n\tValidateS2ExtensionResult,\n\tvalidateS2Extension,\n} from \"../lib/Security2/Extension.js\";\nimport {\n\tECDHProfiles,\n\tKEXFailType,\n\tKEXSchemes,\n} from \"../lib/Security2/shared.js\";\nimport { Security2Command } from \"../lib/_Types.js\";\nimport { CRC16CC } from \"./CRC16CC.js\";\nimport { MultiChannelCC } from \"./MultiChannelCC.js\";\nimport { SecurityCC } from \"./SecurityCC.js\";\nimport { TransportServiceCC } from \"./TransportServiceCC.js\";\n\nfunction securityClassToBitMask(key: SecurityClass): Bytes {\n\treturn encodeBitMask(\n\t\t[key],\n\t\tSecurityClass.S0_Legacy,\n\t\tSecurityClass.S2_Unauthenticated,\n\t);\n}\n\nfunction bitMaskToSecurityClass(\n\tbuffer: BytesView,\n\toffset: number,\n): SecurityClass {\n\tconst keys = parseBitMask(\n\t\tbuffer.subarray(offset, offset + 1),\n\t\tSecurityClass.S2_Unauthenticated,\n\t);\n\tvalidatePayload(keys.length === 1);\n\treturn keys[0];\n}\n\nconst SECURITY_S2_AUTH_TAG_LENGTH = 8;\n\nfunction getAuthenticationData(\n\tsendingNodeId: number,\n\tdestination: number,\n\thomeId: number,\n\tcommandLength: number,\n\tunencryptedPayload: BytesView,\n): BytesView {\n\tconst nodeIdSize =\n\t\tisLongRangeNodeId(sendingNodeId) || isLongRangeNodeId(destination)\n\t\t\t? 2\n\t\t\t: 1;\n\tconst ret = new Bytes(\n\t\t2 * nodeIdSize + 6 + unencryptedPayload.length,\n\t);\n\tlet offset = 0;\n\tret.writeUIntBE(sendingNodeId, offset, nodeIdSize);\n\toffset += nodeIdSize;\n\tret.writeUIntBE(destination, offset, nodeIdSize);\n\toffset += nodeIdSize;\n\tret.writeUInt32BE(homeId, offset);\n\toffset += 4;\n\tret.writeUInt16BE(commandLength, offset);\n\toffset += 2;\n\t// This includes the sequence number and all unencrypted extensions\n\tret.set(unencryptedPayload, offset);\n\treturn ret;\n}\nfunction getSecurityManager(\n\townNodeId: number,\n\tsecurityManagers: SecurityManagers,\n\totherNodeId: MulticastDestination | number,\n): SecurityManager2 | undefined {\n\tconst longRange = isLongRangeNodeId(ownNodeId)\n\t\t|| isLongRangeNodeId(\n\t\t\tisArray(otherNodeId) ? otherNodeId[0] : otherNodeId,\n\t\t);\n\treturn longRange\n\t\t? securityManagers.securityManagerLR\n\t\t: securityManagers.securityManager2;\n}\n\n/** Validates that a sequence number is not a duplicate and updates the SPAN table if it is accepted. Returns the previous sequence number if there is one. */\nfunction validateSequenceNumber(\n\tsecurityManager: SecurityManager2,\n\tsourceNodeId: number,\n\tsequenceNumber: number,\n): number | undefined {\n\tvalidatePayload.withReason(\n\t\t`Duplicate command (sequence number ${sequenceNumber})`,\n\t)(\n\t\t!securityManager.isDuplicateSinglecast(\n\t\t\tsourceNodeId,\n\t\t\tsequenceNumber,\n\t\t),\n\t);\n\t// Not a duplicate, store it\n\treturn securityManager.storeSequenceNumber(\n\t\tsourceNodeId,\n\t\tsequenceNumber,\n\t);\n}\n\nconst MAX_DECRYPT_ATTEMPTS_SINGLECAST = 5;\nconst MAX_DECRYPT_ATTEMPTS_MULTICAST = 5;\nconst MAX_DECRYPT_ATTEMPTS_SC_FOLLOWUP = 1;\n\n// @publicAPI\nexport interface DecryptionResult {\n\tplaintext: BytesView;\n\tauthOK: boolean;\n\tkey?: BytesView;\n\tiv?: BytesView;\n\tsecurityClass: SecurityClass | undefined;\n}\n\nfunction assertSecurityRX(\n\tctx: CCParsingContext,\n): SecurityManager2 {\n\tif (!ctx.ownNodeId) {\n\t\tthrow new ZWaveError(\n\t\t\t`Secure commands (S2) can only be decoded when the controller's node id is known!`,\n\t\t\tZWaveErrorCodes.Driver_NotReady,\n\t\t);\n\t}\n\n\tconst ret = getSecurityManager(ctx.ownNodeId, ctx, ctx.sourceNodeId);\n\n\tif (!ret) {\n\t\tthrow new ZWaveError(\n\t\t\t`Secure commands (S2) can only be decoded when the security manager is set up!`,\n\t\t\tZWaveErrorCodes.Driver_NoSecurity,\n\t\t);\n\t}\n\n\treturn ret;\n}\n\nfunction assertSecurityTX(\n\tctx: CCEncodingContext,\n\tdestination: MulticastDestination | number,\n): SecurityManager2 {\n\tif (!ctx.ownNodeId) {\n\t\tthrow new ZWaveError(\n\t\t\t`Secure commands (S2) can only be sent when the controller's node id is known!`,\n\t\t\tZWaveErrorCodes.Driver_NotReady,\n\t\t);\n\t}\n\n\tconst ret = getSecurityManager(ctx.ownNodeId, ctx, destination);\n\n\tif (!ret) {\n\t\tthrow new ZWaveError(\n\t\t\t`Secure commands (S2) can only be sent when the security manager is set up!`,\n\t\t\tZWaveErrorCodes.Driver_NoSecurity,\n\t\t);\n\t}\n\n\treturn ret;\n}\n\nasync function decryptSinglecast(\n\tctx: CCParsingContext,\n\tsecurityManager: SecurityManager2,\n\tsendingNodeId: number,\n\tcurSequenceNumber: number,\n\tprevSequenceNumber: number,\n\tciphertext: BytesView,\n\tauthData: BytesView,\n\tauthTag: BytesView,\n\tspanState: SPANTableEntry & {\n\t\ttype: SPANState.SPAN | SPANState.LocalEI;\n\t},\n\textensions: Security2Extension[],\n): Promise<DecryptionResult> {\n\tconst decryptWithNonce = async (nonce: BytesView) => {\n\t\tconst { keyCCM: key } = securityManager.getKeysForNode(\n\t\t\tsendingNodeId,\n\t\t);\n\n\t\tconst iv = nonce;\n\n\t\tconst ret = await decryptAES128CCM(\n\t\t\tciphertext,\n\t\t\tkey,\n\t\t\tiv,\n\t\t\tauthData,\n\t\t\tauthTag,\n\t\t);\n\n\t\treturn {\n\t\t\tkey,\n\t\t\tiv,\n\t\t\t...ret,\n\t\t};\n\t};\n\tconst getNonceAndDecrypt = async () => {\n\t\tconst iv = await securityManager.nextNonce(sendingNodeId);\n\t\treturn decryptWithNonce(iv);\n\t};\n\n\tif (spanState.type === SPANState.SPAN) {\n\t\t// There SHOULD be a shared SPAN between both parties. But experience has shown that both could have\n\t\t// sent a command at roughly the same time, using the same SPAN for encryption.\n\t\t// To avoid a nasty desync and both nodes trying to resync at the same time, causing message loss,\n\t\t// we accept commands encrypted with the previous SPAN under very specific circumstances:\n\t\tif (\n\t\t\t// The previous SPAN is still known, i.e. the node didn't send another command that was successfully decrypted\n\t\t\t!!spanState.currentSPAN\n\t\t\t// it is still valid\n\t\t\t&& spanState.currentSPAN.expires > highResTimestamp()\n\t\t\t// The received command is exactly the next, expected one\n\t\t\t&& prevSequenceNumber != undefined\n\t\t\t&& curSequenceNumber === ((prevSequenceNumber + 1) & 0xff)\n\t\t\t// And in case of a mock-based test, do this only on the controller\n\t\t\t&& !ctx.__internalIsMockNode\n\t\t) {\n\t\t\tconst nonce = spanState.currentSPAN.nonce;\n\t\t\tspanState.currentSPAN = undefined;\n\n\t\t\t// If we could decrypt this way, we're done...\n\t\t\tconst result = await decryptWithNonce(nonce);\n\t\t\tif (result.authOK) {\n\t\t\t\treturn {\n\t\t\t\t\t...result,\n\t\t\t\t\tsecurityClass: spanState.securityClass,\n\t\t\t\t};\n\t\t\t}\n\t\t\t// ...otherwise, we need to try the normal way\n\t\t} else {\n\t\t\t// forgetting the current SPAN shouldn't be necessary but better be safe than sorry\n\t\t\tspanState.currentSPAN = undefined;\n\t\t}\n\n\t\t// This can only happen if the security class is known\n\t\treturn {\n\t\t\t...(await getNonceAndDecrypt()),\n\t\t\tsecurityClass: spanState.securityClass,\n\t\t};\n\t} else if (spanState.type === SPANState.LocalEI) {\n\t\t// We've sent the other our receiver's EI and received its sender's EI,\n\t\t// meaning we can now establish an SPAN\n\t\tconst senderEI = getSenderEI(extensions);\n\t\tif (!senderEI) failNoSPAN();\n\t\tconst receiverEI = spanState.receiverEI;\n\n\t\t// How we do this depends on whether we know the security class of the other node\n\t\tconst isBootstrappingNode = securityManager.tempKeys.has(\n\t\t\tsendingNodeId,\n\t\t);\n\t\tif (isBootstrappingNode) {\n\t\t\t// We're currently bootstrapping the node, it might be using a temporary key\n\t\t\tawait securityManager.initializeTempSPAN(\n\t\t\t\tsendingNodeId,\n\t\t\t\tsenderEI,\n\t\t\t\treceiverEI,\n\t\t\t);\n\n\t\t\tconst ret = await getNonceAndDecrypt();\n\t\t\t// Decryption with the temporary key worked\n\t\t\tif (ret.authOK) {\n\t\t\t\treturn {\n\t\t\t\t\t...ret,\n\t\t\t\t\tsecurityClass: SecurityClass.Temporary,\n\t\t\t\t};\n\t\t\t}\n\n\t\t\t// Reset the SPAN state and try with the recently granted security class\n\t\t\tsecurityManager.setSPANState(\n\t\t\t\tsendingNodeId,\n\t\t\t\tspanState,\n\t\t\t);\n\t\t}\n\n\t\t// When ending up here, one of two situations has occured:\n\t\t// a) We've taken over an existing network and do not know the node's security class\n\t\t// b) We know the security class, but we're about to establish a new SPAN. This may happen at a lower\n\t\t//    security class than the one the node normally uses, e.g. when we're being queried for securely\n\t\t//    supported CCs.\n\t\t// In both cases, we should simply try decoding with multiple security classes, starting from the highest one.\n\t\t// If this fails, we restore the previous (partial) SPAN state.\n\n\t\t// Try all security classes where we do not definitely know that it was not granted\n\t\t// While bootstrapping a node, we consider the key that is being exchanged (including S0) to be the highest. No need to look at others\n\t\tconst possibleSecurityClasses = isBootstrappingNode\n\t\t\t? [ctx.getHighestSecurityClass(sendingNodeId)!]\n\t\t\t: securityClassOrder.filter(\n\t\t\t\t(s) =>\n\t\t\t\t\tctx.hasSecurityClass(sendingNodeId, s)\n\t\t\t\t\t\t!== false,\n\t\t\t);\n\n\t\tfor (const secClass of possibleSecurityClasses) {\n\t\t\t// Skip security classes we don't have keys for\n\t\t\tif (\n\t\t\t\t!securityManager.hasKeysForSecurityClass(\n\t\t\t\t\tsecClass,\n\t\t\t\t)\n\t\t\t) {\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\t// Initialize an SPAN with that security class\n\t\t\tawait securityManager.initializeSPAN(\n\t\t\t\tsendingNodeId,\n\t\t\t\tsecClass,\n\t\t\t\tsenderEI,\n\t\t\t\treceiverEI,\n\t\t\t);\n\t\t\tconst ret = await getNonceAndDecrypt();\n\n\t\t\t// It worked, return the result\n\t\t\tif (ret.authOK) {\n\t\t\t\t// Also if we weren't sure before, we now know that the security class is granted\n\t\t\t\tif (\n\t\t\t\t\tctx.hasSecurityClass(sendingNodeId, secClass)\n\t\t\t\t\t\t=== undefined\n\t\t\t\t) {\n\t\t\t\t\tctx.setSecurityClass(sendingNodeId, secClass, true);\n\t\t\t\t}\n\t\t\t\treturn {\n\t\t\t\t\t...ret,\n\t\t\t\t\tsecurityClass: secClass,\n\t\t\t\t};\n\t\t\t} else {\n\t\t\t\t// Reset the SPAN state and try with the next security class\n\t\t\t\tsecurityManager.setSPANState(\n\t\t\t\t\tsendingNodeId,\n\t\t\t\t\tspanState,\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\t}\n\n\t// Nothing worked, fail the decryption\n\treturn {\n\t\tplaintext: new Uint8Array(),\n\t\tauthOK: false,\n\t\tsecurityClass: undefined,\n\t};\n}\n\nasync function decryptMulticast(\n\tsendingNodeId: number,\n\tsecurityManager: SecurityManager2,\n\tgroupId: number,\n\tciphertext: BytesView,\n\tauthData: BytesView,\n\tauthTag: BytesView,\n): Promise<DecryptionResult> {\n\tconst iv = await securityManager.nextPeerMPAN(\n\t\tsendingNodeId,\n\t\tgroupId,\n\t);\n\tconst { keyCCM: key } = securityManager.getKeysForNode(\n\t\tsendingNodeId,\n\t);\n\treturn {\n\t\tkey,\n\t\tiv,\n\t\t...(await decryptAES128CCM(\n\t\t\tciphertext,\n\t\t\tkey,\n\t\t\tiv,\n\t\t\tauthData,\n\t\t\tauthTag,\n\t\t)),\n\t\t// The security class is irrelevant when decrypting multicast commands\n\t\tsecurityClass: undefined,\n\t};\n}\n\nfunction parseExtensions(buffer: BytesView, wasEncrypted: boolean): {\n\textensions: Security2Extension[];\n\tmustDiscardCommand: boolean;\n\tbytesRead: number;\n} {\n\tconst extensions: Security2Extension[] = [];\n\tlet mustDiscardCommand = false;\n\tlet offset = 0;\n\n\tparsing: while (true) {\n\t\tif (buffer.length < offset + 2) {\n\t\t\t// An S2 extension was expected, but the buffer is too short\n\t\t\tmustDiscardCommand = true;\n\t\t\tbreak parsing;\n\t\t}\n\n\t\t// The length field could be too large, which would cause part of the actual ciphertext\n\t\t// to be ignored. Try to avoid this for known extensions by checking the actual and expected length.\n\t\tconst { actual: actualLength, expected: expectedLength } =\n\t\t\tSecurity2Extension\n\t\t\t\t.getExtensionLength(\n\t\t\t\t\tbuffer.subarray(offset),\n\t\t\t\t);\n\n\t\t// Parse the extension using the expected length if possible\n\t\tconst extensionLength = expectedLength ?? actualLength;\n\t\tif (extensionLength < 2) {\n\t\t\t// An S2 extension was expected, but the length is too short\n\t\t\tmustDiscardCommand = true;\n\t\t\tbreak parsing;\n\t\t} else if (\n\t\t\textensionLength\n\t\t\t\t> buffer.length\n\t\t\t\t\t- offset\n\t\t\t\t\t- (wasEncrypted\n\t\t\t\t\t\t? 0\n\t\t\t\t\t\t: SECURITY_S2_AUTH_TAG_LENGTH)\n\t\t) {\n\t\t\t// The supposed length is longer than the space the extensions may occupy\n\t\t\tmustDiscardCommand = true;\n\t\t\tbreak parsing;\n\t\t}\n\n\t\tconst extensionData = buffer.subarray(\n\t\t\toffset,\n\t\t\toffset + extensionLength,\n\t\t);\n\t\toffset += extensionLength;\n\n\t\tconst ext = Security2Extension.parse(extensionData);\n\n\t\tswitch (validateS2Extension(ext, wasEncrypted)) {\n\t\t\tcase ValidateS2ExtensionResult.OK:\n\t\t\t\tif (\n\t\t\t\t\texpectedLength != undefined\n\t\t\t\t\t&& actualLength !== expectedLength\n\t\t\t\t) {\n\t\t\t\t\t// The extension length field does not match, ignore the extension\n\t\t\t\t} else {\n\t\t\t\t\textensions.push(ext);\n\t\t\t\t}\n\t\t\t\tbreak;\n\t\t\tcase ValidateS2ExtensionResult.DiscardExtension:\n\t\t\t\t// Do nothing\n\t\t\t\tbreak;\n\t\t\tcase ValidateS2ExtensionResult.DiscardCommand:\n\t\t\t\tmustDiscardCommand = true;\n\t\t\t\tbreak;\n\t\t}\n\n\t\t// Check if that was the last extension\n\t\tif (!ext.moreToFollow) break parsing;\n\t}\n\n\treturn {\n\t\textensions,\n\t\tmustDiscardCommand,\n\t\tbytesRead: offset,\n\t};\n}\n\nfunction getDestinationIDTX(\n\tthis: Security2CC & { extensions: Security2Extension[] },\n): number {\n\tif (this.isSinglecast()) return this.nodeId;\n\n\tconst ret = getMulticastGroupId(this.extensions);\n\tif (ret == undefined) {\n\t\tthrow new ZWaveError(\n\t\t\t\"Multicast Security S2 encapsulation requires the MGRP extension\",\n\t\t\tZWaveErrorCodes.Security2CC_MissingExtension,\n\t\t);\n\t}\n\treturn ret;\n}\n\nfunction getDestinationIDRX(\n\tctx: CCParsingContext,\n\textensions: Security2Extension[],\n): number {\n\tif (ctx.frameType === \"singlecast\") {\n\t\treturn ctx.ownNodeId;\n\t}\n\n\tconst ret = getMulticastGroupId(extensions);\n\tif (ret == undefined) {\n\t\tthrow new ZWaveError(\n\t\t\t\"Multicast Security S2 encapsulation requires the MGRP extension\",\n\t\t\tZWaveErrorCodes.Security2CC_MissingExtension,\n\t\t);\n\t}\n\treturn ret;\n}\n\nfunction getMulticastGroupId(\n\textensions: Security2Extension[],\n): number | undefined {\n\tconst mgrpExtension = extensions.find(\n\t\t(e) => e instanceof MGRPExtension,\n\t);\n\treturn mgrpExtension?.groupId;\n}\n\n/** Returns the Sender's Entropy Input if this command contains an SPAN extension */\nfunction getSenderEI(extensions: Security2Extension[]): BytesView | undefined {\n\tconst spanExtension = extensions.find(\n\t\t(e) => e instanceof SPANExtension,\n\t);\n\treturn spanExtension?.senderEI;\n}\n\n// Encapsulation CCs are used internally and too frequently that we\n// want to pay the cost of validating each call\n/* eslint-disable @zwave-js/ccapi-validate-args */\n\n@API(CommandClasses[\"Security 2\"])\nexport class Security2CCAPI extends CCAPI {\n\tpublic supportsCommand(_cmd: Security2Command): MaybeNotKnown<boolean> {\n\t\t// All commands are mandatory\n\t\treturn true;\n\t}\n\n\t/**\n\t * Sends a nonce to the node, either in response to a NonceGet request or a message that failed to decrypt. The message is sent without any retransmission etc.\n\t * The return value indicates whether a nonce was successfully sent\n\t */\n\tpublic async sendNonce(): Promise<boolean> {\n\t\tthis.assertSupportsCommand(\n\t\t\tSecurity2Command,\n\t\t\tSecurity2Command.NonceReport,\n\t\t);\n\n\t\tthis.assertPhysicalEndpoint(this.endpoint);\n\n\t\tconst securityManager = getSecurityManager(\n\t\t\tthis.host.ownNodeId,\n\t\t\tthis.host,\n\t\t\tthis.endpoint.nodeId,\n\t\t);\n\n\t\tif (!securityManager) {\n\t\t\tthrow new ZWaveError(\n\t\t\t\t`Nonces can only be sent if secure communication is set up!`,\n\t\t\t\tZWaveErrorCodes.Driver_NoSecurity,\n\t\t\t);\n\t\t}\n\n\t\tconst receiverEI = await securityManager.generateNonce(\n\t\t\tthis.endpoint.nodeId,\n\t\t);\n\n\t\tconst cc = new Security2CCNonceReport({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t\tSOS: true,\n\t\t\tMOS: false,\n\t\t\treceiverEI,\n\t\t});\n\n\t\ttry {\n\t\t\tawait this.host.sendCommand(cc, {\n\t\t\t\t...this.commandOptions,\n\t\t\t\t// Seems we need these options or some nodes won't accept the nonce\n\t\t\t\ttransmitOptions: TransmitOptions.ACK\n\t\t\t\t\t| TransmitOptions.AutoRoute,\n\t\t\t\t// Only try sending a nonce once\n\t\t\t\tmaxSendAttempts: 1,\n\t\t\t\t// Nonce requests must be handled immediately\n\t\t\t\tpriority: MessagePriority.Immediate,\n\t\t\t\t// We don't want failures causing us to treat the node as asleep or dead\n\t\t\t\tchangeNodeStatusOnMissingACK: false,\n\t\t\t\t// And we need to react to\n\t\t\t});\n\t\t} catch (e) {\n\t\t\tif (isTransmissionError(e)) {\n\t\t\t\t// The nonce could not be sent, invalidate it\n\t\t\t\tsecurityManager.deleteNonce(\n\t\t\t\t\tthis.endpoint.nodeId,\n\t\t\t\t);\n\t\t\t\treturn false;\n\t\t\t} else {\n\t\t\t\t// Pass other errors through\n\t\t\t\tthrow e;\n\t\t\t}\n\t\t}\n\t\treturn true;\n\t}\n\n\t/** Notifies the target node that the MPAN state is out of sync */\n\tpublic async sendMOS(): Promise<boolean> {\n\t\tthis.assertSupportsCommand(\n\t\t\tSecurity2Command,\n\t\t\tSecurity2Command.NonceReport,\n\t\t);\n\n\t\tthis.assertPhysicalEndpoint(this.endpoint);\n\n\t\tconst cc = new Security2CCNonceReport({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t\tSOS: false,\n\t\t\tMOS: true,\n\t\t});\n\n\t\ttry {\n\t\t\tawait this.host.sendCommand(cc, {\n\t\t\t\t...this.commandOptions,\n\t\t\t\t// Seems we need these options or some nodes won't accept the nonce\n\t\t\t\ttransmitOptions: TransmitOptions.ACK\n\t\t\t\t\t| TransmitOptions.AutoRoute,\n\t\t\t\t// Only try sending a nonce once\n\t\t\t\tmaxSendAttempts: 1,\n\t\t\t\t// Nonce requests must be handled immediately\n\t\t\t\tpriority: MessagePriority.Immediate,\n\t\t\t\t// We don't want failures causing us to treat the node as asleep or dead\n\t\t\t\tchangeNodeStatusOnMissingACK: false,\n\t\t\t});\n\t\t} catch (e) {\n\t\t\tif (isTransmissionError(e)) {\n\t\t\t\treturn false;\n\t\t\t} else {\n\t\t\t\t// Pass other errors through\n\t\t\t\tthrow e;\n\t\t\t}\n\t\t}\n\t\treturn true;\n\t}\n\n\t/** Sends the given MPAN to the node */\n\tpublic async sendMPAN(\n\t\tgroupId: number,\n\t\tinnerMPANState: BytesView,\n\t): Promise<boolean> {\n\t\tthis.assertSupportsCommand(\n\t\t\tSecurity2Command,\n\t\t\tSecurity2Command.MessageEncapsulation,\n\t\t);\n\n\t\tthis.assertPhysicalEndpoint(this.endpoint);\n\n\t\tconst cc = new Security2CCMessageEncapsulation({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t\textensions: [\n\t\t\t\tnew MPANExtension({\n\t\t\t\t\tgroupId,\n\t\t\t\t\tinnerMPANState,\n\t\t\t\t}),\n\t\t\t],\n\t\t});\n\n\t\ttry {\n\t\t\tawait this.host.sendCommand(cc, {\n\t\t\t\t...this.commandOptions,\n\t\t\t\t// Seems we need these options or some nodes won't accept the nonce\n\t\t\t\ttransmitOptions: TransmitOptions.ACK\n\t\t\t\t\t| TransmitOptions.AutoRoute,\n\t\t\t\t// Only try sending a nonce once\n\t\t\t\tmaxSendAttempts: 1,\n\t\t\t\t// Nonce requests must be handled immediately\n\t\t\t\tpriority: MessagePriority.Immediate,\n\t\t\t\t// We don't want failures causing us to treat the node as asleep or dead\n\t\t\t\tchangeNodeStatusOnMissingACK: false,\n\t\t\t});\n\t\t} catch (e) {\n\t\t\tif (isTransmissionError(e)) {\n\t\t\t\treturn false;\n\t\t\t} else {\n\t\t\t\t// Pass other errors through\n\t\t\t\tthrow e;\n\t\t\t}\n\t\t}\n\t\treturn true;\n\t}\n\n\t/**\n\t * Queries the securely supported commands for the current security class\n\t * @param securityClass Can be used to overwrite the security class to use. If this doesn't match the current one, new nonces will need to be exchanged.\n\t */\n\tpublic async getSupportedCommands(\n\t\tsecurityClass:\n\t\t\t| SecurityClass.S2_AccessControl\n\t\t\t| SecurityClass.S2_Authenticated\n\t\t\t| SecurityClass.S2_Unauthenticated,\n\t): Promise<MaybeNotKnown<CommandClasses[]>> {\n\t\tthis.assertSupportsCommand(\n\t\t\tSecurity2Command,\n\t\t\tSecurity2Command.CommandsSupportedGet,\n\t\t);\n\n\t\tlet cc: CommandClass = new Security2CCCommandsSupportedGet({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t});\n\t\t// Security2CCCommandsSupportedGet is special because we cannot reply on the applHost to do the automatic\n\t\t// encapsulation because it would use a different security class. Therefore the entire possible stack\n\t\t// of encapsulation needs to be done here\n\t\tif (MultiChannelCC.requiresEncapsulation(cc)) {\n\t\t\tconst multiChannelCCVersion = this.host.getSupportedCCVersion(\n\t\t\t\tCommandClasses[\"Multi Channel\"],\n\t\t\t\tthis.endpoint.nodeId as number,\n\t\t\t);\n\n\t\t\tcc = multiChannelCCVersion === 1\n\t\t\t\t? MultiChannelCC.encapsulateV1(cc)\n\t\t\t\t: MultiChannelCC.encapsulate(cc);\n\t\t}\n\t\tcc = Security2CC.encapsulate(\n\t\t\tcc,\n\t\t\tthis.host.ownNodeId,\n\t\t\tthis.host,\n\t\t\t{ securityClass },\n\t\t);\n\n\t\tconst response = await this.host.sendCommand<\n\t\t\tSecurity2CCCommandsSupportedReport\n\t\t>(\n\t\t\tcc,\n\t\t\t{\n\t\t\t\t...this.commandOptions,\n\t\t\t\tautoEncapsulate: false,\n\t\t\t},\n\t\t);\n\t\treturn response?.supportedCCs;\n\t}\n\n\tpublic async reportSupportedCommands(\n\t\tsupportedCCs: CommandClasses[],\n\t): Promise<void> {\n\t\tthis.assertSupportsCommand(\n\t\t\tSecurity2Command,\n\t\t\tSecurity2Command.CommandsSupportedReport,\n\t\t);\n\n\t\tconst cc = new Security2CCCommandsSupportedReport({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t\tsupportedCCs,\n\t\t});\n\t\tawait this.host.sendCommand(cc, this.commandOptions);\n\t}\n\n\t// oxlint-disable-next-line typescript/explicit-module-boundary-types\n\tpublic async getKeyExchangeParameters() {\n\t\tthis.assertSupportsCommand(Security2Command, Security2Command.KEXGet);\n\n\t\tconst cc = new Security2CCKEXGet({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t});\n\t\tconst response = await this.host.sendCommand<Security2CCKEXReport>(\n\t\t\tcc,\n\t\t\tthis.commandOptions,\n\t\t);\n\t\tif (response) {\n\t\t\treturn pick(response, [\n\t\t\t\t\"requestCSA\",\n\t\t\t\t\"echo\",\n\t\t\t\t\"supportedKEXSchemes\",\n\t\t\t\t\"supportedECDHProfiles\",\n\t\t\t\t\"requestedKeys\",\n\t\t\t\t\"_reserved\",\n\t\t\t]);\n\t\t}\n\t}\n\n\t/** Requests the given keys from an including node */\n\tpublic async requestKeys(\n\t\tparams: Omit<Security2CCKEXReportOptions, \"echo\">,\n\t): Promise<void> {\n\t\tthis.assertSupportsCommand(\n\t\t\tSecurity2Command,\n\t\t\tSecurity2Command.KEXReport,\n\t\t);\n\n\t\tconst cc = new Security2CCKEXReport({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t\t...params,\n\t\t\techo: false,\n\t\t});\n\t\tawait this.host.sendCommand(cc, this.commandOptions);\n\t}\n\n\t/** Grants the joining node the given keys */\n\tpublic async grantKeys(\n\t\tparams: Omit<Security2CCKEXSetOptions, \"echo\">,\n\t): Promise<void> {\n\t\tthis.assertSupportsCommand(Security2Command, Security2Command.KEXSet);\n\n\t\tconst cc = new Security2CCKEXSet({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t\t...params,\n\t\t\techo: false,\n\t\t});\n\t\tawait this.host.sendCommand(cc, this.commandOptions);\n\t}\n\n\t/** Confirms the keys that were requested by a node */\n\tpublic async confirmRequestedKeys(\n\t\tparams: Omit<Security2CCKEXReportOptions, \"echo\">,\n\t): Promise<void> {\n\t\tthis.assertSupportsCommand(\n\t\t\tSecurity2Command,\n\t\t\tSecurity2Command.KEXReport,\n\t\t);\n\n\t\tconst cc = new Security2CCKEXReport({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t\t...params,\n\t\t\techo: true,\n\t\t});\n\t\tawait this.host.sendCommand(cc, this.commandOptions);\n\t}\n\n\t/** Confirms the keys that were granted by the including node */\n\tpublic async confirmGrantedKeys(\n\t\tparams: Omit<Security2CCKEXSetOptions, \"echo\">,\n\t): Promise<Security2CCKEXReport | Security2CCKEXFail | undefined> {\n\t\tthis.assertSupportsCommand(\n\t\t\tSecurity2Command,\n\t\t\tSecurity2Command.KEXSet,\n\t\t);\n\n\t\tconst cc = new Security2CCKEXSet({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t\t...params,\n\t\t\techo: true,\n\t\t});\n\t\treturn this.host.sendCommand(cc, this.commandOptions);\n\t}\n\n\t/** Notifies the other node that the ongoing key exchange was aborted */\n\tpublic async abortKeyExchange(failType: KEXFailType): Promise<void> {\n\t\tthis.assertSupportsCommand(Security2Command, Security2Command.KEXFail);\n\n\t\tconst cc = new Security2CCKEXFail({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t\tfailType,\n\t\t});\n\t\tawait this.host.sendCommand(cc, this.commandOptions);\n\t}\n\n\tpublic async sendPublicKey(\n\t\tpublicKey: BytesView,\n\t\tincludingNode: boolean = true,\n\t): Promise<void> {\n\t\tthis.assertSupportsCommand(\n\t\t\tSecurity2Command,\n\t\t\tSecurity2Command.PublicKeyReport,\n\t\t);\n\n\t\tconst cc = new Security2CCPublicKeyReport({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t\tincludingNode,\n\t\t\tpublicKey,\n\t\t});\n\t\tawait this.host.sendCommand(cc, this.commandOptions);\n\t}\n\n\tpublic async requestNetworkKey(\n\t\tsecurityClass: SecurityClass,\n\t): Promise<void> {\n\t\tthis.assertSupportsCommand(\n\t\t\tSecurity2Command,\n\t\t\tSecurity2Command.NetworkKeyGet,\n\t\t);\n\n\t\tconst cc = new Security2CCNetworkKeyGet({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t\trequestedKey: securityClass,\n\t\t});\n\t\tawait this.host.sendCommand(cc, this.commandOptions);\n\t}\n\n\tpublic async sendNetworkKey(\n\t\tsecurityClass: SecurityClass,\n\t\tnetworkKey: BytesView,\n\t): Promise<void> {\n\t\tthis.assertSupportsCommand(\n\t\t\tSecurity2Command,\n\t\t\tSecurity2Command.NetworkKeyReport,\n\t\t);\n\n\t\tconst cc = new Security2CCNetworkKeyReport({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t\tgrantedKey: securityClass,\n\t\t\tnetworkKey,\n\t\t});\n\t\tawait this.host.sendCommand(cc, this.commandOptions);\n\t}\n\n\tpublic async verifyNetworkKey(): Promise<void> {\n\t\tthis.assertSupportsCommand(\n\t\t\tSecurity2Command,\n\t\t\tSecurity2Command.NetworkKeyVerify,\n\t\t);\n\n\t\tconst cc = new Security2CCNetworkKeyVerify({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t});\n\t\tawait this.host.sendCommand(cc, this.commandOptions);\n\t}\n\n\tpublic async confirmKeyVerification(): Promise<void> {\n\t\tthis.assertSupportsCommand(\n\t\t\tSecurity2Command,\n\t\t\tSecurity2Command.TransferEnd,\n\t\t);\n\n\t\tconst cc = new Security2CCTransferEnd({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t\tkeyVerified: true,\n\t\t\tkeyRequestComplete: false,\n\t\t});\n\t\tawait this.host.sendCommand(cc, {\n\t\t\t...this.commandOptions,\n\t\t\t// Don't wait for an ACK from the node\n\t\t\ttransmitOptions: TransmitOptions.DEFAULT & ~TransmitOptions.ACK,\n\t\t});\n\t}\n\n\tpublic async endKeyExchange(): Promise<void> {\n\t\tthis.assertSupportsCommand(\n\t\t\tSecurity2Command,\n\t\t\tSecurity2Command.TransferEnd,\n\t\t);\n\n\t\tconst cc = new Security2CCTransferEnd({\n\t\t\tnodeId: this.endpoint.nodeId,\n\t\t\tendpointIndex: this.endpoint.index,\n\t\t\tkeyVerified: false,\n\t\t\tkeyRequestComplete: true,\n\t\t});\n\t\tawait this.host.sendCommand(cc, this.commandOptions);\n\t}\n}\n\n@commandClass(CommandClasses[\"Security 2\"])\n@implementedVersion(1)\nexport class Security2CC extends CommandClass {\n\tdeclare ccCommand: Security2Command;\n\n\tpublic async interview(\n\t\tctx: InterviewContext,\n\t): Promise<void> {\n\t\tconst securityManager = getSecurityManager(\n\t\t\tctx.ownNodeId,\n\t\t\tctx,\n\t\t\tthis.nodeId,\n\t\t);\n\n\t\tconst node = this.getNode(ctx)!;\n\t\tconst endpoint = this.getEndpoint(ctx)!;\n\t\tconst api = CCAPI.create(\n\t\t\tCommandClasses[\"Security 2\"],\n\t\t\tctx,\n\t\t\tendpoint,\n\t\t).withOptions({\n\t\t\tpriority: MessagePriority.NodeQuery,\n\t\t});\n\t\t// Only on the highest security class the response includes the supported commands\n\t\tconst secClass = node.getHighestSecurityClass();\n\t\tlet hasReceivedSecureCommands = false;\n\n\t\tlet possibleSecurityClasses: S2SecurityClass[];\n\t\tif (securityClassIsS2(secClass)) {\n\t\t\t// The highest security class is known to be S2, only query that one\n\t\t\tpossibleSecurityClasses = [secClass];\n\t\t} else if (endpoint.index === 0) {\n\t\t\t// If the highest security class isn't known, query all possible security classes\n\t\t\t// but only on the root device\n\t\t\tpossibleSecurityClasses = [\n\t\t\t\tSecurityClass.S2_Unauthenticated,\n\t\t\t\tSecurityClass.S2_Authenticated,\n\t\t\t\tSecurityClass.S2_AccessControl,\n\t\t\t];\n\t\t} else {\n\t\t\t// For endpoint interviews, the security class MUST be known\n\t\t\tctx.logNode(node.id, {\n\t\t\t\tendpoint: endpoint.index,\n\t\t\t\tmessage:\n\t\t\t\t\t`Cannot query securely supported commands for endpoint because the node's security class isn't known...`,\n\t\t\t\tlevel: \"error\",\n\t\t\t});\n\t\t\treturn;\n\t\t}\n\n\t\tfor (const secClass of possibleSecurityClasses) {\n\t\t\t// We might not know all assigned security classes yet, so we work our way up from low to high and try to request the supported commands.\n\t\t\t// This way, each command is encrypted with the security class we're currently testing.\n\n\t\t\t// If the node does not respond, it wasn't assigned the security class.\n\t\t\t// If it responds with a non-empty list, we know this is the highest class it supports.\n\t\t\t// If the list is empty, the security class is still supported.\n\n\t\t\t// If we already know the class is not supported, skip it\n\t\t\tif (node.hasSecurityClass(secClass) === false) continue;\n\n\t\t\t// If no key is configured for this security class, skip it\n\t\t\tif (\n\t\t\t\t!securityManager?.hasKeysForSecurityClass(secClass)\n\t\t\t) {\n\t\t\t\tctx.logNode(node.id, {\n\t\t\t\t\tendpoint: endpoint.index,\n\t\t\t\t\tmessage: `Cannot query securely supported commands (${\n\t\t\t\t\t\tgetEnumMemberName(\n\t\t\t\t\t\t\tSecurityClass,\n\t\t\t\t\t\t\tsecClass,\n\t\t\t\t\t\t)\n\t\t\t\t\t}) - network key is not configured...`,\n\t\t\t\t\tlevel: \"warn\",\n\t\t\t\t});\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\tctx.logNode(node.id, {\n\t\t\t\tendpoint: endpoint.index,\n\t\t\t\tmessage: `Querying securely supported commands (${\n\t\t\t\t\tgetEnumMemberName(\n\t\t\t\t\t\tSecurityClass,\n\t\t\t\t\t\tsecClass,\n\t\t\t\t\t)\n\t\t\t\t})...`,\n\t\t\t\tdirection: \"outbound\",\n\t\t\t});\n\n\t\t\t// Query the supported commands but avoid remembering the wrong security class in case of a failure\n\t\t\tlet supportedCCs: CommandClasses[] | undefined;\n\t\t\t// Try up to 3 times on the root device. We REALLY don't want a spurious timeout or collision to cause us to discard a known good security class\n\t\t\tconst MAX_ATTEMPTS = this.endpointIndex === 0 ? 3 : 1;\n\t\t\tfor (let attempts = 1; attempts <= MAX_ATTEMPTS; attempts++) {\n\t\t\t\ttry {\n\t\t\t\t\tsupportedCCs = await api.getSupportedCommands(secClass);\n\t\t\t\t} catch (e) {\n\t\t\t\t\tif (\n\t\t\t\t\t\tisZWaveError(e)\n\t\t\t\t\t\t&& e.code === ZWaveErrorCodes.Security2CC_CannotDecode\n\t\t\t\t\t) {\n\t\t\t\t\t\t// Either we were using a non-granted security class,\n\t\t\t\t\t\t// or querying with the known highest security class had an issue\n\t\t\t\t\t\tsupportedCCs = undefined;\n\t\t\t\t\t} else {\n\t\t\t\t\t\tthrow e;\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tif (\n\t\t\t\t\tsupportedCCs == undefined\n\t\t\t\t\t&& possibleSecurityClasses.length === 1\n\t\t\t\t) {\n\t\t\t\t\tif (attempts < MAX_ATTEMPTS) {\n\t\t\t\t\t\t// We definitely know the highest security class\n\t\t\t\t\t\tctx.logNode(node.id, {\n\t\t\t\t\t\t\tendpoint: endpoint.index,\n\t\t\t\t\t\t\tmessage: `Querying securely supported commands (${\n\t\t\t\t\t\t\t\tgetEnumMemberName(\n\t\t\t\t\t\t\t\t\tSecurityClass,\n\t\t\t\t\t\t\t\t\tsecClass,\n\t\t\t\t\t\t\t\t)\n\t\t\t\t\t\t\t}), attempt ${attempts}/${MAX_ATTEMPTS} failed. Retrying in 500ms...`,\n\t\t\t\t\t\t\tlevel: \"warn\",\n\t\t\t\t\t\t});\n\t\t\t\t\t\tawait wait(500);\n\t\t\t\t\t\tcontinue;\n\t\t\t\t\t} else if (endpoint.index > 0) {\n\t\t\t\t\t\tctx.logNode(node.id, {\n\t\t\t\t\t\t\tendpoint: endpoint.index,\n\t\t\t\t\t\t\tmessage: `Querying securely supported commands (${\n\t\t\t\t\t\t\t\tgetEnumMemberName(\n\t\t\t\t\t\t\t\t\tSecurityClass,\n\t\t\t\t\t\t\t\t\tsecClass,\n\t\t\t\t\t\t\t\t)\n\t\t\t\t\t\t\t}) failed. Assuming the endpoint supports all its mandatory CCs securely...`,\n\t\t\t\t\t\t\tlevel: \"warn\",\n\t\t\t\t\t\t});\n\n\t\t\t\t\t\t// Just mark all endpoint CCs as secure. Without this we would attempt\n\t\t\t\t\t\t// unencrypted communication with the endpoint, which will likely fail.\n\t\t\t\t\t\tfor (const [ccId] of endpoint.getCCs()) {\n\t\t\t\t\t\t\tendpoint.addCC(ccId, { secure: true });\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\tbreak;\n\t\t\t\t\t} else {\n\t\t\t\t\t\tctx.logNode(node.id, {\n\t\t\t\t\t\t\tendpoint: endpoint.index,\n\t\t\t\t\t\t\tmessage: `Querying securely supported commands (${\n\t\t\t\t\t\t\t\tgetEnumMemberName(\n\t\t\t\t\t\t\t\t\tSecurityClass,\n\t\t\t\t\t\t\t\t\tsecClass,\n\t\t\t\t\t\t\t\t)\n\t\t\t\t\t\t\t}) failed. Let's hope for the best...`,\n\t\t\t\t\t\t\tlevel: \"warn\",\n\t\t\t\t\t\t});\n\t\t\t\t\t\tbreak;\n\t\t\t\t\t}\n\t\t\t\t} else {\n\t\t\t\t\t// In any other case, we can stop trying\n\t\t\t\t\tbreak;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (supportedCCs == undefined) {\n\t\t\t\tif (\n\t\t\t\t\tendpoint.index === 0\n\t\t\t\t\t&& possibleSecurityClasses.length > 1\n\t\t\t\t) {\n\t\t\t\t\t// No supported commands found, mark the security class as not granted\n\t\t\t\t\t// unless we were sure about the security class\n\t\t\t\t\tnode.setSecurityClass(secClass, false);\n\n\t\t\t\t\tctx.logNode(node.id, {\n\t\t\t\t\t\tmessage: `The node was NOT granted the security class ${\n\t\t\t\t\t\t\tgetEnumMemberName(\n\t\t\t\t\t\t\t\tSecurityClass,\n\t\t\t\t\t\t\t\tsecClass,\n\t\t\t\t\t\t\t)\n\t\t\t\t\t\t}`,\n\t\t\t\t\t\tdirection: \"inbound\",\n\t\t\t\t\t});\n\t\t\t\t}\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\tif (endpoint.index === 0 && possibleSecurityClasses.length > 1) {\n\t\t\t\t// Mark the security class as granted unless we were sure about the security class\n\t\t\t\tnode.setSecurityClass(secClass, true);\n\n\t\t\t\tctx.logNode(node.id, {\n\t\t\t\t\tmessage: `The node was granted the security class ${\n\t\t\t\t\t\tgetEnumMemberName(\n\t\t\t\t\t\t\tSecurityClass,\n\t\t\t\t\t\t\tsecClass,\n\t\t\t\t\t\t)\n\t\t\t\t\t}`,\n\t\t\t\t\tdirection: \"inbound\",\n\t\t\t\t});\n\t\t\t}\n\n\t\t\tif (!hasReceivedSecureCommands && supportedCCs.length > 0) {\n\t\t\t\thasReceivedSecureCommands = true;\n\n\t\t\t\tconst logLines: string[] = [\n\t\t\t\t\t`received secure commands (${\n\t\t\t\t\t\tgetEnumMemberName(\n\t\t\t\t\t\t\tSecurityClass,\n\t\t\t\t\t\t\tsecClass,\n\t\t\t\t\t\t)\n\t\t\t\t\t})`,\n\t\t\t\t\t\"supported CCs:\",\n\t\t\t\t];\n\t\t\t\tfor (const cc of supportedCCs) {\n\t\t\t\t\tlogLines.push(`\u00B7 ${getCCName(cc)}`);\n\t\t\t\t}\n\t\t\t\tctx.logNode(node.id, {\n\t\t\t\t\tendpoint: endpoint.index,\n\t\t\t\t\tmessage: logLines.join(\"\\n\"),\n\t\t\t\t\tdirection: \"inbound\",\n\t\t\t\t});\n\n\t\t\t\t// Remember which commands are supported securely\n\t\t\t\tfor (const cc of supportedCCs) {\n\t\t\t\t\t// Basic CC has special rules for when it is considered supported\n\t\t\t\t\t// Therefore we mark all other CCs as supported, but not Basic CC,\n\t\t\t\t\t// for which support is determined later.\n\t\t\t\t\tif (cc === CommandClasses.Basic) {\n\t\t\t\t\t\tendpoint.addCC(cc, { secure: true });\n\t\t\t\t\t} else {\n\t\t\t\t\t\tendpoint.addCC(cc, {\n\t\t\t\t\t\t\tisSupported: true,\n\t\t\t\t\t\t\tsecure: true,\n\t\t\t\t\t\t});\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\t// Remember that the interview is complete\n\t\tthis.setInterviewComplete(ctx, true);\n\t}\n\n\t/** Tests if a command should be sent secure and thus requires encapsulation */\n\tpublic static requiresEncapsulation(cc: CommandClass): boolean {\n\t\t// No security flag -> no encapsulation\n\t\tif (!(cc.encapsulationFlags & EncapsulationFlags.Security)) {\n\t\t\treturn false;\n\t\t}\n\t\t// S0, CRC16, Transport Service -> no S2 encapsulation\n\t\tif (\n\t\t\tcc instanceof SecurityCC\n\t\t\t|| cc instanceof CRC16CC\n\t\t\t|| cc instanceof TransportServiceCC\n\t\t) {\n\t\t\treturn false;\n\t\t}\n\t\t// S2: check command\n\t\tif (cc instanceof Security2CC) {\n\t\t\t// These S2 commands need additional encapsulation\n\t\t\tswitch (cc.ccCommand) {\n\t\t\t\tcase Security2Command.CommandsSupportedGet:\n\t\t\t\tcase Security2Command.CommandsSupportedReport:\n\t\t\t\tcase Security2Command.NetworkKeyGet:\n\t\t\t\tcase Security2Command.NetworkKeyReport:\n\t\t\t\tcase Security2Command.NetworkKeyVerify:\n\t\t\t\tcase Security2Command.TransferEnd:\n\t\t\t\t\treturn true;\n\n\t\t\t\tcase Security2Command.KEXSet:\n\t\t\t\tcase Security2Command.KEXReport:\n\t\t\t\t\t// KEXSet/Report need to be encrypted for the confirmation only\n\t\t\t\t\treturn (cc as Security2CCKEXSet | Security2CCKEXReport)\n\t\t\t\t\t\t.echo;\n\n\t\t\t\tcase Security2Command.KEXFail: {\n\t\t\t\t\tswitch ((cc as Security2CCKEXFail).failType) {\n\t\t\t\t\t\tcase KEXFailType.Decrypt:\n\t\t\t\t\t\tcase KEXFailType.WrongSecurityLevel:\n\t\t\t\t\t\tcase KEXFailType.KeyNotGranted:\n\t\t\t\t\t\tcase KEXFailType.NoVerify:\n\t\t\t\t\t\t\treturn true;\n\t\t\t\t\t\tdefault:\n\t\t\t\t\t\t\treturn false;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn false;\n\t\t}\n\n\t\t// Everything else needs to be encapsulated if the CC is secure\n\t\treturn true;\n\t}\n\n\t/** Encapsulates a command that should be sent encrypted */\n\tpublic static encapsulate(\n\t\tcc: CommandClass,\n\t\townNodeId: number,\n\t\tsecurityManagers: SecurityManagers,\n\t\toptions?: {\n\t\t\tsecurityClass?: SecurityClass;\n\t\t\tmulticastOutOfSync?: boolean;\n\t\t\tmulticastGroupId?: number;\n\t\t\tverifyDelivery?: boolean;\n\t\t},\n\t): Security2CCMessageEncapsulation {\n\t\t// Determine which extensions must be used on the command\n\t\tconst extensions: Security2Extension[] = [];\n\t\tif (options?.multicastOutOfSync) {\n\t\t\textensions.push(new MOSExtension());\n\t\t}\n\t\tif (options?.multicastGroupId != undefined) {\n\t\t\textensions.push(\n\t\t\t\tnew MGRPExtension({ groupId: options.multicastGroupId }),\n\t\t\t);\n\t\t}\n\n\t\t// Make sure that S2 multicast uses broadcasts. While the specs mention that both multicast and broadcast\n\t\t// are possible, it has been found that devices treat multicasts like singlecast followups and respond incorrectly.\n\t\tlet nodeId: number;\n\t\tif (cc.isMulticast()) {\n\t\t\tif (cc.nodeId.some((nodeId) => isLongRangeNodeId(nodeId))) {\n\t\t\t\tnodeId = NODE_ID_BROADCAST_LR;\n\t\t\t} else {\n\t\t\t\tnodeId = NODE_ID_BROADCAST;\n\t\t\t}\n\t\t} else {\n\t\t\tnodeId = cc.nodeId as number;\n\t\t}\n\n\t\tconst ret = new Security2CCMessageEncapsulation({\n\t\t\tnodeId,\n\t\t\tencapsulated: cc,\n\t\t\tsecurityClass: options?.securityClass,\n\t\t\textensions,\n\t\t\tverifyDelivery: options?.verifyDelivery,\n\t\t});\n\n\t\t// Copy the encapsulation flags from the encapsulated command\n\t\t// but omit Security, since we're doing that right now\n\t\tret.encapsulationFlags = cc.encapsulationFlags\n\t\t\t& ~EncapsulationFlags.Security;\n\n\t\treturn ret;\n\t}\n}\n\nfunction failNoSPAN(): never {\n\tvalidatePayload.fail(ZWaveErrorCodes.Security2CC_NoSPAN);\n}\n\nfunction failNoMPAN(): never {\n\tvalidatePayload.fail(ZWaveErrorCodes.Security2CC_NoMPAN);\n}\n\n// @publicAPI\nexport type MulticastContext =\n\t| {\n\t\tisMulticast: true;\n\t\tgroupId: number;\n\t}\n\t| {\n\t\tisMulticast: false;\n\t\tgroupId?: number;\n\t};\n\n// @publicAPI\nexport interface Security2CCMessageEncapsulationOptions {\n\tsequenceNumber?: number;\n\t/** Can be used to override the default security class for the command */\n\tsecurityClass?: SecurityClass;\n\textensions?: Security2Extension[];\n\tencapsulated?: CommandClass;\n\tverifyDelivery?: boolean;\n}\n\n// An S2 encapsulated command may result in a NonceReport to be sent by the node if it couldn't decrypt the message\nfunction getCCResponseForMessageEncapsulation(\n\tctx: GetNode<NodeId & SupportsCC>,\n\tsent: Security2CCMessageEncapsulation,\n) {\n\tif (sent.encapsulated?.expectsCCResponse(ctx)) {\n\t\tconst ret = [\n\t\t\tSecurity2CCMessageEncapsulation as any,\n\t\t\tSecurity2CCNonceReport as any,\n\t\t];\n\n\t\tif (\n\t\t\tsent.encapsulated instanceof Security2CCKEXSet\n\t\t\t|| sent.encapsulated instanceof Security2CCKEXReport\n\t\t\t|| sent.encapsulated instanceof Security2CCNetworkKeyGet\n\t\t\t|| sent.encapsulated instanceof Security2CCNetworkKeyReport\n\t\t\t|| sent.encapsulated instanceof Security2CCNetworkKeyVerify\n\t\t) {\n\t\t\tret.push(Security2CCKEXFail as any);\n\t\t}\n\n\t\treturn ret;\n\t}\n}\n\nfunction testCCResponseForMessageEncapsulation(\n\tsent: Security2CCMessageEncapsulation,\n\treceived:\n\t\t| Security2CCMessageEncapsulation\n\t\t| Security2CCNonceReport\n\t\t| Security2CCKEXFail,\n) {\n\tif (received instanceof Security2CCMessageEncapsulation) {\n\t\treturn \"checkEncapsulated\";\n\t} else if (received instanceof Security2CCKEXFail) {\n\t\treturn true;\n\t} else {\n\t\treturn received.SOS && !!received.receiverEI;\n\t}\n}\n\n@CCCommand(Security2Command.MessageEncapsulation)\n@expectedCCResponse(\n\tgetCCResponseForMessageEncapsulation,\n\ttestCCResponseForMessageEncapsulation,\n)\nexport class Security2CCMessageEncapsulation extends Security2CC {\n\tpublic constructor(\n\t\toptions: WithAddress<Security2CCMessageEncapsulationOptions>,\n\t) {\n\t\tsuper(options);\n\n\t\tif (!options.encapsulated && !options.extensions?.length) {\n\t\t\tthrow new ZWaveError(\n\t\t\t\t\"Security S2 encapsulation requires an encapsulated CC and/or extensions\",\n\t\t\t\tZWaveErrorCodes.Argument_Invalid,\n\t\t\t);\n\t\t}\n\n\t\tthis.sequenceNumber = options.sequenceNumber;\n\n\t\tthis.securityClass = options.securityClass;\n\t\tif (options.encapsulated) {\n\t\t\tthis.encapsulated = options.encapsulated;\n\t\t\toptions.encapsulated.encapsulatingCC = this as any;\n\t\t}\n\n\t\tthis.verifyDelivery = options.verifyDelivery !== false;\n\n\t\tthis.extensions = options.extensions ?? [];\n\t\tif (\n\t\t\ttypeof this.nodeId !== \"number\"\n\t\t\t&& !this.extensions.some((e) => e instanceof MGRPExtension)\n\t\t) {\n\t\t\tthrow new ZWaveError(\n\t\t\t\t\"Multicast Security S2 encapsulation requires the MGRP extension\",\n\t\t\t\tZWaveErrorCodes.Security2CC_MissingExtension,\n\t\t\t);\n\t\t}\n\t}\n\n\tpublic static async from(\n\t\traw: CCRaw,\n\t\tctx: CCParsingContext,\n\t): Promise<Security2CCMessageEncapsulation> {\n\t\tconst securityManager = assertSecurityRX(ctx);\n\n\t\tvalidatePayload(raw.payload.length >= 2);\n\t\t// Check the sequence number to avoid duplicates\n\t\tconst sequenceNumber: number | undefined = raw.payload[0];\n\n\t\t// Ensure the node has a security class\n\t\tvalidatePayload.withReason(\"No security class granted\")(\n\t\t\tctx.getHighestSecurityClass(\n\t\t\t\tctx.sourceNodeId,\n\t\t\t) !== SecurityClass.None,\n\t\t);\n\n\t\tconst hasExtensions = !!(raw.payload[1] & 0b1);\n\t\tconst hasEncryptedExtensions = !!(raw.payload[1] & 0b10);\n\n\t\tlet offset = 2;\n\t\tconst extensions: Security2Extension[] = [];\n\t\tlet mustDiscardCommand = false;\n\n\t\tif (hasExtensions) {\n\t\t\tconst parseResult = parseExtensions(\n\t\t\t\traw.payload.subarray(offset),\n\t\t\t\tfalse,\n\t\t\t);\n\t\t\textensions.push(...parseResult.extensions);\n\t\t\toffset += parseResult.bytesRead;\n\t\t\tmustDiscardCommand = parseResult.mustDiscardCommand;\n\t\t}\n\n\t\tconst mcctx = ((): MulticastContext => {\n\t\t\tconst multicastGroupId = getMulticastGroupId(extensions);\n\t\t\tif (\n\t\t\t\tctx.frameType === \"multicast\" || ctx.frameType === \"broadcast\"\n\t\t\t) {\n\t\t\t\tif (multicastGroupId == undefined) {\n\t\t\t\t\tvalidatePayload.fail(\n\t\t\t\t\t\t\"Multicast frames without MGRP extension\",\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\treturn {\n\t\t\t\t\tisMulticast: true,\n\t\t\t\t\tgroupId: multicastGroupId,\n\t\t\t\t};\n\t\t\t} else {\n\t\t\t\treturn { isMulticast: false, groupId: multicastGroupId };\n\t\t\t}\n\t\t})();\n\n\t\t// If a command is to be discarded before decryption,\n\t\t// we still need to increment the SPAN or MPAN state\n\t\tif (mustDiscardCommand) {\n\t\t\tif (mcctx.isMulticast) {\n\t\t\t\tawait securityManager.nextPeerMPAN(\n\t\t\t\t\tctx.sourceNodeId,\n\t\t\t\t\tmcctx.groupId,\n\t\t\t\t);\n\t\t\t} else {\n\t\t\t\tawait securityManager.nextNonce(ctx.sourceNodeId);\n\t\t\t}\n\t\t\tvalidatePayload.fail(\n\t\t\t\t\"Invalid S2 extension\",\n\t\t\t);\n\t\t}\n\n\t\tlet prevSequenceNumber: number | undefined;\n\t\tlet mpanState:\n\t\t\t| ReturnType<SecurityManager2[\"getPeerMPAN\"]>\n\t\t\t| undefined;\n\t\tif (mcctx.isMulticast) {\n\t\t\tmpanState = securityManager.getPeerMPAN(\n\t\t\t\tctx.sourceNodeId,\n\t\t\t\tmcctx.groupId,\n\t\t\t);\n\t\t} else {\n\t\t\t// Don't accept duplicate Singlecast commands\n\t\t\tprevSequenceNumber = validateSequenceNumber(\n\t\t\t\tsecurityManager,\n\t\t\t\tctx.sourceNodeId,\n\t\t\t\tsequenceNumber,\n\t\t\t);\n\n\t\t\t// When a node receives a singlecast message after a multicast group was marked out of sync,\n\t\t\t// it must forget about the group.\n\t\t\tif (mcctx.groupId == undefined) {\n\t\t\t\tsecurityManager.resetOutOfSyncMPANs(\n\t\t\t\t\tctx.sourceNodeId,\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\n\t\tconst unencryptedPayload = raw.payload.subarray(0, offset);\n\t\tconst ciphertext = raw.payload.subarray(\n\t\t\toffset,\n\t\t\t-SECURITY_S2_AUTH_TAG_LENGTH,\n\t\t);\n\t\tconst authTag = raw.payload.subarray(-SECURITY_S2_AUTH_TAG_LENGTH);\n\t\tconst messageLength =\n\t\t\t2 /* CommandClass.computeEncapsulationOverhead() */\n\t\t\t+ raw.payload.length;\n\n\t\tconst authData = getAuthenticationData(\n\t\t\tctx.sourceNodeId,\n\t\t\tgetDestinationIDRX(ctx, extensions),\n\t\t\tctx.homeId,\n\t\t\tmessageLength,\n\t\t\tunencryptedPayload,\n\t\t);\n\n\t\tlet decrypt: () => Promise<DecryptionResult>;\n\t\tif (mcctx.isMulticast) {\n\t\t\t// For incoming multicast commands, make sure we have an MPAN\n\t\t\tif (mpanState?.type !== MPANState.MPAN) {\n\t\t\t\t// If we don't, mark the MPAN as out of sync, so we can respond accordingly on the singlecast followup\n\t\t\t\tsecurityManager.storePeerMPAN(\n\t\t\t\t\tctx.sourceNodeId,\n\t\t\t\t\tmcctx.groupId,\n\t\t\t\t\t{ type: MPANState.OutOfSync },\n\t\t\t\t);\n\t\t\t\tfailNoMPAN();\n\t\t\t}\n\n\t\t\tdecrypt = () =>\n\t\t\t\tdecryptMulticast(\n\t\t\t\t\tctx.sourceNodeId,\n\t\t\t\t\tsecurityManager,\n\t\t\t\t\tmcctx.groupId,\n\t\t\t\t\tciphertext,\n\t\t\t\t\tauthData,\n\t\t\t\t\tauthTag,\n\t\t\t\t);\n\t\t} else {\n\t\t\t// Decrypt payload and verify integrity\n\t\t\tconst spanState = securityManager.getSPANState(\n\t\t\t\tctx.sourceNodeId,\n\t\t\t);\n\n\t\t\t// If we are not able to establish an SPAN yet, fail the decryption\n\t\t\tif (spanState.type === SPANState.None) {\n\t\t\t\tfailNoSPAN();\n\t\t\t} else if (spanState.type === SPANState.RemoteEI) {\n\t\t\t\t// TODO: The specs are not clear how to handle this case\n\t\t\t\t// For now, do the same as if we didn't have any EI\n\t\t\t\tfailNoSPAN();\n\t\t\t}\n\n\t\t\tdecrypt = () =>\n\t\t\t\tdecryptSinglecast(\n\t\t\t\t\tctx,\n\t\t\t\t\tsecurityManager,\n\t\t\t\t\tctx.sourceNodeId,\n\t\t\t\t\tsequenceNumber,\n\t\t\t\t\tprevSequenceNumber!,\n\t\t\t\t\tciphertext,\n\t\t\t\t\tauthData,\n\t\t\t\t\tauthTag,\n\t\t\t\t\tspanState,\n\t\t\t\t\textensions,\n\t\t\t\t);\n\t\t}\n\n\t\tlet plaintext: BytesView | undefined;\n\t\tlet authOK = false;\n\t\tlet key: BytesView | undefined;\n\t\tlet iv: BytesView | undefined;\n\t\tlet decryptionSecurityClass: SecurityClass | undefined;\n\n\t\t// If the Receiver is unable to authenticate the singlecast message with the current SPAN,\n\t\t// the Receiver SHOULD try decrypting the message with one or more of the following SPAN values,\n\t\t// stopping when decryption is successful or the maximum number of iterations is reached.\n\n\t\t// If the Receiver is unable to decrypt the S2 MC frame with the current MPAN, the Receiver MAY try\n\t\t// decrypting the frame with one or more of the subsequent MPAN values, stopping when decryption is\n\t\t// successful or the maximum number of iterations is reached.\n\t\tconst decryptAttempts = mcctx.isMulticast\n\t\t\t? MAX_DECRYPT_ATTEMPTS_MULTICAST\n\t\t\t: mcctx.groupId != undefined\n\t\t\t? MAX_DECRYPT_ATTEMPTS_SC_FOLLOWUP\n\t\t\t: MAX_DECRYPT_ATTEMPTS_SINGLECAST;\n\n\t\tfor (let i = 0; i < decryptAttempts; i++) {\n\t\t\t({\n\t\t\t\tplaintext,\n\t\t\t\tauthOK,\n\t\t\t\tkey,\n\t\t\t\tiv,\n\t\t\t\tsecurityClass: decryptionSecurityClass,\n\t\t\t} = await decrypt());\n\t\t\tif (!!authOK && !!plaintext) break;\n\t\t\t// No need to try further SPANs if we just got the sender's EI\n\t\t\tif (!!getSenderEI(extensions)) break;\n\t\t}\n\n\t\t// If authentication fails, do so with an error code that instructs the\n\t\t// applHost to tell the node we have no nonce\n\t\tif (!authOK || !plaintext) {\n\t\t\tif (mcctx.isMulticast) {\n\t\t\t\t// Mark the MPAN as out of sync\n\t\t\t\tsecurityManager.storePeerMPAN(\n\t\t\t\t\tctx.sourceNodeId,\n\t\t\t\t\tmcctx.groupId,\n\t\t\t\t\t{ type: MPANState.OutOfSync },\n\t\t\t\t);\n\t\t\t\tvalidatePayload.fail(\n\t\t\t\t\tZWaveErrorCodes.Security2CC_CannotDecodeMulticast,\n\t\t\t\t);\n\t\t\t} else {\n\t\t\t\tvalidatePayload.fail(\n\t\t\t\t\tZWaveErrorCodes.Security2CC_CannotDecode,\n\t\t\t\t);\n\t\t\t}\n\t\t} else if (!mcctx.isMulticast && mcctx.groupId != undefined) {\n\t\t\t// After reception of a singlecast followup, the MPAN state must be increased\n\t\t\tsecurityManager.tryIncrementPeerMPAN(\n\t\t\t\tctx.sourceNodeId,\n\t\t\t\tmcctx.groupId,\n\t\t\t);\n\t\t}\n\n\t\t// Remember which security class was used to decrypt this message, so we can discard it later\n\t\tconst securityClass: SecurityClass | undefined =\n\t\t\tdecryptionSecurityClass;\n\n\t\toffset = 0;\n\t\tif (hasEncryptedExtensions) {\n\t\t\tconst parseResult = parseExtensions(plaintext, true);\n\t\t\textensions.push(...parseResult.extensions);\n\t\t\toffset += parseResult.bytesRead;\n\t\t\tmustDiscardCommand = parseResult.mustDiscardCommand;\n\t\t}\n\n\t\t// Before we can continue, check if the command must be discarded\n\t\tif (mustDiscardCommand) {\n\t\t\tvalidatePayload.fail(\"Invalid extension\");\n\t\t}\n\n\t\t// The MPAN and MGRP extensions must not be sent together\n\t\tconst mpanExtension = extensions.find((e) =>\n\t\t\te instanceof MPANExtension\n\t\t);\n\t\tif (mcctx.groupId != undefined && mpanExtension) {\n\t\t\tvalidatePayload.fail(\"Invalid combination of extensions\");\n\t\t}\n\n\t\t// If the MPAN extension was received, store the MPAN\n\t\tif (!mcctx.isMulticast) {\n\t\t\tconst mpanExtension = extensions.find((e) =>\n\t\t\t\te instanceof MPANExtension\n\t\t\t);\n\t\t\tif (mpanExtension) {\n\t\t\t\tsecurityManager.storePeerMPAN(\n\t\t\t\t\tctx.sourceNodeId,\n\t\t\t\t\tmpanExtension.groupId,\n\t\t\t\t\t{\n\t\t\t\t\t\ttype: MPANState.MPAN,\n\t\t\t\t\t\tcurrentMPAN: mpanExtension.innerMPANState,\n\t\t\t\t\t},\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\n\t\t// Not every S2 message includes an encapsulated CC\n\t\tconst decryptedCCBytes = plaintext.subarray(offset);\n\t\tlet encapsulated: CommandClass | undefined;\n\t\tif (decryptedCCBytes.length > 0) {\n\t\t\t// make sure this contains a complete CC command that's worth splitting\n\t\t\tvalidatePayload(decryptedCCBytes.length >= 2);\n\t\t\t// and deserialize the CC\n\t\t\tencapsulated = await CommandClass.parse(decryptedCCBytes, ctx);\n\t\t}\n\n\t\tconst ret = new Security2CCMessageEncapsulation({\n\t\t\tnodeId: ctx.sourceNodeId,\n\t\t\tsequenceNumber,\n\t\t\tsecurityClass,\n\t\t\textensions,\n\t\t\tencapsulated,\n\t\t});\n\n\t\t// Remember for debugging purposes\n\t\tret.key = key;\n\t\tret.iv = iv;\n\t\tret.authData = authData;\n\t\tret.authTag = authTag;\n\t\tret.plaintext = decryptedCCBytes;\n\n\t\treturn ret;\n\t}\n\n\tpublic readonly securityClass?: SecurityClass;\n\n\t// Only used for testing/debugging purposes\n\tprivate key?: BytesView;\n\tprivate iv?: BytesView;\n\tprivate authData?: BytesView;\n\tprivate authTag?: BytesView;\n\tprivate ciphertext?: BytesView;\n\tprivate plaintext?: BytesView;\n\n\tpublic readonly verifyDelivery: boolean = true;\n\n\tpublic sequenceNumber: number | undefined;\n\tprivate ensureSequenceNumber(\n\t\tsecurityManager: SecurityManager2,\n\t): asserts this is this & {\n\t\tsequenceNumber: number;\n\t} {\n\t\tif (this.sequenceNumber == undefined) {\n\t\t\tif (this.isSinglecast()) {\n\t\t\t\tthis.sequenceNumber = securityManager.nextSequenceNumber(\n\t\t\t\t\tthis.nodeId,\n\t\t\t\t);\n\t\t\t} else {\n\t\t\t\tconst groupId = getDestinationIDTX.call(this);\n\t\t\t\tthis.sequenceNumber = securityManager\n\t\t\t\t\t.nextMulticastSequenceNumber(\n\t\t\t\t\t\tgroupId,\n\t\t\t\t\t);\n\t\t\t}\n\t\t}\n\t}\n\n\tpublic encapsulated?: CommandClass;\n\tpublic extensions: Security2Extension[];\n\n\tpublic override prepareRetransmission(): void {\n\t\tsuper.prepareRetransmission();\n\t\tthis.sequenceNumber = undefined;\n\t}\n\n\tpublic hasMOSExtension(): boolean {\n\t\treturn this.extensions.some((e) => e instanceof MOSExtension);\n\t}\n\n\t/** Returns the Sender's Entropy Input if this command contains an SPAN extension */\n\tpublic getSenderEI(): BytesView | undefined {\n\t\treturn getSenderEI(this.extensions);\n\t}\n\n\t/** Returns the multicast group ID if this command contains an MGRP extension */\n\tpublic getMulticastGroupId(): number | undefined {\n\t\treturn getMulticastGroupId(this.extensions);\n\t}\n\n\tprivate async maybeAddSPANExtension(\n\t\tctx: CCEncodingContext,\n\t\tsecurityManager: SecurityManager2,\n\t): Promise<void> {\n\t\tif (!this.isSinglecast()) return;\n\n\t\tconst receiverNodeId: number = this.nodeId;\n\t\tconst spanState = securityManager.getSPANState(\n\t\t\treceiverNodeId,\n\t\t);\n\n\t\tif (\n\t\t\tspanState.type === SPANState.None\n\t\t\t|| spanState.type === SPANState.LocalEI\n\t\t) {\n\t\t\t// Can't do anything here if we don't have the receiver's EI\n\t\t\tthrow new ZWaveError(\n\t\t\t\t`Security S2 CC requires the receiver's nonce to be sent!`,\n\t\t\t\tZWaveErrorCodes.Security2CC_NoSPAN,\n\t\t\t);\n\t\t} else if (spanState.type === SPANState.RemoteEI) {\n\t\t\t// We have the receiver's EI, generate our input and send it over\n\t\t\t// With both, we can create an SPAN\n\t\t\tconst senderEI = await securityManager.generateNonce(\n\t\t\t\tundefined,\n\t\t\t);\n\t\t\tconst receiverEI = spanState.receiverEI;\n\n\t\t\t// While bootstrapping a node, prefer the temporary key, unless the\n\t\t\t// specific command specifies a security class\n\t\t\tif (\n\t\t\t\tthis.securityClass == undefined\n\t\t\t\t&& securityManager.tempKeys.has(receiverNodeId)\n\t\t\t) {\n\t\t\t\tawait securityManager.initializeTempSPAN(\n\t\t\t\t\treceiverNodeId,\n\t\t\t\t\tsenderEI,\n\t\t\t\t\treceiverEI,\n\t\t\t\t);\n\t\t\t} else {\n\t\t\t\tconst securityClass = this.securityClass\n\t\t\t\t\t?? ctx.getHighestSecurityClass(receiverNodeId);\n\n\t\t\t\tif (securityClass == undefined) {\n\t\t\t\t\tthrow new ZWaveError(\n\t\t\t\t\t\t\"No security class defined for this command!\",\n\t\t\t\t\t\tZWaveErrorCodes.Security2CC_NoSPAN,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tawait securityManager.initializeSPAN(\n\t\t\t\t\treceiverNodeId,\n\t\t\t\t\tsecurityClass,\n\t\t\t\t\tsenderEI,\n\t\t\t\t\treceiverEI,\n\t\t\t\t);\n\t\t\t}\n\n\t\t\t// Add or update the SPAN extension\n\t\t\tlet spanExtension = this.extensions.find(\n\t\t\t\t(e) => e instanceof SPANExtension,\n\t\t\t);\n\t\t\tif (spanExtension) {\n\t\t\t\tspanExtension.senderEI = senderEI;\n\t\t\t} else {\n\t\t\t\tspanExtension = new SPANExtension({ senderEI });\n\t\t\t\tthis.extensions.push(spanExtension);\n\t\t\t}\n\t\t}\n\t}\n\n\tpublic async serialize(ctx: CCEncodingContext): Promise<Bytes> {\n\t\tconst securityManager = assertSecurityTX(ctx, this.nodeId);\n\t\tthis.ensureSequenceNumber(securityManager);\n\n\t\t// Include Sender EI in the command if we only have the receiver's EI\n\t\tawait this.maybeAddSPANExtension(ctx, securityManager);\n\n\t\tconst unencryptedExtensions = this.extensions.filter(\n\t\t\t(e) => !e.isEncrypted(),\n\t\t);\n\t\tconst encryptedExtensions = this.extensions.filter((e) =>\n\t\t\te.isEncrypted()\n\t\t);\n\n\t\tconst unencryptedPayload = Bytes.concat([\n\t\t\t[\n\t\t\t\tthis.sequenceNumber,\n\t\t\t\t(encryptedExtensions.length > 0 ? 0b10 : 0)\n\t\t\t\t| (unencryptedExtensions.length > 0 ? 1 : 0),\n\t\t\t],\n\t\t\t...unencryptedExtensions.map((e, index) =>\n\t\t\t\te.serialize(index < unencryptedExtensions.length - 1)\n\t\t\t),\n\t\t]);\n\t\tconst serializedCC = (await this.encapsulated?.serialize(ctx))\n\t\t\t?? new Bytes();\n\t\tconst plaintextPayload = Bytes.concat([\n\t\t\t...encryptedExtensions.map((e, index) =>\n\t\t\t\te.serialize(index < encryptedExtensions.length - 1)\n\t\t\t),\n\t\t\tserializedCC,\n\t\t]);\n\n\t\t// Generate the authentication data for CCM encryption\n\t\tconst destinationTag = getDestinationIDTX.call(\n\t\t\tthis as Security2CCMessageEncapsulation,\n\t\t);\n\t\tconst messageLength = this.computeEncapsulationOverhead()\n\t\t\t+ serializedCC.length;\n\t\tconst authData = getAuthenticationData(\n\t\t\tctx.ownNodeId,\n\t\t\tdestinationTag,\n\t\t\tctx.homeId,\n\t\t\tmessageLength,\n\t\t\tunencryptedPayload,\n\t\t);\n\n\t\tlet key: BytesView;\n\t\tlet iv: BytesView;\n\n\t\tif (this.isSinglecast()) {\n\t\t\t// Singlecast:\n\t\t\t// Generate a nonce for encryption, and remember it to attempt decryption\n\t\t\t// of potential in-flight messages from the target node.\n\t\t\tiv = await securityManager.nextNonce(this.nodeId, true);\n\t\t\tconst { keyCCM } =\n\t\t\t\t// Prefer the overridden security class if it was given\n\t\t\t\tthis.securityClass != undefined\n\t\t\t\t\t? securityManager.getKeysForSecurityClass(\n\t\t\t\t\t\tthis.securityClass,\n\t\t\t\t\t)\n\t\t\t\t\t: securityManager.getKeysForNode(this.nodeId);\n\t\t\tkey = keyCCM;\n\t\t} else {\n\t\t\t// Multicast:\n\t\t\tconst keyAndIV = await securityManager.getMulticastKeyAndIV(\n\t\t\t\tdestinationTag,\n\t\t\t);\n\t\t\tkey = keyAndIV.key;\n\t\t\tiv = keyAndIV.iv;\n\t\t}\n\n\t\tconst { ciphertext: ciphertextPayload, authTag } =\n\t\t\tawait encryptAES128CCM(\n\t\t\t\tplaintextPayload,\n\t\t\t\tkey,\n\t\t\t\tiv,\n\t\t\t\tauthData,\n\t\t\t\tSECURITY_S2_AUTH_TAG_LENGTH,\n\t\t\t);\n\n\t\t// Remember key and IV for debugging purposes\n\t\tthis.key = key;\n\t\tthis.iv = iv;\n\t\tthis.authData = authData;\n\t\tthis.authTag = authTag;\n\t\tthis.ciphertext = ciphertextPayload;\n\n\t\tthis.payload = Bytes.concat([\n\t\t\tunencryptedPayload,\n\t\t\tciphertextPayload,\n\t\t\tauthTag,\n\t\t]);\n\t\treturn super.serialize(ctx);\n\t}\n\n\tprotected computeEncapsulationOverhead(): number {\n\t\t// Security S2 adds:\n\t\t// * 1 byte sequence number\n\t\t// * 1 byte control\n\t\t// * N bytes extensions\n\t\t// * SECURITY_S2_AUTH_TAG_LENGTH bytes auth tag\n\t\tconst extensionBytes = this.extensions\n\t\t\t.map((e) => e.computeLength())\n\t\t\t.reduce((a, b) => a + b, 0);\n\n\t\treturn (\n\t\t\tsuper.computeEncapsulationOverhead()\n\t\t\t+ 2\n\t\t\t+ SECURITY_S2_AUTH_TAG_LENGTH\n\t\t\t+ extensionBytes\n\t\t);\n\t}\n\n\tpublic toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry {\n\t\tconst message: MessageRecord = {\n\t\t\t\"sequence number\": this.sequenceNumber ?? \"(not set)\",\n\t\t};\n\t\tif (this.extensions.length > 0) {\n\t\t\tmessage.extensions = this.extensions\n\t\t\t\t.map((e) => e.toLogEntry())\n\t\t\t\t.join(\"\");\n\t\t}\n\t\t// Log the used keys in integration tests\n\t\tif (\n\t\t\tprocess.env.NODE_ENV === \"test\"\n\t\t\t|| process.env.NODE_ENV === \"development\"\n\t\t) {\n\t\t\tif (this.key) {\n\t\t\t\tmessage.key = buffer2hex(this.key);\n\t\t\t}\n\t\t\tif (this.iv) {\n\t\t\t\tmessage.IV = buffer2hex(this.iv);\n\t\t\t}\n\t\t\tif (this.ciphertext) {\n\t\t\t\tmessage.ciphertext = buffer2hex(this.ciphertext);\n\t\t\t} else if (this.plaintext) {\n\t\t\t\tmessage.plaintext = buffer2hex(this.plaintext);\n\t\t\t}\n\t\t\tif (this.authData) {\n\t\t\t\tmessage[\"auth data\"] = buffer2hex(this.authData);\n\t\t\t}\n\t\t\tif (this.authTag) {\n\t\t\t\tmessage[\"auth tag\"] = buffer2hex(this.authTag);\n\t\t\t}\n\t\t}\n\n\t\tif (this.securityClass != undefined) {\n\t\t\tmessage[\"security class\"] = getEnumMemberName(\n\t\t\t\tSecurityClass,\n\t\t\t\tthis.securityClass,\n\t\t\t);\n\t\t}\n\n\t\treturn {\n\t\t\t...super.toLogEntry(ctx),\n\t\t\tmessage,\n\t\t};\n\t}\n}\n\n// @publicAPI\nexport type Security2CCNonceReportOptions =\n\t& {\n\t\tsequenceNumber?: number;\n\t}\n\t& (\n\t\t| {\n\t\t\tMOS: boolean;\n\t\t\tSOS: true;\n\t\t\treceiverEI: BytesView;\n\t\t}\n\t\t| {\n\t\t\tMOS: true;\n\t\t\tSOS: false;\n\t\t\treceiverEI?: undefined;\n\t\t}\n\t);\n\n@CCCommand(Security2Command.NonceReport)\nexport class Security2CCNonceReport extends Security2CC {\n\tpublic constructor(\n\t\toptions: WithAddress<Security2CCNonceReportOptions>,\n\t) {\n\t\tsuper(options);\n\n\t\tthis.SOS = options.SOS;\n\t\tthis.MOS = options.MOS;\n\t\tthis.sequenceNumber = options.sequenceNumber;\n\t\tif (options.SOS) this.receiverEI = options.receiverEI;\n\t}\n\n\tpublic static from(\n\t\traw: CCRaw,\n\t\tctx: CCParsingContext,\n\t): Security2CCNonceReport {\n\t\t// Make sure that we can send/receive secure commands\n\t\tconst securityManager = assertSecurityRX(ctx);\n\n\t\tvalidatePayload(raw.payload.length >= 2);\n\t\tconst sequenceNumber = raw.payload[0];\n\n\t\t// Don't accept duplicate commands\n\t\tvalidateSequenceNumber(\n\t\t\tsecurityManager,\n\t\t\tctx.sourceNodeId,\n\t\t\tsequenceNumber,\n\t\t);\n\t\tconst MOS = !!(raw.payload[1] & 0b10);\n\t\tconst SOS = !!(raw.payload[1] & 0b1);\n\n\t\tif (SOS) {\n\t\t\t// If the SOS flag is set, the REI field MUST be included in the command\n\t\t\tvalidatePayload(raw.payload.length >= 18);\n\t\t\tconst receiverEI = raw.payload.subarray(2, 18);\n\n\t\t\t// In that case we also need to store it, so the next sent command\n\t\t\t// can use it for encryption\n\t\t\tsecurityManager.storeRemoteEI(\n\t\t\t\tctx.sourceNodeId,\n\t\t\t\treceiverEI,\n\t\t\t);\n\n\t\t\treturn new this({\n\t\t\t\tnodeId: ctx.sourceNodeId,\n\t\t\t\tsequenceNumber,\n\t\t\t\tMOS,\n\t\t\t\tSOS,\n\t\t\t\treceiverEI,\n\t\t\t});\n\t\t} else if (MOS) {\n\t\t\treturn new this({\n\t\t\t\tnodeId: ctx.sourceNodeId,\n\t\t\t\tsequenceNumber,\n\t\t\t\tMOS,\n\t\t\t\tSOS: false,\n\t\t\t});\n\t\t} else {\n\t\t\tvalidatePayload.fail(\"Either MOS or SOS must be set\");\n\t\t}\n\t}\n\n\tpublic sequenceNumber: number | undefined;\n\tprivate ensureSequenceNumber(\n\t\tsecurityManager: SecurityManager2,\n\t): asserts this is this & {\n\t\tsequenceNumber: number;\n\t} {\n\t\tif (this.sequenceNumber == undefined) {\n\t\t\tthis.sequenceNumber = securityManager.nextSequenceNumber(\n\t\t\t\tthis.nodeId as number,\n\t\t\t);\n\t\t}\n\t}\n\n\tpublic readonly SOS: boolean;\n\tpublic readonly MOS: boolean;\n\tpublic readonly receiverEI?: BytesView;\n\n\tpublic serialize(ctx: CCEncodingContext): Promise<Bytes> {\n\t\tconst securityManager = assertSecurityTX(ctx, this.nodeId);\n\t\tthis.ensureSequenceNumber(securityManager);\n\n\t\tthis.payload = Bytes.from([\n\t\t\tthis.sequenceNumber,\n\t\t\t(this.MOS ? 0b10 : 0) + (this.SOS ? 0b1 : 0),\n\t\t]);\n\t\tif (this.SOS) {\n\t\t\tthis.payload = Bytes.concat([this.payload, this.receiverEI!]);\n\t\t}\n\t\treturn super.serialize(ctx);\n\t}\n\n\tpublic toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry {\n\t\tconst message: MessageRecord = {\n\t\t\t\"sequence number\": this.sequenceNumber ?? \"(not set)\",\n\t\t\tSOS: this.SOS,\n\t\t\tMOS: this.MOS,\n\t\t};\n\t\tif (this.receiverEI) {\n\t\t\tmessage[\"receiver entropy\"] = buffer2hex(this.receiverEI);\n\t\t}\n\t\treturn {\n\t\t\t...super.toLogEntry(ctx),\n\t\t\tmessage,\n\t\t};\n\t}\n}\n\n// @publicAPI\nexport interface Security2CCNonceGetOptions {\n\tsequenceNumber?: number;\n}\n\n@CCCommand(Security2Command.NonceGet)\n@expectedCCResponse(Security2CCNonceReport)\nexport class Security2CCNonceGet extends Security2CC {\n\t// TODO: A node sending this command MUST accept a delay up to <Previous Round-trip-time to peer node> +\n\t// 250 ms before receiving the Security 2 Nonce Report Command.\n\n\tpublic constructor(\n\t\toptions: WithAddress<Security2CCNonceGetOptions>,\n\t) {\n\t\tsuper(options);\n\t\tthis.sequenceNumber = options.sequenceNumber;\n\t}\n\n\tpublic static from(raw: CCRaw, ctx: CCParsingContext): Security2CCNonceGet {\n\t\tconst securityManager = assertSecurityRX(ctx);\n\n\t\tvalidatePayload(raw.payload.length >= 1);\n\t\tconst sequenceNumber = raw.payload[0];\n\n\t\t// Don't accept duplicate commands\n\t\tvalidateSequenceNumber(\n\t\t\tsecurityManager,\n\t\t\tctx.sourceNodeId,\n\t\t\tsequenceNumber,\n\t\t);\n\n\t\treturn new this({\n\t\t\tnodeId: ctx.sourceNodeId,\n\t\t\tsequenceNumber,\n\t\t});\n\t}\n\n\tpublic sequenceNumber: number | undefined;\n\tprivate ensureSequenceNumber(\n\t\tsecurityManager: SecurityManager2,\n\t): asserts this is this & {\n\t\tsequenceNumber: number;\n\t} {\n\t\tif (this.sequenceNumber == undefined) {\n\t\t\tthis.sequenceNumber = securityManager.nextSequenceNumber(\n\t\t\t\tthis.nodeId as number,\n\t\t\t);\n\t\t}\n\t}\n\n\tpublic serialize(ctx: CCEncodingContext): Promise<Bytes> {\n\t\tconst securityManager = assertSecurityTX(ctx, this.nodeId);\n\t\tthis.ensureSequenceNumber(securityManager);\n\n\t\tthis.payload = Bytes.from([this.sequenceNumber]);\n\t\treturn super.serialize(ctx);\n\t}\n\n\tpublic toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry {\n\t\treturn {\n\t\t\t...super.toLogEntry(ctx),\n\t\t\tmessage: {\n\t\t\t\t\"sequence number\": this.sequenceNumber ?? \"(not set)\",\n\t\t\t},\n\t\t};\n\t}\n}\n\n// @publicAPI\nexport interface Security2CCKEXReportOptions {\n\trequestCSA: boolean;\n\techo: boolean;\n\t_reserved?: number;\n\tsupportedKEXSchemes: KEXSchemes[];\n\tsupportedECDHProfiles: ECDHProfiles[];\n\trequestedKeys: SecurityClass[];\n}\n\n@CCCommand(Security2Command.KEXReport)\nexport class Security2CCKEXReport extends Security2CC {\n\tpublic constructor(\n\t\toptions: WithAddress<Security2CCKEXReportOptions>,\n\t) {\n\t\tsuper(options);\n\t\tthis.requestCSA = options.requestCSA;\n\t\tthis.echo = options.echo;\n\t\tthis._reserved = options._reserved ?? 0;\n\t\tthis.supportedKEXSchemes = options.supportedKEXSchemes;\n\t\tthis.supportedECDHProfiles = options.supportedECDHProfiles;\n\t\tthis.requestedKeys = options.requestedKeys;\n\t}\n\n\tpublic static from(\n\t\traw: CCRaw,\n\t\tctx: CCParsingContext,\n\t): Security2CCKEXReport {\n\t\tvalidatePayload(raw.payload.length >= 4);\n\t\tconst requestCSA = !!(raw.payload[0] & 0b10);\n\t\tconst echo = !!(raw.payload[0] & 0b1);\n\n\t\t// Remember the reserved bits for the echo\n\t\tconst _reserved = raw.payload[0] & 0b1111_1100;\n\n\t\t// The bit mask starts at 0, but bit 0 is not used\n\t\tconst supportedKEXSchemes: KEXSchemes[] = parseBitMask(\n\t\t\traw.payload.subarray(1, 2),\n\t\t\t0,\n\t\t).filter((s) => s !== 0);\n\t\tconst supportedECDHProfiles: ECDHProfiles[] = parseBitMask(\n\t\t\traw.payload.subarray(2, 3),\n\t\t\tECDHProfiles.Curve25519,\n\t\t);\n\t\tconst requestedKeys: SecurityClass[] = parseBitMask(\n\t\t\traw.payload.subarray(3, 4),\n\t\t\tSecurityClass.S2_Unauthenticated,\n\t\t);\n\n\t\treturn new this({\n\t\t\tnodeId: ctx.sourceNodeId,\n\t\t\trequestCSA,\n\t\t\techo,\n\t\t\t_reserved,\n\t\t\tsupportedKEXSchemes,\n\t\t\tsupportedECDHProfiles,\n\t\t\trequestedKeys,\n\t\t});\n\t}\n\n\tpublic readonly _reserved: number;\n\tpublic readonly requestCSA: boolean;\n\tpublic readonly echo: boolean;\n\tpublic readonly supportedKEXSchemes: readonly KEXSchemes[];\n\tpublic readonly supportedECDHProfiles: readonly ECDHProfiles[];\n\tpublic readonly requestedKeys: readonly SecurityClass[];\n\n\tpublic serialize(ctx: CCEncodingContext): Promise<Bytes> {\n\t\tthis.payload = Bytes.concat([\n\t\t\t[\n\t\t\t\tthis._reserved\n\t\t\t\t+ (this.requestCSA ? 0b10 : 0)\n\t\t\t\t+ (this.echo ? 0b1 : 0),\n\t\t\t],\n\t\t\t// The bit mask starts at 0, but bit 0 is not used\n\t\t\tencodeBitMask(this.supportedKEXSchemes, 7, 0),\n\t\t\tencodeBitMask(\n\t\t\t\tthis.supportedECDHProfiles,\n\t\t\t\t7,\n\t\t\t\tECDHProfiles.Curve25519,\n\t\t\t),\n\t\t\tencodeBitMask(\n\t\t\t\tthis.requestedKeys,\n\t\t\t\tSecurityClass.S0_Legacy,\n\t\t\t\tSecurityClass.S2_Unauthenticated,\n\t\t\t),\n\t\t]);\n\t\treturn super.serialize(ctx);\n\t}\n\n\tpublic toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry {\n\t\treturn {\n\t\t\t...super.toLogEntry(ctx),\n\t\t\tmessage: {\n\t\t\t\techo: this.echo,\n\t\t\t\t\"supported schemes\": this.supportedKEXSchemes\n\t\t\t\t\t.map((s) => `\\n\u00B7 ${getEnumMemberName(KEXSchemes, s)}`)\n\t\t\t\t\t.join(\"\"),\n\t\t\t\t\"supported ECDH profiles\": this.supportedECDHProfiles\n\t\t\t\t\t.map((s) => `\\n\u00B7 ${getEnumMemberName(ECDHProfiles, s)}`)\n\t\t\t\t\t.join(\"\"),\n\t\t\t\t\"CSA requested\": this.requestCSA,\n\t\t\t\t\"requested security classes\": this.requestedKeys\n\t\t\t\t\t.map((s) => `\\n\u00B7 ${getEnumMemberName(SecurityClass, s)}`)\n\t\t\t\t\t.join(\"\"),\n\t\t\t},\n\t\t};\n\t}\n}\n\n@CCCommand(Security2Command.KEXGet)\n@expectedCCResponse(Security2CCKEXReport)\nexport class Security2CCKEXGet extends Security2CC {}\n\n// @publicAPI\nexport interface Security2CCKEXSetOptions {\n\tpermitCSA: boolean;\n\techo: boolean;\n\t_reserved?: number;\n\tselectedKEXScheme: KEXSchemes;\n\tselectedECDHProfile: ECDHProfiles;\n\tgrantedKeys: SecurityClass[];\n}\n\nfunction getExpectedResponseForKEXSet(\n\tctx: GetNode<NodeId & SupportsCC>,\n\tsent: Security2CCKEXSet,\n) {\n\tif (sent.echo) {\n\t\treturn [Security2CCKEXReport, Security2CCKEXFail];\n\t} else {\n\t\treturn undefined;\n\t}\n}\n\nfunction testExpectedResponseForKEXSet(\n\tsent: Security2CCKEXSet,\n\treceived: any,\n): CCResponseRole {\n\tif (sent.echo) {\n\t\tif (received instanceof Security2CCKEXReport) {\n\t\t\treturn received.echo;\n\t\t} else if (received instanceof Security2CCKEXFail) {\n\t\t\treturn true;\n\t\t}\n\t}\n\treturn false;\n}\n\n@CCCommand(Security2Command.KEXSet)\n@expectedCCResponse(getExpectedResponseForKEXSet, testExpectedResponseForKEXSet)\nexport class Security2CCKEXSet extends Security2CC {\n\tpublic constructor(\n\t\toptions: WithAddress<Security2CCKEXSetOptions>,\n\t) {\n\t\tsuper(options);\n\t\tthis.permitCSA = options.permitCSA;\n\t\tthis.echo = options.echo;\n\t\tthis._reserved = options._reserved ?? 0;\n\t\tthis.selectedKEXScheme = options.selectedKEXScheme;\n\t\tthis.selectedECDHProfile = options.selectedECDHProfile;\n\t\tthis.grantedKeys = options.grantedKeys;\n\t}\n\n\tpublic static from(raw: CCRaw, ctx: CCParsingContext): Security2CCKEXSet {\n\t\tvalidatePayload(raw.payload.length >= 4);\n\t\tconst _reserved = raw.payload[0] & 0b1111_1100;\n\t\tconst permitCSA = !!(raw.payload[0] & 0b10);\n\t\tconst echo = !!(raw.payload[0] & 0b1);\n\n\t\t// The bit mask starts at 0, but bit 0 is not used\n\t\tconst selectedKEXSchemes = parseBitMask(\n\t\t\traw.payload.subarray(1, 2),\n\t\t\t0,\n\t\t).filter((s) => s !== 0);\n\t\tvalidatePayload(selectedKEXSchemes.length === 1);\n\t\tconst selectedKEXScheme: KEXSchemes = selectedKEXSchemes[0];\n\t\tconst selectedECDHProfiles = parseBitMask(\n\t\t\traw.payload.subarray(2, 3),\n\t\t\tECDHProfiles.Curve25519,\n\t\t);\n\t\tvalidatePayload(selectedECDHProfiles.length === 1);\n\t\tconst selectedECDHProfile: ECDHProfiles = selectedECDHProfiles[0];\n\t\tconst grantedKeys: SecurityClass[] = parseBitMask(\n\t\t\traw.payload.subarray(3, 4),\n\t\t\tSecurityClass.S2_Unauthenticated,\n\t\t);\n\n\t\treturn new this({\n\t\t\tnodeId: ctx.sourceNodeId,\n\t\t\t_reserved,\n\t\t\tpermitCSA,\n\t\t\techo,\n\t\t\tselectedKEXScheme,\n\t\t\tselectedECDHProfile,\n\t\t\tgrantedKeys,\n\t\t});\n\t}\n\n\tpublic readonly _reserved: number;\n\tpublic permitCSA: boolean;\n\tpublic echo: boolean;\n\tpublic selectedKEXScheme: KEXSchemes;\n\tpublic selectedECDHProfile: ECDHProfiles;\n\tpublic grantedKeys: SecurityClass[];\n\n\tpublic serialize(ctx: CCEncodingContext): Promise<Bytes> {\n\t\tthis.payload = Bytes.concat([\n\t\t\t[\n\t\t\t\tthis._reserved\n\t\t\t\t+ (this.permitCSA ? 0b10 : 0)\n\t\t\t\t+ (this.echo ? 0b1 : 0),\n\t\t\t],\n\t\t\t// The bit mask starts at 0, but bit 0 is not used\n\t\t\tencodeBitMask([this.selectedKEXScheme], 7, 0),\n\t\t\tencodeBitMask(\n\t\t\t\t[this.selectedECDHProfile],\n\t\t\t\t7,\n\t\t\t\tECDHProfiles.Curve25519,\n\t\t\t),\n\t\t\tencodeBitMask(\n\t\t\t\tthis.grantedKeys,\n\t\t\t\tSecurityClass.S0_Legacy,\n\t\t\t\tSecurityClass.S2_Unauthenticated,\n\t\t\t),\n\t\t]);\n\t\treturn super.serialize(ctx);\n\t}\n\n\tpublic toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry {\n\t\treturn {\n\t\t\t...super.toLogEntry(ctx),\n\t\t\tmessage: {\n\t\t\t\techo: this.echo,\n\t\t\t\t\"selected scheme\": getEnumMemberName(\n\t\t\t\t\tKEXSchemes,\n\t\t\t\t\tthis.selectedKEXScheme,\n\t\t\t\t),\n\t\t\t\t\"selected ECDH profile\": getEnumMemberName(\n\t\t\t\t\tECDHProfiles,\n\t\t\t\t\tthis.selectedECDHProfile,\n\t\t\t\t),\n\t\t\t\t\"CSA permitted\": this.permitCSA,\n\t\t\t\t\"granted security classes\": this.grantedKeys\n\t\t\t\t\t.map((s) => `\\n\u00B7 ${getEnumMemberName(SecurityClass, s)}`)\n\t\t\t\t\t.join(\"\"),\n\t\t\t},\n\t\t};\n\t}\n}\n\n// @publicAPI\nexport interface Security2CCKEXFailOptions {\n\tfailType: KEXFailType;\n}\n\n@CCCommand(Security2Command.KEXFail)\nexport class Security2CCKEXFail extends Security2CC {\n\tpublic constructor(\n\t\toptions: WithAddress<Security2CCKEXFailOptions>,\n\t) {\n\t\tsuper(options);\n\t\tthis.failType = options.failType;\n\t}\n\n\tpublic static from(raw: CCRaw, ctx: CCParsingContext): Security2CCKEXFail {\n\t\tvalidatePayload(raw.payload.length >= 1);\n\t\tconst failType: KEXFailType = raw.payload[0];\n\n\t\treturn new this({\n\t\t\tnodeId: ctx.sourceNodeId,\n\t\t\tfailType,\n\t\t});\n\t}\n\n\tpublic failType: KEXFailType;\n\n\tpublic serialize(ctx: CCEncodingContext): Promise<Bytes> {\n\t\tthis.payload = Bytes.from([this.failType]);\n\t\treturn super.serialize(ctx);\n\t}\n\n\tpublic toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry {\n\t\treturn {\n\t\t\t...super.toLogEntry(ctx),\n\t\t\tmessage: { reason: getEnumMemberName(KEXFailType, this.failType) },\n\t\t};\n\t}\n}\n\n// @publicAPI\nexport interface Security2CCPublicKeyReportOptions {\n\tincludingNode: boolean;\n\tpublicKey: BytesView;\n}\n\n@CCCommand(Security2Command.PublicKeyReport)\nexport class Security2CCPublicKeyReport extends Security2CC {\n\tpublic constructor(\n\t\toptions: WithAddress<Security2CCPublicKeyReportOptions>,\n\t) {\n\t\tsuper(options);\n\t\tthis.includingNode = options.includingNode;\n\t\tthis.publicKey = options.publicKey;\n\t}\n\n\tpublic static from(\n\t\traw: CCRaw,\n\t\tctx: CCParsingContext,\n\t): Security2CCPublicKeyReport {\n\t\tvalidatePayload(raw.payload.length >= 17);\n\t\tconst includingNode = !!(raw.payload[0] & 0b1);\n\t\tconst publicKey: BytesView = raw.payload.subarray(1);\n\n\t\treturn new this({\n\t\t\tnodeId: ctx.sourceNodeId,\n\t\t\tincludingNode,\n\t\t\tpublicKey,\n\t\t});\n\t}\n\n\tpublic includingNode: boolean;\n\tpublic publicKey: BytesView;\n\n\tpublic serialize(ctx: CCEncodingContext): Promise<Bytes> {\n\t\tthis.payload = Bytes.concat([\n\t\t\t[this.includingNode ? 1 : 0],\n\t\t\tthis.publicKey,\n\t\t]);\n\t\treturn super.serialize(ctx);\n\t}\n\n\tpublic toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry {\n\t\treturn {\n\t\t\t...super.toLogEntry(ctx),\n\t\t\tmessage: {\n\t\t\t\t\"is including node\": this.includingNode,\n\t\t\t\t\"public key\": buffer2hex(this.publicKey),\n\t\t\t},\n\t\t};\n\t}\n}\n\n// @publicAPI\nexport interface Security2CCNetworkKeyReportOptions {\n\tgrantedKey: SecurityClass;\n\tnetworkKey: BytesView;\n}\n\n@CCCommand(Security2Command.NetworkKeyReport)\nexport class Security2CCNetworkKeyReport extends Security2CC {\n\tpublic constructor(\n\t\toptions: WithAddress<Security2CCNetworkKeyReportOptions>,\n\t) {\n\t\tsuper(options);\n\t\tthis.grantedKey = options.grantedKey;\n\t\tthis.networkKey = options.networkKey;\n\t}\n\n\tpublic static from(\n\t\traw: CCRaw,\n\t\tctx: CCParsingContext,\n\t): Security2CCNetworkKeyReport {\n\t\tvalidatePayload(raw.payload.length >= 17);\n\t\tconst grantedKey: SecurityClass = bitMaskToSecurityClass(\n\t\t\traw.payload,\n\t\t\t0,\n\t\t);\n\t\tconst networkKey = raw.payload.subarray(1, 17);\n\n\t\treturn new this({\n\t\t\tnodeId: ctx.sourceNodeId,\n\t\t\tgrantedKey,\n\t\t\tnetworkKey,\n\t\t});\n\t}\n\n\tpublic grantedKey: SecurityClass;\n\tpublic networkKey: BytesView;\n\n\tpublic serialize(ctx: CCEncodingContext): Promise<Bytes> {\n\t\tthis.payload = Bytes.concat([\n\t\t\tsecurityClassToBitMask(this.grantedKey),\n\t\t\tthis.networkKey,\n\t\t]);\n\t\treturn super.serialize(ctx);\n\t}\n\n\tpublic toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry {\n\t\treturn {\n\t\t\t...super.toLogEntry(ctx),\n\t\t\tmessage: {\n\t\t\t\t\"security class\": getEnumMemberName(\n\t\t\t\t\tSecurityClass,\n\t\t\t\t\tthis.grantedKey,\n\t\t\t\t),\n\t\t\t\t// This shouldn't be logged, so users can safely post their logs online\n\t\t\t\t// \"network key\": buffer2hex(this.networkKey),\n\t\t\t},\n\t\t};\n\t}\n}\n\n// @publicAPI\nexport interface Security2CCNetworkKeyGetOptions {\n\trequestedKey: SecurityClass;\n}\n\n@CCCommand(Security2Command.NetworkKeyGet)\n// Don't expect a response - we need to distinguish between Report and Fail\n// FIXME: maybe use the dynamic @expectedCCResponse instead?\nexport class Security2CCNetworkKeyGet extends Security2CC {\n\tpublic constructor(\n\t\toptions: WithAddress<Security2CCNetworkKeyGetOptions>,\n\t) {\n\t\tsuper(options);\n\t\tthis.requestedKey = options.requestedKey;\n\t}\n\n\tpublic static from(\n\t\traw: CCRaw,\n\t\tctx: CCParsingContext,\n\t): Security2CCNetworkKeyGet {\n\t\tvalidatePayload(raw.payload.length >= 1);\n\t\tconst requestedKey: SecurityClass = bitMaskToSecurityClass(\n\t\t\traw.payload,\n\t\t\t0,\n\t\t);\n\n\t\treturn new this({\n\t\t\tnodeId: ctx.sourceNodeId,\n\t\t\trequestedKey,\n\t\t});\n\t}\n\n\tpublic requestedKey: SecurityClass;\n\n\tpublic serialize(ctx: CCEncodingContext): Promise<Bytes> {\n\t\tthis.payload = securityClassToBitMask(this.requestedKey);\n\t\treturn super.serialize(ctx);\n\t}\n\n\tpublic toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry {\n\t\treturn {\n\t\t\t...super.toLogEntry(ctx),\n\t\t\tmessage: {\n\t\t\t\t\"security class\": getEnumMemberName(\n\t\t\t\t\tSecurityClass,\n\t\t\t\t\tthis.requestedKey,\n\t\t\t\t),\n\t\t\t},\n\t\t};\n\t}\n}\n\n@CCCommand(Security2Command.NetworkKeyVerify)\nexport class Security2CCNetworkKeyVerify extends Security2CC {}\n\n// @publicAPI\nexport interface Security2CCTransferEndOptions {\n\tkeyVerified: boolean;\n\tkeyRequestComplete: boolean;\n}\n\n@CCCommand(Security2Command.TransferEnd)\nexport class Security2CCTransferEnd extends Security2CC {\n\tpublic constructor(\n\t\toptions: WithAddress<Security2CCTransferEndOptions>,\n\t) {\n\t\tsuper(options);\n\t\tthis.keyVerified = options.keyVerified;\n\t\tthis.keyRequestComplete = options.keyRequestComplete;\n\t}\n\n\tpublic static from(\n\t\traw: CCRaw,\n\t\tctx: CCParsingContext,\n\t): Security2CCTransferEnd {\n\t\tvalidatePayload(raw.payload.length >= 1);\n\t\tconst keyVerified = !!(raw.payload[0] & 0b10);\n\t\tconst keyRequestComplete = !!(raw.payload[0] & 0b1);\n\n\t\treturn new this({\n\t\t\tnodeId: ctx.sourceNodeId,\n\t\t\tkeyVerified,\n\t\t\tkeyRequestComplete,\n\t\t});\n\t}\n\n\tpublic keyVerified: boolean;\n\tpublic keyRequestComplete: boolean;\n\n\tpublic serialize(ctx: CCEncodingContext): Promise<Bytes> {\n\t\tthis.payload = Bytes.from([\n\t\t\t(this.keyVerified ? 0b10 : 0) + (this.keyRequestComplete ? 0b1 : 0),\n\t\t]);\n\t\treturn super.serialize(ctx);\n\t}\n\n\tpublic toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry {\n\t\treturn {\n\t\t\t...super.toLogEntry(ctx),\n\t\t\tmessage: {\n\t\t\t\t\"key verified\": this.keyVerified,\n\t\t\t\t\"request complete\": this.keyRequestComplete,\n\t\t\t},\n\t\t};\n\t}\n}\n\n// @publicAPI\nexport interface Security2CCCommandsSupportedReportOptions {\n\tsupportedCCs: CommandClasses[];\n}\n\n@CCCommand(Security2Command.CommandsSupportedReport)\nexport class Security2CCCommandsSupportedReport extends Security2CC {\n\tpublic constructor(\n\t\toptions: WithAddress<Security2CCCommandsSupportedReportOptions>,\n\t) {\n\t\tsuper(options);\n\t\tthis.supportedCCs = options.supportedCCs;\n\t}\n\n\tpublic static from(\n\t\traw: CCRaw,\n\t\tctx: CCParsingContext,\n\t): Security2CCCommandsSupportedReport {\n\t\tconst CCs = parseCCList(raw.payload);\n\t\t// SDS13783: A sending node MAY terminate the list of supported command classes with the\n\t\t// COMMAND_CLASS_MARK command class identifier.\n\t\t// A receiving node MUST stop parsing the list of supported command classes if it detects the\n\t\t// COMMAND_CLASS_MARK command class identifier in the Security 2 Commands Supported Report\n\t\tconst supportedCCs = CCs.supportedCCs;\n\n\t\treturn new this({\n\t\t\tnodeId: ctx.sourceNodeId,\n\t\t\tsupportedCCs,\n\t\t});\n\t}\n\n\tpublic readonly supportedCCs: CommandClasses[];\n\n\tpublic serialize(ctx: CCEncodingContext): Promise<Bytes> {\n\t\tthis.payload = encodeCCList(this.supportedCCs, []);\n\t\treturn super.serialize(ctx);\n\t}\n\n\tpublic toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry {\n\t\treturn {\n\t\t\t...super.toLogEntry(ctx),\n\t\t\tmessage: {\n\t\t\t\t\"supported CCs\": this.supportedCCs\n\t\t\t\t\t.map((cc) => getCCName(cc))\n\t\t\t\t\t.map((cc) => `\\n\u00B7 ${cc}`)\n\t\t\t\t\t.join(\"\"),\n\t\t\t},\n\t\t};\n\t}\n}\n\n@CCCommand(Security2Command.CommandsSupportedGet)\n@expectedCCResponse(Security2CCCommandsSupportedReport)\nexport class Security2CCCommandsSupportedGet extends Security2CC {}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,kBAuCO;AACP,oBAMO;AACP,mBAAqB;AACrB,wBAAwB;AACxB,iBAAsB;AACtB,0BAKO;AACP,oCAMO;AACP,uBAQO;AACP,IAAAA,iBAIO;AACP,mBAAiC;AACjC,qBAAwB;AACxB,4BAA+B;AAC/B,wBAA2B;AAC3B,gCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEnC,SAAS,uBAAuB,KAAkB;AACjD,aAAO,2BACN,CAAC,GAAG,GACJ,0BAAc,WACd,0BAAc,kBAAkB;AAElC;AANS;AAQT,SAAS,uBACR,QACA,QAAc;AAEd,QAAM,WAAO,0BACZ,OAAO,SAAS,QAAQ,SAAS,CAAC,GAClC,0BAAc,kBAAkB;AAEjC,mCAAgB,KAAK,WAAW,CAAC;AACjC,SAAO,KAAK,CAAC;AACd;AAVS;AAYT,MAAM,8BAA8B;AAEpC,SAAS,sBACR,eACA,aACA,QACA,eACA,oBAA6B;AAE7B,QAAM,iBACL,+BAAkB,aAAa,SAAK,+BAAkB,WAAW,IAC9D,IACA;AACJ,QAAM,MAAM,IAAI,oBACf,IAAI,aAAa,IAAI,mBAAmB,MAAM;AAE/C,MAAI,SAAS;AACb,MAAI,YAAY,eAAe,QAAQ,UAAU;AACjD,YAAU;AACV,MAAI,YAAY,aAAa,QAAQ,UAAU;AAC/C,YAAU;AACV,MAAI,cAAc,QAAQ,MAAM;AAChC,YAAU;AACV,MAAI,cAAc,eAAe,MAAM;AACvC,YAAU;AAEV,MAAI,IAAI,oBAAoB,MAAM;AAClC,SAAO;AACR;AA1BS;AA2BT,SAAS,mBACR,WACA,kBACA,aAA0C;AAE1C,QAAM,gBAAY,+BAAkB,SAAS,SACzC,mCACF,2BAAQ,WAAW,IAAI,YAAY,CAAC,IAAI,WAAW;AAErD,SAAO,YACJ,iBAAiB,oBACjB,iBAAiB;AACrB;AAZS;AAeT,SAAS,uBACR,iBACA,cACA,gBAAsB;AAEtB,8BAAgB,WACf,sCAAsC,cAAc,GAAG,EAEvD,CAAC,gBAAgB,sBAChB,cACA,cAAc,CACd;AAGF,SAAO,gBAAgB,oBACtB,cACA,cAAc;AAEhB;AAlBS;AAoBT,MAAM,kCAAkC;AACxC,MAAM,iCAAiC;AACvC,MAAM,mCAAmC;AAWzC,SAAS,iBACR,KAAqB;AAErB,MAAI,CAAC,IAAI,WAAW;AACnB,UAAM,IAAI,uBACT,oFACA,4BAAgB,eAAe;EAEjC;AAEA,QAAM,MAAM,mBAAmB,IAAI,WAAW,KAAK,IAAI,YAAY;AAEnE,MAAI,CAAC,KAAK;AACT,UAAM,IAAI,uBACT,iFACA,4BAAgB,iBAAiB;EAEnC;AAEA,SAAO;AACR;AApBS;AAsBT,SAAS,iBACR,KACA,aAA0C;AAE1C,MAAI,CAAC,IAAI,WAAW;AACnB,UAAM,IAAI,uBACT,iFACA,4BAAgB,eAAe;EAEjC;AAEA,QAAM,MAAM,mBAAmB,IAAI,WAAW,KAAK,WAAW;AAE9D,MAAI,CAAC,KAAK;AACT,UAAM,IAAI,uBACT,8EACA,4BAAgB,iBAAiB;EAEnC;AAEA,SAAO;AACR;AArBS;AAuBT,eAAe,kBACd,KACA,iBACA,eACA,mBACA,oBACA,YACA,UACA,SACA,WAGA,YAAgC;AAEhC,QAAM,mBAAmB,8BAAO,UAAoB;AACnD,UAAM,EAAE,QAAQ,IAAG,IAAK,gBAAgB,eACvC,aAAa;AAGd,UAAM,KAAK;AAEX,UAAM,MAAM,UAAM,8BACjB,YACA,KACA,IACA,UACA,OAAO;AAGR,WAAO;MACN;MACA;MACA,GAAG;;EAEL,GApByB;AAqBzB,QAAM,qBAAqB,mCAAW;AACrC,UAAM,KAAK,MAAM,gBAAgB,UAAU,aAAa;AACxD,WAAO,iBAAiB,EAAE;EAC3B,GAH2B;AAK3B,MAAI,UAAU,SAAS,sBAAU,MAAM;AAKtC;;MAEC,CAAC,CAAC,UAAU,eAET,UAAU,YAAY,cAAU,8BAAgB,KAEhD,sBAAsB,UACtB,uBAAwB,qBAAqB,IAAK,QAElD,CAAC,IAAI;MACP;AACD,YAAM,QAAQ,UAAU,YAAY;AACpC,gBAAU,cAAc;AAGxB,YAAM,SAAS,MAAM,iBAAiB,KAAK;AAC3C,UAAI,OAAO,QAAQ;AAClB,eAAO;UACN,GAAG;UACH,eAAe,UAAU;;MAE3B;IAED,OAAO;AAEN,gBAAU,cAAc;IACzB;AAGA,WAAO;MACN,GAAI,MAAM,mBAAkB;MAC5B,eAAe,UAAU;;EAE3B,WAAW,UAAU,SAAS,sBAAU,SAAS;AAGhD,UAAM,WAAW,YAAY,UAAU;AACvC,QAAI,CAAC;AAAU,iBAAU;AACzB,UAAM,aAAa,UAAU;AAG7B,UAAM,sBAAsB,gBAAgB,SAAS,IACpD,aAAa;AAEd,QAAI,qBAAqB;AAExB,YAAM,gBAAgB,mBACrB,eACA,UACA,UAAU;AAGX,YAAM,MAAM,MAAM,mBAAkB;AAEpC,UAAI,IAAI,QAAQ;AACf,eAAO;UACN,GAAG;UACH,eAAe,0BAAc;;MAE/B;AAGA,sBAAgB,aACf,eACA,SAAS;IAEX;AAYA,UAAM,0BAA0B,sBAC7B,CAAC,IAAI,wBAAwB,aAAa,CAAE,IAC5C,+BAAmB,OACpB,CAAC,MACA,IAAI,iBAAiB,eAAe,CAAC,MAChC,KAAK;AAGb,eAAW,YAAY,yBAAyB;AAE/C,UACC,CAAC,gBAAgB,wBAChB,QAAQ,GAER;AACD;MACD;AAGA,YAAM,gBAAgB,eACrB,eACA,UACA,UACA,UAAU;AAEX,YAAM,MAAM,MAAM,mBAAkB;AAGpC,UAAI,IAAI,QAAQ;AAEf,YACC,IAAI,iBAAiB,eAAe,QAAQ,MACvC,QACJ;AACD,cAAI,iBAAiB,eAAe,UAAU,IAAI;QACnD;AACA,eAAO;UACN,GAAG;UACH,eAAe;;MAEjB,OAAO;AAEN,wBAAgB,aACf,eACA,SAAS;MAEX;IACD;EACD;AAGA,SAAO;IACN,WAAW,IAAI,WAAU;IACzB,QAAQ;IACR,eAAe;;AAEjB;AAnLe;AAqLf,eAAe,iBACd,eACA,iBACA,SACA,YACA,UACA,SAAkB;AAElB,QAAM,KAAK,MAAM,gBAAgB,aAChC,eACA,OAAO;AAER,QAAM,EAAE,QAAQ,IAAG,IAAK,gBAAgB,eACvC,aAAa;AAEd,SAAO;IACN;IACA;IACA,GAAI,UAAM,8BACT,YACA,KACA,IACA,UACA,OAAO;;IAGR,eAAe;;AAEjB;AA5Be;AA8Bf,SAAS,gBAAgB,QAAmB,cAAqB;AAKhE,QAAM,aAAmC,CAAA;AACzC,MAAI,qBAAqB;AACzB,MAAI,SAAS;AAEb,UAAS,QAAO,MAAM;AACrB,QAAI,OAAO,SAAS,SAAS,GAAG;AAE/B,2BAAqB;AACrB,YAAM;IACP;AAIA,UAAM,EAAE,QAAQ,cAAc,UAAU,eAAc,IACrD,oCACE,mBACA,OAAO,SAAS,MAAM,CAAC;AAI1B,UAAM,kBAAkB,kBAAkB;AAC1C,QAAI,kBAAkB,GAAG;AAExB,2BAAqB;AACrB,YAAM;IACP,WACC,kBACG,OAAO,SACN,UACC,eACA,IACA,8BACJ;AAED,2BAAqB;AACrB,YAAM;IACP;AAEA,UAAM,gBAAgB,OAAO,SAC5B,QACA,SAAS,eAAe;AAEzB,cAAU;AAEV,UAAM,MAAM,oCAAmB,MAAM,aAAa;AAElD,gBAAQ,sCAAoB,KAAK,YAAY,GAAG;MAC/C,KAAK,2CAA0B;AAC9B,YACC,kBAAkB,UACf,iBAAiB,gBACnB;QAEF,OAAO;AACN,qBAAW,KAAK,GAAG;QACpB;AACA;MACD,KAAK,2CAA0B;AAE9B;MACD,KAAK,2CAA0B;AAC9B,6BAAqB;AACrB;IACF;AAGA,QAAI,CAAC,IAAI;AAAc,YAAM;EAC9B;AAEA,SAAO;IACN;IACA;IACA,WAAW;;AAEb;AA/ES;AAiFT,SAAS,qBAAkB;AAG1B,MAAI,KAAK,aAAY;AAAI,WAAO,KAAK;AAErC,QAAM,MAAM,oBAAoB,KAAK,UAAU;AAC/C,MAAI,OAAO,QAAW;AACrB,UAAM,IAAI,uBACT,mEACA,4BAAgB,4BAA4B;EAE9C;AACA,SAAO;AACR;AAbS;AAeT,SAAS,mBACR,KACA,YAAgC;AAEhC,MAAI,IAAI,cAAc,cAAc;AACnC,WAAO,IAAI;EACZ;AAEA,QAAM,MAAM,oBAAoB,UAAU;AAC1C,MAAI,OAAO,QAAW;AACrB,UAAM,IAAI,uBACT,mEACA,4BAAgB,4BAA4B;EAE9C;AACA,SAAO;AACR;AAhBS;AAkBT,SAAS,oBACR,YAAgC;AAEhC,QAAM,gBAAgB,WAAW,KAChC,CAAC,MAAM,aAAa,8BAAa;AAElC,SAAO,eAAe;AACvB;AAPS;AAUT,SAAS,YAAY,YAAgC;AACpD,QAAM,gBAAgB,WAAW,KAChC,CAAC,MAAM,aAAa,8BAAa;AAElC,SAAO,eAAe;AACvB;AALS;IAYI,kBAAc,MAAA;8BAD1B,mCAAI,2BAAe,YAAY,CAAC,CAAC;;;;oBACE;sCAAA,YAAK;WAAA;;;;;;;;AAAzC,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;IACL,gBAAgB,MAAsB;AAE5C,aAAO;IACR;;;;;IAMO,MAAM,YAAS;AACrB,WAAK,sBACJ,+BACA,8BAAiB,WAAW;AAG7B,WAAK,uBAAuB,KAAK,QAAQ;AAEzC,YAAM,kBAAkB,mBACvB,KAAK,KAAK,WACV,KAAK,MACL,KAAK,SAAS,MAAM;AAGrB,UAAI,CAAC,iBAAiB;AACrB,cAAM,IAAI,uBACT,8DACA,4BAAgB,iBAAiB;MAEnC;AAEA,YAAM,aAAa,MAAM,gBAAgB,cACxC,KAAK,SAAS,MAAM;AAGrB,YAAM,KAAK,IAAI,uBAAuB;QACrC,QAAQ,KAAK,SAAS;QACtB,eAAe,KAAK,SAAS;QAC7B,KAAK;QACL,KAAK;QACL;OACA;AAED,UAAI;AACH,cAAM,KAAK,KAAK,YAAY,IAAI;UAC/B,GAAG,KAAK;;UAER,iBAAiB,4BAAgB,MAC9B,4BAAgB;;UAEnB,iBAAiB;;UAEjB,UAAU,4BAAgB;;UAE1B,8BAA8B;;SAE9B;MACF,SAAS,GAAG;AACX,gBAAI,iCAAoB,CAAC,GAAG;AAE3B,0BAAgB,YACf,KAAK,SAAS,MAAM;AAErB,iBAAO;QACR,OAAO;AAEN,gBAAM;QACP;MACD;AACA,aAAO;IACR;;IAGO,MAAM,UAAO;AACnB,WAAK,sBACJ,+BACA,8BAAiB,WAAW;AAG7B,WAAK,uBAAuB,KAAK,QAAQ;AAEzC,YAAM,KAAK,IAAI,uBAAuB;QACrC,QAAQ,KAAK,SAAS;QACtB,eAAe,KAAK,SAAS;QAC7B,KAAK;QACL,KAAK;OACL;AAED,UAAI;AACH,cAAM,KAAK,KAAK,YAAY,IAAI;UAC/B,GAAG,KAAK;;UAER,iBAAiB,4BAAgB,MAC9B,4BAAgB;;UAEnB,iBAAiB;;UAEjB,UAAU,4BAAgB;;UAE1B,8BAA8B;SAC9B;MACF,SAAS,GAAG;AACX,gBAAI,iCAAoB,CAAC,GAAG;AAC3B,iBAAO;QACR,OAAO;AAEN,gBAAM;QACP;MACD;AACA,aAAO;IACR;;IAGO,MAAM,SACZ,SACA,gBAAyB;AAEzB,WAAK,sBACJ,+BACA,8BAAiB,oBAAoB;AAGtC,WAAK,uBAAuB,KAAK,QAAQ;AAEzC,YAAM,KAAK,IAAI,gCAAgC;QAC9C,QAAQ,KAAK,SAAS;QACtB,eAAe,KAAK,SAAS;QAC7B,YAAY;UACX,IAAI,+BAAc;YACjB;YACA;WACA;;OAEF;AAED,UAAI;AACH,cAAM,KAAK,KAAK,YAAY,IAAI;UAC/B,GAAG,KAAK;;UAER,iBAAiB,4BAAgB,MAC9B,4BAAgB;;UAEnB,iBAAiB;;UAEjB,UAAU,4BAAgB;;UAE1B,8BAA8B;SAC9B;MACF,SAAS,GAAG;AACX,gBAAI,iCAAoB,CAAC,GAAG;AAC3B,iBAAO;QACR,OAAO;AAEN,gBAAM;QACP;MACD;AACA,aAAO;IACR;;;;;IAMO,MAAM,qBACZ,eAGmC;AAEnC,WAAK,sBACJ,+BACA,8BAAiB,oBAAoB;AAGtC,UAAI,KAAmB,IAAI,gCAAgC;QAC1D,QAAQ,KAAK,SAAS;QACtB,eAAe,KAAK,SAAS;OAC7B;AAID,UAAI,qCAAe,sBAAsB,EAAE,GAAG;AAC7C,cAAM,wBAAwB,KAAK,KAAK,sBACvC,2BAAe,eAAe,GAC9B,KAAK,SAAS,MAAgB;AAG/B,aAAK,0BAA0B,IAC5B,qCAAe,cAAc,EAAE,IAC/B,qCAAe,YAAY,EAAE;MACjC;AACA,WAAK,YAAY,YAChB,IACA,KAAK,KAAK,WACV,KAAK,MACL,EAAE,cAAa,CAAE;AAGlB,YAAM,WAAW,MAAM,KAAK,KAAK,YAGhC,IACA;QACC,GAAG,KAAK;QACR,iBAAiB;OACjB;AAEF,aAAO,UAAU;IAClB;IAEO,MAAM,wBACZ,cAA8B;AAE9B,WAAK,sBACJ,+BACA,8BAAiB,uBAAuB;AAGzC,YAAM,KAAK,IAAI,mCAAmC;QACjD,QAAQ,KAAK,SAAS;QACtB,eAAe,KAAK,SAAS;QAC7B;OACA;AACD,YAAM,KAAK,KAAK,YAAY,IAAI,KAAK,cAAc;IACpD;;IAGO,MAAM,2BAAwB;AACpC,WAAK,sBAAsB,+BAAkB,8BAAiB,MAAM;AAEpE,YAAM,KAAK,IAAI,kBAAkB;QAChC,QAAQ,KAAK,SAAS;QACtB,eAAe,KAAK,SAAS;OAC7B;AACD,YAAM,WAAW,MAAM,KAAK,KAAK,YAChC,IACA,KAAK,cAAc;AAEpB,UAAI,UAAU;AACb,mBAAO,oBAAK,UAAU;UACrB;UACA;UACA;UACA;UACA;UACA;SACA;MACF;IACD;;IAGO,MAAM,YACZ,QAAiD;AAEjD,WAAK,sBACJ,+BACA,8BAAiB,SAAS;AAG3B,YAAM,KAAK,IAAI,qBAAqB;QACnC,QAAQ,KAAK,SAAS;QACtB,eAAe,KAAK,SAAS;QAC7B,GAAG;QACH,MAAM;OACN;AACD,YAAM,KAAK,KAAK,YAAY,IAAI,KAAK,cAAc;IACpD;;IAGO,MAAM,UACZ,QAA8C;AAE9C,WAAK,sBAAsB,+BAAkB,8BAAiB,MAAM;AAEpE,YAAM,KAAK,IAAI,kBAAkB;QAChC,QAAQ,KAAK,SAAS;QACtB,eAAe,KAAK,SAAS;QAC7B,GAAG;QACH,MAAM;OACN;AACD,YAAM,KAAK,KAAK,YAAY,IAAI,KAAK,cAAc;IACpD;;IAGO,MAAM,qBACZ,QAAiD;AAEjD,WAAK,sBACJ,+BACA,8BAAiB,SAAS;AAG3B,YAAM,KAAK,IAAI,qBAAqB;QACnC,QAAQ,KAAK,SAAS;QACtB,eAAe,KAAK,SAAS;QAC7B,GAAG;QACH,MAAM;OACN;AACD,YAAM,KAAK,KAAK,YAAY,IAAI,KAAK,cAAc;IACpD;;IAGO,MAAM,mBACZ,QAA8C;AAE9C,WAAK,sBACJ,+BACA,8BAAiB,MAAM;AAGxB,YAAM,KAAK,IAAI,kBAAkB;QAChC,QAAQ,KAAK,SAAS;QACtB,eAAe,KAAK,SAAS;QAC7B,GAAG;QACH,MAAM;OACN;AACD,aAAO,KAAK,KAAK,YAAY,IAAI,KAAK,cAAc;IACrD;;IAGO,MAAM,iBAAiB,UAAqB;AAClD,WAAK,sBAAsB,+BAAkB,8BAAiB,OAAO;AAErE,YAAM,KAAK,IAAI,mBAAmB;QACjC,QAAQ,KAAK,SAAS;QACtB,eAAe,KAAK,SAAS;QAC7B;OACA;AACD,YAAM,KAAK,KAAK,YAAY,IAAI,KAAK,cAAc;IACpD;IAEO,MAAM,cACZ,WACA,gBAAyB,MAAI;AAE7B,WAAK,sBACJ,+BACA,8BAAiB,eAAe;AAGjC,YAAM,KAAK,IAAI,2BAA2B;QACzC,QAAQ,KAAK,SAAS;QACtB,eAAe,KAAK,SAAS;QAC7B;QACA;OACA;AACD,YAAM,KAAK,KAAK,YAAY,IAAI,KAAK,cAAc;IACpD;IAEO,MAAM,kBACZ,eAA4B;AAE5B,WAAK,sBACJ,+BACA,8BAAiB,aAAa;AAG/B,YAAM,KAAK,IAAI,yBAAyB;QACvC,QAAQ,KAAK,SAAS;QACtB,eAAe,KAAK,SAAS;QAC7B,cAAc;OACd;AACD,YAAM,KAAK,KAAK,YAAY,IAAI,KAAK,cAAc;IACpD;IAEO,MAAM,eACZ,eACA,YAAqB;AAErB,WAAK,sBACJ,+BACA,8BAAiB,gBAAgB;AAGlC,YAAM,KAAK,IAAI,4BAA4B;QAC1C,QAAQ,KAAK,SAAS;QACtB,eAAe,KAAK,SAAS;QAC7B,YAAY;QACZ;OACA;AACD,YAAM,KAAK,KAAK,YAAY,IAAI,KAAK,cAAc;IACpD;IAEO,MAAM,mBAAgB;AAC5B,WAAK,sBACJ,+BACA,8BAAiB,gBAAgB;AAGlC,YAAM,KAAK,IAAI,4BAA4B;QAC1C,QAAQ,KAAK,SAAS;QACtB,eAAe,KAAK,SAAS;OAC7B;AACD,YAAM,KAAK,KAAK,YAAY,IAAI,KAAK,cAAc;IACpD;IAEO,MAAM,yBAAsB;AAClC,WAAK,sBACJ,+BACA,8BAAiB,WAAW;AAG7B,YAAM,KAAK,IAAI,uBAAuB;QACrC,QAAQ,KAAK,SAAS;QACtB,eAAe,KAAK,SAAS;QAC7B,aAAa;QACb,oBAAoB;OACpB;AACD,YAAM,KAAK,KAAK,YAAY,IAAI;QAC/B,GAAG,KAAK;;QAER,iBAAiB,4BAAgB,UAAU,CAAC,4BAAgB;OAC5D;IACF;IAEO,MAAM,iBAAc;AAC1B,WAAK,sBACJ,+BACA,8BAAiB,WAAW;AAG7B,YAAM,KAAK,IAAI,uBAAuB;QACrC,QAAQ,KAAK,SAAS;QACtB,eAAe,KAAK,SAAS;QAC7B,aAAa;QACb,oBAAoB;OACpB;AACD,YAAM,KAAK,KAAK,YAAY,IAAI,KAAK,cAAc;IACpD;;;;IAKY,eAAW,MAAA;8BAFvB,4CAAa,2BAAe,YAAY,CAAC,OACzC,kDAAmB,CAAC,CAAC;;;;oBACW;mCAAA,YAAY;WAAA;;;;;;;;AAA7C,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;IAGL,MAAM,UACZ,KAAqB;AAErB,YAAM,kBAAkB,mBACvB,IAAI,WACJ,KACA,KAAK,MAAM;AAGZ,YAAM,OAAO,KAAK,QAAQ,GAAG;AAC7B,YAAM,WAAW,KAAK,YAAY,GAAG;AACrC,YAAM,MAAM,iBAAM,OACjB,2BAAe,YAAY,GAC3B,KACA,QAAQ,EACP,YAAY;QACb,UAAU,4BAAgB;OAC1B;AAED,YAAM,WAAW,KAAK,wBAAuB;AAC7C,UAAI,4BAA4B;AAEhC,UAAI;AACJ,cAAI,+BAAkB,QAAQ,GAAG;AAEhC,kCAA0B,CAAC,QAAQ;MACpC,WAAW,SAAS,UAAU,GAAG;AAGhC,kCAA0B;UACzB,0BAAc;UACd,0BAAc;UACd,0BAAc;;MAEhB,OAAO;AAEN,YAAI,QAAQ,KAAK,IAAI;UACpB,UAAU,SAAS;UACnB,SACC;UACD,OAAO;SACP;AACD;MACD;AAEA,iBAAWC,aAAY,yBAAyB;AAS/C,YAAI,KAAK,iBAAiBA,SAAQ,MAAM;AAAO;AAG/C,YACC,CAAC,iBAAiB,wBAAwBA,SAAQ,GACjD;AACD,cAAI,QAAQ,KAAK,IAAI;YACpB,UAAU,SAAS;YACnB,SAAS,iDACR,iCACC,2BACAA,SAAQ,CAEV;YACA,OAAO;WACP;AACD;QACD;AAEA,YAAI,QAAQ,KAAK,IAAI;UACpB,UAAU,SAAS;UACnB,SAAS,6CACR,iCACC,2BACAA,SAAQ,CAEV;UACA,WAAW;SACX;AAGD,YAAI;AAEJ,cAAM,eAAe,KAAK,kBAAkB,IAAI,IAAI;AACpD,iBAAS,WAAW,GAAG,YAAY,cAAc,YAAY;AAC5D,cAAI;AACH,2BAAe,MAAM,IAAI,qBAAqBA,SAAQ;UACvD,SAAS,GAAG;AACX,oBACC,0BAAa,CAAC,KACX,EAAE,SAAS,4BAAgB,0BAC7B;AAGD,6BAAe;YAChB,OAAO;AACN,oBAAM;YACP;UACD;AAEA,cACC,gBAAgB,UACb,wBAAwB,WAAW,GACrC;AACD,gBAAI,WAAW,cAAc;AAE5B,kBAAI,QAAQ,KAAK,IAAI;gBACpB,UAAU,SAAS;gBACnB,SAAS,6CACR,iCACC,2BACAA,SAAQ,CAEV,cAAc,QAAQ,IAAI,YAAY;gBACtC,OAAO;eACP;AACD,wBAAM,mBAAK,GAAG;AACd;YACD,WAAW,SAAS,QAAQ,GAAG;AAC9B,kBAAI,QAAQ,KAAK,IAAI;gBACpB,UAAU,SAAS;gBACnB,SAAS,6CACR,iCACC,2BACAA,SAAQ,CAEV;gBACA,OAAO;eACP;AAID,yBAAW,CAAC,IAAI,KAAK,SAAS,OAAM,GAAI;AACvC,yBAAS,MAAM,MAAM,EAAE,QAAQ,KAAI,CAAE;cACtC;AAEA;YACD,OAAO;AACN,kBAAI,QAAQ,KAAK,IAAI;gBACpB,UAAU,SAAS;gBACnB,SAAS,6CACR,iCACC,2BACAA,SAAQ,CAEV;gBACA,OAAO;eACP;AACD;YACD;UACD,OAAO;AAEN;UACD;QACD;AAEA,YAAI,gBAAgB,QAAW;AAC9B,cACC,SAAS,UAAU,KAChB,wBAAwB,SAAS,GACnC;AAGD,iBAAK,iBAAiBA,WAAU,KAAK;AAErC,gBAAI,QAAQ,KAAK,IAAI;cACpB,SAAS,mDACR,iCACC,2BACAA,SAAQ,CAEV;cACA,WAAW;aACX;UACF;AACA;QACD;AAEA,YAAI,SAAS,UAAU,KAAK,wBAAwB,SAAS,GAAG;AAE/D,eAAK,iBAAiBA,WAAU,IAAI;AAEpC,cAAI,QAAQ,KAAK,IAAI;YACpB,SAAS,+CACR,iCACC,2BACAA,SAAQ,CAEV;YACA,WAAW;WACX;QACF;AAEA,YAAI,CAAC,6BAA6B,aAAa,SAAS,GAAG;AAC1D,sCAA4B;AAE5B,gBAAM,WAAqB;YAC1B,iCACC,iCACC,2BACAA,SAAQ,CAEV;YACA;;AAED,qBAAW,MAAM,cAAc;AAC9B,qBAAS,KAAK,YAAK,uBAAU,EAAE,CAAC,EAAE;UACnC;AACA,cAAI,QAAQ,KAAK,IAAI;YACpB,UAAU,SAAS;YACnB,SAAS,SAAS,KAAK,IAAI;YAC3B,WAAW;WACX;AAGD,qBAAW,MAAM,cAAc;AAI9B,gBAAI,OAAO,2BAAe,OAAO;AAChC,uBAAS,MAAM,IAAI,EAAE,QAAQ,KAAI,CAAE;YACpC,OAAO;AACN,uBAAS,MAAM,IAAI;gBAClB,aAAa;gBACb,QAAQ;eACR;YACF;UACD;QACD;MACD;AAGA,WAAK,qBAAqB,KAAK,IAAI;IACpC;;IAGO,OAAO,sBAAsB,IAAgB;AAEnD,UAAI,EAAE,GAAG,qBAAqB,+BAAmB,WAAW;AAC3D,eAAO;MACR;AAEA,UACC,cAAc,gCACX,cAAc,0BACd,cAAc,8CAChB;AACD,eAAO;MACR;AAEA,UAAI,cAAcC,cAAa;AAE9B,gBAAQ,GAAG,WAAW;UACrB,KAAK,8BAAiB;UACtB,KAAK,8BAAiB;UACtB,KAAK,8BAAiB;UACtB,KAAK,8BAAiB;UACtB,KAAK,8BAAiB;UACtB,KAAK,8BAAiB;AACrB,mBAAO;UAER,KAAK,8BAAiB;UACtB,KAAK,8BAAiB;AAErB,mBAAQ,GACN;UAEH,KAAK,8BAAiB,SAAS;AAC9B,oBAAS,GAA0B,UAAU;cAC5C,KAAK,2BAAY;cACjB,KAAK,2BAAY;cACjB,KAAK,2BAAY;cACjB,KAAK,2BAAY;AAChB,uBAAO;cACR;AACC,uBAAO;YACT;UACD;QACD;AACA,eAAO;MACR;AAGA,aAAO;IACR;;IAGO,OAAO,YACb,IACA,WACA,kBACA,SAKC;AAGD,YAAM,aAAmC,CAAA;AACzC,UAAI,SAAS,oBAAoB;AAChC,mBAAW,KAAK,IAAI,8BAAY,CAAE;MACnC;AACA,UAAI,SAAS,oBAAoB,QAAW;AAC3C,mBAAW,KACV,IAAI,+BAAc,EAAE,SAAS,QAAQ,iBAAgB,CAAE,CAAC;MAE1D;AAIA,UAAI;AACJ,UAAI,GAAG,YAAW,GAAI;AACrB,YAAI,GAAG,OAAO,KAAK,CAACC,gBAAW,+BAAkBA,OAAM,CAAC,GAAG;AAC1D,mBAAS;QACV,OAAO;AACN,mBAAS;QACV;MACD,OAAO;AACN,iBAAS,GAAG;MACb;AAEA,YAAM,MAAM,IAAI,gCAAgC;QAC/C;QACA,cAAc;QACd,eAAe,SAAS;QACxB;QACA,gBAAgB,SAAS;OACzB;AAID,UAAI,qBAAqB,GAAG,qBACzB,CAAC,+BAAmB;AAEvB,aAAO;IACR;;;;AAGD,SAAS,aAAU;AAClB,8BAAgB,KAAK,4BAAgB,kBAAkB;AACxD;AAFS;AAIT,SAAS,aAAU;AAClB,8BAAgB,KAAK,4BAAgB,kBAAkB;AACxD;AAFS;AA0BT,SAAS,qCACR,KACA,MAAqC;AAErC,MAAI,KAAK,cAAc,kBAAkB,GAAG,GAAG;AAC9C,UAAM,MAAM;MACX;MACA;;AAGD,QACC,KAAK,wBAAwB,qBAC1B,KAAK,wBAAwB,wBAC7B,KAAK,wBAAwB,4BAC7B,KAAK,wBAAwB,+BAC7B,KAAK,wBAAwB,6BAC/B;AACD,UAAI,KAAK,kBAAyB;IACnC;AAEA,WAAO;EACR;AACD;AAtBS;AAwBT,SAAS,sCACR,MACA,UAGqB;AAErB,MAAI,oBAAoB,iCAAiC;AACxD,WAAO;EACR,WAAW,oBAAoB,oBAAoB;AAClD,WAAO;EACR,OAAO;AACN,WAAO,SAAS,OAAO,CAAC,CAAC,SAAS;EACnC;AACD;AAdS;IAqBI,mCAA+B,MAAA;8BAL3C,yCAAU,8BAAiB,oBAAoB,OAC/C,kDACA,sCACA,qCAAqC,CACrC;;;;oBACoD;uDAAA,YAAW;WAAA;;;;;;;;AAAhE,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;IACZ,YACC,SAA4D;AAE5D,YAAM,OAAO;AAEb,UAAI,CAAC,QAAQ,gBAAgB,CAAC,QAAQ,YAAY,QAAQ;AACzD,cAAM,IAAI,uBACT,2EACA,4BAAgB,gBAAgB;MAElC;AAEA,WAAK,iBAAiB,QAAQ;AAE9B,WAAK,gBAAgB,QAAQ;AAC7B,UAAI,QAAQ,cAAc;AACzB,aAAK,eAAe,QAAQ;AAC5B,gBAAQ,aAAa,kBAAkB;MACxC;AAEA,WAAK,iBAAiB,QAAQ,mBAAmB;AAEjD,WAAK,aAAa,QAAQ,cAAc,CAAA;AACxC,UACC,OAAO,KAAK,WAAW,YACpB,CAAC,KAAK,WAAW,KAAK,CAAC,MAAM,aAAa,8BAAa,GACzD;AACD,cAAM,IAAI,uBACT,mEACA,4BAAgB,4BAA4B;MAE9C;IACD;IAEO,aAAa,KACnB,KACA,KAAqB;AAErB,YAAM,kBAAkB,iBAAiB,GAAG;AAE5C,uCAAgB,IAAI,QAAQ,UAAU,CAAC;AAEvC,YAAM,iBAAqC,IAAI,QAAQ,CAAC;AAGxD,kCAAgB,WAAW,2BAA2B,EACrD,IAAI,wBACH,IAAI,YAAY,MACX,0BAAc,IAAI;AAGzB,YAAM,gBAAgB,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI;AAC1C,YAAM,yBAAyB,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI;AAEnD,UAAI,SAAS;AACb,YAAM,aAAmC,CAAA;AACzC,UAAI,qBAAqB;AAEzB,UAAI,eAAe;AAClB,cAAM,cAAc,gBACnB,IAAI,QAAQ,SAAS,MAAM,GAC3B,KAAK;AAEN,mBAAW,KAAK,GAAG,YAAY,UAAU;AACzC,kBAAU,YAAY;AACtB,6BAAqB,YAAY;MAClC;AAEA,YAAM,SAAS,MAAuB;AACrC,cAAM,mBAAmB,oBAAoB,UAAU;AACvD,YACC,IAAI,cAAc,eAAe,IAAI,cAAc,aAClD;AACD,cAAI,oBAAoB,QAAW;AAClC,wCAAgB,KACf,yCAAyC;UAE3C;AACA,iBAAO;YACN,aAAa;YACb,SAAS;;QAEX,OAAO;AACN,iBAAO,EAAE,aAAa,OAAO,SAAS,iBAAgB;QACvD;MACD,GAAE;AAIF,UAAI,oBAAoB;AACvB,YAAI,MAAM,aAAa;AACtB,gBAAM,gBAAgB,aACrB,IAAI,cACJ,MAAM,OAAO;QAEf,OAAO;AACN,gBAAM,gBAAgB,UAAU,IAAI,YAAY;QACjD;AACA,oCAAgB,KACf,sBAAsB;MAExB;AAEA,UAAI;AACJ,UAAI;AAGJ,UAAI,MAAM,aAAa;AACtB,oBAAY,gBAAgB,YAC3B,IAAI,cACJ,MAAM,OAAO;MAEf,OAAO;AAEN,6BAAqB,uBACpB,iBACA,IAAI,cACJ,cAAc;AAKf,YAAI,MAAM,WAAW,QAAW;AAC/B,0BAAgB,oBACf,IAAI,YAAY;QAElB;MACD;AAEA,YAAM,qBAAqB,IAAI,QAAQ,SAAS,GAAG,MAAM;AACzD,YAAM,aAAa,IAAI,QAAQ,SAC9B,QACA,CAAC,2BAA2B;AAE7B,YAAM,UAAU,IAAI,QAAQ,SAAS,CAAC,2BAA2B;AACjE,YAAM,gBACL,IACE,IAAI,QAAQ;AAEf,YAAM,WAAW,sBAChB,IAAI,cACJ,mBAAmB,KAAK,UAAU,GAClC,IAAI,QACJ,eACA,kBAAkB;AAGnB,UAAI;AACJ,UAAI,MAAM,aAAa;AAEtB,YAAI,WAAW,SAAS,sBAAU,MAAM;AAEvC,0BAAgB,cACf,IAAI,cACJ,MAAM,SACN,EAAE,MAAM,sBAAU,UAAS,CAAE;AAE9B,qBAAU;QACX;AAEA,kBAAU,6BACT,iBACC,IAAI,cACJ,iBACA,MAAM,SACN,YACA,UACA,OAAO,GAPC;MASX,OAAO;AAEN,cAAM,YAAY,gBAAgB,aACjC,IAAI,YAAY;AAIjB,YAAI,UAAU,SAAS,sBAAU,MAAM;AACtC,qBAAU;QACX,WAAW,UAAU,SAAS,sBAAU,UAAU;AAGjD,qBAAU;QACX;AAEA,kBAAU,6BACT,kBACC,KACA,iBACA,IAAI,cACJ,gBACA,oBACA,YACA,UACA,SACA,WACA,UAAU,GAXF;MAaX;AAEA,UAAI;AACJ,UAAI,SAAS;AACb,UAAI;AACJ,UAAI;AACJ,UAAI;AASJ,YAAM,kBAAkB,MAAM,cAC3B,iCACA,MAAM,WAAW,SACjB,mCACA;AAEH,eAAS,IAAI,GAAG,IAAI,iBAAiB,KAAK;AACzC,SAAC;UACA;UACA;UACA;UACA;UACA,eAAe;YACZ,MAAM,QAAO;AACjB,YAAI,CAAC,CAAC,UAAU,CAAC,CAAC;AAAW;AAE7B,YAAI,CAAC,CAAC,YAAY,UAAU;AAAG;MAChC;AAIA,UAAI,CAAC,UAAU,CAAC,WAAW;AAC1B,YAAI,MAAM,aAAa;AAEtB,0BAAgB,cACf,IAAI,cACJ,MAAM,SACN,EAAE,MAAM,sBAAU,UAAS,CAAE;AAE9B,sCAAgB,KACf,4BAAgB,iCAAiC;QAEnD,OAAO;AACN,sCAAgB,KACf,4BAAgB,wBAAwB;QAE1C;MACD,WAAW,CAAC,MAAM,eAAe,MAAM,WAAW,QAAW;AAE5D,wBAAgB,qBACf,IAAI,cACJ,MAAM,OAAO;MAEf;AAGA,YAAM,gBACL;AAED,eAAS;AACT,UAAI,wBAAwB;AAC3B,cAAM,cAAc,gBAAgB,WAAW,IAAI;AACnD,mBAAW,KAAK,GAAG,YAAY,UAAU;AACzC,kBAAU,YAAY;AACtB,6BAAqB,YAAY;MAClC;AAGA,UAAI,oBAAoB;AACvB,oCAAgB,KAAK,mBAAmB;MACzC;AAGA,YAAM,gBAAgB,WAAW,KAAK,CAAC,MACtC,aAAa,8BAAa;AAE3B,UAAI,MAAM,WAAW,UAAa,eAAe;AAChD,oCAAgB,KAAK,mCAAmC;MACzD;AAGA,UAAI,CAAC,MAAM,aAAa;AACvB,cAAMC,iBAAgB,WAAW,KAAK,CAAC,MACtC,aAAa,8BAAa;AAE3B,YAAIA,gBAAe;AAClB,0BAAgB,cACf,IAAI,cACJA,eAAc,SACd;YACC,MAAM,sBAAU;YAChB,aAAaA,eAAc;WAC3B;QAEH;MACD;AAGA,YAAM,mBAAmB,UAAU,SAAS,MAAM;AAClD,UAAI;AACJ,UAAI,iBAAiB,SAAS,GAAG;AAEhC,yCAAgB,iBAAiB,UAAU,CAAC;AAE5C,uBAAe,MAAM,iCAAa,MAAM,kBAAkB,GAAG;MAC9D;AAEA,YAAM,MAAM,IAAIC,iCAAgC;QAC/C,QAAQ,IAAI;QACZ;QACA;QACA;QACA;OACA;AAGD,UAAI,MAAM;AACV,UAAI,KAAK;AACT,UAAI,WAAW;AACf,UAAI,UAAU;AACd,UAAI,YAAY;AAEhB,aAAO;IACR;IAEgB;;IAGR;IACA;IACA;IACA;IACA;IACA;IAEQ,iBAA0B;IAEnC;IACC,qBACP,iBAAiC;AAIjC,UAAI,KAAK,kBAAkB,QAAW;AACrC,YAAI,KAAK,aAAY,GAAI;AACxB,eAAK,iBAAiB,gBAAgB,mBACrC,KAAK,MAAM;QAEb,OAAO;AACN,gBAAM,UAAU,mBAAmB,KAAK,IAAI;AAC5C,eAAK,iBAAiB,gBACpB,4BACA,OAAO;QAEV;MACD;IACD;IAEO;IACA;IAES,wBAAqB;AACpC,YAAM,sBAAqB;AAC3B,WAAK,iBAAiB;IACvB;IAEO,kBAAe;AACrB,aAAO,KAAK,WAAW,KAAK,CAAC,MAAM,aAAa,6BAAY;IAC7D;;IAGO,cAAW;AACjB,aAAO,YAAY,KAAK,UAAU;IACnC;;IAGO,sBAAmB;AACzB,aAAO,oBAAoB,KAAK,UAAU;IAC3C;IAEQ,MAAM,sBACb,KACA,iBAAiC;AAEjC,UAAI,CAAC,KAAK,aAAY;AAAI;AAE1B,YAAM,iBAAyB,KAAK;AACpC,YAAM,YAAY,gBAAgB,aACjC,cAAc;AAGf,UACC,UAAU,SAAS,sBAAU,QAC1B,UAAU,SAAS,sBAAU,SAC/B;AAED,cAAM,IAAI,uBACT,4DACA,4BAAgB,kBAAkB;MAEpC,WAAW,UAAU,SAAS,sBAAU,UAAU;AAGjD,cAAM,WAAW,MAAM,gBAAgB,cACtC,MAAS;AAEV,cAAM,aAAa,UAAU;AAI7B,YACC,KAAK,iBAAiB,UACnB,gBAAgB,SAAS,IAAI,cAAc,GAC7C;AACD,gBAAM,gBAAgB,mBACrB,gBACA,UACA,UAAU;QAEZ,OAAO;AACN,gBAAM,gBAAgB,KAAK,iBACvB,IAAI,wBAAwB,cAAc;AAE9C,cAAI,iBAAiB,QAAW;AAC/B,kBAAM,IAAI,uBACT,+CACA,4BAAgB,kBAAkB;UAEpC;AACA,gBAAM,gBAAgB,eACrB,gBACA,eACA,UACA,UAAU;QAEZ;AAGA,YAAI,gBAAgB,KAAK,WAAW,KACnC,CAAC,MAAM,aAAa,8BAAa;AAElC,YAAI,eAAe;AAClB,wBAAc,WAAW;QAC1B,OAAO;AACN,0BAAgB,IAAI,+BAAc,EAAE,SAAQ,CAAE;AAC9C,eAAK,WAAW,KAAK,aAAa;QACnC;MACD;IACD;IAEO,MAAM,UAAU,KAAsB;AAC5C,YAAM,kBAAkB,iBAAiB,KAAK,KAAK,MAAM;AACzD,WAAK,qBAAqB,eAAe;AAGzC,YAAM,KAAK,sBAAsB,KAAK,eAAe;AAErD,YAAM,wBAAwB,KAAK,WAAW,OAC7C,CAAC,MAAM,CAAC,EAAE,YAAW,CAAE;AAExB,YAAM,sBAAsB,KAAK,WAAW,OAAO,CAAC,MACnD,EAAE,YAAW,CAAE;AAGhB,YAAM,qBAAqB,oBAAM,OAAO;QACvC;UACC,KAAK;WACJ,oBAAoB,SAAS,IAAI,IAAO,MACtC,sBAAsB,SAAS,IAAI,IAAI;;QAE3C,GAAG,sBAAsB,IAAI,CAAC,GAAG,UAChC,EAAE,UAAU,QAAQ,sBAAsB,SAAS,CAAC,CAAC;OAEtD;AACD,YAAM,eAAgB,MAAM,KAAK,cAAc,UAAU,GAAG,KACxD,IAAI,oBAAK;AACb,YAAM,mBAAmB,oBAAM,OAAO;QACrC,GAAG,oBAAoB,IAAI,CAAC,GAAG,UAC9B,EAAE,UAAU,QAAQ,oBAAoB,SAAS,CAAC,CAAC;QAEpD;OACA;AAGD,YAAM,iBAAiB,mBAAmB,KACzC,IAAuC;AAExC,YAAM,gBAAgB,KAAK,6BAA4B,IACpD,aAAa;AAChB,YAAM,WAAW,sBAChB,IAAI,WACJ,gBACA,IAAI,QACJ,eACA,kBAAkB;AAGnB,UAAI;AACJ,UAAI;AAEJ,UAAI,KAAK,aAAY,GAAI;AAIxB,aAAK,MAAM,gBAAgB,UAAU,KAAK,QAAQ,IAAI;AACtD,cAAM,EAAE,OAAM;;UAEb,KAAK,iBAAiB,SACnB,gBAAgB,wBACjB,KAAK,aAAa,IAEjB,gBAAgB,eAAe,KAAK,MAAM;;AAC9C,cAAM;MACP,OAAO;AAEN,cAAM,WAAW,MAAM,gBAAgB,qBACtC,cAAc;AAEf,cAAM,SAAS;AACf,aAAK,SAAS;MACf;AAEA,YAAM,EAAE,YAAY,mBAAmB,QAAO,IAC7C,UAAM,8BACL,kBACA,KACA,IACA,UACA,2BAA2B;AAI7B,WAAK,MAAM;AACX,WAAK,KAAK;AACV,WAAK,WAAW;AAChB,WAAK,UAAU;AACf,WAAK,aAAa;AAElB,WAAK,UAAU,oBAAM,OAAO;QAC3B;QACA;QACA;OACA;AACD,aAAO,MAAM,UAAU,GAAG;IAC3B;IAEU,+BAA4B;AAMrC,YAAM,iBAAiB,KAAK,WAC1B,IAAI,CAAC,MAAM,EAAE,cAAa,CAAE,EAC5B,OAAO,CAAC,GAAG,MAAM,IAAI,GAAG,CAAC;AAE3B,aACC,MAAM,6BAA4B,IAChC,IACA,8BACA;IAEJ;IAEO,WAAW,KAAgB;AACjC,YAAM,UAAyB;QAC9B,mBAAmB,KAAK,kBAAkB;;AAE3C,UAAI,KAAK,WAAW,SAAS,GAAG;AAC/B,gBAAQ,aAAa,KAAK,WACxB,IAAI,CAAC,MAAM,EAAE,WAAU,CAAE,EACzB,KAAK,EAAE;MACV;AAEA,UACC,QAAQ,IAAI,aAAa,UACtB,QAAQ,IAAI,aAAa,eAC3B;AACD,YAAI,KAAK,KAAK;AACb,kBAAQ,UAAM,0BAAW,KAAK,GAAG;QAClC;AACA,YAAI,KAAK,IAAI;AACZ,kBAAQ,SAAK,0BAAW,KAAK,EAAE;QAChC;AACA,YAAI,KAAK,YAAY;AACpB,kBAAQ,iBAAa,0BAAW,KAAK,UAAU;QAChD,WAAW,KAAK,WAAW;AAC1B,kBAAQ,gBAAY,0BAAW,KAAK,SAAS;QAC9C;AACA,YAAI,KAAK,UAAU;AAClB,kBAAQ,WAAW,QAAI,0BAAW,KAAK,QAAQ;QAChD;AACA,YAAI,KAAK,SAAS;AACjB,kBAAQ,UAAU,QAAI,0BAAW,KAAK,OAAO;QAC9C;MACD;AAEA,UAAI,KAAK,iBAAiB,QAAW;AACpC,gBAAQ,gBAAgB,QAAI,iCAC3B,2BACA,KAAK,aAAa;MAEpB;AAEA,aAAO;QACN,GAAG,MAAM,WAAW,GAAG;QACvB;;IAEF;;;;IAsBY,0BAAsB,MAAA;8BADlC,yCAAU,8BAAiB,WAAW,CAAC;;;;oBACI;8CAAA,YAAW;WAAA;;;;;;;;AAAvD,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;IACZ,YACC,SAAmD;AAEnD,YAAM,OAAO;AAEb,WAAK,MAAM,QAAQ;AACnB,WAAK,MAAM,QAAQ;AACnB,WAAK,iBAAiB,QAAQ;AAC9B,UAAI,QAAQ;AAAK,aAAK,aAAa,QAAQ;IAC5C;IAEO,OAAO,KACb,KACA,KAAqB;AAGrB,YAAM,kBAAkB,iBAAiB,GAAG;AAE5C,uCAAgB,IAAI,QAAQ,UAAU,CAAC;AACvC,YAAM,iBAAiB,IAAI,QAAQ,CAAC;AAGpC,6BACC,iBACA,IAAI,cACJ,cAAc;AAEf,YAAM,MAAM,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI;AAChC,YAAM,MAAM,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI;AAEhC,UAAI,KAAK;AAER,yCAAgB,IAAI,QAAQ,UAAU,EAAE;AACxC,cAAM,aAAa,IAAI,QAAQ,SAAS,GAAG,EAAE;AAI7C,wBAAgB,cACf,IAAI,cACJ,UAAU;AAGX,eAAO,IAAI,KAAK;UACf,QAAQ,IAAI;UACZ;UACA;UACA;UACA;SACA;MACF,WAAW,KAAK;AACf,eAAO,IAAI,KAAK;UACf,QAAQ,IAAI;UACZ;UACA;UACA,KAAK;SACL;MACF,OAAO;AACN,oCAAgB,KAAK,+BAA+B;MACrD;IACD;IAEO;IACC,qBACP,iBAAiC;AAIjC,UAAI,KAAK,kBAAkB,QAAW;AACrC,aAAK,iBAAiB,gBAAgB,mBACrC,KAAK,MAAgB;MAEvB;IACD;IAEgB;IACA;IACA;IAET,UAAU,KAAsB;AACtC,YAAM,kBAAkB,iBAAiB,KAAK,KAAK,MAAM;AACzD,WAAK,qBAAqB,eAAe;AAEzC,WAAK,UAAU,oBAAM,KAAK;QACzB,KAAK;SACJ,KAAK,MAAM,IAAO,MAAM,KAAK,MAAM,IAAM;OAC1C;AACD,UAAI,KAAK,KAAK;AACb,aAAK,UAAU,oBAAM,OAAO,CAAC,KAAK,SAAS,KAAK,UAAW,CAAC;MAC7D;AACA,aAAO,MAAM,UAAU,GAAG;IAC3B;IAEO,WAAW,KAAgB;AACjC,YAAM,UAAyB;QAC9B,mBAAmB,KAAK,kBAAkB;QAC1C,KAAK,KAAK;QACV,KAAK,KAAK;;AAEX,UAAI,KAAK,YAAY;AACpB,gBAAQ,kBAAkB,QAAI,0BAAW,KAAK,UAAU;MACzD;AACA,aAAO;QACN,GAAG,MAAM,WAAW,GAAG;QACvB;;IAEF;;;;IAUY,uBAAmB,MAAA;8BAF/B,yCAAU,8BAAiB,QAAQ,OACnC,kDAAmB,sBAAsB,CAAC;;;;oBACF;2CAAA,YAAW;WAAA;;;;;;;;AAApD,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;;;IAIZ,YACC,SAAgD;AAEhD,YAAM,OAAO;AACb,WAAK,iBAAiB,QAAQ;IAC/B;IAEO,OAAO,KAAK,KAAY,KAAqB;AACnD,YAAM,kBAAkB,iBAAiB,GAAG;AAE5C,uCAAgB,IAAI,QAAQ,UAAU,CAAC;AACvC,YAAM,iBAAiB,IAAI,QAAQ,CAAC;AAGpC,6BACC,iBACA,IAAI,cACJ,cAAc;AAGf,aAAO,IAAI,KAAK;QACf,QAAQ,IAAI;QACZ;OACA;IACF;IAEO;IACC,qBACP,iBAAiC;AAIjC,UAAI,KAAK,kBAAkB,QAAW;AACrC,aAAK,iBAAiB,gBAAgB,mBACrC,KAAK,MAAgB;MAEvB;IACD;IAEO,UAAU,KAAsB;AACtC,YAAM,kBAAkB,iBAAiB,KAAK,KAAK,MAAM;AACzD,WAAK,qBAAqB,eAAe;AAEzC,WAAK,UAAU,oBAAM,KAAK,CAAC,KAAK,cAAc,CAAC;AAC/C,aAAO,MAAM,UAAU,GAAG;IAC3B;IAEO,WAAW,KAAgB;AACjC,aAAO;QACN,GAAG,MAAM,WAAW,GAAG;QACvB,SAAS;UACR,mBAAmB,KAAK,kBAAkB;;;IAG7C;;;;IAcY,wBAAoB,MAAA;8BADhC,yCAAU,8BAAiB,SAAS,CAAC;;;;oBACI;4CAAA,YAAW;WAAA;;;;;;;;AAArD,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;IACZ,YACC,SAAiD;AAEjD,YAAM,OAAO;AACb,WAAK,aAAa,QAAQ;AAC1B,WAAK,OAAO,QAAQ;AACpB,WAAK,YAAY,QAAQ,aAAa;AACtC,WAAK,sBAAsB,QAAQ;AACnC,WAAK,wBAAwB,QAAQ;AACrC,WAAK,gBAAgB,QAAQ;IAC9B;IAEO,OAAO,KACb,KACA,KAAqB;AAErB,uCAAgB,IAAI,QAAQ,UAAU,CAAC;AACvC,YAAM,aAAa,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI;AACvC,YAAM,OAAO,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI;AAGjC,YAAM,YAAY,IAAI,QAAQ,CAAC,IAAI;AAGnC,YAAM,0BAAoC,0BACzC,IAAI,QAAQ,SAAS,GAAG,CAAC,GACzB,CAAC,EACA,OAAO,CAAC,MAAM,MAAM,CAAC;AACvB,YAAM,4BAAwC,0BAC7C,IAAI,QAAQ,SAAS,GAAG,CAAC,GACzB,4BAAa,UAAU;AAExB,YAAM,oBAAiC,0BACtC,IAAI,QAAQ,SAAS,GAAG,CAAC,GACzB,0BAAc,kBAAkB;AAGjC,aAAO,IAAI,KAAK;QACf,QAAQ,IAAI;QACZ;QACA;QACA;QACA;QACA;QACA;OACA;IACF;IAEgB;IACA;IACA;IACA;IACA;IACA;IAET,UAAU,KAAsB;AACtC,WAAK,UAAU,oBAAM,OAAO;QAC3B;UACC,KAAK,aACF,KAAK,aAAa,IAAO,MACzB,KAAK,OAAO,IAAM;;;YAGtB,2BAAc,KAAK,qBAAqB,GAAG,CAAC;YAC5C,2BACC,KAAK,uBACL,GACA,4BAAa,UAAU;YAExB,2BACC,KAAK,eACL,0BAAc,WACd,0BAAc,kBAAkB;OAEjC;AACD,aAAO,MAAM,UAAU,GAAG;IAC3B;IAEO,WAAW,KAAgB;AACjC,aAAO;QACN,GAAG,MAAM,WAAW,GAAG;QACvB,SAAS;UACR,MAAM,KAAK;UACX,qBAAqB,KAAK,oBACxB,IAAI,CAAC,MAAM;WAAO,iCAAkB,2BAAY,CAAC,CAAC,EAAE,EACpD,KAAK,EAAE;UACT,2BAA2B,KAAK,sBAC9B,IAAI,CAAC,MAAM;WAAO,iCAAkB,6BAAc,CAAC,CAAC,EAAE,EACtD,KAAK,EAAE;UACT,iBAAiB,KAAK;UACtB,8BAA8B,KAAK,cACjC,IAAI,CAAC,MAAM;WAAO,iCAAkB,2BAAe,CAAC,CAAC,EAAE,EACvD,KAAK,EAAE;;;IAGZ;;;;IAKY,qBAAiB,MAAA;8BAF7B,yCAAU,8BAAiB,MAAM,OACjC,kDAAmB,oBAAoB,CAAC;;;;oBACF;yCAAA,YAAW;WAAA;;;;;;;;AAAlD,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;;;;AAYb,SAAS,6BACR,KACA,MAAuB;AAEvB,MAAI,KAAK,MAAM;AACd,WAAO,CAAC,sBAAsB,kBAAkB;EACjD,OAAO;AACN,WAAO;EACR;AACD;AATS;AAWT,SAAS,8BACR,MACA,UAAa;AAEb,MAAI,KAAK,MAAM;AACd,QAAI,oBAAoB,sBAAsB;AAC7C,aAAO,SAAS;IACjB,WAAW,oBAAoB,oBAAoB;AAClD,aAAO;IACR;EACD;AACA,SAAO;AACR;AAZS;IAgBI,qBAAiB,MAAA;8BAF7B,yCAAU,8BAAiB,MAAM,OACjC,kDAAmB,8BAA8B,6BAA6B,CAAC;;;;oBACzC;yCAAA,YAAW;WAAA;;;;;;;;AAAlD,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;IACZ,YACC,SAA8C;AAE9C,YAAM,OAAO;AACb,WAAK,YAAY,QAAQ;AACzB,WAAK,OAAO,QAAQ;AACpB,WAAK,YAAY,QAAQ,aAAa;AACtC,WAAK,oBAAoB,QAAQ;AACjC,WAAK,sBAAsB,QAAQ;AACnC,WAAK,cAAc,QAAQ;IAC5B;IAEO,OAAO,KAAK,KAAY,KAAqB;AACnD,uCAAgB,IAAI,QAAQ,UAAU,CAAC;AACvC,YAAM,YAAY,IAAI,QAAQ,CAAC,IAAI;AACnC,YAAM,YAAY,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI;AACtC,YAAM,OAAO,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI;AAGjC,YAAM,yBAAqB,0BAC1B,IAAI,QAAQ,SAAS,GAAG,CAAC,GACzB,CAAC,EACA,OAAO,CAAC,MAAM,MAAM,CAAC;AACvB,uCAAgB,mBAAmB,WAAW,CAAC;AAC/C,YAAM,oBAAgC,mBAAmB,CAAC;AAC1D,YAAM,2BAAuB,0BAC5B,IAAI,QAAQ,SAAS,GAAG,CAAC,GACzB,4BAAa,UAAU;AAExB,uCAAgB,qBAAqB,WAAW,CAAC;AACjD,YAAM,sBAAoC,qBAAqB,CAAC;AAChE,YAAM,kBAA+B,0BACpC,IAAI,QAAQ,SAAS,GAAG,CAAC,GACzB,0BAAc,kBAAkB;AAGjC,aAAO,IAAI,KAAK;QACf,QAAQ,IAAI;QACZ;QACA;QACA;QACA;QACA;QACA;OACA;IACF;IAEgB;IACT;IACA;IACA;IACA;IACA;IAEA,UAAU,KAAsB;AACtC,WAAK,UAAU,oBAAM,OAAO;QAC3B;UACC,KAAK,aACF,KAAK,YAAY,IAAO,MACxB,KAAK,OAAO,IAAM;;;YAGtB,2BAAc,CAAC,KAAK,iBAAiB,GAAG,GAAG,CAAC;YAC5C,2BACC,CAAC,KAAK,mBAAmB,GACzB,GACA,4BAAa,UAAU;YAExB,2BACC,KAAK,aACL,0BAAc,WACd,0BAAc,kBAAkB;OAEjC;AACD,aAAO,MAAM,UAAU,GAAG;IAC3B;IAEO,WAAW,KAAgB;AACjC,aAAO;QACN,GAAG,MAAM,WAAW,GAAG;QACvB,SAAS;UACR,MAAM,KAAK;UACX,uBAAmB,iCAClB,2BACA,KAAK,iBAAiB;UAEvB,6BAAyB,iCACxB,6BACA,KAAK,mBAAmB;UAEzB,iBAAiB,KAAK;UACtB,4BAA4B,KAAK,YAC/B,IAAI,CAAC,MAAM;WAAO,iCAAkB,2BAAe,CAAC,CAAC,EAAE,EACvD,KAAK,EAAE;;;IAGZ;;;;IASY,sBAAkB,MAAA;8BAD9B,yCAAU,8BAAiB,OAAO,CAAC;;;;oBACI;0CAAA,YAAW;WAAA;;;;;;;;AAAnD,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;IACZ,YACC,SAA+C;AAE/C,YAAM,OAAO;AACb,WAAK,WAAW,QAAQ;IACzB;IAEO,OAAO,KAAK,KAAY,KAAqB;AACnD,uCAAgB,IAAI,QAAQ,UAAU,CAAC;AACvC,YAAM,WAAwB,IAAI,QAAQ,CAAC;AAE3C,aAAO,IAAI,KAAK;QACf,QAAQ,IAAI;QACZ;OACA;IACF;IAEO;IAEA,UAAU,KAAsB;AACtC,WAAK,UAAU,oBAAM,KAAK,CAAC,KAAK,QAAQ,CAAC;AACzC,aAAO,MAAM,UAAU,GAAG;IAC3B;IAEO,WAAW,KAAgB;AACjC,aAAO;QACN,GAAG,MAAM,WAAW,GAAG;QACvB,SAAS,EAAE,YAAQ,iCAAkB,4BAAa,KAAK,QAAQ,EAAC;;IAElE;;;;IAUY,8BAA0B,MAAA;8BADtC,yCAAU,8BAAiB,eAAe,CAAC;;;;oBACI;kDAAA,YAAW;WAAA;;;;;;;;AAA3D,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;IACZ,YACC,SAAuD;AAEvD,YAAM,OAAO;AACb,WAAK,gBAAgB,QAAQ;AAC7B,WAAK,YAAY,QAAQ;IAC1B;IAEO,OAAO,KACb,KACA,KAAqB;AAErB,uCAAgB,IAAI,QAAQ,UAAU,EAAE;AACxC,YAAM,gBAAgB,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI;AAC1C,YAAM,YAAuB,IAAI,QAAQ,SAAS,CAAC;AAEnD,aAAO,IAAI,KAAK;QACf,QAAQ,IAAI;QACZ;QACA;OACA;IACF;IAEO;IACA;IAEA,UAAU,KAAsB;AACtC,WAAK,UAAU,oBAAM,OAAO;QAC3B,CAAC,KAAK,gBAAgB,IAAI,CAAC;QAC3B,KAAK;OACL;AACD,aAAO,MAAM,UAAU,GAAG;IAC3B;IAEO,WAAW,KAAgB;AACjC,aAAO;QACN,GAAG,MAAM,WAAW,GAAG;QACvB,SAAS;UACR,qBAAqB,KAAK;UAC1B,kBAAc,0BAAW,KAAK,SAAS;;;IAG1C;;;;IAUY,+BAA2B,MAAA;8BADvC,yCAAU,8BAAiB,gBAAgB,CAAC;;;;oBACI;mDAAA,YAAW;WAAA;;;;;;;;AAA5D,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;IACZ,YACC,SAAwD;AAExD,YAAM,OAAO;AACb,WAAK,aAAa,QAAQ;AAC1B,WAAK,aAAa,QAAQ;IAC3B;IAEO,OAAO,KACb,KACA,KAAqB;AAErB,uCAAgB,IAAI,QAAQ,UAAU,EAAE;AACxC,YAAM,aAA4B,uBACjC,IAAI,SACJ,CAAC;AAEF,YAAM,aAAa,IAAI,QAAQ,SAAS,GAAG,EAAE;AAE7C,aAAO,IAAI,KAAK;QACf,QAAQ,IAAI;QACZ;QACA;OACA;IACF;IAEO;IACA;IAEA,UAAU,KAAsB;AACtC,WAAK,UAAU,oBAAM,OAAO;QAC3B,uBAAuB,KAAK,UAAU;QACtC,KAAK;OACL;AACD,aAAO,MAAM,UAAU,GAAG;IAC3B;IAEO,WAAW,KAAgB;AACjC,aAAO;QACN,GAAG,MAAM,WAAW,GAAG;QACvB,SAAS;UACR,sBAAkB,iCACjB,2BACA,KAAK,UAAU;;;;;IAMnB;;;;IAWY,4BAAwB,MAAA;8BAHpC,yCAAU,8BAAiB,aAAa,CAAC;;;;oBAGI;gDAAA,YAAW;WAAA;;;;;;;;AAAzD,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;IACZ,YACC,SAAqD;AAErD,YAAM,OAAO;AACb,WAAK,eAAe,QAAQ;IAC7B;IAEO,OAAO,KACb,KACA,KAAqB;AAErB,uCAAgB,IAAI,QAAQ,UAAU,CAAC;AACvC,YAAM,eAA8B,uBACnC,IAAI,SACJ,CAAC;AAGF,aAAO,IAAI,KAAK;QACf,QAAQ,IAAI;QACZ;OACA;IACF;IAEO;IAEA,UAAU,KAAsB;AACtC,WAAK,UAAU,uBAAuB,KAAK,YAAY;AACvD,aAAO,MAAM,UAAU,GAAG;IAC3B;IAEO,WAAW,KAAgB;AACjC,aAAO;QACN,GAAG,MAAM,WAAW,GAAG;QACvB,SAAS;UACR,sBAAkB,iCACjB,2BACA,KAAK,YAAY;;;IAIrB;;;;IAIY,+BAA2B,MAAA;8BADvC,yCAAU,8BAAiB,gBAAgB,CAAC;;;;oBACI;mDAAA,YAAW;WAAA;;;;;;;;AAA5D,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;;;;IASA,0BAAsB,MAAA;8BADlC,yCAAU,8BAAiB,WAAW,CAAC;;;;oBACI;8CAAA,YAAW;WAAA;;;;;;;;AAAvD,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;IACZ,YACC,SAAmD;AAEnD,YAAM,OAAO;AACb,WAAK,cAAc,QAAQ;AAC3B,WAAK,qBAAqB,QAAQ;IACnC;IAEO,OAAO,KACb,KACA,KAAqB;AAErB,uCAAgB,IAAI,QAAQ,UAAU,CAAC;AACvC,YAAM,cAAc,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI;AACxC,YAAM,qBAAqB,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI;AAE/C,aAAO,IAAI,KAAK;QACf,QAAQ,IAAI;QACZ;QACA;OACA;IACF;IAEO;IACA;IAEA,UAAU,KAAsB;AACtC,WAAK,UAAU,oBAAM,KAAK;SACxB,KAAK,cAAc,IAAO,MAAM,KAAK,qBAAqB,IAAM;OACjE;AACD,aAAO,MAAM,UAAU,GAAG;IAC3B;IAEO,WAAW,KAAgB;AACjC,aAAO;QACN,GAAG,MAAM,WAAW,GAAG;QACvB,SAAS;UACR,gBAAgB,KAAK;UACrB,oBAAoB,KAAK;;;IAG5B;;;;IASY,sCAAkC,MAAA;8BAD9C,yCAAU,8BAAiB,uBAAuB,CAAC;;;;oBACI;0DAAA,YAAW;WAAA;;;;;;;;AAAnE,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;IACZ,YACC,SAA+D;AAE/D,YAAM,OAAO;AACb,WAAK,eAAe,QAAQ;IAC7B;IAEO,OAAO,KACb,KACA,KAAqB;AAErB,YAAM,UAAM,yBAAY,IAAI,OAAO;AAKnC,YAAM,eAAe,IAAI;AAEzB,aAAO,IAAI,KAAK;QACf,QAAQ,IAAI;QACZ;OACA;IACF;IAEgB;IAET,UAAU,KAAsB;AACtC,WAAK,cAAU,0BAAa,KAAK,cAAc,CAAA,CAAE;AACjD,aAAO,MAAM,UAAU,GAAG;IAC3B;IAEO,WAAW,KAAgB;AACjC,aAAO;QACN,GAAG,MAAM,WAAW,GAAG;QACvB,SAAS;UACR,iBAAiB,KAAK,aACpB,IAAI,CAAC,WAAO,uBAAU,EAAE,CAAC,EACzB,IAAI,CAAC,OAAO;OAAO,EAAE,EAAE,EACvB,KAAK,EAAE;;;IAGZ;;;;IAKY,mCAA+B,MAAA;8BAF3C,yCAAU,8BAAiB,oBAAoB,OAC/C,kDAAmB,kCAAkC,CAAC;;;;oBACF;uDAAA,YAAW;WAAA;;;;;;;;AAAhE,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;;;;",
+  "sources": ["../../../src_gen/cc/Security2CC.ts"],
+  "sourcesContent": ["import { CommandClasses, EncapsulationFlags, type GetNode, type GetValueDB, MPANState, type MaybeNotKnown, type MessageOrCCLogEntry, MessagePriority, type MessageRecord, type MulticastDestination, NODE_ID_BROADCAST, NODE_ID_BROADCAST_LR, type NodeId, type S2SecurityClass, SPANState, type SPANTableEntry, SecurityClass, type SecurityManager2, type SecurityManagers, type SupportsCC, TransmitOptions, type WithAddress, ZWaveError, ZWaveErrorCodes, decryptAES128CCM, encodeBitMask, encodeCCList, encryptAES128CCM, getCCName, highResTimestamp, isLongRangeNodeId, isTransmissionError, isZWaveError, parseBitMask, parseCCList, securityClassIsS2, securityClassOrder, validatePayload, } from \"@zwave-js/core\";\nimport { Bytes, type BytesView, buffer2hex, getEnumMemberName, pick, } from \"@zwave-js/shared\";\nimport { wait } from \"alcalzone-shared/async\";\nimport { isArray } from \"alcalzone-shared/typeguards\";\nimport { CCAPI } from \"../lib/API.js\";\nimport { type CCRaw, type CCResponseRole, CommandClass, type InterviewContext, } from \"../lib/CommandClass.js\";\nimport { API, CCCommand, commandClass, expectedCCResponse, implementedVersion, } from \"../lib/CommandClassDecorators.js\";\nimport { MGRPExtension, MOSExtension, MPANExtension, SPANExtension, Security2Extension, ValidateS2ExtensionResult, validateS2Extension, } from \"../lib/Security2/Extension.js\";\nimport { ECDHProfiles, KEXFailType, KEXSchemes, } from \"../lib/Security2/shared.js\";\nimport { Security2Command } from \"../lib/_Types.js\";\nimport type { CCEncodingContext, CCParsingContext } from \"../lib/traits.js\";\nimport { CRC16CC } from \"./CRC16CC.js\";\nimport { MultiChannelCC } from \"./MultiChannelCC.js\";\nimport { SecurityCC } from \"./SecurityCC.js\";\nimport { TransportServiceCC } from \"./TransportServiceCC.js\";\nfunction securityClassToBitMask(key: SecurityClass): Bytes {\n    return encodeBitMask([key], SecurityClass.S0_Legacy, SecurityClass.S2_Unauthenticated);\n}\nfunction bitMaskToSecurityClass(buffer: BytesView, offset: number): SecurityClass {\n    const keys = parseBitMask(buffer.subarray(offset, offset + 1), SecurityClass.S2_Unauthenticated);\n    validatePayload(keys.length === 1);\n    return keys[0];\n}\nconst SECURITY_S2_AUTH_TAG_LENGTH = 8;\nfunction getAuthenticationData(sendingNodeId: number, destination: number, homeId: number, commandLength: number, unencryptedPayload: BytesView): BytesView {\n    const nodeIdSize = isLongRangeNodeId(sendingNodeId) || isLongRangeNodeId(destination)\n        ? 2\n        : 1;\n    const ret = new Bytes(2 * nodeIdSize + 6 + unencryptedPayload.length);\n    let offset = 0;\n    ret.writeUIntBE(sendingNodeId, offset, nodeIdSize);\n    offset += nodeIdSize;\n    ret.writeUIntBE(destination, offset, nodeIdSize);\n    offset += nodeIdSize;\n    ret.writeUInt32BE(homeId, offset);\n    offset += 4;\n    ret.writeUInt16BE(commandLength, offset);\n    offset += 2;\n    // This includes the sequence number and all unencrypted extensions\n    ret.set(unencryptedPayload, offset);\n    return ret;\n}\nfunction getSecurityManager(ownNodeId: number, securityManagers: SecurityManagers, otherNodeId: MulticastDestination | number): SecurityManager2 | undefined {\n    const longRange = isLongRangeNodeId(ownNodeId)\n        || isLongRangeNodeId(isArray(otherNodeId) ? otherNodeId[0] : otherNodeId);\n    return longRange\n        ? securityManagers.securityManagerLR\n        : securityManagers.securityManager2;\n}\n/** Validates that a sequence number is not a duplicate and updates the SPAN table if it is accepted. Returns the previous sequence number if there is one. */\nfunction validateSequenceNumber(securityManager: SecurityManager2, sourceNodeId: number, sequenceNumber: number): number | undefined {\n    validatePayload.withReason(`Duplicate command (sequence number ${sequenceNumber})`)(!securityManager.isDuplicateSinglecast(sourceNodeId, sequenceNumber));\n    // Not a duplicate, store it\n    return securityManager.storeSequenceNumber(sourceNodeId, sequenceNumber);\n}\nconst MAX_DECRYPT_ATTEMPTS_SINGLECAST = 5;\nconst MAX_DECRYPT_ATTEMPTS_MULTICAST = 5;\nconst MAX_DECRYPT_ATTEMPTS_SC_FOLLOWUP = 1;\n// @publicAPI\nexport interface DecryptionResult {\n    plaintext: BytesView;\n    authOK: boolean;\n    key?: BytesView;\n    iv?: BytesView;\n    securityClass: SecurityClass | undefined;\n}\nfunction assertSecurityRX(ctx: CCParsingContext): SecurityManager2 {\n    if (!ctx.ownNodeId) {\n        throw new ZWaveError(`Secure commands (S2) can only be decoded when the controller's node id is known!`, ZWaveErrorCodes.Driver_NotReady);\n    }\n    const ret = getSecurityManager(ctx.ownNodeId, ctx, ctx.sourceNodeId);\n    if (!ret) {\n        throw new ZWaveError(`Secure commands (S2) can only be decoded when the security manager is set up!`, ZWaveErrorCodes.Driver_NoSecurity);\n    }\n    return ret;\n}\nfunction assertSecurityTX(ctx: CCEncodingContext, destination: MulticastDestination | number): SecurityManager2 {\n    if (!ctx.ownNodeId) {\n        throw new ZWaveError(`Secure commands (S2) can only be sent when the controller's node id is known!`, ZWaveErrorCodes.Driver_NotReady);\n    }\n    const ret = getSecurityManager(ctx.ownNodeId, ctx, destination);\n    if (!ret) {\n        throw new ZWaveError(`Secure commands (S2) can only be sent when the security manager is set up!`, ZWaveErrorCodes.Driver_NoSecurity);\n    }\n    return ret;\n}\nasync function decryptSinglecast(ctx: CCParsingContext, securityManager: SecurityManager2, sendingNodeId: number, curSequenceNumber: number, prevSequenceNumber: number, ciphertext: BytesView, authData: BytesView, authTag: BytesView, spanState: SPANTableEntry & {\n    type: SPANState.SPAN | SPANState.LocalEI;\n}, extensions: Security2Extension[]): Promise<DecryptionResult> {\n    const decryptWithNonce = async (nonce: BytesView) => {\n        const { keyCCM: key } = securityManager.getKeysForNode(sendingNodeId);\n        const iv = nonce;\n        const ret = await decryptAES128CCM(ciphertext, key, iv, authData, authTag);\n        return {\n            key,\n            iv,\n            ...ret,\n        };\n    };\n    const getNonceAndDecrypt = async () => {\n        const iv = await securityManager.nextNonce(sendingNodeId);\n        return decryptWithNonce(iv);\n    };\n    if (spanState.type === SPANState.SPAN) {\n        // There SHOULD be a shared SPAN between both parties. But experience has shown that both could have\n        // sent a command at roughly the same time, using the same SPAN for encryption.\n        // To avoid a nasty desync and both nodes trying to resync at the same time, causing message loss,\n        // we accept commands encrypted with the previous SPAN under very specific circumstances:\n        if (\n        // The previous SPAN is still known, i.e. the node didn't send another command that was successfully decrypted\n        !!spanState.currentSPAN\n            // it is still valid\n            && spanState.currentSPAN.expires > highResTimestamp()\n            // The received command is exactly the next, expected one\n            && prevSequenceNumber != undefined\n            && curSequenceNumber === ((prevSequenceNumber + 1) & 0xff)\n            // And in case of a mock-based test, do this only on the controller\n            && !ctx.__internalIsMockNode) {\n            const nonce = spanState.currentSPAN.nonce;\n            spanState.currentSPAN = undefined;\n            // If we could decrypt this way, we're done...\n            const result = await decryptWithNonce(nonce);\n            if (result.authOK) {\n                return {\n                    ...result,\n                    securityClass: spanState.securityClass,\n                };\n            }\n            // ...otherwise, we need to try the normal way\n        }\n        else {\n            // forgetting the current SPAN shouldn't be necessary but better be safe than sorry\n            spanState.currentSPAN = undefined;\n        }\n        // This can only happen if the security class is known\n        return {\n            ...(await getNonceAndDecrypt()),\n            securityClass: spanState.securityClass,\n        };\n    }\n    else if (spanState.type === SPANState.LocalEI) {\n        // We've sent the other our receiver's EI and received its sender's EI,\n        // meaning we can now establish an SPAN\n        const senderEI = getSenderEI(extensions);\n        if (!senderEI)\n            failNoSPAN();\n        const receiverEI = spanState.receiverEI;\n        // How we do this depends on whether we know the security class of the other node\n        const isBootstrappingNode = securityManager.tempKeys.has(sendingNodeId);\n        if (isBootstrappingNode) {\n            // We're currently bootstrapping the node, it might be using a temporary key\n            await securityManager.initializeTempSPAN(sendingNodeId, senderEI, receiverEI);\n            const ret = await getNonceAndDecrypt();\n            // Decryption with the temporary key worked\n            if (ret.authOK) {\n                return {\n                    ...ret,\n                    securityClass: SecurityClass.Temporary,\n                };\n            }\n            // Reset the SPAN state and try with the recently granted security class\n            securityManager.setSPANState(sendingNodeId, spanState);\n        }\n        // When ending up here, one of two situations has occured:\n        // a) We've taken over an existing network and do not know the node's security class\n        // b) We know the security class, but we're about to establish a new SPAN. This may happen at a lower\n        //    security class than the one the node normally uses, e.g. when we're being queried for securely\n        //    supported CCs.\n        // In both cases, we should simply try decoding with multiple security classes, starting from the highest one.\n        // If this fails, we restore the previous (partial) SPAN state.\n        // Try all security classes where we do not definitely know that it was not granted\n        // While bootstrapping a node, we consider the key that is being exchanged (including S0) to be the highest. No need to look at others\n        const possibleSecurityClasses = isBootstrappingNode\n            ? [ctx.getHighestSecurityClass(sendingNodeId)!]\n            : securityClassOrder.filter((s) => ctx.hasSecurityClass(sendingNodeId, s)\n                !== false);\n        for (const secClass of possibleSecurityClasses) {\n            // Skip security classes we don't have keys for\n            if (!securityManager.hasKeysForSecurityClass(secClass)) {\n                continue;\n            }\n            // Initialize an SPAN with that security class\n            await securityManager.initializeSPAN(sendingNodeId, secClass, senderEI, receiverEI);\n            const ret = await getNonceAndDecrypt();\n            // It worked, return the result\n            if (ret.authOK) {\n                // Also if we weren't sure before, we now know that the security class is granted\n                if (ctx.hasSecurityClass(sendingNodeId, secClass)\n                    === undefined) {\n                    ctx.setSecurityClass(sendingNodeId, secClass, true);\n                }\n                return {\n                    ...ret,\n                    securityClass: secClass,\n                };\n            }\n            else {\n                // Reset the SPAN state and try with the next security class\n                securityManager.setSPANState(sendingNodeId, spanState);\n            }\n        }\n    }\n    // Nothing worked, fail the decryption\n    return {\n        plaintext: new Uint8Array(),\n        authOK: false,\n        securityClass: undefined,\n    };\n}\nasync function decryptMulticast(sendingNodeId: number, securityManager: SecurityManager2, groupId: number, ciphertext: BytesView, authData: BytesView, authTag: BytesView): Promise<DecryptionResult> {\n    const iv = await securityManager.nextPeerMPAN(sendingNodeId, groupId);\n    const { keyCCM: key } = securityManager.getKeysForNode(sendingNodeId);\n    return {\n        key,\n        iv,\n        ...(await decryptAES128CCM(ciphertext, key, iv, authData, authTag)),\n        // The security class is irrelevant when decrypting multicast commands\n        securityClass: undefined,\n    };\n}\nfunction parseExtensions(buffer: BytesView, wasEncrypted: boolean): {\n    extensions: Security2Extension[];\n    mustDiscardCommand: boolean;\n    bytesRead: number;\n} {\n    const extensions: Security2Extension[] = [];\n    let mustDiscardCommand = false;\n    let offset = 0;\n    parsing: while (true) {\n        if (buffer.length < offset + 2) {\n            // An S2 extension was expected, but the buffer is too short\n            mustDiscardCommand = true;\n            break parsing;\n        }\n        // The length field could be too large, which would cause part of the actual ciphertext\n        // to be ignored. Try to avoid this for known extensions by checking the actual and expected length.\n        const { actual: actualLength, expected: expectedLength } = Security2Extension\n            .getExtensionLength(buffer.subarray(offset));\n        // Parse the extension using the expected length if possible\n        const extensionLength = expectedLength ?? actualLength;\n        if (extensionLength < 2) {\n            // An S2 extension was expected, but the length is too short\n            mustDiscardCommand = true;\n            break parsing;\n        }\n        else if (extensionLength\n            > buffer.length\n                - offset\n                - (wasEncrypted\n                    ? 0\n                    : SECURITY_S2_AUTH_TAG_LENGTH)) {\n            // The supposed length is longer than the space the extensions may occupy\n            mustDiscardCommand = true;\n            break parsing;\n        }\n        const extensionData = buffer.subarray(offset, offset + extensionLength);\n        offset += extensionLength;\n        const ext = Security2Extension.parse(extensionData);\n        switch (validateS2Extension(ext, wasEncrypted)) {\n            case ValidateS2ExtensionResult.OK:\n                if (expectedLength != undefined\n                    && actualLength !== expectedLength) {\n                    // The extension length field does not match, ignore the extension\n                }\n                else {\n                    extensions.push(ext);\n                }\n                break;\n            case ValidateS2ExtensionResult.DiscardExtension:\n                // Do nothing\n                break;\n            case ValidateS2ExtensionResult.DiscardCommand:\n                mustDiscardCommand = true;\n                break;\n        }\n        // Check if that was the last extension\n        if (!ext.moreToFollow)\n            break parsing;\n    }\n    return {\n        extensions,\n        mustDiscardCommand,\n        bytesRead: offset,\n    };\n}\nfunction getDestinationIDTX(this: Security2CC & {\n    extensions: Security2Extension[];\n}): number {\n    if (this.isSinglecast())\n        return this.nodeId;\n    const ret = getMulticastGroupId(this.extensions);\n    if (ret == undefined) {\n        throw new ZWaveError(\"Multicast Security S2 encapsulation requires the MGRP extension\", ZWaveErrorCodes.Security2CC_MissingExtension);\n    }\n    return ret;\n}\nfunction getDestinationIDRX(ctx: CCParsingContext, extensions: Security2Extension[]): number {\n    if (ctx.frameType === \"singlecast\") {\n        return ctx.ownNodeId;\n    }\n    const ret = getMulticastGroupId(extensions);\n    if (ret == undefined) {\n        throw new ZWaveError(\"Multicast Security S2 encapsulation requires the MGRP extension\", ZWaveErrorCodes.Security2CC_MissingExtension);\n    }\n    return ret;\n}\nfunction getMulticastGroupId(extensions: Security2Extension[]): number | undefined {\n    const mgrpExtension = extensions.find((e) => e instanceof MGRPExtension);\n    return mgrpExtension?.groupId;\n}\n/** Returns the Sender's Entropy Input if this command contains an SPAN extension */\nfunction getSenderEI(extensions: Security2Extension[]): BytesView | undefined {\n    const spanExtension = extensions.find((e) => e instanceof SPANExtension);\n    return spanExtension?.senderEI;\n}\n// Encapsulation CCs are used internally and too frequently that we\n// want to pay the cost of validating each call\n/* eslint-disable @zwave-js/ccapi-validate-args */\n@API(CommandClasses[\"Security 2\"])\nexport class Security2CCAPI extends CCAPI {\n    public supportsCommand(_cmd: Security2Command): MaybeNotKnown<boolean> {\n        // All commands are mandatory\n        return true;\n    }\n    /**\n     * Sends a nonce to the node, either in response to a NonceGet request or a message that failed to decrypt. The message is sent without any retransmission etc.\n     * The return value indicates whether a nonce was successfully sent\n     */\n    public async sendNonce(): Promise<boolean> {\n        this.assertSupportsCommand(Security2Command, Security2Command.NonceReport);\n        this.assertPhysicalEndpoint(this.endpoint);\n        const securityManager = getSecurityManager(this.host.ownNodeId, this.host, this.endpoint.nodeId);\n        if (!securityManager) {\n            throw new ZWaveError(`Nonces can only be sent if secure communication is set up!`, ZWaveErrorCodes.Driver_NoSecurity);\n        }\n        const receiverEI = await securityManager.generateNonce(this.endpoint.nodeId);\n        const cc = new Security2CCNonceReport({\n            nodeId: this.endpoint.nodeId,\n            endpointIndex: this.endpoint.index,\n            SOS: true,\n            MOS: false,\n            receiverEI,\n        });\n        try {\n            await this.host.sendCommand(cc, {\n                ...this.commandOptions,\n                // Seems we need these options or some nodes won't accept the nonce\n                transmitOptions: TransmitOptions.ACK\n                    | TransmitOptions.AutoRoute,\n                // Only try sending a nonce once\n                maxSendAttempts: 1,\n                // Nonce requests must be handled immediately\n                priority: MessagePriority.Immediate,\n                // We don't want failures causing us to treat the node as asleep or dead\n                changeNodeStatusOnMissingACK: false,\n                // And we need to react to\n            });\n        }\n        catch (e) {\n            if (isTransmissionError(e)) {\n                // The nonce could not be sent, invalidate it\n                securityManager.deleteNonce(this.endpoint.nodeId);\n                return false;\n            }\n            else {\n                // Pass other errors through\n                throw e;\n            }\n        }\n        return true;\n    }\n    /** Notifies the target node that the MPAN state is out of sync */\n    public async sendMOS(): Promise<boolean> {\n        this.assertSupportsCommand(Security2Command, Security2Command.NonceReport);\n        this.assertPhysicalEndpoint(this.endpoint);\n        const cc = new Security2CCNonceReport({\n            nodeId: this.endpoint.nodeId,\n            endpointIndex: this.endpoint.index,\n            SOS: false,\n            MOS: true,\n        });\n        try {\n            await this.host.sendCommand(cc, {\n                ...this.commandOptions,\n                // Seems we need these options or some nodes won't accept the nonce\n                transmitOptions: TransmitOptions.ACK\n                    | TransmitOptions.AutoRoute,\n                // Only try sending a nonce once\n                maxSendAttempts: 1,\n                // Nonce requests must be handled immediately\n                priority: MessagePriority.Immediate,\n                // We don't want failures causing us to treat the node as asleep or dead\n                changeNodeStatusOnMissingACK: false,\n            });\n        }\n        catch (e) {\n            if (isTransmissionError(e)) {\n                return false;\n            }\n            else {\n                // Pass other errors through\n                throw e;\n            }\n        }\n        return true;\n    }\n    /** Sends the given MPAN to the node */\n    public async sendMPAN(groupId: number, innerMPANState: BytesView): Promise<boolean> {\n        this.assertSupportsCommand(Security2Command, Security2Command.MessageEncapsulation);\n        this.assertPhysicalEndpoint(this.endpoint);\n        const cc = new Security2CCMessageEncapsulation({\n            nodeId: this.endpoint.nodeId,\n            endpointIndex: this.endpoint.index,\n            extensions: [\n                new MPANExtension({\n                    groupId,\n                    innerMPANState,\n                }),\n            ],\n        });\n        try {\n            await this.host.sendCommand(cc, {\n                ...this.commandOptions,\n                // Seems we need these options or some nodes won't accept the nonce\n                transmitOptions: TransmitOptions.ACK\n                    | TransmitOptions.AutoRoute,\n                // Only try sending a nonce once\n                maxSendAttempts: 1,\n                // Nonce requests must be handled immediately\n                priority: MessagePriority.Immediate,\n                // We don't want failures causing us to treat the node as asleep or dead\n                changeNodeStatusOnMissingACK: false,\n            });\n        }\n        catch (e) {\n            if (isTransmissionError(e)) {\n                return false;\n            }\n            else {\n                // Pass other errors through\n                throw e;\n            }\n        }\n        return true;\n    }\n    /**\n     * Queries the securely supported commands for the current security class\n     * @param securityClass Can be used to overwrite the security class to use. If this doesn't match the current one, new nonces will need to be exchanged.\n     */\n    public async getSupportedCommands(securityClass: SecurityClass.S2_AccessControl | SecurityClass.S2_Authenticated | SecurityClass.S2_Unauthenticated): Promise<MaybeNotKnown<CommandClasses[]>> {\n        this.assertSupportsCommand(Security2Command, Security2Command.CommandsSupportedGet);\n        let cc: CommandClass = new Security2CCCommandsSupportedGet({\n            nodeId: this.endpoint.nodeId,\n            endpointIndex: this.endpoint.index,\n        });\n        // Security2CCCommandsSupportedGet is special because we cannot reply on the applHost to do the automatic\n        // encapsulation because it would use a different security class. Therefore the entire possible stack\n        // of encapsulation needs to be done here\n        if (MultiChannelCC.requiresEncapsulation(cc)) {\n            const multiChannelCCVersion = this.host.getSupportedCCVersion(CommandClasses[\"Multi Channel\"], this.endpoint.nodeId as number);\n            cc = multiChannelCCVersion === 1\n                ? MultiChannelCC.encapsulateV1(cc)\n                : MultiChannelCC.encapsulate(cc);\n        }\n        cc = Security2CC.encapsulate(cc, this.host.ownNodeId, this.host, { securityClass });\n        const response = await this.host.sendCommand<Security2CCCommandsSupportedReport>(cc, {\n            ...this.commandOptions,\n            autoEncapsulate: false,\n        });\n        return response?.supportedCCs;\n    }\n    public async reportSupportedCommands(supportedCCs: CommandClasses[]): Promise<void> {\n        this.assertSupportsCommand(Security2Command, Security2Command.CommandsSupportedReport);\n        const cc = new Security2CCCommandsSupportedReport({\n            nodeId: this.endpoint.nodeId,\n            endpointIndex: this.endpoint.index,\n            supportedCCs,\n        });\n        await this.host.sendCommand(cc, this.commandOptions);\n    }\n    // oxlint-disable-next-line typescript/explicit-module-boundary-types\n    public async getKeyExchangeParameters() {\n        this.assertSupportsCommand(Security2Command, Security2Command.KEXGet);\n        const cc = new Security2CCKEXGet({\n            nodeId: this.endpoint.nodeId,\n            endpointIndex: this.endpoint.index,\n        });\n        const response = await this.host.sendCommand<Security2CCKEXReport>(cc, this.commandOptions);\n        if (response) {\n            return pick(response, [\n                \"requestCSA\",\n                \"echo\",\n                \"supportedKEXSchemes\",\n                \"supportedECDHProfiles\",\n                \"requestedKeys\",\n                \"_reserved\",\n            ]);\n        }\n    }\n    /** Requests the given keys from an including node */\n    public async requestKeys(params: Omit<Security2CCKEXReportOptions, \"echo\">): Promise<void> {\n        this.assertSupportsCommand(Security2Command, Security2Command.KEXReport);\n        const cc = new Security2CCKEXReport({\n            nodeId: this.endpoint.nodeId,\n            endpointIndex: this.endpoint.index,\n            ...params,\n            echo: false,\n        });\n        await this.host.sendCommand(cc, this.commandOptions);\n    }\n    /** Grants the joining node the given keys */\n    public async grantKeys(params: Omit<Security2CCKEXSetOptions, \"echo\">): Promise<void> {\n        this.assertSupportsCommand(Security2Command, Security2Command.KEXSet);\n        const cc = new Security2CCKEXSet({\n            nodeId: this.endpoint.nodeId,\n            endpointIndex: this.endpoint.index,\n            ...params,\n            echo: false,\n        });\n        await this.host.sendCommand(cc, this.commandOptions);\n    }\n    /** Confirms the keys that were requested by a node */\n    public async confirmRequestedKeys(params: Omit<Security2CCKEXReportOptions, \"echo\">): Promise<void> {\n        this.assertSupportsCommand(Security2Command, Security2Command.KEXReport);\n        const cc = new Security2CCKEXReport({\n            nodeId: this.endpoint.nodeId,\n            endpointIndex: this.endpoint.index,\n            ...params,\n            echo: true,\n        });\n        await this.host.sendCommand(cc, this.commandOptions);\n    }\n    /** Confirms the keys that were granted by the including node */\n    public async confirmGrantedKeys(params: Omit<Security2CCKEXSetOptions, \"echo\">): Promise<Security2CCKEXReport | Security2CCKEXFail | undefined> {\n        this.assertSupportsCommand(Security2Command, Security2Command.KEXSet);\n        const cc = new Security2CCKEXSet({\n            nodeId: this.endpoint.nodeId,\n            endpointIndex: this.endpoint.index,\n            ...params,\n            echo: true,\n        });\n        return this.host.sendCommand(cc, this.commandOptions);\n    }\n    /** Notifies the other node that the ongoing key exchange was aborted */\n    public async abortKeyExchange(failType: KEXFailType): Promise<void> {\n        this.assertSupportsCommand(Security2Command, Security2Command.KEXFail);\n        const cc = new Security2CCKEXFail({\n            nodeId: this.endpoint.nodeId,\n            endpointIndex: this.endpoint.index,\n            failType,\n        });\n        await this.host.sendCommand(cc, this.commandOptions);\n    }\n    public async sendPublicKey(publicKey: BytesView, includingNode: boolean = true): Promise<void> {\n        this.assertSupportsCommand(Security2Command, Security2Command.PublicKeyReport);\n        const cc = new Security2CCPublicKeyReport({\n            nodeId: this.endpoint.nodeId,\n            endpointIndex: this.endpoint.index,\n            includingNode,\n            publicKey,\n        });\n        await this.host.sendCommand(cc, this.commandOptions);\n    }\n    public async requestNetworkKey(securityClass: SecurityClass): Promise<void> {\n        this.assertSupportsCommand(Security2Command, Security2Command.NetworkKeyGet);\n        const cc = new Security2CCNetworkKeyGet({\n            nodeId: this.endpoint.nodeId,\n            endpointIndex: this.endpoint.index,\n            requestedKey: securityClass,\n        });\n        await this.host.sendCommand(cc, this.commandOptions);\n    }\n    public async sendNetworkKey(securityClass: SecurityClass, networkKey: BytesView): Promise<void> {\n        this.assertSupportsCommand(Security2Command, Security2Command.NetworkKeyReport);\n        const cc = new Security2CCNetworkKeyReport({\n            nodeId: this.endpoint.nodeId,\n            endpointIndex: this.endpoint.index,\n            grantedKey: securityClass,\n            networkKey,\n        });\n        await this.host.sendCommand(cc, this.commandOptions);\n    }\n    public async verifyNetworkKey(): Promise<void> {\n        this.assertSupportsCommand(Security2Command, Security2Command.NetworkKeyVerify);\n        const cc = new Security2CCNetworkKeyVerify({\n            nodeId: this.endpoint.nodeId,\n            endpointIndex: this.endpoint.index,\n        });\n        await this.host.sendCommand(cc, this.commandOptions);\n    }\n    public async confirmKeyVerification(): Promise<void> {\n        this.assertSupportsCommand(Security2Command, Security2Command.TransferEnd);\n        const cc = new Security2CCTransferEnd({\n            nodeId: this.endpoint.nodeId,\n            endpointIndex: this.endpoint.index,\n            keyVerified: true,\n            keyRequestComplete: false,\n        });\n        await this.host.sendCommand(cc, {\n            ...this.commandOptions,\n            // Don't wait for an ACK from the node\n            transmitOptions: TransmitOptions.DEFAULT & ~TransmitOptions.ACK,\n        });\n    }\n    public async endKeyExchange(): Promise<void> {\n        this.assertSupportsCommand(Security2Command, Security2Command.TransferEnd);\n        const cc = new Security2CCTransferEnd({\n            nodeId: this.endpoint.nodeId,\n            endpointIndex: this.endpoint.index,\n            keyVerified: false,\n            keyRequestComplete: true,\n        });\n        await this.host.sendCommand(cc, this.commandOptions);\n    }\n}\n@commandClass(CommandClasses[\"Security 2\"])\n@implementedVersion(1)\nexport class Security2CC extends CommandClass {\n    declare ccCommand: Security2Command;\n    public async interview(ctx: InterviewContext): Promise<void> {\n        const securityManager = getSecurityManager(ctx.ownNodeId, ctx, this.nodeId);\n        const node = this.getNode(ctx)!;\n        const endpoint = this.getEndpoint(ctx)!;\n        const api = CCAPI.create(CommandClasses[\"Security 2\"], ctx, endpoint).withOptions({\n            priority: MessagePriority.NodeQuery,\n        });\n        // Only on the highest security class the response includes the supported commands\n        const secClass = node.getHighestSecurityClass();\n        let hasReceivedSecureCommands = false;\n        let possibleSecurityClasses: S2SecurityClass[];\n        if (securityClassIsS2(secClass)) {\n            // The highest security class is known to be S2, only query that one\n            possibleSecurityClasses = [secClass];\n        }\n        else if (endpoint.index === 0) {\n            // If the highest security class isn't known, query all possible security classes\n            // but only on the root device\n            possibleSecurityClasses = [\n                SecurityClass.S2_Unauthenticated,\n                SecurityClass.S2_Authenticated,\n                SecurityClass.S2_AccessControl,\n            ];\n        }\n        else {\n            // For endpoint interviews, the security class MUST be known\n            ctx.logNode(node.id, {\n                endpoint: endpoint.index,\n                message: `Cannot query securely supported commands for endpoint because the node's security class isn't known...`,\n                level: \"error\",\n            });\n            return;\n        }\n        for (const secClass of possibleSecurityClasses) {\n            // We might not know all assigned security classes yet, so we work our way up from low to high and try to request the supported commands.\n            // This way, each command is encrypted with the security class we're currently testing.\n            // If the node does not respond, it wasn't assigned the security class.\n            // If it responds with a non-empty list, we know this is the highest class it supports.\n            // If the list is empty, the security class is still supported.\n            // If we already know the class is not supported, skip it\n            if (node.hasSecurityClass(secClass) === false)\n                continue;\n            // If no key is configured for this security class, skip it\n            if (!securityManager?.hasKeysForSecurityClass(secClass)) {\n                ctx.logNode(node.id, {\n                    endpoint: endpoint.index,\n                    message: `Cannot query securely supported commands (${getEnumMemberName(SecurityClass, secClass)}) - network key is not configured...`,\n                    level: \"warn\",\n                });\n                continue;\n            }\n            ctx.logNode(node.id, {\n                endpoint: endpoint.index,\n                message: `Querying securely supported commands (${getEnumMemberName(SecurityClass, secClass)})...`,\n                direction: \"outbound\",\n            });\n            // Query the supported commands but avoid remembering the wrong security class in case of a failure\n            let supportedCCs: CommandClasses[] | undefined;\n            // Try up to 3 times on the root device. We REALLY don't want a spurious timeout or collision to cause us to discard a known good security class\n            const MAX_ATTEMPTS = this.endpointIndex === 0 ? 3 : 1;\n            for (let attempts = 1; attempts <= MAX_ATTEMPTS; attempts++) {\n                try {\n                    supportedCCs = await api.getSupportedCommands(secClass);\n                }\n                catch (e) {\n                    if (isZWaveError(e)\n                        && e.code === ZWaveErrorCodes.Security2CC_CannotDecode) {\n                        // Either we were using a non-granted security class,\n                        // or querying with the known highest security class had an issue\n                        supportedCCs = undefined;\n                    }\n                    else {\n                        throw e;\n                    }\n                }\n                if (supportedCCs == undefined\n                    && possibleSecurityClasses.length === 1) {\n                    if (attempts < MAX_ATTEMPTS) {\n                        // We definitely know the highest security class\n                        ctx.logNode(node.id, {\n                            endpoint: endpoint.index,\n                            message: `Querying securely supported commands (${getEnumMemberName(SecurityClass, secClass)}), attempt ${attempts}/${MAX_ATTEMPTS} failed. Retrying in 500ms...`,\n                            level: \"warn\",\n                        });\n                        await wait(500);\n                        continue;\n                    }\n                    else if (endpoint.index > 0) {\n                        ctx.logNode(node.id, {\n                            endpoint: endpoint.index,\n                            message: `Querying securely supported commands (${getEnumMemberName(SecurityClass, secClass)}) failed. Assuming the endpoint supports all its mandatory CCs securely...`,\n                            level: \"warn\",\n                        });\n                        // Just mark all endpoint CCs as secure. Without this we would attempt\n                        // unencrypted communication with the endpoint, which will likely fail.\n                        for (const [ccId] of endpoint.getCCs()) {\n                            endpoint.addCC(ccId, { secure: true });\n                        }\n                        break;\n                    }\n                    else {\n                        ctx.logNode(node.id, {\n                            endpoint: endpoint.index,\n                            message: `Querying securely supported commands (${getEnumMemberName(SecurityClass, secClass)}) failed. Let's hope for the best...`,\n                            level: \"warn\",\n                        });\n                        break;\n                    }\n                }\n                else {\n                    // In any other case, we can stop trying\n                    break;\n                }\n            }\n            if (supportedCCs == undefined) {\n                if (endpoint.index === 0\n                    && possibleSecurityClasses.length > 1) {\n                    // No supported commands found, mark the security class as not granted\n                    // unless we were sure about the security class\n                    node.setSecurityClass(secClass, false);\n                    ctx.logNode(node.id, {\n                        message: `The node was NOT granted the security class ${getEnumMemberName(SecurityClass, secClass)}`,\n                        direction: \"inbound\",\n                    });\n                }\n                continue;\n            }\n            if (endpoint.index === 0 && possibleSecurityClasses.length > 1) {\n                // Mark the security class as granted unless we were sure about the security class\n                node.setSecurityClass(secClass, true);\n                ctx.logNode(node.id, {\n                    message: `The node was granted the security class ${getEnumMemberName(SecurityClass, secClass)}`,\n                    direction: \"inbound\",\n                });\n            }\n            if (!hasReceivedSecureCommands && supportedCCs.length > 0) {\n                hasReceivedSecureCommands = true;\n                const logLines: string[] = [\n                    `received secure commands (${getEnumMemberName(SecurityClass, secClass)})`,\n                    \"supported CCs:\",\n                ];\n                for (const cc of supportedCCs) {\n                    logLines.push(`\u00B7 ${getCCName(cc)}`);\n                }\n                ctx.logNode(node.id, {\n                    endpoint: endpoint.index,\n                    message: logLines.join(\"\\n\"),\n                    direction: \"inbound\",\n                });\n                // Remember which commands are supported securely\n                for (const cc of supportedCCs) {\n                    // Basic CC has special rules for when it is considered supported\n                    // Therefore we mark all other CCs as supported, but not Basic CC,\n                    // for which support is determined later.\n                    if (cc === CommandClasses.Basic) {\n                        endpoint.addCC(cc, { secure: true });\n                    }\n                    else {\n                        endpoint.addCC(cc, {\n                            isSupported: true,\n                            secure: true,\n                        });\n                    }\n                }\n            }\n        }\n        // Remember that the interview is complete\n        this.setInterviewComplete(ctx, true);\n    }\n    /** Tests if a command should be sent secure and thus requires encapsulation */\n    public static requiresEncapsulation(cc: CommandClass): boolean {\n        // No security flag -> no encapsulation\n        if (!(cc.encapsulationFlags & EncapsulationFlags.Security)) {\n            return false;\n        }\n        // S0, CRC16, Transport Service -> no S2 encapsulation\n        if (cc instanceof SecurityCC\n            || cc instanceof CRC16CC\n            || cc instanceof TransportServiceCC) {\n            return false;\n        }\n        // S2: check command\n        if (cc instanceof Security2CC) {\n            // These S2 commands need additional encapsulation\n            switch (cc.ccCommand) {\n                case Security2Command.CommandsSupportedGet:\n                case Security2Command.CommandsSupportedReport:\n                case Security2Command.NetworkKeyGet:\n                case Security2Command.NetworkKeyReport:\n                case Security2Command.NetworkKeyVerify:\n                case Security2Command.TransferEnd:\n                    return true;\n                case Security2Command.KEXSet:\n                case Security2Command.KEXReport:\n                    // KEXSet/Report need to be encrypted for the confirmation only\n                    return (cc as Security2CCKEXSet | Security2CCKEXReport)\n                        .echo;\n                case Security2Command.KEXFail: {\n                    switch ((cc as Security2CCKEXFail).failType) {\n                        case KEXFailType.Decrypt:\n                        case KEXFailType.WrongSecurityLevel:\n                        case KEXFailType.KeyNotGranted:\n                        case KEXFailType.NoVerify:\n                            return true;\n                        default:\n                            return false;\n                    }\n                }\n            }\n            return false;\n        }\n        // Everything else needs to be encapsulated if the CC is secure\n        return true;\n    }\n    /** Encapsulates a command that should be sent encrypted */\n    public static encapsulate(cc: CommandClass, ownNodeId: number, securityManagers: SecurityManagers, options?: {\n        securityClass?: SecurityClass;\n        multicastOutOfSync?: boolean;\n        multicastGroupId?: number;\n        verifyDelivery?: boolean;\n    }): Security2CCMessageEncapsulation {\n        // Determine which extensions must be used on the command\n        const extensions: Security2Extension[] = [];\n        if (options?.multicastOutOfSync) {\n            extensions.push(new MOSExtension());\n        }\n        if (options?.multicastGroupId != undefined) {\n            extensions.push(new MGRPExtension({ groupId: options.multicastGroupId }));\n        }\n        // Make sure that S2 multicast uses broadcasts. While the specs mention that both multicast and broadcast\n        // are possible, it has been found that devices treat multicasts like singlecast followups and respond incorrectly.\n        let nodeId: number;\n        if (cc.isMulticast()) {\n            if (cc.nodeId.some((nodeId) => isLongRangeNodeId(nodeId))) {\n                nodeId = NODE_ID_BROADCAST_LR;\n            }\n            else {\n                nodeId = NODE_ID_BROADCAST;\n            }\n        }\n        else {\n            nodeId = cc.nodeId as number;\n        }\n        const ret = new Security2CCMessageEncapsulation({\n            nodeId,\n            encapsulated: cc,\n            securityClass: options?.securityClass,\n            extensions,\n            verifyDelivery: options?.verifyDelivery,\n        });\n        // Copy the encapsulation flags from the encapsulated command\n        // but omit Security, since we're doing that right now\n        ret.encapsulationFlags = cc.encapsulationFlags\n            & ~EncapsulationFlags.Security;\n        return ret;\n    }\n}\nfunction failNoSPAN(): never {\n    validatePayload.fail(ZWaveErrorCodes.Security2CC_NoSPAN);\n}\nfunction failNoMPAN(): never {\n    validatePayload.fail(ZWaveErrorCodes.Security2CC_NoMPAN);\n}\n// @publicAPI\nexport type MulticastContext = {\n    isMulticast: true;\n    groupId: number;\n} | {\n    isMulticast: false;\n    groupId?: number;\n};\n// @publicAPI\nexport interface Security2CCMessageEncapsulationOptions {\n    sequenceNumber?: number;\n    /** Can be used to override the default security class for the command */\n    securityClass?: SecurityClass;\n    extensions?: Security2Extension[];\n    encapsulated?: CommandClass;\n    verifyDelivery?: boolean;\n}\n// An S2 encapsulated command may result in a NonceReport to be sent by the node if it couldn't decrypt the message\nfunction getCCResponseForMessageEncapsulation(ctx: GetNode<NodeId & SupportsCC>, sent: Security2CCMessageEncapsulation) {\n    if (sent.encapsulated?.expectsCCResponse(ctx)) {\n        const ret = [\n            Security2CCMessageEncapsulation as any,\n            Security2CCNonceReport as any,\n        ];\n        if (sent.encapsulated instanceof Security2CCKEXSet\n            || sent.encapsulated instanceof Security2CCKEXReport\n            || sent.encapsulated instanceof Security2CCNetworkKeyGet\n            || sent.encapsulated instanceof Security2CCNetworkKeyReport\n            || sent.encapsulated instanceof Security2CCNetworkKeyVerify) {\n            ret.push(Security2CCKEXFail as any);\n        }\n        return ret;\n    }\n}\nfunction testCCResponseForMessageEncapsulation(sent: Security2CCMessageEncapsulation, received: Security2CCMessageEncapsulation | Security2CCNonceReport | Security2CCKEXFail) {\n    if (received instanceof Security2CCMessageEncapsulation) {\n        return \"checkEncapsulated\";\n    }\n    else if (received instanceof Security2CCKEXFail) {\n        return true;\n    }\n    else {\n        return received.SOS && !!received.receiverEI;\n    }\n}\n@CCCommand(Security2Command.MessageEncapsulation)\n@expectedCCResponse(getCCResponseForMessageEncapsulation, testCCResponseForMessageEncapsulation)\nexport class Security2CCMessageEncapsulation extends Security2CC {\n    public constructor(options: WithAddress<Security2CCMessageEncapsulationOptions>) {\n        super(options);\n        if (!options.encapsulated && !options.extensions?.length) {\n            throw new ZWaveError(\"Security S2 encapsulation requires an encapsulated CC and/or extensions\", ZWaveErrorCodes.Argument_Invalid);\n        }\n        this.sequenceNumber = options.sequenceNumber;\n        this.securityClass = options.securityClass;\n        if (options.encapsulated) {\n            this.encapsulated = options.encapsulated;\n            options.encapsulated.encapsulatingCC = this as any;\n        }\n        this.verifyDelivery = options.verifyDelivery !== false;\n        this.extensions = options.extensions ?? [];\n        if (typeof this.nodeId !== \"number\"\n            && !this.extensions.some((e) => e instanceof MGRPExtension)) {\n            throw new ZWaveError(\"Multicast Security S2 encapsulation requires the MGRP extension\", ZWaveErrorCodes.Security2CC_MissingExtension);\n        }\n    }\n    public static async from(raw: CCRaw, ctx: CCParsingContext): Promise<Security2CCMessageEncapsulation> {\n        const securityManager = assertSecurityRX(ctx);\n        validatePayload(raw.payload.length >= 2);\n        // Check the sequence number to avoid duplicates\n        const sequenceNumber: number | undefined = raw.payload[0];\n        // Ensure the node has a security class\n        validatePayload.withReason(\"No security class granted\")(ctx.getHighestSecurityClass(ctx.sourceNodeId) !== SecurityClass.None);\n        const hasExtensions = !!(raw.payload[1] & 0b1);\n        const hasEncryptedExtensions = !!(raw.payload[1] & 0b10);\n        let offset = 2;\n        const extensions: Security2Extension[] = [];\n        let mustDiscardCommand = false;\n        if (hasExtensions) {\n            const parseResult = parseExtensions(raw.payload.subarray(offset), false);\n            extensions.push(...parseResult.extensions);\n            offset += parseResult.bytesRead;\n            mustDiscardCommand = parseResult.mustDiscardCommand;\n        }\n        const mcctx = ((): MulticastContext => {\n            const multicastGroupId = getMulticastGroupId(extensions);\n            if (ctx.frameType === \"multicast\" || ctx.frameType === \"broadcast\") {\n                if (multicastGroupId == undefined) {\n                    validatePayload.fail(\"Multicast frames without MGRP extension\");\n                }\n                return {\n                    isMulticast: true,\n                    groupId: multicastGroupId,\n                };\n            }\n            else {\n                return { isMulticast: false, groupId: multicastGroupId };\n            }\n        })();\n        // If a command is to be discarded before decryption,\n        // we still need to increment the SPAN or MPAN state\n        if (mustDiscardCommand) {\n            if (mcctx.isMulticast) {\n                await securityManager.nextPeerMPAN(ctx.sourceNodeId, mcctx.groupId);\n            }\n            else {\n                await securityManager.nextNonce(ctx.sourceNodeId);\n            }\n            validatePayload.fail(\"Invalid S2 extension\");\n        }\n        let prevSequenceNumber: number | undefined;\n        let mpanState: ReturnType<SecurityManager2[\"getPeerMPAN\"]> | undefined;\n        if (mcctx.isMulticast) {\n            mpanState = securityManager.getPeerMPAN(ctx.sourceNodeId, mcctx.groupId);\n        }\n        else {\n            // Don't accept duplicate Singlecast commands\n            prevSequenceNumber = validateSequenceNumber(securityManager, ctx.sourceNodeId, sequenceNumber);\n            // When a node receives a singlecast message after a multicast group was marked out of sync,\n            // it must forget about the group.\n            if (mcctx.groupId == undefined) {\n                securityManager.resetOutOfSyncMPANs(ctx.sourceNodeId);\n            }\n        }\n        const unencryptedPayload = raw.payload.subarray(0, offset);\n        const ciphertext = raw.payload.subarray(offset, -SECURITY_S2_AUTH_TAG_LENGTH);\n        const authTag = raw.payload.subarray(-SECURITY_S2_AUTH_TAG_LENGTH);\n        const messageLength = 2 /* CommandClass.computeEncapsulationOverhead() */\n            + raw.payload.length;\n        const authData = getAuthenticationData(ctx.sourceNodeId, getDestinationIDRX(ctx, extensions), ctx.homeId, messageLength, unencryptedPayload);\n        let decrypt: () => Promise<DecryptionResult>;\n        if (mcctx.isMulticast) {\n            // For incoming multicast commands, make sure we have an MPAN\n            if (mpanState?.type !== MPANState.MPAN) {\n                // If we don't, mark the MPAN as out of sync, so we can respond accordingly on the singlecast followup\n                securityManager.storePeerMPAN(ctx.sourceNodeId, mcctx.groupId, { type: MPANState.OutOfSync });\n                failNoMPAN();\n            }\n            decrypt = () => decryptMulticast(ctx.sourceNodeId, securityManager, mcctx.groupId, ciphertext, authData, authTag);\n        }\n        else {\n            // Decrypt payload and verify integrity\n            const spanState = securityManager.getSPANState(ctx.sourceNodeId);\n            // If we are not able to establish an SPAN yet, fail the decryption\n            if (spanState.type === SPANState.None) {\n                failNoSPAN();\n            }\n            else if (spanState.type === SPANState.RemoteEI) {\n                // TODO: The specs are not clear how to handle this case\n                // For now, do the same as if we didn't have any EI\n                failNoSPAN();\n            }\n            decrypt = () => decryptSinglecast(ctx, securityManager, ctx.sourceNodeId, sequenceNumber, prevSequenceNumber!, ciphertext, authData, authTag, spanState, extensions);\n        }\n        let plaintext: BytesView | undefined;\n        let authOK = false;\n        let key: BytesView | undefined;\n        let iv: BytesView | undefined;\n        let decryptionSecurityClass: SecurityClass | undefined;\n        // If the Receiver is unable to authenticate the singlecast message with the current SPAN,\n        // the Receiver SHOULD try decrypting the message with one or more of the following SPAN values,\n        // stopping when decryption is successful or the maximum number of iterations is reached.\n        // If the Receiver is unable to decrypt the S2 MC frame with the current MPAN, the Receiver MAY try\n        // decrypting the frame with one or more of the subsequent MPAN values, stopping when decryption is\n        // successful or the maximum number of iterations is reached.\n        const decryptAttempts = mcctx.isMulticast\n            ? MAX_DECRYPT_ATTEMPTS_MULTICAST\n            : mcctx.groupId != undefined\n                ? MAX_DECRYPT_ATTEMPTS_SC_FOLLOWUP\n                : MAX_DECRYPT_ATTEMPTS_SINGLECAST;\n        for (let i = 0; i < decryptAttempts; i++) {\n            ({\n                plaintext,\n                authOK,\n                key,\n                iv,\n                securityClass: decryptionSecurityClass,\n            } = await decrypt());\n            if (!!authOK && !!plaintext)\n                break;\n            // No need to try further SPANs if we just got the sender's EI\n            if (!!getSenderEI(extensions))\n                break;\n        }\n        // If authentication fails, do so with an error code that instructs the\n        // applHost to tell the node we have no nonce\n        if (!authOK || !plaintext) {\n            if (mcctx.isMulticast) {\n                // Mark the MPAN as out of sync\n                securityManager.storePeerMPAN(ctx.sourceNodeId, mcctx.groupId, { type: MPANState.OutOfSync });\n                validatePayload.fail(ZWaveErrorCodes.Security2CC_CannotDecodeMulticast);\n            }\n            else {\n                validatePayload.fail(ZWaveErrorCodes.Security2CC_CannotDecode);\n            }\n        }\n        else if (!mcctx.isMulticast && mcctx.groupId != undefined) {\n            // After reception of a singlecast followup, the MPAN state must be increased\n            securityManager.tryIncrementPeerMPAN(ctx.sourceNodeId, mcctx.groupId);\n        }\n        // Remember which security class was used to decrypt this message, so we can discard it later\n        const securityClass: SecurityClass | undefined = decryptionSecurityClass;\n        offset = 0;\n        if (hasEncryptedExtensions) {\n            const parseResult = parseExtensions(plaintext, true);\n            extensions.push(...parseResult.extensions);\n            offset += parseResult.bytesRead;\n            mustDiscardCommand = parseResult.mustDiscardCommand;\n        }\n        // Before we can continue, check if the command must be discarded\n        if (mustDiscardCommand) {\n            validatePayload.fail(\"Invalid extension\");\n        }\n        // The MPAN and MGRP extensions must not be sent together\n        const mpanExtension = extensions.find((e) => e instanceof MPANExtension);\n        if (mcctx.groupId != undefined && mpanExtension) {\n            validatePayload.fail(\"Invalid combination of extensions\");\n        }\n        // If the MPAN extension was received, store the MPAN\n        if (!mcctx.isMulticast) {\n            const mpanExtension = extensions.find((e) => e instanceof MPANExtension);\n            if (mpanExtension) {\n                securityManager.storePeerMPAN(ctx.sourceNodeId, mpanExtension.groupId, {\n                    type: MPANState.MPAN,\n                    currentMPAN: mpanExtension.innerMPANState,\n                });\n            }\n        }\n        // Not every S2 message includes an encapsulated CC\n        const decryptedCCBytes = plaintext.subarray(offset);\n        let encapsulated: CommandClass | undefined;\n        if (decryptedCCBytes.length > 0) {\n            // make sure this contains a complete CC command that's worth splitting\n            validatePayload(decryptedCCBytes.length >= 2);\n            // and deserialize the CC\n            encapsulated = await CommandClass.parse(decryptedCCBytes, ctx);\n        }\n        const ret = new Security2CCMessageEncapsulation({\n            nodeId: ctx.sourceNodeId,\n            sequenceNumber,\n            securityClass,\n            extensions,\n            encapsulated,\n        });\n        // Remember for debugging purposes\n        ret.key = key;\n        ret.iv = iv;\n        ret.authData = authData;\n        ret.authTag = authTag;\n        ret.plaintext = decryptedCCBytes;\n        return ret;\n    }\n    public readonly securityClass?: SecurityClass;\n    // Only used for testing/debugging purposes\n    private key?: BytesView;\n    private iv?: BytesView;\n    private authData?: BytesView;\n    private authTag?: BytesView;\n    private ciphertext?: BytesView;\n    private plaintext?: BytesView;\n    public readonly verifyDelivery: boolean = true;\n    public sequenceNumber: number | undefined;\n    private ensureSequenceNumber(securityManager: SecurityManager2): asserts this is this & {\n        sequenceNumber: number;\n    } {\n        if (this.sequenceNumber == undefined) {\n            if (this.isSinglecast()) {\n                this.sequenceNumber = securityManager.nextSequenceNumber(this.nodeId);\n            }\n            else {\n                const groupId = getDestinationIDTX.call(this);\n                this.sequenceNumber = securityManager\n                    .nextMulticastSequenceNumber(groupId);\n            }\n        }\n    }\n    public encapsulated?: CommandClass;\n    public extensions: Security2Extension[];\n    public override prepareRetransmission(): void {\n        super.prepareRetransmission();\n        this.sequenceNumber = undefined;\n    }\n    public hasMOSExtension(): boolean {\n        return this.extensions.some((e) => e instanceof MOSExtension);\n    }\n    /** Returns the Sender's Entropy Input if this command contains an SPAN extension */\n    public getSenderEI(): BytesView | undefined {\n        return getSenderEI(this.extensions);\n    }\n    /** Returns the multicast group ID if this command contains an MGRP extension */\n    public getMulticastGroupId(): number | undefined {\n        return getMulticastGroupId(this.extensions);\n    }\n    private async maybeAddSPANExtension(ctx: CCEncodingContext, securityManager: SecurityManager2): Promise<void> {\n        if (!this.isSinglecast())\n            return;\n        const receiverNodeId: number = this.nodeId;\n        const spanState = securityManager.getSPANState(receiverNodeId);\n        if (spanState.type === SPANState.None\n            || spanState.type === SPANState.LocalEI) {\n            // Can't do anything here if we don't have the receiver's EI\n            throw new ZWaveError(`Security S2 CC requires the receiver's nonce to be sent!`, ZWaveErrorCodes.Security2CC_NoSPAN);\n        }\n        else if (spanState.type === SPANState.RemoteEI) {\n            // We have the receiver's EI, generate our input and send it over\n            // With both, we can create an SPAN\n            const senderEI = await securityManager.generateNonce(undefined);\n            const receiverEI = spanState.receiverEI;\n            // While bootstrapping a node, prefer the temporary key, unless the\n            // specific command specifies a security class\n            if (this.securityClass == undefined\n                && securityManager.tempKeys.has(receiverNodeId)) {\n                await securityManager.initializeTempSPAN(receiverNodeId, senderEI, receiverEI);\n            }\n            else {\n                const securityClass = this.securityClass\n                    ?? ctx.getHighestSecurityClass(receiverNodeId);\n                if (securityClass == undefined) {\n                    throw new ZWaveError(\"No security class defined for this command!\", ZWaveErrorCodes.Security2CC_NoSPAN);\n                }\n                await securityManager.initializeSPAN(receiverNodeId, securityClass, senderEI, receiverEI);\n            }\n            // Add or update the SPAN extension\n            let spanExtension = this.extensions.find((e) => e instanceof SPANExtension);\n            if (spanExtension) {\n                spanExtension.senderEI = senderEI;\n            }\n            else {\n                spanExtension = new SPANExtension({ senderEI });\n                this.extensions.push(spanExtension);\n            }\n        }\n    }\n    public async serialize(ctx: CCEncodingContext): Promise<Bytes> {\n        const securityManager = assertSecurityTX(ctx, this.nodeId);\n        this.ensureSequenceNumber(securityManager);\n        // Include Sender EI in the command if we only have the receiver's EI\n        await this.maybeAddSPANExtension(ctx, securityManager);\n        const unencryptedExtensions = this.extensions.filter((e) => !e.isEncrypted());\n        const encryptedExtensions = this.extensions.filter((e) => e.isEncrypted());\n        const unencryptedPayload = Bytes.concat([\n            [\n                this.sequenceNumber,\n                (encryptedExtensions.length > 0 ? 0b10 : 0)\n                    | (unencryptedExtensions.length > 0 ? 1 : 0),\n            ],\n            ...unencryptedExtensions.map((e, index) => e.serialize(index < unencryptedExtensions.length - 1)),\n        ]);\n        const serializedCC = (await this.encapsulated?.serialize(ctx))\n            ?? new Bytes();\n        const plaintextPayload = Bytes.concat([\n            ...encryptedExtensions.map((e, index) => e.serialize(index < encryptedExtensions.length - 1)),\n            serializedCC,\n        ]);\n        // Generate the authentication data for CCM encryption\n        const destinationTag = getDestinationIDTX.call(this as Security2CCMessageEncapsulation);\n        const messageLength = this.computeEncapsulationOverhead()\n            + serializedCC.length;\n        const authData = getAuthenticationData(ctx.ownNodeId, destinationTag, ctx.homeId, messageLength, unencryptedPayload);\n        let key: BytesView;\n        let iv: BytesView;\n        if (this.isSinglecast()) {\n            // Singlecast:\n            // Generate a nonce for encryption, and remember it to attempt decryption\n            // of potential in-flight messages from the target node.\n            iv = await securityManager.nextNonce(this.nodeId, true);\n            const { keyCCM } = \n            // Prefer the overridden security class if it was given\n            this.securityClass != undefined\n                ? securityManager.getKeysForSecurityClass(this.securityClass)\n                : securityManager.getKeysForNode(this.nodeId);\n            key = keyCCM;\n        }\n        else {\n            // Multicast:\n            const keyAndIV = await securityManager.getMulticastKeyAndIV(destinationTag);\n            key = keyAndIV.key;\n            iv = keyAndIV.iv;\n        }\n        const { ciphertext: ciphertextPayload, authTag } = await encryptAES128CCM(plaintextPayload, key, iv, authData, SECURITY_S2_AUTH_TAG_LENGTH);\n        // Remember key and IV for debugging purposes\n        this.key = key;\n        this.iv = iv;\n        this.authData = authData;\n        this.authTag = authTag;\n        this.ciphertext = ciphertextPayload;\n        this.payload = Bytes.concat([\n            unencryptedPayload,\n            ciphertextPayload,\n            authTag,\n        ]);\n        return super.serialize(ctx);\n    }\n    protected computeEncapsulationOverhead(): number {\n        // Security S2 adds:\n        // * 1 byte sequence number\n        // * 1 byte control\n        // * N bytes extensions\n        // * SECURITY_S2_AUTH_TAG_LENGTH bytes auth tag\n        const extensionBytes = this.extensions\n            .map((e) => e.computeLength())\n            .reduce((a, b) => a + b, 0);\n        return (super.computeEncapsulationOverhead()\n            + 2\n            + SECURITY_S2_AUTH_TAG_LENGTH\n            + extensionBytes);\n    }\n    public toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry {\n        const message: MessageRecord = {\n            \"sequence number\": this.sequenceNumber ?? \"(not set)\",\n        };\n        if (this.extensions.length > 0) {\n            message.extensions = this.extensions\n                .map((e) => e.toLogEntry())\n                .join(\"\");\n        }\n        // Log the used keys in integration tests\n        if (process.env.NODE_ENV === \"test\"\n            || process.env.NODE_ENV === \"development\") {\n            if (this.key) {\n                message.key = buffer2hex(this.key);\n            }\n            if (this.iv) {\n                message.IV = buffer2hex(this.iv);\n            }\n            if (this.ciphertext) {\n                message.ciphertext = buffer2hex(this.ciphertext);\n            }\n            else if (this.plaintext) {\n                message.plaintext = buffer2hex(this.plaintext);\n            }\n            if (this.authData) {\n                message[\"auth data\"] = buffer2hex(this.authData);\n            }\n            if (this.authTag) {\n                message[\"auth tag\"] = buffer2hex(this.authTag);\n            }\n        }\n        if (this.securityClass != undefined) {\n            message[\"security class\"] = getEnumMemberName(SecurityClass, this.securityClass);\n        }\n        return {\n            ...super.toLogEntry(ctx),\n            message,\n        };\n    }\n}\n// @publicAPI\nexport type Security2CCNonceReportOptions = {\n    sequenceNumber?: number;\n} & ({\n    MOS: boolean;\n    SOS: true;\n    receiverEI: BytesView;\n} | {\n    MOS: true;\n    SOS: false;\n    receiverEI?: undefined;\n});\n@CCCommand(Security2Command.NonceReport)\nexport class Security2CCNonceReport extends Security2CC {\n    public constructor(options: WithAddress<Security2CCNonceReportOptions>) {\n        super(options);\n        this.SOS = options.SOS;\n        this.MOS = options.MOS;\n        this.sequenceNumber = options.sequenceNumber;\n        if (options.SOS)\n            this.receiverEI = options.receiverEI;\n    }\n    public static from(raw: CCRaw, ctx: CCParsingContext): Security2CCNonceReport {\n        // Make sure that we can send/receive secure commands\n        const securityManager = assertSecurityRX(ctx);\n        validatePayload(raw.payload.length >= 2);\n        const sequenceNumber = raw.payload[0];\n        // Don't accept duplicate commands\n        validateSequenceNumber(securityManager, ctx.sourceNodeId, sequenceNumber);\n        const MOS = !!(raw.payload[1] & 0b10);\n        const SOS = !!(raw.payload[1] & 0b1);\n        if (SOS) {\n            // If the SOS flag is set, the REI field MUST be included in the command\n            validatePayload(raw.payload.length >= 18);\n            const receiverEI = raw.payload.subarray(2, 18);\n            // In that case we also need to store it, so the next sent command\n            // can use it for encryption\n            securityManager.storeRemoteEI(ctx.sourceNodeId, receiverEI);\n            return new this({\n                nodeId: ctx.sourceNodeId,\n                sequenceNumber,\n                MOS,\n                SOS,\n                receiverEI,\n            });\n        }\n        else if (MOS) {\n            return new this({\n                nodeId: ctx.sourceNodeId,\n                sequenceNumber,\n                MOS,\n                SOS: false,\n            });\n        }\n        else {\n            validatePayload.fail(\"Either MOS or SOS must be set\");\n        }\n    }\n    public sequenceNumber: number | undefined;\n    private ensureSequenceNumber(securityManager: SecurityManager2): asserts this is this & {\n        sequenceNumber: number;\n    } {\n        if (this.sequenceNumber == undefined) {\n            this.sequenceNumber = securityManager.nextSequenceNumber(this.nodeId as number);\n        }\n    }\n    public readonly SOS: boolean;\n    public readonly MOS: boolean;\n    public readonly receiverEI?: BytesView;\n    public serialize(ctx: CCEncodingContext): Promise<Bytes> {\n        const securityManager = assertSecurityTX(ctx, this.nodeId);\n        this.ensureSequenceNumber(securityManager);\n        this.payload = Bytes.from([\n            this.sequenceNumber,\n            (this.MOS ? 0b10 : 0) + (this.SOS ? 0b1 : 0),\n        ]);\n        if (this.SOS) {\n            this.payload = Bytes.concat([this.payload, this.receiverEI!]);\n        }\n        return super.serialize(ctx);\n    }\n    public toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry {\n        const message: MessageRecord = {\n            \"sequence number\": this.sequenceNumber ?? \"(not set)\",\n            SOS: this.SOS,\n            MOS: this.MOS,\n        };\n        if (this.receiverEI) {\n            message[\"receiver entropy\"] = buffer2hex(this.receiverEI);\n        }\n        return {\n            ...super.toLogEntry(ctx),\n            message,\n        };\n    }\n}\n// @publicAPI\nexport interface Security2CCNonceGetOptions {\n    sequenceNumber?: number;\n}\n@CCCommand(Security2Command.NonceGet)\n@expectedCCResponse(Security2CCNonceReport)\nexport class Security2CCNonceGet extends Security2CC {\n    // TODO: A node sending this command MUST accept a delay up to <Previous Round-trip-time to peer node> +\n    // 250 ms before receiving the Security 2 Nonce Report Command.\n    public constructor(options: WithAddress<Security2CCNonceGetOptions>) {\n        super(options);\n        this.sequenceNumber = options.sequenceNumber;\n    }\n    public static from(raw: CCRaw, ctx: CCParsingContext): Security2CCNonceGet {\n        const securityManager = assertSecurityRX(ctx);\n        validatePayload(raw.payload.length >= 1);\n        const sequenceNumber = raw.payload[0];\n        // Don't accept duplicate commands\n        validateSequenceNumber(securityManager, ctx.sourceNodeId, sequenceNumber);\n        return new this({\n            nodeId: ctx.sourceNodeId,\n            sequenceNumber,\n        });\n    }\n    public sequenceNumber: number | undefined;\n    private ensureSequenceNumber(securityManager: SecurityManager2): asserts this is this & {\n        sequenceNumber: number;\n    } {\n        if (this.sequenceNumber == undefined) {\n            this.sequenceNumber = securityManager.nextSequenceNumber(this.nodeId as number);\n        }\n    }\n    public serialize(ctx: CCEncodingContext): Promise<Bytes> {\n        const securityManager = assertSecurityTX(ctx, this.nodeId);\n        this.ensureSequenceNumber(securityManager);\n        this.payload = Bytes.from([this.sequenceNumber]);\n        return super.serialize(ctx);\n    }\n    public toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry {\n        return {\n            ...super.toLogEntry(ctx),\n            message: {\n                \"sequence number\": this.sequenceNumber ?? \"(not set)\",\n            },\n        };\n    }\n}\n// @publicAPI\nexport interface Security2CCKEXReportOptions {\n    requestCSA: boolean;\n    echo: boolean;\n    _reserved?: number;\n    supportedKEXSchemes: KEXSchemes[];\n    supportedECDHProfiles: ECDHProfiles[];\n    requestedKeys: SecurityClass[];\n}\n@CCCommand(Security2Command.KEXReport)\nexport class Security2CCKEXReport extends Security2CC {\n    public constructor(options: WithAddress<Security2CCKEXReportOptions>) {\n        super(options);\n        this.requestCSA = options.requestCSA;\n        this.echo = options.echo;\n        this._reserved = options._reserved ?? 0;\n        this.supportedKEXSchemes = options.supportedKEXSchemes;\n        this.supportedECDHProfiles = options.supportedECDHProfiles;\n        this.requestedKeys = options.requestedKeys;\n    }\n    public static from(raw: CCRaw, ctx: CCParsingContext): Security2CCKEXReport {\n        validatePayload(raw.payload.length >= 4);\n        const requestCSA = !!(raw.payload[0] & 0b10);\n        const echo = !!(raw.payload[0] & 0b1);\n        // Remember the reserved bits for the echo\n        const _reserved = raw.payload[0] & 252;\n        // The bit mask starts at 0, but bit 0 is not used\n        const supportedKEXSchemes: KEXSchemes[] = parseBitMask(raw.payload.subarray(1, 2), 0).filter((s) => s !== 0);\n        const supportedECDHProfiles: ECDHProfiles[] = parseBitMask(raw.payload.subarray(2, 3), ECDHProfiles.Curve25519);\n        const requestedKeys: SecurityClass[] = parseBitMask(raw.payload.subarray(3, 4), SecurityClass.S2_Unauthenticated);\n        return new this({\n            nodeId: ctx.sourceNodeId,\n            requestCSA,\n            echo,\n            _reserved,\n            supportedKEXSchemes,\n            supportedECDHProfiles,\n            requestedKeys,\n        });\n    }\n    public readonly _reserved: number;\n    public readonly requestCSA: boolean;\n    public readonly echo: boolean;\n    public readonly supportedKEXSchemes: readonly KEXSchemes[];\n    public readonly supportedECDHProfiles: readonly ECDHProfiles[];\n    public readonly requestedKeys: readonly SecurityClass[];\n    public serialize(ctx: CCEncodingContext): Promise<Bytes> {\n        this.payload = Bytes.concat([\n            [\n                this._reserved\n                    + (this.requestCSA ? 0b10 : 0)\n                    + (this.echo ? 0b1 : 0),\n            ],\n            // The bit mask starts at 0, but bit 0 is not used\n            encodeBitMask(this.supportedKEXSchemes, 7, 0),\n            encodeBitMask(this.supportedECDHProfiles, 7, ECDHProfiles.Curve25519),\n            encodeBitMask(this.requestedKeys, SecurityClass.S0_Legacy, SecurityClass.S2_Unauthenticated),\n        ]);\n        return super.serialize(ctx);\n    }\n    public toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry {\n        return {\n            ...super.toLogEntry(ctx),\n            message: {\n                echo: this.echo,\n                \"supported schemes\": this.supportedKEXSchemes\n                    .map((s) => `\\n\u00B7 ${getEnumMemberName(KEXSchemes, s)}`)\n                    .join(\"\"),\n                \"supported ECDH profiles\": this.supportedECDHProfiles\n                    .map((s) => `\\n\u00B7 ${getEnumMemberName(ECDHProfiles, s)}`)\n                    .join(\"\"),\n                \"CSA requested\": this.requestCSA,\n                \"requested security classes\": this.requestedKeys\n                    .map((s) => `\\n\u00B7 ${getEnumMemberName(SecurityClass, s)}`)\n                    .join(\"\"),\n            },\n        };\n    }\n}\n@CCCommand(Security2Command.KEXGet)\n@expectedCCResponse(Security2CCKEXReport)\nexport class Security2CCKEXGet extends Security2CC {\n}\n// @publicAPI\nexport interface Security2CCKEXSetOptions {\n    permitCSA: boolean;\n    echo: boolean;\n    _reserved?: number;\n    selectedKEXScheme: KEXSchemes;\n    selectedECDHProfile: ECDHProfiles;\n    grantedKeys: SecurityClass[];\n}\nfunction getExpectedResponseForKEXSet(ctx: GetNode<NodeId & SupportsCC>, sent: Security2CCKEXSet) {\n    if (sent.echo) {\n        return [Security2CCKEXReport, Security2CCKEXFail];\n    }\n    else {\n        return undefined;\n    }\n}\nfunction testExpectedResponseForKEXSet(sent: Security2CCKEXSet, received: any): CCResponseRole {\n    if (sent.echo) {\n        if (received instanceof Security2CCKEXReport) {\n            return received.echo;\n        }\n        else if (received instanceof Security2CCKEXFail) {\n            return true;\n        }\n    }\n    return false;\n}\n@CCCommand(Security2Command.KEXSet)\n@expectedCCResponse(getExpectedResponseForKEXSet, testExpectedResponseForKEXSet)\nexport class Security2CCKEXSet extends Security2CC {\n    public constructor(options: WithAddress<Security2CCKEXSetOptions>) {\n        super(options);\n        this.permitCSA = options.permitCSA;\n        this.echo = options.echo;\n        this._reserved = options._reserved ?? 0;\n        this.selectedKEXScheme = options.selectedKEXScheme;\n        this.selectedECDHProfile = options.selectedECDHProfile;\n        this.grantedKeys = options.grantedKeys;\n    }\n    public static from(raw: CCRaw, ctx: CCParsingContext): Security2CCKEXSet {\n        validatePayload(raw.payload.length >= 4);\n        const _reserved = raw.payload[0] & 252;\n        const permitCSA = !!(raw.payload[0] & 0b10);\n        const echo = !!(raw.payload[0] & 0b1);\n        // The bit mask starts at 0, but bit 0 is not used\n        const selectedKEXSchemes = parseBitMask(raw.payload.subarray(1, 2), 0).filter((s) => s !== 0);\n        validatePayload(selectedKEXSchemes.length === 1);\n        const selectedKEXScheme: KEXSchemes = selectedKEXSchemes[0];\n        const selectedECDHProfiles = parseBitMask(raw.payload.subarray(2, 3), ECDHProfiles.Curve25519);\n        validatePayload(selectedECDHProfiles.length === 1);\n        const selectedECDHProfile: ECDHProfiles = selectedECDHProfiles[0];\n        const grantedKeys: SecurityClass[] = parseBitMask(raw.payload.subarray(3, 4), SecurityClass.S2_Unauthenticated);\n        return new this({\n            nodeId: ctx.sourceNodeId,\n            _reserved,\n            permitCSA,\n            echo,\n            selectedKEXScheme,\n            selectedECDHProfile,\n            grantedKeys,\n        });\n    }\n    public readonly _reserved: number;\n    public permitCSA: boolean;\n    public echo: boolean;\n    public selectedKEXScheme: KEXSchemes;\n    public selectedECDHProfile: ECDHProfiles;\n    public grantedKeys: SecurityClass[];\n    public serialize(ctx: CCEncodingContext): Promise<Bytes> {\n        this.payload = Bytes.concat([\n            [\n                this._reserved\n                    + (this.permitCSA ? 0b10 : 0)\n                    + (this.echo ? 0b1 : 0),\n            ],\n            // The bit mask starts at 0, but bit 0 is not used\n            encodeBitMask([this.selectedKEXScheme], 7, 0),\n            encodeBitMask([this.selectedECDHProfile], 7, ECDHProfiles.Curve25519),\n            encodeBitMask(this.grantedKeys, SecurityClass.S0_Legacy, SecurityClass.S2_Unauthenticated),\n        ]);\n        return super.serialize(ctx);\n    }\n    public toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry {\n        return {\n            ...super.toLogEntry(ctx),\n            message: {\n                echo: this.echo,\n                \"selected scheme\": getEnumMemberName(KEXSchemes, this.selectedKEXScheme),\n                \"selected ECDH profile\": getEnumMemberName(ECDHProfiles, this.selectedECDHProfile),\n                \"CSA permitted\": this.permitCSA,\n                \"granted security classes\": this.grantedKeys\n                    .map((s) => `\\n\u00B7 ${getEnumMemberName(SecurityClass, s)}`)\n                    .join(\"\"),\n            },\n        };\n    }\n}\n// @publicAPI\nexport interface Security2CCKEXFailOptions {\n    failType: KEXFailType;\n}\n@CCCommand(Security2Command.KEXFail)\nexport class Security2CCKEXFail extends Security2CC {\n    public constructor(options: WithAddress<Security2CCKEXFailOptions>) {\n        super(options);\n        this.failType = options.failType;\n    }\n    public static from(raw: CCRaw, ctx: CCParsingContext): Security2CCKEXFail {\n        validatePayload(raw.payload.length >= 1);\n        const failType: KEXFailType = raw.payload[0];\n        return new this({\n            nodeId: ctx.sourceNodeId,\n            failType,\n        });\n    }\n    public failType: KEXFailType;\n    public serialize(ctx: CCEncodingContext): Promise<Bytes> {\n        this.payload = Bytes.from([this.failType]);\n        return super.serialize(ctx);\n    }\n    public toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry {\n        return {\n            ...super.toLogEntry(ctx),\n            message: { reason: getEnumMemberName(KEXFailType, this.failType) },\n        };\n    }\n}\n// @publicAPI\nexport interface Security2CCPublicKeyReportOptions {\n    includingNode: boolean;\n    publicKey: BytesView;\n}\n@CCCommand(Security2Command.PublicKeyReport)\nexport class Security2CCPublicKeyReport extends Security2CC {\n    public constructor(options: WithAddress<Security2CCPublicKeyReportOptions>) {\n        super(options);\n        this.includingNode = options.includingNode;\n        this.publicKey = options.publicKey;\n    }\n    public static from(raw: CCRaw, ctx: CCParsingContext): Security2CCPublicKeyReport {\n        validatePayload(raw.payload.length >= 17);\n        const includingNode = !!(raw.payload[0] & 0b1);\n        const publicKey: BytesView = raw.payload.subarray(1);\n        return new this({\n            nodeId: ctx.sourceNodeId,\n            includingNode,\n            publicKey,\n        });\n    }\n    public includingNode: boolean;\n    public publicKey: BytesView;\n    public serialize(ctx: CCEncodingContext): Promise<Bytes> {\n        this.payload = Bytes.concat([\n            [this.includingNode ? 1 : 0],\n            this.publicKey,\n        ]);\n        return super.serialize(ctx);\n    }\n    public toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry {\n        return {\n            ...super.toLogEntry(ctx),\n            message: {\n                \"is including node\": this.includingNode,\n                \"public key\": buffer2hex(this.publicKey),\n            },\n        };\n    }\n}\n// @publicAPI\nexport interface Security2CCNetworkKeyReportOptions {\n    grantedKey: SecurityClass;\n    networkKey: BytesView;\n}\n@CCCommand(Security2Command.NetworkKeyReport)\nexport class Security2CCNetworkKeyReport extends Security2CC {\n    public constructor(options: WithAddress<Security2CCNetworkKeyReportOptions>) {\n        super(options);\n        this.grantedKey = options.grantedKey;\n        this.networkKey = options.networkKey;\n    }\n    public static from(raw: CCRaw, ctx: CCParsingContext): Security2CCNetworkKeyReport {\n        validatePayload(raw.payload.length >= 17);\n        const grantedKey: SecurityClass = bitMaskToSecurityClass(raw.payload, 0);\n        const networkKey = raw.payload.subarray(1, 17);\n        return new this({\n            nodeId: ctx.sourceNodeId,\n            grantedKey,\n            networkKey,\n        });\n    }\n    public grantedKey: SecurityClass;\n    public networkKey: BytesView;\n    public serialize(ctx: CCEncodingContext): Promise<Bytes> {\n        this.payload = Bytes.concat([\n            securityClassToBitMask(this.grantedKey),\n            this.networkKey,\n        ]);\n        return super.serialize(ctx);\n    }\n    public toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry {\n        return {\n            ...super.toLogEntry(ctx),\n            message: {\n                \"security class\": getEnumMemberName(SecurityClass, this.grantedKey),\n                // This shouldn't be logged, so users can safely post their logs online\n                // \"network key\": buffer2hex(this.networkKey),\n            },\n        };\n    }\n}\n// @publicAPI\nexport interface Security2CCNetworkKeyGetOptions {\n    requestedKey: SecurityClass;\n}\n@CCCommand(Security2Command.NetworkKeyGet)\n// Don't expect a response - we need to distinguish between Report and Fail\n// FIXME: maybe use the dynamic @expectedCCResponse instead?\nexport class Security2CCNetworkKeyGet extends Security2CC {\n    public constructor(options: WithAddress<Security2CCNetworkKeyGetOptions>) {\n        super(options);\n        this.requestedKey = options.requestedKey;\n    }\n    public static from(raw: CCRaw, ctx: CCParsingContext): Security2CCNetworkKeyGet {\n        validatePayload(raw.payload.length >= 1);\n        const requestedKey: SecurityClass = bitMaskToSecurityClass(raw.payload, 0);\n        return new this({\n            nodeId: ctx.sourceNodeId,\n            requestedKey,\n        });\n    }\n    public requestedKey: SecurityClass;\n    public serialize(ctx: CCEncodingContext): Promise<Bytes> {\n        this.payload = securityClassToBitMask(this.requestedKey);\n        return super.serialize(ctx);\n    }\n    public toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry {\n        return {\n            ...super.toLogEntry(ctx),\n            message: {\n                \"security class\": getEnumMemberName(SecurityClass, this.requestedKey),\n            },\n        };\n    }\n}\n@CCCommand(Security2Command.NetworkKeyVerify)\nexport class Security2CCNetworkKeyVerify extends Security2CC {\n}\n// @publicAPI\nexport interface Security2CCTransferEndOptions {\n    keyVerified: boolean;\n    keyRequestComplete: boolean;\n}\n@CCCommand(Security2Command.TransferEnd)\nexport class Security2CCTransferEnd extends Security2CC {\n    public constructor(options: WithAddress<Security2CCTransferEndOptions>) {\n        super(options);\n        this.keyVerified = options.keyVerified;\n        this.keyRequestComplete = options.keyRequestComplete;\n    }\n    public static from(raw: CCRaw, ctx: CCParsingContext): Security2CCTransferEnd {\n        validatePayload(raw.payload.length >= 1);\n        const keyVerified = !!(raw.payload[0] & 0b10);\n        const keyRequestComplete = !!(raw.payload[0] & 0b1);\n        return new this({\n            nodeId: ctx.sourceNodeId,\n            keyVerified,\n            keyRequestComplete,\n        });\n    }\n    public keyVerified: boolean;\n    public keyRequestComplete: boolean;\n    public serialize(ctx: CCEncodingContext): Promise<Bytes> {\n        this.payload = Bytes.from([\n            (this.keyVerified ? 0b10 : 0) + (this.keyRequestComplete ? 0b1 : 0),\n        ]);\n        return super.serialize(ctx);\n    }\n    public toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry {\n        return {\n            ...super.toLogEntry(ctx),\n            message: {\n                \"key verified\": this.keyVerified,\n                \"request complete\": this.keyRequestComplete,\n            },\n        };\n    }\n}\n// @publicAPI\nexport interface Security2CCCommandsSupportedReportOptions {\n    supportedCCs: CommandClasses[];\n}\n@CCCommand(Security2Command.CommandsSupportedReport)\nexport class Security2CCCommandsSupportedReport extends Security2CC {\n    public constructor(options: WithAddress<Security2CCCommandsSupportedReportOptions>) {\n        super(options);\n        this.supportedCCs = options.supportedCCs;\n    }\n    public static from(raw: CCRaw, ctx: CCParsingContext): Security2CCCommandsSupportedReport {\n        const CCs = parseCCList(raw.payload);\n        // SDS13783: A sending node MAY terminate the list of supported command classes with the\n        // COMMAND_CLASS_MARK command class identifier.\n        // A receiving node MUST stop parsing the list of supported command classes if it detects the\n        // COMMAND_CLASS_MARK command class identifier in the Security 2 Commands Supported Report\n        const supportedCCs = CCs.supportedCCs;\n        return new this({\n            nodeId: ctx.sourceNodeId,\n            supportedCCs,\n        });\n    }\n    public readonly supportedCCs: CommandClasses[];\n    public serialize(ctx: CCEncodingContext): Promise<Bytes> {\n        this.payload = encodeCCList(this.supportedCCs, []);\n        return super.serialize(ctx);\n    }\n    public toLogEntry(ctx?: GetValueDB): MessageOrCCLogEntry {\n        return {\n            ...super.toLogEntry(ctx),\n            message: {\n                \"supported CCs\": this.supportedCCs\n                    .map((cc) => getCCName(cc))\n                    .map((cc) => `\\n\u00B7 ${cc}`)\n                    .join(\"\"),\n            },\n        };\n    }\n}\n@CCCommand(Security2Command.CommandsSupportedGet)\n@expectedCCResponse(Security2CCCommandsSupportedReport)\nexport class Security2CCCommandsSupportedGet extends Security2CC {\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,kBAA6qB;AAC7qB,oBAA4E;AAC5E,mBAAqB;AACrB,wBAAwB;AACxB,iBAAsB;AACtB,0BAAsF;AACtF,oCAAsF;AACtF,uBAA+I;AAC/I,IAAAA,iBAAuD;AACvD,mBAAiC;AAEjC,qBAAwB;AACxB,4BAA+B;AAC/B,wBAA2B;AAC3B,gCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACnC,SAAS,uBAAuB,KAAkB;AAC9C,aAAO,2BAAc,CAAC,GAAG,GAAG,0BAAc,WAAW,0BAAc,kBAAkB;AACzF;AAFS;AAGT,SAAS,uBAAuB,QAAmB,QAAc;AAC7D,QAAM,WAAO,0BAAa,OAAO,SAAS,QAAQ,SAAS,CAAC,GAAG,0BAAc,kBAAkB;AAC/F,mCAAgB,KAAK,WAAW,CAAC;AACjC,SAAO,KAAK,CAAC;AACjB;AAJS;AAKT,MAAM,8BAA8B;AACpC,SAAS,sBAAsB,eAAuB,aAAqB,QAAgB,eAAuB,oBAA6B;AAC3I,QAAM,iBAAa,+BAAkB,aAAa,SAAK,+BAAkB,WAAW,IAC9E,IACA;AACN,QAAM,MAAM,IAAI,oBAAM,IAAI,aAAa,IAAI,mBAAmB,MAAM;AACpE,MAAI,SAAS;AACb,MAAI,YAAY,eAAe,QAAQ,UAAU;AACjD,YAAU;AACV,MAAI,YAAY,aAAa,QAAQ,UAAU;AAC/C,YAAU;AACV,MAAI,cAAc,QAAQ,MAAM;AAChC,YAAU;AACV,MAAI,cAAc,eAAe,MAAM;AACvC,YAAU;AAEV,MAAI,IAAI,oBAAoB,MAAM;AAClC,SAAO;AACX;AAjBS;AAkBT,SAAS,mBAAmB,WAAmB,kBAAoC,aAA0C;AACzH,QAAM,gBAAY,+BAAkB,SAAS,SACtC,mCAAkB,2BAAQ,WAAW,IAAI,YAAY,CAAC,IAAI,WAAW;AAC5E,SAAO,YACD,iBAAiB,oBACjB,iBAAiB;AAC3B;AANS;AAQT,SAAS,uBAAuB,iBAAmC,cAAsB,gBAAsB;AAC3G,8BAAgB,WAAW,sCAAsC,cAAc,GAAG,EAAE,CAAC,gBAAgB,sBAAsB,cAAc,cAAc,CAAC;AAExJ,SAAO,gBAAgB,oBAAoB,cAAc,cAAc;AAC3E;AAJS;AAKT,MAAM,kCAAkC;AACxC,MAAM,iCAAiC;AACvC,MAAM,mCAAmC;AASzC,SAAS,iBAAiB,KAAqB;AAC3C,MAAI,CAAC,IAAI,WAAW;AAChB,UAAM,IAAI,uBAAW,oFAAoF,4BAAgB,eAAe;EAC5I;AACA,QAAM,MAAM,mBAAmB,IAAI,WAAW,KAAK,IAAI,YAAY;AACnE,MAAI,CAAC,KAAK;AACN,UAAM,IAAI,uBAAW,iFAAiF,4BAAgB,iBAAiB;EAC3I;AACA,SAAO;AACX;AATS;AAUT,SAAS,iBAAiB,KAAwB,aAA0C;AACxF,MAAI,CAAC,IAAI,WAAW;AAChB,UAAM,IAAI,uBAAW,iFAAiF,4BAAgB,eAAe;EACzI;AACA,QAAM,MAAM,mBAAmB,IAAI,WAAW,KAAK,WAAW;AAC9D,MAAI,CAAC,KAAK;AACN,UAAM,IAAI,uBAAW,8EAA8E,4BAAgB,iBAAiB;EACxI;AACA,SAAO;AACX;AATS;AAUT,eAAe,kBAAkB,KAAuB,iBAAmC,eAAuB,mBAA2B,oBAA4B,YAAuB,UAAqB,SAAoB,WAEtO,YAAgC;AAC/B,QAAM,mBAAmB,8BAAO,UAAoB;AAChD,UAAM,EAAE,QAAQ,IAAG,IAAK,gBAAgB,eAAe,aAAa;AACpE,UAAM,KAAK;AACX,UAAM,MAAM,UAAM,8BAAiB,YAAY,KAAK,IAAI,UAAU,OAAO;AACzE,WAAO;MACH;MACA;MACA,GAAG;;EAEX,GATyB;AAUzB,QAAM,qBAAqB,mCAAW;AAClC,UAAM,KAAK,MAAM,gBAAgB,UAAU,aAAa;AACxD,WAAO,iBAAiB,EAAE;EAC9B,GAH2B;AAI3B,MAAI,UAAU,SAAS,sBAAU,MAAM;AAKnC;;MAEA,CAAC,CAAC,UAAU,eAEL,UAAU,YAAY,cAAU,8BAAgB,KAEhD,sBAAsB,UACtB,uBAAwB,qBAAqB,IAAK,QAElD,CAAC,IAAI;MAAsB;AAC9B,YAAM,QAAQ,UAAU,YAAY;AACpC,gBAAU,cAAc;AAExB,YAAM,SAAS,MAAM,iBAAiB,KAAK;AAC3C,UAAI,OAAO,QAAQ;AACf,eAAO;UACH,GAAG;UACH,eAAe,UAAU;;MAEjC;IAEJ,OACK;AAED,gBAAU,cAAc;IAC5B;AAEA,WAAO;MACH,GAAI,MAAM,mBAAkB;MAC5B,eAAe,UAAU;;EAEjC,WACS,UAAU,SAAS,sBAAU,SAAS;AAG3C,UAAM,WAAW,YAAY,UAAU;AACvC,QAAI,CAAC;AACD,iBAAU;AACd,UAAM,aAAa,UAAU;AAE7B,UAAM,sBAAsB,gBAAgB,SAAS,IAAI,aAAa;AACtE,QAAI,qBAAqB;AAErB,YAAM,gBAAgB,mBAAmB,eAAe,UAAU,UAAU;AAC5E,YAAM,MAAM,MAAM,mBAAkB;AAEpC,UAAI,IAAI,QAAQ;AACZ,eAAO;UACH,GAAG;UACH,eAAe,0BAAc;;MAErC;AAEA,sBAAgB,aAAa,eAAe,SAAS;IACzD;AAUA,UAAM,0BAA0B,sBAC1B,CAAC,IAAI,wBAAwB,aAAa,CAAE,IAC5C,+BAAmB,OAAO,CAAC,MAAM,IAAI,iBAAiB,eAAe,CAAC,MAChE,KAAK;AACjB,eAAW,YAAY,yBAAyB;AAE5C,UAAI,CAAC,gBAAgB,wBAAwB,QAAQ,GAAG;AACpD;MACJ;AAEA,YAAM,gBAAgB,eAAe,eAAe,UAAU,UAAU,UAAU;AAClF,YAAM,MAAM,MAAM,mBAAkB;AAEpC,UAAI,IAAI,QAAQ;AAEZ,YAAI,IAAI,iBAAiB,eAAe,QAAQ,MACxC,QAAW;AACf,cAAI,iBAAiB,eAAe,UAAU,IAAI;QACtD;AACA,eAAO;UACH,GAAG;UACH,eAAe;;MAEvB,OACK;AAED,wBAAgB,aAAa,eAAe,SAAS;MACzD;IACJ;EACJ;AAEA,SAAO;IACH,WAAW,IAAI,WAAU;IACzB,QAAQ;IACR,eAAe;;AAEvB;AA1He;AA2Hf,eAAe,iBAAiB,eAAuB,iBAAmC,SAAiB,YAAuB,UAAqB,SAAkB;AACrK,QAAM,KAAK,MAAM,gBAAgB,aAAa,eAAe,OAAO;AACpE,QAAM,EAAE,QAAQ,IAAG,IAAK,gBAAgB,eAAe,aAAa;AACpE,SAAO;IACH;IACA;IACA,GAAI,UAAM,8BAAiB,YAAY,KAAK,IAAI,UAAU,OAAO;;IAEjE,eAAe;;AAEvB;AAVe;AAWf,SAAS,gBAAgB,QAAmB,cAAqB;AAK7D,QAAM,aAAmC,CAAA;AACzC,MAAI,qBAAqB;AACzB,MAAI,SAAS;AACb,UAAS,QAAO,MAAM;AAClB,QAAI,OAAO,SAAS,SAAS,GAAG;AAE5B,2BAAqB;AACrB,YAAM;IACV;AAGA,UAAM,EAAE,QAAQ,cAAc,UAAU,eAAc,IAAK,oCACtD,mBAAmB,OAAO,SAAS,MAAM,CAAC;AAE/C,UAAM,kBAAkB,kBAAkB;AAC1C,QAAI,kBAAkB,GAAG;AAErB,2BAAqB;AACrB,YAAM;IACV,WACS,kBACH,OAAO,SACH,UACC,eACG,IACA,8BAA8B;AAExC,2BAAqB;AACrB,YAAM;IACV;AACA,UAAM,gBAAgB,OAAO,SAAS,QAAQ,SAAS,eAAe;AACtE,cAAU;AACV,UAAM,MAAM,oCAAmB,MAAM,aAAa;AAClD,gBAAQ,sCAAoB,KAAK,YAAY,GAAG;MAC5C,KAAK,2CAA0B;AAC3B,YAAI,kBAAkB,UACf,iBAAiB,gBAAgB;QAExC,OACK;AACD,qBAAW,KAAK,GAAG;QACvB;AACA;MACJ,KAAK,2CAA0B;AAE3B;MACJ,KAAK,2CAA0B;AAC3B,6BAAqB;AACrB;IACR;AAEA,QAAI,CAAC,IAAI;AACL,YAAM;EACd;AACA,SAAO;IACH;IACA;IACA,WAAW;;AAEnB;AAhES;AAiET,SAAS,qBAAkB;AAGvB,MAAI,KAAK,aAAY;AACjB,WAAO,KAAK;AAChB,QAAM,MAAM,oBAAoB,KAAK,UAAU;AAC/C,MAAI,OAAO,QAAW;AAClB,UAAM,IAAI,uBAAW,mEAAmE,4BAAgB,4BAA4B;EACxI;AACA,SAAO;AACX;AAVS;AAWT,SAAS,mBAAmB,KAAuB,YAAgC;AAC/E,MAAI,IAAI,cAAc,cAAc;AAChC,WAAO,IAAI;EACf;AACA,QAAM,MAAM,oBAAoB,UAAU;AAC1C,MAAI,OAAO,QAAW;AAClB,UAAM,IAAI,uBAAW,mEAAmE,4BAAgB,4BAA4B;EACxI;AACA,SAAO;AACX;AATS;AAUT,SAAS,oBAAoB,YAAgC;AACzD,QAAM,gBAAgB,WAAW,KAAK,CAAC,MAAM,aAAa,8BAAa;AACvE,SAAO,eAAe;AAC1B;AAHS;AAKT,SAAS,YAAY,YAAgC;AACjD,QAAM,gBAAgB,WAAW,KAAK,CAAC,MAAM,aAAa,8BAAa;AACvE,SAAO,eAAe;AAC1B;AAHS;IAQI,kBAAc,MAAA;8BAD1B,mCAAI,2BAAe,YAAY,CAAC,CAAC;;;;oBACE;sCAAA,YAAK;WAAA;;;;;;;;AAAzC,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;IACF,gBAAgB,MAAsB;AAEzC,aAAO;IACX;;;;;IAKO,MAAM,YAAS;AAClB,WAAK,sBAAsB,+BAAkB,8BAAiB,WAAW;AACzE,WAAK,uBAAuB,KAAK,QAAQ;AACzC,YAAM,kBAAkB,mBAAmB,KAAK,KAAK,WAAW,KAAK,MAAM,KAAK,SAAS,MAAM;AAC/F,UAAI,CAAC,iBAAiB;AAClB,cAAM,IAAI,uBAAW,8DAA8D,4BAAgB,iBAAiB;MACxH;AACA,YAAM,aAAa,MAAM,gBAAgB,cAAc,KAAK,SAAS,MAAM;AAC3E,YAAM,KAAK,IAAI,uBAAuB;QAClC,QAAQ,KAAK,SAAS;QACtB,eAAe,KAAK,SAAS;QAC7B,KAAK;QACL,KAAK;QACL;OACH;AACD,UAAI;AACA,cAAM,KAAK,KAAK,YAAY,IAAI;UAC5B,GAAG,KAAK;;UAER,iBAAiB,4BAAgB,MAC3B,4BAAgB;;UAEtB,iBAAiB;;UAEjB,UAAU,4BAAgB;;UAE1B,8BAA8B;;SAEjC;MACL,SACO,GAAG;AACN,gBAAI,iCAAoB,CAAC,GAAG;AAExB,0BAAgB,YAAY,KAAK,SAAS,MAAM;AAChD,iBAAO;QACX,OACK;AAED,gBAAM;QACV;MACJ;AACA,aAAO;IACX;;IAEO,MAAM,UAAO;AAChB,WAAK,sBAAsB,+BAAkB,8BAAiB,WAAW;AACzE,WAAK,uBAAuB,KAAK,QAAQ;AACzC,YAAM,KAAK,IAAI,uBAAuB;QAClC,QAAQ,KAAK,SAAS;QACtB,eAAe,KAAK,SAAS;QAC7B,KAAK;QACL,KAAK;OACR;AACD,UAAI;AACA,cAAM,KAAK,KAAK,YAAY,IAAI;UAC5B,GAAG,KAAK;;UAER,iBAAiB,4BAAgB,MAC3B,4BAAgB;;UAEtB,iBAAiB;;UAEjB,UAAU,4BAAgB;;UAE1B,8BAA8B;SACjC;MACL,SACO,GAAG;AACN,gBAAI,iCAAoB,CAAC,GAAG;AACxB,iBAAO;QACX,OACK;AAED,gBAAM;QACV;MACJ;AACA,aAAO;IACX;;IAEO,MAAM,SAAS,SAAiB,gBAAyB;AAC5D,WAAK,sBAAsB,+BAAkB,8BAAiB,oBAAoB;AAClF,WAAK,uBAAuB,KAAK,QAAQ;AACzC,YAAM,KAAK,IAAI,gCAAgC;QAC3C,QAAQ,KAAK,SAAS;QACtB,eAAe,KAAK,SAAS;QAC7B,YAAY;UACR,IAAI,+BAAc;YACd;YACA;WACH;;OAER;AACD,UAAI;AACA,cAAM,KAAK,KAAK,YAAY,IAAI;UAC5B,GAAG,KAAK;;UAER,iBAAiB,4BAAgB,MAC3B,4BAAgB;;UAEtB,iBAAiB;;UAEjB,UAAU,4BAAgB;;UAE1B,8BAA8B;SACjC;MACL,SACO,GAAG;AACN,gBAAI,iCAAoB,CAAC,GAAG;AACxB,iBAAO;QACX,OACK;AAED,gBAAM;QACV;MACJ;AACA,aAAO;IACX;;;;;IAKO,MAAM,qBAAqB,eAAiH;AAC/I,WAAK,sBAAsB,+BAAkB,8BAAiB,oBAAoB;AAClF,UAAI,KAAmB,IAAI,gCAAgC;QACvD,QAAQ,KAAK,SAAS;QACtB,eAAe,KAAK,SAAS;OAChC;AAID,UAAI,qCAAe,sBAAsB,EAAE,GAAG;AAC1C,cAAM,wBAAwB,KAAK,KAAK,sBAAsB,2BAAe,eAAe,GAAG,KAAK,SAAS,MAAgB;AAC7H,aAAK,0BAA0B,IACzB,qCAAe,cAAc,EAAE,IAC/B,qCAAe,YAAY,EAAE;MACvC;AACA,WAAK,YAAY,YAAY,IAAI,KAAK,KAAK,WAAW,KAAK,MAAM,EAAE,cAAa,CAAE;AAClF,YAAM,WAAW,MAAM,KAAK,KAAK,YAAgD,IAAI;QACjF,GAAG,KAAK;QACR,iBAAiB;OACpB;AACD,aAAO,UAAU;IACrB;IACO,MAAM,wBAAwB,cAA8B;AAC/D,WAAK,sBAAsB,+BAAkB,8BAAiB,uBAAuB;AACrF,YAAM,KAAK,IAAI,mCAAmC;QAC9C,QAAQ,KAAK,SAAS;QACtB,eAAe,KAAK,SAAS;QAC7B;OACH;AACD,YAAM,KAAK,KAAK,YAAY,IAAI,KAAK,cAAc;IACvD;;IAEO,MAAM,2BAAwB;AACjC,WAAK,sBAAsB,+BAAkB,8BAAiB,MAAM;AACpE,YAAM,KAAK,IAAI,kBAAkB;QAC7B,QAAQ,KAAK,SAAS;QACtB,eAAe,KAAK,SAAS;OAChC;AACD,YAAM,WAAW,MAAM,KAAK,KAAK,YAAkC,IAAI,KAAK,cAAc;AAC1F,UAAI,UAAU;AACV,mBAAO,oBAAK,UAAU;UAClB;UACA;UACA;UACA;UACA;UACA;SACH;MACL;IACJ;;IAEO,MAAM,YAAY,QAAiD;AACtE,WAAK,sBAAsB,+BAAkB,8BAAiB,SAAS;AACvE,YAAM,KAAK,IAAI,qBAAqB;QAChC,QAAQ,KAAK,SAAS;QACtB,eAAe,KAAK,SAAS;QAC7B,GAAG;QACH,MAAM;OACT;AACD,YAAM,KAAK,KAAK,YAAY,IAAI,KAAK,cAAc;IACvD;;IAEO,MAAM,UAAU,QAA8C;AACjE,WAAK,sBAAsB,+BAAkB,8BAAiB,MAAM;AACpE,YAAM,KAAK,IAAI,kBAAkB;QAC7B,QAAQ,KAAK,SAAS;QACtB,eAAe,KAAK,SAAS;QAC7B,GAAG;QACH,MAAM;OACT;AACD,YAAM,KAAK,KAAK,YAAY,IAAI,KAAK,cAAc;IACvD;;IAEO,MAAM,qBAAqB,QAAiD;AAC/E,WAAK,sBAAsB,+BAAkB,8BAAiB,SAAS;AACvE,YAAM,KAAK,IAAI,qBAAqB;QAChC,QAAQ,KAAK,SAAS;QACtB,eAAe,KAAK,SAAS;QAC7B,GAAG;QACH,MAAM;OACT;AACD,YAAM,KAAK,KAAK,YAAY,IAAI,KAAK,cAAc;IACvD;;IAEO,MAAM,mBAAmB,QAA8C;AAC1E,WAAK,sBAAsB,+BAAkB,8BAAiB,MAAM;AACpE,YAAM,KAAK,IAAI,kBAAkB;QAC7B,QAAQ,KAAK,SAAS;QACtB,eAAe,KAAK,SAAS;QAC7B,GAAG;QACH,MAAM;OACT;AACD,aAAO,KAAK,KAAK,YAAY,IAAI,KAAK,cAAc;IACxD;;IAEO,MAAM,iBAAiB,UAAqB;AAC/C,WAAK,sBAAsB,+BAAkB,8BAAiB,OAAO;AACrE,YAAM,KAAK,IAAI,mBAAmB;QAC9B,QAAQ,KAAK,SAAS;QACtB,eAAe,KAAK,SAAS;QAC7B;OACH;AACD,YAAM,KAAK,KAAK,YAAY,IAAI,KAAK,cAAc;IACvD;IACO,MAAM,cAAc,WAAsB,gBAAyB,MAAI;AAC1E,WAAK,sBAAsB,+BAAkB,8BAAiB,eAAe;AAC7E,YAAM,KAAK,IAAI,2BAA2B;QACtC,QAAQ,KAAK,SAAS;QACtB,eAAe,KAAK,SAAS;QAC7B;QACA;OACH;AACD,YAAM,KAAK,KAAK,YAAY,IAAI,KAAK,cAAc;IACvD;IACO,MAAM,kBAAkB,eAA4B;AACvD,WAAK,sBAAsB,+BAAkB,8BAAiB,aAAa;AAC3E,YAAM,KAAK,IAAI,yBAAyB;QACpC,QAAQ,KAAK,SAAS;QACtB,eAAe,KAAK,SAAS;QAC7B,cAAc;OACjB;AACD,YAAM,KAAK,KAAK,YAAY,IAAI,KAAK,cAAc;IACvD;IACO,MAAM,eAAe,eAA8B,YAAqB;AAC3E,WAAK,sBAAsB,+BAAkB,8BAAiB,gBAAgB;AAC9E,YAAM,KAAK,IAAI,4BAA4B;QACvC,QAAQ,KAAK,SAAS;QACtB,eAAe,KAAK,SAAS;QAC7B,YAAY;QACZ;OACH;AACD,YAAM,KAAK,KAAK,YAAY,IAAI,KAAK,cAAc;IACvD;IACO,MAAM,mBAAgB;AACzB,WAAK,sBAAsB,+BAAkB,8BAAiB,gBAAgB;AAC9E,YAAM,KAAK,IAAI,4BAA4B;QACvC,QAAQ,KAAK,SAAS;QACtB,eAAe,KAAK,SAAS;OAChC;AACD,YAAM,KAAK,KAAK,YAAY,IAAI,KAAK,cAAc;IACvD;IACO,MAAM,yBAAsB;AAC/B,WAAK,sBAAsB,+BAAkB,8BAAiB,WAAW;AACzE,YAAM,KAAK,IAAI,uBAAuB;QAClC,QAAQ,KAAK,SAAS;QACtB,eAAe,KAAK,SAAS;QAC7B,aAAa;QACb,oBAAoB;OACvB;AACD,YAAM,KAAK,KAAK,YAAY,IAAI;QAC5B,GAAG,KAAK;;QAER,iBAAiB,4BAAgB,UAAU,CAAC,4BAAgB;OAC/D;IACL;IACO,MAAM,iBAAc;AACvB,WAAK,sBAAsB,+BAAkB,8BAAiB,WAAW;AACzE,YAAM,KAAK,IAAI,uBAAuB;QAClC,QAAQ,KAAK,SAAS;QACtB,eAAe,KAAK,SAAS;QAC7B,aAAa;QACb,oBAAoB;OACvB;AACD,YAAM,KAAK,KAAK,YAAY,IAAI,KAAK,cAAc;IACvD;;;;IAIS,eAAW,MAAA;8BAFvB,4CAAa,2BAAe,YAAY,CAAC,OACzC,kDAAmB,CAAC,CAAC;;;;oBACW;mCAAA,YAAY;WAAA;;;;;;;;AAA7C,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;IAEF,MAAM,UAAU,KAAqB;AACxC,YAAM,kBAAkB,mBAAmB,IAAI,WAAW,KAAK,KAAK,MAAM;AAC1E,YAAM,OAAO,KAAK,QAAQ,GAAG;AAC7B,YAAM,WAAW,KAAK,YAAY,GAAG;AACrC,YAAM,MAAM,iBAAM,OAAO,2BAAe,YAAY,GAAG,KAAK,QAAQ,EAAE,YAAY;QAC9E,UAAU,4BAAgB;OAC7B;AAED,YAAM,WAAW,KAAK,wBAAuB;AAC7C,UAAI,4BAA4B;AAChC,UAAI;AACJ,cAAI,+BAAkB,QAAQ,GAAG;AAE7B,kCAA0B,CAAC,QAAQ;MACvC,WACS,SAAS,UAAU,GAAG;AAG3B,kCAA0B;UACtB,0BAAc;UACd,0BAAc;UACd,0BAAc;;MAEtB,OACK;AAED,YAAI,QAAQ,KAAK,IAAI;UACjB,UAAU,SAAS;UACnB,SAAS;UACT,OAAO;SACV;AACD;MACJ;AACA,iBAAWC,aAAY,yBAAyB;AAO5C,YAAI,KAAK,iBAAiBA,SAAQ,MAAM;AACpC;AAEJ,YAAI,CAAC,iBAAiB,wBAAwBA,SAAQ,GAAG;AACrD,cAAI,QAAQ,KAAK,IAAI;YACjB,UAAU,SAAS;YACnB,SAAS,iDAA6C,iCAAkB,2BAAeA,SAAQ,CAAC;YAChG,OAAO;WACV;AACD;QACJ;AACA,YAAI,QAAQ,KAAK,IAAI;UACjB,UAAU,SAAS;UACnB,SAAS,6CAAyC,iCAAkB,2BAAeA,SAAQ,CAAC;UAC5F,WAAW;SACd;AAED,YAAI;AAEJ,cAAM,eAAe,KAAK,kBAAkB,IAAI,IAAI;AACpD,iBAAS,WAAW,GAAG,YAAY,cAAc,YAAY;AACzD,cAAI;AACA,2BAAe,MAAM,IAAI,qBAAqBA,SAAQ;UAC1D,SACO,GAAG;AACN,oBAAI,0BAAa,CAAC,KACX,EAAE,SAAS,4BAAgB,0BAA0B;AAGxD,6BAAe;YACnB,OACK;AACD,oBAAM;YACV;UACJ;AACA,cAAI,gBAAgB,UACb,wBAAwB,WAAW,GAAG;AACzC,gBAAI,WAAW,cAAc;AAEzB,kBAAI,QAAQ,KAAK,IAAI;gBACjB,UAAU,SAAS;gBACnB,SAAS,6CAAyC,iCAAkB,2BAAeA,SAAQ,CAAC,cAAc,QAAQ,IAAI,YAAY;gBAClI,OAAO;eACV;AACD,wBAAM,mBAAK,GAAG;AACd;YACJ,WACS,SAAS,QAAQ,GAAG;AACzB,kBAAI,QAAQ,KAAK,IAAI;gBACjB,UAAU,SAAS;gBACnB,SAAS,6CAAyC,iCAAkB,2BAAeA,SAAQ,CAAC;gBAC5F,OAAO;eACV;AAGD,yBAAW,CAAC,IAAI,KAAK,SAAS,OAAM,GAAI;AACpC,yBAAS,MAAM,MAAM,EAAE,QAAQ,KAAI,CAAE;cACzC;AACA;YACJ,OACK;AACD,kBAAI,QAAQ,KAAK,IAAI;gBACjB,UAAU,SAAS;gBACnB,SAAS,6CAAyC,iCAAkB,2BAAeA,SAAQ,CAAC;gBAC5F,OAAO;eACV;AACD;YACJ;UACJ,OACK;AAED;UACJ;QACJ;AACA,YAAI,gBAAgB,QAAW;AAC3B,cAAI,SAAS,UAAU,KAChB,wBAAwB,SAAS,GAAG;AAGvC,iBAAK,iBAAiBA,WAAU,KAAK;AACrC,gBAAI,QAAQ,KAAK,IAAI;cACjB,SAAS,mDAA+C,iCAAkB,2BAAeA,SAAQ,CAAC;cAClG,WAAW;aACd;UACL;AACA;QACJ;AACA,YAAI,SAAS,UAAU,KAAK,wBAAwB,SAAS,GAAG;AAE5D,eAAK,iBAAiBA,WAAU,IAAI;AACpC,cAAI,QAAQ,KAAK,IAAI;YACjB,SAAS,+CAA2C,iCAAkB,2BAAeA,SAAQ,CAAC;YAC9F,WAAW;WACd;QACL;AACA,YAAI,CAAC,6BAA6B,aAAa,SAAS,GAAG;AACvD,sCAA4B;AAC5B,gBAAM,WAAqB;YACvB,iCAA6B,iCAAkB,2BAAeA,SAAQ,CAAC;YACvE;;AAEJ,qBAAW,MAAM,cAAc;AAC3B,qBAAS,KAAK,YAAK,uBAAU,EAAE,CAAC,EAAE;UACtC;AACA,cAAI,QAAQ,KAAK,IAAI;YACjB,UAAU,SAAS;YACnB,SAAS,SAAS,KAAK,IAAI;YAC3B,WAAW;WACd;AAED,qBAAW,MAAM,cAAc;AAI3B,gBAAI,OAAO,2BAAe,OAAO;AAC7B,uBAAS,MAAM,IAAI,EAAE,QAAQ,KAAI,CAAE;YACvC,OACK;AACD,uBAAS,MAAM,IAAI;gBACf,aAAa;gBACb,QAAQ;eACX;YACL;UACJ;QACJ;MACJ;AAEA,WAAK,qBAAqB,KAAK,IAAI;IACvC;;IAEO,OAAO,sBAAsB,IAAgB;AAEhD,UAAI,EAAE,GAAG,qBAAqB,+BAAmB,WAAW;AACxD,eAAO;MACX;AAEA,UAAI,cAAc,gCACX,cAAc,0BACd,cAAc,8CAAoB;AACrC,eAAO;MACX;AAEA,UAAI,cAAcC,cAAa;AAE3B,gBAAQ,GAAG,WAAW;UAClB,KAAK,8BAAiB;UACtB,KAAK,8BAAiB;UACtB,KAAK,8BAAiB;UACtB,KAAK,8BAAiB;UACtB,KAAK,8BAAiB;UACtB,KAAK,8BAAiB;AAClB,mBAAO;UACX,KAAK,8BAAiB;UACtB,KAAK,8BAAiB;AAElB,mBAAQ,GACH;UACT,KAAK,8BAAiB,SAAS;AAC3B,oBAAS,GAA0B,UAAU;cACzC,KAAK,2BAAY;cACjB,KAAK,2BAAY;cACjB,KAAK,2BAAY;cACjB,KAAK,2BAAY;AACb,uBAAO;cACX;AACI,uBAAO;YACf;UACJ;QACJ;AACA,eAAO;MACX;AAEA,aAAO;IACX;;IAEO,OAAO,YAAY,IAAkB,WAAmB,kBAAoC,SAKlG;AAEG,YAAM,aAAmC,CAAA;AACzC,UAAI,SAAS,oBAAoB;AAC7B,mBAAW,KAAK,IAAI,8BAAY,CAAE;MACtC;AACA,UAAI,SAAS,oBAAoB,QAAW;AACxC,mBAAW,KAAK,IAAI,+BAAc,EAAE,SAAS,QAAQ,iBAAgB,CAAE,CAAC;MAC5E;AAGA,UAAI;AACJ,UAAI,GAAG,YAAW,GAAI;AAClB,YAAI,GAAG,OAAO,KAAK,CAACC,gBAAW,+BAAkBA,OAAM,CAAC,GAAG;AACvD,mBAAS;QACb,OACK;AACD,mBAAS;QACb;MACJ,OACK;AACD,iBAAS,GAAG;MAChB;AACA,YAAM,MAAM,IAAI,gCAAgC;QAC5C;QACA,cAAc;QACd,eAAe,SAAS;QACxB;QACA,gBAAgB,SAAS;OAC5B;AAGD,UAAI,qBAAqB,GAAG,qBACtB,CAAC,+BAAmB;AAC1B,aAAO;IACX;;;;AAEJ,SAAS,aAAU;AACf,8BAAgB,KAAK,4BAAgB,kBAAkB;AAC3D;AAFS;AAGT,SAAS,aAAU;AACf,8BAAgB,KAAK,4BAAgB,kBAAkB;AAC3D;AAFS;AAqBT,SAAS,qCAAqC,KAAmC,MAAqC;AAClH,MAAI,KAAK,cAAc,kBAAkB,GAAG,GAAG;AAC3C,UAAM,MAAM;MACR;MACA;;AAEJ,QAAI,KAAK,wBAAwB,qBAC1B,KAAK,wBAAwB,wBAC7B,KAAK,wBAAwB,4BAC7B,KAAK,wBAAwB,+BAC7B,KAAK,wBAAwB,6BAA6B;AAC7D,UAAI,KAAK,kBAAyB;IACtC;AACA,WAAO;EACX;AACJ;AAfS;AAgBT,SAAS,sCAAsC,MAAuC,UAAuF;AACzK,MAAI,oBAAoB,iCAAiC;AACrD,WAAO;EACX,WACS,oBAAoB,oBAAoB;AAC7C,WAAO;EACX,OACK;AACD,WAAO,SAAS,OAAO,CAAC,CAAC,SAAS;EACtC;AACJ;AAVS;IAaI,mCAA+B,MAAA;8BAF3C,yCAAU,8BAAiB,oBAAoB,OAC/C,kDAAmB,sCAAsC,qCAAqC,CAAC;;;;oBAC3C;uDAAA,YAAW;WAAA;;;;;;;;AAAhE,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;IACT,YAAmB,SAA4D;AAC3E,YAAM,OAAO;AACb,UAAI,CAAC,QAAQ,gBAAgB,CAAC,QAAQ,YAAY,QAAQ;AACtD,cAAM,IAAI,uBAAW,2EAA2E,4BAAgB,gBAAgB;MACpI;AACA,WAAK,iBAAiB,QAAQ;AAC9B,WAAK,gBAAgB,QAAQ;AAC7B,UAAI,QAAQ,cAAc;AACtB,aAAK,eAAe,QAAQ;AAC5B,gBAAQ,aAAa,kBAAkB;MAC3C;AACA,WAAK,iBAAiB,QAAQ,mBAAmB;AACjD,WAAK,aAAa,QAAQ,cAAc,CAAA;AACxC,UAAI,OAAO,KAAK,WAAW,YACpB,CAAC,KAAK,WAAW,KAAK,CAAC,MAAM,aAAa,8BAAa,GAAG;AAC7D,cAAM,IAAI,uBAAW,mEAAmE,4BAAgB,4BAA4B;MACxI;IACJ;IACO,aAAa,KAAK,KAAY,KAAqB;AACtD,YAAM,kBAAkB,iBAAiB,GAAG;AAC5C,uCAAgB,IAAI,QAAQ,UAAU,CAAC;AAEvC,YAAM,iBAAqC,IAAI,QAAQ,CAAC;AAExD,kCAAgB,WAAW,2BAA2B,EAAE,IAAI,wBAAwB,IAAI,YAAY,MAAM,0BAAc,IAAI;AAC5H,YAAM,gBAAgB,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI;AAC1C,YAAM,yBAAyB,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI;AACnD,UAAI,SAAS;AACb,YAAM,aAAmC,CAAA;AACzC,UAAI,qBAAqB;AACzB,UAAI,eAAe;AACf,cAAM,cAAc,gBAAgB,IAAI,QAAQ,SAAS,MAAM,GAAG,KAAK;AACvE,mBAAW,KAAK,GAAG,YAAY,UAAU;AACzC,kBAAU,YAAY;AACtB,6BAAqB,YAAY;MACrC;AACA,YAAM,SAAS,MAAuB;AAClC,cAAM,mBAAmB,oBAAoB,UAAU;AACvD,YAAI,IAAI,cAAc,eAAe,IAAI,cAAc,aAAa;AAChE,cAAI,oBAAoB,QAAW;AAC/B,wCAAgB,KAAK,yCAAyC;UAClE;AACA,iBAAO;YACH,aAAa;YACb,SAAS;;QAEjB,OACK;AACD,iBAAO,EAAE,aAAa,OAAO,SAAS,iBAAgB;QAC1D;MACJ,GAAE;AAGF,UAAI,oBAAoB;AACpB,YAAI,MAAM,aAAa;AACnB,gBAAM,gBAAgB,aAAa,IAAI,cAAc,MAAM,OAAO;QACtE,OACK;AACD,gBAAM,gBAAgB,UAAU,IAAI,YAAY;QACpD;AACA,oCAAgB,KAAK,sBAAsB;MAC/C;AACA,UAAI;AACJ,UAAI;AACJ,UAAI,MAAM,aAAa;AACnB,oBAAY,gBAAgB,YAAY,IAAI,cAAc,MAAM,OAAO;MAC3E,OACK;AAED,6BAAqB,uBAAuB,iBAAiB,IAAI,cAAc,cAAc;AAG7F,YAAI,MAAM,WAAW,QAAW;AAC5B,0BAAgB,oBAAoB,IAAI,YAAY;QACxD;MACJ;AACA,YAAM,qBAAqB,IAAI,QAAQ,SAAS,GAAG,MAAM;AACzD,YAAM,aAAa,IAAI,QAAQ,SAAS,QAAQ,CAAC,2BAA2B;AAC5E,YAAM,UAAU,IAAI,QAAQ,SAAS,CAAC,2BAA2B;AACjE,YAAM,gBAAgB,IAChB,IAAI,QAAQ;AAClB,YAAM,WAAW,sBAAsB,IAAI,cAAc,mBAAmB,KAAK,UAAU,GAAG,IAAI,QAAQ,eAAe,kBAAkB;AAC3I,UAAI;AACJ,UAAI,MAAM,aAAa;AAEnB,YAAI,WAAW,SAAS,sBAAU,MAAM;AAEpC,0BAAgB,cAAc,IAAI,cAAc,MAAM,SAAS,EAAE,MAAM,sBAAU,UAAS,CAAE;AAC5F,qBAAU;QACd;AACA,kBAAU,6BAAM,iBAAiB,IAAI,cAAc,iBAAiB,MAAM,SAAS,YAAY,UAAU,OAAO,GAAtG;MACd,OACK;AAED,cAAM,YAAY,gBAAgB,aAAa,IAAI,YAAY;AAE/D,YAAI,UAAU,SAAS,sBAAU,MAAM;AACnC,qBAAU;QACd,WACS,UAAU,SAAS,sBAAU,UAAU;AAG5C,qBAAU;QACd;AACA,kBAAU,6BAAM,kBAAkB,KAAK,iBAAiB,IAAI,cAAc,gBAAgB,oBAAqB,YAAY,UAAU,SAAS,WAAW,UAAU,GAAzJ;MACd;AACA,UAAI;AACJ,UAAI,SAAS;AACb,UAAI;AACJ,UAAI;AACJ,UAAI;AAOJ,YAAM,kBAAkB,MAAM,cACxB,iCACA,MAAM,WAAW,SACb,mCACA;AACV,eAAS,IAAI,GAAG,IAAI,iBAAiB,KAAK;AACtC,SAAC;UACG;UACA;UACA;UACA;UACA,eAAe;YACf,MAAM,QAAO;AACjB,YAAI,CAAC,CAAC,UAAU,CAAC,CAAC;AACd;AAEJ,YAAI,CAAC,CAAC,YAAY,UAAU;AACxB;MACR;AAGA,UAAI,CAAC,UAAU,CAAC,WAAW;AACvB,YAAI,MAAM,aAAa;AAEnB,0BAAgB,cAAc,IAAI,cAAc,MAAM,SAAS,EAAE,MAAM,sBAAU,UAAS,CAAE;AAC5F,sCAAgB,KAAK,4BAAgB,iCAAiC;QAC1E,OACK;AACD,sCAAgB,KAAK,4BAAgB,wBAAwB;QACjE;MACJ,WACS,CAAC,MAAM,eAAe,MAAM,WAAW,QAAW;AAEvD,wBAAgB,qBAAqB,IAAI,cAAc,MAAM,OAAO;MACxE;AAEA,YAAM,gBAA2C;AACjD,eAAS;AACT,UAAI,wBAAwB;AACxB,cAAM,cAAc,gBAAgB,WAAW,IAAI;AACnD,mBAAW,KAAK,GAAG,YAAY,UAAU;AACzC,kBAAU,YAAY;AACtB,6BAAqB,YAAY;MACrC;AAEA,UAAI,oBAAoB;AACpB,oCAAgB,KAAK,mBAAmB;MAC5C;AAEA,YAAM,gBAAgB,WAAW,KAAK,CAAC,MAAM,aAAa,8BAAa;AACvE,UAAI,MAAM,WAAW,UAAa,eAAe;AAC7C,oCAAgB,KAAK,mCAAmC;MAC5D;AAEA,UAAI,CAAC,MAAM,aAAa;AACpB,cAAMC,iBAAgB,WAAW,KAAK,CAAC,MAAM,aAAa,8BAAa;AACvE,YAAIA,gBAAe;AACf,0BAAgB,cAAc,IAAI,cAAcA,eAAc,SAAS;YACnE,MAAM,sBAAU;YAChB,aAAaA,eAAc;WAC9B;QACL;MACJ;AAEA,YAAM,mBAAmB,UAAU,SAAS,MAAM;AAClD,UAAI;AACJ,UAAI,iBAAiB,SAAS,GAAG;AAE7B,yCAAgB,iBAAiB,UAAU,CAAC;AAE5C,uBAAe,MAAM,iCAAa,MAAM,kBAAkB,GAAG;MACjE;AACA,YAAM,MAAM,IAAIC,iCAAgC;QAC5C,QAAQ,IAAI;QACZ;QACA;QACA;QACA;OACH;AAED,UAAI,MAAM;AACV,UAAI,KAAK;AACT,UAAI,WAAW;AACf,UAAI,UAAU;AACd,UAAI,YAAY;AAChB,aAAO;IACX;IACgB;;IAER;IACA;IACA;IACA;IACA;IACA;IACQ,iBAA0B;IACnC;IACC,qBAAqB,iBAAiC;AAG1D,UAAI,KAAK,kBAAkB,QAAW;AAClC,YAAI,KAAK,aAAY,GAAI;AACrB,eAAK,iBAAiB,gBAAgB,mBAAmB,KAAK,MAAM;QACxE,OACK;AACD,gBAAM,UAAU,mBAAmB,KAAK,IAAI;AAC5C,eAAK,iBAAiB,gBACjB,4BAA4B,OAAO;QAC5C;MACJ;IACJ;IACO;IACA;IACS,wBAAqB;AACjC,YAAM,sBAAqB;AAC3B,WAAK,iBAAiB;IAC1B;IACO,kBAAe;AAClB,aAAO,KAAK,WAAW,KAAK,CAAC,MAAM,aAAa,6BAAY;IAChE;;IAEO,cAAW;AACd,aAAO,YAAY,KAAK,UAAU;IACtC;;IAEO,sBAAmB;AACtB,aAAO,oBAAoB,KAAK,UAAU;IAC9C;IACQ,MAAM,sBAAsB,KAAwB,iBAAiC;AACzF,UAAI,CAAC,KAAK,aAAY;AAClB;AACJ,YAAM,iBAAyB,KAAK;AACpC,YAAM,YAAY,gBAAgB,aAAa,cAAc;AAC7D,UAAI,UAAU,SAAS,sBAAU,QAC1B,UAAU,SAAS,sBAAU,SAAS;AAEzC,cAAM,IAAI,uBAAW,4DAA4D,4BAAgB,kBAAkB;MACvH,WACS,UAAU,SAAS,sBAAU,UAAU;AAG5C,cAAM,WAAW,MAAM,gBAAgB,cAAc,MAAS;AAC9D,cAAM,aAAa,UAAU;AAG7B,YAAI,KAAK,iBAAiB,UACnB,gBAAgB,SAAS,IAAI,cAAc,GAAG;AACjD,gBAAM,gBAAgB,mBAAmB,gBAAgB,UAAU,UAAU;QACjF,OACK;AACD,gBAAM,gBAAgB,KAAK,iBACpB,IAAI,wBAAwB,cAAc;AACjD,cAAI,iBAAiB,QAAW;AAC5B,kBAAM,IAAI,uBAAW,+CAA+C,4BAAgB,kBAAkB;UAC1G;AACA,gBAAM,gBAAgB,eAAe,gBAAgB,eAAe,UAAU,UAAU;QAC5F;AAEA,YAAI,gBAAgB,KAAK,WAAW,KAAK,CAAC,MAAM,aAAa,8BAAa;AAC1E,YAAI,eAAe;AACf,wBAAc,WAAW;QAC7B,OACK;AACD,0BAAgB,IAAI,+BAAc,EAAE,SAAQ,CAAE;AAC9C,eAAK,WAAW,KAAK,aAAa;QACtC;MACJ;IACJ;IACO,MAAM,UAAU,KAAsB;AACzC,YAAM,kBAAkB,iBAAiB,KAAK,KAAK,MAAM;AACzD,WAAK,qBAAqB,eAAe;AAEzC,YAAM,KAAK,sBAAsB,KAAK,eAAe;AACrD,YAAM,wBAAwB,KAAK,WAAW,OAAO,CAAC,MAAM,CAAC,EAAE,YAAW,CAAE;AAC5E,YAAM,sBAAsB,KAAK,WAAW,OAAO,CAAC,MAAM,EAAE,YAAW,CAAE;AACzE,YAAM,qBAAqB,oBAAM,OAAO;QACpC;UACI,KAAK;WACJ,oBAAoB,SAAS,IAAI,IAAO,MAClC,sBAAsB,SAAS,IAAI,IAAI;;QAElD,GAAG,sBAAsB,IAAI,CAAC,GAAG,UAAU,EAAE,UAAU,QAAQ,sBAAsB,SAAS,CAAC,CAAC;OACnG;AACD,YAAM,eAAgB,MAAM,KAAK,cAAc,UAAU,GAAG,KACrD,IAAI,oBAAK;AAChB,YAAM,mBAAmB,oBAAM,OAAO;QAClC,GAAG,oBAAoB,IAAI,CAAC,GAAG,UAAU,EAAE,UAAU,QAAQ,oBAAoB,SAAS,CAAC,CAAC;QAC5F;OACH;AAED,YAAM,iBAAiB,mBAAmB,KAAK,IAAuC;AACtF,YAAM,gBAAgB,KAAK,6BAA4B,IACjD,aAAa;AACnB,YAAM,WAAW,sBAAsB,IAAI,WAAW,gBAAgB,IAAI,QAAQ,eAAe,kBAAkB;AACnH,UAAI;AACJ,UAAI;AACJ,UAAI,KAAK,aAAY,GAAI;AAIrB,aAAK,MAAM,gBAAgB,UAAU,KAAK,QAAQ,IAAI;AACtD,cAAM,EAAE,OAAM;;UAEd,KAAK,iBAAiB,SAChB,gBAAgB,wBAAwB,KAAK,aAAa,IAC1D,gBAAgB,eAAe,KAAK,MAAM;;AAChD,cAAM;MACV,OACK;AAED,cAAM,WAAW,MAAM,gBAAgB,qBAAqB,cAAc;AAC1E,cAAM,SAAS;AACf,aAAK,SAAS;MAClB;AACA,YAAM,EAAE,YAAY,mBAAmB,QAAO,IAAK,UAAM,8BAAiB,kBAAkB,KAAK,IAAI,UAAU,2BAA2B;AAE1I,WAAK,MAAM;AACX,WAAK,KAAK;AACV,WAAK,WAAW;AAChB,WAAK,UAAU;AACf,WAAK,aAAa;AAClB,WAAK,UAAU,oBAAM,OAAO;QACxB;QACA;QACA;OACH;AACD,aAAO,MAAM,UAAU,GAAG;IAC9B;IACU,+BAA4B;AAMlC,YAAM,iBAAiB,KAAK,WACvB,IAAI,CAAC,MAAM,EAAE,cAAa,CAAE,EAC5B,OAAO,CAAC,GAAG,MAAM,IAAI,GAAG,CAAC;AAC9B,aAAQ,MAAM,6BAA4B,IACpC,IACA,8BACA;IACV;IACO,WAAW,KAAgB;AAC9B,YAAM,UAAyB;QAC3B,mBAAmB,KAAK,kBAAkB;;AAE9C,UAAI,KAAK,WAAW,SAAS,GAAG;AAC5B,gBAAQ,aAAa,KAAK,WACrB,IAAI,CAAC,MAAM,EAAE,WAAU,CAAE,EACzB,KAAK,EAAE;MAChB;AAEA,UAAI,QAAQ,IAAI,aAAa,UACtB,QAAQ,IAAI,aAAa,eAAe;AAC3C,YAAI,KAAK,KAAK;AACV,kBAAQ,UAAM,0BAAW,KAAK,GAAG;QACrC;AACA,YAAI,KAAK,IAAI;AACT,kBAAQ,SAAK,0BAAW,KAAK,EAAE;QACnC;AACA,YAAI,KAAK,YAAY;AACjB,kBAAQ,iBAAa,0BAAW,KAAK,UAAU;QACnD,WACS,KAAK,WAAW;AACrB,kBAAQ,gBAAY,0BAAW,KAAK,SAAS;QACjD;AACA,YAAI,KAAK,UAAU;AACf,kBAAQ,WAAW,QAAI,0BAAW,KAAK,QAAQ;QACnD;AACA,YAAI,KAAK,SAAS;AACd,kBAAQ,UAAU,QAAI,0BAAW,KAAK,OAAO;QACjD;MACJ;AACA,UAAI,KAAK,iBAAiB,QAAW;AACjC,gBAAQ,gBAAgB,QAAI,iCAAkB,2BAAe,KAAK,aAAa;MACnF;AACA,aAAO;QACH,GAAG,MAAM,WAAW,GAAG;QACvB;;IAER;;;;IAeS,0BAAsB,MAAA;8BADlC,yCAAU,8BAAiB,WAAW,CAAC;;;;oBACI;8CAAA,YAAW;WAAA;;;;;;;;AAAvD,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;IACT,YAAmB,SAAmD;AAClE,YAAM,OAAO;AACb,WAAK,MAAM,QAAQ;AACnB,WAAK,MAAM,QAAQ;AACnB,WAAK,iBAAiB,QAAQ;AAC9B,UAAI,QAAQ;AACR,aAAK,aAAa,QAAQ;IAClC;IACO,OAAO,KAAK,KAAY,KAAqB;AAEhD,YAAM,kBAAkB,iBAAiB,GAAG;AAC5C,uCAAgB,IAAI,QAAQ,UAAU,CAAC;AACvC,YAAM,iBAAiB,IAAI,QAAQ,CAAC;AAEpC,6BAAuB,iBAAiB,IAAI,cAAc,cAAc;AACxE,YAAM,MAAM,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI;AAChC,YAAM,MAAM,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI;AAChC,UAAI,KAAK;AAEL,yCAAgB,IAAI,QAAQ,UAAU,EAAE;AACxC,cAAM,aAAa,IAAI,QAAQ,SAAS,GAAG,EAAE;AAG7C,wBAAgB,cAAc,IAAI,cAAc,UAAU;AAC1D,eAAO,IAAI,KAAK;UACZ,QAAQ,IAAI;UACZ;UACA;UACA;UACA;SACH;MACL,WACS,KAAK;AACV,eAAO,IAAI,KAAK;UACZ,QAAQ,IAAI;UACZ;UACA;UACA,KAAK;SACR;MACL,OACK;AACD,oCAAgB,KAAK,+BAA+B;MACxD;IACJ;IACO;IACC,qBAAqB,iBAAiC;AAG1D,UAAI,KAAK,kBAAkB,QAAW;AAClC,aAAK,iBAAiB,gBAAgB,mBAAmB,KAAK,MAAgB;MAClF;IACJ;IACgB;IACA;IACA;IACT,UAAU,KAAsB;AACnC,YAAM,kBAAkB,iBAAiB,KAAK,KAAK,MAAM;AACzD,WAAK,qBAAqB,eAAe;AACzC,WAAK,UAAU,oBAAM,KAAK;QACtB,KAAK;SACJ,KAAK,MAAM,IAAO,MAAM,KAAK,MAAM,IAAM;OAC7C;AACD,UAAI,KAAK,KAAK;AACV,aAAK,UAAU,oBAAM,OAAO,CAAC,KAAK,SAAS,KAAK,UAAW,CAAC;MAChE;AACA,aAAO,MAAM,UAAU,GAAG;IAC9B;IACO,WAAW,KAAgB;AAC9B,YAAM,UAAyB;QAC3B,mBAAmB,KAAK,kBAAkB;QAC1C,KAAK,KAAK;QACV,KAAK,KAAK;;AAEd,UAAI,KAAK,YAAY;AACjB,gBAAQ,kBAAkB,QAAI,0BAAW,KAAK,UAAU;MAC5D;AACA,aAAO;QACH,GAAG,MAAM,WAAW,GAAG;QACvB;;IAER;;;;IAQS,uBAAmB,MAAA;8BAF/B,yCAAU,8BAAiB,QAAQ,OACnC,kDAAmB,sBAAsB,CAAC;;;;oBACF;2CAAA,YAAW;WAAA;;;;;;;;AAApD,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;;;IAGT,YAAmB,SAAgD;AAC/D,YAAM,OAAO;AACb,WAAK,iBAAiB,QAAQ;IAClC;IACO,OAAO,KAAK,KAAY,KAAqB;AAChD,YAAM,kBAAkB,iBAAiB,GAAG;AAC5C,uCAAgB,IAAI,QAAQ,UAAU,CAAC;AACvC,YAAM,iBAAiB,IAAI,QAAQ,CAAC;AAEpC,6BAAuB,iBAAiB,IAAI,cAAc,cAAc;AACxE,aAAO,IAAI,KAAK;QACZ,QAAQ,IAAI;QACZ;OACH;IACL;IACO;IACC,qBAAqB,iBAAiC;AAG1D,UAAI,KAAK,kBAAkB,QAAW;AAClC,aAAK,iBAAiB,gBAAgB,mBAAmB,KAAK,MAAgB;MAClF;IACJ;IACO,UAAU,KAAsB;AACnC,YAAM,kBAAkB,iBAAiB,KAAK,KAAK,MAAM;AACzD,WAAK,qBAAqB,eAAe;AACzC,WAAK,UAAU,oBAAM,KAAK,CAAC,KAAK,cAAc,CAAC;AAC/C,aAAO,MAAM,UAAU,GAAG;IAC9B;IACO,WAAW,KAAgB;AAC9B,aAAO;QACH,GAAG,MAAM,WAAW,GAAG;QACvB,SAAS;UACL,mBAAmB,KAAK,kBAAkB;;;IAGtD;;;;IAYS,wBAAoB,MAAA;8BADhC,yCAAU,8BAAiB,SAAS,CAAC;;;;oBACI;4CAAA,YAAW;WAAA;;;;;;;;AAArD,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;IACT,YAAmB,SAAiD;AAChE,YAAM,OAAO;AACb,WAAK,aAAa,QAAQ;AAC1B,WAAK,OAAO,QAAQ;AACpB,WAAK,YAAY,QAAQ,aAAa;AACtC,WAAK,sBAAsB,QAAQ;AACnC,WAAK,wBAAwB,QAAQ;AACrC,WAAK,gBAAgB,QAAQ;IACjC;IACO,OAAO,KAAK,KAAY,KAAqB;AAChD,uCAAgB,IAAI,QAAQ,UAAU,CAAC;AACvC,YAAM,aAAa,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI;AACvC,YAAM,OAAO,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI;AAEjC,YAAM,YAAY,IAAI,QAAQ,CAAC,IAAI;AAEnC,YAAM,0BAAoC,0BAAa,IAAI,QAAQ,SAAS,GAAG,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,MAAM,MAAM,CAAC;AAC3G,YAAM,4BAAwC,0BAAa,IAAI,QAAQ,SAAS,GAAG,CAAC,GAAG,4BAAa,UAAU;AAC9G,YAAM,oBAAiC,0BAAa,IAAI,QAAQ,SAAS,GAAG,CAAC,GAAG,0BAAc,kBAAkB;AAChH,aAAO,IAAI,KAAK;QACZ,QAAQ,IAAI;QACZ;QACA;QACA;QACA;QACA;QACA;OACH;IACL;IACgB;IACA;IACA;IACA;IACA;IACA;IACT,UAAU,KAAsB;AACnC,WAAK,UAAU,oBAAM,OAAO;QACxB;UACI,KAAK,aACE,KAAK,aAAa,IAAO,MACzB,KAAK,OAAO,IAAM;;;YAG7B,2BAAc,KAAK,qBAAqB,GAAG,CAAC;YAC5C,2BAAc,KAAK,uBAAuB,GAAG,4BAAa,UAAU;YACpE,2BAAc,KAAK,eAAe,0BAAc,WAAW,0BAAc,kBAAkB;OAC9F;AACD,aAAO,MAAM,UAAU,GAAG;IAC9B;IACO,WAAW,KAAgB;AAC9B,aAAO;QACH,GAAG,MAAM,WAAW,GAAG;QACvB,SAAS;UACL,MAAM,KAAK;UACX,qBAAqB,KAAK,oBACrB,IAAI,CAAC,MAAM;WAAO,iCAAkB,2BAAY,CAAC,CAAC,EAAE,EACpD,KAAK,EAAE;UACZ,2BAA2B,KAAK,sBAC3B,IAAI,CAAC,MAAM;WAAO,iCAAkB,6BAAc,CAAC,CAAC,EAAE,EACtD,KAAK,EAAE;UACZ,iBAAiB,KAAK;UACtB,8BAA8B,KAAK,cAC9B,IAAI,CAAC,MAAM;WAAO,iCAAkB,2BAAe,CAAC,CAAC,EAAE,EACvD,KAAK,EAAE;;;IAGxB;;;;IAIS,qBAAiB,MAAA;8BAF7B,yCAAU,8BAAiB,MAAM,OACjC,kDAAmB,oBAAoB,CAAC;;;;oBACF;yCAAA,YAAW;WAAA;;;;;;;;AAAlD,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;;;;AAWb,SAAS,6BAA6B,KAAmC,MAAuB;AAC5F,MAAI,KAAK,MAAM;AACX,WAAO,CAAC,sBAAsB,kBAAkB;EACpD,OACK;AACD,WAAO;EACX;AACJ;AAPS;AAQT,SAAS,8BAA8B,MAAyB,UAAa;AACzE,MAAI,KAAK,MAAM;AACX,QAAI,oBAAoB,sBAAsB;AAC1C,aAAO,SAAS;IACpB,WACS,oBAAoB,oBAAoB;AAC7C,aAAO;IACX;EACJ;AACA,SAAO;AACX;AAVS;IAaI,qBAAiB,MAAA;8BAF7B,yCAAU,8BAAiB,MAAM,OACjC,kDAAmB,8BAA8B,6BAA6B,CAAC;;;;oBACzC;yCAAA,YAAW;WAAA;;;;;;;;AAAlD,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;IACT,YAAmB,SAA8C;AAC7D,YAAM,OAAO;AACb,WAAK,YAAY,QAAQ;AACzB,WAAK,OAAO,QAAQ;AACpB,WAAK,YAAY,QAAQ,aAAa;AACtC,WAAK,oBAAoB,QAAQ;AACjC,WAAK,sBAAsB,QAAQ;AACnC,WAAK,cAAc,QAAQ;IAC/B;IACO,OAAO,KAAK,KAAY,KAAqB;AAChD,uCAAgB,IAAI,QAAQ,UAAU,CAAC;AACvC,YAAM,YAAY,IAAI,QAAQ,CAAC,IAAI;AACnC,YAAM,YAAY,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI;AACtC,YAAM,OAAO,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI;AAEjC,YAAM,yBAAqB,0BAAa,IAAI,QAAQ,SAAS,GAAG,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,MAAM,MAAM,CAAC;AAC5F,uCAAgB,mBAAmB,WAAW,CAAC;AAC/C,YAAM,oBAAgC,mBAAmB,CAAC;AAC1D,YAAM,2BAAuB,0BAAa,IAAI,QAAQ,SAAS,GAAG,CAAC,GAAG,4BAAa,UAAU;AAC7F,uCAAgB,qBAAqB,WAAW,CAAC;AACjD,YAAM,sBAAoC,qBAAqB,CAAC;AAChE,YAAM,kBAA+B,0BAAa,IAAI,QAAQ,SAAS,GAAG,CAAC,GAAG,0BAAc,kBAAkB;AAC9G,aAAO,IAAI,KAAK;QACZ,QAAQ,IAAI;QACZ;QACA;QACA;QACA;QACA;QACA;OACH;IACL;IACgB;IACT;IACA;IACA;IACA;IACA;IACA,UAAU,KAAsB;AACnC,WAAK,UAAU,oBAAM,OAAO;QACxB;UACI,KAAK,aACE,KAAK,YAAY,IAAO,MACxB,KAAK,OAAO,IAAM;;;YAG7B,2BAAc,CAAC,KAAK,iBAAiB,GAAG,GAAG,CAAC;YAC5C,2BAAc,CAAC,KAAK,mBAAmB,GAAG,GAAG,4BAAa,UAAU;YACpE,2BAAc,KAAK,aAAa,0BAAc,WAAW,0BAAc,kBAAkB;OAC5F;AACD,aAAO,MAAM,UAAU,GAAG;IAC9B;IACO,WAAW,KAAgB;AAC9B,aAAO;QACH,GAAG,MAAM,WAAW,GAAG;QACvB,SAAS;UACL,MAAM,KAAK;UACX,uBAAmB,iCAAkB,2BAAY,KAAK,iBAAiB;UACvE,6BAAyB,iCAAkB,6BAAc,KAAK,mBAAmB;UACjF,iBAAiB,KAAK;UACtB,4BAA4B,KAAK,YAC5B,IAAI,CAAC,MAAM;WAAO,iCAAkB,2BAAe,CAAC,CAAC,EAAE,EACvD,KAAK,EAAE;;;IAGxB;;;;IAOS,sBAAkB,MAAA;8BAD9B,yCAAU,8BAAiB,OAAO,CAAC;;;;oBACI;0CAAA,YAAW;WAAA;;;;;;;;AAAnD,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;IACT,YAAmB,SAA+C;AAC9D,YAAM,OAAO;AACb,WAAK,WAAW,QAAQ;IAC5B;IACO,OAAO,KAAK,KAAY,KAAqB;AAChD,uCAAgB,IAAI,QAAQ,UAAU,CAAC;AACvC,YAAM,WAAwB,IAAI,QAAQ,CAAC;AAC3C,aAAO,IAAI,KAAK;QACZ,QAAQ,IAAI;QACZ;OACH;IACL;IACO;IACA,UAAU,KAAsB;AACnC,WAAK,UAAU,oBAAM,KAAK,CAAC,KAAK,QAAQ,CAAC;AACzC,aAAO,MAAM,UAAU,GAAG;IAC9B;IACO,WAAW,KAAgB;AAC9B,aAAO;QACH,GAAG,MAAM,WAAW,GAAG;QACvB,SAAS,EAAE,YAAQ,iCAAkB,4BAAa,KAAK,QAAQ,EAAC;;IAExE;;;;IAQS,8BAA0B,MAAA;8BADtC,yCAAU,8BAAiB,eAAe,CAAC;;;;oBACI;kDAAA,YAAW;WAAA;;;;;;;;AAA3D,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;IACT,YAAmB,SAAuD;AACtE,YAAM,OAAO;AACb,WAAK,gBAAgB,QAAQ;AAC7B,WAAK,YAAY,QAAQ;IAC7B;IACO,OAAO,KAAK,KAAY,KAAqB;AAChD,uCAAgB,IAAI,QAAQ,UAAU,EAAE;AACxC,YAAM,gBAAgB,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI;AAC1C,YAAM,YAAuB,IAAI,QAAQ,SAAS,CAAC;AACnD,aAAO,IAAI,KAAK;QACZ,QAAQ,IAAI;QACZ;QACA;OACH;IACL;IACO;IACA;IACA,UAAU,KAAsB;AACnC,WAAK,UAAU,oBAAM,OAAO;QACxB,CAAC,KAAK,gBAAgB,IAAI,CAAC;QAC3B,KAAK;OACR;AACD,aAAO,MAAM,UAAU,GAAG;IAC9B;IACO,WAAW,KAAgB;AAC9B,aAAO;QACH,GAAG,MAAM,WAAW,GAAG;QACvB,SAAS;UACL,qBAAqB,KAAK;UAC1B,kBAAc,0BAAW,KAAK,SAAS;;;IAGnD;;;;IAQS,+BAA2B,MAAA;8BADvC,yCAAU,8BAAiB,gBAAgB,CAAC;;;;oBACI;mDAAA,YAAW;WAAA;;;;;;;;AAA5D,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;IACT,YAAmB,SAAwD;AACvE,YAAM,OAAO;AACb,WAAK,aAAa,QAAQ;AAC1B,WAAK,aAAa,QAAQ;IAC9B;IACO,OAAO,KAAK,KAAY,KAAqB;AAChD,uCAAgB,IAAI,QAAQ,UAAU,EAAE;AACxC,YAAM,aAA4B,uBAAuB,IAAI,SAAS,CAAC;AACvE,YAAM,aAAa,IAAI,QAAQ,SAAS,GAAG,EAAE;AAC7C,aAAO,IAAI,KAAK;QACZ,QAAQ,IAAI;QACZ;QACA;OACH;IACL;IACO;IACA;IACA,UAAU,KAAsB;AACnC,WAAK,UAAU,oBAAM,OAAO;QACxB,uBAAuB,KAAK,UAAU;QACtC,KAAK;OACR;AACD,aAAO,MAAM,UAAU,GAAG;IAC9B;IACO,WAAW,KAAgB;AAC9B,aAAO;QACH,GAAG,MAAM,WAAW,GAAG;QACvB,SAAS;UACL,sBAAkB,iCAAkB,2BAAe,KAAK,UAAU;;;;;IAK9E;;;;IASS,4BAAwB,MAAA;8BAHpC,yCAAU,8BAAiB,aAAa,CAAC;;;;oBAGI;gDAAA,YAAW;WAAA;;;;;;;;AAAzD,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;IACT,YAAmB,SAAqD;AACpE,YAAM,OAAO;AACb,WAAK,eAAe,QAAQ;IAChC;IACO,OAAO,KAAK,KAAY,KAAqB;AAChD,uCAAgB,IAAI,QAAQ,UAAU,CAAC;AACvC,YAAM,eAA8B,uBAAuB,IAAI,SAAS,CAAC;AACzE,aAAO,IAAI,KAAK;QACZ,QAAQ,IAAI;QACZ;OACH;IACL;IACO;IACA,UAAU,KAAsB;AACnC,WAAK,UAAU,uBAAuB,KAAK,YAAY;AACvD,aAAO,MAAM,UAAU,GAAG;IAC9B;IACO,WAAW,KAAgB;AAC9B,aAAO;QACH,GAAG,MAAM,WAAW,GAAG;QACvB,SAAS;UACL,sBAAkB,iCAAkB,2BAAe,KAAK,YAAY;;;IAGhF;;;;IAGS,+BAA2B,MAAA;8BADvC,yCAAU,8BAAiB,gBAAgB,CAAC;;;;oBACI;mDAAA,YAAW;WAAA;;;;;;;;AAA5D,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;;;;IAQA,0BAAsB,MAAA;8BADlC,yCAAU,8BAAiB,WAAW,CAAC;;;;oBACI;8CAAA,YAAW;WAAA;;;;;;;;AAAvD,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;IACT,YAAmB,SAAmD;AAClE,YAAM,OAAO;AACb,WAAK,cAAc,QAAQ;AAC3B,WAAK,qBAAqB,QAAQ;IACtC;IACO,OAAO,KAAK,KAAY,KAAqB;AAChD,uCAAgB,IAAI,QAAQ,UAAU,CAAC;AACvC,YAAM,cAAc,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI;AACxC,YAAM,qBAAqB,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI;AAC/C,aAAO,IAAI,KAAK;QACZ,QAAQ,IAAI;QACZ;QACA;OACH;IACL;IACO;IACA;IACA,UAAU,KAAsB;AACnC,WAAK,UAAU,oBAAM,KAAK;SACrB,KAAK,cAAc,IAAO,MAAM,KAAK,qBAAqB,IAAM;OACpE;AACD,aAAO,MAAM,UAAU,GAAG;IAC9B;IACO,WAAW,KAAgB;AAC9B,aAAO;QACH,GAAG,MAAM,WAAW,GAAG;QACvB,SAAS;UACL,gBAAgB,KAAK;UACrB,oBAAoB,KAAK;;;IAGrC;;;;IAOS,sCAAkC,MAAA;8BAD9C,yCAAU,8BAAiB,uBAAuB,CAAC;;;;oBACI;0DAAA,YAAW;WAAA;;;;;;;;AAAnE,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;IACT,YAAmB,SAA+D;AAC9E,YAAM,OAAO;AACb,WAAK,eAAe,QAAQ;IAChC;IACO,OAAO,KAAK,KAAY,KAAqB;AAChD,YAAM,UAAM,yBAAY,IAAI,OAAO;AAKnC,YAAM,eAAe,IAAI;AACzB,aAAO,IAAI,KAAK;QACZ,QAAQ,IAAI;QACZ;OACH;IACL;IACgB;IACT,UAAU,KAAsB;AACnC,WAAK,cAAU,0BAAa,KAAK,cAAc,CAAA,CAAE;AACjD,aAAO,MAAM,UAAU,GAAG;IAC9B;IACO,WAAW,KAAgB;AAC9B,aAAO;QACH,GAAG,MAAM,WAAW,GAAG;QACvB,SAAS;UACL,iBAAiB,KAAK,aACjB,IAAI,CAAC,WAAO,uBAAU,EAAE,CAAC,EACzB,IAAI,CAAC,OAAO;OAAO,EAAE,EAAE,EACvB,KAAK,EAAE;;;IAGxB;;;;IAIS,mCAA+B,MAAA;8BAF3C,yCAAU,8BAAiB,oBAAoB,OAC/C,kDAAmB,kCAAkC,CAAC;;;;oBACF;uDAAA,YAAW;WAAA;;;;;;;;AAAhE,mBAAA,MAAA,mBAAA,EAAA,OAAA,WAAA,GAAA,kBAAA,EAAA,MAAA,SAAA,MAAA,WAAA,MAAA,UAAA,UAAA,GAAA,MAAA,uBAAA;;;AAAa,wBAAA,YAAA,uBAAA;;;;;",
   "names": ["import_shared", "secClass", "Security2CC", "nodeId", "mpanExtension", "Security2CCMessageEncapsulation"]
 }

package/build/cjs/cc/SecurityCC.d.ts

@@ -1,9 +1,9 @@
-import type { CCEncodingContext, CCParsingContext } from "@zwave-js/cc";
 import { CommandClasses, type GetValueDB, type MaybeNotKnown, type MessageOrCCLogEntry, type SecurityManager, type WithAddress } from "@zwave-js/core";
 import { Bytes, type BytesView } from "@zwave-js/shared";
 import { PhysicalCCAPI } from "../lib/API.js";
 import { type CCRaw, CommandClass, type InterviewContext } from "../lib/CommandClass.js";
 import { SecurityCommand } from "../lib/_Types.js";
+import type { CCEncodingContext, CCParsingContext } from "../lib/traits.js";
 export declare class SecurityCCAPI extends PhysicalCCAPI {
     supportsCommand(_cmd: SecurityCommand): MaybeNotKnown<boolean>;
     sendEncapsulated(encapsulated: CommandClass, requestNextNonce?: boolean): Promise<void>;
@@ -16,7 +16,9 @@ export declare class SecurityCCAPI extends PhysicalCCAPI {
      * The return value indicates whether a nonce was successfully sent
      */
     sendNonce(): Promise<boolean>;
-    getSecurityScheme(): Promise<[0]>;
+    getSecurityScheme(): Promise<[
+        0
+    ]>;
     reportSecurityScheme(encapsulated: boolean): Promise<void>;
     inheritSecurityScheme(): Promise<void>;
     setNetworkKey(networkKey: BytesView): Promise<void>;