@zwave-js/cc 9.3.1-0-pr-4662-79458fb

package/build/cc/Security2CC.js

@@ -0,0 +1,1124 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var Security2CC_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Security2CCCommandsSupportedGet = exports.Security2CCCommandsSupportedReport = exports.Security2CCTransferEnd = exports.Security2CCNetworkKeyVerify = exports.Security2CCNetworkKeyGet = exports.Security2CCNetworkKeyReport = exports.Security2CCPublicKeyReport = exports.Security2CCKEXFail = exports.Security2CCKEXSet = exports.Security2CCKEXGet = exports.Security2CCKEXReport = exports.Security2CCNonceGet = exports.Security2CCNonceReport = exports.Security2CCMessageEncapsulation = exports.Security2CC = exports.Security2CCAPI = void 0;
+const core_1 = require("@zwave-js/core");
+const serial_1 = require("@zwave-js/serial");
+const safe_1 = require("@zwave-js/shared/safe");
+const API_1 = require("../lib/API");
+const CommandClass_1 = require("../lib/CommandClass");
+const Extension_1 = require("../lib/Security2/Extension");
+const shared_1 = require("../lib/Security2/shared");
+const _Types_1 = require("../lib/_Types");
+const MultiChannelCC_1 = require("./MultiChannelCC");
+function securityClassToBitMask(key) {
+    return (0, core_1.encodeBitMask)([key], core_1.SecurityClass.S0_Legacy, core_1.SecurityClass.S2_Unauthenticated);
+}
+function bitMaskToSecurityClass(buffer, offset) {
+    const keys = (0, core_1.parseBitMask)(buffer.slice(offset, offset + 1), core_1.SecurityClass.S2_Unauthenticated);
+    (0, core_1.validatePayload)(keys.length === 1);
+    return keys[0];
+}
+function getAuthenticationData(sendingNodeId, destination, homeId, commandLength, unencryptedPayload) {
+    const ret = Buffer.allocUnsafe(8 + unencryptedPayload.length);
+    ret[0] = sendingNodeId;
+    ret[1] = destination;
+    ret.writeUInt32BE(homeId, 2);
+    ret.writeUInt16BE(commandLength, 6);
+    // This includes the sequence number and all unencrypted extensions
+    unencryptedPayload.copy(ret, 8, 0);
+    return ret;
+}
+/** Validates that a sequence number is not a duplicate and updates the SPAN table if it is accepted */
+function validateSequenceNumber(sequenceNumber) {
+    const peerNodeID = this.nodeId;
+    core_1.validatePayload.withReason("Duplicate command")(!this.host.securityManager2.isDuplicateSinglecast(peerNodeID, sequenceNumber));
+    // Not a duplicate, store it
+    this.host.securityManager2.storeSequenceNumber(peerNodeID, sequenceNumber);
+}
+function assertSecurity(options) {
+    const verb = (0, serial_1.gotDeserializationOptions)(options) ? "decoded" : "sent";
+    if (!this.host.ownNodeId) {
+        throw new core_1.ZWaveError(`Secure commands (S2) can only be ${verb} when the controller's node id is known!`, core_1.ZWaveErrorCodes.Driver_NotReady);
+    }
+    else if (!this.host.securityManager2) {
+        throw new core_1.ZWaveError(`Secure commands (S2) can only be ${verb} when the network keys for the applHost are set!`, core_1.ZWaveErrorCodes.Driver_NoSecurity);
+    }
+}
+const DECRYPT_ATTEMPTS = 5;
+// @noValidateArgs - Encapsulation CCs are used internally and too frequently that we
+// want to pay the cost of validating each call
+let Security2CCAPI = class Security2CCAPI extends API_1.CCAPI {
+    supportsCommand(_cmd) {
+        // All commands are mandatory
+        return true;
+    }
+    /**
+     * Sends a nonce to the node, either in response to a NonceGet request or a message that failed to decrypt. The message is sent without any retransmission etc.
+     * The return value indicates whether a nonce was successfully sent
+     */
+    async sendNonce() {
+        this.assertSupportsCommand(_Types_1.Security2Command, _Types_1.Security2Command.NonceReport);
+        this.assertPhysicalEndpoint(this.endpoint);
+        if (!this.applHost.securityManager2) {
+            throw new core_1.ZWaveError(`Nonces can only be sent if secure communication is set up!`, core_1.ZWaveErrorCodes.Driver_NoSecurity);
+        }
+        const receiverEI = this.applHost.securityManager2.generateNonce(this.endpoint.nodeId);
+        const cc = new Security2CCNonceReport(this.applHost, {
+            nodeId: this.endpoint.nodeId,
+            endpoint: this.endpoint.index,
+            SOS: true,
+            MOS: false,
+            receiverEI,
+        });
+        try {
+            await this.applHost.sendCommand(cc, {
+                ...this.commandOptions,
+                // Seems we need these options or some nodes won't accept the nonce
+                transmitOptions: core_1.TransmitOptions.ACK | core_1.TransmitOptions.AutoRoute,
+                // Only try sending a nonce once
+                maxSendAttempts: 1,
+                // Nonce requests must be handled immediately
+                priority: core_1.MessagePriority.Nonce,
+                // We don't want failures causing us to treat the node as asleep or dead
+                changeNodeStatusOnMissingACK: false,
+                // And we need to react to
+            });
+        }
+        catch (e) {
+            if ((0, core_1.isTransmissionError)(e)) {
+                // The nonce could not be sent, invalidate it
+                this.applHost.securityManager2.deleteNonce(this.endpoint.nodeId);
+                return false;
+            }
+            else {
+                // Pass other errors through
+                throw e;
+            }
+        }
+        return true;
+    }
+    /**
+     * Queries the securely supported commands for the current security class
+     * @param securityClass Can be used to overwrite the security class to use. If this doesn't match the current one, new nonces will need to be exchanged.
+     */
+    async getSupportedCommands(securityClass) {
+        this.assertSupportsCommand(_Types_1.Security2Command, _Types_1.Security2Command.CommandsSupportedGet);
+        let cc = new Security2CCCommandsSupportedGet(this.applHost, {
+            nodeId: this.endpoint.nodeId,
+            endpoint: this.endpoint.index,
+        });
+        // Security2CCCommandsSupportedGet is special because we cannot reply on the applHost to do the automatic
+        // encapsulation because it would use a different security class. Therefore the entire possible stack
+        // of encapsulation needs to be done here
+        if (MultiChannelCC_1.MultiChannelCC.requiresEncapsulation(cc)) {
+            cc = MultiChannelCC_1.MultiChannelCC.encapsulate(this.applHost, cc);
+        }
+        cc = Security2CC.encapsulate(this.applHost, cc, securityClass);
+        const response = await this.applHost.sendCommand(cc, {
+            ...this.commandOptions,
+            autoEncapsulate: false,
+        });
+        return response === null || response === void 0 ? void 0 : response.supportedCCs;
+    }
+    // eslint-disable-next-line @typescript-eslint/explicit-module-boundary-types
+    async getKeyExchangeParameters() {
+        this.assertSupportsCommand(_Types_1.Security2Command, _Types_1.Security2Command.KEXGet);
+        const cc = new Security2CCKEXGet(this.applHost, {
+            nodeId: this.endpoint.nodeId,
+            endpoint: this.endpoint.index,
+        });
+        const response = await this.applHost.sendCommand(cc, this.commandOptions);
+        if (response) {
+            return (0, safe_1.pick)(response, [
+                "requestCSA",
+                "echo",
+                "supportedKEXSchemes",
+                "supportedECDHProfiles",
+                "requestedKeys",
+            ]);
+        }
+    }
+    /** Grants the joining node the given keys */
+    async grantKeys(params) {
+        this.assertSupportsCommand(_Types_1.Security2Command, _Types_1.Security2Command.KEXSet);
+        const cc = new Security2CCKEXSet(this.applHost, {
+            nodeId: this.endpoint.nodeId,
+            endpoint: this.endpoint.index,
+            ...params,
+            echo: false,
+        });
+        await this.applHost.sendCommand(cc, this.commandOptions);
+    }
+    /** Confirms the keys that were granted to a node */
+    async confirmGrantedKeys(params) {
+        this.assertSupportsCommand(_Types_1.Security2Command, _Types_1.Security2Command.KEXReport);
+        const cc = new Security2CCKEXReport(this.applHost, {
+            nodeId: this.endpoint.nodeId,
+            endpoint: this.endpoint.index,
+            ...params,
+            echo: true,
+        });
+        await this.applHost.sendCommand(cc, this.commandOptions);
+    }
+    /** Notifies the other node that the ongoing key exchange was aborted */
+    async abortKeyExchange(failType) {
+        this.assertSupportsCommand(_Types_1.Security2Command, _Types_1.Security2Command.KEXFail);
+        const cc = new Security2CCKEXFail(this.applHost, {
+            nodeId: this.endpoint.nodeId,
+            endpoint: this.endpoint.index,
+            failType,
+        });
+        await this.applHost.sendCommand(cc, this.commandOptions);
+    }
+    async sendPublicKey(publicKey) {
+        this.assertSupportsCommand(_Types_1.Security2Command, _Types_1.Security2Command.PublicKeyReport);
+        const cc = new Security2CCPublicKeyReport(this.applHost, {
+            nodeId: this.endpoint.nodeId,
+            endpoint: this.endpoint.index,
+            includingNode: true,
+            publicKey,
+        });
+        await this.applHost.sendCommand(cc, this.commandOptions);
+    }
+    async sendNetworkKey(securityClass, networkKey) {
+        this.assertSupportsCommand(_Types_1.Security2Command, _Types_1.Security2Command.NetworkKeyReport);
+        const cc = new Security2CCNetworkKeyReport(this.applHost, {
+            nodeId: this.endpoint.nodeId,
+            endpoint: this.endpoint.index,
+            grantedKey: securityClass,
+            networkKey,
+        });
+        await this.applHost.sendCommand(cc, this.commandOptions);
+    }
+    async confirmKeyVerification() {
+        this.assertSupportsCommand(_Types_1.Security2Command, _Types_1.Security2Command.TransferEnd);
+        const cc = new Security2CCTransferEnd(this.applHost, {
+            nodeId: this.endpoint.nodeId,
+            endpoint: this.endpoint.index,
+            keyVerified: true,
+            keyRequestComplete: false,
+        });
+        await this.applHost.sendCommand(cc, {
+            ...this.commandOptions,
+            // Don't wait for an ACK from the node
+            transmitOptions: core_1.TransmitOptions.DEFAULT & ~core_1.TransmitOptions.ACK,
+        });
+    }
+};
+Security2CCAPI = __decorate([
+    (0, CommandClass_1.API)(core_1.CommandClasses["Security 2"])
+], Security2CCAPI);
+exports.Security2CCAPI = Security2CCAPI;
+let Security2CC = Security2CC_1 = class Security2CC extends CommandClass_1.CommandClass {
+    async interview(applHost) {
+        var _a;
+        const node = this.getNode(applHost);
+        const endpoint = this.getEndpoint(applHost);
+        const api = API_1.CCAPI.create(core_1.CommandClasses["Security 2"], applHost, endpoint).withOptions({
+            priority: core_1.MessagePriority.NodeQuery,
+        });
+        // Only on the highest security class the reponse includes the supported commands
+        const secClass = node.getHighestSecurityClass();
+        let hasReceivedSecureCommands = false;
+        let possibleSecurityClasses;
+        if ((0, core_1.securityClassIsS2)(secClass)) {
+            // The highest security class is known to be S2, only query that one
+            possibleSecurityClasses = [secClass];
+        }
+        else if (endpoint.index === 0) {
+            // If the highest security class isn't known, query all possible security classes
+            // but only on the root device
+            possibleSecurityClasses = [
+                core_1.SecurityClass.S2_Unauthenticated,
+                core_1.SecurityClass.S2_Authenticated,
+                core_1.SecurityClass.S2_AccessControl,
+            ];
+        }
+        else {
+            // For endpoint interviews, the security class MUST be known
+            applHost.controllerLog.logNode(node.id, {
+                endpoint: endpoint.index,
+                message: `Cannot query securely supported commands for endpoint because the node's security class isn't known...`,
+                level: "error",
+            });
+            return;
+        }
+        for (const secClass of possibleSecurityClasses) {
+            // We might not know all assigned security classes yet, so we work our way up from low to high and try to request the supported commands.
+            // This way, each command is encrypted with the security class we're currently testing.
+            // If the node does not respond, it wasn't assigned the security class.
+            // If it responds with a non-empty list, we know this is the highest class it supports.
+            // If the list is empty, the security class is still supported.
+            // If we already know the class is not supported, skip it
+            if (node.hasSecurityClass(secClass) === false)
+                continue;
+            // If no key is configured for this security class, skip it
+            if (!((_a = this.host.securityManager2) === null || _a === void 0 ? void 0 : _a.hasKeysForSecurityClass(secClass))) {
+                applHost.controllerLog.logNode(node.id, {
+                    endpoint: endpoint.index,
+                    message: `Cannot query securely supported commands (${(0, safe_1.getEnumMemberName)(core_1.SecurityClass, secClass)}) - network key is not configured...`,
+                    level: "warn",
+                });
+                continue;
+            }
+            applHost.controllerLog.logNode(node.id, {
+                endpoint: endpoint.index,
+                message: `Querying securely supported commands (${(0, safe_1.getEnumMemberName)(core_1.SecurityClass, secClass)})...`,
+                direction: "outbound",
+            });
+            // Query the supported commands but avoid remembering the wrong security class in case of a failure
+            let supportedCCs;
+            try {
+                supportedCCs = await api.getSupportedCommands(secClass);
+            }
+            catch (e) {
+                if ((0, core_1.isZWaveError)(e) &&
+                    e.code === core_1.ZWaveErrorCodes.Security2CC_CannotDecode) {
+                    // This has to be expected when we're using a non-granted security class
+                    supportedCCs = undefined;
+                }
+                else {
+                    throw e;
+                }
+            }
+            if (supportedCCs == undefined) {
+                if (endpoint.index === 0) {
+                    // No supported commands found, mark the security class as not granted
+                    node.setSecurityClass(secClass, false);
+                    applHost.controllerLog.logNode(node.id, {
+                        message: `The node was NOT granted the security class ${(0, safe_1.getEnumMemberName)(core_1.SecurityClass, secClass)}`,
+                        direction: "inbound",
+                    });
+                }
+                continue;
+            }
+            if (endpoint.index === 0) {
+                // Mark the security class as granted
+                node.setSecurityClass(secClass, true);
+                applHost.controllerLog.logNode(node.id, {
+                    message: `The node was granted the security class ${(0, safe_1.getEnumMemberName)(core_1.SecurityClass, secClass)}`,
+                    direction: "inbound",
+                });
+            }
+            if (!hasReceivedSecureCommands && supportedCCs.length > 0) {
+                hasReceivedSecureCommands = true;
+                const logLines = [
+                    `received secure commands (${(0, safe_1.getEnumMemberName)(core_1.SecurityClass, secClass)})`,
+                    "supported CCs:",
+                ];
+                for (const cc of supportedCCs) {
+                    logLines.push(`· ${(0, core_1.getCCName)(cc)}`);
+                }
+                applHost.controllerLog.logNode(node.id, {
+                    endpoint: endpoint.index,
+                    message: logLines.join("\n"),
+                    direction: "inbound",
+                });
+                // Remember which commands are supported securely
+                for (const cc of supportedCCs) {
+                    endpoint.addCC(cc, {
+                        isSupported: true,
+                        secure: true,
+                    });
+                }
+            }
+        }
+        // Remember that the interview is complete
+        this.setInterviewComplete(applHost, true);
+    }
+    /** Tests if a command should be sent secure and thus requires encapsulation */
+    static requiresEncapsulation(cc) {
+        // Everything that's not an S2 CC needs to be encapsulated if the CC is secure
+        if (!cc.secure)
+            return false;
+        if (!(cc instanceof Security2CC_1))
+            return true;
+        // These S2 commands need additional encapsulation
+        switch (cc.ccCommand) {
+            case _Types_1.Security2Command.CommandsSupportedGet:
+            case _Types_1.Security2Command.CommandsSupportedReport:
+            case _Types_1.Security2Command.NetworkKeyGet:
+            case _Types_1.Security2Command.NetworkKeyReport:
+            case _Types_1.Security2Command.NetworkKeyVerify:
+            case _Types_1.Security2Command.TransferEnd:
+                return true;
+            case _Types_1.Security2Command.KEXSet:
+            case _Types_1.Security2Command.KEXReport:
+                // KEXSet/Report need to be encrypted for the confirmation only
+                return cc.echo;
+            case _Types_1.Security2Command.KEXFail: {
+                switch (cc.failType) {
+                    case shared_1.KEXFailType.Decrypt:
+                    case shared_1.KEXFailType.WrongSecurityLevel:
+                    case shared_1.KEXFailType.KeyNotGranted:
+                    case shared_1.KEXFailType.NoVerify:
+                        return true;
+                    default:
+                        return false;
+                }
+            }
+        }
+        return false;
+    }
+    /** Encapsulates a command that should be sent encrypted */
+    static encapsulate(host, cc, securityClass) {
+        return new Security2CCMessageEncapsulation(host, {
+            nodeId: cc.nodeId,
+            encapsulated: cc,
+            securityClass,
+        });
+    }
+};
+Security2CC = Security2CC_1 = __decorate([
+    (0, CommandClass_1.commandClass)(core_1.CommandClasses["Security 2"]),
+    (0, CommandClass_1.implementedVersion)(1)
+], Security2CC);
+exports.Security2CC = Security2CC;
+// An S2 encapsulated command may result in a NonceReport to be sent by the node if it couldn't decrypt the message
+function getCCResponseForMessageEncapsulation(sent) {
+    var _a;
+    if ((_a = sent.encapsulated) === null || _a === void 0 ? void 0 : _a.expectsCCResponse()) {
+        return [
+            Security2CCMessageEncapsulation,
+            Security2CCNonceReport,
+        ];
+    }
+}
+function testCCResponseForMessageEncapsulation(sent, received) {
+    if (received instanceof Security2CCMessageEncapsulation) {
+        return "checkEncapsulated";
+    }
+    else {
+        return received.SOS && !!received.receiverEI;
+    }
+}
+let Security2CCMessageEncapsulation = class Security2CCMessageEncapsulation extends Security2CC {
+    constructor(host, options) {
+        var _a;
+        super(host, options);
+        // Make sure that we can send/receive secure commands
+        assertSecurity.call(this, options);
+        if ((0, serial_1.gotDeserializationOptions)(options)) {
+            (0, core_1.validatePayload)(this.payload.length >= 2);
+            // Check the sequence number to avoid duplicates
+            // TODO: distinguish between multicast and singlecast
+            this._sequenceNumber = this.payload[0];
+            // Don't accept duplicate commands
+            validateSequenceNumber.call(this, this._sequenceNumber);
+            // Ensure the node has a security class
+            const peerNodeID = this.nodeId;
+            // const node = this.getNode()!;
+            // validatePayload.withReason("The node is not included")(!!node);
+            const securityClass = this.host.getHighestSecurityClass(peerNodeID);
+            core_1.validatePayload.withReason("No security class granted")(securityClass !== core_1.SecurityClass.None);
+            const hasExtensions = !!(this.payload[1] & 0b1);
+            const hasEncryptedExtensions = !!(this.payload[1] & 0b10);
+            let offset = 2;
+            this.extensions = [];
+            const parseExtensions = (buffer) => {
+                while (true) {
+                    // we need to read at least the length byte
+                    (0, core_1.validatePayload)(buffer.length >= offset + 1);
+                    const extensionLength = Extension_1.Security2Extension.getExtensionLength(buffer.slice(offset));
+                    // Parse the extension
+                    const ext = Extension_1.Security2Extension.from(buffer.slice(offset, offset + extensionLength));
+                    this.extensions.push(ext);
+                    offset += extensionLength;
+                    // Check if that was the last extension
+                    if (!ext.moreToFollow)
+                        break;
+                }
+            };
+            if (hasExtensions)
+                parseExtensions(this.payload);
+            const unencryptedPayload = this.payload.slice(0, offset);
+            const ciphertext = this.payload.slice(offset, -core_1.SECURITY_S2_AUTH_TAG_LENGTH);
+            const authTag = this.payload.slice(-core_1.SECURITY_S2_AUTH_TAG_LENGTH);
+            const messageLength = super.computeEncapsulationOverhead() + this.payload.length;
+            const authData = getAuthenticationData(this.nodeId, this.getDestinationIDRX(), this.host.homeId, messageLength, unencryptedPayload);
+            // Decrypt payload and verify integrity
+            const spanState = this.host.securityManager2.getSPANState(peerNodeID);
+            const failNoSPAN = () => {
+                return core_1.validatePayload.fail(core_1.ZWaveErrorCodes.Security2CC_NoSPAN);
+            };
+            // If we are not able to establish an SPAN yet, fail the decryption
+            if (spanState.type === core_1.SPANState.None) {
+                return failNoSPAN();
+            }
+            else if (spanState.type === core_1.SPANState.RemoteEI) {
+                // TODO: The specs are not clear how to handle this case
+                // For now, do the same as if we didn't have any EI
+                return failNoSPAN();
+            }
+            const decrypt = () => {
+                const getNonceAndDecrypt = () => {
+                    const iv = this.host.securityManager2.nextNonce(peerNodeID);
+                    const { keyCCM: key } = this.host.securityManager2.getKeysForNode(peerNodeID);
+                    return {
+                        decryptionKey: key,
+                        ...(0, core_1.decryptAES128CCM)(key, iv, ciphertext, authData, authTag),
+                    };
+                };
+                if (spanState.type === core_1.SPANState.SPAN) {
+                    // This can only happen if the security class is known
+                    return getNonceAndDecrypt();
+                }
+                else if (spanState.type === core_1.SPANState.LocalEI) {
+                    // We've sent the other our receiver's EI and received its sender's EI,
+                    // meaning we can now establish an SPAN
+                    const senderEI = this.getSenderEI();
+                    if (!senderEI)
+                        return failNoSPAN();
+                    const receiverEI = spanState.receiverEI;
+                    // How we do this depends on whether we know the security class of the other node
+                    if (this.host.securityManager2.tempKeys.has(peerNodeID)) {
+                        // We're currently bootstrapping the node, it might be using a temporary key
+                        this.host.securityManager2.initializeTempSPAN(peerNodeID, senderEI, receiverEI);
+                        const ret = getNonceAndDecrypt();
+                        // Decryption with the temporary key worked
+                        if (ret.authOK)
+                            return ret;
+                        // Reset the SPAN state and try with the recently granted security class
+                        this.host.securityManager2.setSPANState(peerNodeID, spanState);
+                    }
+                    if (securityClass != undefined) {
+                        this.host.securityManager2.initializeSPAN(peerNodeID, securityClass, senderEI, receiverEI);
+                        return getNonceAndDecrypt();
+                    }
+                    else {
+                        // Not knowing it can happen if we just took over an existing network
+                        // Try multiple security classes
+                        const possibleSecurityClasses = core_1.securityClassOrder
+                            .filter((s) => (0, core_1.securityClassIsS2)(s))
+                            .filter((s) => this.host.hasSecurityClass(peerNodeID, s) !== false);
+                        for (const secClass of possibleSecurityClasses) {
+                            // Initialize an SPAN with that security class
+                            this.host.securityManager2.initializeSPAN(peerNodeID, secClass, senderEI, receiverEI);
+                            const ret = getNonceAndDecrypt();
+                            // It worked, return the result and remember the security class
+                            if (ret.authOK) {
+                                this.host.setSecurityClass(peerNodeID, secClass, true);
+                                return ret;
+                            }
+                            // Reset the SPAN state and try with the next security class
+                            this.host.securityManager2.setSPANState(peerNodeID, spanState);
+                        }
+                    }
+                }
+                // Nothing worked, fail the decryption
+                return { plaintext: Buffer.from([]), authOK: false };
+            };
+            let plaintext;
+            let authOK = false;
+            let decryptionKey;
+            // If the Receiver is unable to authenticate the singlecast message with the current SPAN,
+            // the Receiver SHOULD try decrypting the message with one or more of the following SPAN values,
+            // stopping when decryption is successful or the maximum number of iterations is reached.
+            for (let i = 0; i < DECRYPT_ATTEMPTS; i++) {
+                ({ plaintext, authOK, decryptionKey } = decrypt());
+                if (!!authOK && !!plaintext)
+                    break;
+            }
+            // If authentication fails, do so with an error code that instructs the
+            // applHost to tell the node we have no nonce
+            if (!authOK || !plaintext) {
+                return core_1.validatePayload.fail(core_1.ZWaveErrorCodes.Security2CC_CannotDecode);
+            }
+            offset = 0;
+            if (hasEncryptedExtensions)
+                parseExtensions(plaintext);
+            // Not every S2 message includes an encapsulated CC
+            const decryptedCCBytes = plaintext.slice(offset);
+            if (decryptedCCBytes.length > 0) {
+                // make sure this contains a complete CC command that's worth splitting
+                (0, core_1.validatePayload)(decryptedCCBytes.length >= 2);
+                // and deserialize the CC
+                this.encapsulated = CommandClass_1.CommandClass.from(this.host, {
+                    data: decryptedCCBytes,
+                    fromEncapsulation: true,
+                    encapCC: this,
+                });
+            }
+            this.decryptionKey = decryptionKey;
+        }
+        else {
+            this._securityClass = options.securityClass;
+            this.encapsulated = options.encapsulated;
+            options.encapsulated.encapsulatingCC = this;
+            this.extensions = (_a = options.extensions) !== null && _a !== void 0 ? _a : [];
+            if (typeof this.nodeId !== "number" &&
+                !this.extensions.some((e) => e instanceof Extension_1.MGRPExtension)) {
+                throw new core_1.ZWaveError("Multicast Security S2 encapsulation requires the MGRP extension", core_1.ZWaveErrorCodes.Security2CC_MissingExtension);
+            }
+        }
+    }
+    /**
+     * Return the sequence number of this command.
+     *
+     * **WARNING:** If the sequence number hasn't been set before, this will create a new one.
+     * When sending messages, this should only happen immediately before serializing.
+     */
+    get sequenceNumber() {
+        if (this._sequenceNumber == undefined) {
+            this._sequenceNumber =
+                this.host.securityManager2.nextSequenceNumber(this.nodeId);
+        }
+        return this._sequenceNumber;
+    }
+    unsetSequenceNumber() {
+        this._sequenceNumber = undefined;
+    }
+    getDestinationIDTX() {
+        const mgrpExtension = this.extensions.find((e) => e instanceof Extension_1.MGRPExtension);
+        if (mgrpExtension)
+            return mgrpExtension.groupId;
+        else if (typeof this.nodeId === "number")
+            return this.nodeId;
+        throw new core_1.ZWaveError("Multicast Security S2 encapsulation requires the MGRP extension", core_1.ZWaveErrorCodes.Security2CC_MissingExtension);
+    }
+    getDestinationIDRX() {
+        const mgrpExtension = this.extensions.find((e) => e instanceof Extension_1.MGRPExtension);
+        if (mgrpExtension)
+            return mgrpExtension.groupId;
+        return this.host.ownNodeId;
+    }
+    /** Returns the Sender's Entropy Input if this command contains an SPAN extension */
+    getSenderEI() {
+        const spanExtension = this.extensions.find((e) => e instanceof Extension_1.SPANExtension);
+        return spanExtension === null || spanExtension === void 0 ? void 0 : spanExtension.senderEI;
+    }
+    serialize() {
+        var _a, _b, _c;
+        // TODO: Support Multicast
+        const nodeId = this.nodeId;
+        // Include Sender EI in the command if we only have the receiver's EI
+        const spanState = this.host.securityManager2.getSPANState(nodeId);
+        if (spanState.type === core_1.SPANState.None ||
+            spanState.type === core_1.SPANState.LocalEI) {
+            // Can't do anything here if we don't have the receiver's EI
+            throw new core_1.ZWaveError(`Security S2 CC requires the receiver's nonce to be sent!`, core_1.ZWaveErrorCodes.Security2CC_NoSPAN);
+        }
+        else if (spanState.type === core_1.SPANState.RemoteEI) {
+            // We have the receiver's EI, generate our input and send it over
+            // With both, we can create an SPAN
+            const senderEI = this.host.securityManager2.generateNonce(undefined);
+            const receiverEI = spanState.receiverEI;
+            // While bootstrapping a node, the controller only sends commands encrypted
+            // with the temporary key
+            if (this.host.securityManager2.tempKeys.has(nodeId)) {
+                this.host.securityManager2.initializeTempSPAN(nodeId, senderEI, receiverEI);
+            }
+            else {
+                const securityClass = (_a = this._securityClass) !== null && _a !== void 0 ? _a : this.host.getHighestSecurityClass(nodeId);
+                if (securityClass == undefined) {
+                    throw new core_1.ZWaveError("No security class defined for this command!", core_1.ZWaveErrorCodes.Security2CC_NoSPAN);
+                }
+                this.host.securityManager2.initializeSPAN(nodeId, securityClass, senderEI, receiverEI);
+            }
+            // Add or update the SPAN extension
+            let spanExtension = this.extensions.find((e) => e instanceof Extension_1.SPANExtension);
+            if (spanExtension) {
+                spanExtension.senderEI = senderEI;
+            }
+            else {
+                spanExtension = new Extension_1.SPANExtension({ senderEI });
+                this.extensions.push(spanExtension);
+            }
+        }
+        const unencryptedExtensions = this.extensions.filter((e) => !e.isEncrypted());
+        const encryptedExtensions = this.extensions.filter((e) => e.isEncrypted());
+        const unencryptedPayload = Buffer.concat([
+            Buffer.from([
+                this.sequenceNumber,
+                (encryptedExtensions.length > 0 ? 0b10 : 0) |
+                    (unencryptedExtensions.length > 0 ? 1 : 0),
+            ]),
+            ...unencryptedExtensions.map((e, index) => e.serialize(index < unencryptedExtensions.length - 1)),
+        ]);
+        const serializedCC = (_c = (_b = this.encapsulated) === null || _b === void 0 ? void 0 : _b.serialize()) !== null && _c !== void 0 ? _c : Buffer.from([]);
+        const plaintextPayload = Buffer.concat([
+            ...encryptedExtensions.map((e, index) => e.serialize(index < encryptedExtensions.length - 1)),
+            serializedCC,
+        ]);
+        // Generate the authentication data for CCM encryption
+        const messageLength = this.computeEncapsulationOverhead() + serializedCC.length;
+        const authData = getAuthenticationData(this.host.ownNodeId, this.getDestinationIDTX(), this.host.homeId, messageLength, unencryptedPayload);
+        const iv = this.host.securityManager2.nextNonce(nodeId);
+        const { keyCCM: key } = 
+        // Prefer the overridden security class if it was given
+        this._securityClass != undefined
+            ? this.host.securityManager2.getKeysForSecurityClass(this._securityClass)
+            : this.host.securityManager2.getKeysForNode(nodeId);
+        const { ciphertext: ciphertextPayload, authTag } = (0, core_1.encryptAES128CCM)(key, iv, plaintextPayload, authData, core_1.SECURITY_S2_AUTH_TAG_LENGTH);
+        this.payload = Buffer.concat([
+            unencryptedPayload,
+            ciphertextPayload,
+            authTag,
+        ]);
+        return super.serialize();
+    }
+    computeEncapsulationOverhead() {
+        // Security S2 adds:
+        // * 1 byte sequence number
+        // * 1 byte control
+        // * N bytes extensions
+        // * SECURITY_S2_AUTH_TAG_LENGTH bytes auth tag
+        const extensionBytes = this.extensions
+            .map((e) => e.computeLength())
+            .reduce((a, b) => a + b, 0);
+        return (super.computeEncapsulationOverhead() +
+            2 +
+            core_1.SECURITY_S2_AUTH_TAG_LENGTH +
+            extensionBytes);
+    }
+    toLogEntry(applHost) {
+        const message = {
+            "sequence number": this.sequenceNumber,
+        };
+        if (this.extensions.length > 0) {
+            message.extensions = this.extensions
+                .map((e) => e.toLogEntry())
+                .join("");
+        }
+        return {
+            ...super.toLogEntry(applHost),
+            message,
+        };
+    }
+};
+Security2CCMessageEncapsulation = __decorate([
+    (0, CommandClass_1.CCCommand)(_Types_1.Security2Command.MessageEncapsulation),
+    (0, CommandClass_1.expectedCCResponse)(getCCResponseForMessageEncapsulation, testCCResponseForMessageEncapsulation)
+], Security2CCMessageEncapsulation);
+exports.Security2CCMessageEncapsulation = Security2CCMessageEncapsulation;
+let Security2CCNonceReport = class Security2CCNonceReport extends Security2CC {
+    constructor(host, options) {
+        super(host, options);
+        // Make sure that we can send/receive secure commands
+        assertSecurity.call(this, options);
+        if ((0, serial_1.gotDeserializationOptions)(options)) {
+            (0, core_1.validatePayload)(this.payload.length >= 2);
+            this._sequenceNumber = this.payload[0];
+            // Don't accept duplicate commands
+            validateSequenceNumber.call(this, this._sequenceNumber);
+            this.MOS = !!(this.payload[1] & 0b10);
+            this.SOS = !!(this.payload[1] & 0b1);
+            (0, core_1.validatePayload)(this.MOS || this.SOS);
+            if (this.SOS) {
+                // If the SOS flag is set, the REI field MUST be included in the command
+                (0, core_1.validatePayload)(this.payload.length >= 18);
+                this.receiverEI = this.payload.slice(2, 18);
+                // In that case we also need to store it, so the next sent command
+                // can use it for encryption
+                this.host.securityManager2.storeRemoteEI(this.nodeId, this.receiverEI);
+            }
+        }
+        else {
+            this.SOS = options.SOS;
+            this.MOS = options.MOS;
+            if (options.SOS)
+                this.receiverEI = options.receiverEI;
+        }
+    }
+    /**
+     * Return the sequence number of this command.
+     *
+     * **WARNING:** If the sequence number hasn't been set before, this will create a new one.
+     * When sending messages, this should only happen immediately before serializing.
+     */
+    get sequenceNumber() {
+        if (this._sequenceNumber == undefined) {
+            this._sequenceNumber =
+                this.host.securityManager2.nextSequenceNumber(this.nodeId);
+        }
+        return this._sequenceNumber;
+    }
+    serialize() {
+        this.payload = Buffer.from([
+            this.sequenceNumber,
+            (this.MOS ? 0b10 : 0) + (this.SOS ? 0b1 : 0),
+        ]);
+        if (this.SOS) {
+            this.payload = Buffer.concat([this.payload, this.receiverEI]);
+        }
+        return super.serialize();
+    }
+    toLogEntry(applHost) {
+        const message = {
+            "sequence number": this.sequenceNumber,
+            SOS: this.SOS,
+            MOS: this.MOS,
+        };
+        if (this.receiverEI) {
+            message["receiver entropy"] = (0, safe_1.buffer2hex)(this.receiverEI);
+        }
+        return {
+            ...super.toLogEntry(applHost),
+            message,
+        };
+    }
+};
+Security2CCNonceReport = __decorate([
+    (0, CommandClass_1.CCCommand)(_Types_1.Security2Command.NonceReport)
+], Security2CCNonceReport);
+exports.Security2CCNonceReport = Security2CCNonceReport;
+let Security2CCNonceGet = class Security2CCNonceGet extends Security2CC {
+    constructor(host, options) {
+        super(host, options);
+        // Make sure that we can send/receive secure commands
+        assertSecurity.call(this, options);
+        if ((0, serial_1.gotDeserializationOptions)(options)) {
+            (0, core_1.validatePayload)(this.payload.length >= 1);
+            this._sequenceNumber = this.payload[0];
+            // Don't accept duplicate commands
+            validateSequenceNumber.call(this, this._sequenceNumber);
+        }
+        else {
+            // No options here
+        }
+    }
+    /**
+     * Return the sequence number of this command.
+     *
+     * **WARNING:** If the sequence number hasn't been set before, this will create a new one.
+     * When sending messages, this should only happen immediately before serializing.
+     */
+    get sequenceNumber() {
+        if (this._sequenceNumber == undefined) {
+            this._sequenceNumber =
+                this.host.securityManager2.nextSequenceNumber(this.nodeId);
+        }
+        return this._sequenceNumber;
+    }
+    serialize() {
+        this.payload = Buffer.from([this.sequenceNumber]);
+        return super.serialize();
+    }
+    toLogEntry(applHost) {
+        return {
+            ...super.toLogEntry(applHost),
+            message: { "sequence number": this.sequenceNumber },
+        };
+    }
+};
+Security2CCNonceGet = __decorate([
+    (0, CommandClass_1.CCCommand)(_Types_1.Security2Command.NonceGet),
+    (0, CommandClass_1.expectedCCResponse)(Security2CCNonceReport)
+], Security2CCNonceGet);
+exports.Security2CCNonceGet = Security2CCNonceGet;
+let Security2CCKEXReport = class Security2CCKEXReport extends Security2CC {
+    constructor(host, options) {
+        super(host, options);
+        if ((0, serial_1.gotDeserializationOptions)(options)) {
+            (0, core_1.validatePayload)(this.payload.length >= 4);
+            this.requestCSA = !!(this.payload[0] & 0b10);
+            this.echo = !!(this.payload[0] & 0b1);
+            // The bit mask starts at 0, but bit 0 is not used
+            this.supportedKEXSchemes = (0, core_1.parseBitMask)(this.payload.slice(1, 2), 0).filter((s) => s !== 0);
+            this.supportedECDHProfiles = (0, core_1.parseBitMask)(this.payload.slice(2, 3), shared_1.ECDHProfiles.Curve25519);
+            this.requestedKeys = (0, core_1.parseBitMask)(this.payload.slice(3, 4), core_1.SecurityClass.S2_Unauthenticated);
+        }
+        else {
+            this.requestCSA = options.requestCSA;
+            this.echo = options.echo;
+            this.supportedKEXSchemes = options.supportedKEXSchemes;
+            this.supportedECDHProfiles = options.supportedECDHProfiles;
+            this.requestedKeys = options.requestedKeys;
+        }
+    }
+    serialize() {
+        this.payload = Buffer.concat([
+            Buffer.from([(this.requestCSA ? 0b10 : 0) + (this.echo ? 0b1 : 0)]),
+            // The bit mask starts at 0, but bit 0 is not used
+            (0, core_1.encodeBitMask)(this.supportedKEXSchemes, 7, 0),
+            (0, core_1.encodeBitMask)(this.supportedECDHProfiles, 7, shared_1.ECDHProfiles.Curve25519),
+            (0, core_1.encodeBitMask)(this.requestedKeys, core_1.SecurityClass.S0_Legacy, core_1.SecurityClass.S2_Unauthenticated),
+        ]);
+        return super.serialize();
+    }
+    toLogEntry(applHost) {
+        return {
+            ...super.toLogEntry(applHost),
+            message: {
+                echo: this.echo,
+                "supported schemes": this.supportedKEXSchemes
+                    .map((s) => `\n· ${(0, safe_1.getEnumMemberName)(shared_1.KEXSchemes, s)}`)
+                    .join(""),
+                "supported ECDH profiles": this.supportedECDHProfiles
+                    .map((s) => `\n· ${(0, safe_1.getEnumMemberName)(shared_1.ECDHProfiles, s)}`)
+                    .join(""),
+                "CSA requested": this.requestCSA,
+                "requested security classes": this.requestedKeys
+                    .map((s) => `\n· ${(0, safe_1.getEnumMemberName)(core_1.SecurityClass, s)}`)
+                    .join(""),
+            },
+        };
+    }
+};
+Security2CCKEXReport = __decorate([
+    (0, CommandClass_1.CCCommand)(_Types_1.Security2Command.KEXReport)
+], Security2CCKEXReport);
+exports.Security2CCKEXReport = Security2CCKEXReport;
+let Security2CCKEXGet = class Security2CCKEXGet extends Security2CC {
+};
+Security2CCKEXGet = __decorate([
+    (0, CommandClass_1.CCCommand)(_Types_1.Security2Command.KEXGet),
+    (0, CommandClass_1.expectedCCResponse)(Security2CCKEXReport)
+], Security2CCKEXGet);
+exports.Security2CCKEXGet = Security2CCKEXGet;
+let Security2CCKEXSet = class Security2CCKEXSet extends Security2CC {
+    constructor(host, options) {
+        super(host, options);
+        if ((0, serial_1.gotDeserializationOptions)(options)) {
+            (0, core_1.validatePayload)(this.payload.length >= 4);
+            this.permitCSA = !!(this.payload[0] & 0b10);
+            this.echo = !!(this.payload[0] & 0b1);
+            // The bit mask starts at 0, but bit 0 is not used
+            const selectedKEXSchemes = (0, core_1.parseBitMask)(this.payload.slice(1, 2), 0).filter((s) => s !== 0);
+            (0, core_1.validatePayload)(selectedKEXSchemes.length === 1);
+            this.selectedKEXScheme = selectedKEXSchemes[0];
+            const selectedECDHProfiles = (0, core_1.parseBitMask)(this.payload.slice(2, 3), shared_1.ECDHProfiles.Curve25519);
+            (0, core_1.validatePayload)(selectedECDHProfiles.length === 1);
+            this.selectedECDHProfile = selectedECDHProfiles[0];
+            this.grantedKeys = (0, core_1.parseBitMask)(this.payload.slice(3, 4), core_1.SecurityClass.S2_Unauthenticated);
+        }
+        else {
+            this.permitCSA = options.permitCSA;
+            this.echo = options.echo;
+            this.selectedKEXScheme = options.selectedKEXScheme;
+            this.selectedECDHProfile = options.selectedECDHProfile;
+            this.grantedKeys = options.grantedKeys;
+        }
+    }
+    serialize() {
+        this.payload = Buffer.concat([
+            Buffer.from([(this.permitCSA ? 0b10 : 0) + (this.echo ? 0b1 : 0)]),
+            // The bit mask starts at 0, but bit 0 is not used
+            (0, core_1.encodeBitMask)([this.selectedKEXScheme], 7, 0),
+            (0, core_1.encodeBitMask)([this.selectedECDHProfile], 7, shared_1.ECDHProfiles.Curve25519),
+            (0, core_1.encodeBitMask)(this.grantedKeys, core_1.SecurityClass.S0_Legacy, core_1.SecurityClass.S2_Unauthenticated),
+        ]);
+        return super.serialize();
+    }
+    toLogEntry(applHost) {
+        return {
+            ...super.toLogEntry(applHost),
+            message: {
+                echo: this.echo,
+                "selected scheme": (0, safe_1.getEnumMemberName)(shared_1.KEXSchemes, this.selectedKEXScheme),
+                "selected ECDH profile": (0, safe_1.getEnumMemberName)(shared_1.ECDHProfiles, this.selectedECDHProfile),
+                "CSA permitted": this.permitCSA,
+                "granted security classes": this.grantedKeys
+                    .map((s) => `\n· ${(0, safe_1.getEnumMemberName)(core_1.SecurityClass, s)}`)
+                    .join(""),
+            },
+        };
+    }
+};
+Security2CCKEXSet = __decorate([
+    (0, CommandClass_1.CCCommand)(_Types_1.Security2Command.KEXSet)
+], Security2CCKEXSet);
+exports.Security2CCKEXSet = Security2CCKEXSet;
+let Security2CCKEXFail = class Security2CCKEXFail extends Security2CC {
+    constructor(host, options) {
+        super(host, options);
+        if ((0, serial_1.gotDeserializationOptions)(options)) {
+            (0, core_1.validatePayload)(this.payload.length >= 1);
+            this.failType = this.payload[0];
+        }
+        else {
+            this.failType = options.failType;
+        }
+    }
+    serialize() {
+        this.payload = Buffer.from([this.failType]);
+        return super.serialize();
+    }
+    toLogEntry(applHost) {
+        return {
+            ...super.toLogEntry(applHost),
+            message: { reason: (0, safe_1.getEnumMemberName)(shared_1.KEXFailType, this.failType) },
+        };
+    }
+};
+Security2CCKEXFail = __decorate([
+    (0, CommandClass_1.CCCommand)(_Types_1.Security2Command.KEXFail)
+], Security2CCKEXFail);
+exports.Security2CCKEXFail = Security2CCKEXFail;
+let Security2CCPublicKeyReport = class Security2CCPublicKeyReport extends Security2CC {
+    constructor(host, options) {
+        super(host, options);
+        if ((0, serial_1.gotDeserializationOptions)(options)) {
+            (0, core_1.validatePayload)(this.payload.length >= 17);
+            this.includingNode = !!(this.payload[0] & 0b1);
+            this.publicKey = this.payload.slice(1);
+        }
+        else {
+            this.includingNode = options.includingNode;
+            this.publicKey = options.publicKey;
+        }
+    }
+    serialize() {
+        this.payload = Buffer.concat([
+            Buffer.from([this.includingNode ? 1 : 0]),
+            this.publicKey,
+        ]);
+        return super.serialize();
+    }
+    toLogEntry(applHost) {
+        return {
+            ...super.toLogEntry(applHost),
+            message: {
+                "is including node": this.includingNode,
+                "public key": (0, safe_1.buffer2hex)(this.publicKey),
+            },
+        };
+    }
+};
+Security2CCPublicKeyReport = __decorate([
+    (0, CommandClass_1.CCCommand)(_Types_1.Security2Command.PublicKeyReport)
+], Security2CCPublicKeyReport);
+exports.Security2CCPublicKeyReport = Security2CCPublicKeyReport;
+let Security2CCNetworkKeyReport = class Security2CCNetworkKeyReport extends Security2CC {
+    constructor(host, options) {
+        super(host, options);
+        if ((0, serial_1.gotDeserializationOptions)(options)) {
+            // TODO: Deserialize payload
+            throw new core_1.ZWaveError(`${this.constructor.name}: deserialization not implemented`, core_1.ZWaveErrorCodes.Deserialization_NotImplemented);
+        }
+        else {
+            this.grantedKey = options.grantedKey;
+            this.networkKey = options.networkKey;
+        }
+    }
+    serialize() {
+        this.payload = Buffer.concat([
+            securityClassToBitMask(this.grantedKey),
+            this.networkKey,
+        ]);
+        return super.serialize();
+    }
+    toLogEntry(applHost) {
+        return {
+            ...super.toLogEntry(applHost),
+            message: {
+                "security class": (0, safe_1.getEnumMemberName)(core_1.SecurityClass, this.grantedKey),
+                // This shouldn't be logged, so users can safely post their logs online
+                // "network key": buffer2hex(this.networkKey),
+            },
+        };
+    }
+};
+Security2CCNetworkKeyReport = __decorate([
+    (0, CommandClass_1.CCCommand)(_Types_1.Security2Command.NetworkKeyReport)
+], Security2CCNetworkKeyReport);
+exports.Security2CCNetworkKeyReport = Security2CCNetworkKeyReport;
+let Security2CCNetworkKeyGet = class Security2CCNetworkKeyGet extends Security2CC {
+    constructor(host, options) {
+        super(host, options);
+        if ((0, serial_1.gotDeserializationOptions)(options)) {
+            (0, core_1.validatePayload)(this.payload.length >= 1);
+            this.requestedKey = bitMaskToSecurityClass(this.payload, 0);
+        }
+        else {
+            this.requestedKey = options.requestedKey;
+        }
+    }
+    serialize() {
+        this.payload = securityClassToBitMask(this.requestedKey);
+        return super.serialize();
+    }
+    toLogEntry(applHost) {
+        return {
+            ...super.toLogEntry(applHost),
+            message: {
+                "security class": (0, safe_1.getEnumMemberName)(core_1.SecurityClass, this.requestedKey),
+            },
+        };
+    }
+};
+Security2CCNetworkKeyGet = __decorate([
+    (0, CommandClass_1.CCCommand)(_Types_1.Security2Command.NetworkKeyGet),
+    (0, CommandClass_1.expectedCCResponse)(Security2CCNetworkKeyReport)
+], Security2CCNetworkKeyGet);
+exports.Security2CCNetworkKeyGet = Security2CCNetworkKeyGet;
+let Security2CCNetworkKeyVerify = class Security2CCNetworkKeyVerify extends Security2CC {
+};
+Security2CCNetworkKeyVerify = __decorate([
+    (0, CommandClass_1.CCCommand)(_Types_1.Security2Command.NetworkKeyVerify)
+], Security2CCNetworkKeyVerify);
+exports.Security2CCNetworkKeyVerify = Security2CCNetworkKeyVerify;
+let Security2CCTransferEnd = class Security2CCTransferEnd extends Security2CC {
+    constructor(host, options) {
+        super(host, options);
+        if ((0, serial_1.gotDeserializationOptions)(options)) {
+            (0, core_1.validatePayload)(this.payload.length >= 1);
+            this.keyVerified = !!(this.payload[0] & 0b10);
+            this.keyRequestComplete = !!(this.payload[0] & 0b1);
+        }
+        else {
+            this.keyVerified = options.keyVerified;
+            this.keyRequestComplete = options.keyRequestComplete;
+        }
+    }
+    serialize() {
+        this.payload = Buffer.from([
+            (this.keyVerified ? 0b10 : 0) + (this.keyRequestComplete ? 0b1 : 0),
+        ]);
+        return super.serialize();
+    }
+    toLogEntry(applHost) {
+        return {
+            ...super.toLogEntry(applHost),
+            message: {
+                "key verified": this.keyVerified,
+                "request complete": this.keyRequestComplete,
+            },
+        };
+    }
+};
+Security2CCTransferEnd = __decorate([
+    (0, CommandClass_1.CCCommand)(_Types_1.Security2Command.TransferEnd)
+], Security2CCTransferEnd);
+exports.Security2CCTransferEnd = Security2CCTransferEnd;
+let Security2CCCommandsSupportedReport = class Security2CCCommandsSupportedReport extends Security2CC {
+    constructor(host, options) {
+        super(host, options);
+        const CCs = (0, core_1.parseCCList)(this.payload);
+        // SDS13783: A sending node MAY terminate the list of supported command classes with the
+        // COMMAND_CLASS_MARK command class identifier.
+        // A receiving node MUST stop parsing the list of supported command classes if it detects the
+        // COMMAND_CLASS_MARK command class identifier in the Security 2 Commands Supported Report
+        this.supportedCCs = CCs.supportedCCs;
+    }
+    toLogEntry(applHost) {
+        return {
+            ...super.toLogEntry(applHost),
+            message: {
+                supportedCCs: this.supportedCCs
+                    .map((cc) => (0, core_1.getCCName)(cc))
+                    .map((cc) => `\n· ${cc}`)
+                    .join(""),
+            },
+        };
+    }
+};
+Security2CCCommandsSupportedReport = __decorate([
+    (0, CommandClass_1.CCCommand)(_Types_1.Security2Command.CommandsSupportedReport)
+], Security2CCCommandsSupportedReport);
+exports.Security2CCCommandsSupportedReport = Security2CCCommandsSupportedReport;
+let Security2CCCommandsSupportedGet = class Security2CCCommandsSupportedGet extends Security2CC {
+};
+Security2CCCommandsSupportedGet = __decorate([
+    (0, CommandClass_1.CCCommand)(_Types_1.Security2Command.CommandsSupportedGet),
+    (0, CommandClass_1.expectedCCResponse)(Security2CCCommandsSupportedReport)
+], Security2CCCommandsSupportedGet);
+exports.Security2CCCommandsSupportedGet = Security2CCCommandsSupportedGet;
+//# sourceMappingURL=Security2CC.js.map