entr-ble 1.0.0__tar.gz

entr_ble-1.0.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Johann Lejeune
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

entr_ble-1.0.0/PKG-INFO

@@ -0,0 +1,89 @@
+Metadata-Version: 2.4
+Name: entr-ble
+Version: 1.0.0
+Summary: Python client for ENTR Bluetooth locks
+Author: Johann Lejeune
+Author-email: Johann Lejeune <tofupedia.fr@gmail.com>
+License-Expression: MIT
+License-File: LICENSE
+Requires-Dist: bleak>=3.0.2
+Requires-Dist: cryptography>=48.0.1
+Requires-Python: >=3.14
+Project-URL: Repository, https://github.com/johannlejeune/entr-ble
+Project-URL: Issues, https://github.com/johannlejeune/entr-ble/issues
+Description-Content-Type: text/markdown
+
+# ENTR BLE
+
+**Your ENTR lock, over Bluetooth.** A Python library, a command-line interface, and a Home Assistant integration sharing the same protocol implementation.
+
+> [!WARNING]
+> This project is fully vibe coded, but it is being used in a working Home Assistant installation.\
+> It was created to integrate the lock into Home Assistant and get rid of the horrible mobile app.
+
+[![GitHub release](https://img.shields.io/github/v/release/johannlejeune/entr-ble)](https://github.com/johannlejeune/entr-ble/releases/latest)
+[![Checks](https://github.com/johannlejeune/entr-ble/actions/workflows/check.yml/badge.svg)](https://github.com/johannlejeune/entr-ble/actions/workflows/check.yml)
+[![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
+
+## Choose your starting point
+
+| Use ENTR BLE to… | Start here | Component |
+| --- | --- | --- |
+| Control a lock from dashboards and automations | [Home Assistant guide](custom_components/entr_ble/README.md) | HACS custom integration |
+| Set up a lock, manage keys, or control it from a terminal | [CLI guide](packages/entr-ble-cli/README.md) | `entr-ble-cli` command |
+| Build your own application | [Python library guide](src/entr_ble/README.md) | `entr-ble` → `EntrLockClient` |
+
+The library is independent of the CLI and Home Assistant. Both frontends use its asynchronous API for pairing, encrypted sessions, and lock operations.
+
+## What you can do
+
+- Discover nearby locks and initialize a new lock or recover owner access.
+- Lock and unlock, read battery and reported door/lock status.
+- Create, activate, suspend, and revoke user keys.
+- Change settings, calibrate the lock and magnet, and read diagnostics on supported firmware.
+- Import CLI credentials into Home Assistant without enrolling again.
+
+See [feature coverage](docs/FEATURES.md) for the complete command matrix and firmware requirements, and [protocol notes](docs/PROTOCOL.md) for the underlying BLE protocol.
+
+## Before you start
+
+The Python packages require **Python 3.14+** and a working Bluetooth adapter; the HACS integration requires **Home Assistant 2026.9.3+** and connectable Bluetooth coverage.
+
+ENTR has a single owner slot. Recovering ownership replaces the previous owner's credential. To keep the mobile app as owner, redeem an additional user key instead. Each component's guide explains the choice before setup.
+
+Hardware observations come from an **ENTR EURO with communication version 1.29r5**. Firmware support varies, and reported state can be stale after manual operation. This is an independent project, unaffiliated with ASSA ABLOY.
+
+## Development
+
+This repository is a uv workspace:
+
+```text
+src/entr_ble/                  Python library
+packages/entr-ble-cli/          CLI and local credential store
+custom_components/entr_ble/    Home Assistant integration
+docs/                        Feature coverage and protocol reference
+```
+
+From the repository root, install all packages and the isolated Home Assistant development dependencies. The full suite requires Python 3.14.2+.
+
+```sh
+uv sync --locked --all-packages --group hacs
+uv run --no-sync ruff check .
+uv run --no-sync ruff format --check .
+uv run --no-sync basedpyright
+uv run --no-sync python -m unittest discover -s tests -v
+uv run --no-sync python -m unittest discover -s packages/entr-ble-cli/tests -v
+uv build --all-packages --no-sources
+```
+
+Tests simulate BLE responses and do not operate a physical lock. The [CI workflow](.github/workflows/check.yml) also validates the integration with Hassfest and HACS. Builds produce separate library and CLI wheels and source distributions in `dist/`; hardware behavior still needs verification on the target lock.
+
+## Releases
+
+All components release together with one version and [changelog](CHANGELOG.md). Release Please prepares a release PR; merging it runs the checks, publishes both Python packages to PyPI, and publishes the matching GitHub release for HACS. See [release setup and recovery](docs/RELEASING.md).
+
+## Support and license
+
+[Report an issue](https://github.com/johannlejeune/entr-ble/issues) with the component, software version, lock model, communication version if known, and the command or action that failed. Remove credentials and passwords from anything you share.
+
+Licensed under the [MIT License](LICENSE).

entr_ble-1.0.0/README.md

@@ -0,0 +1,74 @@
+# ENTR BLE
+
+**Your ENTR lock, over Bluetooth.** A Python library, a command-line interface, and a Home Assistant integration sharing the same protocol implementation.
+
+> [!WARNING]
+> This project is fully vibe coded, but it is being used in a working Home Assistant installation.\
+> It was created to integrate the lock into Home Assistant and get rid of the horrible mobile app.
+
+[![GitHub release](https://img.shields.io/github/v/release/johannlejeune/entr-ble)](https://github.com/johannlejeune/entr-ble/releases/latest)
+[![Checks](https://github.com/johannlejeune/entr-ble/actions/workflows/check.yml/badge.svg)](https://github.com/johannlejeune/entr-ble/actions/workflows/check.yml)
+[![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
+
+## Choose your starting point
+
+| Use ENTR BLE to… | Start here | Component |
+| --- | --- | --- |
+| Control a lock from dashboards and automations | [Home Assistant guide](custom_components/entr_ble/README.md) | HACS custom integration |
+| Set up a lock, manage keys, or control it from a terminal | [CLI guide](packages/entr-ble-cli/README.md) | `entr-ble-cli` command |
+| Build your own application | [Python library guide](src/entr_ble/README.md) | `entr-ble` → `EntrLockClient` |
+
+The library is independent of the CLI and Home Assistant. Both frontends use its asynchronous API for pairing, encrypted sessions, and lock operations.
+
+## What you can do
+
+- Discover nearby locks and initialize a new lock or recover owner access.
+- Lock and unlock, read battery and reported door/lock status.
+- Create, activate, suspend, and revoke user keys.
+- Change settings, calibrate the lock and magnet, and read diagnostics on supported firmware.
+- Import CLI credentials into Home Assistant without enrolling again.
+
+See [feature coverage](docs/FEATURES.md) for the complete command matrix and firmware requirements, and [protocol notes](docs/PROTOCOL.md) for the underlying BLE protocol.
+
+## Before you start
+
+The Python packages require **Python 3.14+** and a working Bluetooth adapter; the HACS integration requires **Home Assistant 2026.9.3+** and connectable Bluetooth coverage.
+
+ENTR has a single owner slot. Recovering ownership replaces the previous owner's credential. To keep the mobile app as owner, redeem an additional user key instead. Each component's guide explains the choice before setup.
+
+Hardware observations come from an **ENTR EURO with communication version 1.29r5**. Firmware support varies, and reported state can be stale after manual operation. This is an independent project, unaffiliated with ASSA ABLOY.
+
+## Development
+
+This repository is a uv workspace:
+
+```text
+src/entr_ble/                  Python library
+packages/entr-ble-cli/          CLI and local credential store
+custom_components/entr_ble/    Home Assistant integration
+docs/                        Feature coverage and protocol reference
+```
+
+From the repository root, install all packages and the isolated Home Assistant development dependencies. The full suite requires Python 3.14.2+.
+
+```sh
+uv sync --locked --all-packages --group hacs
+uv run --no-sync ruff check .
+uv run --no-sync ruff format --check .
+uv run --no-sync basedpyright
+uv run --no-sync python -m unittest discover -s tests -v
+uv run --no-sync python -m unittest discover -s packages/entr-ble-cli/tests -v
+uv build --all-packages --no-sources
+```
+
+Tests simulate BLE responses and do not operate a physical lock. The [CI workflow](.github/workflows/check.yml) also validates the integration with Hassfest and HACS. Builds produce separate library and CLI wheels and source distributions in `dist/`; hardware behavior still needs verification on the target lock.
+
+## Releases
+
+All components release together with one version and [changelog](CHANGELOG.md). Release Please prepares a release PR; merging it runs the checks, publishes both Python packages to PyPI, and publishes the matching GitHub release for HACS. See [release setup and recovery](docs/RELEASING.md).
+
+## Support and license
+
+[Report an issue](https://github.com/johannlejeune/entr-ble/issues) with the component, software version, lock model, communication version if known, and the command or action that failed. Remove credentials and passwords from anything you share.
+
+Licensed under the [MIT License](LICENSE).

entr_ble-1.0.0/pyproject.toml

@@ -0,0 +1,55 @@
+[project]
+name = "entr-ble"
+version = "1.0.0"
+description = "Python client for ENTR Bluetooth locks"
+readme = "README.md"
+license = "MIT"
+license-files = ["LICENSE"]
+requires-python = ">=3.14"
+dependencies = [
+    "bleak>=3.0.2",
+    "cryptography>=48.0.1",
+]
+
+[[project.authors]]
+name = "Johann Lejeune"
+email = "tofupedia.fr@gmail.com"
+
+[project.urls]
+Repository = "https://github.com/johannlejeune/entr-ble"
+Issues = "https://github.com/johannlejeune/entr-ble/issues"
+
+[tool.ruff.lint.per-file-ignores]
+"src/entr_ble/client/*.py" = ["PLR0402"]
+
+[tool.basedpyright]
+typeCheckingMode = "standard"
+include = [
+    "src",
+    "packages/entr-ble-cli/src",
+    "custom_components",
+    "tests",
+    "packages/entr-ble-cli/tests",
+]
+extraPaths = [
+    "src",
+    "packages/entr-ble-cli/src",
+    ".",
+]
+
+[tool.uv.workspace]
+members = ["packages/entr-ble-cli"]
+
+[tool.uv.dependency-groups.hacs]
+requires-python = ">=3.14.2"
+
+[build-system]
+requires = ["uv_build>=0.12.0,<0.13.0"]
+build-backend = "uv_build"
+
+[dependency-groups]
+dev = [
+    "basedpyright>=1.40.1",
+    "ruff>=0.16.9",
+]
+hacs = ["homeassistant==2026.9.4"]

entr_ble-1.0.0/pyproject.toml.orig

@@ -0,0 +1,46 @@
+[project]
+name = "entr-ble"
+version = "1.0.0"
+description = "Python client for ENTR Bluetooth locks"
+readme = "README.md"
+license = "MIT"
+license-files = ["LICENSE"]
+authors = [
+    { name = "Johann Lejeune", email = "tofupedia.fr@gmail.com" }
+]
+requires-python = ">=3.14"
+dependencies = [
+    "bleak>=3.0.2",
+    "cryptography>=48.0.1",
+]
+
+[project.urls]
+Repository = "https://github.com/johannlejeune/entr-ble"
+Issues = "https://github.com/johannlejeune/entr-ble/issues"
+
+[tool.ruff.lint.per-file-ignores]
+"src/entr_ble/client/*.py" = ["PLR0402"]
+
+[tool.basedpyright]
+typeCheckingMode = "standard"
+include = ["src", "packages/entr-ble-cli/src", "custom_components", "tests", "packages/entr-ble-cli/tests"]
+extraPaths = ["src", "packages/entr-ble-cli/src", "."]
+
+[tool.uv.workspace]
+members = ["packages/entr-ble-cli"]
+
+[tool.uv.dependency-groups]
+hacs = { requires-python = ">=3.14.2" }
+
+[build-system]
+requires = ["uv_build>=0.12.0,<0.13.0"]
+build-backend = "uv_build"
+
+[dependency-groups]
+dev = [
+    "basedpyright>=1.40.1",
+    "ruff>=0.16.9",
+]
+hacs = [
+    "homeassistant==2026.9.4",
+]

entr_ble-1.0.0/src/entr_ble/README.md

@@ -0,0 +1,110 @@
+# ENTR BLE · Python library
+
+**An asynchronous Python client for ENTR Bluetooth locks.** Discover locks, provision credentials, restore encrypted sessions, and send lock commands using Bleak.
+
+[Project overview](../../README.md) · [CLI](../../packages/entr-ble-cli/README.md) · [Home Assistant](../../custom_components/entr_ble/README.md) · [Protocol reference](../../docs/PROTOCOL.md)
+
+## Installation
+
+Requires **Python 3.14+** and a working Bluetooth adapter. On Linux, Bluetooth access uses BlueZ and the system D-Bus.
+
+Add the library to your project:
+
+```sh
+uv add entr-ble
+```
+
+For environments using pip, use `pip install entr-ble`.
+
+From a checkout, install the library into the repository's virtual environment:
+
+```sh
+uv sync --locked
+```
+
+To install directly from the repository into your own environment:
+
+```sh
+pip install "git+https://github.com/johannlejeune/entr-ble.git"
+```
+
+The package is named `entr-ble`; import it as `entr_ble`. For a terminal command and credential storage, install the separate [CLI](../../packages/entr-ble-cli/README.md).
+
+## Read status with an existing key
+
+`EntrLockClient` accepts a Bluetooth address or a Bleak `BLEDevice`. Connect, read the communication version, then restore the saved session before issuing encrypted commands:
+
+```python
+from entr_ble import EntrLockClient
+
+
+async def read_status(address, kdf_id, role, aes_key):
+    client = EntrLockClient(address)
+    try:
+        await client.connect()
+        await client.fetch_comm_version()
+        await client.kdf_resync(kdf_id, role, aes_key)
+        return await client.get_device_config()
+    finally:
+        await client.disconnect()
+```
+
+Call this function from your application's event loop. `aes_key` is the saved **16-byte key**; decode hexadecimal storage with `bytes.fromhex()` before passing it. `kdf_id` and `role` are the values returned during provisioning.
+
+Locking and unlocking also require the saved user id, application id, and BLE lock key. Within the restored session, use:
+
+```python
+await client.unlock(user_id, app_id, ble_ekey)
+await client.lock(user_id, app_id, ble_ekey)
+```
+
+The ids are each 16 bytes, and `ble_ekey` is 32 bytes. Keep one command in flight per client and disconnect after use. After reconnecting, restore the session again.
+
+## Provisioning and credentials
+
+For a new credential, the protocol starts with `pair()` and `handshake(app_id)`, followed by `set_owner()`, `recover_owner()`, or `get_new_key()`. These methods acknowledge provisioning responses; your application must persist the returned credential fields and the session key.
+
+**Recovering the owner slot revokes the previous owner's credential.** Redeem an additional user key to preserve the existing owner. See [initial setup](../../docs/FEATURES.md#initial-setup) and the [CLI setup guide](../../packages/entr-ble-cli/README.md#2-choose-how-to-access-the-lock) for the available paths.
+
+Credentials grant access to the lock. The library leaves persistence to the caller; protect keys and keep them out of logs and version control.
+
+## API guide
+
+Every public method and helper has a docstring describing inputs, results, and restrictions. Start with `help(EntrLockClient)` or `help(EntrLockClient.unlock)`. Command docstrings include protocol names and decimal command numbers, matching [const.py](const.py).
+
+| Area | Implementation |
+| --- | --- |
+| Pairing, owner enrollment, key activation, session recovery | [client/pairing.py](client/pairing.py) |
+| Lock and unlock | [client/access.py](client/access.py) |
+| Configuration, battery, serial number, device info | [client/status.py](client/status.py) |
+| User keys and permissions | [client/users.py](client/users.py) |
+| Settings, calibration, factory reset | [client/config.py](client/config.py) |
+| Clock, audit trail, error log | [client/diagnostics.py](client/diagnostics.py) |
+| Field encoding and returned dictionary definitions | [client/fields.py](client/fields.py) |
+| Identify locks from BLE advertisements without connecting | [advertising.py](advertising.py) |
+
+See [feature coverage](../../docs/FEATURES.md) for firmware restrictions. Reported status may be stale after manual operation; see [protocol notes](../../docs/PROTOCOL.md).
+
+## Errors and timeouts
+
+| Exception | Meaning |
+| --- | --- |
+| `ValueError` | Invalid field length or encoding |
+| `EntrLockError` | Lock rejection; exposes numeric `category` and `detail` |
+| `EntrProtocolError` | Malformed/unexpected response or missing session prerequisite; parent of `EntrLockError` |
+| `TimeoutError` | No protocol response within eight seconds |
+| Bleak backend exceptions | Bluetooth connection or I/O failure |
+
+The constructor's `timeout` controls the Bleak **connection timeout**, separately from the protocol response timeout. Backend errors propagate to the caller.
+
+## Development
+
+From the repository root, run the library tests without Bluetooth hardware:
+
+```sh
+uv run --no-sync python -m unittest discover -s tests -p 'test_library*.py' -v
+```
+
+See the [development guide](../../README.md#development) for workspace setup, integration tests, and packaging.
+
+Licensed under the [MIT License](../../LICENSE).

entr_ble-1.0.0/src/entr_ble/__init__.py

@@ -0,0 +1,5 @@
+"""Asynchronous ENTR lock access through EntrLockClient and its protocol errors."""
+
+from .client import EntrLockClient, EntrLockError, EntrProtocolError
+
+__all__ = ["EntrLockClient", "EntrLockError", "EntrProtocolError"]

entr_ble-1.0.0/src/entr_ble/advertising.py

@@ -0,0 +1,77 @@
+"""Decoding of the ENTR BLE advertisement.
+
+Locks broadcast their name and initialisation state in the clear, so a scan can identify
+them without connecting or authenticating.
+"""
+
+from dataclasses import dataclass
+
+from . import const
+
+
+@dataclass
+class LockAdvertisement:
+    """A discovered lock's BLE address, decoded name, raw state/version nibbles, and
+    RSSI in dBm.
+    """
+
+    address: str
+    name: str
+    lock_state: int
+    advert_version: int
+    rssi: int
+
+    @property
+    def state_name(self) -> str:
+        """Return the known state label, or ``unknown (<value>)`` for an unrecognized
+        state.
+        """
+        return const.LOCK_STATE_NAMES.get(
+            self.lock_state, f"unknown ({self.lock_state})"
+        )
+
+
+# The name sits in a fixed-width field: space padded, and followed by a trailing
+# control byte that belongs to neither the name nor the padding.
+PADDING = bytes(range(0x21))
+
+
+def parse_advertisement(address: str, adv) -> LockAdvertisement | None:
+    """Return the first ENTR manufacturer payload as a ``LockAdvertisement``, or
+    ``None`` when none matches.
+
+    ``adv`` is a Bleak advertisement or an object exposing ``manufacturer_data``,
+    ``local_name``, and ``rssi``. Empty payloads and product IDs without a following
+    state/version byte are skipped. Version 1 supplies an encoded name when present;
+    other layouts use the stripped local name, falling back to ``?``. Name decoding
+    replaces invalid characters. ``address`` is copied unchanged.
+    """
+    for payload in adv.manufacturer_data.values():
+        if not payload or payload[0] != const.MANUFACTURER_PRODUCT_ID:
+            continue
+        custom = payload[1:]
+        if not custom:
+            continue
+        advert_version = (custom[0] >> 4) & 0x0F
+        lock_state = custom[0] & 0x0F
+        if advert_version == 1 and len(custom) > 4:
+            name = _decode_name(custom[3], custom[4:])
+        else:
+            name = (adv.local_name or "").strip() or "?"
+        return LockAdvertisement(
+            address=address,
+            name=name,
+            lock_state=lock_state,
+            advert_version=advert_version,
+            rssi=adv.rssi,
+        )
+    return None
+
+
+def _decode_name(encoding_byte: int, raw: bytes) -> str:
+    # Use latin-1 for unknown encoding signs so every byte remains decodable.
+    encoding = const.LOCK_NAME_ENCODINGS.get(encoding_byte, "latin-1")
+    try:
+        return raw.strip(PADDING).decode(encoding, errors="replace")
+    except LookupError:
+        return raw.strip(PADDING).decode("latin-1", errors="replace")

entr_ble-1.0.0/src/entr_ble/client/__init__.py

@@ -0,0 +1,30 @@
+from .access import Access
+from .config import Config
+from .diagnostics import Diagnostics
+from .fields import build_lock_name, settings_status_byte, user_id_bytes
+from .pairing import Pairing
+from .status import Status
+from .transport import EntrLockError, EntrProtocolError
+from .users import Users
+
+
+class EntrLockClient(Pairing, Access, Status, Users, Config, Diagnostics):
+    """Asynchronous ENTR lock client combining provisioning, access, status, users,
+    configuration and diagnostics.
+
+    Accepts a Bluetooth address or Bleak BLEDevice and an optional connection timeout in
+    seconds. Call connect(), then pair() and handshake() for provisioning or
+    kdf_resync() with saved credentials for normal use. Run one command at a time and
+    call disconnect() in a finally block. See TransportClient for shared session state
+    and command errors.
+    """
+
+
+__all__ = [
+    "EntrLockClient",
+    "EntrLockError",
+    "EntrProtocolError",
+    "build_lock_name",
+    "settings_status_byte",
+    "user_id_bytes",
+]

entr_ble-1.0.0/src/entr_ble/client/access.py

@@ -0,0 +1,58 @@
+import entr_ble.const as const
+
+from .fields import fixed_bytes
+from .transport import EntrProtocolError, TransportClient
+
+
+class Access(TransportClient):
+    """Credential-based physical lock operations over an established session."""
+
+    async def unlock(
+        self, user_id: bytes, app_id: bytes, ble_ekey: bytes, mode: int | None = None
+    ) -> None:
+        """UNLOCK (17): unlock using a 16-byte user ID, 16-byte application ID and
+        32-byte BLE key.
+
+        Requires an established session and an active credential. Mode 0 selects
+        auto-lock and mode 1 manual operation; omitted mode follows cached status,
+        falling back to manual when status is unavailable. Returns None after an
+        operation-status response or explicit success; a missing confirmation raises
+        EntrProtocolError and lock rejection raises EntrLockError. Invalid field lengths
+        raise ValueError.
+        """
+        if mode is None:
+            # Derive the mode from auto-lock: enabled sends 0, disabled sends 1.
+            auto_lock = self.status["auto_lock"] if self.status else False
+            mode = const.MODE_AUTO if auto_lock else const.MODE_MANUAL
+        fields = (
+            fixed_bytes(user_id, 16, "user id")
+            + fixed_bytes(app_id, 16, "application id")
+            + fixed_bytes(ble_ekey, 32, "lock key")
+            + bytes([mode])
+        )
+        await self._operate(const.CMD_UNLOCK, fields)
+
+    async def lock(self, user_id: bytes, app_id: bytes, ble_ekey: bytes) -> None:
+        """LOCK (18): lock using a 16-byte user ID, 16-byte application ID and 32-byte
+        BLE key.
+
+        Requires an established session and an active credential; the operation always
+        sends mode 0. Returns None after an operation-status response or explicit
+        success; a missing confirmation raises EntrProtocolError and lock rejection
+        raises EntrLockError. Invalid field lengths raise ValueError.
+        """
+        # Lock always uses mode 0.
+        fields = (
+            fixed_bytes(user_id, 16, "user id")
+            + fixed_bytes(app_id, 16, "application id")
+            + fixed_bytes(ble_ekey, 32, "lock key")
+            + bytes([const.MODE_AUTO])
+        )
+        await self._operate(const.CMD_LOCK, fields)
+
+    async def _operate(self, command, fields):
+        outer_command, payload = await self._exchange_encrypted(command, fields)
+        if outer_command != const.CMD_OP_STATUS and not self._is_explicit_success(
+            outer_command, payload, command
+        ):
+            raise EntrProtocolError(f"lock did not confirm command {command}")