zwave-js 13.2.0 → 13.3.1

package/build/lib/controller/Controller.js

@@ -21,7 +21,6 @@ const deferred_promise_1 = require("alcalzone-shared/deferred-promise");
 const math_1 = require("alcalzone-shared/math");
 const typeguards_1 = require("alcalzone-shared/typeguards");
 const node_crypto_1 = __importDefault(require("node:crypto"));
-const node_util_1 = __importDefault(require("node:util"));
 const NetworkCache_1 = require("../driver/NetworkCache");
 const DeviceClass_1 = require("../node/DeviceClass");
 const Node_1 = require("../node/Node");
@@ -60,12 +59,14 @@ const RemoveFailedNodeMessages_1 = require("../serialapi/network-mgmt/RemoveFail
 const RemoveNodeFromNetworkRequest_1 = require("../serialapi/network-mgmt/RemoveNodeFromNetworkRequest");
 const ReplaceFailedNodeRequest_1 = require("../serialapi/network-mgmt/ReplaceFailedNodeRequest");
 const RequestNodeNeighborUpdateMessages_1 = require("../serialapi/network-mgmt/RequestNodeNeighborUpdateMessages");
+const SetLearnModeMessages_1 = require("../serialapi/network-mgmt/SetLearnModeMessages");
 const SetPriorityRouteMessages_1 = require("../serialapi/network-mgmt/SetPriorityRouteMessages");
 const SetSUCNodeIDMessages_1 = require("../serialapi/network-mgmt/SetSUCNodeIDMessages");
 const ExtNVMReadLongBufferMessages_1 = require("../serialapi/nvm/ExtNVMReadLongBufferMessages");
 const ExtNVMReadLongByteMessages_1 = require("../serialapi/nvm/ExtNVMReadLongByteMessages");
 const ExtNVMWriteLongBufferMessages_1 = require("../serialapi/nvm/ExtNVMWriteLongBufferMessages");
 const ExtNVMWriteLongByteMessages_1 = require("../serialapi/nvm/ExtNVMWriteLongByteMessages");
+const ExtendedNVMOperationsMessages_1 = require("../serialapi/nvm/ExtendedNVMOperationsMessages");
 const FirmwareUpdateNVMMessages_1 = require("../serialapi/nvm/FirmwareUpdateNVMMessages");
 const GetNVMIdMessages_1 = require("../serialapi/nvm/GetNVMIdMessages");
 const NVMOperationsMessages_1 = require("../serialapi/nvm/NVMOperationsMessages");
@@ -93,6 +94,7 @@ let ZWaveController = class ZWaveController extends shared_1.TypedEventEmitter {
         driver.registerRequestHandler(serial_1.FunctionType.AddNodeToNetwork, this.handleAddNodeStatusReport.bind(this));
         driver.registerRequestHandler(serial_1.FunctionType.RemoveNodeFromNetwork, this.handleRemoveNodeStatusReport.bind(this));
         driver.registerRequestHandler(serial_1.FunctionType.ReplaceFailedNode, this.handleReplaceNodeStatusReport.bind(this));
+        driver.registerRequestHandler(serial_1.FunctionType.SetLearnMode, this.handleLearnModeCallback.bind(this));
     }
     _type;
     get type() {
@@ -124,11 +126,36 @@ let ZWaveController = class ZWaveController extends shared_1.TypedEventEmitter {
     get ownNodeId() {
         return this._ownNodeId;
     }
-    _isPrimary;
+    _dsk;
+    /**
+     * The device specific key (DSK) of the controller in binary format.
+     */
+    get dsk() {
+        if (this._dsk == undefined) {
+            const keyPair = this.driver.getLearnModeAuthenticatedKeyPair();
+            const publicKey = (0, core_1.extractRawECDHPublicKey)(keyPair.publicKey);
+            this._dsk = publicKey.subarray(0, 16);
+        }
+        return this._dsk;
+    }
+    /** @deprecated Use {@link role} instead */
     get isPrimary() {
-        return this._isPrimary;
+        switch (this.role) {
+            case core_1.NOT_KNOWN:
+                return core_1.NOT_KNOWN;
+            case core_1.ControllerRole.Primary:
+                return true;
+            default:
+                return false;
+        }
     }
+    // This seems odd, but isPrimary comes from the Serial API init data command,
+    // while isSecondary comes from the GetControllerCapabilities command. They don't really do what their name implies
+    // and sometimes contradict each other...
+    _isPrimary;
+    _isSecondary;
     _isUsingHomeIdFromOtherNetwork;
+    /** @deprecated Use {@link role} instead */
     get isUsingHomeIdFromOtherNetwork() {
         return this._isUsingHomeIdFromOtherNetwork;
     }
@@ -137,6 +164,7 @@ let ZWaveController = class ZWaveController extends shared_1.TypedEventEmitter {
         return this._isSISPresent;
     }
     _wasRealPrimary;
+    /** @deprecated Use {@link role} instead */
     get wasRealPrimary() {
         return this._wasRealPrimary;
     }
@@ -148,6 +176,7 @@ let ZWaveController = class ZWaveController extends shared_1.TypedEventEmitter {
     get isSUC() {
         return this._isSUC;
     }
+    _noNodesIncluded;
     _nodeType;
     get nodeType() {
         return this._nodeType;
@@ -269,6 +298,11 @@ let ZWaveController = class ZWaveController extends shared_1.TypedEventEmitter {
     get supportsTimers() {
         return this._supportsTimers;
     }
+    _supportedRegions;
+    /** Which RF regions are supported by the controller, including information about them */
+    get supportedRegions() {
+        return this._supportedRegions;
+    }
     _rfRegion;
     /** Which RF region the controller is currently set to, or `undefined` if it could not be determined (yet). This value is cached and can be changed through {@link setRFRegion}. */
     get rfRegion() {
@@ -363,6 +397,34 @@ let ZWaveController = class ZWaveController extends shared_1.TypedEventEmitter {
     set powerlevel(value) {
         this._powerlevel = value;
     }
+    /** The role of the controller on the network */
+    get role() {
+        if (this._wasRealPrimary)
+            return core_1.ControllerRole.Primary;
+        // Ideally we'd rely on wasRealPrimary, but there are some older controllers out there where this flag isn't set.
+        if (this._isPrimary && this._isSIS && this._isSecondary === false) {
+            return core_1.ControllerRole.Primary;
+        }
+        switch (this._isSecondary) {
+            case true:
+                return core_1.ControllerRole.Secondary;
+            case false:
+                return core_1.ControllerRole.Inclusion;
+            default:
+                return core_1.NOT_KNOWN;
+        }
+    }
+    /** Returns whether learn mode may be enabled on this controller */
+    get isLearnModePermitted() {
+        // The primary controller may only enter learn mode, if hasn't included nodes yet
+        if (this.role === core_1.ControllerRole.Primary) {
+            return !!this._noNodesIncluded;
+        }
+        else {
+            // Secondary controllers may only enter learn mode if they are not the SUC
+            return this._isSUC === false;
+        }
+    }
     /**
      * @internal
      * Remembers the indicator values set by another node
@@ -549,28 +611,7 @@ let ZWaveController = class ZWaveController extends shared_1.TypedEventEmitter {
             .map((fn) => `\n  · ${serial_1.FunctionType[fn]} (${(0, shared_1.num2hex)(fn)})`)
             .join("")}`);
         // Request additional information about the controller/Z-Wave chip
-        this.driver.controllerLog.print(`querying additional controller information...`);
-        const initData = await this.driver.sendMessage(new GetSerialApiInitDataMessages_1.GetSerialApiInitDataRequest(this.driver));
-        // and remember the new info
-        this._zwaveApiVersion = initData.zwaveApiVersion;
-        this._zwaveChipType = initData.zwaveChipType;
-        this._isPrimary = initData.isPrimary;
-        this._isSIS = initData.isSIS;
-        this._nodeType = initData.nodeType;
-        this._supportsTimers = initData.supportsTimers;
-        // ignore the initVersion, no clue what to do with it
-        this.driver.controllerLog.print(`received additional controller information:
-  Z-Wave API version:         ${this._zwaveApiVersion.version} (${this._zwaveApiVersion.kind})${this._zwaveChipType
-            ? `
-  Z-Wave chip type:           ${typeof this._zwaveChipType === "string"
-                ? this._zwaveChipType
-                : `unknown (type: ${(0, shared_1.num2hex)(this._zwaveChipType.type)}, version: ${(0, shared_1.num2hex)(this._zwaveChipType.version)})`}`
-            : ""}
-  node type                   ${(0, shared_1.getEnumMemberName)(core_1.NodeType, this._nodeType)}
-  controller role:            ${this._isPrimary ? "primary" : "secondary"}
-  controller is the SIS:      ${this._isSIS}
-  controller supports timers: ${this._supportsTimers}
-  Z-Wave Classic nodes:       ${initData.nodeIds.join(", ")}`);
+        const initData = await this.getSerialApiInitData();
         // Get basic controller version info
         this.driver.controllerLog.print(`querying version info...`);
         const version = await this.driver.sendMessage(new GetControllerVersionMessages_1.GetControllerVersionRequest(this.driver), {
@@ -602,22 +643,7 @@ let ZWaveController = class ZWaveController extends shared_1.TypedEventEmitter {
         // The SDK version cannot be queried directly, but we can deduce it from the protocol version
         this._sdkVersion = (0, ZWaveSDKVersions_1.protocolVersionToSDKVersion)(this._protocolVersion);
         // find out what the controller can do
-        this.driver.controllerLog.print(`querying controller capabilities...`);
-        const ctrlCaps = await this.driver.sendMessage(new GetControllerCapabilitiesMessages_1.GetControllerCapabilitiesRequest(this.driver), {
-            supportCheck: false,
-        });
-        this._isPrimary = !ctrlCaps.isSecondary;
-        this._isUsingHomeIdFromOtherNetwork =
-            ctrlCaps.isUsingHomeIdFromOtherNetwork;
-        this._isSISPresent = ctrlCaps.isSISPresent;
-        this._wasRealPrimary = ctrlCaps.wasRealPrimary;
-        this._isSUC = ctrlCaps.isStaticUpdateController;
-        this.driver.controllerLog.print(`received controller capabilities:
-  controller role:      ${this._isPrimary ? "primary" : "secondary"}
-  is the SUC:           ${this._isSUC}
-  started this network: ${!this._isUsingHomeIdFromOtherNetwork}
-  SIS is present:       ${this._isSISPresent}
-  was real primary:     ${this._wasRealPrimary}`);
+        await this.getControllerCapabilities();
         // If the serial API can be configured, figure out which sub commands are supported
         // This MUST be done after querying the SDK version due to a bug in some 7.xx firmwares, which incorrectly encode the bitmask
         if (this.isFunctionSupported(serial_1.FunctionType.SerialAPISetup)) {
@@ -679,8 +705,18 @@ let ZWaveController = class ZWaveController extends shared_1.TypedEventEmitter {
     }
     /** Tries to determine the LR capable replacement of the given region. If none is found, the given region is returned. */
     tryGetLRCapableRegion(region) {
-        // There is no official API to query whether a given region is supported,
-        // but there are ways to figure out if LR regions are.
+        if (this._supportedRegions) {
+            // If the region supports LR, use it
+            if (this._supportedRegions.get(region)?.supportsLongRange) {
+                return region;
+            }
+            // Find a possible LR capable superset for this region
+            for (const info of this._supportedRegions.values()) {
+                if (info.supportsLongRange && info.includesRegion === region) {
+                    return info.region;
+                }
+            }
+        }
         // US_LR is the first supported LR region, so if the controller supports LR, US_LR is supported
         if (region === core_1.RFRegion.USA && this.isLongRangeCapable()) {
             return core_1.RFRegion["USA (Long Range)"];
@@ -692,6 +728,38 @@ let ZWaveController = class ZWaveController extends shared_1.TypedEventEmitter {
      * Queries the region and powerlevel settings and configures them if necessary
      */
     async queryAndConfigureRF() {
+        // Figure out which regions are supported
+        if (this.isSerialAPISetupCommandSupported(SerialAPISetupMessages_1.SerialAPISetupCommand.GetSupportedRegions)) {
+            this.driver.controllerLog.print(`Querying supported RF regions and their information...`);
+            const supportedRegions = await this.querySupportedRFRegions().catch(() => []);
+            this._supportedRegions = new Map();
+            for (const region of supportedRegions) {
+                try {
+                    const info = await this.queryRFRegionInfo(region);
+                    if (info.region === core_1.RFRegion.Unknown)
+                        continue;
+                    this._supportedRegions.set(region, info);
+                }
+                catch {
+                    continue;
+                }
+            }
+            this.driver.controllerLog.print(`supported regions:${[...this._supportedRegions.values()]
+                .map((info) => {
+                let ret = `\n· ${(0, shared_1.getEnumMemberName)(core_1.RFRegion, info.region)}`;
+                if (info.includesRegion != undefined) {
+                    ret += ` · superset of ${(0, shared_1.getEnumMemberName)(core_1.RFRegion, info.includesRegion)}`;
+                }
+                if (info.supportsLongRange) {
+                    ret += " · ZWLR";
+                    if (!info.supportsZWave) {
+                        ret += " only";
+                    }
+                }
+                return ret;
+            })
+                .join("")}`);
+        }
         // Check and possibly update the RF region to the desired value
         if (this.isSerialAPISetupCommandSupported(SerialAPISetupMessages_1.SerialAPISetupCommand.GetRFRegion)) {
             this.driver.controllerLog.print(`Querying configured RF region...`);
@@ -862,8 +930,9 @@ let ZWaveController = class ZWaveController extends shared_1.TypedEventEmitter {
             this.driver.controllerLog.print(`SUC has node ID ${this.sucNodeId}`);
         }
         // There needs to be a SUC/SIS in the network. If not, we promote ourselves to one if the following conditions are met:
-        // We are the primary controller, but we are not SUC, there is no SUC and there is no SIS
-        if (this._isPrimary
+        // We are the primary controller, but we are not SUC, there is no SUC and there is no SIS, and there are no nodes in the network yet
+        if (this.role === core_1.ControllerRole.Primary
+            && this._noNodesIncluded
             && this._sucNodeId === 0
             && !this._isSUC
             && !this._isSISPresent) {
@@ -872,6 +941,8 @@ let ZWaveController = class ZWaveController extends shared_1.TypedEventEmitter {
                 const result = await this.configureSUC(this._ownNodeId, true, true);
                 if (result) {
                     this._sucNodeId = this._ownNodeId;
+                    this._isSUC = true;
+                    this._isSISPresent = true;
                 }
                 this.driver.controllerLog.print(`Promotion to SUC/SIS ${result ? "succeeded" : "failed"}.`, result ? undefined : "warn");
             }
@@ -879,11 +950,7 @@ let ZWaveController = class ZWaveController extends shared_1.TypedEventEmitter {
                 this.driver.controllerLog.print(`Error while promoting to SUC/SIS: ${(0, shared_1.getErrorMessage)(e)}`, "error");
             }
         }
-        // if it's a bridge controller, request the virtual nodes
-        if (this.type === _Types_2.ZWaveLibraryTypes["Bridge Controller"]
-            && this.isFunctionSupported(serial_1.FunctionType.FUNC_ID_ZW_GET_VIRTUAL_NODES)) {
-            // TODO: send FUNC_ID_ZW_GET_VIRTUAL_NODES message
-        }
+        // TODO: if it's a bridge controller, request the virtual nodes
         if (this.type !== _Types_2.ZWaveLibraryTypes["Bridge Controller"]
             && this.isFunctionSupported(serial_1.FunctionType.SetSerialApiTimeouts)) {
             const { ack, byte } = this.driver.options.timeouts;
@@ -1640,6 +1707,10 @@ let ZWaveController = class ZWaveController extends shared_1.TypedEventEmitter {
                 }
             });
         }
+        else if (msg instanceof ApplicationUpdateRequest_1.ApplicationUpdateRequestSUCIdChanged) {
+            this._sucNodeId = msg.sucNodeID;
+            // TODO: Emit event or what?
+        }
     }
     /**
      * @internal
@@ -1824,6 +1895,10 @@ let ZWaveController = class ZWaveController extends shared_1.TypedEventEmitter {
             }
             // Remember that the node was granted the S0 security class
             node.securityClasses.set(core_1.SecurityClass.S0_Legacy, true);
+            this.driver.controllerLog.logNode(node.id, {
+                message: `Security S0 bootstrapping successful`,
+            });
+            // success 🎉
         }
         catch (e) {
             let errorMessage = `Security S0 bootstrapping failed, the node was not granted the S0 security class`;
@@ -2090,11 +2165,8 @@ let ZWaveController = class ZWaveController extends shared_1.TypedEventEmitter {
             const timerStartTAI2 = Date.now();
             // Generate ECDH key pair. We need to immediately send the other node our public key,
             // so it won't abort bootstrapping
-            const keyPair = await node_util_1.default.promisify(node_crypto_1.default.generateKeyPair)("x25519");
-            const publicKey = (0, core_1.decodeX25519KeyDER)(keyPair.publicKey.export({
-                type: "spki",
-                format: "der",
-            }));
+            const keyPair = (0, core_1.generateECDHKeyPair)();
+            const publicKey = (0, core_1.extractRawECDHPublicKey)(keyPair.publicKey);
             await api.sendPublicKey(publicKey);
             // After this, the node will start sending us a KEX SET every 10 seconds.
             // We won't be able to decode it until the DSK was verified
@@ -2137,11 +2209,7 @@ let ZWaveController = class ZWaveController extends shared_1.TypedEventEmitter {
             // After the user has verified the DSK, we can derive the shared secret
             // Z-Wave works with the "raw" keys, so this is a tad complicated
             const sharedSecret = node_crypto_1.default.diffieHellman({
-                publicKey: node_crypto_1.default.createPublicKey({
-                    key: (0, core_1.encodeX25519KeyDERSPKI)(nodePublicKey),
-                    format: "der",
-                    type: "spki",
-                }),
+                publicKey: (0, core_1.importRawECDHPublicKey)(nodePublicKey),
                 privateKey: keyPair.privateKey,
             });
             // Derive temporary key from ECDH key pair - this will allow us to receive the node's KEX SET commands
@@ -2221,7 +2289,7 @@ let ZWaveController = class ZWaveController extends shared_1.TypedEventEmitter {
                 return Inclusion_1.SecurityBootstrapFailure.S2WrongSecurityLevel;
             }
             // Confirm the keys - the node will start requesting the granted keys in response
-            await api.confirmGrantedKeys({
+            await api.confirmRequestedKeys({
                 requestCSA: kexParams.requestCSA,
                 requestedKeys: [...kexParams.requestedKeys],
                 supportedECDHProfiles: [...kexParams.supportedECDHProfiles],
@@ -2272,11 +2340,12 @@ let ZWaveController = class ZWaveController extends shared_1.TypedEventEmitter {
                     await abort(cc_1.KEXFailType.KeyNotGranted);
                     return Inclusion_1.SecurityBootstrapFailure.S2WrongSecurityLevel;
                 }
-                // Send the node the requested key
-                await api.sendNetworkKey(securityClass, securityManager.getKeysForSecurityClass(securityClass).pnk);
                 // We need to temporarily mark this security class as granted, so the following exchange will use this
                 // key for decryption
+                // FIXME: Is this actually necessary?
                 node.securityClasses.set(securityClass, true);
+                // Send the node the requested key
+                await api.sendNetworkKey(securityClass, securityManager.getKeysForSecurityClass(securityClass).pnk);
                 // And wait for verification
                 const verify = await this.driver.waitForCommand((cc) => cc instanceof cc_1.Security2CCNetworkKeyVerify
                     || cc instanceof cc_1.Security2CCKEXFail, cc_1.inclusionTimeouts.TA4).catch(() => "timeout");
@@ -4014,6 +4083,35 @@ ${associatedNodes.join(", ")}`,
         this._rfRegion = result.region;
         return result.region;
     }
+    /**
+     * Query the supported regions of the Z-Wave API Module
+     *
+     * **Note:** Applications should prefer using {@link getSupportedRFRegions} instead
+     */
+    async querySupportedRFRegions() {
+        const result = await this.driver.sendMessage(new SerialAPISetupMessages_1.SerialAPISetup_GetSupportedRegionsRequest(this.driver));
+        if (result instanceof SerialAPISetupMessages_1.SerialAPISetup_CommandUnsupportedResponse) {
+            throw new core_1.ZWaveError(`Your hardware does not support getting the supported RF regions!`, core_1.ZWaveErrorCodes.Driver_NotSupported);
+        }
+        return result.supportedRegions;
+    }
+    /**
+     * Query the supported regions of the Z-Wave API Module
+     *
+     * **Note:** Applications should prefer reading the cached value from {@link supportedRFRegions} instead
+     */
+    async queryRFRegionInfo(region) {
+        const result = await this.driver.sendMessage(new SerialAPISetupMessages_1.SerialAPISetup_GetRegionInfoRequest(this.driver, { region }));
+        if (result instanceof SerialAPISetupMessages_1.SerialAPISetup_CommandUnsupportedResponse) {
+            throw new core_1.ZWaveError(`Your hardware does not support getting the RF region info!`, core_1.ZWaveErrorCodes.Driver_NotSupported);
+        }
+        return (0, shared_1.pick)(result, [
+            "region",
+            "supportsZWave",
+            "supportsLongRange",
+            "includesRegion",
+        ]);
+    }
     /**
      * Returns the RF regions supported by this controller, or `undefined` if the information is not known yet.
      *
@@ -4021,7 +4119,21 @@ ${associatedNodes.join(", ")}`,
      * for example `USA` which is a subset of `USA (Long Range)`
      */
     getSupportedRFRegions(filterSubsets = true) {
-        // FIXME: Once supported in firmware, query the controller for supported regions instead of hardcoding
+        // If supported by the firmware, rely on the queried information
+        if (this.isSerialAPISetupCommandSupported(SerialAPISetupMessages_1.SerialAPISetupCommand.GetSupportedRegions)) {
+            if (this._supportedRegions == core_1.NOT_KNOWN)
+                return core_1.NOT_KNOWN;
+            const allRegions = new Set(this._supportedRegions.keys());
+            if (filterSubsets) {
+                for (const region of this._supportedRegions.values()) {
+                    if (region.includesRegion != undefined) {
+                        allRegions.delete(region.includesRegion);
+                    }
+                }
+            }
+            return [...allRegions].sort((a, b) => a - b);
+        }
+        // Fallback: Hardcoded list of known supported regions
         const ret = new Set([
             // Always supported
             core_1.RFRegion.Europe,
@@ -4037,9 +4149,19 @@ ${associatedNodes.join(", ")}`,
             core_1.RFRegion["Default (EU)"],
         ]);
         if (this.isLongRangeCapable()) {
+            // All LR capable controllers support USA Long Range
             ret.add(core_1.RFRegion["USA (Long Range)"]);
-            if (filterSubsets) {
+            if (filterSubsets)
                 ret.delete(core_1.RFRegion.USA);
+            // EU Long Range was added in SDK 7.22 for 800 series chips
+            // 7.22.1 adds support for querying the supported regions, so the following
+            // is really only necessary for 7.22.0.
+            if (typeof this._zwaveChipType === "string"
+                && (0, core_1.getChipTypeAndVersion)(this._zwaveChipType)?.type === 8
+                && this.sdkVersionGte("7.22")) {
+                ret.add(core_1.RFRegion["Europe (Long Range)"]);
+                if (filterSubsets)
+                    ret.delete(core_1.RFRegion.Europe);
             }
         }
         return [...ret].sort((a, b) => a - b);
@@ -4269,6 +4391,69 @@ ${associatedNodes.join(", ")}`,
         }
         return ret;
     }
+    /** Request additional information about the controller/Z-Wave chip */
+    async getSerialApiInitData() {
+        this.driver.controllerLog.print(`querying additional controller information...`);
+        const initData = await this.driver.sendMessage(new GetSerialApiInitDataMessages_1.GetSerialApiInitDataRequest(this.driver));
+        this.driver.controllerLog.print(`received additional controller information:
+  Z-Wave API version:         ${initData.zwaveApiVersion.version} (${initData.zwaveApiVersion.kind})${initData.zwaveChipType
+            ? `
+  Z-Wave chip type:           ${typeof initData.zwaveChipType === "string"
+                ? initData.zwaveChipType
+                : `unknown (type: ${(0, shared_1.num2hex)(initData.zwaveChipType.type)}, version: ${(0, shared_1.num2hex)(initData.zwaveChipType.version)})`}`
+            : ""}
+  node type                   ${(0, shared_1.getEnumMemberName)(core_1.NodeType, initData.nodeType)}
+  controller role:            ${initData.isPrimary ? "primary" : "secondary"}
+  controller is the SIS:      ${initData.isSIS}
+  controller supports timers: ${initData.supportsTimers}
+  Z-Wave Classic nodes:       ${initData.nodeIds.join(", ")}`);
+        const ret = {
+            ...(0, shared_1.pick)(initData, [
+                "zwaveApiVersion",
+                "zwaveChipType",
+                "isPrimary",
+                "isSIS",
+                "nodeType",
+                "supportsTimers",
+            ]),
+            nodeIds: [...initData.nodeIds],
+            // ignore the initVersion, no clue what to do with it
+        };
+        // and remember the new info
+        this._zwaveApiVersion = initData.zwaveApiVersion;
+        this._zwaveChipType = initData.zwaveChipType;
+        this._isPrimary = initData.isPrimary;
+        this._isSIS = initData.isSIS;
+        this._nodeType = initData.nodeType;
+        this._supportsTimers = initData.supportsTimers;
+        return ret;
+    }
+    /** Determines the controller's network role/capabilities */
+    async getControllerCapabilities() {
+        this.driver.controllerLog.print(`querying controller capabilities...`);
+        const result = await this.driver.sendMessage(new GetControllerCapabilitiesMessages_1.GetControllerCapabilitiesRequest(this.driver), { supportCheck: false });
+        const ret = {
+            isSecondary: result.isSecondary,
+            isUsingHomeIdFromOtherNetwork: result.isUsingHomeIdFromOtherNetwork,
+            isSISPresent: result.isSISPresent,
+            wasRealPrimary: result.wasRealPrimary,
+            isSUC: result.isStaticUpdateController,
+            noNodesIncluded: result.noNodesIncluded,
+        };
+        this._isSecondary = ret.isSecondary;
+        this._isUsingHomeIdFromOtherNetwork = ret.isUsingHomeIdFromOtherNetwork;
+        this._isSISPresent = ret.isSISPresent;
+        this._wasRealPrimary = ret.wasRealPrimary;
+        this._isSUC = ret.isSUC;
+        this._noNodesIncluded = ret.noNodesIncluded;
+        this.driver.controllerLog.print(`received controller capabilities:
+  controller role:      ${(0, shared_1.getEnumMemberName)(core_1.ControllerRole, this.role)}
+  is the SUC:           ${ret.isSUC}
+  started this network: ${!ret.isUsingHomeIdFromOtherNetwork}
+  SIS is present:       ${ret.isSISPresent}
+  was real primary:     ${ret.wasRealPrimary}`);
+        return ret;
+    }
     /**
      * @internal
      * Deserializes the controller information and all nodes from the cache.
@@ -4407,9 +4592,11 @@ ${associatedNodes.join(", ")}`,
         return ret.buffer;
     }
     /**
-     * **Z-Wave 700 series only**
+     * **Z-Wave 700+ series only**
      *
      * Reads a buffer from the external NVM at the given offset
+     *
+     * **Note:** Prefer {@link externalNVMReadBufferExt} if supported, as that command supports larger NVMs than 64 KiB.
      */
     async externalNVMReadBuffer700(offset, length) {
         const ret = await this.driver.sendMessage(new NVMOperationsMessages_1.NVMOperationsReadRequest(this.driver, {
@@ -4431,6 +4618,35 @@ ${associatedNodes.join(", ")}`,
             endOfFile: ret.status === NVMOperationsMessages_1.NVMOperationStatus.EndOfFile,
         };
     }
+    /**
+     * **Z-Wave 700+ series only**
+     *
+     * Reads a buffer from the external NVM at the given offset
+     *
+     * **Note:** If supported, this command should be preferred over {@link externalNVMReadBuffer700} as it supports larger NVMs than 64 KiB.
+     */
+    async externalNVMReadBufferExt(offset, length) {
+        const ret = await this.driver.sendMessage(new ExtendedNVMOperationsMessages_1.ExtendedNVMOperationsReadRequest(this.driver, {
+            offset,
+            length,
+        }));
+        if (!ret.isOK()) {
+            let message = "Could not read from the external NVM";
+            if (ret.status
+                === ExtendedNVMOperationsMessages_1.ExtendedNVMOperationStatus.Error_OperationInterference) {
+                message += ": interference between read and write operation.";
+            }
+            else if (ret.status
+                === ExtendedNVMOperationsMessages_1.ExtendedNVMOperationStatus.Error_OperationMismatch) {
+                message += ": wrong operation requested.";
+            }
+            throw new core_1.ZWaveError(message, core_1.ZWaveErrorCodes.Controller_CommandError);
+        }
+        return {
+            buffer: ret.bufferOrBitmask,
+            endOfFile: ret.status === ExtendedNVMOperationsMessages_1.ExtendedNVMOperationStatus.EndOfFile,
+        };
+    }
     /**
      * **Z-Wave 500 series only**
      *
@@ -4448,9 +4664,12 @@ ${associatedNodes.join(", ")}`,
         return ret.success;
     }
     /**
-     * **Z-Wave 700 series only**
+     * **Z-Wave 700+ series only**
      *
      * Writes a buffer to the external NVM at the given offset
+     *
+     * **Note:** Prefer {@link externalNVMWriteBufferExt} if supported, as that command supports larger NVMs than 64 KiB.
+     *
      * **WARNING:** This function can write in the full NVM address space and is not offset to start at the application area.
      * Take care not to accidentally overwrite the protocol NVM area!
      */
@@ -4474,9 +4693,46 @@ ${associatedNodes.join(", ")}`,
         };
     }
     /**
-     * **Z-Wave 700 series only**
+     * **Z-Wave 700+ series only**
+     *
+     * Writes a buffer to the external NVM at the given offset
+     *
+     * **Note:** If supported, this command should be preferred over {@link externalNVMWriteBuffer700} as it supports larger NVMs than 64 KiB.
+     *
+     * **WARNING:** This function can write in the full NVM address space and is not offset to start at the application area.
+     * Take care not to accidentally overwrite the protocol NVM area!
+     */
+    async externalNVMWriteBufferExt(offset, buffer) {
+        const ret = await this.driver.sendMessage(new ExtendedNVMOperationsMessages_1.ExtendedNVMOperationsWriteRequest(this.driver, {
+            offset,
+            buffer,
+        }));
+        if (!ret.isOK()) {
+            let message = "Could not write to the external NVM";
+            if (ret.status
+                === ExtendedNVMOperationsMessages_1.ExtendedNVMOperationStatus.Error_OperationInterference) {
+                message += ": interference between read and write operation.";
+            }
+            else if (ret.status
+                === ExtendedNVMOperationsMessages_1.ExtendedNVMOperationStatus.Error_OperationMismatch) {
+                message += ": wrong operation requested.";
+            }
+            else if (ret.status
+                === ExtendedNVMOperationsMessages_1.ExtendedNVMOperationStatus.Error_SubCommandNotSupported) {
+                message += ": sub-command not supported.";
+            }
+            throw new core_1.ZWaveError(message, core_1.ZWaveErrorCodes.Controller_CommandError);
+        }
+        return {
+            endOfFile: ret.status === ExtendedNVMOperationsMessages_1.ExtendedNVMOperationStatus.EndOfFile,
+        };
+    }
+    /**
+     * **Z-Wave 700+ series only**
      *
      * Opens the controller's external NVM for reading/writing and returns the NVM size
+     *
+     * **Note:** Prefer {@link externalNVMOpenExt} if supported, as that command supports larger NVMs than 64 KiB.
      */
     async externalNVMOpen() {
         const ret = await this.driver.sendMessage(new NVMOperationsMessages_1.NVMOperationsOpenRequest(this.driver));
@@ -4486,9 +4742,30 @@ ${associatedNodes.join(", ")}`,
         return ret.offsetOrSize;
     }
     /**
-     * **Z-Wave 700 series only**
+     * **Z-Wave 700+ series only**
+     *
+     * Opens the controller's external NVM for reading/writing and returns the NVM size and supported operations.
+     *
+     * **Note:** If supported, this command should be preferred over {@link externalNVMOpen} as it supports larger NVMs than 64 KiB.
+     */
+    async externalNVMOpenExt() {
+        const ret = await this.driver.sendMessage(new ExtendedNVMOperationsMessages_1.ExtendedNVMOperationsOpenRequest(this.driver));
+        if (!ret.isOK()) {
+            throw new core_1.ZWaveError("Failed to open the external NVM", core_1.ZWaveErrorCodes.Controller_CommandError);
+        }
+        const size = ret.offsetOrSize;
+        const supportedOperations = (0, core_1.parseBitMask)(ret.bufferOrBitmask, ExtendedNVMOperationsMessages_1.ExtendedNVMOperationsCommand.Open);
+        return {
+            size,
+            supportedOperations,
+        };
+    }
+    /**
+     * **Z-Wave 700+ series only**
      *
      * Closes the controller's external NVM
+     *
+     * **Note:** Prefer {@link externalNVMCloseExt} if supported, as that command supports larger NVMs than 64 KiB.
      */
     async externalNVMClose() {
         const ret = await this.driver.sendMessage(new NVMOperationsMessages_1.NVMOperationsCloseRequest(this.driver));
@@ -4496,6 +4773,19 @@ ${associatedNodes.join(", ")}`,
             throw new core_1.ZWaveError("Failed to close the external NVM", core_1.ZWaveErrorCodes.Controller_CommandError);
         }
     }
+    /**
+     * **Z-Wave 700+ series only**
+     *
+     * Closes the controller's external NVM
+     *
+     * **Note:** If supported, this command should be preferred over {@link externalNVMClose} as it supports larger NVMs than 64 KiB.
+     */
+    async externalNVMCloseExt() {
+        const ret = await this.driver.sendMessage(new ExtendedNVMOperationsMessages_1.ExtendedNVMOperationsCloseRequest(this.driver));
+        if (!ret.isOK()) {
+            throw new core_1.ZWaveError("Failed to close the external NVM", core_1.ZWaveErrorCodes.Controller_CommandError);
+        }
+    }
     /**
      * Creates a backup of the NVM and returns the raw data as a Buffer. The Z-Wave radio is turned off/on automatically.
      * @param onProgress Can be used to monitor the progress of the operation, which may take several seconds up to a few minutes depending on the NVM size
@@ -4561,8 +4851,24 @@ ${associatedNodes.join(", ")}`,
         return ret;
     }
     async backupNVMRaw700(onProgress) {
+        let open;
+        let read;
+        let close;
+        if (this.supportedFunctionTypes?.includes(serial_1.FunctionType.ExtendedNVMOperations)) {
+            open = async () => {
+                const { size } = await this.externalNVMOpenExt();
+                return size;
+            };
+            read = (offset, length) => this.externalNVMReadBufferExt(offset, length);
+            close = () => this.externalNVMCloseExt();
+        }
+        else {
+            open = () => this.externalNVMOpen();
+            read = (offset, length) => this.externalNVMReadBuffer700(offset, length);
+            close = () => this.externalNVMClose();
+        }
         // Open NVM for reading
-        const size = await this.externalNVMOpen();
+        const size = await open();
         const ret = Buffer.allocUnsafe(size);
         let offset = 0;
         // Try reading the maximum size at first, the Serial API should return chunks in a size it supports
@@ -4570,8 +4876,7 @@ ${associatedNodes.join(", ")}`,
         let chunkSize = Math.min(0xff, ret.length);
         try {
             while (offset < ret.length) {
-                const { buffer: chunk, endOfFile } = await this
-                    .externalNVMReadBuffer700(offset, Math.min(chunkSize, ret.length - offset));
+                const { buffer: chunk, endOfFile } = await read(offset, Math.min(chunkSize, ret.length - offset));
                 if (chunkSize === 0xff && chunk.length === 0) {
                     // Some SDK versions return an empty buffer when trying to read a buffer that is too long
                     // Fallback to a sane (but maybe slow) size
@@ -4591,7 +4896,7 @@ ${associatedNodes.join(", ")}`,
         }
         finally {
             // Whatever happens, close the NVM
-            await this.externalNVMClose();
+            await close();
         }
         return ret;
     }
@@ -4735,8 +5040,27 @@ ${associatedNodes.join(", ")}`,
         }
     }
     async restoreNVMRaw700(nvmData, onProgress) {
+        let open;
+        let read;
+        let write;
+        let close;
+        if (this.supportedFunctionTypes?.includes(serial_1.FunctionType.ExtendedNVMOperations)) {
+            open = async () => {
+                const { size } = await this.externalNVMOpenExt();
+                return size;
+            };
+            read = (offset, length) => this.externalNVMReadBufferExt(offset, length);
+            write = (offset, buffer) => this.externalNVMWriteBufferExt(offset, buffer);
+            close = () => this.externalNVMCloseExt();
+        }
+        else {
+            open = () => this.externalNVMOpen();
+            read = (offset, length) => this.externalNVMReadBuffer700(offset, length);
+            write = (offset, buffer) => this.externalNVMWriteBuffer700(offset, buffer);
+            close = () => this.externalNVMClose();
+        }
         // Open NVM for reading
-        const size = await this.externalNVMOpen();
+        const size = await open();
         if (size !== nvmData.length) {
             throw new core_1.ZWaveError("The given data does not match the NVM size - cannot restore!", core_1.ZWaveErrorCodes.Argument_Invalid);
         }
@@ -4744,12 +5068,12 @@ ${associatedNodes.join(", ")}`,
         // For some reason, there is no documentation and no official command for this
         // The write requests have the same size as the read response - if this yields no
         // data, default to a sane (but maybe slow) size
-        const chunkSize = (await this.externalNVMReadBuffer700(0, 0xff)).buffer.length || 48;
+        const chunkSize = (await read(0, 0xff)).buffer.length || 48;
         // Close NVM and re-open again for writing
-        await this.externalNVMClose();
-        await this.externalNVMOpen();
+        await close();
+        await open();
         for (let offset = 0; offset < nvmData.length; offset += chunkSize) {
-            const { endOfFile } = await this.externalNVMWriteBuffer700(offset, nvmData.subarray(offset, offset + chunkSize));
+            const { endOfFile } = await write(offset, nvmData.subarray(offset, offset + chunkSize));
             // Report progress for listeners
             if (onProgress)
                 setImmediate(() => onProgress(offset, size));
@@ -4757,7 +5081,7 @@ ${associatedNodes.join(", ")}`,
                 break;
         }
         // Close NVM
-        await this.externalNVMClose();
+        await close();
     }
     /**
      * Request the most recent background RSSI levels detected by the controller.
@@ -4907,7 +5231,7 @@ ${associatedNodes.join(", ")}`,
      * The return value indicates whether the update was successful.
      * **WARNING:** This method will throw instead of returning `false` if invalid arguments are passed or downloading files or starting an update fails.
      */
-    async firmwareUpdateOTA(nodeId, updateInfo) {
+    async firmwareUpdateOTA(nodeId, updateInfo, options) {
         // Don't let two firmware updates happen in parallel
         if (this.isAnyOTAFirmwareUpdateInProgress()) {
             const message = `Failed to start the update: A firmware update is already in progress on this network!`;
@@ -4977,7 +5301,7 @@ ${associatedNodes.join(", ")}`,
         else {
             this.driver.controllerLog.logNode(nodeId, `All updates downloaded, installing...`);
         }
-        return node.updateFirmware(firmwares);
+        return node.updateFirmware(firmwares, options);
     }
     _firmwareUpdateInProgress = false;
     /**
@@ -5231,6 +5555,788 @@ ${associatedNodes.join(", ")}`,
             this._firmwareUpdateInProgress = false;
         }
     }
+    _currentLearnMode;
+    _joinNetworkOptions;
+    async beginJoiningNetwork(options) {
+        if (this._currentLearnMode != undefined) {
+            return Inclusion_1.JoinNetworkResult.Error_Busy;
+        }
+        else if (!this.isLearnModePermitted) {
+            return Inclusion_1.JoinNetworkResult.Error_NotPermitted;
+        }
+        // FIXME: If the join strategy says S0, remove S2 from the NIF before joining
+        try {
+            const result = await this.driver.sendMessage(new SetLearnModeMessages_1.SetLearnModeRequest(this.driver, {
+                intent: SetLearnModeMessages_1.LearnModeIntent.Inclusion,
+            }));
+            if (result.isOK()) {
+                this._currentLearnMode = SetLearnModeMessages_1.LearnModeIntent.Inclusion;
+                this._joinNetworkOptions = options;
+                return Inclusion_1.JoinNetworkResult.OK;
+            }
+        }
+        catch (e) {
+            this.driver.controllerLog.print(`Joining a network failed: ${(0, shared_1.getErrorMessage)(e)}`, "error");
+        }
+        this._currentLearnMode = undefined;
+        return Inclusion_1.JoinNetworkResult.Error_Failed;
+    }
+    async stopJoiningNetwork() {
+        if (this._currentLearnMode !== SetLearnModeMessages_1.LearnModeIntent.LegacyInclusionExclusion
+            // FIXME: ^ only for actual exclusion
+            && this._currentLearnMode !== SetLearnModeMessages_1.LearnModeIntent.Inclusion) {
+            return false;
+        }
+        try {
+            const result = await this.driver.sendMessage(new SetLearnModeMessages_1.SetLearnModeRequest(this.driver, {
+                // TODO: We should be using .Stop here for the non-legacy
+                // inclusion/exclusion, but that command results in a
+                // negative response on current firmwares, even though it works.
+                // Using LegacyStop avoids that, but results in an unexpected
+                // LearnModeFailed callback.
+                intent: SetLearnModeMessages_1.LearnModeIntent.LegacyStop,
+            }));
+            if (result.isOK()) {
+                this._currentLearnMode = undefined;
+                this._joinNetworkOptions = undefined;
+                return true;
+            }
+        }
+        catch (e) {
+            this.driver.controllerLog.print(`Failed to stop joining a network: ${(0, shared_1.getErrorMessage)(e)}`, "error");
+        }
+        return false;
+    }
+    async beginLeavingNetwork() {
+        if (this._currentLearnMode != undefined) {
+            return Inclusion_1.LeaveNetworkResult.Error_Busy;
+        }
+        else if (!this.isLearnModePermitted) {
+            return Inclusion_1.LeaveNetworkResult.Error_NotPermitted;
+        }
+        try {
+            const result = await this.driver.sendMessage(new SetLearnModeMessages_1.SetLearnModeRequest(this.driver, {
+                intent: SetLearnModeMessages_1.LearnModeIntent.NetworkWideExclusion,
+            }));
+            if (result.isOK()) {
+                this._currentLearnMode = SetLearnModeMessages_1.LearnModeIntent.NetworkWideExclusion;
+                return Inclusion_1.LeaveNetworkResult.OK;
+            }
+        }
+        catch (e) {
+            this.driver.controllerLog.print(`Leaving the current network failed: ${(0, shared_1.getErrorMessage)(e)}`, "error");
+        }
+        this._currentLearnMode = undefined;
+        return Inclusion_1.LeaveNetworkResult.Error_Failed;
+    }
+    async stopLeavingNetwork() {
+        if (this._currentLearnMode !== SetLearnModeMessages_1.LearnModeIntent.LegacyInclusionExclusion
+            // FIXME: ^ only for actual exclusion
+            && this._currentLearnMode
+                !== SetLearnModeMessages_1.LearnModeIntent.LegacyNetworkWideExclusion
+            && this._currentLearnMode !== SetLearnModeMessages_1.LearnModeIntent.DirectExclusion
+            && this._currentLearnMode !== SetLearnModeMessages_1.LearnModeIntent.NetworkWideExclusion) {
+            return false;
+        }
+        try {
+            const result = await this.driver.sendMessage(new SetLearnModeMessages_1.SetLearnModeRequest(this.driver, {
+                // TODO: We should be using .Stop here for the non-legacy
+                // inclusion/exclusion, but that command results in a
+                // negative response on current firmwares, even though it works.
+                // Using LegacyStop avoids that, but results in an unexpected
+                // LearnModeFailed callback.
+                intent: SetLearnModeMessages_1.LearnModeIntent.LegacyStop,
+            }));
+            if (result.isOK()) {
+                this._currentLearnMode = undefined;
+                return true;
+            }
+        }
+        catch (e) {
+            this.driver.controllerLog.print(`Failed to stop leaving a network: ${(0, shared_1.getErrorMessage)(e)}`, "error");
+        }
+        return false;
+    }
+    /**
+     * Is called when a RemoveNode request is received from the controller.
+     * Handles and controls the exclusion process.
+     */
+    handleLearnModeCallback(msg) {
+        // not sure what to do with this message, we're not in learn mode
+        if (this._currentLearnMode == undefined)
+            return false;
+        // FIXME: Reset security manager on successful join or leave
+        const wasJoining = this._currentLearnMode === SetLearnModeMessages_1.LearnModeIntent.Inclusion
+            || this._currentLearnMode === SetLearnModeMessages_1.LearnModeIntent.SmartStart
+            || this._currentLearnMode
+                === SetLearnModeMessages_1.LearnModeIntent.LegacyNetworkWideInclusion
+            || (this._currentLearnMode
+                === SetLearnModeMessages_1.LearnModeIntent.LegacyInclusionExclusion
+                // TODO: Secondary controller may also use this to accept controller shift
+                // Figure out how to detect that.
+                && this.role === core_1.ControllerRole.Primary);
+        const wasLeaving = this._currentLearnMode === SetLearnModeMessages_1.LearnModeIntent.DirectExclusion
+            || this._currentLearnMode
+                === SetLearnModeMessages_1.LearnModeIntent.NetworkWideExclusion
+            || this._currentLearnMode
+                === SetLearnModeMessages_1.LearnModeIntent.LegacyNetworkWideExclusion
+            || (this._currentLearnMode
+                === SetLearnModeMessages_1.LearnModeIntent.LegacyInclusionExclusion
+                && this.role !== core_1.ControllerRole.Primary);
+        if (msg.status === SetLearnModeMessages_1.LearnModeStatus.Started) {
+            // cool, cool, cool...
+            return true;
+        }
+        else if (msg.status === SetLearnModeMessages_1.LearnModeStatus.Failed) {
+            if (wasJoining) {
+                this._currentLearnMode = undefined;
+                this._joinNetworkOptions = undefined;
+                this.emit("joining network failed");
+                return true;
+            }
+            else if (wasLeaving) {
+                this._currentLearnMode = undefined;
+                this.emit("leaving network failed");
+                return true;
+            }
+        }
+        else if (msg.status === SetLearnModeMessages_1.LearnModeStatus.Completed
+            || (this._currentLearnMode >= SetLearnModeMessages_1.LearnModeIntent.Inclusion
+                && msg.status === SetLearnModeMessages_1.LearnModeStatus.ProtocolDone)) {
+            if (wasJoining) {
+                this._currentLearnMode = undefined;
+                this.driver["_securityManager"] = undefined;
+                this.driver["_securityManager2"] = new core_1.SecurityManager2();
+                this.driver["_securityManagerLR"] = new core_1.SecurityManager2();
+                this._nodes.clear();
+                process.nextTick(() => this.afterJoiningNetwork().catch(shared_1.noop));
+                return true;
+            }
+            else if (wasLeaving) {
+                this._currentLearnMode = undefined;
+                this.emit("network left");
+                return true;
+            }
+        }
+        // not sure what to do with this message
+        return false;
+    }
+    async expectSecurityBootstrapS0(bootstrappingNode) {
+        // When bootstrapping with S0, no other keys are granted
+        for (const secClass of core_1.securityClassOrder) {
+            if (secClass !== core_1.SecurityClass.S0_Legacy) {
+                bootstrappingNode.securityClasses.set(secClass, false);
+            }
+        }
+        const unGrantSecurityClass = () => {
+            this.driver["_securityManager"] = undefined;
+            bootstrappingNode.securityClasses.set(core_1.SecurityClass.S0_Legacy, false);
+        };
+        const abortTimeout = () => {
+            this.driver.controllerLog.logNode(bootstrappingNode.id, {
+                message: `Security S0 bootstrapping failed: a secure inclusion timer has elapsed`,
+                level: "warn",
+            });
+            unGrantSecurityClass();
+            return Inclusion_1.SecurityBootstrapFailure.Timeout;
+        };
+        try {
+            const api = bootstrappingNode.commandClasses.Security;
+            // For the first part of the bootstrapping, a temporary key needs to be used
+            this.driver["_securityManager"] = new core_1.SecurityManager({
+                ownNodeId: this._ownNodeId,
+                networkKey: Buffer.alloc(16, 0),
+                nonceTimeout: this.driver.options.timeouts.nonce,
+            });
+            // Report the supported schemes
+            await api.reportSecurityScheme(false);
+            // Expect a NonceGet within 10 seconds
+            let nonceGet = await this.driver.waitForCommand((cc) => cc instanceof cc_1.SecurityCCNonceGet, 10000).catch(() => "timeout");
+            if (nonceGet === "timeout")
+                return abortTimeout();
+            // Send nonce
+            await api.sendNonce();
+            // Expect NetworkKeySet within 10 seconds
+            const networkKeySet = await this.driver.waitForCommand((cc) => cc instanceof cc_1.SecurityCCNetworkKeySet, 10000).catch(() => "timeout");
+            if (networkKeySet === "timeout")
+                return abortTimeout();
+            // Now that the key is known, we can create the real security manager
+            this.driver["_securityManager"] = new core_1.SecurityManager({
+                ownNodeId: this._ownNodeId,
+                networkKey: networkKeySet.networkKey,
+                nonceTimeout: this.driver.options.timeouts.nonce,
+            });
+            // Request a new nonce to respond, which should be answered within 10 seconds
+            let nonce = await api.withOptions({ reportTimeoutMs: 10000 })
+                .getNonce();
+            if (!nonce)
+                return abortTimeout();
+            // Verify the key
+            await api.verifyNetworkKey();
+            // We are a controller, so continue with scheme inherit
+            // Expect a NonceGet within 10 seconds
+            nonceGet = await this.driver.waitForCommand((cc) => cc instanceof cc_1.SecurityCCNonceGet, 10000).catch(() => "timeout");
+            if (nonceGet === "timeout")
+                return abortTimeout();
+            // Send nonce
+            await api.sendNonce();
+            // Expect SchemeInherit within 10 seconds
+            const schemeInherit = await this.driver.waitForCommand((cc) => cc instanceof cc_1.SecurityCCSchemeInherit, 10000).catch(() => "timeout");
+            if (schemeInherit === "timeout")
+                return abortTimeout();
+            // Request a new nonce to respond, which should be answered within 10 seconds
+            nonce = await api.withOptions({ reportTimeoutMs: 10000 })
+                .getNonce();
+            if (!nonce)
+                return abortTimeout();
+            // Report the supported schemes. This isn't technically correct, but since
+            // S0 won't get any extensions, we can just report the default scheme again
+            await api.reportSecurityScheme(true);
+            // Remember that the S0 key was granted
+            bootstrappingNode.securityClasses.set(core_1.SecurityClass.S0_Legacy, true);
+            // Store the key
+            this.driver.cacheSet(NetworkCache_1.cacheKeys.controller.securityKeys(core_1.SecurityClass.S0_Legacy), networkKeySet.networkKey);
+            this.driver.driverLog.print(`Security S0 bootstrapping successful`);
+            // success 🎉
+        }
+        catch (e) {
+            let errorMessage = `Security S0 bootstrapping failed`;
+            let result = Inclusion_1.SecurityBootstrapFailure.Unknown;
+            if (!(0, core_1.isZWaveError)(e)) {
+                errorMessage += `: ${e}`;
+            }
+            else if (e.code === core_1.ZWaveErrorCodes.Controller_MessageExpired) {
+                errorMessage += ": a secure inclusion timer has elapsed.";
+                result = Inclusion_1.SecurityBootstrapFailure.Timeout;
+            }
+            else if (e.code !== core_1.ZWaveErrorCodes.Controller_MessageDropped
+                && e.code !== core_1.ZWaveErrorCodes.Controller_NodeTimeout) {
+                errorMessage += `: ${e.message}`;
+            }
+            this.driver.controllerLog.logNode(bootstrappingNode.id, errorMessage, "warn");
+            unGrantSecurityClass();
+            return result;
+        }
+    }
+    async expectSecurityBootstrapS2(bootstrappingNode, requested, userCallbacks = this.driver.options.joinNetworkUserCallbacks) {
+        const api = bootstrappingNode.commandClasses["Security 2"]
+            .withOptions({
+            // Do not wait for Nonce Reports after SET-type commands.
+            // Timing is critical here
+            s2VerifyDelivery: false,
+        });
+        const unGrantSecurityClasses = () => {
+            for (const secClass of core_1.securityClassOrder) {
+                bootstrappingNode.securityClasses.set(secClass, false);
+            }
+        };
+        // FIXME: Abstract this out so it can be reused as primary and secondary
+        const securityManager = (0, core_1.isLongRangeNodeId)(this._ownNodeId)
+            ? this.driver.securityManagerLR
+            : this.driver.securityManager2;
+        if (!securityManager) {
+            // This should not happen when joining a network.
+            unGrantSecurityClasses();
+            return Inclusion_1.SecurityBootstrapFailure.NoKeysConfigured;
+        }
+        const receivedKeys = new Map();
+        const deleteTempKey = () => {
+            // Whatever happens, no further communication needs the temporary key
+            securityManager.deleteNonce(bootstrappingNode.id);
+            securityManager.tempKeys.delete(bootstrappingNode.id);
+        };
+        let dskHidden = false;
+        const applicationHideDSK = () => {
+            if (dskHidden)
+                return;
+            dskHidden = true;
+            try {
+                userCallbacks?.done();
+            }
+            catch {
+                // ignore application-level errors
+            }
+        };
+        const abort = async (failType) => {
+            applicationHideDSK();
+            if (failType != undefined) {
+                try {
+                    await api.abortKeyExchange(failType);
+                }
+                catch {
+                    // ignore
+                }
+            }
+            // Un-grant S2 security classes we might have granted
+            unGrantSecurityClasses();
+            deleteTempKey();
+        };
+        const abortTimeout = async () => {
+            this.driver.controllerLog.logNode(bootstrappingNode.id, {
+                message: `Security S2 bootstrapping failed: a secure inclusion timer has elapsed`,
+                level: "warn",
+            });
+            await abort();
+            return Inclusion_1.SecurityBootstrapFailure.Timeout;
+        };
+        const abortCanceled = async () => {
+            this.driver.controllerLog.logNode(bootstrappingNode.id, {
+                message: `The including node canceled the Security S2 bootstrapping.`,
+                direction: "inbound",
+                level: "warn",
+            });
+            await abort();
+            return Inclusion_1.SecurityBootstrapFailure.NodeCanceled;
+        };
+        try {
+            // Send with our desired keys
+            await api.requestKeys({
+                requestedKeys: requested.securityClasses,
+                requestCSA: false,
+                supportedECDHProfiles: [cc_1.ECDHProfiles.Curve25519],
+                supportedKEXSchemes: [cc_1.KEXSchemes.KEXScheme1],
+            });
+            // Wait for including node to grant keys
+            const kexSet = await this.driver.waitForCommand((cc) => cc instanceof cc_1.Security2CCKEXSet
+                || cc instanceof cc_1.Security2CCKEXFail, cc_1.inclusionTimeouts.TB2).catch(() => "timeout");
+            if (kexSet === "timeout")
+                return abortTimeout();
+            if (kexSet instanceof cc_1.Security2CCKEXFail) {
+                return abortCanceled();
+            }
+            // Validate the command
+            // Echo flag must be false
+            if (kexSet.echo) {
+                this.driver.controllerLog.logNode(bootstrappingNode.id, {
+                    message: `Security S2 bootstrapping failed: KEX Set unexpectedly has the echo flag set.`,
+                    level: "warn",
+                });
+                await abort(cc_1.KEXFailType.NoVerify);
+                return Inclusion_1.SecurityBootstrapFailure.ParameterMismatch;
+            }
+            else if (kexSet.selectedKEXScheme !== cc_1.KEXSchemes.KEXScheme1) {
+                this.driver.controllerLog.logNode(bootstrappingNode.id, {
+                    message: `Security S2 bootstrapping failed: Unsupported key exchange scheme.`,
+                    level: "warn",
+                });
+                await abort(cc_1.KEXFailType.NoSupportedScheme);
+                return Inclusion_1.SecurityBootstrapFailure.ParameterMismatch;
+            }
+            else if (kexSet.selectedECDHProfile !== cc_1.ECDHProfiles.Curve25519) {
+                this.driver.controllerLog.logNode(bootstrappingNode.id, {
+                    message: `Security S2 bootstrapping failed: Unsupported ECDH profile.`,
+                    level: "warn",
+                });
+                await abort(cc_1.KEXFailType.NoSupportedCurve);
+                return Inclusion_1.SecurityBootstrapFailure.ParameterMismatch;
+            }
+            else if (kexSet.permitCSA !== false) {
+                // We do not support CSA at the moment, so it is never requested.
+                this.driver.controllerLog.logNode(bootstrappingNode.id, {
+                    message: `Security S2 bootstrapping failed: CSA granted but not requested.`,
+                    level: "warn",
+                });
+                await abort(cc_1.KEXFailType.BootstrappingCanceled);
+                return Inclusion_1.SecurityBootstrapFailure.ParameterMismatch;
+            }
+            const matchingKeys = kexSet.grantedKeys.filter((k) => core_1.securityClassOrder.includes(k)
+                && requested.securityClasses.includes(k));
+            if (!matchingKeys.length) {
+                this.driver.controllerLog.logNode(bootstrappingNode.id, {
+                    message: `Security S2 bootstrapping failed: None of the requested security classes are granted.`,
+                    level: "warn",
+                });
+                await abort(cc_1.KEXFailType.NoKeyMatch);
+                return Inclusion_1.SecurityBootstrapFailure.ParameterMismatch;
+            }
+            const highestGranted = (0, core_1.getHighestSecurityClass)(matchingKeys);
+            const requiresAuthentication = highestGranted === core_1.SecurityClass.S2_AccessControl
+                || highestGranted === core_1.SecurityClass.S2_Authenticated;
+            // If authentication is required, use the (static) authenticated ECDH key pair,
+            // otherwise generate a new one
+            const keyPair = requiresAuthentication
+                ? this.driver.getLearnModeAuthenticatedKeyPair()
+                : (0, core_1.generateECDHKeyPair)();
+            const publicKey = (0, core_1.extractRawECDHPublicKey)(keyPair.publicKey);
+            const transmittedPublicKey = Buffer.from(publicKey);
+            if (requiresAuthentication) {
+                // Authentication requires obfuscating the public key
+                transmittedPublicKey.writeUInt16BE(0x0000, 0);
+                // Show the DSK to the user
+                const dsk = (0, core_1.dskToString)(publicKey.subarray(0, 16));
+                try {
+                    userCallbacks?.showDSK(dsk);
+                }
+                catch {
+                    // ignore application-level errors
+                }
+            }
+            await api.sendPublicKey(transmittedPublicKey, false);
+            // Wait for including node to send its public key
+            const pubKeyReport = await this.driver.waitForCommand((cc) => cc instanceof cc_1.Security2CCPublicKeyReport
+                || cc instanceof cc_1.Security2CCKEXFail, cc_1.inclusionTimeouts.TB3).catch(() => "timeout");
+            if (pubKeyReport === "timeout")
+                return abortTimeout();
+            if (pubKeyReport instanceof cc_1.Security2CCKEXFail) {
+                return abortCanceled();
+            }
+            const includingNodePubKey = pubKeyReport.publicKey;
+            const sharedSecret = node_crypto_1.default.diffieHellman({
+                publicKey: (0, core_1.importRawECDHPublicKey)(includingNodePubKey),
+                privateKey: keyPair.privateKey,
+            });
+            // Derive temporary key from ECDH key pair - this will allow us to receive the node's KEX SET commands
+            const tempKeys = (0, core_1.deriveTempKeys)((0, core_1.computePRK)(sharedSecret, includingNodePubKey, publicKey));
+            securityManager.deleteNonce(bootstrappingNode.id);
+            securityManager.tempKeys.set(bootstrappingNode.id, {
+                keyCCM: tempKeys.tempKeyCCM,
+                personalizationString: tempKeys.tempPersonalizationString,
+            });
+            // Wait for the confirmation of the requested keys and
+            // retransmit the KEXSet echo every 10 seconds until a response is
+            // received or the process timed out.
+            const confirmKeysStartTime = Date.now();
+            let kexReportEcho;
+            for (let i = 0; i <= 25; i++) {
+                try {
+                    kexReportEcho = await api.withOptions({
+                        reportTimeoutMs: 10000,
+                    }).confirmGrantedKeys({
+                        grantedKeys: kexSet.grantedKeys,
+                        permitCSA: kexSet.permitCSA,
+                        selectedECDHProfile: kexSet.selectedECDHProfile,
+                        selectedKEXScheme: kexSet.selectedKEXScheme,
+                        _reserved: kexSet._reserved,
+                    });
+                }
+                catch {
+                    // ignore
+                }
+                if (kexReportEcho != undefined)
+                    break;
+                if (Date.now() - confirmKeysStartTime > 240000)
+                    break;
+            }
+            if (!kexReportEcho || kexReportEcho === "timeout") {
+                return abortTimeout();
+            }
+            else if (kexReportEcho instanceof cc_1.Security2CCKEXFail) {
+                return abortCanceled();
+            }
+            // The application no longer needs to show the DSK
+            applicationHideDSK();
+            // Validate the response
+            if (!kexReportEcho.echo) {
+                this.driver.controllerLog.logNode(bootstrappingNode.id, {
+                    message: `Security S2 bootstrapping failed: KEXReport received without echo flag`,
+                    direction: "inbound",
+                    level: "warn",
+                });
+                await abort(cc_1.KEXFailType.WrongSecurityLevel);
+                return Inclusion_1.SecurityBootstrapFailure.NodeCanceled;
+            }
+            else if (kexReportEcho.requestCSA !== false) {
+                // We don't request CSA
+                this.driver.controllerLog.logNode(bootstrappingNode.id, {
+                    message: `Security S2 bootstrapping failed: Invalid KEXReport received`,
+                    level: "warn",
+                });
+                await abort(cc_1.KEXFailType.WrongSecurityLevel);
+                return Inclusion_1.SecurityBootstrapFailure.NodeCanceled;
+            }
+            else if (kexReportEcho._reserved !== 0) {
+                this.driver.controllerLog.logNode(bootstrappingNode.id, {
+                    message: `Security S2 bootstrapping failed: Invalid KEXReport received`,
+                    direction: "inbound",
+                    level: "warn",
+                });
+                await abort(cc_1.KEXFailType.WrongSecurityLevel);
+                return Inclusion_1.SecurityBootstrapFailure.NodeCanceled;
+            }
+            else if (!kexReportEcho.isEncapsulatedWith(core_1.CommandClasses["Security 2"], cc_1.Security2Command.MessageEncapsulation)) {
+                this.driver.controllerLog.logNode(bootstrappingNode.id, {
+                    message: `Security S2 bootstrapping failed: Command received without encryption`,
+                    direction: "inbound",
+                    level: "warn",
+                });
+                await abort(cc_1.KEXFailType.WrongSecurityLevel);
+                return Inclusion_1.SecurityBootstrapFailure.S2WrongSecurityLevel;
+            }
+            else if (kexReportEcho.requestedKeys.length
+                !== requested.securityClasses.length
+                || !kexReportEcho.requestedKeys.every((k) => requested.securityClasses.includes(k))) {
+                this.driver.controllerLog.logNode(bootstrappingNode.id, {
+                    message: `Security S2 bootstrapping failed: Granted key mismatch.`,
+                    level: "warn",
+                });
+                await abort(cc_1.KEXFailType.WrongSecurityLevel);
+                return Inclusion_1.SecurityBootstrapFailure.S2WrongSecurityLevel;
+            }
+            for (const key of kexSet.grantedKeys) {
+                // Request network key and wait for including node to respond
+                const keyReportPromise = this.driver.waitForCommand((cc) => cc instanceof cc_1.Security2CCNetworkKeyReport
+                    || cc instanceof cc_1.Security2CCKEXFail, cc_1.inclusionTimeouts.TB4).catch(() => "timeout");
+                await api.requestNetworkKey(key);
+                const keyReport = await keyReportPromise;
+                if (keyReport === "timeout")
+                    return abortTimeout();
+                if (keyReport instanceof cc_1.Security2CCKEXFail) {
+                    return abortCanceled();
+                }
+                if (!keyReport.isEncapsulatedWith(core_1.CommandClasses["Security 2"], cc_1.Security2Command.MessageEncapsulation)) {
+                    this.driver.controllerLog.logNode(bootstrappingNode.id, {
+                        message: `Security S2 bootstrapping failed: Command received without encryption`,
+                        direction: "inbound",
+                        level: "warn",
+                    });
+                    await abort(cc_1.KEXFailType.WrongSecurityLevel);
+                    return Inclusion_1.SecurityBootstrapFailure.S2WrongSecurityLevel;
+                }
+                // Ensure it was received encrypted with the temporary key
+                if (!securityManager.hasUsedSecurityClass(bootstrappingNode.id, core_1.SecurityClass.Temporary)) {
+                    this.driver.controllerLog.logNode(bootstrappingNode.id, {
+                        message: `Security S2 bootstrapping failed: Node used wrong key to communicate.`,
+                        level: "warn",
+                    });
+                    await abort(cc_1.KEXFailType.WrongSecurityLevel);
+                    return Inclusion_1.SecurityBootstrapFailure.S2WrongSecurityLevel;
+                }
+                const securityClass = keyReport.grantedKey;
+                if (securityClass !== key) {
+                    // and that the granted key is the requested key
+                    this.driver.controllerLog.logNode(bootstrappingNode.id, {
+                        message: `Security S2 bootstrapping failed: Received key for wrong security class`,
+                        direction: "inbound",
+                        level: "warn",
+                    });
+                    await abort(cc_1.KEXFailType.DifferentKey);
+                    return Inclusion_1.SecurityBootstrapFailure.ParameterMismatch;
+                }
+                // Store the network key
+                receivedKeys.set(securityClass, keyReport.networkKey);
+                securityManager.setKey(securityClass, keyReport.networkKey);
+                if (securityClass === core_1.SecurityClass.S0_Legacy) {
+                    // TODO: This is awkward to have here
+                    this.driver["_securityManager"] = new core_1.SecurityManager({
+                        ownNodeId: this._ownNodeId,
+                        networkKey: keyReport.networkKey,
+                        nonceTimeout: this.driver.options.timeouts.nonce,
+                    });
+                }
+                // Force nonce synchronization, then verify the network key
+                securityManager.deleteNonce(bootstrappingNode.id);
+                await api.withOptions({
+                    s2OverrideSecurityClass: securityClass,
+                }).verifyNetworkKey();
+                // Force nonce synchronization again for the temporary key
+                securityManager.deleteNonce(bootstrappingNode.id);
+                // Wait for including node to send its public key
+                const transferEnd = await this.driver.waitForCommand((cc) => cc instanceof cc_1.Security2CCTransferEnd
+                    || cc instanceof cc_1.Security2CCKEXFail, cc_1.inclusionTimeouts.TB5).catch(() => "timeout");
+                if (transferEnd === "timeout")
+                    return abortTimeout();
+                if (transferEnd instanceof cc_1.Security2CCKEXFail) {
+                    return abortCanceled();
+                }
+                if (!keyReport.isEncapsulatedWith(core_1.CommandClasses["Security 2"], cc_1.Security2Command.MessageEncapsulation)) {
+                    this.driver.controllerLog.logNode(bootstrappingNode.id, {
+                        message: `Security S2 bootstrapping failed: Command received without encryption`,
+                        direction: "inbound",
+                        level: "warn",
+                    });
+                    await abort(cc_1.KEXFailType.WrongSecurityLevel);
+                    return Inclusion_1.SecurityBootstrapFailure.S2WrongSecurityLevel;
+                }
+                else if (!transferEnd.keyVerified || transferEnd.keyRequestComplete) {
+                    this.driver.controllerLog.logNode(bootstrappingNode.id, {
+                        message: `Security S2 bootstrapping failed: Invalid TransferEnd received`,
+                        direction: "inbound",
+                        level: "warn",
+                    });
+                    await abort(cc_1.KEXFailType.WrongSecurityLevel);
+                    return Inclusion_1.SecurityBootstrapFailure.NodeCanceled;
+                }
+            }
+            // Confirm end of bootstrapping
+            await api.endKeyExchange();
+            // Remember all security classes we were granted
+            for (const securityClass of core_1.securityClassOrder) {
+                bootstrappingNode.securityClasses.set(securityClass, kexSet.grantedKeys.includes(securityClass));
+            }
+            // And store the keys
+            for (const [secClass, key] of receivedKeys) {
+                this.driver.cacheSet(NetworkCache_1.cacheKeys.controller.securityKeys(secClass), key);
+            }
+            this.driver.driverLog.print(`Security S2 bootstrapping successful with these security classes:${[
+                ...bootstrappingNode.securityClasses.entries(),
+            ]
+                .filter(([, v]) => v)
+                .map(([k]) => `\n· ${(0, shared_1.getEnumMemberName)(core_1.SecurityClass, k)}`)
+                .join("")}`);
+            // success 🎉
+        }
+        catch (e) {
+            let errorMessage = `Security S2 bootstrapping failed, no S2 security classes were granted`;
+            let result = Inclusion_1.SecurityBootstrapFailure.Unknown;
+            if (!(0, core_1.isZWaveError)(e)) {
+                errorMessage += `: ${e}`;
+            }
+            else if (e.code === core_1.ZWaveErrorCodes.Controller_MessageExpired) {
+                errorMessage += ": a secure inclusion timer has elapsed.";
+                result = Inclusion_1.SecurityBootstrapFailure.Timeout;
+            }
+            else if (e.code !== core_1.ZWaveErrorCodes.Controller_MessageDropped
+                && e.code !== core_1.ZWaveErrorCodes.Controller_NodeTimeout) {
+                errorMessage += `: ${e.message}`;
+            }
+            this.driver.controllerLog.logNode(bootstrappingNode.id, errorMessage, "warn");
+            // Remember that we were NOT granted any S2 security classes
+            unGrantSecurityClasses();
+            bootstrappingNode.removeCC(core_1.CommandClasses["Security 2"]);
+            return result;
+        }
+        finally {
+            // Whatever happens, no further communication needs the temporary key
+            deleteTempKey();
+        }
+    }
+    async afterJoiningNetwork() {
+        this.driver.driverLog.print("waiting for security bootstrapping...");
+        const bootstrapInitStart = Date.now();
+        const supportedCCs = (0, NodeInformationFrame_1.determineNIF)().supportedCCs;
+        const supportsS0 = supportedCCs.includes(core_1.CommandClasses.Security);
+        const supportsS2 = supportedCCs.includes(core_1.CommandClasses["Security 2"]);
+        let initTimeout;
+        let initPredicate;
+        // KEX Get must be received:
+        // - no later than 10..30 seconds after the inclusion if S0 is supported
+        // - no later than 30 seconds after the inclusion if only S2 is supported
+        //   For simplicity, we wait the full 30s.
+        // SecurityCCSchemeGet must be received no later than 10 seconds
+        //   after the inclusion if S0 is supported
+        if (supportsS0 && supportsS2) {
+            initTimeout = cc_1.inclusionTimeouts.TB1;
+            initPredicate = (cc) => cc instanceof cc_1.SecurityCCSchemeGet
+                || cc instanceof cc_1.Security2CCKEXGet;
+        }
+        else if (supportsS2) {
+            initTimeout = cc_1.inclusionTimeouts.TB1;
+            initPredicate = (cc) => cc instanceof cc_1.Security2CCKEXGet;
+        }
+        else if (supportsS0) {
+            initTimeout = 10000;
+            initPredicate = (cc) => cc instanceof cc_1.SecurityCCSchemeGet;
+        }
+        else {
+            initTimeout = 0;
+            initPredicate = () => false;
+        }
+        const bootstrapInitPromise = this.driver.waitForCommand(initPredicate, initTimeout).catch(() => "timeout");
+        const identifySelf = async () => {
+            // Update own node ID and other controller flags.
+            await this.identify().catch(shared_1.noop);
+            // Notify applications that we're now part of a new network
+            // The driver will point the databases to the new home ID
+            this.emit("network found", this._homeId, this._ownNodeId);
+            // Figure out the controller's network role
+            await this.getControllerCapabilities().catch(shared_1.noop);
+            // Create new node instances
+            const { nodeIds } = await this.getSerialApiInitData();
+            await this.initNodes(nodeIds, [], () => Promise.resolve());
+        };
+        // Do the self-identification while waiting for the bootstrap init command
+        const [bootstrapInit] = await Promise.all([
+            bootstrapInitPromise,
+            identifySelf(),
+        ]);
+        if (bootstrapInit === "timeout") {
+            this.driver.controllerLog.print("No security bootstrapping command received, continuing without encryption...");
+        }
+        else if (bootstrapInit instanceof cc_1.SecurityCCSchemeGet) {
+            const nodeId = bootstrapInit.nodeId;
+            const bootstrappingNode = this.nodes.get(nodeId);
+            if (!bootstrappingNode) {
+                this.driver.controllerLog.logNode(nodeId, {
+                    message: "Received S2 bootstrap initiation from unknown node, ignoring...",
+                    level: "warn",
+                });
+            }
+            else if (Date.now() - bootstrapInitStart > 10000) {
+                // Received too late, S0 bootstrapping must not continue
+                this.driver.controllerLog.print("Security S0 bootstrapping command received too late, continuing without encryption...");
+            }
+            else {
+                // We definitely know that the node supports S0
+                bootstrappingNode.addCC(core_1.CommandClasses.Security, {
+                    secure: true,
+                    isSupported: true,
+                });
+                this.driver.controllerLog.logNode(nodeId, {
+                    message: `Received S0 bootstrap initiation`,
+                });
+                const bootstrapResult = await this.expectSecurityBootstrapS0(bootstrappingNode);
+                if (bootstrapResult !== undefined) {
+                    // If there was a failure, mark S0 as not supported
+                    bootstrappingNode.removeCC(core_1.CommandClasses.Security);
+                }
+            }
+        }
+        else if (bootstrapInit instanceof cc_1.Security2CCKEXGet) {
+            const nodeId = bootstrapInit.nodeId;
+            const bootstrappingNode = this.nodes.get(nodeId);
+            if (!bootstrappingNode) {
+                this.driver.controllerLog.logNode(nodeId, {
+                    message: "Received S2 bootstrap initiation from unknown node, ignoring...",
+                    level: "warn",
+                });
+            }
+            else {
+                // We definitely know that the node supports S2
+                bootstrappingNode.addCC(core_1.CommandClasses["Security 2"], {
+                    secure: true,
+                    isSupported: true,
+                });
+                let grant;
+                switch (this._joinNetworkOptions?.strategy) {
+                    // case JoinNetworkStrategy.Security_S2: {
+                    // 	grant = this._joinNetworkOptions.requested;
+                    // 	break;
+                    // }
+                    // case JoinNetworkStrategy.SmartStart:
+                    case Inclusion_1.JoinNetworkStrategy.Default:
+                    default: {
+                        // No options given, just request all keys
+                        grant = {
+                            securityClasses: [...core_1.securityClassOrder],
+                            clientSideAuth: false,
+                        };
+                        break;
+                    }
+                }
+                if (grant) {
+                    this.driver.controllerLog.logNode(nodeId, {
+                        message: `Received S2 bootstrap initiation, requesting keys: ${grant.securityClasses.map((sc) => `\n· ${(0, shared_1.getEnumMemberName)(core_1.SecurityClass, sc)}\n`).join("")}
+  client-side auth: ${grant.clientSideAuth}`,
+                    });
+                    const bootstrapResult = await this
+                        .expectSecurityBootstrapS2(bootstrappingNode, grant);
+                    if (bootstrapResult !== undefined) {
+                        // If there was a failure, mark S2 as not supported
+                        bootstrappingNode.removeCC(core_1.CommandClasses["Security 2"]);
+                    }
+                }
+            }
+        }
+        this._joinNetworkOptions = undefined;
+        // Read protocol information of all nodes
+        for (const node of this.nodes.values()) {
+            if (node.isControllerNode)
+                continue;
+            await node["queryProtocolInfo"]();
+        }
+        // Notify applications that joining the network is complete
+        this.emit("network joined");
+    }
 };
 exports.ZWaveController = ZWaveController;
 exports.ZWaveController = ZWaveController = __decorate([