@mega-yfue/eufy-sdk 0.2.0-beta.0 → 0.2.0-beta.10

package/dist/model/solix-device.d.ts

@@ -0,0 +1,102 @@
+import { type SolixCapability, type SolixEnergyMeterReads } from "./capabilities/solix.js";
+import type { SolixDeviceRecord, SolixProductCategory } from "../core/solix-types.js";
+/**
+ * The device record shape, re-exported from the model surface. It lives in `core/solix-types` so the
+ * transport client can return it without crossing the transport↔model line.
+ */
+export type { SolixDeviceRecord } from "../core/solix-types.js";
+export interface SolixIdentity {
+    serial: string;
+    productCode: string;
+    /** Friendly name — the catalog marketing name if resolvable, else the record's alias/name. */
+    name: string;
+    /** Anker catalog category (e.g. "Accessory", "Portable Power Station"), if resolvable. */
+    category?: string;
+}
+export interface SolixConnectivity {
+    online: boolean;
+    rssi?: number;
+    ssid?: string;
+}
+/**
+ * The `dev.energyMeter()` handle: the members-derived reads ({@link SolixEnergyMeterReads} —
+ * `meterVoltageL1` is present only once a frame carrying its tag has landed). Every not-yet-named meter
+ * quantity is read from {@link SolixDevice.telemetry} under its `channel_<hex tag>` key instead, which a
+ * static members table cannot enumerate.
+ */
+export type SolixEnergyMeter = SolixEnergyMeterReads;
+/** Options for {@link SolixDevice}. */
+export interface SolixDeviceOptions {
+    /** Catalog categories (from `SolixClient.getProductCatalog()`) — used to resolve name + category. */
+    catalog?: SolixProductCategory[];
+}
+/**
+ * A discovered Solix device with resolved category + capabilities. Feed live telemetry with
+ * {@link applyReading} (from {@link SolixMqtt}'s `reading` events) to populate value accessors.
+ */
+export declare class SolixDevice {
+    readonly serial: string;
+    readonly productCode: string;
+    readonly record: SolixDeviceRecord;
+    private readonly caps;
+    private readonly identity_;
+    private values;
+    constructor(record: SolixDeviceRecord, opts?: SolixDeviceOptions);
+    /** All capabilities this device carries. */
+    get capabilities(): SolixCapability[];
+    /** Whether the device carries a capability — the only correct way to branch on behaviour. */
+    has(capability: SolixCapability): boolean;
+    /**
+     * Merge a live telemetry reading (a `SolixMqtt` `reading` event) so accessors reflect it. Takes the
+     * WHOLE reading, not just its values, and drops one addressed to a different device: the documented
+     * wiring is `mqtt.on("reading", r => device.applyReading(r))`, and one MQTT stream carries every
+     * watched meter on the account — so without this filter two meters would cross-feed each other's floats.
+     * A reading with no `deviceSn` (a hand-built one) is accepted as-is.
+     */
+    applyReading(reading: {
+        deviceSn?: string;
+        values: Record<string, number>;
+    }): void;
+    /** All decoded float telemetry channels from the latest applied reading (raw, `channel_<tag>` keys). */
+    telemetry(): Record<string, number>;
+    identity(): SolixIdentity;
+    firmware(): {
+        version: string;
+    } | undefined;
+    connectivity(): SolixConnectivity | undefined;
+    /**
+     * The members-derived `energyMeter` reads, or `undefined` when the device has no meter. Each getter is
+     * installed only for a tag this device has actually reported, and reads `this.values` LIVE — a handle
+     * held across an {@link applyReading} reflects the newer values. Getter INSTALLATION is fixed at the
+     * time of this call, so re-call it to pick up a tag first seen since.
+     */
+    energyMeter(): SolixEnergyMeter | undefined;
+    /**
+     * The {@link MemberDeps} the members engine needs: a read closure over the live values store, and the
+     * evidence gate (`ctx.paramIds`) rebuilt from the ff09 tags this device has reported. No `codec` — the
+     * codecs are eufy transport families and a Solix device belongs to none of them. The sink is a no-op:
+     * Solix telemetry is read-only, no member here dispatches a command.
+     */
+    private meterDeps;
+    /** The ff09 tags this device has reported, derived from the decoder's `channel_<hex>` keys. */
+    private seenTags;
+}
+/**
+ * The minimum a client must offer to be discovered against — the two wire reads {@link discoverSolixDevices}
+ * composes. Typed STRUCTURALLY (not as `SolixClient`) so the model layer never imports the transport
+ * client: the hard `transport ⊥ model` rule forbids it, and a structural shape needs no import.
+ */
+export interface SolixDeviceReader {
+    getDevices(): Promise<SolixDeviceRecord[]>;
+    getProductCatalog(): Promise<SolixProductCategory[]>;
+}
+/**
+ * Discover an account's Solix devices as capability-driven {@link SolixDevice} objects — the wire+model
+ * composition (a transport read + the product catalog) that used to be `SolixClient.discoverDevices()`.
+ * It lives in the model layer because it builds `SolixDevice`; the wire client (now `transport/http`)
+ * cannot, and passing it structurally keeps the layers decorrelated. Feed live telemetry to each result
+ * via `SolixDevice.applyReading`.
+ */
+export declare function discoverSolixDevices(client: SolixDeviceReader, opts?: {
+    catalog?: SolixProductCategory[];
+}): Promise<SolixDevice[]>;

package/dist/model/types.d.ts

@@ -28,10 +28,10 @@
  *
  * `display` is the T87Ax Smart Display line — its own codec because its `device_type` collides with
  * the security residual range (confirmed live, 2026-09-04: it connects over secure MQTT with no
- * `p2p_did`, never P2P). Its param namespace and product line are nonetheless grouped into `security`
- * by maintainer decision, not wire evidence — see {@link namespaceForCodec}. No capability module
- * targets it yet: no screen/audio/assistant param has been observed, only its own small cloud-param
- * namespace (ids 8001-8006).
+ * `p2p_did`, never P2P). It owns its own param namespace (ids 8001-8006) and its own product line, so
+ * no other line's capability can attach to it — see `namespaceForCodec` and `CODEC_LINE`. The `display`
+ * capability targets it and reads the charge; no screen/audio/assistant param has been observed, so
+ * those are absent rather than deferred.
  */
 export type Codec = "station" | "camera" | "sensor" | "lock" | "keypad" | "vacuum" | "mower" | "light" | "printer" | "display";
 /**
@@ -39,7 +39,7 @@ export type Codec = "station" | "camera" | "sensor" | "lock" | "keypad" | "vacuu
  * it maps to a {@link CapabilityModule} that owns its property schema. Extend this union as
  * new capabilities are modelled — adding one never requires a subclass.
  */
-export type Capability = "video" | "snapshot" | "motion" | "person_detection" | "battery" | "light" | "ptz" | "doorbell" | "contact" | "leak" | "smoke" | "co" | "siren" | "lock" | "keypad" | "arming" | "storage" | "rtsp" | "camera" | "audio" | "vacuum_clean" | "vacuum_dock" | "suction" | "locate" | "smart_light" | "info";
+export type Capability = "video" | "snapshot" | "motion" | "person_detection" | "battery" | "light" | "ptz" | "doorbell" | "contact" | "leak" | "smoke" | "co" | "siren" | "lock" | "keypad" | "arming" | "storage" | "rtsp" | "camera" | "audio" | "vacuum_clean" | "vacuum_dock" | "suction" | "locate" | "smart_light" | "display" | "info";
 /** Value type of a property. */
 export type PropertyValueType = "bool" | "number" | "string" | "enum";
 /**

package/dist/transport/ff09.d.ts

@@ -397,6 +397,13 @@ export interface Ff09SettingsResponse {
  * padding past the last real field.
  */
 export declare function parseFf09SettingsResponse(plain: Buffer): Ff09SettingsResponse;
+/**
+ * Walk a bounded `tag|len|value` TLV region into a `tag → bytes` map. Stops at a `0x00` tag (only ever
+ * trailing zero-padding, never a real field — real tags start at `0xa1`) and refuses a field whose
+ * declared length would overrun `end`, so a corrupt length can't read past the region (e.g. into a
+ * trailing checksum). Shared by {@link parseFf09SettingsResponse} and the Solix param decoder.
+ */
+export declare function walkFf09Tlv(buf: Buffer, start: number, end: number): Map<number, Buffer>;
 /** Read a little-endian u16 out of a TLV field buffer (throws on a missing/short field — a caller-side bug, not a wire ambiguity). */
 export declare function readFf09U16LE(field: Buffer | undefined, name: string): number;
 /** Read a single byte out of a TLV field buffer (throws on a missing field — same convention as {@link readFf09U16LE}). */

package/dist/transport/http/index.d.ts

@@ -3,3 +3,4 @@ export { randomPhoneModel, randomUserAgent } from "./phone-model.js";
 export * from "./decodeImageV1.js";
 export * from "./decodeImageV2.js";
 export { listLightEffects, listAiSceneRecommendations, type LightEffectSummary } from "./light-catalog.js";
+export { SolixClient, type SolixClientOptions, type SolixLoginResult, type SolixSession, type SolixPersisted, type SolixSessionStore, } from "./solix-client.js";

package/dist/transport/http/mega-client.d.ts

@@ -186,8 +186,16 @@ export declare class MegaHttpClient {
      *  restored-session short-circuit must NOT treat it as a usable session. Cleared on Ok/reset. */
     private pending2fa;
     private tokenExpiresAt;
-    /** Stable per-install device id — the auth token is bound to it. */
-    private openudid;
+    /**
+     * Stable per-install device id: `openudid` as configured, as restored from the session store, or as
+     * derived from the ACCOUNT when neither supplied one — two clients that configure none therefore
+     * share it, and are one install as far as everything keyed on this is concerned.
+     *
+     * Two things are keyed on it, and both fail the same way when it is shared: the auth token is bound
+     * to it, so each login displaces the other's session, and the secure-MQTT client id is built from it,
+     * so each connection evicts the other's channel.
+     */
+    readonly openudid: string;
     /** The device model reported to the cloud (explicit `phoneModel`, else a stable random one). */
     private readonly phoneModel;
     /** The `user-agent` for the media-download path (explicit `mediaUserAgent`, else derived from the model). */

package/dist/transport/http/solix-client.d.ts

@@ -0,0 +1,158 @@
+/**
+ * A minimal client for the Anker Solix power-station cloud, driven by the SAME account login the
+ * eufy client uses.
+ *
+ * Why this is separate from the eufy device client: Solix shares Anker's `algo_ecdh` passport (so
+ * {@link prepareKeyExchange} / {@link encryptLoginPassword} / {@link signRequest} are reused verbatim
+ * for the login handshake) but exposes a different device backend — its own `app-name`, host, and
+ * bootstrap key (`SOLIX_APP_NAME`, `SOLIX_DEFAULT_API_HOST`, {@link SOLIX_LOCAL_KEY_HEX}) —
+ * and its authenticated resource reads are PLAIN JSON, carrying only the auth token and a
+ * `gtoken = md5(user_id)`, with no per-request encryption or signature. This client therefore does
+ * the encrypted passport handshake to obtain a token, then makes plain authenticated reads.
+ *
+ * This is the wire client (transport layer): it returns the vendor's typed JSON as received. Building
+ * those records into capability-driven `SolixDevice` models is the model layer's job — see
+ * `discoverSolixDevices()` — so the two stay decorrelated (transport never imports model).
+ */
+import { type SessionStore, type SolixDeviceRecord, type SolixProductCategory } from "../../core/index.js";
+import type { SecureMqttCredentials } from "../mqtt/secure-mqtt.js";
+/** An authenticated Solix session — the token + the derived `gtoken` + the resolved API host. */
+export interface SolixSession {
+    authToken: string;
+    userId: string;
+    /** `md5(user_id)` — sent as the `gtoken` header on every authenticated read. */
+    gtoken: string;
+    /** The regional API host the account resolved to (e.g. the EU shard). */
+    apiHost: string;
+    /** Unix seconds; 0 when the server did not supply one. */
+    tokenExpiresAt: number;
+}
+/**
+ * Outcome of {@link SolixClient.login}. `2fa` mirrors the eufy passport: the server sent a code and
+ * the client holds a limited token — call {@link SolixClient.submitVerifyCode} to finish.
+ */
+export type SolixLoginResult = {
+    status: "ok";
+    session: SolixSession;
+} | {
+    status: "2fa";
+    method: string;
+};
+/** Options for {@link SolixClient}. */
+export interface SolixClientOptions {
+    email: string;
+    password: string;
+    /** ISO-3166 alpha-2; defaults to "US". Sent as `country` and `ab`. */
+    countryCode?: string;
+    /** Override the API host (skips domain-estimate). Defaults to estimate → `SOLIX_DEFAULT_API_HOST`. */
+    apiHost?: string;
+    /** App version reported to the cloud. */
+    appVersion?: string;
+    /**
+     * Stable per-install device id (UUID). The auth token is bound to it, and a shifting id looks like
+     * a new device each run and re-triggers 2FA. Defaults to a deterministic id derived from the email
+     * (stable across runs); a store's saved id wins over this.
+     */
+    openudid?: string;
+    /** Persist the token + device id so a dedicated account logs in once and reuses it until expiry. */
+    store?: SolixSessionStore;
+    /** Injected fetch (for tests). Defaults to the global `fetch`. */
+    fetchImpl?: typeof fetch;
+}
+/** What {@link SolixSessionStore} holds: the stable device id and (once logged in) the session. */
+export interface SolixPersisted {
+    openudid: string;
+    session?: SolixSession;
+}
+/**
+ * A place to persist a Solix session across process runs — the core {@link SessionStore} parameterised on
+ * the Solix record shape, so `FileSessionStore` serves it as-is. The device id survives token expiry (so
+ * the account keeps seeing the same device and does not re-prompt 2FA), and a live session is reused
+ * until it expires.
+ */
+export type SolixSessionStore = SessionStore<SolixPersisted>;
+/**
+ * Login + read client for one Anker account's Solix devices. Construct with the account
+ * credentials, `await login()`, then read {@link getDevices} / {@link getSites} / {@link
+ * getUserMqttInfo}. Not tied to any host runtime.
+ */
+export declare class SolixClient {
+    private readonly email;
+    private readonly password;
+    private readonly country;
+    private readonly appVersion;
+    private readonly doFetch;
+    private readonly store?;
+    private readonly openudid;
+    private apiHost;
+    private session_?;
+    /** Carried between {@link login} and {@link submitVerifyCode} while a 2FA code is outstanding. */
+    private pending2fa?;
+    /**
+     * Resolve the device id (explicit → stored → deterministic from the email, so it is stable and does
+     * not re-trigger 2FA) and adopt a stored session that has not expired, so a warm start skips the
+     * handshake. An explicit `opts.apiHost` outranks a stored session's host in both cases: it is an
+     * override that also skips domain-estimate, and every read goes through `this.apiHost`.
+     */
+    constructor(opts: SolixClientOptions);
+    /** Persist the current device id (+ session, if any) when a store is configured. */
+    private persist;
+    /** The authenticated session, once {@link login} has resolved to `ok`. */
+    get session(): SolixSession | undefined;
+    /**
+     * Headers for the login/key-exchange path, which carry the device id. Authenticated resource reads
+     * must NOT send `openudid` — the gateway rejects a token-bearing read that also carries a device id
+     * (`401 token error`) — so those use {@link baseHeaders} directly.
+     */
+    private authHeaders;
+    /** Base headers common to every Solix request. */
+    private baseHeaders;
+    /** One request path for every Solix call (GET or POST) — always parses through the non-JSON guard. */
+    private send;
+    /** POST helper for the login/key-exchange path (which builds its own bespoke headers per request). */
+    private post;
+    /** Resolve the regional API host via domain-estimate (best-effort; keeps the default on failure). */
+    private estimateHost;
+    /** Do the localKey-bootstrapped ECDH key exchange and return the negotiated session key. */
+    private keyExchange;
+    /** Build the encrypted, signed `/passport/login` request body + headers for the negotiated key. */
+    private postLogin;
+    /**
+     * Turn a decrypted `/passport/login` payload into an `ok`/`2fa` result, establishing the session on
+     * `ok`. The passport marks a pending 2FA with a non-empty `fa_info.info`, and empties it once the code
+     * has been satisfied.
+     */
+    private classifyLogin;
+    /** Decrypt a login envelope's `data` (base64 `IV(16)||AES-128-CBC`, keyed by the share key). */
+    private decryptLogin;
+    /**
+     * Authenticate with the account credentials. Resolves to `ok` with a {@link SolixSession}, or `2fa`
+     * when the passport sent a code — then call {@link submitVerifyCode}. A session that is already fresh
+     * (adopted from a store) is answered without a handshake.
+     */
+    login(): Promise<SolixLoginResult>;
+    /** Complete a `2fa` login with the code the passport sent. */
+    submitVerifyCode(code: string): Promise<SolixLoginResult>;
+    /**
+     * One authenticated PLAIN read for both GET and POST endpoints (no per-request encryption; carries
+     * the auth token + `gtoken` only). Routes through {@link send} so every read keeps the non-JSON guard.
+     */
+    private authed;
+    /**
+     * The account's bound Solix devices (flat list; may be empty when devices live under sites). The
+     * gateway's JSON is asserted to {@link SolixDeviceRecord} here, at the one trust boundary — every field
+     * beyond `device_sn`/`product_code` is optional on the record, so a caller reads them defensively.
+     */
+    getDevices(): Promise<SolixDeviceRecord[]>;
+    /** The account's sites (systems); devices are typically grouped under a site. */
+    getSites(): Promise<unknown[]>;
+    /** Per-user AWS-IoT MQTT credentials (cert/key/endpoint/thing) for the real-time device plane. */
+    getUserMqttInfo(): Promise<SecureMqttCredentials>;
+    /**
+     * The pairable-product catalog (categories → products). This is Anker's product registry, not the
+     * account's devices — fetch it to label a discovered device's model code with a marketing name and
+     * category. Pair with {@link buildModelIndex}. It is a live endpoint, so it stays current without a
+     * baked-in table.
+     */
+    getProductCatalog(): Promise<SolixProductCategory[]>;
+}

package/dist/transport/http/solix-constants.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Anker "Solix" cloud endpoints + app-line constants for {@link SolixClient}.
+ *
+ * Solix runs the SAME `algo_ecdh` passport as the eufy_mega account stack, re-skinned under a
+ * different `app-name` with its own API host and key-exchange bootstrap key (the bootstrap key lives
+ * in `core` beside its siblings — {@link SOLIX_LOCAL_KEY_HEX}). One Anker/eufy account logs in here
+ * with the exact login handshake the eufy client uses; only these constants differ. Authenticated
+ * resource reads, by contrast, are PLAIN JSON carrying just the auth token + `gtoken`.
+ */
+/** The `app-name` header value that scopes the passport + API to the Solix product. */
+export declare const SOLIX_APP_NAME = "anker_power";
+/** Domain-estimate bootstrap host. `POST /passport/estimate_domain {ab,mode:1}` answers the shard host. */
+export declare const SOLIX_ESTIMATE_HOST = "uniapp-api-pr.anker.com";
+/** EU-shard API host — the estimate result, and the fallback when estimate is skipped. */
+export declare const SOLIX_DEFAULT_API_HOST = "ankerpower-api-eu.anker.com";
+/** Solix cloud paths used by {@link SolixClient}. */
+export declare const SOLIX_ENDPOINTS: {
+    readonly estimateDomain: "/passport/estimate_domain";
+    readonly keyExchange: "/openapi/oauth/key/exchange";
+    readonly login: "/passport/login";
+    /** Bound devices for the account (flat list). */
+    readonly getRelateAndBindDevices: "/power_service/v1/app/get_relate_and_bind_devices";
+    /** Sites (systems) the account owns; devices are grouped under a site. */
+    readonly getSiteList: "/power_service/v1/site/get_site_list";
+    /** Per-user AWS-IoT MQTT credentials (cert/key/endpoint/thing) for the real-time device plane. */
+    readonly getUserMqttInfo: "/v1/openapi/devicemanage/get_user_mqtt_info";
+    /** GET: the pairable-product catalog (categories → products), for labelling model codes. */
+    readonly productCategories: "/power_service/v1/product_categories";
+};

package/dist/transport/mqtt/app-client-id.d.ts

@@ -11,6 +11,12 @@ export interface AppClientIdInput {
 }
 /** Build a client_id shaped like `android-{appName}-{uid}-{mqttUuid}-{timestamp}`. */
 export declare function buildAppShapedClientId(input: AppClientIdInput): string;
-/** A fresh stable-looking install UUID (16 hex chars) — generate ONCE per identity and persist it
- * (a new random value on every connect defeats the point of "stable"). */
-export declare function generateMqttUuid(): string;
+/**
+ * The `mqttUuid` segment for a client bound to `installId`, hashed to the 16-hex shape
+ * {@link buildAppShapedClientId} expects. Deterministic, so a client keeps its id across restarts and
+ * takes its own stale session over rather than doubling up beside it; one-way, so the id it is derived
+ * from is not recoverable from a client_id that travels the wire in clear.
+ *
+ * Two clients are distinguished exactly as far as their `installId` is: equal ids in, equal ids out.
+ */
+export declare function mqttUuidFrom(installId: string): string;

package/dist/transport/mqtt/command-router.d.ts

@@ -87,9 +87,6 @@ export interface MqttRouterDeps {
 export declare class MqttCommandRouter {
     private readonly deps;
     private readonly logger;
-    /** Stable per-process install id for the app-shaped MQTT client_id (see {@link buildAppShapedClientId}) —
-     * generated once, reused for every security-MQTT connect this router makes. */
-    private mqttUuid?;
     constructor(deps: MqttRouterDeps);
     /**
      * Whether this transport stack drives `dev`'s `ff09-*` commands — a **eufy-cloud device**

package/dist/transport/mqtt/index.d.ts

@@ -3,3 +3,5 @@ export * from "./topics.js";
 export * from "./app-client-id.js";
 export * from "./broker-discovery.js";
 export * from "./biz-stream.js";
+export { SolixMqtt } from "./solix-mqtt.js";
+export type { SolixMqttOptions, SolixMqttDevice, SolixReading, SolixParamFrame, SolixChannel } from "./solix-mqtt.js";

package/dist/transport/mqtt/secure-mqtt.d.ts

@@ -14,6 +14,16 @@
 import { EventEmitter } from "node:events";
 import type { EufyDevice, RealtimeTransport } from "../../core/types.js";
 import { type Logger } from "../../core/logger.js";
+/**
+ * Whether a connect failed because the broker REFUSED the client — a CONNACK return code the client
+ * cannot retry its way out of, as `mqtt.js` words it (`Connection refused: not authorized`). A socket
+ * that dies without an answer is not this: it is the same request, unanswered, and retrying it is the
+ * only way to learn which of the two happened.
+ *
+ * A refusal that arrives as a dropped connection instead of a CONNACK reads here as the transport
+ * failure it is indistinguishable from.
+ */
+export declare function isNotAuthorized(err: unknown): boolean;
 /**
  * Per-user mTLS credentials as returned by get_user_mqtt_info.
  *
@@ -83,12 +93,25 @@ export declare class SecureMqtt extends EventEmitter implements RealtimeTranspor
      * four topics for `eufy_life`).
      *
      * The grants are INSPECTED, not assumed: AWS IoT answers a policy-denied filter with a
-     * `SUBACK_FAILURE` (`0x80`) grant rather than failing the SUBSCRIBE, so subscribing with a credential
+     * SUBACK_FAILURE (`0x80`) grant rather than failing the SUBSCRIBE, so subscribing with a credential
      * whose scope doesn't cover the topic looks identical to success and then delivers nothing. A denied
      * topic is reported via `error` naming the credential scope; only an all-denied device throws, so a
      * line that grants its state channel but refuses (say) the OTA leg still works.
      */
     subscribeDevice(device: EufyDevice): Promise<void>;
+    /**
+     * Subscribe to explicit topic filters, returning the topics that were granted. A scope-denied filter
+     * comes back with SUBACK_FAILURE rather than an error (AWS IoT quirk), so it is dropped from the result
+     * instead of throwing — callers that need every leg check the returned list. Used by lines whose topic
+     * vocabulary isn't the eufy `subscribeTopics` shape (e.g. Anker Solix `dt/{app}/{pn}/{sn}`).
+     */
+    subscribe(topics: string[]): Promise<string[]>;
+    /**
+     * Split SUBACK grants into granted vs scope-denied topics. AWS IoT marks a policy-denied filter with a
+     * SUBACK_FAILURE (`0x80`) grant rather than failing the SUBSCRIBE, so the two subscribe paths share
+     * this split and layer their own policy (drop vs report) on top.
+     */
+    private partitionGrants;
     /**
      * Publish a raw payload to an MQTT topic (the command leg — `cmd/{app}/{pn}/{sn}/req`). The `body`
      * is a pre-built envelope the caller supplies (the command router builds it). QoS 1 by default (the