esp-idf-provisioning-web 0.0.5 → 0.0.6

package/dist/security/Security0.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Security0.d.ts","sourceRoot":"","sources":["../../src/security/Security0.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAGtC;;GAEG;AACH,qBAAa,SAAU,SAAQ,QAAQ;IACrC,OAAO,CAAC,WAAW,CAAkB;IAE/B,OAAO,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IAI9C,OAAO,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IAI9C,sBAAsB,IAAI,OAAO,CAAC,UAAU,CAAC;IAU7C,2BAA2B,CAAC,QAAQ,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAStE,aAAa,IAAI,OAAO;CAGzB"}
+{"version":3,"file":"Security0.d.ts","sourceRoot":"","sources":["../../src/security/Security0.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAGtC;;GAEG;AACH,qBAAa,SAAU,SAAQ,QAAQ;IACrC,OAAO,CAAC,WAAW,CAAkB;IAE/B,OAAO,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IAI9C,OAAO,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IAI9C,sBAAsB,IAAI,OAAO,CAAC,UAAU,CAAC;IAU7C,2BAA2B,CAAC,QAAQ,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAWtE,aAAa,IAAI,OAAO;CAGzB"}

package/dist/security/Security1.d.ts

@@ -0,0 +1,17 @@
+import { Security } from './Security';
+/** ESP-IDF Security 1: X25519, optional PoP, and one continuous AES-CTR stream. */
+export declare class Security1 extends Security {
+    private proofOfPossession;
+    private phase;
+    private keyPair?;
+    private publicKey?;
+    private devicePublicKey?;
+    private cipher?;
+    constructor(proofOfPossession: string, patchVersion?: number);
+    getSessionSetupRequest(): Promise<Uint8Array>;
+    processSessionSetupResponse(response: Uint8Array): Promise<void>;
+    encrypt(data: Uint8Array): Promise<Uint8Array>;
+    decrypt(data: Uint8Array): Promise<Uint8Array>;
+    isEstablished(): boolean;
+}
+//# sourceMappingURL=Security1.d.ts.map

package/dist/security/Security1.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Security1.d.ts","sourceRoot":"","sources":["../../src/security/Security1.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAItC,mFAAmF;AACnF,qBAAa,SAAU,SAAQ,QAAQ;IAOzB,OAAO,CAAC,iBAAiB;IANrC,OAAO,CAAC,KAAK,CAAmF;IAChG,OAAO,CAAC,OAAO,CAAC,CAAgB;IAChC,OAAO,CAAC,SAAS,CAAC,CAAa;IAC/B,OAAO,CAAC,eAAe,CAAC,CAAa;IACrC,OAAO,CAAC,MAAM,CAAC,CAAe;gBAEV,iBAAiB,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM;IAU9D,sBAAsB,IAAI,OAAO,CAAC,UAAU,CAAC;IAwB7C,2BAA2B,CAAC,QAAQ,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAmDhE,OAAO,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IAK9C,OAAO,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IAIpD,aAAa,IAAI,OAAO;CAGzB"}

package/dist/types.d.ts

@@ -1,3 +1,17 @@
+/** Public proto-ver metadata, including application-defined capability lists. */
+export interface ESPProvisioningMetadata {
+    ver?: string;
+    cap?: string[];
+}
+export interface ESPProvisioningInfo {
+    prov: ESPProvisioningMetadata & {
+        sec_ver?: number;
+        sec_patch_ver?: number;
+    };
+    [name: string]: ESPProvisioningMetadata;
+}
+/** Resolve the security configuration after reading public discovery data. */
+export type ESPSecurityResolver = (info: ESPProvisioningInfo) => ESPSecurityConfig | undefined | Promise<ESPSecurityConfig | undefined>;
 export type ESPSecurityConfig = ESPSecurity1Config | ESPSecurity2Config;
 export interface ESPSecurity1Config {
     type: 'Security1';
@@ -63,7 +77,7 @@ export interface ESPScanStatusResponse {
  * Device interface for ESP provisioning
  */
 export interface ESPDeviceInterface {
-    connect(security?: ESPSecurityConfig): Promise<void>;
+    connect(security?: ESPSecurityConfig | ESPSecurityResolver): Promise<void>;
     scanWifiList(): Promise<ESPWifiAp[]>;
     provision(ssid: string, passphrase: string): Promise<void>;
     fetchWifiStatus(): Promise<ESPWifiStatus>;

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,iBAAiB,GAAG,kBAAkB,GAAG,kBAAkB,CAAC;AAExE,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,WAAW,CAAC;IAClB,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,WAAW,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,oBAAY,eAAe;IACzB,IAAI,IAAI;IACR,GAAG,IAAI;IACP,cAAc,IAAI;IAClB,OAAO,IAAI;IACX,MAAM,IAAI;IACV,UAAU,IAAI;IACd,OAAO,IAAI;IACX,WAAW,IAAI;CAChB;AAED;;GAEG;AACH,oBAAY,eAAe;IACzB,SAAS,IAAI;IACb,UAAU,IAAI;IACd,YAAY,IAAI;IAChB,MAAM,IAAI;CACX;AAED;;GAEG;AACH,oBAAY,oBAAoB;IAC9B,SAAS,IAAI;IACb,eAAe,IAAI;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,eAAe,CAAC;IAC1B,YAAY,CAAC,EAAE,oBAAoB,CAAC;IACpC,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,eAAe,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,QAAQ,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAErD,YAAY,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAErC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE3D,eAAe,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC;IAE1C,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAE9D,UAAU,IAAI,IAAI,CAAC;IAEnB,SAAS,IAAI,eAAe,GAAG,GAAG,CAAC;CACpC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,MAAM,WAAW,uBAAuB;IACtC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,uBAAuB,GAAG;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7E,CAAC,IAAI,EAAE,MAAM,GAAG,uBAAuB,CAAC;CACzC;AAED,8EAA8E;AAC9E,MAAM,MAAM,mBAAmB,GAAG,CAChC,IAAI,EAAE,mBAAmB,KACtB,iBAAiB,GAAG,SAAS,GAAG,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC,CAAC;AAE5E,MAAM,MAAM,iBAAiB,GAAG,kBAAkB,GAAG,kBAAkB,CAAC;AAExE,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,WAAW,CAAC;IAClB,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,WAAW,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,oBAAY,eAAe;IACzB,IAAI,IAAI;IACR,GAAG,IAAI;IACP,cAAc,IAAI;IAClB,OAAO,IAAI;IACX,MAAM,IAAI;IACV,UAAU,IAAI;IACd,OAAO,IAAI;IACX,WAAW,IAAI;CAChB;AAED;;GAEG;AACH,oBAAY,eAAe;IACzB,SAAS,IAAI;IACb,UAAU,IAAI;IACd,YAAY,IAAI;IAChB,MAAM,IAAI;CACX;AAED;;GAEG;AACH,oBAAY,oBAAoB;IAC9B,SAAS,IAAI;IACb,eAAe,IAAI;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,eAAe,CAAC;IAC1B,YAAY,CAAC,EAAE,oBAAoB,CAAC;IACpC,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,eAAe,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,QAAQ,CAAC,EAAE,iBAAiB,GAAG,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE3E,YAAY,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAErC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE3D,eAAe,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC;IAE1C,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAE9D,UAAU,IAAI,IAAI,CAAC;IAEnB,SAAS,IAAI,eAAe,GAAG,GAAG,CAAC;CACpC"}

package/dist/utils/crypto.d.ts

@@ -41,4 +41,13 @@ export declare function aesDecrypt(key: Uint8Array, counter: Uint8Array, data: U
  * Concatenate multiple Uint8Arrays
  */
 export declare function concatBytes(...arrays: Uint8Array[]): Uint8Array;
+/** Stateful AES-CTR, preserving partial blocks across requests and responses. */
+export declare class AESCTRStream {
+    private key;
+    private counter;
+    private offset;
+    private constructor();
+    static create(key: Uint8Array, counter: Uint8Array): Promise<AESCTRStream>;
+    update(data: Uint8Array): Promise<Uint8Array>;
+}
 //# sourceMappingURL=crypto.d.ts.map

package/dist/utils/crypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/utils/crypto.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAI9D;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAMlD;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAIpD;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAErD;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAEvD;AAED;;GAEG;AACH,wBAAsB,MAAM,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAGlE;AAED;;GAEG;AACH,wBAAsB,UAAU,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAUvF;AAED;;GAEG;AACH,wBAAsB,UAAU,CAC9B,GAAG,EAAE,UAAU,EACf,OAAO,EAAE,UAAU,EACnB,IAAI,EAAE,UAAU,GACf,OAAO,CAAC,UAAU,CAAC,CAcrB;AAED;;GAEG;AACH,wBAAsB,UAAU,CAC9B,GAAG,EAAE,UAAU,EACf,OAAO,EAAE,UAAU,EACnB,IAAI,EAAE,UAAU,GACf,OAAO,CAAC,UAAU,CAAC,CAcrB;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,GAAG,MAAM,EAAE,UAAU,EAAE,GAAG,UAAU,CAS/D"}
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/utils/crypto.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAI9D;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAMlD;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAIpD;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAErD;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAEvD;AAED;;GAEG;AACH,wBAAsB,MAAM,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAGlE;AAED;;GAEG;AACH,wBAAsB,UAAU,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAUvF;AAED;;GAEG;AACH,wBAAsB,UAAU,CAC9B,GAAG,EAAE,UAAU,EACf,OAAO,EAAE,UAAU,EACnB,IAAI,EAAE,UAAU,GACf,OAAO,CAAC,UAAU,CAAC,CAcrB;AAED;;GAEG;AACH,wBAAsB,UAAU,CAC9B,GAAG,EAAE,UAAU,EACf,OAAO,EAAE,UAAU,EACnB,IAAI,EAAE,UAAU,GACf,OAAO,CAAC,UAAU,CAAC,CAcrB;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,GAAG,MAAM,EAAE,UAAU,EAAE,GAAG,UAAU,CAS/D;AAED,iFAAiF;AACjF,qBAAa,YAAY;IAGH,OAAO,CAAC,GAAG;IAAa,OAAO,CAAC,OAAO;IAF3D,OAAO,CAAC,MAAM,CAAK;IAEnB,OAAO;WAEM,MAAM,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC;IAQ1E,MAAM,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;CAkBpD"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "esp-idf-provisioning-web",
-  "version": "0.0.5",
+  "version": "0.0.6",
   "description": "ESP-IDF WiFi Provisioning SDK for web browsers",
   "main": "dist/index.cjs.js",
   "module": "dist/index.es.js",
@@ -12,6 +12,17 @@
       "require": "./dist/index.cjs.js"
     }
   },
+  "scripts": {
+    "prebuild": "pbjs -t static-module -w es6 -o src/generated/proto.js src/proto/*.proto && pbts -o src/generated/proto.d.ts src/generated/proto.js",
+    "build": "vite build && tsc --emitDeclarationOnly",
+    "dev": "vite build --watch",
+    "example": "npx http-server -p 8080 -o /examples/ble-provisioning.html",
+    "serve": "npx http-server -p 8080",
+    "test": "jest",
+    "lint": "eslint src --ext .ts",
+    "format": "prettier --write \"src/**/*.ts\"",
+    "prepack": "npm run build"
+  },
   "keywords": [
     "esp32",
     "esp-idf",
@@ -26,20 +37,21 @@
   "author": "",
   "license": "MIT",
   "dependencies": {
-    "protobufjs": "^7.0.0"
+    "@types/web-bluetooth": "0.0.22",
+    "protobufjs": "^7.6.6"
   },
   "devDependencies": {
-    "@types/jest": "^29.5.0",
-    "@types/web-bluetooth": "0.0.21",
-    "@typescript-eslint/eslint-plugin": "8.46.2",
-    "@typescript-eslint/parser": "8.46.2",
-    "eslint": "9.38.0",
-    "jest": "30.2.0",
-    "prettier": "^3.0.0",
-    "protobufjs-cli": "^1.0.0",
-    "ts-jest": "^29.0.0",
-    "typescript": "^5.0.0",
-    "vite": "7.1.11"
+    "@eslint/js": "10.0.1",
+    "@types/jest": "^30.0.0",
+    "@typescript-eslint/eslint-plugin": "8.72.0",
+    "@typescript-eslint/parser": "8.72.0",
+    "eslint": "10.13.0",
+    "jest": "30.5.2",
+    "prettier": "^3.9.10",
+    "protobufjs-cli": "^1.3.3",
+    "ts-jest": "^29.4.15",
+    "typescript": "^5.9.3",
+    "vite": "7.3.7"
   },
   "files": [
     "dist",
@@ -53,15 +65,5 @@
   },
   "bugs": {
     "url": "https://github.com/ho-229/esp-idf-provisioning-web/issues"
-  },
-  "scripts": {
-    "prebuild": "pbjs -t static-module -w es6 -o src/generated/proto.js src/proto/*.proto && pbts -o src/generated/proto.d.ts src/generated/proto.js",
-    "build": "vite build && tsc --emitDeclarationOnly",
-    "dev": "vite build --watch",
-    "example": "npx http-server -p 8080 -o /examples/ble-provisioning.html",
-    "serve": "npx http-server -p 8080",
-    "test": "jest",
-    "lint": "eslint src --ext .ts",
-    "format": "prettier --write \"src/**/*.ts\""
   }
-}
+}

package/src/ESPDevice.ts

@@ -3,12 +3,16 @@ import {
   ESPWifiAp,
   ESPWifiStatus,
   ESPSecurityConfig,
+  ESPSecurityResolver,
+  ESPProvisioningInfo,
 } from './types';
 import { Transport } from './transport/Transport';
 import { BLETransport } from './transport/BLETransport';
 import { SoftAPTransport } from './transport/SoftAPTransport';
 import { Security } from './security/Security';
 import { Security0 } from './security/Security0';
+import { Security1 } from './security/Security1';
+import { bytesToString, stringToBytes } from './utils/crypto';
 import { FALLBACK_NU_LOOKUP, FALLBACK_SERVICE_UUID, PROTO_ENDPOINTS } from './constants';
 import {
   getScanResultRequest,
@@ -34,6 +38,7 @@ export class ESPDevice implements ESPDeviceInterface {
   private device: BluetoothDevice | URL;
   private transportImpl?: Transport;
   private securityImpl?: Security;
+  private requestQueue: Promise<void> = Promise.resolve();
 
   /**
    * Create a new ESPDevice instance
@@ -43,22 +48,47 @@ export class ESPDevice implements ESPDeviceInterface {
     this.device = device;
   }
 
-  /**
-   * Connect to the device
-   * @param proofOfPossession - Proof of possession for secure modes
-   * @param softAPPassword - Password for SoftAP mode (not used in browser)
-   * @param username - Username for authentication
-   */
-  async connect(security?: ESPSecurityConfig): Promise<void> {
-    // Initialize transport
-    await this.initializeTransport();
-
-    // Initialize security
-    this.initializeSecurity(security);
-
-    // Establish secure session if needed
-    if (security) {
-      await this.establishSession();
+  /** Connect, read public metadata, resolve credentials, then complete the handshake. */
+  async connect(security?: ESPSecurityConfig | ESPSecurityResolver): Promise<void> {
+    if (this.transportImpl) throw new Error('Device already connected or connecting');
+    const transport = this.device instanceof URL
+      ? new SoftAPTransport(this.device.toString())
+      : new BLETransport(this.device, FALLBACK_SERVICE_UUID, new Map(Object.entries(FALLBACK_NU_LOOKUP)));
+    this.transportImpl = transport;
+    try {
+      await transport.connect();
+      const response = await transport.sendData(PROTO_ENDPOINTS.PROTO_VER, stringToBytes('ESP'));
+      const info: ESPProvisioningInfo = JSON.parse(bytesToString(response));
+      if (!info || !info.prov || typeof info.prov !== 'object' || Array.isArray(info.prov)) {
+        throw new Error('Invalid proto-ver metadata');
+      }
+      if (this.transportImpl !== transport || !transport.isConnected()) {
+        throw new Error('Device disconnected during discovery');
+      }
+      const config = typeof security === 'function' ? await security(info) : security;
+      if (this.transportImpl !== transport || !transport.isConnected()) {
+        throw new Error('Device disconnected while resolving security');
+      }
+      const version = config?.type === 'Security1' ? 1 : config?.type === 'Security2' ? 2 : 0;
+      if (info.prov.sec_ver !== undefined && info.prov.sec_ver !== version) {
+        throw new Error(`Device requires Security${info.prov.sec_ver}; provide a matching security configuration`);
+      }
+      let session: Security;
+      if (!config) {
+        session = new Security0();
+      } else if (config.type === 'Security1') {
+        session = new Security1(config.proofOfPossession, info.prov.sec_patch_ver);
+      } else {
+        throw new Error('Unsupported security configuration');
+      }
+      await this.establishSession(transport, session);
+      if (this.transportImpl !== transport || !transport.isConnected()) {
+        throw new Error('Device disconnected during handshake');
+      }
+      this.securityImpl = session;
+    } catch (error) {
+      if (this.transportImpl === transport) this.disconnect();
+      throw error;
     }
   }
 
@@ -148,19 +178,30 @@ export class ESPDevice implements ESPDeviceInterface {
    * @returns Response data from device
    */
   async sendData(path: string, data: Uint8Array): Promise<Uint8Array> {
-    if (!this.transportImpl || !this.securityImpl) {
-      throw new Error('Device not connected');
-    }
-
-    // Encrypt data if security is established
-    const encryptedData = await this.securityImpl.encrypt(data);
-    console.debug('Send encrypted data length:', encryptedData.length);
-
-    // Send encrypted data
-    const encryptedResponse = await this.transportImpl.sendData(path, encryptedData);
-
-    // Decrypt response
-    return await this.securityImpl.decrypt(encryptedResponse);
+    const transport = this.transportImpl;
+    const security = this.securityImpl;
+    if (!transport || !security?.isEstablished()) throw new Error('Device not connected');
+    if (path === PROTO_ENDPOINTS.PROV_SESSION) throw new Error('Session endpoint is managed by connect()');
+
+    // Security1 shares one CTR stream in both directions. Serialize the entire
+    // request/response pair, including custom endpoints.
+    const request = this.requestQueue.then(async () => {
+      if (this.transportImpl !== transport || this.securityImpl !== security || !transport.isConnected()) {
+        throw new Error('Device disconnected');
+      }
+      try {
+        if (path === PROTO_ENDPOINTS.PROTO_VER) return await transport.sendData(path, data);
+        const encrypted = await security.encrypt(data);
+        const response = await transport.sendData(path, encrypted);
+        return await security.decrypt(response);
+      } catch (error) {
+        // A lost response leaves the shared cipher position unknown.
+        if (this.transportImpl === transport) this.disconnect();
+        throw error;
+      }
+    });
+    this.requestQueue = request.then(() => {}, () => {});
+    return request;
   }
 
   /**
@@ -172,6 +213,7 @@ export class ESPDevice implements ESPDeviceInterface {
       this.transportImpl = undefined;
     }
     this.securityImpl = undefined;
+    this.requestQueue = Promise.resolve();
   }
 
   /**
@@ -181,51 +223,14 @@ export class ESPDevice implements ESPDeviceInterface {
     return this.device;
   }
 
-  /**
-   * Initialize security layer based on security type
-   */
-  private initializeSecurity(security?: ESPSecurityConfig): void {
-    if (!security) {
-      this.securityImpl = new Security0();
-    } else {
-      throw new Error('Unsupported security configuration');
-    }
-  }
-
-  /**
-   * Establish secure session with device
-   */
-  private async establishSession(): Promise<void> {
-    if (!this.transportImpl || !this.securityImpl) {
-      throw new Error('Transport or security not initialized');
-    }
-
-    // Get session setup request
-    const setupRequest = await this.securityImpl.getSessionSetupRequest();
-
-    // Send session setup request
-    const setupResponse = await this.transportImpl.sendData(
-      PROTO_ENDPOINTS.PROV_SESSION,
-      setupRequest
-    );
-
-    // Process session setup response
-    await this.securityImpl.processSessionSetupResponse(setupResponse);
-  }
-
-  /**
-   * Initialize transport layer based on transport type
-   */
-  private async initializeTransport(): Promise<void> {
-    if (this.device instanceof URL) {
-      this.transportImpl = new SoftAPTransport(this.device.toString());
-    } else {  // BluetoothDevice
-      this.transportImpl = new BLETransport(
-        this.device,
-        FALLBACK_SERVICE_UUID,
-        new Map(Object.entries(FALLBACK_NU_LOOKUP))
-      );
+  private async establishSession(transport: Transport, security: Security): Promise<void> {
+    while (!security.isEstablished()) {
+      if (this.transportImpl !== transport || !transport.isConnected()) {
+        throw new Error('Device disconnected during handshake');
+      }
+      const request = await security.getSessionSetupRequest();
+      const response = await transport.sendData(PROTO_ENDPOINTS.PROV_SESSION, request);
+      await security.processSessionSetupResponse(response);
     }
-    await this.transportImpl.connect();
   }
 }