@mega-yfue/eufy-sdk 0.5.0-beta.88 → 0.5.0-beta.89

package/dist/client/eufy-mega.d.ts

@@ -435,8 +435,10 @@ export declare class EufyMega extends EventEmitter {
      * Choose the transport stack for one command — the routing half of {@link commandSinkFor}.
      *
      * The `ff09-*` kinds share ONE frame that rides either transport, so each stack is asked whether it
-     * drives this device (`claimsDevice`) rather than inferring from the kind. `registry.require` throws
-     * on an unloaded serial, so a routing decision never silently falls through to the wrong transport.
+     * drives this device (`claimsDevice`) rather than inferring from the kind; `keyed-payload-actuate` (the
+     * classic Wi-Fi lock) is routed the same way, a channel-less actuation claimed by the stack that drives
+     * the lock. `registry.require` throws on an unloaded serial, so a routing decision never silently falls
+     * through to the wrong transport.
      * The `eufy_life` DP writes (smart lights) are secure-MQTT-only. `aiot-dp` routes to either the
      * Anker AIoT MQTT stack or the legacy Tuya REST router depending on the device's category
      * (`eufy_home_tuya` → Tuya, everything else → MQTT). The capability layer emits a single `aiot-dp`

package/dist/core/contracts.d.ts

@@ -264,10 +264,11 @@ export declare class StateConvergenceError extends Error {
  */
 export type ScalarForm = "auto" | "int-string" | "direct-binary";
 /**
- * The identity fields the `ff09` frame is built from — the AES key/IV inputs (`adminUserId`/`deviceSn`)
- * plus the frame's own direction bit and user-attribution fields (`A3`/`A4`/`A5`). Shared by the
- * actuate intent; the settings intents carry a narrower subset (the GET/SET frames omit the
- * user-attribution fields).
+ * The identity fields an actuation frame is built from — for `ff09`, the AES key/IV inputs
+ * (`adminUserId`/`deviceSn`) plus the frame's own direction bit and user-attribution fields
+ * (`A3`/`A4`/`A5`); for the keyed-payload envelope, the same five fields, sealed into its inner JSON.
+ * Shared by both actuate intents; the `ff09` settings intents carry a narrower subset (the GET/SET frames
+ * omit the user-attribution fields).
  */
 export interface Ff09Identity {
     /** Actuation direction: `true` = engage (lock / close), `false` = release (unlock / open) — the frame's `A3` byte. */
@@ -353,6 +354,14 @@ export type Command = {
     channel: number;
 } | ({
     kind: "ff09-actuate";
+} & Ff09Identity)
+/**
+ * `keyed-payload-actuate` — a `SET_PAYLOAD` envelope whose inner JSON is sealed with a fresh AES key
+ * that the envelope itself carries, wrapped for the device's own public key. P2P-only; the router
+ * resolves the device key and the member display name from the device record.
+ */
+ | ({
+    kind: "keyed-payload-actuate";
 } & Ff09Identity) | {
     kind: "ff09-autolock";
     adminUserId: string;

package/dist/index.js

@@ -2160,6 +2160,32 @@ ${this.auth_?.authToken ?? ""}`;
     const shard = this.region.split("-")[0];
     return shard === "us" ? "security-app.eufylife.com" : `security-app-${shard}.eufylife.com`;
   }
+  /**
+   * The device's long-lived P-256 public key, as the cloud publishes it for key-wrapped commands
+   * (`type=2`): 64 bytes hex with no `04` prefix. A plain authed GET on the security-app host — the
+   * one read here that is neither signed nor body-encrypted, matching how the app fetches it.
+   * Cached per serial for the client's lifetime; the key does not rotate in normal operation.
+   */
+  async getDevicePublicKey(deviceSn) {
+    const cached2 = this.devicePublicKeys.get(deviceSn);
+    if (cached2)
+      return cached2;
+    const url = `https://${this.securityAppHost()}/v1/app/public_key/query?device_sn=${encodeURIComponent(deviceSn)}&type=2`;
+    const res = await fetch(url, {
+      method: "GET",
+      headers: { ...this.baseHeaders(), ...this.authTokenHeaders() },
+      signal: AbortSignal.timeout(2e4)
+    });
+    const env = parseMaybeJson(await res.text());
+    const key = env?.data?.public_key;
+    if (res.status !== 200 || env?.code !== 0 || typeof key !== "string" || !key.length) {
+      throw new MegaApiError(`public_key/query failed (${res.status}/${env?.code}): ${env?.msg ?? "no public key"}`, env?.code, res.status);
+    }
+    this.devicePublicKeys.set(deviceSn, key);
+    return key;
+  }
+  /** Per-serial cache for {@link getDevicePublicKey}. */
+  devicePublicKeys = /* @__PURE__ */ new Map();
   /**
    * Signed+encrypted POST to the security-app data host (face recognition, etc.).
    * Despite the different host, these endpoints use the SAME algo_ecdh pipeline as
@@ -3661,6 +3687,7 @@ var isDoorbellT8223 = (ctx) => ctx.model === "T8223";
 var isAiotVacuum = (ctx) => ctx.category !== "eufy_home_tuya";
 var isTuyaVacuum = (ctx) => ctx.category === "eufy_home_tuya";
 var isVideoSmartLock = (ctx) => ctx.deviceType === DeviceType.LOCK_8530;
+var isClassicWifiLock = (ctx) => ctx.deviceType === DeviceType.LOCK_WIFI && typeof ctx.serial === "string" && ctx.serial.startsWith("T8520") && ctx.serial.charAt(6) === "2";
 
 // dist/model/capabilities/rtsp.js
 var RTSP_PARAM = {
@@ -7535,7 +7562,7 @@ function actuate(engage, ctx, sink) {
     });
   }
   return sink.dispatch({
-    kind: "ff09-actuate",
+    kind: isClassicWifiLock(ctx) ? "keyed-payload-actuate" : "ff09-actuate",
     engage,
     adminUserId: ctx.adminUserId,
     username: ctx.accountName ?? "",
@@ -7580,6 +7607,8 @@ function nativeReport(signal) {
   const report = signal.json.payload;
   return report?.code === 0 ? report : void 0;
 }
+var speaksFf09Settings = (ctx) => !isClassicWifiLock(ctx);
+var rainModeAvailable = (ctx) => overP2p(ctx) && speaksFf09Settings(ctx);
 var LOCK_MEMBERS = {
   /**
    * The lock's own state, verified on param 6000: "4" = locked, "3" = unlocked.
@@ -7610,8 +7639,8 @@ var LOCK_MEMBERS = {
     description: "Lock battery level 0-100 (verified: param 1101, alias 6001)."
   },
   /**
-   * Link quality in dBm as the lock measures it, on the shared param 1141. Both actuation methods here
-   * are fire-and-forget, so a weak link is silent rather than an error.
+   * Link quality in dBm as the lock measures it, on the shared param 1141. On the `ff09` wire the
+   * actuations are fire-and-forget, so a weak link is silent rather than an error.
    */
   rssi: {
     param: 1141,
@@ -7621,9 +7650,15 @@ var LOCK_MEMBERS = {
     provenance: "verified",
     description: "Lock signal strength (verified: param 1141 = RSSI)."
   },
-  /** Lock the deadbolt/door. Resolves after sending; does not confirm physical state. */
+  /**
+   * Lock the deadbolt/door. Resolves after sending, without confirming physical state — except on the
+   * classic Wi-Fi lock, which answers: there it rejects on a device refusal or no reply as well.
+   */
   lock: method(({ ctx, sink }) => () => actuate(true, ctx, sink), "Lock the deadbolt/door.", actuationAvailable),
-  /** Unlock the deadbolt/door. Resolves after sending; does not confirm physical state. */
+  /**
+   * Unlock the deadbolt/door. Resolves after sending, without confirming physical state — except on the
+   * classic Wi-Fi lock, which answers: there it rejects on a device refusal or no reply as well.
+   */
   unlock: method(({ ctx, sink }) => () => actuate(false, ctx, sink), "Unlock the deadbolt/door.", actuationAvailable),
   /**
    * Read-modify-write the auto-lock setting: the transport GETs the device's current settings, changes
@@ -7645,13 +7680,13 @@ var LOCK_MEMBERS = {
       enabled,
       delaySeconds
     });
-  }, "Read-modify-write the auto-lock setting, preserving the fields it does not change.", (ctx) => !isVideoSmartLock(ctx)),
+  }, "Read-modify-write the auto-lock setting, preserving the fields it does not change.", (ctx) => !isVideoSmartLock(ctx) && speaksFf09Settings(ctx)),
   /**
    * Toggle Rain Mode — a pure blind write, unlike `setAutoLock`: the compact frame carries only this one
    * field, so there is no GET pass and it is fire-and-forget. Confirmed on-device end-to-end in both
    * directions, with the app UI reflecting the new state afterward. P2P video lock only.
    */
-  setRainMode: method(({ ctx, sink }) => (enabled) => settingToggle(LOCK_SETTING_ID.RAIN_MODE, "setRainMode", enabled, ctx, sink), "Toggle Rain Mode.", overP2p),
+  setRainMode: method(({ ctx, sink }) => (enabled) => settingToggle(LOCK_SETTING_ID.RAIN_MODE, "setRainMode", enabled, ctx, sink), "Toggle Rain Mode.", rainModeAvailable),
   /**
    * Lock the door by a single touch on the pad, with no code. First of the six compact toggles: all
    * `unverified` (frame shape read out of the app's JS, never captured), so no setter is installed and
@@ -15140,13 +15175,8 @@ function abortable(work, signal) {
   ]);
 }
 
-// dist/transport/p2p/command-router.js
-import { setTimeout as sleep2 } from "node:timers/promises";
-
-// dist/transport/p2p/p2p-session.js
-import { EventEmitter as EventEmitter2 } from "node:events";
-import dgram from "node:dgram";
-import { constants as constants2, createCipheriv as createCipheriv3, createDecipheriv as createDecipheriv4, generateKeyPairSync, privateDecrypt as privateDecrypt2, randomBytes as randomBytes2 } from "node:crypto";
+// dist/transport/p2p/keyed-payload.js
+import { createCipheriv as createCipheriv3, randomBytes as randomBytes3 } from "node:crypto";
 
 // dist/transport/p2p/codec.js
 var codec_exports = {};
@@ -15173,6 +15203,7 @@ __export(codec_exports, {
   deriveLevel2KeyFromGatewayInfo: () => deriveLevel2KeyFromGatewayInfo,
   deriveLevel2KeyFromRsaGatewayInfo: () => deriveLevel2KeyFromRsaGatewayInfo,
   eciesUnwrap: () => eciesUnwrap,
+  eciesWrap: () => eciesWrap,
   encryptP2PData: () => encryptP2PData,
   frameMessage: () => frameMessage,
   gatewayInfoCipherId: () => gatewayInfoCipherId,
@@ -15185,7 +15216,7 @@ __export(codec_exports, {
   readNullTerminatedString: () => readNullTerminatedString,
   stringWithLength: () => stringWithLength
 });
-import { constants, createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv3, createECDH as createECDH2, createHmac as createHmac2, createPrivateKey, privateDecrypt, timingSafeEqual } from "node:crypto";
+import { constants, createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv3, createECDH as createECDH2, createHmac as createHmac2, createPrivateKey, privateDecrypt, randomBytes as randomBytes2, timingSafeEqual } from "node:crypto";
 var MAGIC_WORD = "XZYH";
 var RequestMessageType = {
   LOCAL_LOOKUP: Buffer.from([241, 48]),
@@ -15322,6 +15353,19 @@ function eciesUnwrap(envelope, eccPrivateKeyHex, options = {}) {
     return void 0;
   }
 }
+function eciesWrap(plaintext, peerPublicKey, options = {}) {
+  const ecdh = createECDH2("prime256v1");
+  if (options.ephemeralPrivateKey)
+    ecdh.setPrivateKey(options.ephemeralPrivateKey);
+  else
+    ecdh.generateKeys();
+  const kdf = eufyKdf(ecdh.computeSecret(peerPublicKey), 48);
+  const iv = options.iv ?? randomBytes2(16);
+  const cipher = createCipheriv2("aes-128-cbc", kdf.subarray(0, 16), iv);
+  const ct = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+  const tag2 = createHmac2("sha256", kdf.subarray(16, 48)).update(iv).update(ct).digest();
+  return Buffer.concat([ecdh.getPublicKey(null, "compressed"), iv, ct, tag2]);
+}
 function deriveLevel2KeyFromGatewayInfo(gwPayload, eccPrivateKeyHex) {
   const plain = eciesUnwrap(gwPayload.subarray(4, 4 + 129), eccPrivateKeyHex);
   if (!plain)
@@ -16041,6 +16085,65 @@ function commandName(id) {
   return COMMAND_NAMES[id] ?? `CMD_${id}`;
 }
 
+// dist/transport/p2p/keyed-payload.js
+var KEYED_PAYLOAD_SEQ_ERROR = -151;
+function serialIv(deviceSn) {
+  const iv = Buffer.alloc(16);
+  Buffer.from(deviceSn, "utf8").copy(iv, 0, 0, 16);
+  return iv;
+}
+function spellAesKey(key) {
+  return key.toString("hex").toUpperCase();
+}
+function buildKeyBlob(aesKeyHex, devicePublicKeyHex, rnd = {}) {
+  const devicePublicKey = Buffer.concat([Buffer.from([4]), Buffer.from(devicePublicKeyHex, "hex")]);
+  return eciesWrap(Buffer.from(aesKeyHex, "utf8"), devicePublicKey, {
+    ephemeralPrivateKey: rnd.ephemeralPrivateKey,
+    iv: rnd.nonce
+  }).toString("hex");
+}
+function sealInnerPayload(innerJson, aesKeyHex, deviceSn) {
+  const cipher = createCipheriv3("aes-128-cbc", Buffer.from(aesKeyHex, "hex"), serialIv(deviceSn));
+  return Buffer.concat([cipher.update(Buffer.from(innerJson, "utf8")), cipher.final()]).toString("base64");
+}
+function buildKeyedActuatePayload(id, devicePublicKeyHex, userName, rnd) {
+  const aesKeyHex = spellAesKey(rnd.aesKey ?? randomBytes3(16));
+  const inner = JSON.stringify({
+    shortUserId: id.shortUserId,
+    slOperation: id.engage ? 1 : 0,
+    userId: id.adminUserId,
+    userName,
+    seq_num: rnd.seqNum
+  });
+  return {
+    key: buildKeyBlob(aesKeyHex, devicePublicKeyHex, rnd),
+    payload: sealInnerPayload(inner, aesKeyHex, id.deviceSn)
+  };
+}
+function keyedPayloadReportCode(json, engage) {
+  if (json?.cmd !== CommandType.P2P_QUERY_STATUS_IN_LOCK)
+    return void 0;
+  const payload = json.payload;
+  const slState = engage ? "4" : "3";
+  if (payload?.slState !== slState)
+    return void 0;
+  return typeof payload?.code === "number" ? payload.code : void 0;
+}
+function keyedPayloadSeqMark(json) {
+  if (json?.cmd !== CommandType.CMD_DOORLOCK_P2P_SEQ)
+    return void 0;
+  const seq = json.payload?.seq_num;
+  return typeof seq === "number" && Number.isFinite(seq) ? seq : void 0;
+}
+
+// dist/transport/p2p/command-router.js
+import { setTimeout as sleep2 } from "node:timers/promises";
+
+// dist/transport/p2p/p2p-session.js
+import { EventEmitter as EventEmitter2 } from "node:events";
+import dgram from "node:dgram";
+import { constants as constants2, createCipheriv as createCipheriv4, createDecipheriv as createDecipheriv4, generateKeyPairSync, privateDecrypt as privateDecrypt2, randomBytes as randomBytes4 } from "node:crypto";
+
 // dist/transport/p2p/live-trace.js
 var LIVE_TRACE_MESSAGE = "[live] start trace";
 function traceLiveStart(logger, trace, source) {
@@ -17449,8 +17552,8 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
   encryptLevel2(plaintext) {
     if (!this.level2Key)
       return void 0;
-    const nonce = randomBytes2(12);
-    const c = createCipheriv3("aes-256-gcm", this.level2Key, nonce);
+    const nonce = randomBytes4(12);
+    const c = createCipheriv4("aes-256-gcm", this.level2Key, nonce);
     c.setAAD(GCM_AAD);
     const ct = Buffer.concat([c.update(plaintext), c.final()]);
     const sub2 = Buffer.alloc(4);
@@ -17660,22 +17763,28 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
    * Low-level: send a `CMD_SET_PAYLOAD` (1350) wrapping `{account_id, cmd:<subCmd>, mChannel,
    * payload, transaction}` over the level-1 channel. The reply arrives as a `NOTIFY_PAYLOAD`
    * (1351) frame (level-1 decrypted, surfaced via the `data` event / `frame.json`).
+   *
+   * `opts.key` makes it a keyed envelope: the sealed per-command key rides ahead of the other fields
+   * as the value's `key`, and the value goes out unencrypted, encryption-type 0, with `=` written
+   * `=` — the form the vendor app sends one in, and the one form the device reads it in.
    */
   sendSetPayload(subCmd, payload = {}, opts = {}) {
     if (!this.connectAddress)
       throw new Error("not connected");
     const channel = opts.channel ?? 0;
+    const keyed = opts.key !== void 0;
     const inner = opts.rawValue ?? {
+      ...keyed ? { key: opts.key } : {},
       account_id: opts.accountId ?? "",
       cmd: subCmd,
       mChannel: channel,
       mValue3: 0,
       ...opts.omitPayload ? {} : { payload }
     };
-    const value = JSON.stringify(inner);
+    const value = keyed ? JSON.stringify(inner).replace(/=/g, "\\u003d") : JSON.stringify(inner);
     const body = Buffer.concat([
       buildCommandHeader(this.seqNumber, opts.wrapCmd ?? CMD_SET_PAYLOAD),
-      buildStringCommandPayload(value, channel, this.level1Key, 1)
+      buildStringCommandPayload(value, channel, keyed ? void 0 : this.level1Key, 1)
     ]);
     this.seqNumber = this.seqNumber + 1 & 65535;
     this.logger.debug(`[p2p] ${this.cfg.stationSn} sendSetPayload subCmd=${subCmd}`);
@@ -18026,7 +18135,7 @@ function buildDeviceNameBody(channel, name, accountId) {
 }
 
 // dist/transport/ff09.js
-import { createCipheriv as createCipheriv4, createDecipheriv as createDecipheriv5 } from "node:crypto";
+import { createCipheriv as createCipheriv5, createDecipheriv as createDecipheriv5 } from "node:crypto";
 var LOCK_API_COMMAND = {
   /** Lock / unlock the deadbolt — video lock AND garage door, both directions (see above). */
   ON_OFF_LOCK: 6018,
@@ -18106,7 +18215,7 @@ function assembleFf09Frame(commandCode, apiCommand, plain, adminUserId, deviceSn
   const key = Buffer.concat([Buffer.from(adminUserId.slice(-12), "ascii"), u32be(keyTime)]);
   const iv = Buffer.alloc(16);
   Buffer.from(deviceSn, "ascii").copy(iv);
-  const cipher = createCipheriv4("aes-128-cbc", key, iv);
+  const cipher = createCipheriv5("aes-128-cbc", key, iv);
   const ct = Buffer.concat([cipher.update(plain), cipher.final()]);
   const body = Buffer.concat([Buffer.from([3, 0, 2]), u16be(16384 | commandCode), ct]);
   const size = 2 + 2 + body.length + 1;
@@ -21814,6 +21923,17 @@ var P2PCommandRouter = class _P2PCommandRouter {
   cipherKeyCache = /* @__PURE__ */ new Map();
   /** The recording download in flight per station; a station serves one at a time. */
   recordingDownloads = /* @__PURE__ */ new Map();
+  /**
+   * The `seq_num` last sent to each device over the keyed-payload wire. The device holds a mark for the life
+   * of a P2P connection: the first keyed command on a new connection is accepted at whatever number it
+   * carries and becomes the mark, and after that a number not above the mark is refused with the mark
+   * published ({@link keyedPayloadSeqMark}). Each accepted command moves this to its number, a refusal
+   * moves it to the published mark + 1, and a device absent here has not been sent one in this process and
+   * seeds from a small random number — which a new connection takes as sent.
+   */
+  keyedSequences = /* @__PURE__ */ new Map();
+  /** The keyed-payload command in flight per device, which the next one for that device waits on. */
+  keyedQueue = /* @__PURE__ */ new Map();
   constructor(deps) {
     this.deps = deps;
     this.manager = new SessionManager({
@@ -22169,6 +22289,9 @@ var P2PCommandRouter = class _P2PCommandRouter {
       case "ff09-actuate":
         await this.sendFf09Actuate(sn, cmd);
         return;
+      case "keyed-payload-actuate":
+        await this.sendKeyedPayloadActuate(sn, cmd);
+        return;
       case "ff09-autolock":
         await this.sendFf09Autolock(sn, cmd);
         return;
@@ -23151,6 +23274,163 @@ var P2PCommandRouter = class _P2PCommandRouter {
     }
     await this.replayLevel2Send(sn, `set-payload cmd ${cmd}`, ({ session, accountId }) => session.sendControlLevel2(cmd, channel, accountId, payload, mValue3 ?? cmd), resolved ?? await this.resolveSession(sn, { waitLevel2: true, level2Sender }));
   }
+  /**
+   * **`keyed-payload-actuate` intent** — the classic Wi-Fi lock's actuation: the sealed fields from
+   * {@link buildKeyedActuatePayload}, sent as a keyed envelope through {@link P2PSession.sendSetPayload}
+   * on the lock's device channel. No session key is waited for — the envelope seals its own per-command
+   * key for the device's public key (fetched from the cloud, cached per serial), so it goes as soon as
+   * the session is up. The device shows the acting member by display name, which lives on the device
+   * record's `member` rather than in the intent, so it is read here and falls back to the account name
+   * the intent carries.
+   *
+   * The device answers, so the outcome is read rather than assumed: {@link awaitKeyedReply} settles each
+   * send on the replies, and resolves a {@link KEYED_PAYLOAD_SEQ_ERROR} refusal with the mark the device
+   * publishes in the refusal's `CMD_DOORLOCK_P2P_SEQ` (1916) twin. On that mark the command resends once,
+   * at mark + 1; a second refusal, or a refusal that published no mark, throws. Commands run one at a time
+   * per device: the replies carry no correlation id, so one command's answer must never be read as
+   * another's.
+   */
+  sendKeyedPayloadActuate(sn, cmd) {
+    return this.serializeKeyed(sn, async () => {
+      const dev = await this.deviceFor(sn);
+      const member = (dev.raw ?? {}).member;
+      const userName = typeof member?.nick_name === "string" && member.nick_name ? member.nick_name : cmd.username;
+      const devicePublicKey = await this.deps.mega.getDevicePublicKey(sn);
+      const resolved = await this.resolveSession(sn, { waitLevel2: false });
+      const send = (seqNum) => {
+        const { key, payload } = buildKeyedActuatePayload(cmd, devicePublicKey, userName, { seqNum });
+        resolved.session.sendSetPayload(CommandType.P2P_ON_OFF_LOCK, payload, {
+          accountId: cmd.adminUserId,
+          channel: resolved.channel,
+          key
+        });
+      };
+      await this.sendKeyedAtSequence(sn, resolved.session, resolved.channel, cmd.engage, send);
+    });
+  }
+  /** Run `work` once every keyed-payload command already queued for `sn` has settled. */
+  serializeKeyed(sn, work) {
+    const previous = this.keyedQueue.get(sn) ?? Promise.resolve();
+    const run = previous.then(work);
+    const settled = run.then(() => void 0, () => void 0);
+    this.keyedQueue.set(sn, settled);
+    void settled.then(() => {
+      if (this.keyedQueue.get(sn) === settled)
+        this.keyedQueue.delete(sn);
+    });
+    return run;
+  }
+  /**
+   * Send one keyed command at the device's next sequence and, on a sequence refusal, resend once at the
+   * mark the refusal published.
+   *
+   * A device's first number in a process is a small random seed — the scale the vendor app's own counters
+   * run at — and every later one is the previous plus one. The device takes the first number on a new
+   * connection as sent, and from then on refuses one not above the mark it holds, stating the mark in the
+   * refusal's `CMD_DOORLOCK_P2P_SEQ` (1916) twin ({@link awaitKeyedReply} resolves the refusal with it).
+   * So a refusal is resolved to that mark and the command resent once at mark + 1, the number the device
+   * accepts after a refusal; a second refusal, or a refusal that carried no mark, throws. The accepted
+   * number is recorded, so the next command starts just above it.
+   *
+   * @param engage whether the command drives to the engaged (locked) state, which its own report states.
+   * @param send dispatches the envelope at the sequence it is given.
+   */
+  async sendKeyedAtSequence(sn, session, channel, engage, send) {
+    const last = this.keyedSequences.get(sn);
+    const first = last === void 0 ? Math.trunc(Math.random() * 1e3) : last + 1;
+    this.keyedSequences.set(sn, first);
+    const reply = await this.awaitKeyedReply(sn, session, channel, engage, () => send(first));
+    if (reply.code === 0)
+      return;
+    if (reply.code !== KEYED_PAYLOAD_SEQ_ERROR || reply.mark === void 0) {
+      throw new Error(`keyed-payload command rejected by ${sn} with code ${reply.code}`);
+    }
+    const resend = reply.mark + 1;
+    this.keyedSequences.set(sn, resend);
+    const second = await this.awaitKeyedReply(sn, session, channel, engage, () => send(resend));
+    if (second.code === 0)
+      return;
+    throw new Error(`keyed-payload command rejected by ${sn} with code ${second.code}`);
+  }
+  /**
+   * Send one keyed-payload command and read the device's answer for it from the replies on the command's
+   * channel: the `SET_PAYLOAD` echo (a `commandResult`), at once, carrying the result as an int32 — or,
+   * when the echo was not read and the command changed the device's state, the `NOTIFY_PAYLOAD` about two
+   * seconds later carrying the result again as a `P2P_QUERY_STATUS_IN_LOCK` (1955) document. A report
+   * is tied to the command by its `slState`: only one stating the state this command drives to, by
+   * `engage` ({@link keyedPayloadReportCode}), is read as its answer. A report of the other state is a
+   * previous command's, landing after that command settled on its echo, and is ignored.
+   *
+   * - An accepted result (code `0`) settles the command.
+   * - A sequence refusal is stated twice, both about a tenth of a second after the send: the `-151` echo
+   *   and a `CMD_DOORLOCK_P2P_SEQ` (1916) notify whose `seq_num` is the mark the device holds. The
+   *   resolved value carries that mark, so the caller resends just above it. Collection runs for
+   *   {@link KEYED_REFUSAL_TWIN_MS} after the first of the two, so both land and neither is left on the
+   *   channel for the resend to read as its own answer, and either one alone still resolves the refusal.
+   * - No reply within {@link KEYED_REPLY_MS} is a command that never landed, and rejects.
+   *
+   * Both listeners are armed before the send, and only replies on `channel` are read. The channel names
+   * the device, not the command: every other P2P write a lock takes waits for a level-2 key this device
+   * never negotiates, so nothing else the SDK sends can draw a reply here, and a future intent on this
+   * wrapper has to share {@link serializeKeyed}.
+   */
+  awaitKeyedReply(sn, session, channel, engage, send) {
+    return new Promise((resolve, reject) => {
+      let refused = false;
+      let mark;
+      let timer;
+      const settle = (outcome) => {
+        if (timer)
+          clearTimeout(timer);
+        session.off("commandResult", onResult);
+        session.off("data", onData);
+        outcome();
+      };
+      const expire = (ms, onExpiry) => {
+        if (timer)
+          clearTimeout(timer);
+        timer = setTimeout(onExpiry, ms);
+      };
+      const refuse = () => {
+        if (refused)
+          return;
+        refused = true;
+        expire(_P2PCommandRouter.KEYED_REFUSAL_TWIN_MS, () => settle(() => resolve({ code: KEYED_PAYLOAD_SEQ_ERROR, mark })));
+      };
+      const onResult = (r) => {
+        if (r.channel !== channel)
+          return;
+        if (r.code === KEYED_PAYLOAD_SEQ_ERROR)
+          refuse();
+        else if (!refused)
+          settle(() => resolve({ code: r.code }));
+      };
+      const onData = (f) => {
+        if (f.channel !== channel || f.commandId !== CommandType.CMD_NOTIFY_PAYLOAD)
+          return;
+        const published = keyedPayloadSeqMark(f.json);
+        if (published !== void 0) {
+          mark = published;
+          return refuse();
+        }
+        const code = keyedPayloadReportCode(f.json, engage);
+        if (code !== void 0 && !refused)
+          settle(() => resolve({ code }));
+      };
+      session.on("commandResult", onResult);
+      session.on("data", onData);
+      expire(_P2PCommandRouter.KEYED_REPLY_MS, () => settle(() => reject(new Error(`keyed-payload command to ${sn} drew no reply`))));
+      try {
+        send();
+      } catch (e) {
+        settle(() => reject(e));
+      }
+    });
+  }
+  /** How long a keyed-payload command waits for any reply before it is taken as never having landed. */
+  static KEYED_REPLY_MS = 6e3;
+  /** How long a refusal collects its two statements — the `-151` echo and the mark notify — before resolving. */
+  static KEYED_REFUSAL_TWIN_MS = 500;
   /**
    * **`ff09-actuate` intent** — build the `ff09` AES-128-CBC frame ({@link buildFf09Frame}, shared with the
    * MQTT transport — see `transport/ff09.ts`) and dispatch it in the `1940` TRANSFER_PAYLOAD envelope
@@ -25288,7 +25568,7 @@ var RtcCommandRouter = class {
 };
 
 // dist/transport/mqtt/command-router.js
-import { randomBytes as randomBytes3 } from "node:crypto";
+import { randomBytes as randomBytes5 } from "node:crypto";
 
 // dist/transport/mqtt/broker-discovery.js
 import { resolve4 } from "node:dns/promises";
@@ -25671,9 +25951,9 @@ function buildFf09MqttEnvelope(input) {
   const head = {
     version: "1.0.0.1",
     client_id: input.clientId,
-    sess_id: input.sessId ?? randomBytes3(2).toString("hex"),
+    sess_id: input.sessId ?? randomBytes5(2).toString("hex"),
     msg_seq: 1,
-    seed: input.seed ?? randomBytes3(16).toString("hex"),
+    seed: input.seed ?? randomBytes5(16).toString("hex"),
     timestamp: input.timestamp ?? Math.floor(Date.now() / 1e3),
     cmd_status: 2,
     cmd: 9,
@@ -26134,7 +26414,7 @@ var MqttCommandRouter = class _MqttCommandRouter {
 };
 
 // dist/transport/tuya/account.js
-import { createCipheriv as createCipheriv5 } from "node:crypto";
+import { createCipheriv as createCipheriv6 } from "node:crypto";
 var TUYA_USERNAME_PREFIX = "eh-";
 var TUYA_PASSWORD_KEY = Buffer.from([
   36,
@@ -26183,7 +26463,7 @@ function zeroPadTo16(s) {
   return Buffer.concat([Buffer.from("0".repeat(16 - rem), "utf-8"), buf]);
 }
 function deriveTuyaPassword(eufyUserId) {
-  const cipher = createCipheriv5("aes-128-cbc", TUYA_PASSWORD_KEY, TUYA_PASSWORD_IV);
+  const cipher = createCipheriv6("aes-128-cbc", TUYA_PASSWORD_KEY, TUYA_PASSWORD_IV);
   cipher.setAutoPadding(false);
   const ct = Buffer.concat([cipher.update(zeroPadTo16(tuyaUsername(eufyUserId))), cipher.final()]);
   return ct.toString("hex").toUpperCase();
@@ -26338,10 +26618,10 @@ var HmacSigner = class {
 var TUYA_CHKEY = "7cbfe6d8";
 
 // dist/transport/tuya/client.js
-import { randomBytes as randomBytes5, createHash as createHash6, createPublicKey, publicEncrypt, constants as constants3 } from "node:crypto";
+import { randomBytes as randomBytes7, createHash as createHash6, createPublicKey, publicEncrypt, constants as constants3 } from "node:crypto";
 
 // dist/transport/tuya/et3.js
-import { createCipheriv as createCipheriv6, createDecipheriv as createDecipheriv8, createHmac as createHmac5, randomBytes as randomBytes4 } from "node:crypto";
+import { createCipheriv as createCipheriv7, createDecipheriv as createDecipheriv8, createHmac as createHmac5, randomBytes as randomBytes6 } from "node:crypto";
 import { gunzipSync } from "node:zlib";
 function deriveBodyKey(requestId, ecode) {
   const k = resolveSignKey();
@@ -26350,8 +26630,8 @@ function deriveBodyKey(requestId, ecode) {
   return Buffer.from(hex.slice(0, 16), "ascii");
 }
 function encryptBody2(key, json) {
-  const nonce = randomBytes4(12);
-  const cipher = createCipheriv6("aes-128-gcm", key, nonce);
+  const nonce = randomBytes6(12);
+  const cipher = createCipheriv7("aes-128-gcm", key, nonce);
   const ciphertext = Buffer.concat([cipher.update(Buffer.from(json, "utf-8")), cipher.final()]);
   return Buffer.concat([nonce, ciphertext, cipher.getAuthTag()]).toString("base64");
 }
@@ -26489,7 +26769,7 @@ function buildUidTokenCreateAction(countryCode, uid) {
 
 // dist/transport/tuya/client.js
 function genDeviceId() {
-  return randomBytes5(22).toString("hex");
+  return randomBytes7(22).toString("hex");
 }
 function rsaEncryptPassword(password, publicKeyDecimal, exponentDecimal) {
   const bigintToBuffer = (n) => {
@@ -27611,7 +27891,7 @@ var PushClient = class _PushClient extends EventEmitter13 {
 };
 
 // dist/transport/push/fcm.js
-import { randomBytes as randomBytes6 } from "node:crypto";
+import { randomBytes as randomBytes8 } from "node:crypto";
 import { setTimeout as sleep3 } from "node:timers/promises";
 var FCM = {
   PROJECT_ID: "batterycam-3250a",
@@ -27624,7 +27904,7 @@ var FCM = {
   SDK_VERSION: "a:16.3.1"
 };
 function generateFid() {
-  const b = randomBytes6(17);
+  const b = randomBytes8(17);
   b[0] = 112 + b[0] % 16;
   return b.toString("base64url").slice(0, 22);
 }
@@ -29542,8 +29822,10 @@ var EufyMega = class extends EventEmitter14 {
    * Choose the transport stack for one command — the routing half of {@link commandSinkFor}.
    *
    * The `ff09-*` kinds share ONE frame that rides either transport, so each stack is asked whether it
-   * drives this device (`claimsDevice`) rather than inferring from the kind. `registry.require` throws
-   * on an unloaded serial, so a routing decision never silently falls through to the wrong transport.
+   * drives this device (`claimsDevice`) rather than inferring from the kind; `keyed-payload-actuate` (the
+   * classic Wi-Fi lock) is routed the same way, a channel-less actuation claimed by the stack that drives
+   * the lock. `registry.require` throws on an unloaded serial, so a routing decision never silently falls
+   * through to the wrong transport.
    * The `eufy_life` DP writes (smart lights) are secure-MQTT-only. `aiot-dp` routes to either the
    * Anker AIoT MQTT stack or the legacy Tuya REST router depending on the device's category
    * (`eufy_home_tuya` → Tuya, everything else → MQTT). The capability layer emits a single `aiot-dp`
@@ -29554,7 +29836,7 @@ var EufyMega = class extends EventEmitter14 {
    * media only, and the RTC router refuses a command on it. Everything else is P2P.
    */
   routeCommand(sn, cmd) {
-    if (cmd.kind === "ff09-actuate" || cmd.kind === "ff09-autolock" || cmd.kind === "ff09-setting-toggle") {
+    if (cmd.kind === "ff09-actuate" || cmd.kind === "ff09-autolock" || cmd.kind === "ff09-setting-toggle" || cmd.kind === "keyed-payload-actuate") {
       const dev = this.registry.require(sn);
       if (P2PCommandRouter.claimsDevice(dev))
         return this.p2p.dispatchCommand(sn, cmd);