@honeybbq/teamspeak-client 0.3.1 → 1.0.0-beta.1

package/dist/index.js

@@ -0,0 +1,3967 @@
+import { CommandTimeoutError, ErrorCode, NotConnectedError, Reason, ServerError, TeamspeakError, asChannelID, asClientID, asUID, noopLogger } from "@honeybbq/teamspeak-core";
+import { createCipheriv, createECDH, createHash, createPrivateKey, createPublicKey, createSign, createVerify, generateKeyPairSync, randomBytes, timingSafeEqual } from "node:crypto";
+import { ed25519 } from "@noble/curves/ed25519.js";
+import { lookup, resolveSrv } from "node:dns/promises";
+import { connect, createConnection, isIP } from "node:net";
+import { createSocket } from "node:dgram";
+import { buildCommand, buildCommandOrdered, encodeRequest, parseClient, parseCommand, parseErrorCode, parseIconID, parseInt10, parseServerError, parseUint16, parseUint64, responseSpec, sleep, splitCommandRows } from "@honeybbq/teamspeak-core/internal";
+import { pipeline } from "node:stream/promises";
+import { channel, tracingChannel } from "node:diagnostics_channel";
+export * from "@honeybbq/teamspeak-core";
+/** Where a client is in its connection's life. */
+var ClientStatus = /* @__PURE__ */ Object.freeze({
+	/** Not connected: before `connect()`, after `disconnect()`, or after a drop. */
+	Disconnected: "disconnected",
+	/** Connecting: `connect()` is waiting for the handshake. */
+	Connecting: "connecting",
+	/** Connected: the handshake completed and commands can be sent. */
+	Connected: "connected"
+});
+//#endregion
+//#region src/errors.ts
+/** `connect()` was called on a client that is connecting or connected. */
+var AlreadyConnectedError = class extends TeamspeakError {
+	/** {@inheritDoc TeamspeakError.kind} */
+	static kind = "AlreadyConnectedError";
+	constructor() {
+		super("already connecting or connected");
+		this.name = "AlreadyConnectedError";
+	}
+};
+/**
+* The address a client was given cannot be connected to: no host, a host with
+* characters no host name or IP address has, or a port outside 1–65535.
+* `connect()` rejects with it before it starts, and the client stays
+* disconnected. A name that does not resolve is not this: that fails with a
+* TeamspeakError whose `cause` is the lookup's error, since DNS failures are
+* often transient.
+*/
+var InvalidAddressError = class extends TeamspeakError {
+	/** {@inheritDoc TeamspeakError.kind} */
+	static kind = "InvalidAddressError";
+	/** The address as given. */
+	address;
+	constructor(address, reason) {
+		super(`invalid address ${JSON.stringify(address)}: ${reason}`);
+		this.name = "InvalidAddressError";
+		this.address = address;
+	}
+};
+/**
+* A packet failed authentication: it was corrupted, or not from the server.
+* Internal: the packet is dropped, and this never reaches a caller.
+*/
+var EAXTagMismatchError = class extends TeamspeakError {
+	/** {@inheritDoc TeamspeakError.kind} */
+	static kind = "EAXTagMismatchError";
+	constructor() {
+		super("EAX tag mismatch");
+		this.name = "EAXTagMismatchError";
+	}
+};
+/**
+* An unencrypted packet failed its integrity check. Internal: the packet is
+* dropped, and this never reaches a caller.
+*/
+var FakeSignatureMismatchError = class extends TeamspeakError {
+	/** {@inheritDoc TeamspeakError.kind} */
+	static kind = "FakeSignatureMismatchError";
+	constructor() {
+		super("fake signature mismatch");
+		this.name = "FakeSignatureMismatchError";
+	}
+};
+/** A file transfer connection failed: it could not be opened, or broke during the transfer. */
+var FileTransferError = class extends TeamspeakError {
+	/** {@inheritDoc TeamspeakError.kind} */
+	static kind = "FileTransferError";
+	constructor(message, options) {
+		super(message, options);
+		this.name = "FileTransferError";
+	}
+};
+/**
+* The handshake failed on what the server sent: a malformed or out-of-range
+* Init1 step, public key, license or proof. `connect()` rejects with it, the
+* underlying failure as its `cause`.
+*/
+var CryptoInitError = class extends TeamspeakError {
+	/** {@inheritDoc TeamspeakError.kind} */
+	static kind = "CryptoInitError";
+	constructor(message, options) {
+		super(message, options);
+		this.name = "CryptoInitError";
+	}
+};
+/** An identity string `parseIdentity()` cannot read. */
+var InvalidIdentityError = class extends TeamspeakError {
+	/** {@inheritDoc TeamspeakError.kind} */
+	static kind = "InvalidIdentityError";
+	constructor(message = "invalid identity format", options) {
+		super(message, options);
+		this.name = "InvalidIdentityError";
+	}
+};
+/**
+* The server stopped answering: nothing arrived, or a packet went
+* unacknowledged, for a minute.
+*/
+var ConnectionTimeoutError = class extends TeamspeakError {
+	/** {@inheritDoc TeamspeakError.kind} */
+	static kind = "ConnectionTimeoutError";
+	constructor() {
+		super("connection timed out: the server stopped answering");
+		this.name = "ConnectionTimeoutError";
+	}
+};
+/**
+* The server ended this client's session: a kick, a ban, or the server
+* stopping. The default reconnect policy retries a server that stopped, but
+* not a kick or a ban.
+*/
+var RemovedError = class extends TeamspeakError {
+	/** {@inheritDoc TeamspeakError.kind} */
+	static kind = "RemovedError";
+	/** Why: `Reason.KickServer`, `KickServerBan`, `ServerStop` or `ServerShutdown`. */
+	reason;
+	/** The reason the server or the invoker gave, if any. */
+	reasonMessage;
+	/** Who removed the client, for a kick or a ban. */
+	invokerName;
+	constructor(reason, reasonMessage, invokerName) {
+		let message = `removed from the server: ${reasonName(reason)}`;
+		if (invokerName) message += ` by ${invokerName}`;
+		if (reasonMessage) message += `: ${reasonMessage}`;
+		super(message);
+		this.name = "RemovedError";
+		this.reason = reason;
+		this.reasonMessage = reasonMessage;
+		this.invokerName = invokerName;
+	}
+};
+function reasonName(reason) {
+	switch (reason) {
+		case Reason.KickServer: return "kicked from server";
+		case Reason.KickServerBan: return "banned from server";
+		case Reason.ServerStop: return "server stopped";
+		case Reason.ServerShutdown: return "server shut down";
+		default: return `reason ${reason}`;
+	}
+}
+//#endregion
+//#region src/abort.ts
+/** The reason an aborted signal gives, as an error. */
+function abortReason(signal) {
+	return signal.reason ?? new DOMException("This operation was aborted", "AbortError");
+}
+/** Settle with `promise`, or reject as soon as `signal` aborts, whichever is first. */
+function abortable(promise, signal) {
+	if (!signal) return promise;
+	if (signal.aborted) return Promise.reject(abortReason(signal));
+	return new Promise((resolve, reject) => {
+		const onAbort = () => reject(abortReason(signal));
+		signal.addEventListener("abort", onAbort, { once: true });
+		promise.then((value) => {
+			signal.removeEventListener("abort", onAbort);
+			resolve(value);
+		}, (error) => {
+			signal.removeEventListener("abort", onAbort);
+			reject(error);
+		});
+	});
+}
+//#endregion
+//#region src/crypto/identity.ts
+var P256_SCALAR_SIZE = 32;
+var P256_UNCOMPRESSED_KEY_SIZE = 65;
+var P256_POINT_PREFIX = 4;
+/** The most a security level can be: SHA-1 is 160 bits wide. */
+var MAX_SECURITY_LEVEL = 160;
+var createIdentity;
+var privateKeyOf;
+/**
+* A TeamSpeak client identity: a P-256 key pair plus a counter, the offset,
+* whose hash with the public key sets the identity's security level.
+*
+* Immutable: raising the level returns a new identity. Opaque: the private
+* key is never exposed, and `toString()`, `toJSON()` and `util.inspect()`
+* describe the identity without it, so an identity that reaches a log or an
+* error message does not leak; `export()` is the one way to get the secret
+* form, for storing it. Make one with `generateIdentity()` or
+* `parseIdentity()`.
+*/
+var Identity = class Identity {
+	static {
+		createIdentity = (privateKey, offset) => new Identity(privateKey, offset);
+		privateKeyOf = (identity) => identity.#privateKey;
+	}
+	#privateKey;
+	#offset;
+	#publicKey;
+	constructor(privateKey, offset) {
+		this.#privateKey = privateKey;
+		this.#offset = offset;
+	}
+	/** The counter whose hash with the public key sets the security level. */
+	get offset() {
+		return this.#offset;
+	}
+	/** The public key in TeamSpeak's encoding: base64 of its DER form. */
+	publicKey() {
+		if (this.#publicKey !== void 0) return this.#publicKey;
+		const rawJwk = this.#privateKey.export({ format: "jwk" });
+		if (typeof rawJwk.x !== "string" || typeof rawJwk.y !== "string") return "";
+		const xBytes = base64UrlToBytes$1(rawJwk.x, P256_SCALAR_SIZE);
+		const yBytes = base64UrlToBytes$1(rawJwk.y, P256_SCALAR_SIZE);
+		this.#publicKey = encodeTsPublicKey(xBytes, yBytes);
+		return this.#publicKey;
+	}
+	/**
+	* The identity's unique identifier, hashed with `algorithm`: SHA-1 for a
+	* TeamSpeak 3 server, SHA-256 for TeamSpeak 6. A connected client's `uid`
+	* already uses the one its server does.
+	*/
+	uid(algorithm) {
+		return uidFromPublicKey(this.publicKey(), algorithm);
+	}
+	/**
+	* The identity in the form `parseIdentity()` reads, private key included.
+	* Store it as you would a password.
+	*/
+	export() {
+		const jwk = this.#privateKey.export({ format: "jwk" });
+		if (!jwk.d) return `:${this.#offset}`;
+		const dBytes = base64UrlToBytes$1(jwk.d, P256_SCALAR_SIZE);
+		return `${Buffer.from(dBytes).toString("base64")}:${this.#offset}`;
+	}
+	/** Describes the identity, by its SHA-1 unique identifier, without its private key. */
+	toString() {
+		return `identity ${this.uid("sha1")} (private key redacted)`;
+	}
+	/** The same as `toString()`, so serialising an identity cannot leak its key. */
+	toJSON() {
+		return this.toString();
+	}
+	/** The security level: trailing zero bits in SHA-1 of the public key and offset. */
+	securityLevel() {
+		return levelAt(this.publicKey(), this.#offset);
+	}
+	/**
+	* The same key at an offset whose security level reaches `targetLevel`, as
+	* a new identity; this one is unchanged, and returned as it is when it
+	* already reaches the level.
+	*
+	* Each level doubles the expected work, so a high level can take a long
+	* time; `signal` bounds it, and the event loop keeps running meanwhile. A
+	* level above 160, the width of SHA-1, can never be reached and is refused
+	* with a RangeError.
+	*/
+	async upgradeToLevel(targetLevel, options = {}) {
+		checkLevel(targetLevel);
+		const { signal } = options;
+		const prefix = this.publicKey();
+		let offset = this.#offset;
+		while (true) {
+			signal?.throwIfAborted();
+			if (levelAt(prefix, offset) >= targetLevel) return offset === this.#offset ? this : new Identity(this.#privateKey, offset);
+			offset++;
+			if (offset % 10000n === 0n) await new Promise((resolve) => setImmediate(resolve));
+		}
+	}
+};
+Object.defineProperty(Identity.prototype, Symbol.for("nodejs.util.inspect.custom"), { value() {
+	return `Identity <${this.toString()}>`;
+} });
+/**
+* The private key of an identity, for the handshake. Not exported from the
+* package.
+*
+* @internal
+*/
+function identityPrivateKey(identity) {
+	return privateKeyOf(identity);
+}
+function checkLevel(level) {
+	if (!Number.isInteger(level) || level < 0 || level > MAX_SECURITY_LEVEL) throw new RangeError(`a security level is an integer from 0 to 160, not ${level}`);
+}
+function levelAt(publicKey, offset) {
+	const h = createHash("sha1");
+	h.update(publicKey);
+	h.update(offset.toString(10));
+	return countLeadingZeros(h.digest());
+}
+/** The largest offset, an unsigned 64-bit counter. */
+var MAX_UINT64 = (1n << 64n) - 1n;
+/**
+* Read an identity from the form `Identity.export()` writes: the private key
+* as canonical base64 of at most 32 bytes, a colon, and the offset as a
+* decimal unsigned 64-bit integer. Anything else throws an
+* InvalidIdentityError, with the underlying failure as its cause.
+*/
+function parseIdentity(s) {
+	const colonIdx = s.lastIndexOf(":");
+	if (colonIdx < 0) throw new InvalidIdentityError();
+	const dBase64 = s.slice(0, colonIdx);
+	const offsetStr = s.slice(colonIdx + 1);
+	if (!/^\d+$/.test(offsetStr) || BigInt(offsetStr) > MAX_UINT64) throw new InvalidIdentityError("invalid identity offset");
+	const offset = BigInt(offsetStr);
+	const dBytes = Buffer.from(dBase64, "base64");
+	if (dBytes.length === 0 || dBytes.toString("base64") !== dBase64) throw new InvalidIdentityError("the private key is not canonical base64");
+	if (dBytes.length > P256_SCALAR_SIZE) throw new InvalidIdentityError("private key scalar too large");
+	const padded = Buffer.alloc(P256_SCALAR_SIZE);
+	dBytes.copy(padded, P256_SCALAR_SIZE - dBytes.length);
+	try {
+		const ecdh = createECDH("prime256v1");
+		ecdh.setPrivateKey(padded);
+		const pub = ecdh.getPublicKey(null, "uncompressed");
+		const x = Buffer.from(pub.slice(1, 33)).toString("base64url");
+		const y = Buffer.from(pub.slice(33, 65)).toString("base64url");
+		const jwk = {
+			kty: "EC",
+			crv: "P-256",
+			d: padded.toString("base64url"),
+			x,
+			y
+		};
+		return createIdentity(createPrivateKey({
+			key: jwk,
+			format: "jwk"
+		}), offset);
+	} catch (error) {
+		throw new InvalidIdentityError("invalid private key", { cause: error });
+	}
+}
+/**
+* Create an identity at the given security level, at most 160. Each level
+* doubles the expected work; `signal` bounds it, and the event loop keeps
+* running meanwhile.
+*/
+async function generateIdentity(targetLevel, options = {}) {
+	checkLevel(targetLevel);
+	return createIdentity(generateKey(), 0n).upgradeToLevel(targetLevel, options);
+}
+/**
+* Create an identity at the given security level, at most 160, blocking until
+* done. Fine for a low level; a high one can block the event loop for minutes,
+* so prefer `generateIdentity()` there.
+*/
+function generateIdentitySync(targetLevel) {
+	checkLevel(targetLevel);
+	const key = generateKey();
+	const prefix = createIdentity(key, 0n).publicKey();
+	let offset = 0n;
+	while (levelAt(prefix, offset) < targetLevel) offset++;
+	return createIdentity(key, offset);
+}
+function generateKey() {
+	return generateKeyPairSync("ec", { namedCurve: "prime256v1" }).privateKey;
+}
+/** Pick the UID hash from a `virtualserver_version` string, e.g. "6.0.0-beta13.1". */
+function uidAlgorithmForVersion(version) {
+	const major = Number.parseInt(version, 10);
+	return Number.isNaN(major) || major < 6 ? "sha1" : "sha256";
+}
+/**
+* The unique identifier of a public key in TeamSpeak's encoding, hashed with
+* `algorithm`: SHA-1 for a TeamSpeak 3 server, SHA-256 for TeamSpeak 6.
+*/
+function uidFromPublicKey(publicKey, algorithm) {
+	return asUID(createHash(algorithm).update(publicKey).digest("base64"));
+}
+function hash512(data) {
+	return createHash("sha512").update(data).digest();
+}
+/**
+* Encode a P-256 public key as the TS3 canonical ASN.1 SEQUENCE and return
+* its base64 representation.
+*
+* TS3 canonical format (v3+):
+*   SEQUENCE {
+*     BIT STRING { unused=7, value=0x00 }  — DER: 03 02 07 00
+*     INTEGER 32
+*     INTEGER x
+*     INTEGER y
+*   }
+*/
+function encodeTsPublicKey(x, y) {
+	const bitStringDer = encodeDerTlv(3, Buffer.from([7, 0]));
+	const integerSize = encodeDerTlv(2, encodePositiveInt(32));
+	const integerX = encodeDerTlv(2, encodePositiveInt(x));
+	const integerY = encodeDerTlv(2, encodePositiveInt(y));
+	return encodeDerTlv(48, Buffer.concat([
+		bitStringDer,
+		integerSize,
+		integerX,
+		integerY
+	])).toString("base64");
+}
+/** Import a TS3 public key (canonical or legacy ASN.1 DER) and return the
+*  uncompressed 65-byte point [0x04 || x || y]. */
+function importPublicKey(data) {
+	const point = parseTsPublicKeyDer(data);
+	const jwk = {
+		kty: "EC",
+		crv: "P-256",
+		x: Buffer.from(point.slice(1, 33)).toString("base64url"),
+		y: Buffer.from(point.slice(33, 65)).toString("base64url")
+	};
+	return createPublicKey({
+		key: jwk,
+		format: "jwk"
+	});
+}
+/**
+* Parse both TS3 canonical and legacy ASN.1 formats and return the
+* uncompressed 65-byte point [0x04 || x || y].
+*/
+function parseTsPublicKeyDer(data) {
+	try {
+		return parseTsCanonicalPublicKey(data);
+	} catch {}
+	return parseTsLegacyPublicKey(data);
+}
+function parseTsCanonicalPublicKey(data) {
+	const seq = parseDerTlv(data, 48).value;
+	let offset = 0;
+	const bs = parseDerTlv(seq, 3, offset);
+	offset += bs.consumed;
+	const sizeInt = parseDerTlv(seq, 2, offset);
+	offset += sizeInt.consumed;
+	const xInt = parseDerTlv(seq, 2, offset);
+	offset += xInt.consumed;
+	const yInt = parseDerTlv(seq, 2, offset);
+	return buildUncompressedPoint(positiveIntToBytes(xInt.value, P256_SCALAR_SIZE), positiveIntToBytes(yInt.value, P256_SCALAR_SIZE));
+}
+function parseTsLegacyPublicKey(data) {
+	const seq = parseDerTlv(data, 48).value;
+	let offset = 0;
+	const xInt = parseDerTlv(seq, 2, offset);
+	offset += xInt.consumed;
+	const yInt = parseDerTlv(seq, 2, offset);
+	return buildUncompressedPoint(positiveIntToBytes(xInt.value, P256_SCALAR_SIZE), positiveIntToBytes(yInt.value, P256_SCALAR_SIZE));
+}
+function buildUncompressedPoint(x, y) {
+	if (x.length > P256_SCALAR_SIZE || y.length > P256_SCALAR_SIZE) throw new Error("invalid public key point encoding");
+	const point = new Uint8Array(P256_UNCOMPRESSED_KEY_SIZE);
+	point[0] = P256_POINT_PREFIX;
+	point.set(x, 33 - x.length);
+	point.set(y, 65 - y.length);
+	return point;
+}
+function encodeDerTlv(tag, value) {
+	const lenBytes = encodeDerLength(value.length);
+	return Buffer.concat([
+		Buffer.from([tag]),
+		lenBytes,
+		value
+	]);
+}
+function encodeDerLength(len) {
+	if (len < 128) return Buffer.from([len]);
+	if (len < 256) return Buffer.from([129, len]);
+	return Buffer.from([
+		130,
+		len >> 8 & 255,
+		len & 255
+	]);
+}
+/** Encode a non-negative value as a DER INTEGER (with 0x00 prefix if high bit set). */
+function encodePositiveInt(v) {
+	if (typeof v === "number") {
+		const bytes = [];
+		let n = v;
+		do {
+			bytes.unshift(n & 255);
+			n >>= 8;
+		} while (n > 0);
+		if ((bytes[0] & 128) !== 0) bytes.unshift(0);
+		return Buffer.from(bytes);
+	}
+	let start = 0;
+	while (start < v.length - 1 && v[start] === 0) start++;
+	const trimmed = v.slice(start);
+	if ((trimmed[0] & 128) !== 0) return Buffer.concat([Buffer.from([0]), trimmed]);
+	return Buffer.from(trimmed);
+}
+function parseDerTlv(data, expectedTag, offset = 0) {
+	if (data[offset] !== expectedTag) throw new Error(`expected DER tag 0x${expectedTag.toString(16)}, got 0x${(data[offset] ?? 0).toString(16)}`);
+	let pos = offset + 1;
+	let len;
+	const firstLenByte = data[pos++];
+	if (firstLenByte < 128) len = firstLenByte;
+	else if (firstLenByte === 129) len = data[pos++];
+	else if (firstLenByte === 130) {
+		len = (data[pos] << 8 | data[pos + 1]) >>> 0;
+		pos += 2;
+	} else throw new Error("unsupported DER length encoding");
+	return {
+		value: data.slice(pos, pos + len),
+		consumed: pos - offset + len
+	};
+}
+/** Convert a DER INTEGER value (may have leading 0x00) to fixed-length bytes. */
+function positiveIntToBytes(int, size) {
+	let start = 0;
+	while (start < int.length - 1 && int[start] === 0) start++;
+	const stripped = int.slice(start);
+	if (stripped.length > size) throw new Error("integer too large");
+	if (stripped.length === size) return stripped;
+	const padded = new Uint8Array(size);
+	padded.set(stripped, size - stripped.length);
+	return padded;
+}
+function base64UrlToBytes$1(b64url, size) {
+	const buf = Buffer.from(b64url, "base64url");
+	if (buf.length === size) return buf;
+	const padded = Buffer.alloc(size);
+	buf.copy(padded, size - buf.length);
+	return padded;
+}
+function countLeadingZeros(data) {
+	let zeros = 0;
+	for (const b of data) if (b === 0) zeros += 8;
+	else for (let i = 0; i < 8; i++) if ((b & 1 << i) === 0) zeros++;
+	else return zeros;
+	return zeros;
+}
+//#endregion
+//#region src/crypto/eax.ts
+var EAX_TAG_SIZE = 8;
+var EAX_BLOCK_SIZE = 16;
+/**
+* AES-EAX AEAD implementation for TS3 (64-bit tag, AES-128).
+* Uses AES-CMAC for authentication and AES-CTR for encryption.
+*/
+var EAX = class {
+	#key;
+	constructor(key) {
+		if (key.length !== 16) throw new Error("EAX requires a 16-byte key");
+		this.#key = key;
+	}
+	encrypt(nonce, header, plaintext) {
+		const nStar = this.#cmac(0, nonce);
+		const hStar = this.#cmac(1, header);
+		const ciphertext = aesCtr(this.#key, nStar, plaintext);
+		const cStar = this.#cmac(2, ciphertext);
+		const tag = new Uint8Array(EAX_TAG_SIZE);
+		for (let i = 0; i < EAX_TAG_SIZE; i++) tag[i] = nStar[i] ^ hStar[i] ^ cStar[i];
+		return [ciphertext, tag];
+	}
+	decrypt(nonce, header, ciphertext, tag) {
+		const nStar = this.#cmac(0, nonce);
+		const hStar = this.#cmac(1, header);
+		const cStar = this.#cmac(2, ciphertext);
+		const expected = new Uint8Array(EAX_TAG_SIZE);
+		for (let i = 0; i < EAX_TAG_SIZE; i++) expected[i] = nStar[i] ^ hStar[i] ^ cStar[i];
+		if (!timingSafeEqual(Buffer.from(expected), Buffer.from(tag.slice(0, EAX_TAG_SIZE)))) throw new EAXTagMismatchError();
+		return aesCtr(this.#key, nStar, ciphertext);
+	}
+	/**
+	* AES-CMAC per RFC 4493:
+	*   input = [0…0 tag] ++ data   (one block prefix)
+	*/
+	#cmac(tagByte, data) {
+		const input = new Uint8Array(EAX_BLOCK_SIZE + data.length);
+		input[15] = tagByte;
+		input.set(data, EAX_BLOCK_SIZE);
+		return aesCmac(this.#key, input);
+	}
+};
+function aesCtr(key, iv, data) {
+	const cipher = createCipheriv("aes-128-ctr", Buffer.from(key), Buffer.from(iv));
+	return Buffer.concat([cipher.update(Buffer.from(data)), cipher.final()]);
+}
+function aesEcb(key, block) {
+	const cipher = createCipheriv("aes-128-ecb", Buffer.from(key), null);
+	cipher.setAutoPadding(false);
+	return Buffer.concat([cipher.update(Buffer.from(block)), cipher.final()]);
+}
+function xorBlock(a, b) {
+	const out = new Uint8Array(EAX_BLOCK_SIZE);
+	for (let i = 0; i < EAX_BLOCK_SIZE; i++) out[i] = a[i] ^ b[i];
+	return out;
+}
+function shiftLeft1(b) {
+	const out = new Uint8Array(EAX_BLOCK_SIZE);
+	let carry = 0;
+	for (let i = 15; i >= 0; i--) {
+		const shifted = (b[i] << 1 | carry) & 255;
+		carry = b[i] >> 7;
+		out[i] = shifted;
+	}
+	return out;
+}
+var RB = new Uint8Array(EAX_BLOCK_SIZE);
+RB[15] = 135;
+function generateSubkeys(key) {
+	const L = aesEcb(key, new Uint8Array(EAX_BLOCK_SIZE));
+	let K1 = shiftLeft1(L);
+	if ((L[0] & 128) !== 0) K1 = xorBlock(K1, RB);
+	let K2 = shiftLeft1(K1);
+	if ((K1[0] & 128) !== 0) K2 = xorBlock(K2, RB);
+	return [K1, K2];
+}
+function aesCmac(key, message) {
+	const [K1, K2] = generateSubkeys(key);
+	const n = Math.max(1, Math.ceil(message.length / EAX_BLOCK_SIZE));
+	const lastBlockComplete = message.length > 0 && message.length % EAX_BLOCK_SIZE === 0;
+	let X = new Uint8Array(EAX_BLOCK_SIZE);
+	for (let i = 0; i < n - 1; i++) {
+		const block = message.slice(i * EAX_BLOCK_SIZE, (i + 1) * EAX_BLOCK_SIZE);
+		X = Uint8Array.from(aesEcb(key, xorBlock(X, block)));
+	}
+	const lastBlock = new Uint8Array(EAX_BLOCK_SIZE);
+	const lastStart = (n - 1) * EAX_BLOCK_SIZE;
+	const lastSlice = message.slice(lastStart);
+	lastBlock.set(lastSlice);
+	let Mn;
+	if (lastBlockComplete) Mn = xorBlock(lastBlock, K1);
+	else {
+		if (lastSlice.length < EAX_BLOCK_SIZE) lastBlock[lastSlice.length] = 128;
+		Mn = xorBlock(lastBlock, K2);
+	}
+	return Uint8Array.from(aesEcb(key, xorBlock(X, Mn)));
+}
+//#endregion
+//#region src/crypto/crypt.ts
+var FAKE_SIGNATURE_SIZE = 8;
+var IV_ALPHA_SIZE = 10;
+var INIT1_PACKET_TYPE = 8;
+var PACKET_TYPE_MASK = 15;
+var INIT1_MAC = Buffer.from("TS3INIT1");
+/** Precomputed dummy key/nonce matching the TS3 client pre-crypto placeholder. */
+var DUMMY_KEY = Buffer.from("c:\\windows\\syste");
+var DUMMY_NONCE = Buffer.from("m\\firewall32.cpl");
+/**
+* A connection's encryption state. The session material — the IV the keys
+* derive from — lives in private fields, so it shows in no `util.inspect()`
+* or `JSON.stringify()` of anything holding a Crypt.
+*/
+var Crypt = class {
+	identity;
+	#ivStruct = /* @__PURE__ */ new Uint8Array(0);
+	#fakeSignature = new Uint8Array(FAKE_SIGNATURE_SIZE);
+	#alpha = /* @__PURE__ */ new Uint8Array(0);
+	#cryptoInitComplete = false;
+	#cachedKeys = /* @__PURE__ */ new Map();
+	constructor(identity) {
+		this.identity = identity;
+	}
+	/** Whether the session keys are set up; until then packets use the dummy key. */
+	get cryptoInitComplete() {
+		return this.#cryptoInitComplete;
+	}
+	/** The signature unencrypted packets carry: zeros until crypto init completes. */
+	get fakeSignature() {
+		return this.#fakeSignature;
+	}
+	/** The client's random contribution to the IV, sent in clientinitiv; empty before. */
+	get alpha() {
+		return this.#alpha;
+	}
+	/** Choose the client's random contribution to the IV, and return it. */
+	newAlpha() {
+		this.#alpha = new Uint8Array(randomBytes(IV_ALPHA_SIZE));
+		return this.#alpha;
+	}
+	solveRsaChallenge(data, offset, level) {
+		if (!Number.isInteger(level) || level < 0 || level > 1e5) throw new CryptoInitError(`RSA challenge level ${level} out of range`);
+		const xBytes = data.slice(offset, offset + 64);
+		const nBytes = data.slice(offset + 64, offset + 128);
+		let y = bytesToBigInt(xBytes);
+		const n = bytesToBigInt(nBytes);
+		if (n === 0n) throw new CryptoInitError("RSA challenge modulus is zero");
+		for (let i = 0; i < level; i++) y = y * y % n;
+		return bigIntToBytes(y, 64);
+	}
+	initCrypto(alpha, beta, omega) {
+		const alphaBytes = Buffer.from(alpha, "base64");
+		const betaBytes = Buffer.from(beta, "base64");
+		const omegaBytes = Buffer.from(omega, "base64");
+		let sharedSecret;
+		try {
+			sharedSecret = this.#getSharedSecret(importPublicKey(omegaBytes));
+		} catch (error) {
+			throw new CryptoInitError("the server's public key is invalid", { cause: error });
+		}
+		this.setSharedSecret(alphaBytes, betaBytes, sharedSecret);
+	}
+	setSharedSecret(alpha, beta, sharedKey) {
+		this.#ivStruct = new Uint8Array(IV_ALPHA_SIZE + beta.length);
+		for (let i = 0; i < IV_ALPHA_SIZE; i++) {
+			const a = sharedKey[i];
+			const b = alpha[i];
+			this.#ivStruct[i] = ((a !== void 0 ? a : 0) ^ (b !== void 0 ? b : 0)) & 255;
+		}
+		for (let i = 0; i < beta.length; i++) {
+			const a = sharedKey[IV_ALPHA_SIZE + i];
+			const b = beta[i];
+			this.#ivStruct[IV_ALPHA_SIZE + i] = ((a !== void 0 ? a : 0) ^ (b !== void 0 ? b : 0)) & 255;
+		}
+		this.#cachedKeys.clear();
+		const digest = createHash("sha1").update(this.#ivStruct).digest();
+		this.#fakeSignature = new Uint8Array(digest.buffer, digest.byteOffset, FAKE_SIGNATURE_SIZE);
+		this.#cryptoInitComplete = true;
+	}
+	getKeyNonce(fromServer, packetID, generationID, packetType, dummy) {
+		if (dummy) return [Uint8Array.from(DUMMY_KEY), Uint8Array.from(DUMMY_NONCE)];
+		if (!this.#cryptoInitComplete) throw new CryptoInitError("no session key before crypto init completes");
+		const cacheKey = makeCacheKey(fromServer, packetType, generationID);
+		let kn = this.#cachedKeys.get(cacheKey);
+		if (kn === void 0) {
+			const tmpToHash = new Uint8Array(6 + this.#ivStruct.length);
+			tmpToHash[0] = fromServer ? 48 : 49;
+			tmpToHash[1] = packetType & PACKET_TYPE_MASK;
+			new DataView(tmpToHash.buffer).setUint32(2, generationID, false);
+			tmpToHash.set(this.#ivStruct, 6);
+			const hash = createHash("sha256").update(tmpToHash).digest();
+			kn = {
+				key: Uint8Array.from(hash.slice(0, 16)),
+				nonce: Uint8Array.from(hash.slice(16, 32)),
+				gen: generationID
+			};
+			this.#cachedKeys.set(cacheKey, kn);
+		}
+		const key = Uint8Array.from(kn.key);
+		key[0] = (key[0] !== void 0 ? key[0] : 0) ^ packetID >> 8 & 255;
+		key[1] = (key[1] !== void 0 ? key[1] : 0) ^ packetID & 255;
+		return [key, kn.nonce];
+	}
+	encrypt(packetType, packetID, generationID, header, plaintext, dummy, unencrypted) {
+		if (packetType === INIT1_PACKET_TYPE) return [plaintext, INIT1_MAC];
+		if (unencrypted) return [plaintext, this.#fakeSignature];
+		const [key, nonce] = this.getKeyNonce(false, packetID, generationID, packetType, dummy);
+		return new EAX(key).encrypt(nonce, header, plaintext);
+	}
+	decrypt(packetType, packetID, generationID, header, ciphertext, tag, dummy, unencrypted) {
+		if (packetType === INIT1_PACKET_TYPE) return ciphertext;
+		if (unencrypted) {
+			const fsSub = tag.slice(0, FAKE_SIGNATURE_SIZE);
+			if (!Buffer.from(fsSub).equals(Buffer.from(this.#fakeSignature))) throw new FakeSignatureMismatchError();
+			return ciphertext;
+		}
+		const [key, nonce] = this.getKeyNonce(true, packetID, generationID, packetType, dummy);
+		return new EAX(key).decrypt(nonce, header, ciphertext, tag);
+	}
+	#getSharedSecret(serverPubKey) {
+		const privJwk = identityPrivateKey(this.identity).export({ format: "jwk" });
+		const pubJwk = serverPubKey.export({ format: "jwk" });
+		const ecdh = createECDH("prime256v1");
+		const dBytes = Buffer.from(privJwk.d, "base64url");
+		ecdh.setPrivateKey(dBytes);
+		const xBytes = base64UrlToBytes(pubJwk.x, 32);
+		const yBytes = base64UrlToBytes(pubJwk.y, 32);
+		const uncompressed = Buffer.alloc(65);
+		uncompressed[0] = 4;
+		xBytes.copy(uncompressed, 1);
+		yBytes.copy(uncompressed, 33);
+		const rawSecret = ecdh.computeSecret(uncompressed);
+		return createHash("sha1").update(rawSecret).digest();
+	}
+};
+function makeCacheKey(fromServer, packetType, generationID) {
+	let key = 0n;
+	if (fromServer) key |= 1n << 40n;
+	key |= BigInt(packetType & PACKET_TYPE_MASK) << 32n;
+	key |= BigInt(generationID);
+	return key;
+}
+function bytesToBigInt(bytes) {
+	let result = 0n;
+	for (const b of bytes) result = result << 8n | BigInt(b);
+	return result;
+}
+function bigIntToBytes(value, size) {
+	const result = new Uint8Array(size);
+	let v = value;
+	for (let i = size - 1; i >= 0; i--) {
+		result[i] = Number(v & 255n);
+		v >>= 8n;
+	}
+	return result;
+}
+function base64UrlToBytes(b64url, size) {
+	const buf = Buffer.from(b64url, "base64url");
+	if (buf.length === size) return buf;
+	const padded = Buffer.alloc(size);
+	buf.copy(padded, size - buf.length);
+	return padded;
+}
+//#endregion
+//#region src/crypto/primitives.ts
+var CURVE25519_KEY_SIZE = 32;
+var CLAMP_MASK_LOW = 248;
+var CLAMP_MASK_HIGH = 127;
+var CLAMP_HIGH_BIT = 64;
+var SHARED_SIGN_BIT = 128;
+var PRIVATE_KEY_TOP_MASK = 127;
+/** Clamp a Curve25519 scalar in-place (required before scalar multiplication). */
+function clampScalar(key) {
+	if (key.length < CURVE25519_KEY_SIZE) return;
+	key[0] = (key[0] ?? 0) & CLAMP_MASK_LOW;
+	key[31] = (key[31] ?? 0) & CLAMP_MASK_HIGH | CLAMP_HIGH_BIT;
+}
+/**
+* Generate an ephemeral Ed25519 key pair for the TS3 handshake.
+* Returns [publicKey (32 bytes, RFC-8032 encoded), privateKey (32 bytes)].
+*/
+function generateTemporaryKey() {
+	const privateKey = new Uint8Array(randomBytes(CURVE25519_KEY_SIZE));
+	clampScalar(privateKey);
+	const scalar = bytesToBigIntLE(privateKey) % ed25519.Point.CURVE().n;
+	return [ed25519.Point.BASE.multiply(scalar).toBytes(), Uint8Array.from(privateKey)];
+}
+/**
+* Sign data with a P-256 private key (SHA-256 hash, ASN.1 DER encoded).
+*/
+function sign(privateKey, data) {
+	const signer = createSign("SHA256");
+	signer.update(data);
+	return signer.sign(privateKey);
+}
+/**
+* Verify a P-256 ECDSA signature (SHA-256 hash, ASN.1 DER encoded).
+*/
+function verifySign(publicKey, data, sig) {
+	try {
+		const verifier = createVerify("SHA256");
+		verifier.update(data);
+		return verifier.verify(publicKey, Buffer.from(sig));
+	} catch {
+		return false;
+	}
+}
+/**
+* TS3-specific shared secret derivation using Ed25519 point arithmetic.
+* Mirrors NaCl's ge_scalarmult_vartime:
+*   1. Negate the public point
+*   2. Scalar-multiply by clamped private key bytes (NOT reduced mod n)
+*   3. Flip sign bit of result
+*   4. SHA-512 the resulting point bytes
+*
+* The scalar must NOT be reduced mod n: Ed25519 has cofactor 8, so the server's
+* public key may have a small-order component, and P*s ≠ P*(s mod n) in that case.
+* We use scalarMultFull to handle scalars >= n without losing the cofactor term.
+*/
+function getSharedSecret2(publicKeyBytes, privateKeyBytes) {
+	if (publicKeyBytes.length !== CURVE25519_KEY_SIZE || privateKeyBytes.length !== CURVE25519_KEY_SIZE) throw new Error("invalid key length");
+	const privCopy = Uint8Array.from(privateKeyBytes);
+	privCopy[31] = (privCopy[31] ?? 0) & PRIVATE_KEY_TOP_MASK;
+	const rawScalar = bytesToBigIntLE(privCopy);
+	const sharedBytes = scalarMultFull(ed25519.Point.fromBytes(publicKeyBytes).negate(), rawScalar).toBytes();
+	sharedBytes[31] = (sharedBytes[31] ?? 0) ^ SHARED_SIGN_BIT;
+	return createHash("sha512").update(sharedBytes).digest();
+}
+/**
+* Multiply an Ed25519 point by a scalar that may be >= curve order n.
+* Decomposes as: P*s = P*(s mod n) + (P*n)*q  where q = floor(s/n).
+* This preserves the small-order component (cofactor 8) that would be
+* lost by reducing mod n first.
+*
+* For a clamped 255-bit scalar, q is at most 7 (since maxScalar / n < 8),
+* so the second term is computed with at most one extra scalar multiplication.
+*/
+function scalarMultFull(point, scalar) {
+	const n = ed25519.Point.CURVE().n;
+	if (scalar < n) return scalar === 0n ? ed25519.Point.ZERO : point.multiply(scalar);
+	const remainder = scalar % n;
+	const quotient = scalar / n;
+	const mainPart = remainder === 0n ? ed25519.Point.ZERO : point.multiply(remainder);
+	const cofactorPart = point.multiply(n - 1n).add(point).multiply(quotient);
+	return mainPart.add(cofactorPart);
+}
+/** Interpret a little-endian byte array as an unsigned BigInt. */
+function bytesToBigIntLE(bytes) {
+	let result = 0n;
+	for (let i = bytes.length - 1; i >= 0; i--) result = result << 8n | BigInt(bytes[i]);
+	return result;
+}
+//#endregion
+//#region src/address.ts
+/** Parse a TeamSpeak address without confusing an IPv6 colon for a port separator. */
+function splitHostPort(address, defaultPort = "9987") {
+	const input = address.trim();
+	if (input.startsWith("[")) {
+		const closingBracket = input.indexOf("]");
+		if (closingBracket > 0) {
+			const host = input.slice(1, closingBracket);
+			const suffix = input.slice(closingBracket + 1);
+			if (suffix.startsWith(":") && /^\d+$/.test(suffix.slice(1))) return {
+				host,
+				port: suffix.slice(1)
+			};
+			if (!suffix) return {
+				host,
+				port: defaultPort
+			};
+		}
+	}
+	if (isIP(input) === 6) return {
+		host: input,
+		port: defaultPort
+	};
+	const lastColon = input.lastIndexOf(":");
+	if (lastColon < 0) return {
+		host: input,
+		port: defaultPort
+	};
+	const candidatePort = input.slice(lastColon + 1);
+	if (/^\d+$/.test(candidatePort) && input.indexOf(":") === lastColon) return {
+		host: input.slice(0, lastColon),
+		port: candidatePort
+	};
+	return {
+		host: input,
+		port: defaultPort
+	};
+}
+/** Characters no host name or IP address contains, whitespace among them. */
+var NOT_IN_A_HOST = /[\s\p{Cc}/?#@[\]\\]/u;
+/**
+* Parse an address to connect to, and check it can be one: a host, which
+* contains nothing a host name or IP address cannot, and a port from 1 to
+* 65535. Throws an InvalidAddressError otherwise.
+*/
+function parseConnectAddress(address) {
+	const { host, port } = splitHostPort(address);
+	if (host === "") throw new InvalidAddressError(address, "no host");
+	if (NOT_IN_A_HOST.test(host) || host.includes(":") && isIP(host) !== 6) throw new InvalidAddressError(address, "not a host name, IP address or host:port");
+	const portNumber = Number(port);
+	if (!Number.isInteger(portNumber) || portNumber < 1 || portNumber > 65535) throw new InvalidAddressError(address, `port ${port} is not from 1 to 65535`);
+	return {
+		host,
+		port,
+		portNumber
+	};
+}
+function joinHostPort(host, port) {
+	const normalizedHost = stripBrackets(host);
+	return isIP(normalizedHost) === 6 || normalizedHost.includes(":") ? `[${normalizedHost}]:${port}` : `${normalizedHost}:${port}`;
+}
+function isIpAddress(host) {
+	return isIP(stripBrackets(host)) !== 0;
+}
+function stripBrackets(host) {
+	return host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
+}
+//#endregion
+//#region src/discovery/resolver.ts
+var TS_DNS_DEFAULT_PORT = 41144;
+var NICKNAME_LOOKUP_URL = "https://named.myteamspeak.com/lookup";
+var CACHE_TTL_MS = 6e5;
+/**
+* How long resolution may take in all; past it, the address is used as given.
+* A Client holds any resolver, its own or a custom one, to the same budget.
+*
+* @internal
+*/
+var RESOLVE_BUDGET_MS = 1e4;
+/** How long one TSDNS server may take to answer. */
+var TSDNS_TIMEOUT_MS = 3e3;
+var Resolver = class {
+	#cache = /* @__PURE__ */ new Map();
+	#resolveNicknames;
+	constructor(options = {}) {
+		this.#resolveNicknames = options.resolveNicknames ?? false;
+	}
+	/**
+	* Resolve as the TeamSpeak application does: a server nickname (only with
+	* `resolveNicknames`), then SRV, then TSDNS, then the address as given. The
+	* whole resolution is bounded: past the budget, or when a step fails, the
+	* address as given is the answer.
+	*/
+	async resolve(inputAddr, options = {}) {
+		if (!inputAddr) throw new Error("empty address");
+		const budget = AbortSignal.timeout(RESOLVE_BUDGET_MS);
+		const signal = options.signal ? AbortSignal.any([options.signal, budget]) : budget;
+		try {
+			return await this.#resolve(inputAddr, signal, true);
+		} catch (error) {
+			options.signal?.throwIfAborted();
+			if (!budget.aborted) throw error;
+			const { host, port } = splitHostPort(inputAddr);
+			return [{
+				addr: joinHostPort(host, port),
+				source: "Direct"
+			}];
+		}
+	}
+	async #resolve(inputAddr, signal, nicknames) {
+		const cached = this.#getValidCache(inputAddr);
+		if (cached) return cached;
+		const { host, port } = splitHostPort(inputAddr);
+		if (isIpAddress(host)) return [{
+			addr: joinHostPort(host, port),
+			source: "Direct"
+		}];
+		if (nicknames && this.#resolveNicknames && !host.includes(".") && host !== "localhost") {
+			const nickAddr = await resolveNickname(host, signal);
+			signal.throwIfAborted();
+			if (nickAddr) return this.#resolve(nickAddr, signal, false);
+		}
+		const srvResults = await this.#resolveSRV(host, signal);
+		if (srvResults) return this.#setCache(inputAddr, srvResults);
+		const domainList = getDomainList(host);
+		const tsdnsSrv = await this.#resolveTSDNSSRV(domainList, host, signal);
+		if (tsdnsSrv) return this.#setCache(inputAddr, [{
+			addr: tsdnsSrv,
+			source: "TSDNS-SRV"
+		}]);
+		const tsdnsDirect = await this.#resolveTSDNSDirect(domainList, host, signal);
+		if (tsdnsDirect) return this.#setCache(inputAddr, [{
+			addr: tsdnsDirect,
+			source: "TSDNS-Direct"
+		}]);
+		signal.throwIfAborted();
+		const fallback = [{
+			addr: joinHostPort(host, port),
+			source: "Direct"
+		}];
+		return this.#setCache(inputAddr, fallback);
+	}
+	#getValidCache(inputAddr) {
+		const cached = this.#cache.get(inputAddr);
+		if (!cached || cached.length === 0) return null;
+		const first = cached[0];
+		if (first.expiry !== void 0 && Date.now() > first.expiry.getTime()) return null;
+		return cached;
+	}
+	#setCache(key, results) {
+		const expiry = new Date(Date.now() + CACHE_TTL_MS);
+		const withExpiry = results.map((r) => ({
+			...r,
+			expiry
+		}));
+		this.#cache.set(key, withExpiry);
+		return withExpiry;
+	}
+	async #resolveSRV(host, signal) {
+		try {
+			const srvs = await abortable(resolveSrv(`_ts3._udp.${host}`), signal);
+			if (!srvs || srvs.length === 0) return null;
+			return srvs.map((srv) => ({
+				addr: joinHostPort(srv.name.replace(/\.$/, ""), String(srv.port)),
+				source: "SRV"
+			}));
+		} catch {
+			return null;
+		}
+	}
+	async #resolveTSDNSSRV(domains, queryHost, signal) {
+		for (const domain of domains) try {
+			const srvs = await abortable(resolveSrv(`_tsdns._tcp.${domain}`), signal);
+			if (!srvs || srvs.length === 0) continue;
+			for (const srv of srvs) {
+				const result = await queryTSDNS(joinHostPort(srv.name.replace(/\.$/, ""), String(srv.port)), queryHost, signal);
+				if (result) return result;
+			}
+		} catch {
+			continue;
+		}
+		return null;
+	}
+	async #resolveTSDNSDirect(domains, queryHost, signal) {
+		return (await Promise.all(domains.map((domain) => queryTSDNS(joinHostPort(domain, String(TS_DNS_DEFAULT_PORT)), queryHost, signal)))).find((answer) => answer !== null) ?? null;
+	}
+};
+/** @internal Ask the nickname service for `nickname`'s address. */
+async function resolveNickname(nickname, signal) {
+	try {
+		const url = new URL(NICKNAME_LOOKUP_URL);
+		url.searchParams.set("name", nickname);
+		const init = signal ? { signal } : {};
+		const resp = await fetch(url.toString(), init);
+		if (!resp.ok) return null;
+		return (await readLimited(resp, 8192)).split("\n")[0]?.trim() || null;
+	} catch {
+		return null;
+	}
+}
+/** A response body's first `limit` bytes, as text; the rest is not read. */
+async function readLimited(resp, limit) {
+	if (resp.body === null) return "";
+	const reader = resp.body.getReader();
+	const chunks = [];
+	let size = 0;
+	try {
+		while (size < limit) {
+			const { done, value } = await reader.read();
+			if (done) break;
+			const part = value.subarray(0, limit - size);
+			chunks.push(part);
+			size += part.length;
+		}
+	} finally {
+		reader.cancel().catch(() => {});
+	}
+	return Buffer.concat(chunks).toString("utf8");
+}
+/** @internal Ask the TSDNS server at `tsdnsAddr` for `queryHost`'s address. */
+function queryTSDNS(tsdnsAddr, queryHost, signal) {
+	const [host, portStr] = splitHostPortParts(tsdnsAddr);
+	const port = parseInt(portStr, 10);
+	return new Promise((resolve) => {
+		if (signal?.aborted) return resolve(null);
+		const finish = (answer) => {
+			clearTimeout(timeout);
+			signal?.removeEventListener("abort", onAbort);
+			socket.destroy();
+			resolve(answer);
+		};
+		const onAbort = () => finish(null);
+		const timeout = setTimeout(() => finish(null), TSDNS_TIMEOUT_MS);
+		const socket = createConnection({
+			host,
+			port,
+			timeout: 2e3
+		}, () => {
+			socket.write(`${queryHost}\n`);
+		});
+		let buf = "";
+		socket.on("data", (chunk) => {
+			buf += chunk.toString("latin1");
+			const idx = buf.indexOf("\n");
+			if (idx >= 0 && idx < 8192) {
+				const line = Buffer.from(buf.slice(0, idx), "latin1").toString("utf8").trim();
+				finish(!line || line === "404" || line === "errors" ? null : line);
+			} else if (buf.length >= 8192) finish(null);
+		});
+		socket.on("error", () => finish(null));
+		socket.on("timeout", () => finish(null));
+		signal?.addEventListener("abort", onAbort, { once: true });
+	});
+}
+function splitHostPortParts(addr) {
+	const { host, port } = splitHostPort(addr);
+	return [host, port];
+}
+function getDomainList(host) {
+	const parts = host.split(".");
+	const list = [];
+	for (let i = 0; i < parts.length - 1; i++) list.push(parts.slice(i).join("."));
+	return list.slice(0, 3);
+}
+//#endregion
+//#region src/transport/packet.ts
+var PacketType = /* @__PURE__ */ function(PacketType) {
+	PacketType[PacketType["Voice"] = 0] = "Voice";
+	PacketType[PacketType["VoiceWhisper"] = 1] = "VoiceWhisper";
+	PacketType[PacketType["Command"] = 2] = "Command";
+	PacketType[PacketType["CommandLow"] = 3] = "CommandLow";
+	PacketType[PacketType["Ping"] = 4] = "Ping";
+	PacketType[PacketType["Pong"] = 5] = "Pong";
+	PacketType[PacketType["Ack"] = 6] = "Ack";
+	PacketType[PacketType["AckLow"] = 7] = "AckLow";
+	PacketType[PacketType["Init1"] = 8] = "Init1";
+	return PacketType;
+}({});
+var PacketFlags = /* @__PURE__ */ function(PacketFlags) {
+	PacketFlags[PacketFlags["Fragmented"] = 16] = "Fragmented";
+	PacketFlags[PacketFlags["NewProtocol"] = 32] = "NewProtocol";
+	PacketFlags[PacketFlags["Compressed"] = 64] = "Compressed";
+	PacketFlags[PacketFlags["Unencrypted"] = 128] = "Unencrypted";
+	return PacketFlags;
+}({});
+function packetType(p) {
+	return p.typeFlagged & 15;
+}
+function packetFlags(p) {
+	return p.typeFlagged & 240;
+}
+/** Build the 5-byte client-to-server header: [packetID(2), clientID(2), typeFlagged(1)]. */
+function buildC2SHeader(p) {
+	const header = /* @__PURE__ */ new Uint8Array(5);
+	const view = new DataView(header.buffer);
+	view.setUint16(0, p.id, false);
+	view.setUint16(2, p.clientID, false);
+	header[4] = p.typeFlagged;
+	return header;
+}
+/** Parse a 3-byte server-to-client header. */
+function parseS2CHeader(raw) {
+	return {
+		id: new DataView(raw.buffer, raw.byteOffset, raw.byteLength).getUint16(0, false),
+		typeFlagged: raw[2]
+	};
+}
+//#endregion
+//#region src/transport/generation-window.ts
+var GenerationWindow = class {
+	#mappedBaseOffset = 0;
+	#generation = 0;
+	#mod;
+	#receiveWindow;
+	constructor(mod, windowSize) {
+		this.#mod = mod;
+		this.#receiveWindow = windowSize;
+	}
+	get generation() {
+		return this.#generation;
+	}
+	advance(amount) {
+		if (amount <= 0) return;
+		const newBaseOffset = this.#mappedBaseOffset + amount;
+		const genStep = Math.floor(newBaseOffset / this.#mod);
+		if (genStep > 0) this.#generation = Math.min(this.#generation + genStep, 4294967295);
+		this.#mappedBaseOffset = newBaseOffset % this.#mod;
+	}
+	advanceToExcluded(mappedValue) {
+		let moveDist = mappedValue - this.#mappedBaseOffset;
+		if (moveDist < 0) moveDist += this.#mod;
+		this.advance(moveDist + 1);
+	}
+	syncTo(mappedValue) {
+		let moveDist = mappedValue - this.#mappedBaseOffset;
+		if (moveDist < 0) moveDist += this.#mod;
+		this.advance(moveDist);
+	}
+	isInWindow(mappedValue) {
+		const maxOffset = this.#mappedBaseOffset + this.#receiveWindow;
+		if (maxOffset < this.#mod) return mappedValue >= this.#mappedBaseOffset && mappedValue < maxOffset;
+		return mappedValue >= this.#mappedBaseOffset || mappedValue < maxOffset - this.#mod;
+	}
+	mappedToIndex(mappedValue) {
+		if (this.#isNextGen(mappedValue)) return mappedValue + this.#mod - this.#mappedBaseOffset;
+		return mappedValue - this.#mappedBaseOffset;
+	}
+	isOldPacket(mappedValue) {
+		return this.mappedToIndex(mappedValue) < 0;
+	}
+	isFuturePacket(mappedValue) {
+		return this.mappedToIndex(mappedValue) >= this.#receiveWindow;
+	}
+	#isNextGen(mappedValue) {
+		return this.#mappedBaseOffset > this.#mod - this.#receiveWindow && mappedValue < this.#mappedBaseOffset + this.#receiveWindow - this.#mod;
+	}
+	getGeneration(mappedValue) {
+		if (this.#isNextGen(mappedValue)) return this.#generation + 1;
+		return this.#generation;
+	}
+	reset() {
+		this.#mappedBaseOffset = 0;
+		this.#generation = 0;
+	}
+};
+//#endregion
+//#region src/transport/quicklz.ts
+var TABLE_SIZE = 4096;
+/**
+* The largest decompressed command accepted. A command is reassembled from at
+* most a receive window of fragments, and the largest real answers (a full
+* permission list, the welcome channel list of a big server) are a few
+* hundred kilobytes; a header declaring more is refused before anything is
+* allocated.
+*/
+var MAX_DECOMPRESSED_SIZE = 1 << 20;
+/**
+* How much larger than its compressed bytes a level-1 block can be. The most
+* a 3-byte back-reference yields is 255 bytes, and every 32 entries also cost
+* a 4-byte control word, which bounds the ratio at about 82; a block declaring
+* more cannot be honest, and is refused before its output is allocated.
+*/
+var MAX_EXPANSION = 128;
+/** A QuickLZ block that cannot be decompressed: truncated, oversized or inconsistent. */
+var QuickLZError = class extends Error {
+	constructor(message) {
+		super(`QuickLZ: ${message}`);
+		this.name = "QuickLZError";
+	}
+};
+/**
+* QuickLZ level 1 decompression, as the server compresses large commands.
+*
+* The input comes from the network, so every read and every back-reference is
+* checked, and malformed input throws a QuickLZError rather than reading out
+* of range or producing a partly filled buffer.
+*/
+var Qlz = class {
+	#hashtable = new Int32Array(TABLE_SIZE);
+	decompress(data) {
+		const { headerLen, decompressedSize, flags } = parseQlzHeader(data);
+		if ((flags & 1) === 0) {
+			if (headerLen + decompressedSize > data.length) throw new QuickLZError("stored block is shorter than its declared size");
+			return data.slice(headerLen, headerLen + decompressedSize);
+		}
+		if (decompressedSize > (data.length - headerLen) * MAX_EXPANSION) throw new QuickLZError(`declared size ${decompressedSize} is more than ${data.length - headerLen} bytes can expand to`);
+		const dest = new Uint8Array(decompressedSize);
+		this.#hashtable.fill(0);
+		const state = {
+			control: 1,
+			sourcePos: headerLen,
+			destPos: 0,
+			nextHashed: 0
+		};
+		while (state.destPos < decompressedSize) {
+			this.#ensureControl(data, state);
+			if ((state.control & 1) !== 0) this.#processReference(data, dest, state);
+			else if (this.#processLiteral(data, dest, decompressedSize, state)) break;
+		}
+		if (state.destPos !== decompressedSize) throw new QuickLZError("block ends early");
+		return dest;
+	}
+	#ensureControl(data, st) {
+		if (st.control !== 1) return;
+		if (st.sourcePos + 4 > data.length) throw new QuickLZError("block ends early");
+		st.control = (data[st.sourcePos] | data[st.sourcePos + 1] << 8 | data[st.sourcePos + 2] << 16 | data[st.sourcePos + 3] << 24) >>> 0;
+		st.sourcePos += 4;
+	}
+	#processReference(data, dest, st) {
+		st.control = st.control >>> 1 >>> 0;
+		if (st.sourcePos + 2 > data.length) throw new QuickLZError("block ends early");
+		const b1 = data[st.sourcePos];
+		const b2 = data[st.sourcePos + 1];
+		st.sourcePos += 2;
+		const hash = b1 >> 4 | b2 << 4;
+		let matchlen = b1 & 15;
+		if (matchlen !== 0) matchlen += 2;
+		else {
+			if (st.sourcePos >= data.length) throw new QuickLZError("block ends early");
+			matchlen = data[st.sourcePos];
+			st.sourcePos++;
+		}
+		const offset = this.#hashtable[hash];
+		if (offset >= st.destPos) throw new QuickLZError("back-reference points ahead of the output");
+		if (st.destPos + matchlen > dest.length) throw new QuickLZError("back-reference overruns the declared size");
+		for (let i = 0; i < matchlen; i++) {
+			dest[st.destPos] = dest[offset + i];
+			st.destPos++;
+		}
+		const end = st.destPos + 1 - matchlen;
+		this.#updateHashtable(dest, st, end);
+		st.nextHashed = st.destPos;
+	}
+	/** Copy literals; returns true once the tail of the block has been copied. */
+	#processLiteral(data, dest, decompressedSize, st) {
+		const threshold = Math.max(decompressedSize, 10) - 10;
+		if (st.destPos >= threshold) {
+			while (st.destPos < decompressedSize) {
+				if (st.control === 1) {
+					if (st.sourcePos + 4 > data.length) throw new QuickLZError("block ends early");
+					st.control = (data[st.sourcePos] | data[st.sourcePos + 1] << 8 | data[st.sourcePos + 2] << 16 | data[st.sourcePos + 3] << 24) >>> 0;
+					st.sourcePos += 4;
+				}
+				if (st.sourcePos >= data.length) throw new QuickLZError("block ends early");
+				dest[st.destPos++] = data[st.sourcePos++];
+				st.control = st.control >>> 1 >>> 0;
+			}
+			return true;
+		}
+		if (st.sourcePos >= data.length) throw new QuickLZError("block ends early");
+		dest[st.destPos++] = data[st.sourcePos++];
+		st.control = st.control >>> 1 >>> 0;
+		const end = Math.max(st.destPos - 2, 0);
+		this.#updateHashtable(dest, st, end);
+		if (st.nextHashed < end) st.nextHashed = end;
+		return false;
+	}
+	#updateHashtable(dest, st, end) {
+		while (st.nextHashed < end) {
+			if (st.nextHashed + 3 > dest.length) break;
+			const v = (dest[st.nextHashed] | dest[st.nextHashed + 1] << 8 | dest[st.nextHashed + 2] << 16) >>> 0;
+			const hash = (v >> 12 ^ v) & 4095;
+			this.#hashtable[hash] = st.nextHashed;
+			st.nextHashed++;
+		}
+	}
+};
+function parseQlzHeader(data) {
+	if (data.length < 3) throw new QuickLZError("data too short");
+	const flags = data[0];
+	if ((flags >> 2 & 3) !== 1) throw new QuickLZError("only level 1 is supported");
+	const long = (flags & 2) !== 0;
+	const headerLen = long ? 9 : 3;
+	if (data.length < headerLen) throw new QuickLZError("data too short for header");
+	const decompressedSize = long ? (data[5] | data[6] << 8 | data[7] << 16 | data[8] << 24) >>> 0 : data[2];
+	if (decompressedSize > 1048576) throw new QuickLZError(`declared size ${decompressedSize} exceeds ${MAX_DECOMPRESSED_SIZE}`);
+	return {
+		headerLen,
+		decompressedSize,
+		flags
+	};
+}
+//#endregion
+//#region src/handshake/crypt-handshake.ts
+var INIT_VERSION = 1566914096;
+var INIT_STEP_LEN = 21;
+/** The RSA challenge each connection attempt, by its Crypt, has answered. */
+var answeredChallenges = /* @__PURE__ */ new WeakMap();
+/**
+* Handle the TS3INIT1 handshake steps.
+* Returns the response bytes to send, or null if nothing should be sent.
+* Throws a CryptoInitError for a step that cannot be answered.
+*/
+function processInit1(crypt, data) {
+	if (data === null || data.length >= 1 && data[0] === 127) return buildInit1StartPacket();
+	if (data.length === 0) throw new CryptoInitError("empty Init1 packet");
+	switch (data[0]) {
+		case 0: return buildInit1Step1Packet(data);
+		case 1: return buildInit1Step2Packet(data);
+		case 2: return buildInit1Step3Packet(data);
+		case 3: return buildInit1Step4Packet(crypt, data);
+		default: return null;
+	}
+}
+function buildInit1StartPacket() {
+	const sendData = /* @__PURE__ */ new Uint8Array(21);
+	const view = new DataView(sendData.buffer);
+	view.setUint32(0, INIT_VERSION, false);
+	sendData[4] = 0;
+	const nowSec = Math.floor(Date.now() / 1e3);
+	const clampedNow = Math.max(0, Math.min(nowSec, 4294967295));
+	view.setUint32(5, clampedNow, false);
+	const rng = randomBytes(4);
+	sendData.set(rng, 9);
+	return sendData;
+}
+function buildInit1Step1Packet(data) {
+	if (data.length !== INIT_STEP_LEN) return null;
+	const sendData = /* @__PURE__ */ new Uint8Array(21);
+	sendData[0] = 1;
+	const tsRand = data[9] | data[10] << 8 | data[11] << 16 | data[12] << 24;
+	new DataView(sendData.buffer).setUint32(17, tsRand >>> 0, false);
+	return sendData;
+}
+function buildInit1Step2Packet(data) {
+	if (data.length !== INIT_STEP_LEN) return null;
+	const sendData = /* @__PURE__ */ new Uint8Array(25);
+	new DataView(sendData.buffer).setUint32(0, INIT_VERSION, false);
+	sendData[4] = 2;
+	sendData.set(data.slice(1, 21), 5);
+	return sendData;
+}
+function buildInit1Step3Packet(data) {
+	if (data.length !== 25) return null;
+	const sendData = /* @__PURE__ */ new Uint8Array(233);
+	sendData[0] = 3;
+	sendData[64] = 1;
+	sendData[128] = 1;
+	new DataView(sendData.buffer).setUint32(129, 1, false);
+	return sendData;
+}
+function buildInit1Step4Packet(crypt, data) {
+	if (data.length !== 233) return null;
+	const answered = answeredChallenges.get(crypt);
+	if (answered !== void 0) return Buffer.from(answered.challenge).equals(Buffer.from(data)) ? answered.answer : null;
+	const level = new DataView(data.buffer, data.byteOffset).getUint32(129, false);
+	const y = crypt.solveRsaChallenge(data, 1, level);
+	const alphaB64 = Buffer.from(crypt.newAlpha()).toString("base64");
+	const omegaB64 = crypt.identity.publicKey();
+	const cmd = buildCommandOrdered("clientinitiv", [
+		["alpha", alphaB64],
+		["omega", omegaB64],
+		["ot", "1"],
+		["ip", ""]
+	]);
+	const cmdBytes = Buffer.from(cmd);
+	const sendData = new Uint8Array(301 + cmdBytes.length);
+	new DataView(sendData.buffer).setUint32(0, INIT_VERSION, false);
+	sendData[4] = 4;
+	sendData.set(data.slice(1, 233), 5);
+	sendData.set(y.slice(0, 64), 237);
+	sendData.set(cmdBytes, 301);
+	answeredChallenges.set(crypt, {
+		challenge: Uint8Array.from(data),
+		answer: sendData
+	});
+	return sendData;
+}
+//#endregion
+//#region src/transport/handler.ts
+var RECEIVE_PACKET_WINDOW_SIZE = 1024;
+var PING_INTERVAL_MS = 5e3;
+var PACKET_TIMEOUT_MS = 6e4;
+var MAX_RETRY_INTERVAL_MS = 1e3;
+var TAG_SIZE = 8;
+var VOICE_HEADER_SIZE = 3;
+var WHISPER_HEADER_SIZE = 5;
+var RESEND_BASE_INTERVAL_MS = 500;
+var RESEND_LOOP_INTERVAL_MS = 100;
+/**
+* The largest command reassembled from fragments. The receive window already
+* bounds how many fragments one command can span; this bounds their total
+* size, which a datagram's own size limit would otherwise let reach tens of
+* megabytes.
+*/
+var MAX_REASSEMBLED_SIZE = 1 << 20;
+/**
+* The packet types the server may send unencrypted: voice, which TeamSpeak
+* never encrypts, ping and pong, and acknowledgements — TS3 3.13 and TS6 6.0
+* both acknowledge commands with plaintext Acks once crypto init has
+* completed. An Ack carries nothing but the id it acknowledges, so a forged
+* one can at worst stop a resend, which dropping the packet would do too.
+* Init1 is handled before decryption.
+*/
+var UNENCRYPTED_TYPES = /* @__PURE__ */ new Set([
+	PacketType.Voice,
+	PacketType.VoiceWhisper,
+	PacketType.Ping,
+	PacketType.Pong,
+	PacketType.Ack,
+	PacketType.AckLow,
+	PacketType.Init1
+]);
+var PacketHandler = class {
+	onPacket = null;
+	onClosed = null;
+	/**
+	* A received datagram could not be handled: it was malformed, or handling it
+	* threw. The datagram is dropped either way; the owner decides whether that
+	* ends the connection. Without an owner the error is logged.
+	*/
+	onReceiveError = null;
+	#crypt;
+	#logger;
+	#socketFactory;
+	#conn = null;
+	#clientID = 0;
+	#closed = false;
+	#stopPing = null;
+	#stopResend = null;
+	#lastMessageReceived = Date.now();
+	#packetCounter = /* @__PURE__ */ new Uint16Array(9);
+	#generationCounter = /* @__PURE__ */ new Uint32Array(9);
+	#recvWindowCommand = new GenerationWindow(65536, RECEIVE_PACKET_WINDOW_SIZE);
+	#recvWindowCommandLow = new GenerationWindow(65536, RECEIVE_PACKET_WINDOW_SIZE);
+	#sendWindowCommand = new GenerationWindow(65536, RECEIVE_PACKET_WINDOW_SIZE);
+	#sendWindowCommandLow = new GenerationWindow(65536, RECEIVE_PACKET_WINDOW_SIZE);
+	#commandQueue = /* @__PURE__ */ new Map();
+	#commandLowQueue = /* @__PURE__ */ new Map();
+	/** The bytes held in both command queues; see MAX_QUEUED_BYTES. */
+	#queuedBytes = 0;
+	#ackManager = /* @__PURE__ */ new Map();
+	#initPacketCheck = null;
+	/**
+	* Command packets sent under the dummy key, before crypto init completed:
+	* clientek, in practice. Both TS3 and TS6 acknowledge clientek under the
+	* dummy key even though it completes crypto init, so the dummy key stays
+	* acceptable for exactly those acknowledgements, and for nothing else.
+	*/
+	#dummyCommandIDs = /* @__PURE__ */ new Set();
+	#resends = 0;
+	constructor(crypt, logger = noopLogger, socketFactory) {
+		this.#crypt = crypt;
+		this.#logger = logger;
+		this.#socketFactory = socketFactory;
+	}
+	setClientID(id) {
+		this.#clientID = id;
+	}
+	/**
+	* Resolve `addr`, open a socket to it and start the handshake.
+	*
+	* Aborting `signal`, or closing the handler, while this runs abandons it: the
+	* lookup's answer is ignored, and a socket that finishes connecting
+	* afterwards is closed rather than started, so no handshake begins after
+	* the connection was given up.
+	*/
+	async connect(addr, signal) {
+		const { host, portNumber } = parseConnectAddress(addr);
+		this.#throwIfAbandoned(signal);
+		let resolved;
+		try {
+			resolved = await abortable(lookup(host), signal);
+		} catch (error) {
+			if (signal?.aborted) throw error;
+			throw new TeamspeakError(`could not resolve ${host}`, { cause: error });
+		}
+		const { address, family } = resolved;
+		this.#throwIfAbandoned(signal);
+		const family6 = family === 6;
+		const socket = this.#socketFactory ? this.#socketFactory(family6 ? 6 : 4) : createSocket(family6 ? "udp6" : "udp4");
+		await new Promise((resolve, reject) => {
+			let done = false;
+			const fail = (error) => {
+				if (done) return;
+				done = true;
+				socket.off("error", onError);
+				signal?.removeEventListener("abort", onAbort);
+				closeQuietly(socket);
+				reject(error);
+			};
+			const onError = (error) => fail(error);
+			const onAbort = () => fail(abortReason(signal));
+			socket.once("error", onError);
+			signal?.addEventListener("abort", onAbort, { once: true });
+			socket.connect(portNumber, address, () => {
+				if (done) return;
+				if (this.#closed || signal?.aborted) {
+					fail(signal?.aborted ? abortReason(signal) : new NotConnectedError());
+					return;
+				}
+				done = true;
+				socket.off("error", onError);
+				signal?.removeEventListener("abort", onAbort);
+				this.start(socket);
+				resolve();
+			});
+		});
+	}
+	#throwIfAbandoned(signal) {
+		signal?.throwIfAborted();
+		if (this.#closed) throw new NotConnectedError();
+	}
+	/** Take over a connected socket and start the handshake on it. A closed handler closes it instead. */
+	start(conn) {
+		if (this.#closed) {
+			closeQuietly(conn);
+			return;
+		}
+		this.#conn = conn;
+		this.#lastMessageReceived = Date.now();
+		conn.on("message", (msg) => {
+			if (this.#closed) return;
+			try {
+				this.#handleRawPacket(new Uint8Array(msg.buffer, msg.byteOffset, msg.byteLength));
+			} catch (error) {
+				if (this.onReceiveError) this.onReceiveError(error);
+				else this.#logger.debug("dropped a malformed packet", { error: String(error) });
+			}
+		});
+		conn.on("error", (err) => {
+			this.#logger.error("udp error", err);
+			this.#triggerClose(err);
+		});
+		conn.on("close", () => this.#triggerClose(null));
+		this.#packetCounter[PacketType.Command] = 1;
+		this.#packetCounter[PacketType.Init1] = 101;
+		const init1Data = processInit1(this.#crypt, null);
+		if (init1Data) this.#sendPacketRaw(PacketType.Init1, init1Data, 0);
+		const pingTimer = setInterval(() => {
+			if (this.#crypt.cryptoInitComplete) this.sendPacket(PacketType.Ping, /* @__PURE__ */ new Uint8Array(0), PacketFlags.Unencrypted);
+		}, PING_INTERVAL_MS);
+		this.#stopPing = () => clearInterval(pingTimer);
+		const resendTimer = setInterval(() => this.#checkResends(), RESEND_LOOP_INTERVAL_MS);
+		this.#stopResend = () => clearInterval(resendTimer);
+	}
+	receivedFinalInitAck() {
+		this.#initPacketCheck = null;
+	}
+	sendPacket(pType, data, flags) {
+		const dummy = !this.#crypt.cryptoInitComplete;
+		if (data.length > 487 && pType !== PacketType.Voice && pType !== PacketType.VoiceWhisper) {
+			this.#sendSplitPacket(pType, data, flags, dummy);
+			return;
+		}
+		this.#sendPacketRaw(pType, data, flags, dummy);
+	}
+	sendVoicePacket(data, codec) {
+		const pID = this.#packetCounter[PacketType.Voice];
+		const pGen = this.#generationCounter[PacketType.Voice];
+		this.#packetCounter[PacketType.Voice] = pID + 1 & 65535;
+		if (this.#packetCounter[PacketType.Voice] === 0) this.#generationCounter[PacketType.Voice]++;
+		const payloadLen = VOICE_HEADER_SIZE + data.length;
+		const voicePayload = new Uint8Array(payloadLen);
+		new DataView(voicePayload.buffer).setUint16(0, pID, false);
+		voicePayload[2] = codec;
+		voicePayload.set(data, VOICE_HEADER_SIZE);
+		const header = buildC2SHeader({
+			typeFlagged: PacketType.Voice | PacketFlags.Unencrypted,
+			id: pID,
+			clientID: this.#clientID,
+			generationID: pGen,
+			data: voicePayload,
+			receivedAt: 0
+		});
+		const final = new Uint8Array(13 + payloadLen);
+		final.set(this.#crypt.fakeSignature, 0);
+		final.set(header, TAG_SIZE);
+		final.set(voicePayload, 13);
+		this.#write(final);
+	}
+	/** Send an unencrypted TeamSpeak voice whisper packet to up to 32 clients. */
+	sendWhisperPacket(data, targetClientIds, codec) {
+		if (targetClientIds.length === 0) throw new RangeError("a whisper needs at least one target");
+		if (targetClientIds.length > 32) throw new RangeError("a whisper has at most 32 targets");
+		if (targetClientIds.some((id) => !Number.isInteger(id) || id < 0 || id > 65535)) throw new RangeError("invalid whisper target");
+		const pID = this.#packetCounter[PacketType.VoiceWhisper];
+		const pGen = this.#generationCounter[PacketType.VoiceWhisper];
+		this.#packetCounter[PacketType.VoiceWhisper] = pID + 1 & 65535;
+		if (this.#packetCounter[PacketType.VoiceWhisper] === 0) this.#generationCounter[PacketType.VoiceWhisper] = pGen + 1 >>> 0;
+		const payloadLen = WHISPER_HEADER_SIZE + targetClientIds.length * 2 + data.length;
+		const whisperPayload = new Uint8Array(payloadLen);
+		const view = new DataView(whisperPayload.buffer);
+		view.setUint16(0, pID, false);
+		whisperPayload[2] = codec;
+		whisperPayload[3] = 0;
+		whisperPayload[4] = targetClientIds.length;
+		for (let index = 0; index < targetClientIds.length; index++) view.setUint16(WHISPER_HEADER_SIZE + index * 2, targetClientIds[index], false);
+		whisperPayload.set(data, WHISPER_HEADER_SIZE + targetClientIds.length * 2);
+		const header = buildC2SHeader({
+			typeFlagged: PacketType.VoiceWhisper | PacketFlags.Unencrypted,
+			id: pID,
+			clientID: this.#clientID,
+			generationID: pGen,
+			data: whisperPayload,
+			receivedAt: 0
+		});
+		const final = new Uint8Array(13 + payloadLen);
+		final.set(this.#crypt.fakeSignature, 0);
+		final.set(header, TAG_SIZE);
+		final.set(whisperPayload, 13);
+		this.#write(final);
+	}
+	/** How many packets have been sent again for want of an acknowledgement. */
+	get resends() {
+		return this.#resends;
+	}
+	/** Whether there is a live socket to send on. */
+	get isOpen() {
+		return this.#conn !== null && !this.#closed;
+	}
+	close() {
+		if (this.#closed) return;
+		this.#closed = true;
+		this.#stopPing?.();
+		this.#stopResend?.();
+		const conn = this.#conn;
+		this.#conn = null;
+		if (conn === null) return;
+		try {
+			conn.close();
+		} catch (error) {
+			this.#logger.debug("socket already closed", { error: String(error) });
+		}
+	}
+	#sendSplitPacket(pType, data, flags, dummy) {
+		const maxSize = 487;
+		let pos = 0;
+		let first = true;
+		while (pos < data.length) {
+			const blockSize = Math.min(data.length - pos, maxSize);
+			const last = pos + blockSize === data.length;
+			let pFlags = flags;
+			if (first !== last) pFlags |= PacketFlags.Fragmented;
+			this.#sendPacketRaw(pType, data.slice(pos, pos + blockSize), pFlags, dummy);
+			pos += blockSize;
+			first = false;
+		}
+	}
+	#sendPacketRaw(pType, data, flags, dummy = !this.#crypt.cryptoInitComplete) {
+		flags = applyProtocolFlags(pType, flags);
+		const [pID, pGen] = this.#nextPacketIdentity(pType);
+		const p = {
+			typeFlagged: pType | flags,
+			id: pID,
+			clientID: this.#clientID,
+			generationID: pGen,
+			data,
+			receivedAt: 0
+		};
+		const unencrypted = (flags & PacketFlags.Unencrypted) !== 0;
+		const header = buildC2SHeader(p);
+		const [ciphertext, tag] = this.#crypt.encrypt(pType, pID, pGen, header, data, dummy, unencrypted);
+		const final = new Uint8Array(13 + ciphertext.length);
+		final.set(tag.slice(0, TAG_SIZE), 0);
+		final.set(header, TAG_SIZE);
+		final.set(ciphertext, 13);
+		this.#write(final);
+		if (dummy && pType === PacketType.Command) this.#dummyCommandIDs.add(pID);
+		const rp = {
+			packet: p,
+			firstSend: Date.now(),
+			lastSend: Date.now(),
+			retryCount: 0,
+			nextInterval: RESEND_BASE_INTERVAL_MS
+		};
+		this.#trackResend(pType, p, rp);
+	}
+	#write(data) {
+		if (!this.#conn) return;
+		try {
+			this.#conn.send(data, (err) => {
+				if (err) this.#logger.warn("udp send error", err);
+			});
+		} catch (error) {
+			const normalized = error instanceof Error ? error : new Error(String(error));
+			this.#logger.error("udp send failed", normalized);
+			this.#triggerClose(normalized);
+		}
+	}
+	#handleRawPacket(raw) {
+		if (raw.length < 11) return;
+		if (raw.length > 4096) {
+			this.#logger.debug("dropped an oversized datagram", { size: raw.length });
+			return;
+		}
+		const tag = raw.slice(0, TAG_SIZE);
+		const header = raw.slice(TAG_SIZE, 11);
+		const ciphertext = raw.slice(11);
+		const parsed = parseS2CHeader(header);
+		if ((parsed.typeFlagged & 15) === PacketType.Init1 && this.#crypt.cryptoInitComplete) return;
+		const p = {
+			...parsed,
+			clientID: 0,
+			generationID: this.#resolveGeneration(parsed.id, parsed.typeFlagged & 15),
+			data: /* @__PURE__ */ new Uint8Array(0),
+			receivedAt: Date.now()
+		};
+		const decrypted = this.#decryptPacketData(p, header, ciphertext, tag);
+		if (decrypted === null) return;
+		p.data = decrypted.plaintext;
+		this.#lastMessageReceived = Date.now();
+		if (packetType(p) === PacketType.Ping) {
+			this.#sendPong(p.id, decrypted.dummyUsed);
+			return;
+		}
+		if (!this.#handleCommandWindowAndAck(p, decrypted.dummyUsed)) return;
+		this.#handlePacketQueue(p);
+		this.#updatePostReceiveState(p);
+	}
+	#resolveGeneration(id, pType) {
+		switch (pType) {
+			case PacketType.Command: return this.#recvWindowCommand.getGeneration(id);
+			case PacketType.CommandLow: return this.#recvWindowCommandLow.getGeneration(id);
+			case PacketType.Ack: return this.#sendWindowCommand.getGeneration(id);
+			case PacketType.AckLow: return this.#sendWindowCommandLow.getGeneration(id);
+			default: return 0;
+		}
+	}
+	#decryptPacketData(p, header, ciphertext, tag) {
+		const unencrypted = (packetFlags(p) & PacketFlags.Unencrypted) !== 0;
+		const dummy = !this.#crypt.cryptoInitComplete;
+		let dummyUsed = dummy;
+		const pType = packetType(p);
+		const gen = p.generationID;
+		if (unencrypted && !UNENCRYPTED_TYPES.has(pType)) {
+			this.#logger.debug("dropped an unencrypted packet of a type that must be encrypted", {
+				type: pType,
+				id: p.id
+			});
+			return null;
+		}
+		try {
+			return {
+				plaintext: this.#crypt.decrypt(pType, p.id, gen, header, ciphertext, tag, dummy, unencrypted),
+				dummyUsed
+			};
+		} catch {
+			if (dummy) return null;
+			if (!dummy && pType === PacketType.Ack && !unencrypted) try {
+				const plaintext = this.#crypt.decrypt(pType, p.id, gen, header, ciphertext, tag, true, false);
+				const acked = plaintext.length >= 2 ? plaintext[0] << 8 | plaintext[1] : NaN;
+				if (this.#dummyCommandIDs.delete(acked)) return {
+					plaintext,
+					dummyUsed: true
+				};
+			} catch {}
+			return null;
+		}
+	}
+	#handleCommandWindowAndAck(p, dummyUsed) {
+		const pType = packetType(p);
+		if (pType !== PacketType.Command && pType !== PacketType.CommandLow) return true;
+		const win = pType === PacketType.Command ? this.#recvWindowCommand : this.#recvWindowCommandLow;
+		const ackType = pType === PacketType.Command ? PacketType.Ack : PacketType.AckLow;
+		if (!win.isInWindow(p.id)) {
+			if (win.isOldPacket(p.id)) this.#sendAck(p.id, ackType, dummyUsed);
+			return false;
+		}
+		const held = (pType === PacketType.Command ? this.#commandQueue : this.#commandLowQueue).get(p.id)?.data.length ?? 0;
+		const next = pType === PacketType.Command ? this.#_nextCommandID : this.#_nextCommandLowID;
+		if (p.id !== next && this.#queuedBytes - held + p.data.length > 1048576) {
+			this.#logger.debug("dropped a command packet: the receive queues are full", { id: p.id });
+			return false;
+		}
+		this.#sendAck(p.id, ackType, dummyUsed);
+		return true;
+	}
+	#sendAck(packetID, ackType, dummyUsed) {
+		const ackData = /* @__PURE__ */ new Uint8Array(2);
+		new DataView(ackData.buffer).setUint16(0, packetID, false);
+		this.#sendPacketRaw(ackType, ackData, 0, dummyUsed);
+	}
+	#sendPong(pID, dummyUsed) {
+		const pongData = /* @__PURE__ */ new Uint8Array(2);
+		new DataView(pongData.buffer).setUint16(0, pID, false);
+		this.#sendPacketRaw(PacketType.Pong, pongData, PacketFlags.Unencrypted, dummyUsed);
+	}
+	#handlePacketQueue(p) {
+		const pType = packetType(p);
+		if (pType !== PacketType.Command && pType !== PacketType.CommandLow) {
+			this.onPacket?.(p);
+			return;
+		}
+		const isCommand = pType === PacketType.Command;
+		const queue = isCommand ? this.#commandQueue : this.#commandLowQueue;
+		const win = isCommand ? this.#recvWindowCommand : this.#recvWindowCommandLow;
+		this.#hold(queue, p);
+		if (isCommand) this.#fastForwardMissingPackets(queue, win, true);
+		else this.#fastForwardMissingPackets(queue, win, false);
+		while (true) {
+			const current = isCommand ? this.#_nextCommandID : this.#_nextCommandLowID;
+			const packet = queue.get(current);
+			if (packet === void 0) break;
+			const result = this.#tryReassemble(packet, queue, current, win);
+			if (!result) break;
+			const [reassembled, newNext] = result;
+			if (isCommand) this.#_nextCommandID = newNext;
+			else this.#_nextCommandLowID = newNext;
+			if (reassembled === null) {
+				this.#logger.debug("dropped a command over the reassembly limit", { id: current });
+				continue;
+			}
+			if (!this.#tryDecompress(reassembled)) continue;
+			this.onPacket?.(reassembled);
+		}
+	}
+	/** Put a packet in its queue, counting its bytes; one with the same id is replaced. */
+	#hold(queue, p) {
+		this.#release(queue, p.id);
+		queue.set(p.id, p);
+		this.#queuedBytes += p.data.length;
+	}
+	#release(queue, id) {
+		const held = queue.get(id);
+		if (held === void 0) return;
+		queue.delete(id);
+		this.#queuedBytes -= held.data.length;
+	}
+	#_nextCommandID = 0;
+	#_nextCommandLowID = 0;
+	#fastForwardMissingPackets(queue, win, isCommand) {
+		let nextID = isCommand ? this.#_nextCommandID : this.#_nextCommandLowID;
+		while (!queue.has(nextID) && hasOldNewerPacket(queue, nextID)) {
+			nextID = nextID + 1 & 65535;
+			win.advance(1);
+		}
+		if (isCommand) this.#_nextCommandID = nextID;
+		else this.#_nextCommandLowID = nextID;
+	}
+	#tryReassemble(startPacket, queue, nextID, win) {
+		if ((packetFlags(startPacket) & PacketFlags.Fragmented) === 0) {
+			this.#release(queue, nextID);
+			win.advance(1);
+			return [startPacket, nextID + 1 & 65535];
+		}
+		const fragments = [];
+		let totalSize = 0;
+		let currID = nextID;
+		let startSeen = false;
+		let complete = false;
+		while (true) {
+			const frag = queue.get(currID);
+			if (!frag) return null;
+			fragments.push(frag);
+			totalSize += frag.data.length;
+			if (totalSize > MAX_REASSEMBLED_SIZE) {
+				for (let i = 0; i < fragments.length; i++) {
+					this.#release(queue, nextID);
+					win.advance(1);
+					nextID = nextID + 1 & 65535;
+				}
+				return [null, nextID];
+			}
+			const fragmented = (packetFlags(frag) & PacketFlags.Fragmented) !== 0;
+			if (!startSeen) {
+				startSeen = true;
+				if (!fragmented) {
+					complete = true;
+					break;
+				}
+			} else if (fragmented) {
+				complete = true;
+				break;
+			}
+			currID = currID + 1 & 65535;
+		}
+		if (!complete) return null;
+		const combined = new Uint8Array(totalSize);
+		let pos = 0;
+		for (const frag of fragments) {
+			combined.set(frag.data, pos);
+			pos += frag.data.length;
+			this.#release(queue, nextID);
+			win.advance(1);
+			nextID = nextID + 1 & 65535;
+		}
+		startPacket.data = combined;
+		startPacket.typeFlagged &= ~PacketFlags.Fragmented;
+		return [startPacket, nextID];
+	}
+	/** Decompress a command in place; false when it cannot be, and is to be dropped. */
+	#tryDecompress(packet) {
+		if ((packetFlags(packet) & PacketFlags.Compressed) === 0) return true;
+		try {
+			packet.data = new Qlz().decompress(packet.data);
+			packet.typeFlagged &= ~PacketFlags.Compressed;
+			return true;
+		} catch (err) {
+			this.#logger.debug("dropped a command that failed to decompress", {
+				id: packet.id,
+				error: String(err)
+			});
+			return false;
+		}
+	}
+	#updatePostReceiveState(p) {
+		const pType = packetType(p);
+		if (pType === PacketType.Init1) {
+			this.#initPacketCheck = null;
+			return;
+		}
+		if ((pType === PacketType.Ack || pType === PacketType.AckLow) && p.data.length >= 2) {
+			const ackID = new DataView(p.data.buffer, p.data.byteOffset).getUint16(0, false);
+			const key = (pType === PacketType.Ack ? PacketType.Command : PacketType.CommandLow) << 16 | ackID;
+			this.#ackManager.delete(key);
+		}
+	}
+	#nextPacketIdentity(pType) {
+		const pID = this.#packetCounter[pType];
+		const pGen = this.#generationCounter[pType];
+		if (pType === PacketType.Init1) return [pID, pGen];
+		this.#packetCounter[pType] = pID + 1 & 65535;
+		if (this.#packetCounter[pType] === 0) this.#generationCounter[pType] = pGen + 1 >>> 0;
+		if (pType === PacketType.Command) this.#sendWindowCommand.advanceToExcluded(pID);
+		else if (pType === PacketType.CommandLow) this.#sendWindowCommandLow.advanceToExcluded(pID);
+		return [pID, pGen];
+	}
+	#trackResend(pType, p, rp) {
+		if (pType === PacketType.Init1) {
+			this.#initPacketCheck = rp;
+			return;
+		}
+		if (pType === PacketType.Command || pType === PacketType.CommandLow) {
+			const key = pType << 16 | p.id;
+			this.#ackManager.set(key, rp);
+		}
+	}
+	#checkResends() {
+		const now = Date.now();
+		if (now - this.#lastMessageReceived > PACKET_TIMEOUT_MS) {
+			this.#logger.warn("idle timeout");
+			this.#triggerClose(new ConnectionTimeoutError());
+			return;
+		}
+		if (this.#initPacketCheck) this.#doResend(this.#initPacketCheck, now);
+		for (const [key, rp] of this.#ackManager) {
+			if (now - rp.firstSend > PACKET_TIMEOUT_MS) {
+				this.#ackManager.delete(key);
+				this.#triggerClose(new ConnectionTimeoutError());
+				return;
+			}
+			this.#doResend(rp, now);
+		}
+	}
+	#doResend(rp, now) {
+		if (now - rp.lastSend < rp.nextInterval) return;
+		rp.lastSend = now;
+		rp.retryCount++;
+		this.#resends++;
+		rp.nextInterval = Math.min(rp.nextInterval * 2, MAX_RETRY_INTERVAL_MS);
+		const dummy = !this.#crypt.cryptoInitComplete;
+		const unencrypted = (packetFlags(rp.packet) & PacketFlags.Unencrypted) !== 0;
+		const header = buildC2SHeader(rp.packet);
+		const pType = packetType(rp.packet);
+		const [ciphertext, tag] = this.#crypt.encrypt(pType, rp.packet.id, rp.packet.generationID, header, rp.packet.data, dummy, unencrypted);
+		const final = new Uint8Array(13 + ciphertext.length);
+		final.set(tag.slice(0, TAG_SIZE), 0);
+		final.set(header, TAG_SIZE);
+		final.set(ciphertext, 13);
+		this.#write(final);
+	}
+	#triggerClose(err) {
+		if (this.#closed) return;
+		this.close();
+		this.onClosed?.(err);
+	}
+};
+/** Close a socket that may already be closed; dgram throws on a second close. */
+function closeQuietly(socket) {
+	try {
+		socket.close();
+	} catch {}
+}
+function applyProtocolFlags(pType, flags) {
+	if (pType === PacketType.Command || pType === PacketType.CommandLow) return flags | PacketFlags.NewProtocol;
+	return flags;
+}
+function hasOldNewerPacket(queue, nextID) {
+	const now = Date.now();
+	for (const [id, pkg] of queue) if ((id - nextID + 65536 & 65535) < 32768 && now - pkg.receivedAt > 5e3) return true;
+	return false;
+}
+//#endregion
+//#region src/commands.ts
+/**
+* Matches the server's answers to the commands that asked for them.
+*
+* The server handles one client's commands in order and closes each answer
+* with `error … return_code=N`, so every row seen since the previous `error`
+* belongs to command N. Rows are therefore held, tagged with where they came
+* from, until that `error` says whose they are — attributing them on arrival
+* would mean guessing which in-flight command the server is answering, and a
+* command can be registered here well before it is sent (it first waits on the
+* throttle and the middleware chain).
+*
+* A nameless row always belongs to the command. A notification row belongs to
+* it only if the command declared that notification as its answer (see
+* command/responses.ts): the same `notifyclientmoved` that answers nothing can
+* arrive between any two commands.
+*
+* The welcome sequence is the exception. The server pushes channellist,
+* channelgrouplist and the rest unprompted right after the handshake, before
+* `channellistfinished`; without the gate they would land in the first
+* command's answer as duplicate rows and a phantom cid=0.
+*/
+var CommandTracker = class {
+	#pending = /* @__PURE__ */ new Map();
+	#ownClientID;
+	#nextRC = 0;
+	#buffer = [];
+	#welcomeComplete = false;
+	/** @param ownClientID the client's clid, for answers filtered by invoker. */
+	constructor(ownClientID = () => 0) {
+		this.#ownClientID = ownClientID;
+	}
+	register(spec, correlation) {
+		this.#nextRC++;
+		const rc = this.#nextRC;
+		return [rc, new Promise((resolve) => {
+			this.#pending.set(rc, {
+				resolve,
+				spec,
+				correlation,
+				correlated: []
+			});
+		})];
+	}
+	unregister(rc) {
+		this.#pending.delete(rc);
+	}
+	/** Marks the end of the welcome sequence and drops what it left behind. */
+	signalWelcomeComplete() {
+		this.#welcomeComplete = true;
+		this.#buffer = [];
+	}
+	/** Whether some in-flight command declared `name` as its answer. */
+	expects(name) {
+		for (const p of this.#pending.values()) {
+			if (p.spec?.notifications?.includes(name)) return true;
+			if (p.spec?.correlated?.notifications.includes(name)) return true;
+		}
+		return false;
+	}
+	/** Hold a row until the next `error` says which command it answered. */
+	buffer(params, source = "") {
+		if (!this.#welcomeComplete) return;
+		if (this.#pending.size === 0) return;
+		this.#buffer.push({
+			source,
+			params
+		});
+	}
+	/**
+	* Offer a notification to commands answered after their `error`.
+	*
+	* Matching is on the echoed request field, so it does not matter whether the
+	* notification beats the `error` or follows it.
+	*/
+	offerCorrelated(name, params) {
+		for (const [rc, p] of this.#pending) {
+			const c = p.spec?.correlated;
+			if (!c || p.correlation === void 0 || !c.notifications.includes(name)) continue;
+			if (params[c.key] !== p.correlation) continue;
+			if (name === c.failure && (params["status"] ?? "0") !== "0") {
+				const err = new ServerError(parseErrorCode(params["status"]), params["msg"] ?? "", { extraMessage: params["extra_msg"] || void 0 });
+				this.#settle(rc, p, {
+					err,
+					data: []
+				});
+				return;
+			}
+			p.correlated.push(params);
+			if (p.settled) this.#settle(rc, p, {
+				err: null,
+				data: [...p.settled.data, ...p.correlated]
+			});
+			return;
+		}
+	}
+	resolve(rc, err) {
+		const rows = this.#buffer;
+		this.#buffer = [];
+		const p = this.#pending.get(rc);
+		if (!p) return;
+		const data = rows.filter((row) => this.#answers(p, row)).map((row) => row.params);
+		if (err) {
+			this.#settle(rc, p, {
+				err,
+				data
+			});
+			return;
+		}
+		if (p.spec?.correlated && p.correlation !== void 0 && p.correlated.length === 0) {
+			p.settled = {
+				err: null,
+				data
+			};
+			return;
+		}
+		this.#settle(rc, p, {
+			err: null,
+			data: [...data, ...p.correlated]
+		});
+	}
+	discardBuffer() {
+		this.#buffer = [];
+	}
+	/**
+	* Forget every command and fail it with `err`.
+	*
+	* Dropping them silently would leave each caller waiting out its full
+	* timeout for an answer that can no longer come.
+	*/
+	reset(err) {
+		const pending = [...this.#pending.values()];
+		this.#pending.clear();
+		for (const p of pending) p.resolve({
+			err,
+			data: []
+		});
+		this.#buffer = [];
+		this.#welcomeComplete = false;
+		this.#nextRC = 0;
+	}
+	#answers(p, row) {
+		if (row.source === "") return true;
+		if (!p.spec?.notifications?.includes(row.source)) return false;
+		if (!p.spec.ownRowsOnly) return true;
+		return row.params["invokerid"] === String(this.#ownClientID());
+	}
+	#settle(rc, p, result) {
+		this.#pending.delete(rc);
+		p.resolve(result);
+	}
+};
+/**
+* Append the tracker's return_code to a command.
+*
+* The return_code belongs to the tracker: it is how an answer finds its
+* command, so a caller-supplied one would detach the command from its answer.
+* Checked as a parameter rather than as text, because a message body that
+* merely contains "return_code=" used to suppress the real one and time the
+* command out.
+*/
+function appendReturnCode(cmd, rc) {
+	const params = parseCommand(cmd)?.params ?? {};
+	if (Object.hasOwn(params, "return_code")) throw new TypeError("commands must not carry their own return_code; the client assigns it");
+	return `${cmd} return_code=${rc}`;
+}
+//#endregion
+//#region src/transfer.ts
+/**
+* File transfer data.
+*
+* Negotiating a transfer is a command (`initFileUpload`, `initFileDownload`);
+* the bytes then go over a separate TCP connection to the server's file
+* transfer port, opened with the key the negotiation returned.
+*/
+/** How long dialing may take before it fails, unless a signal says otherwise. */
+var DIAL_TIMEOUT_MS = 1e4;
+/**
+* Open a connection to the file transfer port and send the transfer key.
+* The caller owns the returned stream and must end or destroy it.
+*/
+async function dialFileTransfer(host, port, key, options = {}) {
+	const { signal, socketFactory } = options;
+	signal?.throwIfAborted();
+	const socket = socketFactory ? socketFactory(host, port) : connect({
+		host,
+		port
+	});
+	const swallow = () => {};
+	socket.on("error", swallow);
+	try {
+		await connected(socket, signal);
+		await new Promise((resolve, reject) => {
+			socket.write(key, (err) => err ? reject(new FileTransferError(`failed to send transfer key: ${err.message}`, { cause: err })) : resolve());
+		});
+	} catch (error) {
+		socket.destroy();
+		throw error;
+	} finally {
+		socket.off("error", swallow);
+	}
+	return socket;
+}
+/**
+* Wait for a stream to be connected. A `node:net` socket says so with
+* `connect`; a stream from elsewhere that is already writable is taken as
+* connected.
+*/
+function connected(socket, signal) {
+	const pending = socket.pending;
+	if (pending === false || pending === void 0 && socket.writable) return Promise.resolve();
+	return new Promise((resolve, reject) => {
+		const timeout = AbortSignal.timeout(DIAL_TIMEOUT_MS);
+		const done = (error) => {
+			socket.off("connect", onConnect);
+			socket.off("ready", onConnect);
+			socket.off("error", onError);
+			signal?.removeEventListener("abort", onAbort);
+			timeout.removeEventListener("abort", onTimeout);
+			if (error === void 0) resolve();
+			else reject(error);
+		};
+		const onConnect = () => done();
+		const onError = (error) => done(new FileTransferError(`file transfer connection failed: ${error.message}`, { cause: error }));
+		const onAbort = () => done(signal.reason);
+		const onTimeout = () => done(new FileTransferError("file transfer connection timed out"));
+		socket.once("connect", onConnect);
+		socket.once("ready", onConnect);
+		socket.once("error", onError);
+		signal?.addEventListener("abort", onAbort, { once: true });
+		timeout.addEventListener("abort", onTimeout, { once: true });
+	});
+}
+/** Upload `data` over a negotiated transfer. Resolves once every byte is sent. */
+async function uploadFileData(host, info, data, options = {}) {
+	const socket = await dialFileTransfer(host, info.port, info.fileTransferKey, options);
+	await pipeline(data, socket, options.signal ? { signal: options.signal } : {});
+}
+/** Download a negotiated transfer into `dest`. Resolves once the file is written. */
+async function downloadFileData(host, info, dest, options = {}) {
+	const socket = await dialFileTransfer(host, info.port, info.fileTransferKey, options);
+	await pipeline(socket, dest, options.signal ? { signal: options.signal } : {});
+}
+//#endregion
+//#region src/events.ts
+/**
+* Compose a chain of middlewares around a base handler.
+* Rightmost middleware wraps the base first.
+*/
+function buildCommandChain(middlewares, base) {
+	let handler = base;
+	for (let i = middlewares.length - 1; i >= 0; i--) handler = middlewares[i](handler);
+	return handler;
+}
+function buildEventChain(middlewares, base) {
+	let handler = base;
+	for (let i = middlewares.length - 1; i >= 0; i--) handler = middlewares[i](handler);
+	return handler;
+}
+//#endregion
+//#region src/capabilities.ts
+/**
+* Read what a server says about itself in `initserver`, or a version string
+* alone, such as "6.0.0-beta13.1 [Build: 1]".
+*/
+function parseServerCapabilities(initserver) {
+	const params = typeof initserver === "string" ? { virtualserver_version: initserver } : initserver;
+	const version = params["virtualserver_version"] ?? "";
+	const parsed = Number.parseInt(version, 10);
+	const major = Number.isNaN(parsed) ? 0 : parsed;
+	let family = "unknown";
+	if (major === 3) family = "ts3";
+	else if (major >= 6) family = "ts6";
+	return {
+		version,
+		major,
+		family,
+		uidAlgorithm: uidAlgorithmForVersion(version),
+		name: params["virtualserver_name"] ?? "",
+		iconID: parseIconID(params["virtualserver_icon_id"]),
+		hostBannerImageURL: params["virtualserver_hostbanner_gfx_url"]?.trim() || void 0,
+		welcomeMessage: params["virtualserver_welcomemessage"] ?? ""
+	};
+}
+/**
+* Capabilities of a server that has not been connected to yet.
+*
+* The family is `unknown` — nothing has said which server this is — and
+* `uidAlgorithm` is SHA-1, the TS3 hash.
+*/
+function unknownServerCapabilities() {
+	return parseServerCapabilities("");
+}
+//#endregion
+//#region src/handshake/license.ts
+var LICENSE_ROOT_KEY = new Uint8Array([
+	205,
+	13,
+	226,
+	174,
+	212,
+	99,
+	69,
+	80,
+	154,
+	126,
+	60,
+	253,
+	143,
+	104,
+	179,
+	220,
+	117,
+	85,
+	178,
+	157,
+	204,
+	236,
+	115,
+	205,
+	24,
+	117,
+	15,
+	153,
+	56,
+	18,
+	64,
+	138
+]);
+var LicenseChain = class {
+	blocks;
+	constructor(blocks) {
+		this.blocks = blocks;
+	}
+	/**
+	* Derive the session key by chaining Ed25519 point arithmetic starting from
+	* the root key through each license block.
+	*/
+	deriveKey() {
+		let round = Uint8Array.from(LICENSE_ROOT_KEY);
+		for (const block of this.blocks) round = deriveKeyFromBlock(block, round);
+		return round;
+	}
+};
+function parseLicenses(data) {
+	if (data.length < 1) throw new Error("license too short");
+	if (data[0] !== 1) throw new Error("unsupported license version");
+	let remaining = data.slice(1);
+	const blocks = [];
+	while (remaining.length > 0) {
+		if (blocks.length === 8) throw new Error(`license chain longer than 8 blocks`);
+		const { block, consumed } = parseLicenseBlock(remaining);
+		blocks.push(block);
+		remaining = remaining.slice(consumed);
+	}
+	return new LicenseChain(blocks);
+}
+function parseLicenseBlock(data) {
+	const MIN_BLOCK_LEN = 42;
+	if (data.length < MIN_BLOCK_LEN) throw new Error("license too short");
+	if (data[0] !== 0) throw new Error(`wrong key kind in license: ${data[0]}`);
+	const blockType = data[33];
+	const UNIX_OFFSET = 1356998400;
+	const view = new DataView(data.buffer, data.byteOffset, data.byteLength);
+	const notValidBefore = /* @__PURE__ */ new Date((view.getUint32(34, false) + UNIX_OFFSET) * 1e3);
+	const notValidAfter = /* @__PURE__ */ new Date((view.getUint32(38, false) + UNIX_OFFSET) * 1e3);
+	if (notValidAfter < notValidBefore) throw new Error("license times are invalid");
+	const key = Uint8Array.from(data.slice(1, 33));
+	const { payload, payloadRead } = parseBlockPayload(blockType, data, MIN_BLOCK_LEN);
+	const allLen = MIN_BLOCK_LEN + payloadRead;
+	if (allLen > data.length) throw new Error("license block longer than the license");
+	const hashInput = data.slice(1, allLen);
+	const hashFull = hash512(Uint8Array.from(hashInput));
+	return {
+		block: {
+			key,
+			hash: Uint8Array.from(hashFull.slice(0, 32)),
+			properties: payload.properties,
+			issuer: payload.issuer,
+			notValidBefore,
+			notValidAfter,
+			blockType,
+			serverType: payload.serverType
+		},
+		consumed: allLen
+	};
+}
+function parseBlockPayload(blockType, data, minBlockLen) {
+	switch (blockType) {
+		case 0: {
+			const { str, read } = readNullString(data.slice(46));
+			return {
+				payload: {
+					issuer: str,
+					serverType: 0,
+					properties: [],
+					read: 5 + read
+				},
+				payloadRead: 5 + read
+			};
+		}
+		case 2: {
+			const { str, read } = readNullString(data.slice(47));
+			return {
+				payload: {
+					issuer: str,
+					serverType: data[42] ?? 0,
+					properties: [],
+					read: 6 + read
+				},
+				payloadRead: 6 + read
+			};
+		}
+		case 8: {
+			const propCount = data[43] !== void 0 ? data[43] : 0;
+			let pos = 44;
+			const properties = [];
+			for (let i = 0; i < propCount; i++) {
+				if (pos >= data.length) throw new Error("license too short");
+				const propLen = data[pos++];
+				if (pos + propLen > data.length) throw new Error("license too short");
+				properties.push(Uint8Array.from(data.slice(pos, pos + propLen)));
+				pos += propLen;
+			}
+			return {
+				payload: {
+					issuer: "",
+					serverType: data[42] ?? 0,
+					properties,
+					read: pos - minBlockLen
+				},
+				payloadRead: pos - minBlockLen
+			};
+		}
+		case 32: return {
+			payload: {
+				issuer: "",
+				serverType: 0,
+				properties: [],
+				read: 0
+			},
+			payloadRead: 0
+		};
+		default: throw new Error(`invalid license block type: ${blockType}`);
+	}
+}
+/**
+* Scan for a null-terminated string and return its content and the index
+* of the null byte (NOT including it in the count, matching Go behaviour).
+* The parent formulas (`5 + read`, `6 + read`) already add 1 for the null.
+*/
+function readNullString(data) {
+	for (let i = 0; i < data.length; i++) if (data[i] === 0) return {
+		str: new TextDecoder().decode(data.slice(0, i)),
+		read: i
+	};
+	throw new Error("non-null-terminated issuer string");
+}
+/**
+* Derive the next key given a parent key and a license block.
+* Mirrors Go's licenseBlock.deriveKey.
+*/
+function deriveKeyFromBlock(block, parent) {
+	const scalarBytes = Uint8Array.from(block.hash);
+	clampScalar(scalarBytes);
+	const scalar = bytesToBigIntLE(scalarBytes);
+	const negPub = ed25519.Point.fromBytes(block.key).negate();
+	const negPar = ed25519.Point.fromBytes(parent).negate();
+	const raw = scalarMultFull(negPub, scalar).add(negPar).toBytes();
+	const final = new Uint8Array(raw.length);
+	final.set(raw);
+	final[31] = (final[31] !== void 0 ? final[31] : 0) ^ 128;
+	return final;
+}
+//#endregion
+//#region src/handshake/crypt-init2.ts
+/**
+* CryptoInit2 performs the second stage of crypto initialization (Ed25519 ECDH).
+* Mirrors Go's handshake.CryptoInit2.
+*/
+function cryptoInit2(crypt, license, omega, proof, beta, privateKey) {
+	if (crypt.alpha.length === 0) throw new CryptoInitError("initivexpand2 arrived before clientinitiv was sent");
+	const licenseBytes = Buffer.from(license, "base64");
+	const omegaBytes = Buffer.from(omega, "base64");
+	const proofBytes = Buffer.from(proof, "base64");
+	const betaBytes = Buffer.from(beta, "base64");
+	let serverPubKey;
+	try {
+		serverPubKey = importPublicKey(omegaBytes);
+	} catch (error) {
+		throw new CryptoInitError("the server's public key is invalid", { cause: error });
+	}
+	if (!verifySign(serverPubKey, licenseBytes, proofBytes)) throw new CryptoInitError("the server's license proof is not valid");
+	let sharedSecret;
+	try {
+		sharedSecret = getSharedSecret2(parseLicenses(licenseBytes).deriveKey(), privateKey);
+	} catch (error) {
+		throw new CryptoInitError("the server's license is invalid", { cause: error });
+	}
+	crypt.setSharedSecret(crypt.alpha, betaBytes, sharedSecret);
+}
+//#endregion
+//#region src/handshake.ts
+/** Handle the `clientinitiv` message (P-256 based crypto path). */
+function handleHandshakeInitIV(client, params) {
+	const alpha = params["alpha"] ?? "";
+	const beta = params["beta"] ?? "";
+	const omega = params["omega"] ?? "";
+	client.crypt.initCrypto(alpha, beta, omega);
+	client.logger.info("crypto initialized (P-256 path), sending clientinit");
+	sendClientInit(client);
+}
+/** Handle the `initivexpand2` message (Ed25519 / TS3 crypto path). */
+function handleHandshakeExpand2(client, params) {
+	client.logger.info("received initivexpand2");
+	client.handler.receivedFinalInitAck();
+	const license = params["l"] ?? "";
+	const omega = params["omega"] ?? "";
+	const proof = params["proof"] ?? "";
+	const beta = params["beta"] ?? "";
+	const privateKey = sendClientEkPacket(client, beta);
+	cryptoInit2(client.crypt, license, omega, proof, beta, privateKey);
+	sendClientInit(client);
+}
+/** Handle `initserver` — marks the client as connected. */
+function handleInitServer(client, params) {
+	const idStr = params["aclid"] ?? params["clid"] ?? "";
+	const clid = idStr ? parseInt(idStr, 10) : 0;
+	if (clid > 0) {
+		client.clid = clid;
+		client.handler.setClientID(clid);
+	}
+	client.capabilities = parseServerCapabilities(params);
+	client.logger.info("connected to server", { selfId: client.clid });
+	client.markConnected();
+	setImmediate(() => {
+		const updateCmd = buildCommand("clientupdate", {
+			client_input_muted: "0",
+			client_output_muted: "0"
+		});
+		client.execNoWait(updateCmd).catch(() => {});
+	});
+}
+function sendClientEkPacket(client, beta) {
+	const [publicKey, privateKey] = generateTemporaryKey();
+	const ekBase64 = Buffer.from(publicKey).toString("base64");
+	const clientProof = buildClientEkProof(client, publicKey, beta);
+	const clientEk = buildCommandOrdered("clientek", [["ek", ekBase64], ["proof", clientProof]]);
+	client.handler.sendPacket(PacketType.Command, Buffer.from(clientEk), 0);
+	return privateKey;
+}
+function buildClientEkProof(client, publicKey, beta) {
+	const betaBytes = Buffer.from(beta, "base64");
+	const toSign = /* @__PURE__ */ new Uint8Array(86);
+	toSign.set(publicKey.slice(0, 32));
+	toSign.set(betaBytes.slice(0, Math.min(54, betaBytes.length)), 32);
+	const sig = sign(identityPrivateKey(client.crypt.identity), toSign);
+	return Buffer.from(sig).toString("base64");
+}
+/**
+* Encode a password field for the command protocol.
+*
+* TeamSpeak expects password fields as base64(sha1(password)) — server and
+* channel passwords during the handshake, the `clientmove` channel password,
+* and the `cpw` field of the file transfer commands. Sending the plain text
+* instead makes the server reject correct passwords with error 781.
+*/
+function prepareClientPassword(password) {
+	if (password === "") return "";
+	return createHash("sha1").update(password).digest().toString("base64");
+}
+function sendClientInit(client) {
+	const cmd = buildClientInitCommand(client);
+	client.handler.sendPacket(PacketType.Command, Buffer.from(cmd), 0);
+}
+function buildClientInitCommand(client) {
+	const pubKeyBase64 = client.crypt.identity.publicKey();
+	const initOptions = client.initOptions;
+	const hwid = createHash("sha1").update(pubKeyBase64).digest().toString("base64");
+	return buildCommandOrdered("clientinit", [
+		["client_nickname", client.nickname],
+		["client_version", "3.?.? [Build: 5680278000]"],
+		["client_platform", "Windows"],
+		["client_input_hardware", "1"],
+		["client_output_hardware", "1"],
+		["client_default_channel", initOptions.defaultChannel],
+		["client_default_channel_password", initOptions.defaultChannelPasswordHash],
+		["client_server_password", initOptions.serverPasswordHash],
+		["client_meta_data", ""],
+		["client_version_sign", "DX5NIYLvfJEUjuIbCidnoeozxIDRRkpq3I9vVMBmE9L2qnekOoBzSenkzsg2lC9CMv8K5hkEzhr2TYUYSwUXCg=="],
+		["client_key_offset", String(client.crypt.identity.offset)],
+		["client_nickname_phonetic", ""],
+		["client_default_token", ""],
+		["hwid", hwid]
+	]);
+}
+//#endregion
+//#region src/notifications.ts
+function handleNotification(cmd, selfCLID, clients, _nickname) {
+	switch (cmd.name) {
+		case "notifycliententerview": return handleClientEnterView(cmd, clients);
+		case "notifyclientleftview": return handleClientLeftView(cmd, selfCLID, clients);
+		case "notifyclientmoved": return handleClientMoved(cmd, clients);
+		case "notifytextmessage": return handleTextMessage(cmd, clients);
+		case "notifyclientpoke": return handleClientPoked(cmd);
+		default: return { kind: "unknown" };
+	}
+}
+function handleClientEnterView(cmd, clients) {
+	const info = parseClient(cmd.params);
+	if (info.id === 0) return { kind: "unknown" };
+	clients.set(info.id, info);
+	return {
+		kind: "clientEnter",
+		info
+	};
+}
+function handleClientLeftView(cmd, selfCLID, clients) {
+	const clid = asClientID(parseUint16(cmd.params["clid"] ?? ""));
+	if (clid === 0) return { kind: "unknown" };
+	const isSelf = clid === selfCLID;
+	clients.delete(clid);
+	return {
+		kind: "clientLeave",
+		event: {
+			clientID: clid,
+			reason: parseInt10(cmd.params["reasonid"] ?? ""),
+			reasonMessage: cmd.params["reasonmsg"] ?? "",
+			invokerID: asClientID(parseUint16(cmd.params["invokerid"] ?? "")),
+			invokerName: cmd.params["invokername"] ?? "",
+			invokerUID: asUID(cmd.params["invokeruid"] ?? "")
+		},
+		isSelf
+	};
+}
+function handleClientMoved(cmd, clients) {
+	const clid = asClientID(parseUint16(cmd.params["clid"] ?? ""));
+	const ctid = asChannelID(parseUint64(cmd.params["ctid"] ?? ""));
+	if (clid === 0) return { kind: "unknown" };
+	const existing = clients.get(clid);
+	if (existing) clients.set(clid, {
+		...existing,
+		channelID: ctid
+	});
+	return {
+		kind: "clientMoved",
+		event: {
+			clientID: clid,
+			targetChannelID: ctid,
+			reason: parseInt10(cmd.params["reasonid"] ?? ""),
+			invokerID: asClientID(parseUint16(cmd.params["invokerid"] ?? "")),
+			invokerName: cmd.params["invokername"] ?? "",
+			invokerUID: asUID(cmd.params["invokeruid"] ?? "")
+		},
+		reasonMessage: cmd.params["reasonmsg"] ?? ""
+	};
+}
+function handleTextMessage(cmd, clients) {
+	const invokerID = asClientID(parseUint16(cmd.params["invokerid"] ?? ""));
+	const invokerInfo = clients.get(invokerID);
+	return {
+		kind: "textMessage",
+		message: {
+			targetMode: parseInt10(cmd.params["targetmode"] ?? ""),
+			targetID: asClientID(parseUint16(cmd.params["target"] ?? "")),
+			invokerID,
+			invokerName: cmd.params["invokername"] ?? "",
+			invokerUID: asUID(cmd.params["invokeruid"] ?? invokerInfo?.uid ?? ""),
+			message: cmd.params["msg"] ?? "",
+			invokerGroups: invokerInfo?.serverGroups ?? []
+		}
+	};
+}
+function handleClientPoked(cmd) {
+	return {
+		kind: "poked",
+		event: {
+			invokerID: asClientID(parseUint16(cmd.params["invokerid"] ?? "")),
+			invokerName: cmd.params["invokername"] ?? "",
+			invokerUID: asUID(cmd.params["invokeruid"] ?? ""),
+			message: cmd.params["msg"] ?? ""
+		}
+	};
+}
+//#endregion
+//#region src/throttle.ts
+/**
+* Token-bucket limiter for outbound TS3 commands.
+* Mirrors Go's commandThrottle.
+*
+* Waiters are released in the order they arrived: each used to poll for a
+* token on its own timer, so a command that came later could take the turn of
+* one that had waited longer, and the commands went out of order.
+*/
+var CommandThrottle = class CommandThrottle {
+	static TOKEN_RATE = 4;
+	static TOKEN_MAX = 8;
+	#tokens = 5;
+	#lastUpdate = Date.now();
+	#waiters = [];
+	#timer;
+	/**
+	* Wait for a token, behind every earlier waiter. Aborting `signal` rejects
+	* with its reason and gives the place in line up; the abort listener is
+	* removed however the wait ends.
+	*/
+	wait(signal) {
+		if (signal?.aborted) return Promise.reject(signal.reason);
+		this.#refill();
+		if (this.#waiters.length === 0 && this.#tokens >= 1) {
+			this.#tokens -= 1;
+			return Promise.resolve();
+		}
+		return new Promise((resolve, reject) => {
+			const waiter = {
+				resolve,
+				signal,
+				onAbort: () => {
+					const index = this.#waiters.indexOf(waiter);
+					if (index >= 0) this.#waiters.splice(index, 1);
+					if (this.#waiters.length === 0) this.#stopTimer();
+					reject(signal.reason);
+				}
+			};
+			signal?.addEventListener("abort", waiter.onAbort, { once: true });
+			this.#waiters.push(waiter);
+			this.#schedule();
+		});
+	}
+	#refill() {
+		const now = Date.now();
+		const elapsed = (now - this.#lastUpdate) / 1e3;
+		this.#tokens = Math.min(this.#tokens + elapsed * CommandThrottle.TOKEN_RATE, CommandThrottle.TOKEN_MAX);
+		this.#lastUpdate = now;
+	}
+	/** Arm the timer for when the next token is due, unless it already is. */
+	#schedule() {
+		if (this.#timer !== void 0 || this.#waiters.length === 0) return;
+		const waitMs = this.#tokens >= 1 ? 0 : Math.ceil((1 - this.#tokens) / CommandThrottle.TOKEN_RATE * 1e3) + 10;
+		this.#timer = setTimeout(() => {
+			this.#timer = void 0;
+			this.#release();
+		}, waitMs);
+	}
+	#stopTimer() {
+		clearTimeout(this.#timer);
+		this.#timer = void 0;
+	}
+	/** Hand the tokens there are to the waiters at the head of the line. */
+	#release() {
+		this.#refill();
+		while (this.#waiters.length > 0 && this.#tokens >= 1) {
+			this.#tokens -= 1;
+			const waiter = this.#waiters.shift();
+			waiter.signal?.removeEventListener("abort", waiter.onAbort);
+			waiter.resolve();
+		}
+		this.#schedule();
+	}
+};
+//#endregion
+//#region src/helpers.ts
+/**
+* Reports whether `actual` equals `expected` or equals `expected` followed by
+* only digits — the pattern TeamSpeak uses when a nickname is already taken.
+*/
+function isAutoNicknameMatch(expected, actual) {
+	if (actual === expected) return true;
+	if (!actual.startsWith(expected)) return false;
+	const suffix = actual.slice(expected.length);
+	return /^\d+$/.test(suffix);
+}
+//#endregion
+//#region src/diagnostics.ts
+/**
+* Diagnostics channels: the SDK's tracing points, for an application or an
+* APM agent (OpenTelemetry instruments `diagnostics_channel` directly) to
+* subscribe to.
+*
+* A library does not decide where its traces go, so the SDK publishes them
+* here, and with no subscriber a channel costs a property read.
+*
+* Messages carry the command's name, never its parameters: those hold
+* password hashes, which the server accepts as passwords, and privilege keys.
+*
+* ```ts
+* import { tracingChannel } from "node:diagnostics_channel";
+*
+* tracingChannel("honeybbq:teamspeak:command").subscribe({
+*   start: ({ command }) => console.time(command),
+*   asyncEnd: ({ command }) => console.timeEnd(command),
+*   error: ({ command, error }) => console.error(command, error),
+* });
+* ```
+*/
+/**
+* Traces every command with an answer: `start` when it is sent, `asyncEnd`
+* when its answer arrives, `error` when it fails.
+*/
+var commandChannel = tracingChannel("honeybbq:teamspeak:command");
+/** Publishes every command the server sends. */
+var packetChannel = channel("honeybbq:teamspeak:packet");
+//#endregion
+//#region src/reconnect.ts
+/**
+* Reconnection policy.
+*
+* A dropped connection is normal on a UDP voice session, so a bot that cannot
+* recover is not usable unattended. Reconnecting is opt-in rather than
+* automatic: a silent reconnect makes a dropped session look like a healthy
+* one, and a caller that wanted to know about the drop never finds out.
+*
+* Backoff is not a nicety here. TeamSpeak bans an IP that opens several
+* connections in quick succession — measured at roughly three, after which the
+* server answers `error id=3329` and refuses everything. A reconnect loop
+* without a delay therefore bans itself, and the ban outlasts the outage it was
+* recovering from.
+*/
+/** One second, doubling, capped at a minute, with 20% jitter, never giving up. */
+var defaultBackoffPolicy = Object.freeze({
+	initialDelayMs: 1e3,
+	maxDelayMs: 6e4,
+	factor: 2,
+	jitter: .2,
+	maxAttempts: 0
+});
+/**
+* Compute the delay before an attempt.
+*
+* `attempt` is 1-based: the delay before the first retry is `initialDelayMs`,
+* give or take the jitter, and the delay never grows past `maxDelayMs`.
+*/
+function backoffDelay(policy, attempt) {
+	return jitteredDelay(policy, attempt, Math.random);
+}
+/** @internal The delay, with `random` supplying the jitter. */
+function jitteredDelay(policy, attempt, random) {
+	const exponent = Math.max(0, attempt - 1);
+	const raw = policy.initialDelayMs * policy.factor ** exponent;
+	const capped = Math.min(raw, policy.maxDelayMs);
+	if (policy.jitter <= 0) return Math.round(capped);
+	const spread = capped * Math.min(policy.jitter, 1);
+	const delay = capped + (random() * 2 - 1) * spread;
+	return Math.round(Math.max(0, Math.min(delay, policy.maxDelayMs)));
+}
+/**
+* Server errors where retrying cannot help.
+*
+* Deliberately a short list of codes known to be refusals, rather than "any
+* ServerError". The server also answers transiently: after a dropped
+* connection it still holds the old session, and a reconnect with the same
+* identity is refused with 521 "too many clones already connected" until it
+* reaps the zombie — a condition that clears itself and is worth retrying.
+*
+* The asymmetry is deliberate. Retrying a permanent failure costs a few bounded
+* attempts; not retrying a transient one means never recovering.
+*/
+var PERMANENT_SERVER_ERRORS = /* @__PURE__ */ new Set([
+	ErrorCode.ConnectFailedBanned,
+	ErrorCode.BanFlooding,
+	ErrorCode.ServerInvalidPassword,
+	ErrorCode.ChannelInvalidPassword,
+	ErrorCode.PermissionsClientInsufficient
+]);
+/**
+* Whether a failure is worth another attempt.
+*
+* Transport failures are retried; so is a server that stopped, and a server
+* error other than the known refusals — a ban, flooding, a wrong server or
+* channel password, missing permissions — since some, such as 521 "too many
+* clones" right after a drop, clear by themselves. A kick or a ban is not:
+* someone removed the client on purpose. Nor is an AlreadyConnectedError: the
+* client was connected by other means; nor an InvalidAddressError.
+*/
+function defaultShouldRetry(error) {
+	if (error instanceof AlreadyConnectedError) return false;
+	if (error instanceof InvalidAddressError) return false;
+	if (error instanceof RemovedError) return error.reason !== Reason.KickServer && error.reason !== Reason.KickServerBan;
+	return !(error instanceof ServerError && PERMANENT_SERVER_ERRORS.has(error.code));
+}
+function resolveBackoffPolicy(options) {
+	const policy = { ...defaultBackoffPolicy };
+	for (const [key, value] of Object.entries(options.backoff ?? {})) if (value !== void 0) policy[key] = value;
+	return policy;
+}
+//#endregion
+//#region src/client.ts
+function normalizeClientInitOptions(options) {
+	return {
+		serverPasswordHash: prepareClientPassword(options.serverPassword ?? ""),
+		defaultChannel: options.defaultChannel ?? "",
+		defaultChannelPasswordHash: prepareClientPassword(options.defaultChannelPassword ?? "")
+	};
+}
+/** How long a command waits for its answer unless told otherwise. */
+var DEFAULT_COMMAND_TIMEOUT_MS = 1e4;
+/**
+* How long `disconnect()` waits for the server to acknowledge its goodbye
+* unless told otherwise: the acknowledgement is a courtesy, and a connection
+* that has already died would otherwise hold it for a full command timeout.
+*/
+var DISCONNECT_TIMEOUT_MS = 1e3;
+/** How long each reconnection attempt may take. */
+var RECONNECT_ATTEMPT_TIMEOUT_MS = 3e4;
+function newConnectAttempt() {
+	let resolve;
+	let reject;
+	const promise = new Promise((res, rej) => {
+		resolve = res;
+		reject = rej;
+	});
+	promise.catch(() => {});
+	const controller = new AbortController();
+	const attempt = {
+		promise,
+		signal: controller.signal,
+		settled: false,
+		resolve() {
+			if (attempt.settled) return;
+			attempt.settled = true;
+			resolve();
+		},
+		reject(error) {
+			if (attempt.settled) return;
+			attempt.settled = true;
+			controller.abort(error);
+			reject(error);
+		},
+		rejectAfter(error, until) {
+			if (attempt.settled) return;
+			attempt.settled = true;
+			controller.abort(error);
+			until.finally(() => reject(error));
+		}
+	};
+	return attempt;
+}
+/**
+* Voice deliveries are dropped while more than this many deliveries of any
+* kind are waiting: audio is fifty packets a second per speaker, and a
+* listener that cannot keep up would otherwise queue it without bound.
+*/
+var MAX_PENDING_DELIVERIES = 256;
+/** How often dropped voice is reported, at most. */
+var VOICE_DROP_WARN_INTERVAL_MS = 1e4;
+/** The only commands handled before crypto init completes. */
+var PRE_INIT_COMMANDS = /* @__PURE__ */ new Set([
+	"clientinitiv",
+	"initivexpand2",
+	"error"
+]);
+/**
+* A TeamSpeak client over the voice protocol.
+*
+* Listeners run one at a time, in the order their events arrived, after the
+* packet that carried them has been handled, so a listener may call the client
+* and await an answer.
+*/
+var Client = class {
+	static {}
+	#crypt;
+	#handler;
+	#logger;
+	#nickname;
+	#clid = 0;
+	/**
+	* What the server reported about itself in initserver, including the UID
+	* hash it uses: TS3 hashes the public key with SHA-1 and TS6 with SHA-256.
+	*/
+	#capabilities = unknownServerCapabilities();
+	#internals;
+	#identity;
+	#addr;
+	#resolver;
+	#clientInitOptions;
+	#socketFactory;
+	#fileTransferSocketFactory;
+	/** Undefined when the client does not reconnect. */
+	#reconnectOptions;
+	/**
+	* Set while a reconnect attempt is in flight, so overlapping failures do not
+	* start competing loops.
+	*/
+	#reconnecting = false;
+	/**
+	* Why the last established session dropped: a reconnect loop whose own
+	* attempt connected and then dropped before the loop resumed retries for it.
+	*/
+	#lastDrop;
+	/** Set by an explicit disconnect(), which must never be undone by a retry. */
+	#stopped = false;
+	/**
+	* The goodbye of a disconnect() still in progress, which a connect() waits
+	* for: tearing the old session down after a new one has started would end
+	* the new one instead.
+	*/
+	#leaving;
+	/** How many times disconnect() was called, so a waiting connect() sees one. */
+	#disconnects = 0;
+	/**
+	* Settles once the last queued `disconnected` has been delivered. A
+	* connect() waits for it, so the end of one session is never heard during
+	* the next: not by a listener added for the new session, and not by an
+	* events() iterator started for it.
+	*/
+	#disconnectedDelivered;
+	/** Cuts short the reconnect loop's wait, on disconnect(). */
+	#stopReconnecting;
+	#status = ClientStatus.Disconnected;
+	#throttle = new CommandThrottle();
+	#cmdTrack = new CommandTracker(() => this.#clid);
+	#clients = /* @__PURE__ */ new Map();
+	#attempt = newConnectAttempt();
+	#listeners = /* @__PURE__ */ new Map();
+	/** Deliveries waiting for their turn; see #emit. */
+	#queue = [];
+	#draining = false;
+	#voiceDropped = 0;
+	#voiceDropWarnedAt = -Infinity;
+	#eventMiddlewares;
+	#send;
+	#eventChain;
+	constructor(identity, addr, nickname, options = {}) {
+		this.#identity = identity;
+		this.#addr = addr;
+		this.#nickname = nickname;
+		this.#logger = options.logger ?? noopLogger;
+		this.#resolver = options.resolver ?? new Resolver({ resolveNicknames: options.resolveNicknames });
+		this.#clientInitOptions = normalizeClientInitOptions(options);
+		this.#socketFactory = options.socketFactory;
+		this.#fileTransferSocketFactory = options.fileTransferSocketFactory;
+		this.#reconnectOptions = options.reconnect;
+		this.#crypt = new Crypt(identity);
+		this.#handler = this.#newHandler();
+		const self = this;
+		this.#internals = {
+			get crypt() {
+				return self.#crypt;
+			},
+			get handler() {
+				return self.#handler;
+			},
+			get logger() {
+				return self.#logger;
+			},
+			get initOptions() {
+				return self.#clientInitOptions;
+			},
+			get nickname() {
+				return self.#nickname;
+			},
+			set nickname(value) {
+				self.#nickname = value;
+			},
+			get clid() {
+				return self.#clid;
+			},
+			set clid(value) {
+				self.#clid = value;
+			},
+			get capabilities() {
+				return self.#capabilities;
+			},
+			set capabilities(value) {
+				self.#capabilities = value;
+			},
+			markConnected: () => this.#markConnected(),
+			execNoWait: (command) => this.#execNoWait(command, void 0, true),
+			handlePacket: (packet) => this.#handlePacket(packet)
+		};
+		const cmdMiddlewares = options.commandMiddleware ?? [];
+		this.#eventMiddlewares = options.eventMiddleware ?? [];
+		this.#send = buildCommandChain(cmdMiddlewares, (request, commandOptions = {}) => this.#exec(encodeRequest(request, prepareClientPassword), commandOptions, false));
+		this.#eventChain = buildEventChain([...this.#eventMiddlewares], (event) => this.#deliver(event.name, event.payload));
+	}
+	/** Where the client is in its connection's life. */
+	get status() {
+		return this.#status;
+	}
+	/**
+	* Connect to the server. Resolves once the handshake completes.
+	*
+	* An address that cannot be one — no host, a port outside 1–65535 — rejects
+	* with an InvalidAddressError at once, before anything starts. A host name
+	* that does not resolve fails the attempt with a TeamspeakError whose
+	* `cause` is the lookup's error.
+	*
+	* A failed attempt rejects with its cause, such as the server's error for a
+	* rejected password. Aborting `signal` abandons the attempt and rejects with
+	* the signal's reason. The signal bounds only the connecting: once this
+	* resolves, the connection lasts until `disconnect()` or a drop.
+	* `connect()` does not retry; the `reconnect` option only retries a
+	* connection that drops after it was established.
+	*
+	* Called while a `disconnect()` is still saying goodbye, or while an earlier
+	* session's `disconnected` is still waiting to be delivered, this waits for
+	* that first, so the old session is closed, and its `disconnected`
+	* delivered, before the new one starts: no listener or `events()` iterator
+	* of the new session hears the old one end. A `disconnect()` called during
+	* that wait wins: this then rejects with a NotConnectedError.
+	*
+	* `connected` is delivered after this resolves, so a listener added right
+	* after `await client.connect()` still hears it.
+	*/
+	async connect(options = {}) {
+		const { signal } = options;
+		signal?.throwIfAborted();
+		const disconnects = this.#disconnects;
+		if (this.#leaving !== void 0) await abortable(this.#leaving, signal);
+		while (this.#disconnectedDelivered !== void 0) await abortable(this.#disconnectedDelivered, signal);
+		if (this.#disconnects !== disconnects) throw new NotConnectedError();
+		if (this.#status !== ClientStatus.Disconnected) throw new AlreadyConnectedError();
+		parseConnectAddress(this.#addr);
+		this.#stopped = false;
+		this.#resetForConnect();
+		this.#status = ClientStatus.Connecting;
+		const attempt = this.#attempt;
+		const onAbort = () => this.#failConnection(abortReason(signal));
+		signal?.addEventListener("abort", onAbort, { once: true });
+		try {
+			try {
+				const targetAddr = await this.#resolveAddr(attempt.signal);
+				if (!attempt.settled) {
+					this.#logger.info("connecting to server", { address: targetAddr });
+					await this.#handler.connect(targetAddr, attempt.signal);
+				}
+			} catch (error) {
+				this.#failConnection(error);
+			}
+			await attempt.promise;
+		} finally {
+			signal?.removeEventListener("abort", onAbort);
+		}
+	}
+	/**
+	* Leave the server and close the connection.
+	*
+	* Says goodbye first, waiting for the server's acknowledgement for a second
+	* at most, or less if `signal` aborts sooner. The connection is closed
+	* either way. A `connect()` still waiting for its handshake rejects with a
+	* NotConnectedError, and so do the commands still waiting for an answer.
+	* Resolves once `disconnected` has been delivered to the listeners, so one
+	* added after `await client.disconnect()` does not hear it. Does nothing on
+	* a client that is not connected; called again while an earlier call is
+	* still saying goodbye, it waits for that one.
+	*/
+	async disconnect(options = {}) {
+		this.#stopped = true;
+		this.#disconnects++;
+		this.#stopReconnecting?.abort();
+		if (this.#leaving !== void 0) return this.#leaving;
+		if (this.#status === ClientStatus.Disconnected) return this.#disconnectedDelivered;
+		const wasConnected = this.#status === ClientStatus.Connected;
+		this.#status = ClientStatus.Disconnected;
+		let left;
+		this.#attempt.rejectAfter(new NotConnectedError(), new Promise((r) => left = r));
+		const leaving = this.#leave(wasConnected, options.signal).finally(left);
+		this.#leaving = leaving;
+		try {
+			await leaving;
+		} finally {
+			this.#leaving = void 0;
+		}
+	}
+	async #leave(wasConnected, signal) {
+		this.#logger.info("disconnecting from server");
+		if (wasConnected) try {
+			await this.#exec("clientdisconnect reasonmsg=Shutdown", {
+				signal,
+				timeout: DISCONNECT_TIMEOUT_MS
+			}, true);
+		} catch {}
+		this.#handler.close();
+		this.#cmdTrack.reset(new NotConnectedError());
+		await this.#announceDisconnected(void 0);
+	}
+	/** `await using client = …` disconnects when the scope ends. */
+	[Symbol.asyncDispose]() {
+		return this.disconnect();
+	}
+	/**
+	* Send a raw command line and return the rows that answer it: the escape
+	* hatch for a command the typed functions do not cover. The line is sent as
+	* given, so its values must already be escaped and any channel password
+	* already hashed.
+	*
+	* Rejects with a NotConnectedError unless the client is connected: while it
+	* is still connecting, the session's keys may not exist yet.
+	*/
+	exec(command, options = {}) {
+		return this.#exec(command, options, false);
+	}
+	/**
+	* Send a raw command line without waiting for an answer, for the few
+	* commands the server answers with nothing at all.
+	*
+	* Commands are paced by a flood throttle; aborting `signal` while this waits
+	* for its turn rejects with the signal's reason and sends nothing. Rejects
+	* with a NotConnectedError unless the client is connected.
+	*/
+	execNoWait(command, options = {}) {
+		return this.#execNoWait(command, options.signal, false);
+	}
+	/**
+	* Whether a command may go out now. The handshake's own commands (`internal`)
+	* need only an open socket; everything else needs a connected session, so
+	* nothing a caller sends can go out under the public dummy key, or after
+	* disconnect() has begun saying goodbye.
+	*/
+	#canSend(internal) {
+		return this.#handler.isOpen && (internal || this.#status === ClientStatus.Connected);
+	}
+	async #execNoWait(command, signal, internal) {
+		signal?.throwIfAborted();
+		if (!this.#canSend(internal)) throw new NotConnectedError();
+		await this.#throttle.wait(signal);
+		if (!this.#canSend(internal)) throw new NotConnectedError();
+		this.#sendLine(command);
+	}
+	/**
+	* Send a typed command; this is the CommandExecutor the typed commands run on.
+	*
+	* The request passes through the `commandMiddleware` first. Channel
+	* passwords are then hashed, because that is this protocol's rule: the voice
+	* protocol expects `base64(sha1(password))`, where ServerQuery takes the
+	* password itself.
+	*/
+	send(request, options = {}) {
+		return this.#send(request, options);
+	}
+	#sendLine(line) {
+		this.#handler.sendPacket(PacketType.Command, Buffer.from(line), 0);
+	}
+	#exec(command, options, internal) {
+		if (!commandChannel.hasSubscribers) return this.#execUntraced(command, options, internal);
+		const trace = {
+			command: parseCommand(command)?.name ?? "",
+			client: this
+		};
+		return commandChannel.tracePromise(() => this.#execUntraced(command, options, internal), trace);
+	}
+	async #execUntraced(command, options, internal) {
+		const { signal, timeout = DEFAULT_COMMAND_TIMEOUT_MS } = options;
+		signal?.throwIfAborted();
+		if (!this.#canSend(internal)) throw new NotConnectedError();
+		const parsed = parseCommand(command);
+		const spec = responseSpec(parsed?.name ?? "");
+		const key = spec?.correlated?.key;
+		const correlation = key === void 0 ? void 0 : parsed?.params[key];
+		const [rc, answered] = this.#cmdTrack.register(spec, correlation);
+		let timer;
+		let onAbort;
+		const givenUp = new Promise((_, reject) => {
+			timer = setTimeout(() => reject(new CommandTimeoutError(parsed?.name ?? "")), timeout);
+			onAbort = () => reject(abortReason(signal));
+			signal?.addEventListener("abort", onAbort, { once: true });
+		});
+		givenUp.catch(() => {});
+		const throttleAbort = new AbortController();
+		try {
+			const withRc = appendReturnCode(command, rc);
+			await Promise.race([this.#throttle.wait(throttleAbort.signal), givenUp]);
+			if (!this.#canSend(internal)) throw new NotConnectedError();
+			this.#sendLine(withRc);
+			const result = await Promise.race([answered, givenUp]);
+			if (result.err) throw result.err;
+			return result.data;
+		} finally {
+			throttleAbort.abort();
+			clearTimeout(timer);
+			if (onAbort) signal?.removeEventListener("abort", onAbort);
+			this.#cmdTrack.unregister(rc);
+		}
+	}
+	/**
+	* Listen for an event. Returns a function that removes the listener.
+	*
+	* A listener that throws does not stop the others: the rest of the event's
+	* listeners, and the events after it, are still delivered, and the exception
+	* is rethrown on its own, from a microtask, so it surfaces as an
+	* `uncaughtException` just as an EventEmitter listener's would. An async
+	* listener's rejection is not caught, and surfaces as an unhandled
+	* rejection.
+	*/
+	on(event, listener) {
+		const subscription = {
+			listener,
+			removed: false
+		};
+		this.#listeners.set(event, [...this.#listeners.get(event) ?? [], subscription]);
+		const unsubscribe = () => {
+			if (subscription.removed) return;
+			subscription.removed = true;
+			const list = this.#listeners.get(event) ?? [];
+			this.#listeners.set(event, list.filter((s) => s !== subscription));
+		};
+		return Object.assign(unsubscribe, { [Symbol.dispose]: unsubscribe });
+	}
+	/** Listen for the next occurrence of an event only. */
+	once(event, listener) {
+		const unsubscribe = this.on(event, ((payload) => {
+			unsubscribe();
+			listener(payload);
+		}));
+		return unsubscribe;
+	}
+	/**
+	* An event as an async iterator, for `for await`:
+	*
+	* ```ts
+	* for await (const message of client.events("textMessage", { signal })) { … }
+	* ```
+	*
+	* Events that arrive while the loop body runs are buffered, so none is
+	* missed — except voice, of which at most 256 frames are buffered; the rest
+	* are dropped, as for a listener that falls behind. Iteration ends when
+	* `signal` aborts, when the loop exits early (`break`, `return`, a throw),
+	* and — for every event but `disconnected` — when the client disconnects.
+	* An abort stops listening at once and discards whatever is buffered.
+	*/
+	events(event, options = {}) {
+		const { signal } = options;
+		const buffered = [];
+		let wake;
+		let ended = false;
+		const stopListening = this.on(event, ((payload) => {
+			if (ended) return;
+			if (event === "voiceData" && buffered.length >= MAX_PENDING_DELIVERIES) {
+				this.#dropVoice();
+				return;
+			}
+			buffered.push(payload);
+			wake?.();
+		}));
+		const stopOnDisconnect = event === "disconnected" ? void 0 : this.on("disconnected", () => {
+			ended = true;
+			stopListening();
+			wake?.();
+		});
+		const cleanup = () => {
+			ended = true;
+			stopListening();
+			stopOnDisconnect?.();
+			signal?.removeEventListener("abort", abort);
+			wake?.();
+		};
+		const abort = () => {
+			buffered.length = 0;
+			cleanup();
+		};
+		if (signal?.aborted) abort();
+		else signal?.addEventListener("abort", abort, { once: true });
+		const iterator = {
+			async next() {
+				while (buffered.length === 0 && !ended) {
+					await new Promise((resolve) => wake = resolve);
+					wake = void 0;
+				}
+				if (buffered.length > 0) return {
+					value: buffered.shift(),
+					done: false
+				};
+				cleanup();
+				return {
+					value: void 0,
+					done: true
+				};
+			},
+			async return() {
+				buffered.length = 0;
+				cleanup();
+				return {
+					value: void 0,
+					done: true
+				};
+			},
+			[Symbol.asyncIterator]() {
+				return iterator;
+			}
+		};
+		return iterator;
+	}
+	/** This client's id on the server, assigned in the handshake; 0 before it. */
+	get clientID() {
+		return asClientID(this.#clid);
+	}
+	/**
+	* What the connected server is: version, generation, and the uid hash it
+	* uses. Read from `initserver`; before connecting the family is `unknown`
+	* and the uid hash SHA-1.
+	*/
+	get serverCapabilities() {
+		return this.#capabilities;
+	}
+	/**
+	* Our own `client_unique_identifier`, hashed with the algorithm the connected
+	* server uses.
+	*
+	* TS3 uses SHA-1 and TS6 SHA-256, so this reads the algorithm learned during
+	* initserver rather than assuming one. Comparing a hard-coded SHA-1 UID to a
+	* TS6 server silently never matches.
+	*/
+	get uid() {
+		return this.#identity.uid(this.#capabilities.uidAlgorithm);
+	}
+	/** The channel this client is in, as it last learned; 0 before connecting. */
+	get channelID() {
+		return this.#clients.get(this.#clid)?.channelID ?? asChannelID(0n);
+	}
+	/**
+	* Send Opus voice directly to specific clients, bypassing channel routing.
+	* Throws a NotConnectedError unless the client is connected.
+	*/
+	sendWhisper(data, targetClientIDs, codec) {
+		if (!this.#canSend(false)) throw new NotConnectedError();
+		this.#handler.sendWhisperPacket(data, [...targetClientIDs], codec);
+	}
+	/**
+	* Send one encoded audio frame to the channel this client is in. Throws a
+	* NotConnectedError unless the client is connected.
+	*/
+	sendVoice(data, codec) {
+		if (!this.#canSend(false)) throw new NotConnectedError();
+		this.#handler.sendVoicePacket(data, codec);
+	}
+	/**
+	* Upload `data` over a negotiated transfer, through the client's
+	* `fileTransferSocketFactory` if it has one.
+	*/
+	uploadFileData(host, info, data, options = {}) {
+		return uploadFileData(host, info, data, {
+			...options,
+			socketFactory: this.#fileTransferSocketFactory
+		});
+	}
+	/**
+	* Download a negotiated transfer into `dest`, through the client's
+	* `fileTransferSocketFactory` if it has one.
+	*/
+	downloadFileData(host, info, dest, options = {}) {
+		return downloadFileData(host, info, dest, {
+			...options,
+			socketFactory: this.#fileTransferSocketFactory
+		});
+	}
+	#markConnected() {
+		if (this.#status !== ClientStatus.Connecting || this.#attempt.settled) return;
+		this.#status = ClientStatus.Connected;
+		this.#attempt.resolve();
+		this.#emit("connected", void 0);
+	}
+	#newHandler() {
+		const handler = new PacketHandler(this.#crypt, this.#logger, this.#socketFactory);
+		handler.onPacket = (p) => {
+			if (handler === this.#handler) this.#handlePacket(p);
+		};
+		handler.onClosed = (err) => {
+			if (handler === this.#handler) this.#handleConnectionClosed(err);
+		};
+		handler.onReceiveError = (error) => {
+			if (handler === this.#handler) this.#handleReceiveError(error);
+		};
+		return handler;
+	}
+	#resetForConnect() {
+		this.#handler.close();
+		this.#crypt = new Crypt(this.#identity);
+		this.#handler = this.#newHandler();
+		this.#attempt = newConnectAttempt();
+		this.#cmdTrack.reset(new NotConnectedError());
+		this.#clients.clear();
+		this.#clid = 0;
+		this.#capabilities = unknownServerCapabilities();
+	}
+	async #resolveAddr(signal) {
+		const { host, port } = splitHostPort(this.#addr);
+		const fallback = joinHostPort(host, port);
+		const budget = new AbortController();
+		const timer = setTimeout(() => budget.abort(new TeamspeakError("address resolution took too long")), RESOLVE_BUDGET_MS);
+		const lookup = AbortSignal.any([signal, budget.signal]);
+		try {
+			return (await abortable(this.#resolver.resolve(this.#addr, { signal: lookup }), lookup))[0]?.addr ?? fallback;
+		} catch (error) {
+			signal.throwIfAborted();
+			this.#logger.warn("address resolution failed, falling back to direct", { error: String(budget.signal.aborted ? budget.signal.reason : error) });
+			return fallback;
+		} finally {
+			clearTimeout(timer);
+		}
+	}
+	/**
+	* A datagram from the server could not be handled. During the handshake that
+	* is the connection failing, reported as a CryptoInitError with the cause;
+	* once connected, one bad packet is not worth the session, so it is dropped.
+	*/
+	#handleReceiveError(error) {
+		if (this.#status !== ClientStatus.Connected) {
+			this.#failConnection(error instanceof CryptoInitError ? error : new CryptoInitError("the handshake failed on a malformed packet", { cause: error }));
+			return;
+		}
+		this.#logger.debug("dropped a malformed packet", { error: String(error) });
+	}
+	#handlePacket(p) {
+		const pType = p.typeFlagged & 15;
+		if (pType === 8) {
+			if (this.#crypt.cryptoInitComplete) return;
+			const response = processInit1(this.#crypt, p.data);
+			if (response) this.#handler.sendPacket(PacketType.Init1, response, 0);
+			return;
+		}
+		if ((pType === 0 || pType === 1) && p.data.length > 5) {
+			this.#handleVoicePacket(p.data);
+			return;
+		}
+		if ((pType === 2 || pType === 3) && p.data.length > 0) this.#handleCommandLines(Buffer.from(p.data).toString("utf8"));
+	}
+	/**
+	* Parse an incoming S2C voice packet.
+	* Format: [VId: u16] [CId: u16] [Codec: u8] [Data: var]
+	*/
+	#handleVoicePacket(payload) {
+		if (!this.#listeners.get("voiceData")?.length && this.#eventMiddlewares.length === 0) return;
+		if (this.#queue.length > MAX_PENDING_DELIVERIES) {
+			this.#dropVoice();
+			return;
+		}
+		const clientId = new DataView(payload.buffer, payload.byteOffset, payload.byteLength).getUint16(2, false);
+		if (clientId === this.#clid) return;
+		const data = payload.slice(5);
+		this.#emitServerEvent({
+			name: "voiceData",
+			payload: {
+				clientID: asClientID(clientId),
+				codec: payload[4],
+				data
+			}
+		});
+	}
+	#handleCommandLines(s) {
+		if (!s) return;
+		const lines = s.split("\0").join("\n").split("\n");
+		for (const line of lines) {
+			const trimmed = line.replace(/\r$/, "");
+			if (!trimmed) continue;
+			for (const row of splitCommandRows(trimmed)) this.#handleCommandStr(row);
+		}
+	}
+	#handleCommandStr(s) {
+		const cmd = parseCommand(s);
+		if (!cmd) return;
+		if (!this.#crypt.cryptoInitComplete && !PRE_INIT_COMMANDS.has(cmd.name)) {
+			this.#logger.debug("dropped a command that arrived before crypto init", { command: cmd.name });
+			return;
+		}
+		if (packetChannel.hasSubscribers) packetChannel.publish({
+			command: cmd.name,
+			client: this
+		});
+		if (cmd.name === "") {
+			if (Object.keys(cmd.params).length > 0) this.#cmdTrack.buffer(cmd.params);
+			return;
+		}
+		if (cmd.name === "channellistfinished") {
+			this.#cmdTrack.signalWelcomeComplete();
+			return;
+		}
+		if (cmd.name.startsWith("notify")) {
+			if (this.#cmdTrack.expects(cmd.name)) {
+				this.#cmdTrack.buffer(cmd.params, cmd.name);
+				this.#cmdTrack.offerCorrelated(cmd.name, cmd.params);
+			}
+			const result = handleNotification(cmd, this.#clid, this.#clients, this.#nickname);
+			this.#processNotificationResult(result);
+			if (this.#listeners.get("notification")?.length || this.#eventMiddlewares.length > 0) this.#emitServerEvent({
+				name: "notification",
+				payload: {
+					name: cmd.name,
+					params: { ...cmd.params }
+				}
+			});
+			return;
+		}
+		switch (cmd.name) {
+			case "clientinitiv":
+				if (!this.#crypt.cryptoInitComplete) handleHandshakeInitIV(this.#internals, cmd.params);
+				break;
+			case "initivexpand2":
+				if (!this.#crypt.cryptoInitComplete) handleHandshakeExpand2(this.#internals, cmd.params);
+				break;
+			case "initserver":
+				if (this.#status === ClientStatus.Connecting && this.#crypt.cryptoInitComplete) handleInitServer(this.#internals, cmd.params);
+				break;
+			case "error":
+				this.#handleError(cmd.params);
+				break;
+			default: this.#cmdTrack.buffer(cmd.params, cmd.name);
+		}
+	}
+	#handleError(params) {
+		const { err, rc } = parseServerError(params);
+		if (rc !== null) this.#cmdTrack.resolve(rc, err);
+		else this.#cmdTrack.discardBuffer();
+		if (err && this.#status !== ClientStatus.Connected) {
+			this.#failConnection(err);
+			return;
+		}
+		if (err?.code === ErrorCode.ConnectFailedBanned) {
+			this.#logger.warn("banned by the server, closing the connection");
+			setImmediate(() => this.disconnect().catch(() => {}));
+		}
+	}
+	#processNotificationResult(result) {
+		switch (result.kind) {
+			case "clientEnter": {
+				const info = result.info;
+				if (info.id === this.#clid) this.#nickname = info.nickname;
+				else if (this.#clid === 0 && isAutoNicknameMatch(this.#nickname, info.nickname)) {
+					this.#clid = info.id;
+					this.#handler.setClientID(info.id);
+					this.#nickname = info.nickname;
+				}
+				this.#emitServerEvent({
+					name: "clientEnter",
+					payload: info
+				});
+				break;
+			}
+			case "clientLeave": {
+				const event = result.event;
+				this.#emitServerEvent({
+					name: "clientLeave",
+					payload: event
+				});
+				if (!result.isSelf) break;
+				if (event.reason === Reason.KickServer || event.reason === Reason.KickServerBan) this.#emit("kicked", kickedEvent(event));
+				this.#removedByServer(new RemovedError(event.reason, event.reasonMessage, event.invokerName));
+				break;
+			}
+			case "clientMoved":
+				this.#emitServerEvent({
+					name: "clientMoved",
+					payload: result.event
+				});
+				if (result.event.clientID === this.#clid && result.event.reason === Reason.KickChannel) this.#emit("kicked", kickedEvent({
+					...result.event,
+					reasonMessage: result.reasonMessage
+				}));
+				break;
+			case "textMessage":
+				this.#emitServerEvent({
+					name: "textMessage",
+					payload: result.message
+				});
+				break;
+			case "poked": this.#emitServerEvent({
+				name: "poked",
+				payload: result.event
+			});
+		}
+	}
+	/**
+	* End a session the server has ended. The server stops answering a client it
+	* has removed, so waiting for the transport to notice reported the end a
+	* minute late, without its cause, and with the client claiming to be
+	* connected meanwhile.
+	*/
+	#removedByServer(cause) {
+		this.#handleConnectionClosed(cause);
+		this.#handler.close();
+	}
+	/**
+	* Count a dropped voice delivery, and report the drops now and then: at most
+	* once every ten seconds, with how many were dropped since the last report.
+	*/
+	#dropVoice() {
+		this.#voiceDropped++;
+		const now = Date.now();
+		if (now - this.#voiceDropWarnedAt < VOICE_DROP_WARN_INTERVAL_MS) return;
+		this.#voiceDropWarnedAt = now;
+		this.#logger.warn("voice dropped: listeners are not keeping up", { dropped: this.#voiceDropped });
+		this.#voiceDropped = 0;
+	}
+	/** Queue a server event, through the event middleware. */
+	#emitServerEvent(event) {
+		this.#enqueue(() => this.#eventChain(event));
+	}
+	/**
+	* Queue `disconnected`; the promise settles once it has been delivered, and
+	* a connect() waits for it until then.
+	*/
+	#announceDisconnected(cause) {
+		const delivered = new Promise((resolve) => this.#enqueue(() => {
+			try {
+				this.#deliver("disconnected", cause);
+			} finally {
+				resolve();
+			}
+		}));
+		this.#disconnectedDelivered = delivered;
+		delivered.then(() => {
+			if (this.#disconnectedDelivered === delivered) this.#disconnectedDelivered = void 0;
+		});
+		return delivered;
+	}
+	/** Queue a lifecycle event, which middleware does not see. */
+	#emit(event, payload) {
+		this.#enqueue(() => this.#deliver(event, payload));
+	}
+	#deliver(event, payload) {
+		for (const subscription of this.#listeners.get(event) ?? []) {
+			if (subscription.removed) continue;
+			try {
+				subscription.listener(payload);
+			} catch (error) {
+				queueMicrotask(() => {
+					throw error;
+				});
+			}
+		}
+	}
+	/**
+	* Run deliveries one at a time, in order, once the packet being handled is
+	* done with. A listener that throws does so as an uncaught exception, as it
+	* would from an EventEmitter, and the listeners and deliveries behind it
+	* still run.
+	*/
+	#enqueue(delivery) {
+		this.#queue.push(delivery);
+		if (this.#draining) return;
+		this.#draining = true;
+		setImmediate(this.#drain);
+	}
+	#drain = () => {
+		try {
+			while (this.#queue.length > 0) this.#queue.shift()();
+		} finally {
+			if (this.#queue.length > 0) setImmediate(this.#drain);
+			else this.#draining = false;
+		}
+	};
+	#handleConnectionClosed(err) {
+		if (this.#status === ClientStatus.Disconnected) return;
+		this.#cmdTrack.reset(new NotConnectedError(err ? { cause: err } : void 0));
+		if (this.#status !== ClientStatus.Connected) {
+			this.#failConnection(err ?? new TeamspeakError("connection closed before the TeamSpeak handshake completed"));
+			return;
+		}
+		this.#status = ClientStatus.Disconnected;
+		const cause = err ?? new TeamspeakError("connection closed");
+		this.#lastDrop = cause;
+		this.#announceDisconnected(cause);
+		this.#scheduleReconnect(cause).catch((error) => {
+			this.#logger.error("reconnecting failed", { error: String(error) });
+		});
+	}
+	/**
+	* Retry a dropped connection according to the reconnect policy.
+	*
+	* Never runs after an explicit disconnect, and never more than one at a time:
+	* two failures in quick succession would otherwise start competing loops, and
+	* a loop shorter than the server's antiflood window bans the IP rather than
+	* reconnecting it. A drop while the loop runs is the loop's to retry: it
+	* ends only once its attempt is still connected when it resumes.
+	*/
+	async #scheduleReconnect(err) {
+		const options = this.#reconnectOptions;
+		if (options === void 0 || this.#stopped || this.#reconnecting) return;
+		const policy = resolveBackoffPolicy(options);
+		const shouldRetry = options.shouldRetry ?? defaultShouldRetry;
+		this.#reconnecting = true;
+		const stop = new AbortController();
+		this.#stopReconnecting = stop;
+		try {
+			for (let attempt = 1; policy.maxAttempts === 0 || attempt <= policy.maxAttempts; attempt++) {
+				if (this.#stopped) return;
+				let retry;
+				try {
+					retry = shouldRetry(err, attempt);
+				} catch (error) {
+					this.#logger.error("shouldRetry threw; not reconnecting", { error: String(error) });
+					return;
+				}
+				if (!retry) {
+					this.#logger.info("not retrying", {
+						attempt,
+						reason: err.message
+					});
+					return;
+				}
+				const delay = backoffDelay(policy, attempt);
+				this.#logger.info("reconnecting", {
+					attempt,
+					delayMs: delay
+				});
+				await sleep(delay, stop.signal);
+				if (this.#stopped) return;
+				if (this.#status !== ClientStatus.Disconnected) {
+					this.#logger.info("reconnect loop ended: connected by other means", { attempt });
+					return;
+				}
+				try {
+					await this.connect({ signal: AbortSignal.timeout(RECONNECT_ATTEMPT_TIMEOUT_MS) });
+					if (this.status === ClientStatus.Connected) {
+						this.#logger.info("reconnected", { attempt });
+						return;
+					}
+					err = this.#lastDrop ?? new TeamspeakError("connection closed");
+				} catch (retryErr) {
+					if (retryErr instanceof AlreadyConnectedError) return;
+					err = retryErr instanceof Error ? retryErr : new TeamspeakError(String(retryErr));
+				}
+			}
+			this.#logger.warn("reconnect attempts exhausted", { attempts: policy.maxAttempts });
+		} finally {
+			this.#reconnecting = false;
+			if (this.#stopReconnecting === stop) this.#stopReconnecting = void 0;
+		}
+	}
+	/**
+	* A connection attempt has failed for good: settle it with the cause, and
+	* tear the connection down. Does nothing once the handshake has completed,
+	* so it cannot end a live session.
+	*
+	* Without this, a handshake the server rejects (a wrong password, say, which
+	* the server answers with an error instead of closing the socket) surfaces
+	* only as the caller's own timeout, and the client stays in `Connecting`
+	* forever without ever emitting `disconnected`.
+	*/
+	#failConnection(error) {
+		if (this.#status === ClientStatus.Connected) return;
+		this.#attempt.reject(error);
+		if (this.#status === ClientStatus.Disconnected) return;
+		this.#status = ClientStatus.Disconnected;
+		this.#handler.close();
+		this.#announceDisconnected(error instanceof Error ? error : new TeamspeakError(String(error)));
+	}
+};
+function kickedEvent(event) {
+	return {
+		reason: event.reason,
+		reasonMessage: event.reasonMessage,
+		invokerName: event.invokerName,
+		invokerUID: event.invokerUID,
+		invokerID: event.invokerID
+	};
+}
+//#endregion
+//#region src/api/voice.ts
+/** The channel's description, which `listChannels` omits for bandwidth. */
+async function getChannelDescription(client, cid, options) {
+	return (await client.send({
+		command: "channelgetdescription",
+		params: [["cid", cid]]
+	}, options))[0]?.["channel_description"] ?? "";
+}
+/**
+* Subscribe to a channel: receive its clients' events and voice without
+* joining it.
+*/
+async function subscribeChannel(client, cid, options) {
+	await client.send({
+		command: "channelsubscribe",
+		params: [["cid", cid]]
+	}, options);
+}
+/** Stop receiving a subscribed channel's events and voice. */
+async function unsubscribeChannel(client, cid, options) {
+	await client.send({
+		command: "channelunsubscribe",
+		params: [["cid", cid]]
+	}, options);
+}
+/** Subscribe to every channel on the server. */
+async function subscribeAllChannels(client, options) {
+	await client.send({ command: "channelsubscribeall" }, options);
+}
+/** Unsubscribe from every channel on the server. */
+async function unsubscribeAllChannels(client, options) {
+	await client.send({ command: "channelunsubscribeall" }, options);
+}
+//#endregion
+export { AlreadyConnectedError, Client, ClientStatus, ConnectionTimeoutError, CryptoInitError, FileTransferError, Identity, InvalidAddressError, InvalidIdentityError, RemovedError, backoffDelay, commandChannel, defaultBackoffPolicy, defaultShouldRetry, dialFileTransfer, downloadFileData, generateIdentity, generateIdentitySync, getChannelDescription, packetChannel, parseIdentity, subscribeAllChannels, subscribeChannel, uidFromPublicKey, unknownServerCapabilities, unsubscribeAllChannels, unsubscribeChannel, uploadFileData };
+
+//# sourceMappingURL=index.js.map