tesla-fleet-api 0.4.0 → 0.6.0

package/dist/bluetooth/vehiclebluetooth.mjs

@@ -0,0 +1,1270 @@
+import { BluetoothVehicleData } from "../const.mjs";
+import { infotainment_command_name, vcsec_command_name } from "../commands.mjs";
+import { logRequestError, logRequestResult } from "../log.mjs";
+import { BluetoothCloudUnavailableError, BluetoothCommandFailed, BluetoothTimeout, BluetoothTransportError, BluetoothUnconfirmedCommand, InvalidResponse, NotOnWhitelistFault, SessionInfoAuthenticationFault, SignedCommandResponseReplayed, SigningDisabled, TeslaFleetError, TeslaFleetMessageFaultResponseSizeExceedsMTU, WhitelistOperationStatus } from "../exceptions.mjs";
+import { AsyncLock, BleCallTimeout, ReplyQueue, abortable, sleep, withTimeout } from "./async.mjs";
+import { BroadcastListeners, ListenerRegistry, decodeVcsecStatus } from "./broadcast.mjs";
+import { CHARGE_PORT_VERIFY_TIMEOUT_MS, DEFAULT_KEEPALIVE_INTERVAL_MS, DEFAULT_PAIR_POLL_INTERVAL_MS, DEFAULT_PAIR_TIMEOUT_MS, DEFAULT_WAKE_TIMEOUT_MS, GATT_READ_TIMEOUT_MS, GATT_WRITE_TIMEOUT_MS, INFOTAINMENT_BOOT_TIMEOUT_MS, LINK_TEARDOWN_TIMEOUT_MS, WAKE_RESEND_INTERVAL_MS } from "./constants.mjs";
+import { ReassemblingBuffer, prependLength, splitFrame } from "./framing.mjs";
+import { get_name, name_matches_vin } from "./names.mjs";
+import { BleNotSubmittedError } from "./transport.mjs";
+import { chargePortConnected, infotainmentVerifyPlan, vcsecVerifyPlan } from "./verify.mjs";
+import crypto from "crypto";
+import { Domain, MessageFaultE, OperationStatusE, RoutableMessage } from "@teslemetry/tesla-protocol/command/universal_message";
+import { ClosureMoveRequest, ClosureMoveTypeE, FromVCSECMessage, InformationRequest, InformationRequestType, KeyFormFactor, OperationStatusE as OperationStatusE$1, RKEActionE, UnsignedMessage, VehicleSleepStatusE, WhitelistOperation } from "@teslemetry/tesla-protocol/command/vcsec";
+import { Action, GetAlertState, GetChargeScheduleState, GetChargeState, GetChildPresenceDetectionState, GetClimateState, GetClosuresState, GetDisplayState, GetDriveState, GetGuiSettings, GetLegacyVehicleState, GetLightShowState, GetLocationState, GetMediaDetailState, GetMediaState, GetParentalControlsState, GetParkedAccessoryState, GetPreconditioningScheduleState, GetSoftwareUpdateState, GetSohState, GetSuspensionState, GetTirePressureState, GetVehicleConfig, GetVehicleData, GetVehicleDetailState, GetVehicleState, VehicleAction } from "@teslemetry/tesla-protocol/command/car_server";
+import { Role } from "@teslemetry/tesla-protocol/command/keys";
+// src/bluetooth/vehiclebluetooth.ts
+const VCSEC = Domain.DOMAIN_VEHICLE_SECURITY;
+const INFOTAINMENT = Domain.DOMAIN_INFOTAINMENT;
+/** What Device Name starts with once the vehicle's name is available. */
+const DISPLAY_NAME_PREFIX = "🔑 ";
+const DISPLAY_NAME_RETRY_MS = 1e3;
+function success() {
+	return { response: {
+		result: true,
+		reason: ""
+	} };
+}
+/** One GATT connection, or an attempt at one, with everything that must not outlive it. */
+var Link = class {
+	connection;
+	/** Holds one adapter call at a time, so frames and reads never interleave. */
+	gatt = new AsyncLock();
+	/** Per link, so a partial frame from a dead link can never join the next link's. */
+	buffer;
+	/** Aborts when the link is lost, ending every wait on it. */
+	closed = new AbortController();
+	constructor(onMessage) {
+		this.buffer = new ReassemblingBuffer(onMessage);
+	}
+	get lost() {
+		return this.closed.signal.aborted;
+	}
+	close() {
+		this.closed.abort(/* @__PURE__ */ new Error("The Bluetooth link was lost."));
+	}
+};
+/**
+* A vehicle reached directly over Bluetooth, with commands signed by AES-GCM.
+*
+* All Tesla protocol logic lives here and in `Commands`. A `BleTransport`
+* supplies raw GATT only, so the same class runs on any backend, Homey's
+* included. Backends may hang and may misreport their link, so every backend
+* call is bounded, and a failed or timed-out operation is what counts as a dead
+* link.
+*
+* `Commands.dispatch` holds a VCSEC session's lock across `_send`, and that lock
+* is not reentrant, so `_send` serializes on its own `domainSendLock` and must
+* never take `Session.withLock`.
+*
+* Sessions survive a reconnect, and the vehicle key they pinned at first contact
+* survives with them: a new link may re-handshake, but nothing here clears a
+* session or lets a new link trust a new key.
+*
+* A mutating command that times out is unresolved, not failed: in field data 2
+* of 3 failed writes had executed anyway. So a timed-out command is never sent
+* again. The outcomes a caller can see:
+*
+* - `BluetoothTransportError`: provably never reached the radio. Safe to replay.
+* - `BluetoothCommandFailed`: state proved it did not apply. Safe to replay.
+* - `BluetoothUnconfirmedCommand`: it may have run. Never replay it.
+* - A plain `BluetoothTimeout`: a read, or a step before any write.
+* - Best-effort success, when `raise_unconfirmed` is off and nothing resolved it.
+*   `charge_port_door_open` under `"verify"` is the exception, and raises.
+*/
+var VehicleBluetooth = class extends BroadcastListeners {
+	_transport_name = "bluetooth";
+	authMethod = "aes";
+	/** Reply wait with data. */
+	defaultTimeoutMs = 5e3;
+	/** Reply wait for a VCSEC actuation. A lost ack is inconclusive, so a shorter wait loses nothing. */
+	actuationTimeoutMs = 2e3;
+	/** Wait for data after a bare ack. */
+	ackFollowupTimeoutMs = 2e3;
+	/** How long a command woken by `wake_if_asleep` waits for infotainment. */
+	wakeTimeoutMs = DEFAULT_WAKE_TIMEOUT_MS;
+	/** How often a wake is resent while infotainment stays silent. */
+	wakeResendIntervalMs = WAKE_RESEND_INTERVAL_MS;
+	/** How long an awake car's infotainment may take to finish booting. */
+	infotainmentBootTimeoutMs = INFOTAINMENT_BOOT_TIMEOUT_MS;
+	/** How long a charge-port opening has to show in charge state. */
+	chargePortVerifyTimeoutMs = CHARGE_PORT_VERIFY_TIMEOUT_MS;
+	/** Between charge-state polls. */
+	chargePortVerifyIntervalMs = 250;
+	/** Bound on one keepalive read. */
+	keepaliveTimeoutMs = 2e3;
+	/** The vehicle's BLE name, with the usual `C` suffix. */
+	ble_name;
+	confirmation;
+	raise_unconfirmed;
+	wake_if_asleep;
+	keepalive_interval_ms;
+	transport;
+	queues = {
+		[VCSEC]: new ReplyQueue(),
+		[INFOTAINMENT]: new ReplyQueue()
+	};
+	maxConnectAttempts;
+	connectTimeoutMs;
+	scanTimeoutMs;
+	wakeProbeTimeoutMs;
+	domainSendLock = {
+		[VCSEC]: new AsyncLock(),
+		[INFOTAINMENT]: new AsyncLock()
+	};
+	connectLock = new AsyncLock();
+	broadcastWatchers = {};
+	device;
+	link = null;
+	/** Closing a lost link. A new connect waits for it: a late disconnect could end the new link. */
+	teardown = Promise.resolve();
+	keepaliveTimer = null;
+	/** When GATT traffic last moved, on the monotonic clock. */
+	lastActivity = 0;
+	connected = false;
+	connectionListeners = new ListenerRegistry((message) => this.log(message));
+	constructor(parent, vin, options) {
+		super(parent, vin, options.privateKey);
+		const confirmation = options.confirmation ?? "ack";
+		if (![
+			"optimistic",
+			"ack",
+			"verify"
+		].includes(confirmation)) throw new Error("confirmation must be one of \"optimistic\", \"ack\" or \"verify\".");
+		this.confirmation = confirmation;
+		this.raise_unconfirmed = options.raise_unconfirmed ?? false;
+		this.transport = options.transport;
+		this.device = options.device;
+		this.keepalive_interval_ms = options.keepalive_interval_ms === void 0 ? DEFAULT_KEEPALIVE_INTERVAL_MS : options.keepalive_interval_ms;
+		this.wake_if_asleep = options.wake_if_asleep ?? true;
+		this.maxConnectAttempts = options.max_connect_attempts ?? 3;
+		this.connectTimeoutMs = options.connect_timeout_ms ?? 2e4;
+		this.scanTimeoutMs = options.scan_timeout_ms ?? options.transport.scanTimeoutMs ?? 1e4;
+		this.wakeProbeTimeoutMs = options.wake_probe_timeout_ms ?? 1e3;
+		if (this.wakeProbeTimeoutMs <= 0) throw new RangeError("wake_probe_timeout_ms must be greater than 0.");
+		this.ble_name = get_name(vin);
+	}
+	/** Whether `confirmation` is `"optimistic"`. */
+	get optimistic() {
+		return this.confirmation === "optimistic";
+	}
+	/** Whether `confirmation` is `"verify"`. */
+	get verify_commands() {
+		return this.confirmation === "verify";
+	}
+	/**
+	* Find this vehicle. Never filters by service, because the vehicle advertises
+	* none. A device with free connection slots wins, then the strongest signal.
+	* @throws BluetoothTransportError when the scan fails or finds nothing.
+	*/
+	async find_vehicle({ name, address, timeoutMs = this.scanTimeoutMs } = {}) {
+		const matchesName = (seen) => name !== void 0 ? seen === name : name_matches_vin(seen, this.vin);
+		const accepts = (device) => address !== void 0 ? device.id === address : device.name !== void 0 && matchesName(device.name);
+		let seen;
+		try {
+			seen = await withTimeout(() => this.transport.scan({
+				timeoutMs,
+				matches: address === void 0 ? matchesName : void 0
+			}), timeoutMs);
+		} catch (cause) {
+			throw new BluetoothTransportError(null, null, { cause });
+		}
+		const [device] = seen.filter(accepts).sort((a, b) => Number(a.connectable === false) - Number(b.connectable === false) || (b.rssi ?? -Infinity) - (a.rssi ?? -Infinity));
+		if (!device) throw new BluetoothTransportError("Vehicle not found in the scan.");
+		this.device = device;
+		return device;
+	}
+	/** Assign the device later connections use. */
+	set_device(device) {
+		this.device = device;
+	}
+	/** The device later connections use, if one has been found or set. */
+	get_device() {
+		return this.device;
+	}
+	/**
+	* Connect, unless a link is up. Scans first if no device is known. Python
+	* raises there instead, but a Homey app has no scan of its own to run.
+	* @throws BluetoothTransportError when every attempt fails, with the last failure as `cause`.
+	*/
+	async connect(maxAttempts = this.maxConnectAttempts) {
+		await this.connectLock.run(async () => {
+			const current = this.link;
+			if (current?.connection.isConnected) return;
+			if (current) this.loseLink(current, "backend reports it down");
+			await this.teardown;
+			const device = this.device ?? await this.find_vehicle();
+			let cause;
+			for (let attempt = 1; attempt <= maxAttempts; attempt++) try {
+				await this.teardown;
+				await this.connectOnce(device);
+				return;
+			} catch (error) {
+				this.log(`BLE connect attempt ${attempt}/${maxAttempts} failed: ${describe(error)}`);
+				cause = error;
+			}
+			throw new BluetoothTransportError(null, null, { cause });
+		});
+	}
+	/** Connect if the link is down, as every send does. */
+	async connect_if_needed(maxAttempts = this.maxConnectAttempts) {
+		await this.connect(maxAttempts);
+	}
+	async connectOnce(device) {
+		const link = new Link((message) => this.onMessage(message));
+		const connecting = (async () => this.transport.connect(device, {
+			onNotify: (chunk) => this.onNotify(link, chunk),
+			onDisconnect: () => this.loseLink(link, "backend reported a disconnect")
+		}))();
+		let connection;
+		try {
+			connection = await withTimeout(() => connecting, this.connectTimeoutMs);
+		} catch (error) {
+			link.close();
+			if (error instanceof BleCallTimeout) {
+				const closing = connecting.then((late) => this.closeConnection(late), () => void 0);
+				this.teardown = Promise.all([this.teardown, withTimeout(() => closing, LINK_TEARDOWN_TIMEOUT_MS).catch(() => void 0)]);
+			}
+			throw error;
+		}
+		if (link.lost || !connection.isConnected) {
+			link.close();
+			await this.closeConnection(connection);
+			throw new Error("The link dropped while connecting.");
+		}
+		link.connection = connection;
+		this.link = link;
+		this.startKeepalive();
+		this.setConnected(true);
+	}
+	/** Close a connection, bounded and never throwing: the failure behind it is what gets reported. */
+	async closeConnection(connection) {
+		try {
+			await withTimeout(() => connection.disconnect(), LINK_TEARDOWN_TIMEOUT_MS);
+		} catch (error) {
+			this.log(`BLE link teardown failed: ${describe(error)}`);
+		}
+	}
+	/**
+	* Mark a link lost and start closing it. Only the current link has state to
+	* clear, so a late event from an old link or an abandoned attempt ends there.
+	*/
+	loseLink(link, reason) {
+		link.close();
+		if (this.link !== link) return;
+		this.link = null;
+		this.log(`BLE link lost: ${reason}`);
+		this.stopKeepalive();
+		this.teardown = Promise.all([this.teardown, this.closeConnection(link.connection)]);
+		this.setConnected(false);
+	}
+	/** Tear down the link and wait for it. The next send reconnects. */
+	async dropLink(reason) {
+		if (this.link) this.loseLink(this.link, reason);
+		await this.teardown;
+	}
+	/** Drop the link after a failed session setup, unless the failure never touched it. */
+	async dropLinkOnFailure(reason, error) {
+		if (!(error instanceof SigningDisabled)) await this.dropLink(`${reason}: ${describe(error)}`);
+	}
+	/**
+	* Disconnect, waiting out any connect in progress.
+	* @returns Whether there was a connection.
+	*/
+	async disconnect() {
+		return this.connectLock.run(async () => {
+			const connected = this.link !== null;
+			await this.dropLink("disconnect");
+			return connected;
+		});
+	}
+	/**
+	* Listen for the link coming up and going down. `true` fires once
+	* notifications are live, and `false` once the link is lost, for any reason
+	* and however it was noticed. Only real changes fire. A backend that drops
+	* silently makes `false` as late as the next operation to time out.
+	*/
+	listen_connection_status(callback) {
+		return this.connectionListeners.add(callback);
+	}
+	setConnected(connected) {
+		if (this.connected !== connected) {
+			this.connected = connected;
+			this.connectionListeners.emit(connected);
+		}
+	}
+	startKeepalive() {
+		this.stopKeepalive();
+		if (this.keepalive_interval_ms) {
+			this.lastActivity = performance.now();
+			this.scheduleKeepalive(this.keepalive_interval_ms);
+		}
+	}
+	stopKeepalive() {
+		if (this.keepaliveTimer !== null) {
+			clearTimeout(this.keepaliveTimer);
+			this.keepaliveTimer = null;
+		}
+	}
+	scheduleKeepalive(intervalMs) {
+		const idleMs = performance.now() - this.lastActivity;
+		this.keepaliveTimer = setTimeout(() => void this.keepaliveTick(intervalMs), Math.max(0, intervalMs - idleMs));
+		this.keepaliveTimer.unref?.();
+	}
+	/** Idle-triggered, so an active link pays nothing. It never raises, never reconnects and never wakes the car. */
+	async keepaliveTick(intervalMs) {
+		this.keepaliveTimer = null;
+		const link = this.link;
+		if (!link) return;
+		if (performance.now() - this.lastActivity >= intervalMs) {
+			await this.keepaliveRead(link);
+			this.lastActivity = performance.now();
+		}
+		if (this.link === link) this.scheduleKeepalive(intervalMs);
+	}
+	/**
+	* One bounded read, with every failure swallowed. A read that times out
+	* still marks the link lost, as any read does here: on a backend that
+	* misreports its link, that is how a dead idle link is found before the next
+	* command writes to it. Python only drops the read.
+	*/
+	async keepaliveRead(link) {
+		if (!link.connection.isConnected) {
+			this.loseLink(link, "backend reports it down");
+			return;
+		}
+		try {
+			await this.gattRead("version", this.keepaliveTimeoutMs);
+		} catch (error) {
+			this.log(`BLE keepalive read failed: ${describe(error)}`);
+		}
+	}
+	/** A backend calls this, so it must never throw. */
+	onNotify(link, chunk) {
+		if (link.lost) return;
+		this.lastActivity = performance.now();
+		try {
+			link.buffer.receive(chunk);
+		} catch (error) {
+			this.log(`BLE notification failed: ${describe(error)}`);
+		}
+	}
+	/** Route one whole message: replies to their domain's queue, the rest to whoever listens. */
+	onMessage(message) {
+		const address = message.toDestination?.routingAddress;
+		const domain = message.fromDestination?.domain ?? Domain.DOMAIN_BROADCAST;
+		if (!address || !this.fromDestination.equals(address)) {
+			this.broadcastWatchers[domain]?.onBroadcast(message);
+			this.dispatchBroadcast(domain, message);
+			return;
+		}
+		const queue = this.queues[domain];
+		if (!queue) {
+			this.log(`BLE ignored a reply from unhandled domain ${domain}`);
+			return;
+		}
+		queue.push(message);
+	}
+	/** Write one frame, with its chunks together, each bounded. */
+	writeFrame(link, frame, signal) {
+		const { connection } = link;
+		const maxWriteSize = connection.maxWriteSize === void 0 ? 20 : connection.maxWriteSize;
+		return link.gatt.run(async () => {
+			signal?.throwIfAborted();
+			let written = 0;
+			for (const chunk of splitFrame(frame, maxWriteSize)) {
+				if (link.lost) throw new BleNotSubmittedError("The link was lost before the frame was fully written.");
+				try {
+					await withTimeout(() => connection.write(chunk), GATT_WRITE_TIMEOUT_MS, link.closed.signal);
+				} catch (error) {
+					if (error instanceof BleNotSubmittedError && written > 0) this.loseLink(link, "a frame stopped part way");
+					throw error;
+				}
+				written++;
+				this.lastActivity = performance.now();
+			}
+		});
+	}
+	/**
+	* Read a characteristic, bounded. A rejected or timed-out read marks the link
+	* lost, whatever `isConnected` says, as that is how a dead link is found on a
+	* backend that misreports it. The exception is `BleNotSubmittedError` with the
+	* link reported up: no radio I/O happened, and a stack that hides Generic
+	* Access rejects those reads that way on a healthy link.
+	* @throws BluetoothTransportError when there is no link.
+	*/
+	async gattRead(characteristic, timeoutMs = GATT_READ_TIMEOUT_MS) {
+		const link = this.link;
+		if (!link) throw new BluetoothTransportError();
+		const { connection } = link;
+		return link.gatt.run(async () => {
+			if (link.lost) throw new BluetoothTransportError();
+			try {
+				return await withTimeout(() => connection.read(characteristic), timeoutMs, link.closed.signal);
+			} catch (error) {
+				if (!(error instanceof BleNotSubmittedError) || !connection.isConnected) this.loseLink(link, `read failed: ${describe(error)}`);
+				throw error;
+			}
+		});
+	}
+	async _send(msg, requires, options = {}) {
+		const { expectsData = true, optimistic = false, confirmBroadcast, onSubmitted, signal } = options;
+		const timeoutMs = options.timeoutMs ?? (expectsData ? this.defaultTimeoutMs : this.actuationTimeoutMs);
+		const domain = msg.toDestination?.domain;
+		const lock = domain === void 0 ? void 0 : this.domainSendLock[domain];
+		const queue = domain === void 0 ? void 0 : this.queues[domain];
+		if (domain === void 0 || !lock || !queue) throw new Error(`No Bluetooth reply queue for domain ${domain}.`);
+		return lock.run(async () => {
+			const frame = prependLength(RoutableMessage.encode(msg).finish());
+			for (const stale of queue.drain()) this.log(`BLE discarded a stale reply from domain ${stale.fromDestination?.domain}`);
+			await this.connect_if_needed();
+			const link = this.link;
+			if (!link?.connection.isConnected) {
+				if (link) this.loseLink(link, "backend reports it down");
+				throw new BluetoothTransportError();
+			}
+			const watcher = confirmBroadcast && !optimistic ? this.armBroadcastWatcher(domain, confirmBroadcast) : null;
+			const awaitReply = (signal) => this.awaitReply(queue, msg, requires, expectsData, timeoutMs, signal);
+			const awaitOutcome = () => watcher ? this.awaitReplyOrBroadcast(link, watcher, awaitReply) : awaitReply(link.closed.signal);
+			try {
+				try {
+					await this.writeFrame(link, frame, signal);
+				} catch (error) {
+					if (signal?.aborted && error === signal.reason) throw error;
+					if (error instanceof BleNotSubmittedError) {
+						if (!link.connection.isConnected) this.loseLink(link, describe(error));
+						throw new BluetoothTransportError(null, null, { cause: error });
+					}
+					onSubmitted?.();
+					if (watcher) watcher.writeEnded = true;
+					if (optimistic) {
+						this.loseLink(link, `write failed: ${describe(error)}`);
+						throw new BluetoothTimeout(null, null, { cause: error });
+					}
+					try {
+						return await awaitOutcome();
+					} catch (timeout) {
+						if (!(timeout instanceof BluetoothTimeout)) throw timeout;
+						this.loseLink(link, `write failed: ${describe(error)}`);
+						throw new BluetoothTimeout(timeout.data, timeout.status, { cause: error });
+					}
+				}
+				onSubmitted?.();
+				if (watcher) {
+					watcher.writeEnded = true;
+					watcher.writeComplete = true;
+				}
+				if (optimistic) return RoutableMessage.create({});
+				return await awaitOutcome();
+			} finally {
+				if (watcher && this.broadcastWatchers[domain] === watcher) delete this.broadcastWatchers[domain];
+			}
+		});
+	}
+	/**
+	* Watch for broadcasts showing the requested state. A lost ack does not stop
+	* the car broadcasting the change it caused. Only a status after the write
+	* counts, as one from before it says nothing.
+	*/
+	armBroadcastWatcher(domain, matches) {
+		let resolve;
+		const watcher = {
+			confirmed: new Promise((done) => {
+				resolve = done;
+			}),
+			mismatched: false,
+			writeEnded: false,
+			writeComplete: false,
+			onBroadcast: (message) => {
+				const status = decodeVcsecStatus(message);
+				if (status === null || watcher.confirmation || !watcher.writeEnded) return;
+				const executed = matches(status);
+				if (executed) {
+					watcher.confirmation = message;
+					resolve(message);
+				} else if (executed === false && watcher.writeComplete) watcher.mismatched = true;
+			}
+		};
+		this.broadcastWatchers[domain] = watcher;
+		return watcher;
+	}
+	/**
+	* Race the addressed reply against a matching broadcast. A mismatch does not
+	* fail fast, because it may predate the actuation and a later broadcast can
+	* still confirm it. Only a mismatch still standing when the whole window has
+	* run out proves the command did not apply, and a lost link cuts the window
+	* short, so it proves nothing then.
+	*/
+	async awaitReplyOrBroadcast(link, watcher, awaitReply) {
+		const raceOver = new AbortController();
+		const reply = awaitReply(AbortSignal.any([link.closed.signal, raceOver.signal]));
+		try {
+			const winner = await Promise.race([reply.then(() => "reply", () => "reply"), watcher.confirmed]);
+			if (winner !== "reply") return winner;
+			return await reply;
+		} catch (error) {
+			if (error instanceof BluetoothTimeout) {
+				if (watcher.confirmation) return watcher.confirmation;
+				if (watcher.mismatched && !link.lost) throw new BluetoothCommandFailed(error.data, error.status, { cause: error });
+			}
+			throw error;
+		} finally {
+			raceOver.abort();
+			await reply.catch(() => void 0);
+		}
+	}
+	/**
+	* Wait for the reply carrying `requires`, or a bare ack of this request.
+	* @param signal Ends the wait early, as a timeout does.
+	*/
+	async awaitReply(queue, msg, requires, expectsData, timeoutMs, signal) {
+		const uuid = Buffer.from(msg.uuid);
+		const domain = msg.toDestination?.domain;
+		const hasRequired = (resp) => (requires === "session_info" ? resp.sessionInfo : resp.protobufMessageAsBytes) !== void 0;
+		const deadline = performance.now() + timeoutMs;
+		for (;;) {
+			const resp = await queue.get(deadline - performance.now(), signal);
+			if (resp === null) throw new BluetoothTimeout();
+			if (this.isForeignReply(resp, msg, expectsData)) {
+				this.log(`BLE ignored a reply that is not for this request, domain ${resp.fromDestination?.domain}`);
+				continue;
+			}
+			this.validate_msg(resp, uuid, domain);
+			if (hasRequired(resp)) return resp;
+			if (uuid.length === 0 || !uuid.equals(resp.requestUuid)) continue;
+			if (!expectsData) return resp;
+			const followupDeadline = performance.now() + this.ackFollowupTimeoutMs;
+			for (;;) {
+				const limit = Math.min(followupDeadline, deadline);
+				const followup = await queue.get(limit - performance.now(), signal);
+				if (followup === null) {
+					if (followupDeadline > deadline && !signal.aborted) throw new BluetoothTimeout();
+					return resp;
+				}
+				if (this.isForeignReply(followup, msg, expectsData)) {
+					this.log(`BLE ignored a reply that is not for this request, domain ${followup.fromDestination?.domain}`);
+					continue;
+				}
+				this.validate_msg(followup, uuid, domain);
+				if (hasRequired(followup)) return followup;
+			}
+		}
+	}
+	/**
+	* Whether a reply must be ignored rather than acted on. The link is shared, so
+	* an addressed reply can be a late answer to an earlier request, and acting on
+	* one can resend a command or report one that never ran.
+	*
+	* A reply naming another request is never ours. One naming no request must
+	* still be heard, because real VCSEC leaves `request_uuid` empty, but nothing
+	* ties it to this request unless its session-info tag or its encryption does,
+	* and both of those are checked later. So it may ack a command or answer a
+	* read, and it may not make anything happen: not a resend or a fault, and a
+	* status does not stand in for an actuation's ack.
+	*/
+	isForeignReply(resp, msg, expectsData) {
+		if (resp.requestUuid.length > 0) return !Buffer.from(msg.uuid).equals(resp.requestUuid);
+		if (msg.sessionInfoRequest || resp.sessionInfo && resp.sessionInfo.length > 0) return false;
+		const status = resp.signedMessageStatus;
+		if (status?.operationStatus === OperationStatusE.OPERATIONSTATUS_WAIT || status && status.signedMessageFault !== MessageFaultE.MESSAGEFAULT_ERROR_NONE) return true;
+		if (msg.toDestination?.domain !== VCSEC || !resp.protobufMessageAsBytes || resp.signatureData?.AESGCMResponseData) return false;
+		try {
+			const reply = FromVCSECMessage.decode(resp.protobufMessageAsBytes);
+			return reply.commandStatus?.operationStatus === OperationStatusE$1.OPERATIONSTATUS_WAIT || !expectsData && reply.vehicleStatus !== void 0;
+		} catch {
+			return false;
+		}
+	}
+	/** A session that a reply left unready cannot sign, and that reply proved nothing. */
+	async ensureHandshake(domain) {
+		await super.ensureHandshake(domain);
+		if (!this.sessionFor(domain).ready) throw new BluetoothTimeout();
+	}
+	/** A failed handshake drops the link, so a retry starts on a fresh one. */
+	async handshakeVehicleSecurity() {
+		try {
+			await super.handshakeVehicleSecurity();
+		} catch (error) {
+			await this.dropLinkOnFailure("vehicle security handshake failed", error);
+			throw error;
+		}
+	}
+	/**
+	* A failed handshake drops the link, unless VCSEC reports the car asleep:
+	* its infotainment is meant to be silent then, and that read proves the link.
+	*/
+	async handshakeInfotainment() {
+		try {
+			await super.handshakeInfotainment();
+		} catch (error) {
+			if (!(error instanceof BluetoothTimeout)) await this.dropLinkOnFailure("infotainment handshake failed", error);
+			else if (!await this.vehicleAsleep()) await this.dropLink("infotainment handshake failed");
+			throw error;
+		}
+	}
+	/**
+	* Sign and write a mutating command, with no reply wait. A write that fails
+	* provably before submission still raises. One that entered the backend may
+	* have reached the car, so even here it must not let a router replay it, and
+	* it follows `raise_unconfirmed`.
+	*/
+	async sendOptimistic(domain, command, name) {
+		const session = this.sessionFor(domain);
+		const send = (msg) => this._send(msg, "protobuf_message_as_bytes", { optimistic: true });
+		try {
+			if (domain === VCSEC) await session.withLock(() => send(this.buildMessage(session, command)));
+			else await send(await session.withLock(() => this.buildMessage(session, command)));
+		} catch (error) {
+			if (!(error instanceof BluetoothTimeout)) throw error;
+			return this.unconfirmedOutcome(name, new BluetoothUnconfirmedCommand(error.data, error.status, { cause: error }));
+		}
+		return success();
+	}
+	/** End a ladder that could not determine what happened. */
+	unconfirmedOutcome(name, unconfirmed) {
+		if (this.raise_unconfirmed) throw unconfirmed;
+		this.log(`command=${name} transport=${this._transport_name} raise_unconfirmed=False result=success (best-effort)`);
+		return success();
+	}
+	/**
+	* Confirm a timed-out command by state, when `"verify"` asks for it.
+	* @returns Success, or `null` if the state could not be read. An unreadable car is never woken to verify.
+	* @throws BluetoothCommandFailed when the state shows it did not apply, whatever `raise_unconfirmed` says.
+	*/
+	async verifyTimeout(name, plan, timeout) {
+		if (this.confirmation !== "verify" || !plan) return null;
+		let state;
+		try {
+			state = await this[plan.reader]();
+		} catch (error) {
+			if (error instanceof TeslaFleetError) {
+				this.log(`command=${name} transport=${this._transport_name} verify_commands=unresolved`);
+				return null;
+			}
+			throw error;
+		}
+		const executed = plan.executed(state);
+		if (executed === void 0) {
+			this.log(`command=${name} transport=${this._transport_name} verify_commands=unresolved`);
+			return null;
+		}
+		this.log(`command=${name} transport=${this._transport_name} verify_commands=resolved result=${executed}`);
+		if (!executed) throw new BluetoothCommandFailed(timeout.data, timeout.status, { cause: timeout });
+		return success();
+	}
+	/**
+	* Open the flap or release a cable. Under `"verify"`, the charging subsystem
+	* is made ready first, and only physical state counts as success afterwards:
+	* an opening has been reported waking a sleeping car without releasing the
+	* latch. No readiness failure has sent anything, so a router may fail over on
+	* any of them. Once the one opening write has gone, an unresolved result always
+	* raises `BluetoothUnconfirmedCommand`, whatever `raise_unconfirmed` says, and
+	* it is never sent again: a best-effort success would hide a latch that never
+	* released, and a replay could release a cable the caller had plugged back in.
+	* Other modes keep the ordinary VCSEC ladder.
+	* @throws BluetoothCommandFailed when the car is asleep with `wake_if_asleep` off, or the cable state is unknown.
+	* @throws BluetoothTimeout when the car is not ready in time.
+	* @throws BluetoothUnconfirmedCommand when physical state never showed the opening.
+	*/
+	async charge_port_door_open() {
+		if (this.confirmation !== "verify") return super.charge_port_door_open();
+		const connected = await this.chargePortPreflight();
+		let cause;
+		let submitted = false;
+		try {
+			const result = await super.sendVehicleSecurity(UnsignedMessage.create({ closureMoveRequest: ClosureMoveRequest.create({ chargePort: ClosureMoveTypeE.CLOSURE_MOVE_TYPE_OPEN }) }), { onSubmitted: () => submitted = true });
+			if (result.response.result === false) return result;
+		} catch (error) {
+			if (!submitted || !leavesOutcomeUnknown(error)) throw error;
+			cause = error;
+		}
+		return this.verifyChargePortOpened(connected, cause);
+	}
+	/**
+	* Everything before the opening, under one `wakeTimeoutMs` deadline.
+	* @returns Whether a cable is connected, which picks the proof of success.
+	*/
+	async chargePortPreflight() {
+		const deadline = performance.now() + this.wakeTimeoutMs;
+		const over = new AbortController();
+		try {
+			const connected = await withTimeout(() => this.chargePortReadiness(over.signal), this.wakeTimeoutMs);
+			try {
+				await withTimeout(() => this.ensureHandshake(VCSEC), deadline - performance.now());
+			} catch (error) {
+				await this.dropLinkOnFailure("vehicle security handshake failed", error);
+				throw error;
+			}
+			return connected;
+		} catch (error) {
+			if (error instanceof BleCallTimeout) throw new BluetoothTimeout("Charge-port readiness timed out", null, { cause: error });
+			throw error;
+		} finally {
+			over.abort();
+		}
+	}
+	async chargePortReadiness(over) {
+		if (await this.vehicleAsleep()) {
+			if (!this.wake_if_asleep) throw new BluetoothCommandFailed("Vehicle asleep; wake disabled");
+			await this.wakeForCommand(new BluetoothTimeout());
+		} else await this.awaitInfotainment(this.infotainmentBootTimeoutMs, false, over);
+		for (;;) {
+			try {
+				const connected = chargePortConnected(await this.charge_state());
+				if (connected === null) throw new BluetoothCommandFailed("Charge-port cable state unknown; no opening command sent");
+				return connected;
+			} catch (error) {
+				if (error instanceof InvalidResponse) throw new BluetoothCommandFailed("Charge-port cable state unknown; no opening command sent", null, { cause: error });
+				if (!(error instanceof BluetoothTimeout) || over.aborted) throw error;
+			}
+			await sleep(this.chargePortVerifyIntervalMs);
+		}
+	}
+	/**
+	* Poll for the physical result, holding to the goal set before the opening:
+	* an open flap must never stand in for a latch that did not release. Nothing
+	* here may send the opening again, and no failed read may reach a router as
+	* anything but unconfirmed.
+	*/
+	async verifyChargePortOpened(connected, opening) {
+		const name = "closureMoveRequest";
+		const log = (message) => this.log(message);
+		let cause = opening;
+		const deadline = performance.now() + this.chargePortVerifyTimeoutMs;
+		for (let remaining = this.chargePortVerifyTimeoutMs; remaining > 0; remaining = deadline - performance.now()) {
+			try {
+				const after = await withTimeout(() => this.charge_state(), remaining);
+				if (connected ? after.chargePortLatch?.Disengaged !== void 0 : chargePortConnected(after) === false && after.chargePortDoorOpen === true) {
+					log(`command=${name} transport=${this._transport_name} physical_confirmation=confirmed`);
+					logRequestResult(log, name, this._transport_name, success());
+					return success();
+				}
+			} catch (error) {
+				if (!(error instanceof BleCallTimeout)) cause = error;
+			}
+			await sleep(Math.min(this.chargePortVerifyIntervalMs, Math.max(0, deadline - performance.now())));
+		}
+		const unconfirmed = new BluetoothUnconfirmedCommand("Charge-port opening was not confirmed by physical state", null, { cause });
+		log(`command=${name} transport=${this._transport_name} physical_confirmation=unconfirmed`);
+		logRequestError(log, name, this._transport_name, unconfirmed);
+		throw unconfirmed;
+	}
+	/**
+	* Send a VCSEC actuation through the confirmation ladder. A plan's check also
+	* races the ack, so `options` is ignored: the plan is the only source of it.
+	*/
+	async sendVehicleSecurity(command, _options = {}) {
+		try {
+			await this.ensureHandshake(VCSEC);
+		} catch (error) {
+			await this.dropLinkOnFailure("vehicle security handshake failed", error);
+			throw error;
+		}
+		const name = vcsec_command_name(command);
+		if (this.confirmation === "optimistic") return this.sendOptimistic(VCSEC, Buffer.from(UnsignedMessage.encode(command).finish()), name);
+		const plan = vcsecVerifyPlan(command);
+		let submitted = false;
+		try {
+			return await super.sendVehicleSecurity(command, {
+				confirmBroadcast: plan?.executed,
+				onSubmitted: () => submitted = true
+			});
+		} catch (error) {
+			if (!submitted || !leavesOutcomeUnknown(error)) throw error;
+			const unconfirmed = new BluetoothUnconfirmedCommand(null, null, { cause: error });
+			return await this.verifyTimeout(name, plan, unconfirmed) ?? this.unconfirmedOutcome(name, unconfirmed);
+		}
+	}
+	/**
+	* Send an infotainment command through the confirmation ladder. `mutating:
+	* false` is exempt: `ping` always waits for its real reply.
+	*/
+	async sendInfotainment(action, { mutating = true } = {}) {
+		return this.infotainmentLadder(action, mutating, this.wake_if_asleep);
+	}
+	async infotainmentLadder(action, mutating, wake) {
+		try {
+			await this.ensureHandshake(INFOTAINMENT);
+		} catch (error) {
+			if (!(error instanceof BluetoothTimeout)) {
+				await this.dropLinkOnFailure("infotainment handshake failed", error);
+				throw error;
+			}
+			const sleepStatus = await this.sleepStatus();
+			if (sleepStatus === VehicleSleepStatusE.VEHICLE_SLEEP_STATUS_ASLEEP) {
+				if (!wake) throw error;
+				await this.wakeForCommand(error);
+				wake = false;
+			} else if (sleepStatus === VehicleSleepStatusE.VEHICLE_SLEEP_STATUS_AWAKE) try {
+				await this.awaitInfotainment(this.infotainmentBootTimeoutMs, false);
+			} catch (bootError) {
+				if (!(bootError instanceof BluetoothTimeout)) throw bootError;
+				await this.dropLink("infotainment handshake failed");
+				throw error;
+			}
+			else {
+				await this.dropLink("infotainment handshake failed");
+				throw error;
+			}
+		}
+		const name = infotainment_command_name(action);
+		if (this.confirmation === "optimistic" && mutating) return this.sendOptimistic(INFOTAINMENT, Buffer.from(Action.encode(action).finish()), name);
+		let submitted = false;
+		try {
+			return await super.sendInfotainment(action, { onSubmitted: () => submitted = true });
+		} catch (error) {
+			if (!mutating || !submitted || !leavesOutcomeUnknown(error)) throw error;
+			const unconfirmed = new BluetoothUnconfirmedCommand(null, null, { cause: error });
+			const verified = await this.verifyTimeout(name, infotainmentVerifyPlan(action.vehicleAction), unconfirmed);
+			if (verified) return verified;
+			if (!this.raise_unconfirmed && await this.vehicleAsleep()) {
+				if (!wake) throw new BluetoothCommandFailed(null, null, { cause: error });
+				await this.wakeForCommand(unconfirmed);
+				return this.infotainmentLadder(action, mutating, false);
+			}
+			return this.unconfirmedOutcome(name, unconfirmed);
+		}
+	}
+	/**
+	* Wake a sleeping car until infotainment can take a command.
+	* @throws BluetoothCommandFailed when it cannot: the command provably never ran.
+	*/
+	async wakeForCommand(timeout) {
+		try {
+			await this.wake_up({
+				wait: true,
+				timeoutMs: this.wakeTimeoutMs
+			});
+		} catch (cause) {
+			if (cause instanceof TeslaFleetError) throw new BluetoothCommandFailed(timeout.data, timeout.status, { cause });
+			throw cause;
+		}
+	}
+	/** VCSEC's sleep status, or `null` if unreadable. */
+	async sleepStatus() {
+		try {
+			return (await this.vehicle_state()).vehicleSleepStatus;
+		} catch (error) {
+			if (error instanceof TeslaFleetError) return null;
+			throw error;
+		}
+	}
+	/** Whether VCSEC reports the car asleep; `false` if unreadable. */
+	async vehicleAsleep() {
+		return await this.sleepStatus() === VehicleSleepStatusE.VEHICLE_SLEEP_STATUS_ASLEEP;
+	}
+	/** The vehicle security computer's `VehicleStatus`. It answers while the car sleeps. */
+	async vehicle_state() {
+		return this._getVehicleSecurity(UnsignedMessage.create({ InformationRequest: InformationRequest.create({ informationRequestType: InformationRequestType.INFORMATION_REQUEST_TYPE_GET_STATUS }) }));
+	}
+	async readVehicleData(request, field) {
+		const value = (await this._getInfotainment(Action.create({ vehicleAction: VehicleAction.create({ getVehicleData: GetVehicleData.create(request) }) })))[field];
+		if (value === void 0 || value === null) throw new InvalidResponse({ missing: field });
+		return value;
+	}
+	/** The charging state. */
+	async charge_state() {
+		return this.readVehicleData({ getChargeState: GetChargeState.create({}) }, "chargeState");
+	}
+	/** The HVAC and cabin climate state. */
+	async climate_state() {
+		return this.readVehicleData({ getClimateState: GetClimateState.create({}) }, "climateState");
+	}
+	/** The driving state, including speed and power. */
+	async drive_state() {
+		return this.readVehicleData({ getDriveState: GetDriveState.create({}) }, "driveState");
+	}
+	/** The vehicle's location. */
+	async location_state() {
+		return this.readVehicleData({ getLocationState: GetLocationState.create({}) }, "locationState");
+	}
+	/** The doors, windows, trunks and locks, as infotainment reports them. */
+	async closures_state() {
+		return this.readVehicleData({ getClosuresState: GetClosuresState.create({}) }, "closuresState");
+	}
+	/** The charge schedules. */
+	async charge_schedule_state() {
+		return this.readVehicleData({ getChargeScheduleState: GetChargeScheduleState.create({}) }, "chargeScheduleState");
+	}
+	/** The preconditioning schedules. */
+	async preconditioning_schedule_state() {
+		return this.readVehicleData({ getPreconditioningScheduleState: GetPreconditioningScheduleState.create({}) }, "preconditioningScheduleState");
+	}
+	/** The tire pressures. */
+	async tire_pressure_state() {
+		return this.readVehicleData({ getTirePressureState: GetTirePressureState.create({}) }, "tirePressureState");
+	}
+	/** The media playback state. */
+	async media_state() {
+		return this.readVehicleData({ getMediaState: GetMediaState.create({}) }, "mediaState");
+	}
+	/** Detail on the media playing now. */
+	async media_detail_state() {
+		return this.readVehicleData({ getMediaDetailState: GetMediaDetailState.create({}) }, "mediaDetailState");
+	}
+	/** The software update state. */
+	async software_update_state() {
+		return this.readVehicleData({ getSoftwareUpdateState: GetSoftwareUpdateState.create({}) }, "softwareUpdateState");
+	}
+	/** The parental controls state. */
+	async parental_controls_state() {
+		return this.readVehicleData({ getParentalControlsState: GetParentalControlsState.create({}) }, "parentalControlsState");
+	}
+	/** The display units and formats. */
+	async gui_settings() {
+		return this.readVehicleData({ getGuiSettings: GetGuiSettings.create({}) }, "guiSettings");
+	}
+	/** The state of parked accessories, such as a tent. */
+	async parked_accessory_state() {
+		return this.readVehicleData({ getParkedAccessoryState: GetParkedAccessoryState.create({}) }, "parkedAccessoryState");
+	}
+	/**
+	* The older infotainment vehicle state, tag 6, for older firmware. Not `current_vehicle_state`, nor VCSEC's `vehicle_state`.
+	*/
+	async legacy_vehicle_state() {
+		return this.readVehicleData({ getLegacyVehicleState: GetLegacyVehicleState.create({}) }, "legacyVehicleState");
+	}
+	/**
+	* The infotainment vehicle state, tag 18, on current firmware. Not `legacy_vehicle_state`, nor VCSEC's `vehicle_state`.
+	*/
+	async current_vehicle_state() {
+		return this.readVehicleData({ getVehicleState: GetVehicleState.create({}) }, "vehicleState");
+	}
+	/** The vehicle's fixed configuration. */
+	async vehicle_config() {
+		return this.readVehicleData({ getVehicleConfig: GetVehicleConfig.create({}) }, "vehicleConfig");
+	}
+	/** The battery state of health. */
+	async soh_state() {
+		return this.readVehicleData({ getSohState: GetSohState.create({}) }, "sohState");
+	}
+	/** The vehicle's name and software details. */
+	async vehicle_detail_state() {
+		return this.readVehicleData({ getVehicleDetailState: GetVehicleDetailState.create({}) }, "vehicleDetailState");
+	}
+	/** The display state. */
+	async display_state() {
+		return this.readVehicleData({ getDisplayState: GetDisplayState.create({}) }, "displayState");
+	}
+	/** The active alerts. */
+	async alert_state() {
+		return this.readVehicleData({ getAlertState: GetAlertState.create({}) }, "alertState");
+	}
+	/** The light show state. */
+	async light_show_state() {
+		return this.readVehicleData({ getLightShowState: GetLightShowState.create({}) }, "lightShowState");
+	}
+	/** The suspension state. */
+	async suspension_state() {
+		return this.readVehicleData({ getSuspensionState: GetSuspensionState.create({}) }, "suspensionState");
+	}
+	/** The child presence detection state. */
+	async child_presence_detection_state() {
+		return this.readVehicleData({ getChildPresenceDetectionState: GetChildPresenceDetectionState.create({}) }, "childPresenceDetectionState");
+	}
+	/**
+	* Several sub-states in one signed read. This is not the cloud method: it
+	* takes `BluetoothVehicleData` values, not `VehicleDataEndpoint`, and resolves
+	* to `VehicleData`, not a REST envelope. There is no default of every endpoint,
+	* because as few as two together have exceeded the response size limit, which
+	* raises `TeslaFleetMessageFaultResponseSizeExceedsMTU`. Prefer one reader each.
+	* @param endpoints An explicit list. `[]` asks for nothing.
+	* @throws BluetoothCloudUnavailableError for anything else, sending nothing: no argument and REST endpoint names are the cloud call, which a router can fail over to.
+	*/
+	async vehicle_data(endpoints) {
+		const known = Object.values(BluetoothVehicleData);
+		if (!Array.isArray(endpoints) || !endpoints.every((endpoint) => known.includes(endpoint))) throw new BluetoothCloudUnavailableError();
+		const request = {};
+		for (const endpoint of endpoints) request[`${endpoint[0].toLowerCase()}${endpoint.slice(1)}`] = {};
+		return this._getInfotainment(Action.create({ vehicleAction: VehicleAction.create({ getVehicleData: GetVehicleData.create(request) }) }));
+	}
+	/**
+	* The name set in the vehicle, read from GATT Device Name. It is not advertised.
+	* The vehicle prefixes it with a key emoji once it is available.
+	* @returns The name, or `null` if it never appeared: a backend may hide Generic Access.
+	*/
+	async query_display_name(max_attempts = 5) {
+		for (let attempt = 1; attempt <= max_attempts; attempt++) try {
+			await this.connect_if_needed();
+			const name = Buffer.from(await this.gattRead("deviceName")).toString("utf8");
+			if (name.startsWith(DISPLAY_NAME_PREFIX)) return name.slice(3);
+			await sleep(DISPLAY_NAME_RETRY_MS);
+		} catch (error) {
+			this.log(`BLE display name read failed: ${describe(error)}`);
+		}
+		return null;
+	}
+	/** GATT Appearance, or `null` if it cannot be read. */
+	async query_appearance() {
+		try {
+			await this.connect_if_needed();
+			return await this.gattRead("appearance");
+		} catch (error) {
+			this.log(`BLE appearance read failed: ${describe(error)}`);
+			return null;
+		}
+	}
+	/** The version characteristic as a big-endian integer, or `null` if it cannot be read. */
+	async query_version() {
+		try {
+			await this.connect_if_needed();
+			const version = await this.gattRead("version");
+			return version.length === 0 ? null : version.reduce((value, byte) => value * 256 + byte, 0);
+		} catch (error) {
+			this.log(`BLE version read failed: ${describe(error)}`);
+			return null;
+		}
+	}
+	moveClosure(closure, move) {
+		return this.sendVehicleSecurity(UnsignedMessage.create({ closureMoveRequest: ClosureMoveRequest.create({ [closure]: move }) }));
+	}
+	/** Opens the front driver door. */
+	async open_front_driver_door() {
+		return this.moveClosure("frontDriverDoor", ClosureMoveTypeE.CLOSURE_MOVE_TYPE_OPEN);
+	}
+	/** Closes the front driver door. Doors have no reliable powered close on a Model 3. */
+	async close_front_driver_door() {
+		return this.moveClosure("frontDriverDoor", ClosureMoveTypeE.CLOSURE_MOVE_TYPE_CLOSE);
+	}
+	/** Opens the front passenger door. */
+	async open_front_passenger_door() {
+		return this.moveClosure("frontPassengerDoor", ClosureMoveTypeE.CLOSURE_MOVE_TYPE_OPEN);
+	}
+	/** Closes the front passenger door. Doors have no reliable powered close on a Model 3. */
+	async close_front_passenger_door() {
+		return this.moveClosure("frontPassengerDoor", ClosureMoveTypeE.CLOSURE_MOVE_TYPE_CLOSE);
+	}
+	/** Opens the rear driver door. */
+	async open_rear_driver_door() {
+		return this.moveClosure("rearDriverDoor", ClosureMoveTypeE.CLOSURE_MOVE_TYPE_OPEN);
+	}
+	/** Closes the rear driver door. Doors have no reliable powered close on a Model 3. */
+	async close_rear_driver_door() {
+		return this.moveClosure("rearDriverDoor", ClosureMoveTypeE.CLOSURE_MOVE_TYPE_CLOSE);
+	}
+	/** Opens the rear passenger door. */
+	async open_rear_passenger_door() {
+		return this.moveClosure("rearPassengerDoor", ClosureMoveTypeE.CLOSURE_MOVE_TYPE_OPEN);
+	}
+	/** Closes the rear passenger door. Doors have no reliable powered close on a Model 3. */
+	async close_rear_passenger_door() {
+		return this.moveClosure("rearPassengerDoor", ClosureMoveTypeE.CLOSURE_MOVE_TYPE_CLOSE);
+	}
+	/** Opens the rear trunk. */
+	async open_rear_trunk() {
+		return this.moveClosure("rearTrunk", ClosureMoveTypeE.CLOSURE_MOVE_TYPE_OPEN);
+	}
+	/** Closes the rear trunk. */
+	async close_rear_trunk() {
+		return this.moveClosure("rearTrunk", ClosureMoveTypeE.CLOSURE_MOVE_TYPE_CLOSE);
+	}
+	/**
+	* Ask the vehicle to add this instance's key, which someone confirms by tapping
+	* a key card on the console. Resolves once the key is on the whitelist.
+	*
+	* The whitelist operation is written exactly once, because a resend prompts
+	* the user again. Its reply is one frame, which a link that cycles during the
+	* walk to the car can lose, so completion is also proved by polling: a VCSEC
+	* handshake only succeeds once this key is whitelisted, and it reconnects, so
+	* the wait survives a dropped link.
+	*
+	* Success needs positive evidence: an explicit success reply, or an
+	* authenticated handshake with this key. Python takes any reply without a
+	* whitelist fault, which a WAIT or a bare ack satisfies before the tap.
+	*
+	* Tesla's Go SDK sends a bare `ToVCSECMessage` here. This wraps the
+	* `UnsignedMessage` in a `RoutableMessage`, as Python does, and that has paired
+	* a real car. If pairing fails on another vehicle, look there first.
+	* @throws RangeError when `pollIntervalMs` is not positive, before anything is sent.
+	* @throws SigningDisabled when this instance has no key, before anything is sent.
+	* @throws BluetoothTimeout when nothing confirmed it by `timeoutMs`, with the link dropped.
+	* @throws WhitelistOperationStatus or a subclass when the vehicle refused the key.
+	* @throws The reason of `signal`, once it aborts. The link is kept.
+	*/
+	async pair({ role = Role.ROLE_OWNER, form = KeyFormFactor.KEY_FORM_FACTOR_CLOUD_KEY, timeoutMs = DEFAULT_PAIR_TIMEOUT_MS, pollIntervalMs = DEFAULT_PAIR_POLL_INTERVAL_MS, signal } = {}) {
+		if (pollIntervalMs <= 0) throw new RangeError("pollIntervalMs must be greater than 0");
+		if (this.publicKey.length === 0) throw new SigningDisabled();
+		signal?.throwIfAborted();
+		const request = UnsignedMessage.create({ WhitelistOperation: WhitelistOperation.fromPartial({
+			addKeyToWhitelistAndAddPermissions: {
+				key: { PublicKeyRaw: this.publicKey },
+				keyRole: role
+			},
+			metadataForKey: { keyFormFactor: form }
+		}) });
+		const msg = RoutableMessage.create({
+			toDestination: { domain: VCSEC },
+			fromDestination: { routingAddress: this.fromDestination },
+			protobufMessageAsBytes: UnsignedMessage.encode(request).finish(),
+			uuid: crypto.randomBytes(16)
+		});
+		try {
+			await this.confirmPairing(msg, timeoutMs, pollIntervalMs, signal);
+		} catch (error) {
+			if (!signal?.aborted) await this.dropLinkOnFailure("pairing failed", error);
+			throw error;
+		}
+	}
+	async confirmPairing(msg, timeoutMs, pollIntervalMs, signal) {
+		const deadline = performance.now() + timeoutMs;
+		try {
+			const send = this._send(msg, "protobuf_message_as_bytes", {
+				timeoutMs: Math.max(0, Math.min(pollIntervalMs, deadline - performance.now())),
+				signal
+			});
+			if (this.whitelistReplyConfirms(await abortable(send, signal))) return;
+		} catch (error) {
+			if (!(error instanceof BluetoothTimeout)) throw error;
+		}
+		const confirmed = async () => this.consumeLateWhitelistReply() || await abortable(this.pairProbe(signal), signal);
+		while (performance.now() < deadline) {
+			signal?.throwIfAborted();
+			if (await confirmed()) return;
+			const remaining = deadline - performance.now();
+			if (remaining <= 0) break;
+			await sleep(Math.min(pollIntervalMs, remaining), signal);
+		}
+		signal?.throwIfAborted();
+		if (await confirmed()) return;
+		throw new BluetoothTimeout();
+	}
+	/**
+	* Whether this key is on the whitelist: a VCSEC handshake only completes once
+	* it is. Any failure means "not yet", so polling carries on across a dropped
+	* link. It sends one request, unlike `handshake`, because the next poll is the
+	* retry, and nothing may be written after a `pair` is aborted.
+	*/
+	async pairProbe(signal) {
+		const session = this.sessionFor(VCSEC);
+		try {
+			return await session.withLock(async () => {
+				const reply = await this._send(this.sessionInfoRequest(VCSEC), "session_info", { signal });
+				return session.ready && (reply.sessionInfo?.length ?? 0) > 0;
+			});
+		} catch (error) {
+			if (error instanceof TeslaFleetError) return false;
+			throw error;
+		}
+	}
+	/**
+	* Look for a whitelist reply that arrived after `_send` stopped waiting. This
+	* must run before a probe, whose `_send` discards what is queued. Anything else
+	* in the queue stays there.
+	* @returns Whether one was there and explicitly reported success.
+	* @throws WhitelistOperationStatus or a subclass when it reported a refusal.
+	*/
+	consumeLateWhitelistReply() {
+		const queue = this.queues[VCSEC];
+		let reply;
+		for (const queued of queue.drain()) if (reply === void 0 && isWhitelistReply(queued)) reply = queued;
+		else queue.push(queued);
+		return reply !== void 0 && this.whitelistReplyConfirms(reply);
+	}
+	/**
+	* Whether a reply to the whitelist operation says the key was added. Only an
+	* OK with a whitelist status and no failure does. A WAIT means the car is
+	* still waiting for the tap, and a bare ack, a status or anything else says
+	* nothing, so `pair` goes on polling.
+	* @throws WhitelistOperationStatus or a subclass when the reply is a refusal.
+	*/
+	whitelistReplyConfirms(reply) {
+		let message;
+		try {
+			message = FromVCSECMessage.decode(reply.protobufMessageAsBytes ?? /* @__PURE__ */ new Uint8Array());
+		} catch {
+			return false;
+		}
+		const whitelist = message.commandStatus?.whitelistOperationStatus;
+		this.raiseWhitelistFault(whitelist?.whitelistOperationInformation);
+		const { OPERATIONSTATUS_ERROR, OPERATIONSTATUS_OK } = OperationStatusE$1;
+		if (message.nominalError || message.commandStatus?.operationStatus === OPERATIONSTATUS_ERROR || whitelist?.operationStatus === OPERATIONSTATUS_ERROR) throw new WhitelistOperationStatus("The vehicle refused the whitelist operation.");
+		return message.commandStatus?.operationStatus === OPERATIONSTATUS_OK && whitelist?.operationStatus === OPERATIONSTATUS_OK;
+	}
+	/**
+	* Wake the vehicle. Takes `VehicleSpecific`'s options, but resolves to a
+	* `CommandResponse`, not the REST `VehicleResponse`.
+	*
+	* Without `wait`, this sends the RKE wake to the vehicle security computer,
+	* which acks well before infotainment can answer, so an infotainment command
+	* sent straight after can still time out.
+	*
+	* With `wait`, it blocks until infotainment completes a fresh handshake, the
+	* only proof it can take commands: VCSEC reports awake seconds before that.
+	* The wake is idempotent, so it is resent every 3 s until then.
+	* @param options.timeoutMs Deadline for `wait`, in milliseconds. Defaults to 30000.
+	* @throws BluetoothTimeout at the deadline, with the link dropped.
+	*/
+	async wake_up({ wait = false, timeoutMs = DEFAULT_WAKE_TIMEOUT_MS } = {}) {
+		if (!wait) return this.sendVehicleSecurity(UnsignedMessage.create({ RKEAction: RKEActionE.RKE_ACTION_WAKE_VEHICLE }));
+		try {
+			await this.awaitInfotainment(timeoutMs, true);
+		} catch (error) {
+			await this.dropLinkOnFailure("wake failed", error);
+			throw error;
+		}
+		return success();
+	}
+	/**
+	* Probe infotainment until it answers. With `wake`, the RKE wake is sent
+	* first and resent every `wakeResendIntervalMs`.
+	* @param over Stops the probing, for a caller that has stopped waiting.
+	* @throws BluetoothTimeout at the deadline.
+	*/
+	async awaitInfotainment(timeoutMs, wake, over) {
+		const deadline = performance.now() + timeoutMs;
+		let nextWake = performance.now();
+		for (;;) {
+			if (wake && performance.now() >= nextWake) {
+				try {
+					await this.wake_up();
+				} catch (error) {
+					if (!(error instanceof BluetoothTimeout)) throw error;
+				}
+				nextWake = performance.now() + this.wakeResendIntervalMs;
+			}
+			const remaining = deadline - performance.now();
+			if (remaining <= 0 || over?.aborted) throw new BluetoothTimeout();
+			try {
+				await this.probeInfotainment(Math.min(this.wakeProbeTimeoutMs, remaining));
+				return;
+			} catch (error) {
+				if (!(error instanceof BluetoothTimeout || error instanceof SessionInfoAuthenticationFault)) throw error;
+			}
+		}
+	}
+	/**
+	* Handshake with infotainment, always with a fresh request: only a live reply
+	* proves it is awake, so a cached session counts for nothing.
+	*/
+	async probeInfotainment(timeoutMs) {
+		if (this.publicKey.length === 0) throw new SigningDisabled();
+		await this._send(this.sessionInfoRequest(INFOTAINMENT), "session_info", { timeoutMs });
+		if (!this.sessionFor(INFOTAINMENT).ready) throw new BluetoothTimeout();
+	}
+};
+function isWhitelistReply(reply) {
+	try {
+		return FromVCSECMessage.decode(reply.protobufMessageAsBytes ?? /* @__PURE__ */ new Uint8Array()).commandStatus?.whitelistOperationStatus !== void 0;
+	} catch {
+		return false;
+	}
+}
+/**
+* Whether a failure after a write says nothing about whether the command ran.
+* Only a car-side refusal rules that out, as the only `TeslaFleetError`s not
+* listed here are. A silent, unauthenticated, replayed or undecodable reply
+* proves nothing, a key fault may be a stale reply, a reply too big for the MTU
+* can follow execution, and a transport failure now belongs to a resend, after
+* the first frame was written. A router fails over on several of these, which is
+* right before a write and a double execution after one, so the ladders turn all
+* of them into an unresolved outcome first.
+*/
+function leavesOutcomeUnknown(error) {
+	return !(error instanceof TeslaFleetError) || error instanceof BluetoothTimeout || error instanceof BluetoothTransportError || error instanceof NotOnWhitelistFault || error instanceof SessionInfoAuthenticationFault || error instanceof SignedCommandResponseReplayed || error instanceof TeslaFleetMessageFaultResponseSizeExceedsMTU;
+}
+/** An error's class and message, for a log line. */
+function describe(error) {
+	return error instanceof Error ? `${error.name}: ${error.message}` : String(error);
+}
+export { VehicleBluetooth as default };