@mega-yfue/eufy-sdk 0.5.0-beta.87 → 0.5.0-beta.89

package/dist/index.js

@@ -2160,6 +2160,32 @@ ${this.auth_?.authToken ?? ""}`;
     const shard = this.region.split("-")[0];
     return shard === "us" ? "security-app.eufylife.com" : `security-app-${shard}.eufylife.com`;
   }
+  /**
+   * The device's long-lived P-256 public key, as the cloud publishes it for key-wrapped commands
+   * (`type=2`): 64 bytes hex with no `04` prefix. A plain authed GET on the security-app host — the
+   * one read here that is neither signed nor body-encrypted, matching how the app fetches it.
+   * Cached per serial for the client's lifetime; the key does not rotate in normal operation.
+   */
+  async getDevicePublicKey(deviceSn) {
+    const cached2 = this.devicePublicKeys.get(deviceSn);
+    if (cached2)
+      return cached2;
+    const url = `https://${this.securityAppHost()}/v1/app/public_key/query?device_sn=${encodeURIComponent(deviceSn)}&type=2`;
+    const res = await fetch(url, {
+      method: "GET",
+      headers: { ...this.baseHeaders(), ...this.authTokenHeaders() },
+      signal: AbortSignal.timeout(2e4)
+    });
+    const env = parseMaybeJson(await res.text());
+    const key = env?.data?.public_key;
+    if (res.status !== 200 || env?.code !== 0 || typeof key !== "string" || !key.length) {
+      throw new MegaApiError(`public_key/query failed (${res.status}/${env?.code}): ${env?.msg ?? "no public key"}`, env?.code, res.status);
+    }
+    this.devicePublicKeys.set(deviceSn, key);
+    return key;
+  }
+  /** Per-serial cache for {@link getDevicePublicKey}. */
+  devicePublicKeys = /* @__PURE__ */ new Map();
   /**
    * Signed+encrypted POST to the security-app data host (face recognition, etc.).
    * Despite the different host, these endpoints use the SAME algo_ecdh pipeline as
@@ -3661,6 +3687,7 @@ var isDoorbellT8223 = (ctx) => ctx.model === "T8223";
 var isAiotVacuum = (ctx) => ctx.category !== "eufy_home_tuya";
 var isTuyaVacuum = (ctx) => ctx.category === "eufy_home_tuya";
 var isVideoSmartLock = (ctx) => ctx.deviceType === DeviceType.LOCK_8530;
+var isClassicWifiLock = (ctx) => ctx.deviceType === DeviceType.LOCK_WIFI && typeof ctx.serial === "string" && ctx.serial.startsWith("T8520") && ctx.serial.charAt(6) === "2";
 
 // dist/model/capabilities/rtsp.js
 var RTSP_PARAM = {
@@ -4712,6 +4739,10 @@ function cellGated(members) {
   });
   return Object.fromEntries(gated);
 }
+function isChargingState(v) {
+  const n = Number(v);
+  return n !== 0 && n !== 2;
+}
 var BATTERY_MEMBERS = cellGated({
   /**
    * The headline percentage, and this capability's detection evidence: reporting 1101 is what proves a
@@ -4737,10 +4768,7 @@ var BATTERY_MEMBERS = cellGated({
     type: "bool",
     kind: "boolean",
     provenance: "apk",
-    coerce: (v) => {
-      const n = Number(v);
-      return n !== 0 && n !== 2;
-    },
+    coerce: isChargingState,
     description: "Charging in progress \u2014 derived from BATTERY_STATUS (2111) as `value \u2209 {0,2}`, matching the app's own decode. 0/2 = not charging; a solar/USB charge (incl. a built-in solar panel, which reads 4) is non-zero."
   },
   /**
@@ -7534,7 +7562,7 @@ function actuate(engage, ctx, sink) {
     });
   }
   return sink.dispatch({
-    kind: "ff09-actuate",
+    kind: isClassicWifiLock(ctx) ? "keyed-payload-actuate" : "ff09-actuate",
     engage,
     adminUserId: ctx.adminUserId,
     username: ctx.accountName ?? "",
@@ -7579,6 +7607,8 @@ function nativeReport(signal) {
   const report = signal.json.payload;
   return report?.code === 0 ? report : void 0;
 }
+var speaksFf09Settings = (ctx) => !isClassicWifiLock(ctx);
+var rainModeAvailable = (ctx) => overP2p(ctx) && speaksFf09Settings(ctx);
 var LOCK_MEMBERS = {
   /**
    * The lock's own state, verified on param 6000: "4" = locked, "3" = unlocked.
@@ -7609,8 +7639,8 @@ var LOCK_MEMBERS = {
     description: "Lock battery level 0-100 (verified: param 1101, alias 6001)."
   },
   /**
-   * Link quality in dBm as the lock measures it, on the shared param 1141. Both actuation methods here
-   * are fire-and-forget, so a weak link is silent rather than an error.
+   * Link quality in dBm as the lock measures it, on the shared param 1141. On the `ff09` wire the
+   * actuations are fire-and-forget, so a weak link is silent rather than an error.
    */
   rssi: {
     param: 1141,
@@ -7620,9 +7650,15 @@ var LOCK_MEMBERS = {
     provenance: "verified",
     description: "Lock signal strength (verified: param 1141 = RSSI)."
   },
-  /** Lock the deadbolt/door. Resolves after sending; does not confirm physical state. */
+  /**
+   * Lock the deadbolt/door. Resolves after sending, without confirming physical state — except on the
+   * classic Wi-Fi lock, which answers: there it rejects on a device refusal or no reply as well.
+   */
   lock: method(({ ctx, sink }) => () => actuate(true, ctx, sink), "Lock the deadbolt/door.", actuationAvailable),
-  /** Unlock the deadbolt/door. Resolves after sending; does not confirm physical state. */
+  /**
+   * Unlock the deadbolt/door. Resolves after sending, without confirming physical state — except on the
+   * classic Wi-Fi lock, which answers: there it rejects on a device refusal or no reply as well.
+   */
   unlock: method(({ ctx, sink }) => () => actuate(false, ctx, sink), "Unlock the deadbolt/door.", actuationAvailable),
   /**
    * Read-modify-write the auto-lock setting: the transport GETs the device's current settings, changes
@@ -7644,13 +7680,13 @@ var LOCK_MEMBERS = {
       enabled,
       delaySeconds
     });
-  }, "Read-modify-write the auto-lock setting, preserving the fields it does not change.", (ctx) => !isVideoSmartLock(ctx)),
+  }, "Read-modify-write the auto-lock setting, preserving the fields it does not change.", (ctx) => !isVideoSmartLock(ctx) && speaksFf09Settings(ctx)),
   /**
    * Toggle Rain Mode — a pure blind write, unlike `setAutoLock`: the compact frame carries only this one
    * field, so there is no GET pass and it is fire-and-forget. Confirmed on-device end-to-end in both
    * directions, with the app UI reflecting the new state afterward. P2P video lock only.
    */
-  setRainMode: method(({ ctx, sink }) => (enabled) => settingToggle(LOCK_SETTING_ID.RAIN_MODE, "setRainMode", enabled, ctx, sink), "Toggle Rain Mode.", overP2p),
+  setRainMode: method(({ ctx, sink }) => (enabled) => settingToggle(LOCK_SETTING_ID.RAIN_MODE, "setRainMode", enabled, ctx, sink), "Toggle Rain Mode.", rainModeAvailable),
   /**
    * Lock the door by a single touch on the pad, with no code. First of the six compact toggles: all
    * `unverified` (frame shape read out of the app's JS, never captured), so no setter is installed and
@@ -7809,36 +7845,34 @@ var LOCK = {
 // dist/model/capabilities/keypad.js
 var KEYPAD_MEMBERS = {
   /**
-   * `unexposed`, so it reaches a diagnosis through `getProperty` but gets no typed getter. 1103 is a
-   * placeholder AND a likely collision — the app's own param table names 1103 GET_CAMERA_INFO — so a
-   * getter here would be asserting a meaning nothing backs. The keypad's real battery state arrives
-   * under `keypadBatteryCapState`, whose low/charging semantics are not confirmed.
+   * `APP_CMD_KEYPAD_BATTERY_CAP_STATE` (1653). The app's sensor parser maps it to `sensor_is_low_power`,
+   * the field `APP_CMD_ENTRY_SENSOR_BAT_STATE` and `APP_CMD_MOTION_SENSOR_BAT_STATE` decode as a boolean,
+   * yet gives 1653 itself no decode case. `unexposed` until a device confirms which value means low; in
+   * the schema for `getProperty`, absent from the typed surface.
    */
   batteryLow: {
-    param: 1103,
+    param: 1653,
     type: "bool",
     kind: "boolean",
-    provenance: "guessed",
+    provenance: "apk",
     unexposed: true,
-    description: "Keypad low-battery flag. UNVERIFIED: placeholder id pending verification \u2014 and the app's own param table names 1103 GET_CAMERA_INFO, so the id is very likely wrong here."
+    description: "Keypad low-battery flag (APP_CMD_KEYPAD_BATTERY_CAP_STATE, 1653). UNVERIFIED polarity: the app names it its low-battery field but does not decode its value."
   },
   /**
-   * The charging half of the battery pair, `unexposed` for the same reason as `batteryLow`: 1102 is a
-   * placeholder id, and the state the keypad actually reports (`keypadBatteryChargerState`) has no
-   * confirmed value space. In the schema for `getProperty`, absent from the typed surface.
+   * `APP_CMD_KEYPAD_BATTERY_CHARGER_STATE` (1655), decoded the way the app's sensor parser decodes it:
+   * `charging = value ∉ {0,2}` ({@link isChargingState}).
    */
   charging: {
-    param: 1102,
+    param: 1655,
     type: "bool",
     kind: "boolean",
-    provenance: "guessed",
-    unexposed: true,
-    description: "Keypad charging flag. UNVERIFIED: placeholder id pending verification."
+    provenance: "apk",
+    coerce: isChargingState,
+    description: "Keypad charging \u2014 derived from APP_CMD_KEYPAD_BATTERY_CHARGER_STATE (1655) as `value \u2209 {0,2}`, matching the app's own decode."
   },
   /**
-   * The keypad's link quality in dBm — the one verified read in this table, on the same param 1141 the
-   * other sub-1G sensors report signal strength on. Reported as the device measures it: raw dBm, never
-   * normalised to a bar count.
+   * The keypad's link quality in dBm, on the same param 1141 the other sub-1G sensors report signal
+   * strength on. Reported as the device measures it: raw dBm, never normalised to a bar count.
    */
   rssi: {
     param: 1141,
@@ -15141,13 +15175,8 @@ function abortable(work, signal) {
   ]);
 }
 
-// dist/transport/p2p/command-router.js
-import { setTimeout as sleep2 } from "node:timers/promises";
-
-// dist/transport/p2p/p2p-session.js
-import { EventEmitter as EventEmitter2 } from "node:events";
-import dgram from "node:dgram";
-import { constants as constants2, createCipheriv as createCipheriv3, createDecipheriv as createDecipheriv4, generateKeyPairSync, privateDecrypt as privateDecrypt2, randomBytes as randomBytes2 } from "node:crypto";
+// dist/transport/p2p/keyed-payload.js
+import { createCipheriv as createCipheriv3, randomBytes as randomBytes3 } from "node:crypto";
 
 // dist/transport/p2p/codec.js
 var codec_exports = {};
@@ -15174,6 +15203,7 @@ __export(codec_exports, {
   deriveLevel2KeyFromGatewayInfo: () => deriveLevel2KeyFromGatewayInfo,
   deriveLevel2KeyFromRsaGatewayInfo: () => deriveLevel2KeyFromRsaGatewayInfo,
   eciesUnwrap: () => eciesUnwrap,
+  eciesWrap: () => eciesWrap,
   encryptP2PData: () => encryptP2PData,
   frameMessage: () => frameMessage,
   gatewayInfoCipherId: () => gatewayInfoCipherId,
@@ -15186,7 +15216,7 @@ __export(codec_exports, {
   readNullTerminatedString: () => readNullTerminatedString,
   stringWithLength: () => stringWithLength
 });
-import { constants, createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv3, createECDH as createECDH2, createHmac as createHmac2, createPrivateKey, privateDecrypt, timingSafeEqual } from "node:crypto";
+import { constants, createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv3, createECDH as createECDH2, createHmac as createHmac2, createPrivateKey, privateDecrypt, randomBytes as randomBytes2, timingSafeEqual } from "node:crypto";
 var MAGIC_WORD = "XZYH";
 var RequestMessageType = {
   LOCAL_LOOKUP: Buffer.from([241, 48]),
@@ -15323,6 +15353,19 @@ function eciesUnwrap(envelope, eccPrivateKeyHex, options = {}) {
     return void 0;
   }
 }
+function eciesWrap(plaintext, peerPublicKey, options = {}) {
+  const ecdh = createECDH2("prime256v1");
+  if (options.ephemeralPrivateKey)
+    ecdh.setPrivateKey(options.ephemeralPrivateKey);
+  else
+    ecdh.generateKeys();
+  const kdf = eufyKdf(ecdh.computeSecret(peerPublicKey), 48);
+  const iv = options.iv ?? randomBytes2(16);
+  const cipher = createCipheriv2("aes-128-cbc", kdf.subarray(0, 16), iv);
+  const ct = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+  const tag2 = createHmac2("sha256", kdf.subarray(16, 48)).update(iv).update(ct).digest();
+  return Buffer.concat([ecdh.getPublicKey(null, "compressed"), iv, ct, tag2]);
+}
 function deriveLevel2KeyFromGatewayInfo(gwPayload, eccPrivateKeyHex) {
   const plain = eciesUnwrap(gwPayload.subarray(4, 4 + 129), eccPrivateKeyHex);
   if (!plain)
@@ -16042,6 +16085,65 @@ function commandName(id) {
   return COMMAND_NAMES[id] ?? `CMD_${id}`;
 }
 
+// dist/transport/p2p/keyed-payload.js
+var KEYED_PAYLOAD_SEQ_ERROR = -151;
+function serialIv(deviceSn) {
+  const iv = Buffer.alloc(16);
+  Buffer.from(deviceSn, "utf8").copy(iv, 0, 0, 16);
+  return iv;
+}
+function spellAesKey(key) {
+  return key.toString("hex").toUpperCase();
+}
+function buildKeyBlob(aesKeyHex, devicePublicKeyHex, rnd = {}) {
+  const devicePublicKey = Buffer.concat([Buffer.from([4]), Buffer.from(devicePublicKeyHex, "hex")]);
+  return eciesWrap(Buffer.from(aesKeyHex, "utf8"), devicePublicKey, {
+    ephemeralPrivateKey: rnd.ephemeralPrivateKey,
+    iv: rnd.nonce
+  }).toString("hex");
+}
+function sealInnerPayload(innerJson, aesKeyHex, deviceSn) {
+  const cipher = createCipheriv3("aes-128-cbc", Buffer.from(aesKeyHex, "hex"), serialIv(deviceSn));
+  return Buffer.concat([cipher.update(Buffer.from(innerJson, "utf8")), cipher.final()]).toString("base64");
+}
+function buildKeyedActuatePayload(id, devicePublicKeyHex, userName, rnd) {
+  const aesKeyHex = spellAesKey(rnd.aesKey ?? randomBytes3(16));
+  const inner = JSON.stringify({
+    shortUserId: id.shortUserId,
+    slOperation: id.engage ? 1 : 0,
+    userId: id.adminUserId,
+    userName,
+    seq_num: rnd.seqNum
+  });
+  return {
+    key: buildKeyBlob(aesKeyHex, devicePublicKeyHex, rnd),
+    payload: sealInnerPayload(inner, aesKeyHex, id.deviceSn)
+  };
+}
+function keyedPayloadReportCode(json, engage) {
+  if (json?.cmd !== CommandType.P2P_QUERY_STATUS_IN_LOCK)
+    return void 0;
+  const payload = json.payload;
+  const slState = engage ? "4" : "3";
+  if (payload?.slState !== slState)
+    return void 0;
+  return typeof payload?.code === "number" ? payload.code : void 0;
+}
+function keyedPayloadSeqMark(json) {
+  if (json?.cmd !== CommandType.CMD_DOORLOCK_P2P_SEQ)
+    return void 0;
+  const seq = json.payload?.seq_num;
+  return typeof seq === "number" && Number.isFinite(seq) ? seq : void 0;
+}
+
+// dist/transport/p2p/command-router.js
+import { setTimeout as sleep2 } from "node:timers/promises";
+
+// dist/transport/p2p/p2p-session.js
+import { EventEmitter as EventEmitter2 } from "node:events";
+import dgram from "node:dgram";
+import { constants as constants2, createCipheriv as createCipheriv4, createDecipheriv as createDecipheriv4, generateKeyPairSync, privateDecrypt as privateDecrypt2, randomBytes as randomBytes4 } from "node:crypto";
+
 // dist/transport/p2p/live-trace.js
 var LIVE_TRACE_MESSAGE = "[live] start trace";
 function traceLiveStart(logger, trace, source) {
@@ -17450,8 +17552,8 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
   encryptLevel2(plaintext) {
     if (!this.level2Key)
       return void 0;
-    const nonce = randomBytes2(12);
-    const c = createCipheriv3("aes-256-gcm", this.level2Key, nonce);
+    const nonce = randomBytes4(12);
+    const c = createCipheriv4("aes-256-gcm", this.level2Key, nonce);
     c.setAAD(GCM_AAD);
     const ct = Buffer.concat([c.update(plaintext), c.final()]);
     const sub2 = Buffer.alloc(4);
@@ -17661,22 +17763,28 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
    * Low-level: send a `CMD_SET_PAYLOAD` (1350) wrapping `{account_id, cmd:<subCmd>, mChannel,
    * payload, transaction}` over the level-1 channel. The reply arrives as a `NOTIFY_PAYLOAD`
    * (1351) frame (level-1 decrypted, surfaced via the `data` event / `frame.json`).
+   *
+   * `opts.key` makes it a keyed envelope: the sealed per-command key rides ahead of the other fields
+   * as the value's `key`, and the value goes out unencrypted, encryption-type 0, with `=` written
+   * `=` — the form the vendor app sends one in, and the one form the device reads it in.
    */
   sendSetPayload(subCmd, payload = {}, opts = {}) {
     if (!this.connectAddress)
       throw new Error("not connected");
     const channel = opts.channel ?? 0;
+    const keyed = opts.key !== void 0;
     const inner = opts.rawValue ?? {
+      ...keyed ? { key: opts.key } : {},
       account_id: opts.accountId ?? "",
       cmd: subCmd,
       mChannel: channel,
       mValue3: 0,
       ...opts.omitPayload ? {} : { payload }
     };
-    const value = JSON.stringify(inner);
+    const value = keyed ? JSON.stringify(inner).replace(/=/g, "\\u003d") : JSON.stringify(inner);
     const body = Buffer.concat([
       buildCommandHeader(this.seqNumber, opts.wrapCmd ?? CMD_SET_PAYLOAD),
-      buildStringCommandPayload(value, channel, this.level1Key, 1)
+      buildStringCommandPayload(value, channel, keyed ? void 0 : this.level1Key, 1)
     ]);
     this.seqNumber = this.seqNumber + 1 & 65535;
     this.logger.debug(`[p2p] ${this.cfg.stationSn} sendSetPayload subCmd=${subCmd}`);
@@ -18027,7 +18135,7 @@ function buildDeviceNameBody(channel, name, accountId) {
 }
 
 // dist/transport/ff09.js
-import { createCipheriv as createCipheriv4, createDecipheriv as createDecipheriv5 } from "node:crypto";
+import { createCipheriv as createCipheriv5, createDecipheriv as createDecipheriv5 } from "node:crypto";
 var LOCK_API_COMMAND = {
   /** Lock / unlock the deadbolt — video lock AND garage door, both directions (see above). */
   ON_OFF_LOCK: 6018,
@@ -18107,7 +18215,7 @@ function assembleFf09Frame(commandCode, apiCommand, plain, adminUserId, deviceSn
   const key = Buffer.concat([Buffer.from(adminUserId.slice(-12), "ascii"), u32be(keyTime)]);
   const iv = Buffer.alloc(16);
   Buffer.from(deviceSn, "ascii").copy(iv);
-  const cipher = createCipheriv4("aes-128-cbc", key, iv);
+  const cipher = createCipheriv5("aes-128-cbc", key, iv);
   const ct = Buffer.concat([cipher.update(plain), cipher.final()]);
   const body = Buffer.concat([Buffer.from([3, 0, 2]), u16be(16384 | commandCode), ct]);
   const size = 2 + 2 + body.length + 1;
@@ -21815,6 +21923,17 @@ var P2PCommandRouter = class _P2PCommandRouter {
   cipherKeyCache = /* @__PURE__ */ new Map();
   /** The recording download in flight per station; a station serves one at a time. */
   recordingDownloads = /* @__PURE__ */ new Map();
+  /**
+   * The `seq_num` last sent to each device over the keyed-payload wire. The device holds a mark for the life
+   * of a P2P connection: the first keyed command on a new connection is accepted at whatever number it
+   * carries and becomes the mark, and after that a number not above the mark is refused with the mark
+   * published ({@link keyedPayloadSeqMark}). Each accepted command moves this to its number, a refusal
+   * moves it to the published mark + 1, and a device absent here has not been sent one in this process and
+   * seeds from a small random number — which a new connection takes as sent.
+   */
+  keyedSequences = /* @__PURE__ */ new Map();
+  /** The keyed-payload command in flight per device, which the next one for that device waits on. */
+  keyedQueue = /* @__PURE__ */ new Map();
   constructor(deps) {
     this.deps = deps;
     this.manager = new SessionManager({
@@ -22170,6 +22289,9 @@ var P2PCommandRouter = class _P2PCommandRouter {
       case "ff09-actuate":
         await this.sendFf09Actuate(sn, cmd);
         return;
+      case "keyed-payload-actuate":
+        await this.sendKeyedPayloadActuate(sn, cmd);
+        return;
       case "ff09-autolock":
         await this.sendFf09Autolock(sn, cmd);
         return;
@@ -23152,6 +23274,163 @@ var P2PCommandRouter = class _P2PCommandRouter {
     }
     await this.replayLevel2Send(sn, `set-payload cmd ${cmd}`, ({ session, accountId }) => session.sendControlLevel2(cmd, channel, accountId, payload, mValue3 ?? cmd), resolved ?? await this.resolveSession(sn, { waitLevel2: true, level2Sender }));
   }
+  /**
+   * **`keyed-payload-actuate` intent** — the classic Wi-Fi lock's actuation: the sealed fields from
+   * {@link buildKeyedActuatePayload}, sent as a keyed envelope through {@link P2PSession.sendSetPayload}
+   * on the lock's device channel. No session key is waited for — the envelope seals its own per-command
+   * key for the device's public key (fetched from the cloud, cached per serial), so it goes as soon as
+   * the session is up. The device shows the acting member by display name, which lives on the device
+   * record's `member` rather than in the intent, so it is read here and falls back to the account name
+   * the intent carries.
+   *
+   * The device answers, so the outcome is read rather than assumed: {@link awaitKeyedReply} settles each
+   * send on the replies, and resolves a {@link KEYED_PAYLOAD_SEQ_ERROR} refusal with the mark the device
+   * publishes in the refusal's `CMD_DOORLOCK_P2P_SEQ` (1916) twin. On that mark the command resends once,
+   * at mark + 1; a second refusal, or a refusal that published no mark, throws. Commands run one at a time
+   * per device: the replies carry no correlation id, so one command's answer must never be read as
+   * another's.
+   */
+  sendKeyedPayloadActuate(sn, cmd) {
+    return this.serializeKeyed(sn, async () => {
+      const dev = await this.deviceFor(sn);
+      const member = (dev.raw ?? {}).member;
+      const userName = typeof member?.nick_name === "string" && member.nick_name ? member.nick_name : cmd.username;
+      const devicePublicKey = await this.deps.mega.getDevicePublicKey(sn);
+      const resolved = await this.resolveSession(sn, { waitLevel2: false });
+      const send = (seqNum) => {
+        const { key, payload } = buildKeyedActuatePayload(cmd, devicePublicKey, userName, { seqNum });
+        resolved.session.sendSetPayload(CommandType.P2P_ON_OFF_LOCK, payload, {
+          accountId: cmd.adminUserId,
+          channel: resolved.channel,
+          key
+        });
+      };
+      await this.sendKeyedAtSequence(sn, resolved.session, resolved.channel, cmd.engage, send);
+    });
+  }
+  /** Run `work` once every keyed-payload command already queued for `sn` has settled. */
+  serializeKeyed(sn, work) {
+    const previous = this.keyedQueue.get(sn) ?? Promise.resolve();
+    const run = previous.then(work);
+    const settled = run.then(() => void 0, () => void 0);
+    this.keyedQueue.set(sn, settled);
+    void settled.then(() => {
+      if (this.keyedQueue.get(sn) === settled)
+        this.keyedQueue.delete(sn);
+    });
+    return run;
+  }
+  /**
+   * Send one keyed command at the device's next sequence and, on a sequence refusal, resend once at the
+   * mark the refusal published.
+   *
+   * A device's first number in a process is a small random seed — the scale the vendor app's own counters
+   * run at — and every later one is the previous plus one. The device takes the first number on a new
+   * connection as sent, and from then on refuses one not above the mark it holds, stating the mark in the
+   * refusal's `CMD_DOORLOCK_P2P_SEQ` (1916) twin ({@link awaitKeyedReply} resolves the refusal with it).
+   * So a refusal is resolved to that mark and the command resent once at mark + 1, the number the device
+   * accepts after a refusal; a second refusal, or a refusal that carried no mark, throws. The accepted
+   * number is recorded, so the next command starts just above it.
+   *
+   * @param engage whether the command drives to the engaged (locked) state, which its own report states.
+   * @param send dispatches the envelope at the sequence it is given.
+   */
+  async sendKeyedAtSequence(sn, session, channel, engage, send) {
+    const last = this.keyedSequences.get(sn);
+    const first = last === void 0 ? Math.trunc(Math.random() * 1e3) : last + 1;
+    this.keyedSequences.set(sn, first);
+    const reply = await this.awaitKeyedReply(sn, session, channel, engage, () => send(first));
+    if (reply.code === 0)
+      return;
+    if (reply.code !== KEYED_PAYLOAD_SEQ_ERROR || reply.mark === void 0) {
+      throw new Error(`keyed-payload command rejected by ${sn} with code ${reply.code}`);
+    }
+    const resend = reply.mark + 1;
+    this.keyedSequences.set(sn, resend);
+    const second = await this.awaitKeyedReply(sn, session, channel, engage, () => send(resend));
+    if (second.code === 0)
+      return;
+    throw new Error(`keyed-payload command rejected by ${sn} with code ${second.code}`);
+  }
+  /**
+   * Send one keyed-payload command and read the device's answer for it from the replies on the command's
+   * channel: the `SET_PAYLOAD` echo (a `commandResult`), at once, carrying the result as an int32 — or,
+   * when the echo was not read and the command changed the device's state, the `NOTIFY_PAYLOAD` about two
+   * seconds later carrying the result again as a `P2P_QUERY_STATUS_IN_LOCK` (1955) document. A report
+   * is tied to the command by its `slState`: only one stating the state this command drives to, by
+   * `engage` ({@link keyedPayloadReportCode}), is read as its answer. A report of the other state is a
+   * previous command's, landing after that command settled on its echo, and is ignored.
+   *
+   * - An accepted result (code `0`) settles the command.
+   * - A sequence refusal is stated twice, both about a tenth of a second after the send: the `-151` echo
+   *   and a `CMD_DOORLOCK_P2P_SEQ` (1916) notify whose `seq_num` is the mark the device holds. The
+   *   resolved value carries that mark, so the caller resends just above it. Collection runs for
+   *   {@link KEYED_REFUSAL_TWIN_MS} after the first of the two, so both land and neither is left on the
+   *   channel for the resend to read as its own answer, and either one alone still resolves the refusal.
+   * - No reply within {@link KEYED_REPLY_MS} is a command that never landed, and rejects.
+   *
+   * Both listeners are armed before the send, and only replies on `channel` are read. The channel names
+   * the device, not the command: every other P2P write a lock takes waits for a level-2 key this device
+   * never negotiates, so nothing else the SDK sends can draw a reply here, and a future intent on this
+   * wrapper has to share {@link serializeKeyed}.
+   */
+  awaitKeyedReply(sn, session, channel, engage, send) {
+    return new Promise((resolve, reject) => {
+      let refused = false;
+      let mark;
+      let timer;
+      const settle = (outcome) => {
+        if (timer)
+          clearTimeout(timer);
+        session.off("commandResult", onResult);
+        session.off("data", onData);
+        outcome();
+      };
+      const expire = (ms, onExpiry) => {
+        if (timer)
+          clearTimeout(timer);
+        timer = setTimeout(onExpiry, ms);
+      };
+      const refuse = () => {
+        if (refused)
+          return;
+        refused = true;
+        expire(_P2PCommandRouter.KEYED_REFUSAL_TWIN_MS, () => settle(() => resolve({ code: KEYED_PAYLOAD_SEQ_ERROR, mark })));
+      };
+      const onResult = (r) => {
+        if (r.channel !== channel)
+          return;
+        if (r.code === KEYED_PAYLOAD_SEQ_ERROR)
+          refuse();
+        else if (!refused)
+          settle(() => resolve({ code: r.code }));
+      };
+      const onData = (f) => {
+        if (f.channel !== channel || f.commandId !== CommandType.CMD_NOTIFY_PAYLOAD)
+          return;
+        const published = keyedPayloadSeqMark(f.json);
+        if (published !== void 0) {
+          mark = published;
+          return refuse();
+        }
+        const code = keyedPayloadReportCode(f.json, engage);
+        if (code !== void 0 && !refused)
+          settle(() => resolve({ code }));
+      };
+      session.on("commandResult", onResult);
+      session.on("data", onData);
+      expire(_P2PCommandRouter.KEYED_REPLY_MS, () => settle(() => reject(new Error(`keyed-payload command to ${sn} drew no reply`))));
+      try {
+        send();
+      } catch (e) {
+        settle(() => reject(e));
+      }
+    });
+  }
+  /** How long a keyed-payload command waits for any reply before it is taken as never having landed. */
+  static KEYED_REPLY_MS = 6e3;
+  /** How long a refusal collects its two statements — the `-151` echo and the mark notify — before resolving. */
+  static KEYED_REFUSAL_TWIN_MS = 500;
   /**
    * **`ff09-actuate` intent** — build the `ff09` AES-128-CBC frame ({@link buildFf09Frame}, shared with the
    * MQTT transport — see `transport/ff09.ts`) and dispatch it in the `1940` TRANSFER_PAYLOAD envelope
@@ -25289,7 +25568,7 @@ var RtcCommandRouter = class {
 };
 
 // dist/transport/mqtt/command-router.js
-import { randomBytes as randomBytes3 } from "node:crypto";
+import { randomBytes as randomBytes5 } from "node:crypto";
 
 // dist/transport/mqtt/broker-discovery.js
 import { resolve4 } from "node:dns/promises";
@@ -25672,9 +25951,9 @@ function buildFf09MqttEnvelope(input) {
   const head = {
     version: "1.0.0.1",
     client_id: input.clientId,
-    sess_id: input.sessId ?? randomBytes3(2).toString("hex"),
+    sess_id: input.sessId ?? randomBytes5(2).toString("hex"),
     msg_seq: 1,
-    seed: input.seed ?? randomBytes3(16).toString("hex"),
+    seed: input.seed ?? randomBytes5(16).toString("hex"),
     timestamp: input.timestamp ?? Math.floor(Date.now() / 1e3),
     cmd_status: 2,
     cmd: 9,
@@ -26135,7 +26414,7 @@ var MqttCommandRouter = class _MqttCommandRouter {
 };
 
 // dist/transport/tuya/account.js
-import { createCipheriv as createCipheriv5 } from "node:crypto";
+import { createCipheriv as createCipheriv6 } from "node:crypto";
 var TUYA_USERNAME_PREFIX = "eh-";
 var TUYA_PASSWORD_KEY = Buffer.from([
   36,
@@ -26184,7 +26463,7 @@ function zeroPadTo16(s) {
   return Buffer.concat([Buffer.from("0".repeat(16 - rem), "utf-8"), buf]);
 }
 function deriveTuyaPassword(eufyUserId) {
-  const cipher = createCipheriv5("aes-128-cbc", TUYA_PASSWORD_KEY, TUYA_PASSWORD_IV);
+  const cipher = createCipheriv6("aes-128-cbc", TUYA_PASSWORD_KEY, TUYA_PASSWORD_IV);
   cipher.setAutoPadding(false);
   const ct = Buffer.concat([cipher.update(zeroPadTo16(tuyaUsername(eufyUserId))), cipher.final()]);
   return ct.toString("hex").toUpperCase();
@@ -26339,10 +26618,10 @@ var HmacSigner = class {
 var TUYA_CHKEY = "7cbfe6d8";
 
 // dist/transport/tuya/client.js
-import { randomBytes as randomBytes5, createHash as createHash6, createPublicKey, publicEncrypt, constants as constants3 } from "node:crypto";
+import { randomBytes as randomBytes7, createHash as createHash6, createPublicKey, publicEncrypt, constants as constants3 } from "node:crypto";
 
 // dist/transport/tuya/et3.js
-import { createCipheriv as createCipheriv6, createDecipheriv as createDecipheriv8, createHmac as createHmac5, randomBytes as randomBytes4 } from "node:crypto";
+import { createCipheriv as createCipheriv7, createDecipheriv as createDecipheriv8, createHmac as createHmac5, randomBytes as randomBytes6 } from "node:crypto";
 import { gunzipSync } from "node:zlib";
 function deriveBodyKey(requestId, ecode) {
   const k = resolveSignKey();
@@ -26351,8 +26630,8 @@ function deriveBodyKey(requestId, ecode) {
   return Buffer.from(hex.slice(0, 16), "ascii");
 }
 function encryptBody2(key, json) {
-  const nonce = randomBytes4(12);
-  const cipher = createCipheriv6("aes-128-gcm", key, nonce);
+  const nonce = randomBytes6(12);
+  const cipher = createCipheriv7("aes-128-gcm", key, nonce);
   const ciphertext = Buffer.concat([cipher.update(Buffer.from(json, "utf-8")), cipher.final()]);
   return Buffer.concat([nonce, ciphertext, cipher.getAuthTag()]).toString("base64");
 }
@@ -26490,7 +26769,7 @@ function buildUidTokenCreateAction(countryCode, uid) {
 
 // dist/transport/tuya/client.js
 function genDeviceId() {
-  return randomBytes5(22).toString("hex");
+  return randomBytes7(22).toString("hex");
 }
 function rsaEncryptPassword(password, publicKeyDecimal, exponentDecimal) {
   const bigintToBuffer = (n) => {
@@ -27612,7 +27891,7 @@ var PushClient = class _PushClient extends EventEmitter13 {
 };
 
 // dist/transport/push/fcm.js
-import { randomBytes as randomBytes6 } from "node:crypto";
+import { randomBytes as randomBytes8 } from "node:crypto";
 import { setTimeout as sleep3 } from "node:timers/promises";
 var FCM = {
   PROJECT_ID: "batterycam-3250a",
@@ -27625,7 +27904,7 @@ var FCM = {
   SDK_VERSION: "a:16.3.1"
 };
 function generateFid() {
-  const b = randomBytes6(17);
+  const b = randomBytes8(17);
   b[0] = 112 + b[0] % 16;
   return b.toString("base64url").slice(0, 22);
 }
@@ -29543,8 +29822,10 @@ var EufyMega = class extends EventEmitter14 {
    * Choose the transport stack for one command — the routing half of {@link commandSinkFor}.
    *
    * The `ff09-*` kinds share ONE frame that rides either transport, so each stack is asked whether it
-   * drives this device (`claimsDevice`) rather than inferring from the kind. `registry.require` throws
-   * on an unloaded serial, so a routing decision never silently falls through to the wrong transport.
+   * drives this device (`claimsDevice`) rather than inferring from the kind; `keyed-payload-actuate` (the
+   * classic Wi-Fi lock) is routed the same way, a channel-less actuation claimed by the stack that drives
+   * the lock. `registry.require` throws on an unloaded serial, so a routing decision never silently falls
+   * through to the wrong transport.
    * The `eufy_life` DP writes (smart lights) are secure-MQTT-only. `aiot-dp` routes to either the
    * Anker AIoT MQTT stack or the legacy Tuya REST router depending on the device's category
    * (`eufy_home_tuya` → Tuya, everything else → MQTT). The capability layer emits a single `aiot-dp`
@@ -29555,7 +29836,7 @@ var EufyMega = class extends EventEmitter14 {
    * media only, and the RTC router refuses a command on it. Everything else is P2P.
    */
   routeCommand(sn, cmd) {
-    if (cmd.kind === "ff09-actuate" || cmd.kind === "ff09-autolock" || cmd.kind === "ff09-setting-toggle") {
+    if (cmd.kind === "ff09-actuate" || cmd.kind === "ff09-autolock" || cmd.kind === "ff09-setting-toggle" || cmd.kind === "keyed-payload-actuate") {
       const dev = this.registry.require(sn);
       if (P2PCommandRouter.claimsDevice(dev))
         return this.p2p.dispatchCommand(sn, cmd);