@mega-yfue/eufy-sdk 0.2.0-beta.1 → 0.2.0-beta.11

package/dist/index.js

@@ -15,6 +15,7 @@ import { createCipheriv, createDecipheriv, createECDH, createHash, createHmac, r
 var P256 = "prime256v1";
 var EUFY_MEGA_LOCAL_KEY_HEX = "2500a7d5617812f9d52515b2c8f20a3d";
 var EUFYLIFE_LOCAL_KEY_HEX = "118c12c81e211149304bd70a0c071d01";
+var SOLIX_LOCAL_KEY_HEX = "e8ad18f61bbd3fbd52d5ed12d14d3b9c";
 var SERVER_STATIC_PUBLIC_KEY_HEX = "04c5c00c4f8d1197cc7c3167c52bf7acb054d722f0ef08dcd7e0883236e0d72a3868d9750cb47fa4619248f3d83f0f662671dadc6e2d31c2f41db0161651c7c076";
 function genId() {
   return randomBytes(16).toString("hex");
@@ -22,8 +23,11 @@ function genId() {
 function nowSec() {
   return Math.floor(Date.now() / 1e3).toString();
 }
+function md5Hex(input) {
+  return createHash("md5").update(input, "utf-8").digest("hex");
+}
 function gtoken(userId) {
-  return createHash("md5").update(userId, "utf-8").digest("hex");
+  return md5Hex(userId);
 }
 function aesKey(shareKeyHex) {
   return Buffer.from(shareKeyHex, "hex").subarray(0, 16);
@@ -142,13 +146,16 @@ var FileSessionStore = class {
     }
   }
 };
+function tokenNotExpired(tokenExpiresAt, skewSec = 300) {
+  if (tokenExpiresAt && tokenExpiresAt > 0) {
+    return Math.floor(Date.now() / 1e3) < tokenExpiresAt - skewSec;
+  }
+  return true;
+}
 function isSessionValid(s, skewSec = 300) {
   if (!s?.authToken || !s.shareKey || !s.keyIdent)
     return false;
-  if (s.tokenExpiresAt && s.tokenExpiresAt > 0) {
-    return Math.floor(Date.now() / 1e3) < s.tokenExpiresAt - skewSec;
-  }
-  return true;
+  return tokenNotExpired(s.tokenExpiresAt, skewSec);
 }
 
 // dist/core/logger.js
@@ -1810,6 +1817,14 @@ function parseSecureTopic(topic) {
     return void 0;
   return { root, category, model, sn, tail: parts.slice(4).join("/") };
 }
+function solixDeviceTopics(appName, productCode, deviceSn) {
+  const dt = `dt/${appName}/${productCode}/${deviceSn}`;
+  const cmd = `cmd/${appName}/${productCode}/${deviceSn}`;
+  return { paramInfo: `${dt}/param_info`, cmdRes: `${cmd}/app/res`, req: `${cmd}/req` };
+}
+function solixUserTopics(appName, userId) {
+  return { cmdRes: `cmd/${appName}/${userId}/res`, powerSite: `dt/${appName}/${userId}/power_site` };
+}
 
 // dist/transport/mqtt/secure-mqtt.js
 var SUBACK_FAILURE = 128;
@@ -1903,7 +1918,7 @@ var SecureMqtt = class extends EventEmitter {
    * four topics for `eufy_life`).
    *
    * The grants are INSPECTED, not assumed: AWS IoT answers a policy-denied filter with a
-   * `SUBACK_FAILURE` (`0x80`) grant rather than failing the SUBSCRIBE, so subscribing with a credential
+   * SUBACK_FAILURE (`0x80`) grant rather than failing the SUBSCRIBE, so subscribing with a credential
    * whose scope doesn't cover the topic looks identical to success and then delivers nothing. A denied
    * topic is reported via `error` naming the credential scope; only an all-denied device throws, so a
    * line that grants its state channel but refuses (say) the OTA leg still works.
@@ -1912,9 +1927,8 @@ var SecureMqtt = class extends EventEmitter {
     if (!this.client)
       throw new Error("SecureMqtt not connected");
     const topics = [...subscribeTopics(device)];
-    const grants = await this.client.subscribeAsync(topics, { qos: 1 });
+    const { denied } = this.partitionGrants(await this.client.subscribeAsync(topics, { qos: 1 }));
     const scope = this.o.credentials.app_name ?? "default";
-    const denied = grants.filter((g) => g.qos === SUBACK_FAILURE).map((g) => g.topic);
     if (denied.length === topics.length) {
       throw new Error(`subscribe ${device.sn}: every topic denied on credential scope "${scope}" \u2014 this line's topics are granted to a different scope (${denied.join(", ")})`);
     }
@@ -1922,6 +1936,29 @@ var SecureMqtt = class extends EventEmitter {
       this.emit("error", new Error(`subscribe ${device.sn}: "${topic}" denied on credential scope "${scope}"`));
     }
   }
+  /**
+   * Subscribe to explicit topic filters, returning the topics that were granted. A scope-denied filter
+   * comes back with SUBACK_FAILURE rather than an error (AWS IoT quirk), so it is dropped from the result
+   * instead of throwing — callers that need every leg check the returned list. Used by lines whose topic
+   * vocabulary isn't the eufy `subscribeTopics` shape (e.g. Anker Solix `dt/{app}/{pn}/{sn}`).
+   */
+  async subscribe(topics) {
+    if (!this.client)
+      throw new Error("SecureMqtt not connected");
+    return this.partitionGrants(await this.client.subscribeAsync(topics, { qos: 1 })).granted;
+  }
+  /**
+   * Split SUBACK grants into granted vs scope-denied topics. AWS IoT marks a policy-denied filter with a
+   * SUBACK_FAILURE (`0x80`) grant rather than failing the SUBSCRIBE, so the two subscribe paths share
+   * this split and layer their own policy (drop vs report) on top.
+   */
+  partitionGrants(grants) {
+    const granted = [];
+    const denied = [];
+    for (const g of grants)
+      (g.qos === SUBACK_FAILURE ? denied : granted).push(g.topic);
+    return { granted, denied };
+  }
   /**
    * Publish a raw payload to an MQTT topic (the command leg — `cmd/{app}/{pn}/{sn}/req`). The `body`
    * is a pre-built envelope the caller supplies (the command router builds it). QoS 1 by default (the
@@ -2556,14 +2593,26 @@ var CameraDisabledError = class extends Error {
     this.name = "CameraDisabledError";
   }
 };
-var StationBusyError = class extends Error {
-  servingChannel;
-  /** Always true: the station is busy now, and stops being busy when the other stream is released. */
+var StationKeyUnavailableError = class extends Error {
+  stationSn;
+  /** Always true: the negotiation is per connection, so a later one may still produce a key. */
+  retryable = true;
+  constructor(stationSn, options) {
+    super(`station ${stationSn} did not provide its session key, so nothing that requires one could be sent`, options);
+    this.stationSn = stationSn;
+    this.name = "StationKeyUnavailableError";
+  }
+};
+var StationUnreachableError = class extends Error {
+  stationSn;
+  waitedMs;
+  /** Always true: a station unreachable now may answer on a later attempt. */
   retryable = true;
-  constructor(servingChannel, options) {
-    super(`the station is already serving channel ${servingChannel} to a viewer, and serves one camera at a time \u2014 stop that stream before opening another`, options);
-    this.servingChannel = servingChannel;
-    this.name = "StationBusyError";
+  constructor(stationSn, waitedMs, options) {
+    super(`station ${stationSn}'s P2P session did not connect within ${waitedMs}ms, so nothing could be sent to it`, options);
+    this.stationSn = stationSn;
+    this.waitedMs = waitedMs;
+    this.name = "StationUnreachableError";
   }
 };
 var LiveStreamStartError = class extends Error {
@@ -6890,6 +6939,26 @@ var KEYPAD = {
 // dist/model/capabilities/arming.js
 var STATION_CHANNEL2 = 255;
 var ArmingMode = {
+  /** Armed — full protection, nobody home (wire value 0). */
+  away: "away",
+  /** Armed for occupancy — reduced/perimeter protection while home (wire value 1). */
+  home: "home",
+  /** Scheduled — the station follows the timetable configured in the app (wire value 2). */
+  schedule: "schedule",
+  /** Custom 1 — a user-defined posture configured in the app (wire value 3). */
+  custom1: "custom1",
+  /** Custom 2 — a user-defined posture configured in the app (wire value 4). */
+  custom2: "custom2",
+  /** Custom 3 — a user-defined posture configured in the app (wire value 5). */
+  custom3: "custom3",
+  /** Off — the station's alarm system is switched off entirely (wire value 6). */
+  off: "off",
+  /** Geofenced — the station follows the app's location-based rules (wire value 47). */
+  geo: "geo",
+  /** Disarmed — no alarms; sensors still report state (wire value 63). */
+  disarmed: "disarmed"
+};
+var AlarmDelayMode = {
   /** Armed — full protection, nobody home (wire value 0). */
   away: "away",
   /** Armed for occupancy — reduced/perimeter protection while home (wire value 1). */
@@ -6905,10 +6974,11 @@ var ARMING_CMD = {
    * mValue3:0, `payload:{mode_type:<int>, user_name:<string>}`.
    *
    * ⚠️ Only 3 of the 9 modes were exercised in that capture — `mode_type` 0 (away), 63 (disarmed), 1
-   * (home), all confirmed byte-exact, and those three are the whole of {@link ArmingMode}. Re-confirmed
-   * live 2026-08-05: each reported its own MODE_SWITCH push within ~5s of the write. The remaining six are
-   * named by the app but never observed leaving it, so this capability reads them and refuses to send
-   * them. See `ARMING_MODE_WIRE` for the per-value breakdown.
+   * (home), all confirmed byte-exact. Re-confirmed live 2026-08-05: each reported its own MODE_SWITCH push
+   * within ~5s of the write. The remaining six are live confirmations rather than captures — `custom1` 3
+   * first, then `schedule` 2, `custom2` 4, `custom3` 5, `off` 6 and `geo` 47 — each sent as this exact
+   * frame and each observed to bring MODE_SWITCH back, so all nine are settable. `ARMING_MODE_WIRE` has
+   * the per-value evidence and the dates.
    */
   SET_ARMING: 1224,
   /**
@@ -6942,21 +7012,14 @@ var ARMING_MODE_WIRE = {
   away: 0,
   home: 1,
   schedule: 2,
-  // ⚠️ reportable, NOT settable — see the doc comment above
   custom1: 3,
-  // ⚠️ reportable, NOT settable — see the doc comment above
   custom2: 4,
-  // ⚠️ reportable, NOT settable — see the doc comment above
   custom3: 5,
-  // ⚠️ reportable, NOT settable — see the doc comment above
   off: 6,
-  // ⚠️ reportable, NOT settable — see the doc comment above
   geo: 47,
-  // ⚠️ reportable, NOT settable — see the doc comment above
   disarmed: 63
 };
 var ARMING_MODE_LABELS = enumLabels(ARMING_MODE_WIRE);
-var SETTABLE_MODES = Object.values(ArmingMode).map((m) => ARMING_MODE_WIRE[m]);
 function armingModeOf(v) {
   const name = String(v);
   if (name in ArmingMode)
@@ -6965,11 +7028,10 @@ function armingModeOf(v) {
   return Object.values(ArmingMode).find((m) => ARMING_MODE_WIRE[m] === wire);
 }
 function armingCommand(mode, ctx) {
-  const modeType = ARMING_MODE_WIRE[mode];
   if (!ctx.accountName) {
     throw new Error(`arming: missing account identity (user_name) [${describeDevice(ctx)}]`);
   }
-  return setPayload(ARMING_CMD.SET_ARMING, { mode_type: modeType, user_name: ctx.accountName }, ctx, 0);
+  return setPayload(ARMING_CMD.SET_ARMING, { mode_type: ARMING_MODE_WIRE[mode], user_name: ctx.accountName }, ctx, 0);
 }
 function alarmDelayCommand(mode, config, ctx) {
   const data = {
@@ -6986,11 +7048,10 @@ function alarmDelayCommand(mode, config, ctx) {
 }
 var ARMING_MEMBERS = {
   /**
-   * The one member whose write domain is NARROWER than its read: `enumValues` names all nine modes a
-   * station can report, and the argument's `values` publishes only the three whose wire was captured. That
-   * argument IS the domain the derived setter enforces and the refusal names, so an uncaptured mode is
-   * refused by naming the three that work — nine labels for the read and three for the write, off one
-   * declaration.
+   * Read and write are the same nine modes, so `enumValues` is the whole domain: `writeDomain` falls back
+   * to it, and the derived setter, the refusal message and the offered argument all read from that one
+   * declaration. A member states an `args` entry only where the two sides DIFFER. See
+   * {@link ARMING_MODE_WIRE} for the per-value evidence.
    *
    * `armingCommand` may also throw synchronously (missing account identity) and `bindMembers` turns that
    * into a rejection, so the builder stays plain.
@@ -7009,8 +7070,7 @@ var ARMING_MEMBERS = {
     kind: "enum",
     enumValues: ARMING_MODE_LABELS,
     provenance: "verified",
-    args: [{ name: "mode", kind: "enum", values: SETTABLE_MODES }],
-    description: "Guard mode (verified: param 1224 = GUARD_MODE, read/write mechanism confirmed). Reads all 9 modes the app defines; SETS only the 3 whose write is wire-captured (away/home/disarmed) \u2014 schedule/custom1/custom2/custom3/off/geo are named by the app but no capture shows one being sent, so they are refused rather than guessed; see ARMING_MODE_WIRE in arming.ts for the breakdown.",
+    description: "Guard mode (verified: param 1224 = GUARD_MODE, read/write mechanism confirmed). Reads and SETS all 9 modes the app defines \u2014 away/home/schedule/custom1/custom2/custom3/off/geo/disarmed. Three are byte-captured writes and six are live-confirmed (each sent and observed to report its own MODE_SWITCH); see ARMING_MODE_WIRE in arming.ts for the per-value evidence.",
     observation: {
       event: "armingModeChanged",
       reflects: (value) => ({ param: ARMING_CMD.SET_ARMING, expected: ARMING_MODE_WIRE[armingModeOf(value)] }),
@@ -7031,9 +7091,10 @@ var ARMING_MEMBERS = {
    * this mode — there is no known GET to fetch it automatically, and a wrong guess here can silently
    * misconfigure which sensors arm/trigger for real.
    *
-   * Takes {@link ArmingMode}, so a delay can only be configured for a mode whose `mode_id` integer is
-   * captured. The frame carries that same integer, so a schedule/custom mode would be the identical guess
-   * `setMode` refuses.
+   * Takes {@link AlarmDelayMode}, not {@link ArmingMode}: a delay is configurable only for a mode whose
+   * integer is captured on THIS command, and `custom1` is confirmed on cmd 1224 only. The frame carries
+   * that integer in `mode_id` with no runtime validation and no readback, so a mode outside this union
+   * would be the same unverified guess `setMode` refuses.
    */
   setAlarmDelayConfig: method(({ ctx, sink }) => (mode, config) => {
     try {
@@ -7704,6 +7765,89 @@ var ModeCtrlMethod = {
   STOP_SMART_FOLLOW: 18,
   START_GLOBAL_CRUISE: 20
 };
+var ModeCtrlParamMethod = {
+  /** `START_SELECT_ROOMS_CLEAN` — clean the named rooms of a named map. */
+  SELECT_ROOMS: { method: 1, param: 4 },
+  /** `START_SELECT_ZONES_CLEAN` — clean the given rectangles of a named map. */
+  SELECT_ZONES: { method: 2, param: 5 },
+  /** `START_GOTO_CLEAN` — drive to a point and clean around it. */
+  GOTO: { method: 4, param: 7 },
+  /** `START_SCENE_CLEAN` — run a saved scene by its id. */
+  SCENE: { method: 24, param: 14 }
+};
+var SELECT_ROOMS_FIELD = {
+  /** `rooms` — repeated, one entry per room. */
+  ROOMS: 1,
+  /** `clean_times` — how many passes to make. */
+  CLEAN_TIMES: 2,
+  /** `map_id` — WHICH saved map the room ids belong to. */
+  MAP_ID: 3,
+  /** `id` within a `Room`. */
+  ROOM_ID: 1,
+  /** `order` within a `Room` — the sequence to visit them in. */
+  ROOM_ORDER: 2
+};
+var SELECT_ZONES_FIELD = {
+  /** `zones` — repeated, one entry per rectangle. */
+  ZONES: 1,
+  /** `map_id` — which saved map the coordinates belong to. */
+  MAP_ID: 2,
+  /** `quadrangle` within a `Zone` — its four corners. */
+  QUADRANGLE: 1,
+  /** `clean_times` within a `Zone`. */
+  ZONE_CLEAN_TIMES: 2,
+  /** `x` within a `Point`, SIGNED centimetres. */
+  POINT_X: 1,
+  /** `y` within a `Point`, SIGNED centimetres. */
+  POINT_Y: 2
+};
+var SCENE_CLEAN_ID = 1;
+function encodeModeCtrlParam(method2, paramField, build) {
+  return rawDp((w) => {
+    if (method2 !== 0)
+      w.int(MODE_CTRL_FIELD.METHOD, method2);
+    w.int(MODE_CTRL_FIELD.SEQ, nextModeCtrlSeq());
+    w.sub(paramField, build);
+  });
+}
+function encodeSelectRoomsClean(mapId, rooms, cleanTimes = 1) {
+  const { method: method2, param } = ModeCtrlParamMethod.SELECT_ROOMS;
+  return encodeModeCtrlParam(method2, param, (p) => {
+    for (const room of rooms) {
+      p.sub(SELECT_ROOMS_FIELD.ROOMS, (r) => {
+        r.int(SELECT_ROOMS_FIELD.ROOM_ID, room.id);
+        if (room.order !== void 0)
+          r.int(SELECT_ROOMS_FIELD.ROOM_ORDER, room.order);
+      });
+    }
+    p.int(SELECT_ROOMS_FIELD.CLEAN_TIMES, cleanTimes);
+    p.int(SELECT_ROOMS_FIELD.MAP_ID, mapId);
+  });
+}
+function encodeSelectZonesClean(mapId, zones) {
+  const { method: method2, param } = ModeCtrlParamMethod.SELECT_ZONES;
+  return encodeModeCtrlParam(method2, param, (p) => {
+    for (const zone of zones) {
+      p.sub(SELECT_ZONES_FIELD.ZONES, (z) => {
+        z.sub(SELECT_ZONES_FIELD.QUADRANGLE, (q) => {
+          for (const [i, corner] of zone.corners.entries()) {
+            q.sub(i + 1, (pt) => {
+              pt.sint(SELECT_ZONES_FIELD.POINT_X, corner.x);
+              pt.sint(SELECT_ZONES_FIELD.POINT_Y, corner.y);
+            });
+          }
+        });
+        if (zone.cleanTimes !== void 0)
+          z.int(SELECT_ZONES_FIELD.ZONE_CLEAN_TIMES, zone.cleanTimes);
+      });
+    }
+    p.int(SELECT_ZONES_FIELD.MAP_ID, mapId);
+  });
+}
+function encodeSceneClean(sceneId) {
+  const { method: method2, param } = ModeCtrlParamMethod.SCENE;
+  return encodeModeCtrlParam(method2, param, (p) => p.int(SCENE_CLEAN_ID, sceneId));
+}
 var modeCtrlSeq = 111;
 function nextModeCtrlSeq() {
   return ++modeCtrlSeq;
@@ -9539,7 +9683,41 @@ var VACUUM_CLEAN_MEMBERS = {
   /** Return to the dock via ModeCtrlRequest method 6 (DP 152). AIoT only — Tuya write unverified. */
   returnToDock: method(({ sink }) => () => sink.dispatch(aiotDp(VACUUM_DP.MODE_CTRL, encodeModeCtrl(ModeCtrlMethod.START_GOHOME, nextModeCtrlSeq()))), "Return to the dock (ModeCtrlRequest method 6 over DP 152).", isAiotVacuum),
   /** Pause the current cleaning task via ModeCtrlRequest method 13 (DP 152). AIoT only — Tuya write unverified. */
-  pauseCleaning: method(({ sink }) => () => sink.dispatch(aiotDp(VACUUM_DP.MODE_CTRL, encodeModeCtrl(ModeCtrlMethod.PAUSE_TASK, nextModeCtrlSeq()))), "Pause the current cleaning task (ModeCtrlRequest method 13 over DP 152).", isAiotVacuum)
+  pauseCleaning: method(({ sink }) => () => sink.dispatch(aiotDp(VACUUM_DP.MODE_CTRL, encodeModeCtrl(ModeCtrlMethod.PAUSE_TASK, nextModeCtrlSeq()))), "Pause the current cleaning task (ModeCtrlRequest method 13 over DP 152).", isAiotVacuum),
+  /**
+   * Run a saved cleaning scene by its id (ModeCtrlRequest method 24 over DP 152).
+   *
+   * The id is the device's own, as {@link VACUUM_CLEAN_MEMBERS.scenes} reports it — `VacuumScene.id`
+   * off the `SceneResponse` on DP 180. A scene the device reports invalid stays reportable and running
+   * it is still a well-formed request; `VacuumScene.invalidReason` says why the device will refuse.
+   *
+   * Frame shape is byte-proven against the shared outer `ModeCtrlRequest`, and method 24 has been
+   * WATCHED: run on a T2351, it started the named scene.
+   */
+  startScene: method(({ sink }) => (sceneId) => sink.dispatch(aiotDp(VACUUM_DP.MODE_CTRL, encodeSceneClean(sceneId))), "Run a saved cleaning scene by its id (ModeCtrlRequest method 24 over DP 152).", isAiotVacuum),
+  /**
+   * Clean the named rooms of a named map (ModeCtrlRequest method 1 over DP 152).
+   *
+   * `mapId` has no default and that is deliberate: room ids are per map, so assuming the map a
+   * single-floor home would have sends a two-floor home's ids against the wrong floor. `SceneInfo.mapid`
+   * on DP 180 and a scheduled rooms-clean's `map_id` are the two real map ids the device reports.
+   *
+   * `cleanTimes` is how many passes to make over the set; rooms with no `order` are visited in the
+   * order given.
+   *
+   * Frame shape is byte-proven against the shared outer `ModeCtrlRequest`, and method 1 has been
+   * WATCHED: run on a T2351, it cleaned the rooms named.
+   */
+  cleanRooms: method(({ sink }) => (mapId, rooms, cleanTimes = 1) => sink.dispatch(aiotDp(VACUUM_DP.MODE_CTRL, encodeSelectRoomsClean(mapId, rooms, cleanTimes))), "Clean the named rooms of a named map (ModeCtrlRequest method 1 over DP 152).", isAiotVacuum),
+  /**
+   * Clean the given rectangles of a named map (ModeCtrlRequest method 2 over DP 152).
+   *
+   * Corners are SIGNED centimetres in the map's own frame, whose origin sits wherever the robot first
+   * mapped from — negative coordinates are ordinary and are ZigZag-encoded, not written as plain
+   * varints. Same `mapId` reasoning as {@link VACUUM_CLEAN_MEMBERS.cleanRooms}, and the same evidence:
+   * method 2 was run on a T2351 and cleaned the rectangles given.
+   */
+  cleanZones: method(({ sink }) => (mapId, zones) => sink.dispatch(aiotDp(VACUUM_DP.MODE_CTRL, encodeSelectZonesClean(mapId, zones))), "Clean the given rectangles of a named map (ModeCtrlRequest method 2 over DP 152).", isAiotVacuum)
 };
 var VACUUM_CLEAN = {
   capability: "vacuum_clean",
@@ -9715,6 +9893,70 @@ function toNumberArray(arr) {
   return result;
 }
 
+// dist/model/capabilities/display.js
+var DISPLAY_PARAM = { BATTERY: 8001, SOFTWARE_VERSION: 8003 };
+var DISPLAY_MEMBERS = {
+  /**
+   * Battery level, 0-100.
+   *
+   * **On this capability rather than on `battery`, and that is the line partition doing its job.** The
+   * security-line `battery` capability reads param 1101 and a Smart Display's charge is 8001 in its own
+   * id space — two wires that happen to mean the same thing. One capability reading both would be a claim
+   * that the two ecosystems share a param space, so a consumer reads a display's charge through
+   * `dev.display()` and a camera's through `dev.battery()`.
+   *
+   * `verified` rather than `mega`: the id is in the device's cloud record, but the NAME came from the
+   * maintainer's own knowledge of the hardware rather than from the cloud data-point list, and `"100"`
+   * fits brightness, volume or charge equally.
+   *
+   * The scale is `percent` on the reading itself, not on convention alone: a full charge reads `255` on a
+   * 0-255 scale and `1000` on a 0-1000 one, so `"100"` on a charged unit is positive evidence for 0-100
+   * rather than merely consistent with it. What nobody has done is watch it MOVE, which is why a value
+   * frozen at 100 would not yet be distinguishable from a healthy one.
+   */
+  battery: {
+    param: DISPLAY_PARAM.BATTERY,
+    type: "number",
+    unit: "%",
+    kind: "percent",
+    provenance: "verified",
+    description: "Battery level, 0-100 (param 8001)."
+  },
+  /**
+   * Version-shaped, and that shape is the whole of the evidence — hence `guessed`, and hence no typed
+   * getter: a caller reading this off a bound object cannot see the label.
+   *
+   * `unexposed` rather than absent, so the schema still carries its type and that label and
+   * `getProperty("softwareVersion")` still answers. `dev.info()?.firmwareVersion` is the field to trust
+   * where the cloud record carries one; on this display it does not, which is the only reason 8003 is
+   * named at all.
+   */
+  softwareVersion: {
+    param: DISPLAY_PARAM.SOFTWARE_VERSION,
+    type: "string",
+    kind: "text",
+    provenance: "guessed",
+    unexposed: true,
+    description: "Version-shaped string (param 8003), meaning unconfirmed \u2014 prefer `info.firmwareVersion`."
+  }
+};
+var DISPLAY = {
+  capability: "display",
+  line: "display",
+  description: "Smart Display battery level (param 8001, display namespace).",
+  members: DISPLAY_MEMBERS,
+  properties: propertiesOf(DISPLAY_MEMBERS),
+  /**
+   * Claimed by CODEC, not by an evidence param.
+   *
+   * 8001 is in the device's cloud record, so the ordinary evidence gate would install the getter anyway
+   * — but the capability should attach to a Smart Display that has reported nothing yet too, because a
+   * device on this line has no other capability to carry it. The line partition keeps this off
+   * everything else: `display` is the only codec in the `display` line.
+   */
+  detection: { codecs: ["display"] }
+};
+
 // dist/model/capabilities/locate.js
 var LOCATE_DP = 160;
 var LEGACY_LOCATE_DP = TUYA_VACUUM_DP.LOOK_FOR_SWEEPER;
@@ -9843,6 +10085,7 @@ var MODULES = [
   VACUUM_DOCK,
   SUCTION,
   LOCATE,
+  DISPLAY,
   INFO
 ];
 var BY_CAP = new Map(MODULES.map((m) => [m.capability, m]));
@@ -9887,11 +10130,11 @@ var CODEC_LINE = {
   mower: "clean",
   light: "life",
   printer: "print",
-  display: "security"
+  display: "display"
 };
 function lineAllows(module, codec) {
   const line = module.line ?? "security";
-  return line === "any" || line === CODEC_LINE[codec];
+  return line === "any" || codec !== void 0 && line === CODEC_LINE[codec];
 }
 function detectCapabilities(rec, codec) {
   const found = /* @__PURE__ */ new Set();
@@ -9921,10 +10164,10 @@ function detectCapabilities(rec, codec) {
     if (!matched && d.modelHints && haystack.length > 0) {
       matched = d.modelHints.some((re) => re.test(haystack));
     }
-    if (!matched && d.codecs) {
+    if (!matched && d.codecs && codec !== void 0) {
       matched = d.codecs.includes(codec);
     }
-    if (!matched && d.detect) {
+    if (!matched && d.detect && codec !== void 0) {
       try {
         matched = d.detect(rec, codec) === true;
       } catch {
@@ -11987,6 +12230,28 @@ var CLEAN_PARAMS = {
     provenance: "mega"
   }
 };
+var DISPLAY_PARAMS = {
+  8001: {
+    name: "battery",
+    type: "number",
+    provenance: "verified"
+  },
+  8003: {
+    name: "softwareVersion",
+    type: "string",
+    provenance: "guessed"
+  },
+  8005: {
+    name: "modelName",
+    type: "string",
+    provenance: "mega"
+  },
+  8006: {
+    name: "modelCode",
+    type: "string",
+    provenance: "mega"
+  }
+};
 
 // dist/model/life-params.js
 var LIFE_PARAMS = {
@@ -12014,7 +12279,10 @@ var TABLES = {
   // 3D-printer (ankermake) id space — empty until a live capture confirms the param↔semantic map
   // (printer-support plan Stage 3). Present so the printer codec resolves to its OWN namespace rather
   // than falling through to `security` and decoding another line's dictionary.
-  print: {}
+  print: {},
+  // Smart Display (T87Ax) — ids 8001-8006, four of them named. Same reason as `print`: its own
+  // dictionary rather than a corner of another line's.
+  display: DISPLAY_PARAMS
 };
 function paramDef(ns, paramType) {
   return TABLES[ns][paramType];
@@ -12029,7 +12297,7 @@ var NAMESPACE_BY_CODEC = {
   mower: "clean",
   light: "life",
   printer: "print",
-  display: "security"
+  display: "display"
 };
 function namespaceForCodec(codec) {
   return NAMESPACE_BY_CODEC[codec];
@@ -13092,6 +13360,174 @@ function inspectParams(rec, sn) {
   };
 }
 
+// dist/model/capabilities/solix.js
+var SOLIX_ENERGY_METER_MEMBERS = {
+  /**
+   * Line-1 voltage (V), ff09 tag `0xAC` — the ONE confirmed meter binding, matched against a live
+   * single-phase frame (a nominal mains voltage). Read-only; the evidence gate installs its getter only
+   * once a frame carrying `0xAC` has landed, so it is absent (not a fabricated `0`) until then.
+   */
+  meterVoltageL1: {
+    param: 172,
+    type: "number",
+    kind: "scalar",
+    unit: "V",
+    provenance: "verified",
+    description: "Meter line-1 voltage (V) \u2014 ff09 tag 0xAC, confirmed against a live single-phase frame."
+  }
+};
+var CATEGORY_CAPABILITIES = {
+  "Portable Power Station": ["battery", "acOutput", "solarInput"],
+  "Plug-in Home Battery": ["battery", "solarInput", "acOutput", "energyMeter"],
+  "Powered Cooler": ["battery", "cooler"],
+  "Power Bank": ["battery"],
+  "Smart EV Charger": ["evCharger"],
+  Charger: ["charger"],
+  Accessory: []
+};
+var SOLIX_METER_MODELS = ["AE1X0"];
+var SOLARBANK_MODELS = ["A1790", "A17C"];
+function detectSolixCapabilities(rec, category) {
+  const caps = /* @__PURE__ */ new Set(["identity"]);
+  if (rec.device_sw_version)
+    caps.add("firmware");
+  if (rec.wifi_online !== void 0 || rec.rssi != null || rec.wifi_name)
+    caps.add("connectivity");
+  for (const c of category && CATEGORY_CAPABILITIES[category] || [])
+    caps.add(c);
+  if (SOLIX_METER_MODELS.some((m) => rec.product_code?.startsWith(m)))
+    caps.add("energyMeter");
+  if (SOLARBANK_MODELS.some((m) => rec.product_code?.startsWith(m))) {
+    caps.add("battery");
+    caps.add("solarInput");
+  }
+  return caps;
+}
+
+// dist/model/solix-catalog.js
+function buildModelIndex(categories) {
+  const index = /* @__PURE__ */ new Map();
+  for (const category of categories) {
+    for (const product of category.products ?? []) {
+      const entry = { name: product.name, category: category.name };
+      if (product.product_code)
+        index.set(product.product_code, entry);
+      for (const variant of product.p_codes ?? []) {
+        const code = typeof variant === "string" ? variant : variant?.product_code;
+        if (code)
+          index.set(code, entry);
+      }
+    }
+  }
+  return index;
+}
+
+// dist/model/solix-device.js
+var READ_ONLY_SINK = { dispatch: async () => {
+} };
+var SolixDevice = class {
+  serial;
+  productCode;
+  record;
+  caps;
+  identity_;
+  values = {};
+  constructor(record, opts = {}) {
+    this.record = record;
+    this.serial = record.device_sn;
+    this.productCode = record.product_code;
+    const label = opts.catalog ? buildModelIndex(opts.catalog).get(record.product_code) : void 0;
+    this.identity_ = {
+      serial: record.device_sn,
+      productCode: record.product_code,
+      name: label?.name ?? record.alias_name ?? record.device_name ?? record.product_code,
+      category: label?.category
+    };
+    this.caps = detectSolixCapabilities(record, this.identity_.category);
+  }
+  /** All capabilities this device carries. */
+  get capabilities() {
+    return [...this.caps];
+  }
+  /** Whether the device carries a capability — the only correct way to branch on behaviour. */
+  has(capability) {
+    return this.caps.has(capability);
+  }
+  /**
+   * Merge a live telemetry reading (a `SolixMqtt` `reading` event) so accessors reflect it. Takes the
+   * WHOLE reading, not just its values, and drops one addressed to a different device: the documented
+   * wiring is `mqtt.on("reading", r => device.applyReading(r))`, and one MQTT stream carries every
+   * watched meter on the account — so without this filter two meters would cross-feed each other's floats.
+   * A reading with no `deviceSn` (a hand-built one) is accepted as-is.
+   */
+  applyReading(reading) {
+    if (reading.deviceSn && reading.deviceSn !== this.serial)
+      return;
+    this.values = { ...this.values, ...reading.values };
+  }
+  /** All decoded float telemetry channels from the latest applied reading (raw, `channel_<tag>` keys). */
+  telemetry() {
+    return { ...this.values };
+  }
+  identity() {
+    return { ...this.identity_ };
+  }
+  firmware() {
+    return this.record.device_sw_version ? { version: this.record.device_sw_version } : void 0;
+  }
+  connectivity() {
+    if (!this.has("connectivity"))
+      return void 0;
+    const rssi = this.record.rssi != null ? Number(this.record.rssi) : void 0;
+    return {
+      online: !!this.record.wifi_online,
+      rssi: Number.isFinite(rssi) ? rssi : void 0,
+      ssid: this.record.wifi_name
+    };
+  }
+  /**
+   * The members-derived `energyMeter` reads, or `undefined` when the device has no meter. Each getter is
+   * installed only for a tag this device has actually reported, and reads `this.values` LIVE — a handle
+   * held across an {@link applyReading} reflects the newer values. Getter INSTALLATION is fixed at the
+   * time of this call, so re-call it to pick up a tag first seen since.
+   */
+  energyMeter() {
+    if (!this.has("energyMeter"))
+      return void 0;
+    return bindMembers(SOLIX_ENERGY_METER_MEMBERS, this.meterDeps());
+  }
+  /**
+   * The {@link MemberDeps} the members engine needs: a read closure over the live values store, and the
+   * evidence gate (`ctx.paramIds`) rebuilt from the ff09 tags this device has reported. No `codec` — the
+   * codecs are eufy transport families and a Solix device belongs to none of them. The sink is a no-op:
+   * Solix telemetry is read-only, no member here dispatches a command.
+   */
+  meterDeps() {
+    const read = (name) => {
+      const v = this.values[name];
+      return v === void 0 ? void 0 : { name, paramType: 0, value: v, ts: Date.now() };
+    };
+    return { ctx: { channel: 0, paramIds: this.seenTags() }, sink: READ_ONLY_SINK, read };
+  }
+  /** The ff09 tags this device has reported, derived from the decoder's `channel_<hex>` keys. */
+  seenTags() {
+    const tags = /* @__PURE__ */ new Set();
+    for (const key of Object.keys(this.values)) {
+      const m = /^channel_([0-9a-f]+)$/.exec(key);
+      if (m)
+        tags.add(parseInt(m[1], 16));
+    }
+    return tags;
+  }
+};
+async function discoverSolixDevices(client, opts = {}) {
+  const [records, catalog] = await Promise.all([
+    client.getDevices(),
+    opts.catalog ? Promise.resolve(opts.catalog) : client.getProductCatalog().catch(() => [])
+  ]);
+  return records.map((r) => new SolixDevice(r, { catalog }));
+}
+
 // dist/client/map-channels.js
 var reader = (kind, decode) => (raw, codec) => {
   const value = decode(raw, codec);
@@ -14190,19 +14626,27 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
    * cameras from that second group streamed normally at level-1 — including one of the same firmware as an
    * own-session camera that delivered no video at all for a reason of its own. An expired grace therefore
    * separates nothing on this path, and a start failure on such a session is not evidence about it.
+   *
+   * Every `false` answer carries a `level2-unavailable` trace naming its reason, wherever the wait ended: a
+   * `terminal` outcome is the one already stated where the negotiation concluded, since that is where the
+   * cipher and the cause are known, and re-stating it here would double every settled negotiation.
    */
   async awaitLevel2Key(graceMs, graceFrom = "call") {
-    if (this.closed)
+    if (this.closed) {
+      this.trace({ phase: "level2-unavailable", reason: "session-closed" });
       return false;
+    }
     if (this.level2Key)
       return true;
-    if (!this.level2Pending)
+    if (!this.level2Pending) {
+      this.trace({ phase: "level2-unavailable", reason: "not-negotiating" });
       return false;
+    }
     const since = graceFrom === "call" ? Date.now() : this.connectedAtMs ?? Date.now();
     const remaining = graceMs - (Date.now() - since);
     if (remaining <= 0) {
       this.logger.debug(`[p2p] ${this.cfg.stationSn} no level-2 key and its ${graceMs}ms grace has elapsed`);
-      this.trace({ phase: "level2-absent", waitedMs: graceMs });
+      this.trace({ phase: "level2-unavailable", reason: "grace-elapsed", waitedMs: graceMs });
       return false;
     }
     this.logger.debug(`[p2p] ${this.cfg.stationSn} waiting up to ${remaining}ms for the level-2 key`);
@@ -14228,10 +14672,12 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
     });
     if (outcome === "timeout") {
       this.logger.debug(`[p2p] ${this.cfg.stationSn} level-2 key did not arrive within its grace`);
+      this.trace({ phase: "level2-unavailable", reason: "grace-elapsed", waitedMs: remaining });
     } else if (outcome === "terminal") {
       this.logger.debug(`[p2p] ${this.cfg.stationSn} level-2 negotiation concluded without a key`);
     } else if (outcome === "closed") {
       this.logger.debug(`[p2p] ${this.cfg.stationSn} session closed before the level-2 key arrived`);
+      this.trace({ phase: "level2-unavailable", reason: "session-closed" });
     }
     return outcome === "key";
   }
@@ -14282,6 +14728,7 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
     this.level2Negotiating = true;
     const generation = this.connectionGeneration;
     const cipherId = gatewayInfoCipherId(gwPayload);
+    this.trace({ phase: "level2-negotiating", cipherId });
     void (async () => {
       try {
         const eccPrivHex = await this.cfg.resolveCipherKey?.(cipherId);
@@ -14289,11 +14736,13 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
           return;
         if (!eccPrivHex) {
           this.logger.debug(`[p2p] ${this.cfg.stationSn} no ECC key for cipher_id ${cipherId}`);
+          this.trace({ phase: "level2-unavailable", reason: "no-cipher-key", cipherId });
           this.settleLevel2();
           return;
         }
         const key = deriveLevel2KeyFromGatewayInfo(gwPayload, eccPrivHex);
         if (!key) {
+          this.trace({ phase: "level2-unavailable", reason: "derivation-failed", cipherId });
           this.settleLevel2();
           this.emit("error", new Error(`level-2 key derivation failed (cipher_id ${cipherId})`));
           return;
@@ -14305,6 +14754,7 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
       } catch (e) {
         if (this.closed || generation !== this.connectionGeneration)
           return;
+        this.trace({ phase: "level2-unavailable", reason: "derivation-failed", cipherId });
         this.settleLevel2();
         this.emit("error", e instanceof Error ? e : new Error(String(e)));
       }
@@ -15655,19 +16105,23 @@ function parseFf09SettingsResponse(plain) {
   if (plain.length < 1)
     throw new Error("ff09: settings response too short (missing status byte)");
   const status = plain[0];
+  const fields = walkFf09Tlv(plain, 1, plain.length);
+  return { status, fields };
+}
+function walkFf09Tlv(buf, start, end) {
   const fields = /* @__PURE__ */ new Map();
-  let i = 1;
-  while (i + 2 <= plain.length) {
-    const sep = plain[i];
-    if (sep === 0)
+  let i = start;
+  while (i + 2 <= end) {
+    const tag2 = buf[i];
+    if (tag2 === 0)
       break;
-    const len = plain[i + 1];
-    if (i + 2 + len > plain.length)
+    const len = buf[i + 1];
+    if (i + 2 + len > end)
       break;
-    fields.set(sep, plain.subarray(i + 2, i + 2 + len));
+    fields.set(tag2, buf.subarray(i + 2, i + 2 + len));
     i += 2 + len;
   }
-  return { status, fields };
+  return fields;
 }
 function readFf09U16LE(field, name) {
   if (!field || field.length < 2)
@@ -16321,8 +16775,9 @@ var LiveStream = class extends EventEmitter3 {
    * Stop re-issuing the media start once this camera's own media has arrived, on an attached camera.
    *
    * The nudge differs by topology and only one branch is a ping: an own-session camera sends a small
-   * keepalive, while an attached camera has no such state and re-sends the FULL media start. On a station that
-   * serves one camera at a time that restart re-asserts this channel against whatever else is warm, so two
+   * keepalive, while an attached camera has no such state and re-sends the FULL media start. Over one session,
+   * which serves one camera at a time, that restart re-asserts this channel against whatever else is warm on
+   * it, so two
    * attached streams restart every interval and contend for the station continuously — measured on a real base
    * as a full start every 3 s from each.
    *
@@ -16370,10 +16825,12 @@ var LiveStream = class extends EventEmitter3 {
       if (!this.listening || this.kaTimer)
         return;
       if (this.opts.reassertWanted?.() === false) {
+        this.trace({ phase: "channel-silent", silentMs: stallMs, outcome: "declined" });
         this.logger.debug(`[live ch${this.channel}] no own media for ${stallMs}ms, and its owner does not want this channel re-asserted \u2014 staying quiet`);
         this.armStallWatch();
         return;
       }
+      this.trace({ phase: "channel-silent", silentMs: stallMs, outcome: "reasserted" });
       this.logger.debug(`[live ch${this.channel}] no own media for ${stallMs}ms \u2014 re-asserting this camera's channel`);
       this.sendStart();
       this.kaTimer = setInterval(() => this.sendStart(), keepAliveMs);
@@ -16487,7 +16944,7 @@ var LiveStream = class extends EventEmitter3 {
    *
    * The match is UNCONDITIONAL, however long a station serves another camera instead of this one.
    *
-   * A station serving one camera at a time hands a newly opened camera nothing but its sibling's frames until
+   * One session serving one camera at a time hands a newly opened camera nothing but its sibling's frames until
    * it switches, so "no media of my own yet, plenty for someone else" is what an ordinary handover looks like
    * and does not distinguish a station that tags differently from one that is simply busy.
    *
@@ -16594,10 +17051,12 @@ async function captureSnapshotFromShared(source, opts = {}) {
   const timeoutMs = opts.timeoutMs ?? 2e4;
   const collectMs = opts.collectMs ?? 1500;
   const skip = opts.skipKeyframes ?? 1;
+  opts.signal?.throwIfAborted();
   const consumer = source.attach();
   const primed = consumer.primed;
+  let burst;
   try {
-    const burst = await new Promise((resolve, reject) => {
+    burst = await new Promise((resolve, reject) => {
       const bufs = [];
       let sets = source.parameterSets;
       let codec = "h264";
@@ -16632,6 +17091,10 @@ async function captureSnapshotFromShared(source, opts = {}) {
         cleanup();
         reject(new LiveSnapshotUnavailableError("source-failed", `source ended before a keyframe (state: ${source.state})`));
       };
+      const onAbandoned = () => {
+        cleanup();
+        reject(opts.signal?.reason);
+      };
       const cleanup = () => {
         clearTimeout(timer);
         if (settle)
@@ -16639,19 +17102,21 @@ async function captureSnapshotFromShared(source, opts = {}) {
         consumer.off("video", onVideo);
         consumer.off("error", onError);
         consumer.off("stop", onStop);
+        opts.signal?.removeEventListener("abort", onAbandoned);
       };
       consumer.on("video", onVideo);
       consumer.on("error", onError);
       consumer.on("stop", onStop);
-    });
-    return await annexbToJpeg(primeForDecode(burst.h264, burst.sets, burst.codec), {
-      logger: opts.logger ?? noopLogger,
-      level: opts.ffmpegLevel,
-      executable: opts.ffmpegPath
+      opts.signal?.addEventListener("abort", onAbandoned, { once: true });
     });
   } finally {
     consumer.detach();
   }
+  return annexbToJpeg(primeForDecode(burst.h264, burst.sets, burst.codec), {
+    logger: opts.logger ?? noopLogger,
+    level: opts.ffmpegLevel,
+    executable: opts.ffmpegPath
+  });
 }
 async function recordClip(session, seconds, opts = {}) {
   const timeoutMs = opts.timeoutMs ?? 2e4;
@@ -17529,6 +17994,8 @@ var SharedLiveSource = class {
     this.configuredFrom = void 0;
     this.ring = [];
     this._state = state;
+    if (state === "stopped")
+      this.opts.onStopped?.();
     if (startFailed && report)
       this.opts.onStartFailed?.();
   }
@@ -17611,14 +18078,14 @@ var SessionManager = class {
     this.logger = opts.logger ?? noopLogger;
   }
   /** The live session for a station, or `undefined` if not open. */
-  get(parentSn) {
-    return this.entries.get(parentSn)?.session;
+  get(key) {
+    return this.entries.get(key)?.session;
   }
-  /** Serials of stations with a live session. */
+  /** Keys of the open sessions. */
   keys() {
     return [...this.entries].filter(([, e]) => e.session).map(([sn]) => sn);
   }
-  /** A plain `Map<parentSn, P2PSession>` snapshot of the live sessions (for `getSessions()` / tests). */
+  /** A plain `Map<key, P2PSession>` snapshot of the open sessions (for `getSessions()` / tests). */
   liveSessions() {
     const m = /* @__PURE__ */ new Map();
     for (const [sn, e] of this.entries)
@@ -17626,56 +18093,77 @@ var SessionManager = class {
         m.set(sn, e.session);
     return m;
   }
-  /** Get or create the lifecycle entry for a station. */
-  entry(parentSn) {
-    let e = this.entries.get(parentSn);
+  /**
+   * Get or create the lifecycle entry under `key`, recording which station it connects to. An existing
+   * entry keeps the station it was opened with — the key owns one connection for its lifetime, and a
+   * later caller passing a different station would otherwise re-point a live entry's power tier.
+   */
+  entry(key, station) {
+    let e = this.entries.get(key);
     if (!e) {
-      e = { retained: 0, holdTimers: /* @__PURE__ */ new Set(), idle: new Timer() };
-      this.entries.set(parentSn, e);
+      e = { station, retained: 0, holdTimers: /* @__PURE__ */ new Set(), idle: new Timer() };
+      this.entries.set(key, e);
     }
     return e;
   }
-  /** Register an already-built session for test seeding or an externally assembled connection. */
-  register(parentSn, session) {
-    this.entry(parentSn).session = session;
+  /**
+   * Register an already-built session for test seeding or an externally assembled connection.
+   *
+   * `station` defaults to the key, which is safe HERE and nowhere else in this class: the paths that open a
+   * session under a key that is not a station serial all go through {@link acquire}, which requires it. A
+   * caller seeding one under such a key must pass it.
+   */
+  register(key, session, station = key) {
+    this.entry(key, station).session = session;
   }
   /**
-   * Ensure a session to `parentSn` is open, building it via `factory` if cold. Concurrent calls for the
+   * Ensure a session to `key` is open, building it via `factory` if cold. Concurrent calls for the
    * same cold station share ONE connect (the `connecting` promise); `factory` builds + wires + awaits
    * `connect()` and resolves the connected session.
    */
-  async acquire(parentSn, factory) {
-    const e = this.entry(parentSn);
+  async acquire(key, factory, station) {
+    const e = this.entry(key, station);
     if (e.connecting) {
-      this.logger.debug(`[session ${parentSn}] connecting \u2014 joining in-flight open`);
+      this.logger.debug(`[session ${key}] connecting \u2014 joining in-flight open`);
       return e.connecting;
     }
     if (e.session)
       return e.session;
-    this.logger.debug(`[session ${parentSn}] connecting now (on demand)`);
+    this.logger.debug(`[session ${key}] connecting now (on demand)`);
     const generation = this.generation;
     const p = factory((session) => e.session = session);
     e.connecting = p;
     try {
       const session = await p;
-      if (generation !== this.generation || this.entries.get(parentSn) !== e) {
+      if (generation !== this.generation || this.entries.get(key) !== e) {
         await session.close();
-        throw new SessionSupersededError(`P2P session start superseded for station ${parentSn}`);
+        throw new SessionSupersededError(`P2P session start superseded for ${key}`);
       }
       e.session ??= session;
-      this.logger.debug(`[session ${parentSn}] connected`);
+      this.logger.debug(`[session ${key}] connected`);
       return e.session;
     } finally {
       if (e.connecting === p)
         e.connecting = void 0;
     }
   }
-  /** Add a reason to stay connected; cancels a pending idle-close. */
-  retain(parentSn) {
-    const e = this.entry(parentSn);
+  /**
+   * Add a reason to stay connected; cancels a pending idle-close.
+   *
+   * Refused when nothing is open under `key`, for the reason {@link release} gives in the other direction: a
+   * retain names a session that was acquired, and one that names nothing would file an entry with no
+   * connection behind it. {@link hold} is the path that legitimately creates one, and it opens the entry
+   * itself before retaining it.
+   */
+  retain(key) {
+    const e = this.entries.get(key);
+    if (!e) {
+      this.logger.warn(`[session ${key}] retain on a session that is not open \u2014 ignored`);
+      return;
+    }
     e.retained++;
     if (e.idle.pending)
-      this.logger.debug(`[session ${parentSn}] in use again \u2014 idle-detach cancelled`);
+      this.logger.debug(`[session ${key}] in use again \u2014 idle-detach cancelled`);
     e.idle.cancel();
   }
   /**
@@ -17686,44 +18174,50 @@ var SessionManager = class {
    * from scratch or complete a deferred reset a real viewer has not yet earned. Clamping to zero did
    * both silently.
    */
-  release(parentSn) {
-    const e = this.entries.get(parentSn);
+  release(key) {
+    const e = this.entries.get(key);
     if (!e)
       return;
     if (e.retained === 0) {
-      this.logger.warn(`[session ${parentSn}] release with nothing retained \u2014 ignored`);
+      this.logger.warn(`[session ${key}] release with nothing retained \u2014 ignored`);
       return;
     }
     e.retained -= 1;
     if (e.reset && e.retained <= e.holdTimers.size) {
-      void this.autoClose(parentSn).catch((error) => this.logger.error(`[session ${parentSn}] deferred reset failed`, error));
+      void this.autoClose(key).catch((error) => this.logger.error(`[session ${key}] deferred reset failed`, error));
       return;
     }
     if (e.retained === 0)
-      this.armIdle(parentSn, e);
+      this.armIdle(key, e);
   }
   /**
    * Hold a session warm for `commandKeepAliveMs` after a control command, then release. A burst of
    * commands each re-holds before the previous release fires, so the session never idles mid-burst.
    */
-  bumpCommand(parentSn) {
-    this.hold(parentSn, this.opts.commandKeepAliveMs ?? COMMAND_KEEPALIVE_MS);
+  bumpCommand(key, station) {
+    this.hold(key, this.opts.commandKeepAliveMs ?? COMMAND_KEEPALIVE_MS, station);
   }
   /**
-   * Retain a station and release it again after `ms` — the primitive behind command-keepalive and event
+   * Retain a session and release it again after `ms` — the primitive behind command-keepalive and event
    * pre-warm, and the only way to hold one open without an attachment to release it.
    *
+   * `station` is required rather than defaulted from the key, because this is the one path that can
+   * CREATE an entry: a pre-warm takes its hold before the open. An entry filed under a media key with
+   * that key as its own station would be asked for the power tier of a serial that does not exist, be
+   * answered `wired`, and never idle-detach — which on a battery station is the drain this class exists
+   * to prevent, and is invisible until the battery is flat.
+   *
    * The timer is owned by the entry, so {@link discard} cancels it. That ownership is the point: keyed
    * only by serial, an expiring hold would otherwise outlive the entry it was taken on and release a
    * retain counted by the SUCCESSOR entry — dropping a live viewer's count and arming an idle-detach
    * underneath it.
    */
-  hold(parentSn, ms) {
-    const entry = this.entry(parentSn);
-    this.retain(parentSn);
+  hold(key, ms, station) {
+    const entry = this.entry(key, station);
+    this.retain(key);
     const timer = setTimeout(() => {
       entry.holdTimers.delete(timer);
-      this.release(parentSn);
+      this.release(key);
     }, ms);
     timer.unref?.();
     entry.holdTimers.add(timer);
@@ -17732,29 +18226,29 @@ var SessionManager = class {
    * Arm the idle-close timer for a station whose retain count just reached zero. A wired station with
    * an infinite window is left persistent (no timer). Any subsequent {@link retain} cancels it.
    */
-  armIdle(parentSn, e) {
+  armIdle(key, e) {
     e.idle.cancel();
-    if ((this.opts.poweredFor?.(parentSn) ?? "wired") !== "battery") {
-      this.logger.debug(`[session ${parentSn}] idle (nothing retained) \u2014 staying persistent (wired)`);
+    if ((this.opts.poweredFor?.(e.station) ?? "wired") !== "battery") {
+      this.logger.debug(`[session ${key}] idle (nothing retained) \u2014 staying persistent (wired)`);
       return;
     }
     const idleMs = this.opts.batteryIdleMs ?? BATTERY_IDLE_MS;
-    this.logger.debug(`[session ${parentSn}] idle (nothing retained) \u2014 detaching in ${idleMs}ms unless reused`);
-    e.idle.arm(idleMs, () => this.onIdle(parentSn));
+    this.logger.debug(`[session ${key}] idle (nothing retained) \u2014 detaching in ${idleMs}ms unless reused`);
+    e.idle.arm(idleMs, () => this.onIdle(key));
   }
   /**
    * Close a station's session once its idle window elapses with nothing retained, letting the device sleep.
    * Re-checks the count first (activity between the timer firing and now re-arms instead). Dropping the
    * entry here and the session's own `close` → {@link remove} are both idempotent.
    */
-  onIdle(parentSn) {
-    const e = this.entries.get(parentSn);
+  onIdle(key) {
+    const e = this.entries.get(key);
     if (!e)
       return;
     if (e.retained > 0)
       return;
-    this.logger.debug(`[session ${parentSn}] idle window elapsed \u2014 disconnecting now (device can sleep)`);
-    void this.autoClose(parentSn).catch((error) => this.logger.error(`[session ${parentSn}] idle detach failed`, error));
+    this.logger.debug(`[session ${key}] idle window elapsed \u2014 disconnecting now (device can sleep)`);
+    void this.autoClose(key).catch((error) => this.logger.error(`[session ${key}] idle detach failed`, error));
   }
   /**
    * Close a station the manager itself decided to close, and announce it.
@@ -17772,23 +18266,23 @@ var SessionManager = class {
    * An entry that never carried a session is still torn down, but silently: a pre-warm whose open failed
    * leaves one behind, and announcing it would report a station closed that was never reported open.
    */
-  async autoClose(parentSn) {
-    const entry = this.discard(parentSn);
+  async autoClose(key) {
+    const entry = this.discard(key);
     if (!entry)
       return;
     if (entry.session)
-      this.opts.onAutoClose?.(parentSn);
+      this.opts.onAutoClose?.(key);
     await this.closeEntry(entry);
   }
   /** Drop a station's entry + timer (called from the session's `close` handler). Idempotent. */
-  remove(parentSn) {
-    const entry = this.discard(parentSn);
+  remove(key) {
+    const entry = this.discard(key);
     if (entry)
       this.settleReset(entry);
   }
   /** Close one station now and discard its lifecycle entry. */
-  async close(parentSn) {
-    const entry = this.discard(parentSn);
+  async close(key) {
+    const entry = this.discard(key);
     if (entry)
       await this.closeEntry(entry);
   }
@@ -17802,12 +18296,12 @@ var SessionManager = class {
    * Both branches close through {@link autoClose}: the caller asked for a recycle, not for the station's
    * live sources to be dropped, so it does not clean up after one — exactly like the idle path.
    */
-  resetWhenUnused(parentSn) {
-    const entry = this.entries.get(parentSn);
+  resetWhenUnused(key) {
+    const entry = this.entries.get(key);
     if (!entry)
       return Promise.resolve();
     if (entry.retained <= entry.holdTimers.size)
-      return this.autoClose(parentSn);
+      return this.autoClose(key);
     entry.reset ??= Promise.withResolvers();
     return entry.reset.promise;
   }
@@ -17839,22 +18333,22 @@ var SessionManager = class {
    * discarded entry owns no live timer, which is what stops a deferred release from landing on whatever
    * entry next occupies this serial.
    */
-  discard(parentSn) {
-    const entry = this.entries.get(parentSn);
+  discard(key) {
+    const entry = this.entries.get(key);
     if (!entry)
       return void 0;
     entry.idle.cancel();
     for (const timer of entry.holdTimers)
       clearTimeout(timer);
     entry.holdTimers.clear();
-    this.entries.delete(parentSn);
+    this.entries.delete(key);
     return entry;
   }
   /** Close every session and clear all timers. */
   async closeAll() {
     this.generation++;
-    const entries = [...this.entries.keys()].flatMap((parentSn) => {
-      const entry = this.discard(parentSn);
+    const entries = [...this.entries.keys()].flatMap((key) => {
+      const entry = this.discard(key);
       return entry ? [entry] : [];
     });
     const results = await Promise.allSettled(entries.map((entry) => this.closeEntry(entry)));
@@ -18858,6 +19352,11 @@ function abortable(work, signal) {
 }
 var LEVEL2_GRACE_MS = 25e3;
 var LEVEL2_SETTLE_MS = 8e3;
+var P2P_STATION_WAITS = {
+  connect: CONNECT_WAIT_MS,
+  level2Grace: LEVEL2_GRACE_MS,
+  level2Settle: LEVEL2_SETTLE_MS
+};
 var RTSP_URL_READ_TIMEOUT_MS = 12e3;
 var SHARED_LIVE_OPT_KEYS = [
   "eccPrivateKey",
@@ -18875,7 +19374,7 @@ function sameLiveOpt(a, b) {
 }
 var P2PCommandRouter = class _P2PCommandRouter {
   deps;
-  /** Per-station P2P session lifecycle: on-demand open + battery-aware idle-detach + refcount. */
+  /** P2P session lifecycle: on-demand open + battery-aware idle-detach + refcount, per session key. */
   manager;
   /** Error objects already forwarded while a station startup awaits the same session signal. */
   reportedErrors = /* @__PURE__ */ new WeakSet();
@@ -18883,6 +19382,21 @@ var P2PCommandRouter = class _P2PCommandRouter {
   liveSources = /* @__PURE__ */ new Map();
   /** The options each live source was built from, so a later caller's conflicting ones can be reported. */
   liveSourceOpts = /* @__PURE__ */ new Map();
+  /**
+   * The session each live source pulls over — the station's own serial, or the source's own media
+   * session key.
+   *
+   * Written the instant the choice is made and BEFORE the connection is opened, which is what makes it
+   * a reservation rather than a record. Two cameras started together (the four-tile case this feature
+   * exists for) would otherwise both find the station's session free: a consumer attaches only after
+   * `sharedLiveSourceFor` returns, so neither is visible to the other through consumer counts, and both
+   * would take the shared connection and contend on it.
+   *
+   * A station entry is kept as well as a media one, because "is the station's own session already
+   * claimed" is the question being asked, and an entry that is present but not yet in
+   * {@link liveSources} is a claim in flight.
+   */
+  liveSessionKeys = /* @__PURE__ */ new Map();
   /**
    * The open talkback per `${parentSn}:${channel}`, if any. The device plays one audio stream at a
    * time and the session carries one audio sequence, so this path is exclusive where a live pull is
@@ -18896,7 +19410,7 @@ var P2PCommandRouter = class _P2PCommandRouter {
     this.manager = new SessionManager({
       poweredFor: deps.poweredFor,
       logger: deps.logger,
-      onAutoClose: (parentSn) => this.tearDownStation(parentSn),
+      onAutoClose: (key) => _P2PCommandRouter.isMediaSessionKey(key) ? this.tearDownMediaSession(key) : this.tearDownStation(key),
       ...deps.sessionIdle
     });
   }
@@ -18909,6 +19423,14 @@ var P2PCommandRouter = class _P2PCommandRouter {
     }
     return normalized;
   }
+  /**
+   * Emit a live trace under a station session's handle, for work this router does ON that session before
+   * the session itself records anything — reaching the station, and resolving what a device is on it. Same
+   * handle as everything the session goes on to trace, which is what groups one attempt.
+   */
+  traceOnStation(session, trace) {
+    traceLiveStart(this.deps.logger ?? noopLogger, trace, session.traceId);
+  }
   /**
    * Whether this transport stack drives `dev`'s `ff09-*` commands — true when the device has its own
    * usable P2P endpoint (a non-empty `p2p_did`). The command sink asks each stack this to route a
@@ -18920,7 +19442,10 @@ var P2PCommandRouter = class _P2PCommandRouter {
   static claimsDevice(dev) {
     return typeof dev.p2pDid === "string" && dev.p2pDid.length > 0;
   }
-  /** Stations with a live P2P session (a snapshot; mutate via the lifecycle methods, not this map). */
+  /**
+   * The open P2P sessions by key — a station's own under its serial, a camera's media session under
+   * `<stationSn>#live:<channel>` (a snapshot; mutate via the lifecycle methods, not this map).
+   */
   getSessions() {
     return this.manager.liveSessions();
   }
@@ -18932,16 +19457,16 @@ var P2PCommandRouter = class _P2PCommandRouter {
    *
    * One hold, taken before the open so a slow connect can't idle-close mid-flight. It expires on its
    * own, which arms the station's idle window rather than closing the session, per {@link PREWARM_MS}.
-   * A second hold after the open would buy nothing: {@link openStation} returns once the socket is bound
+   * A second hold after the open would buy nothing: {@link openSession} returns once the socket is bound
    * and the lookups are away, not once the peer has answered, so both would expire together.
    *
    * Best-effort — a failed open surfaces via `onError`. A {@link SessionSupersededError} does not: the
    * session was deliberately closed underneath a speculative open, which is not a fault to report.
    */
   async prewarm(parentSn, ms = PREWARM_MS) {
-    this.manager.hold(parentSn, ms);
+    this.manager.hold(parentSn, ms, parentSn);
     try {
-      await this.openStation(parentSn);
+      await this.openSession(parentSn, parentSn);
     } catch (e) {
       if (e instanceof SessionSupersededError)
         return;
@@ -18958,6 +19483,7 @@ var P2PCommandRouter = class _P2PCommandRouter {
       src.dispose();
     this.liveSources.clear();
     this.liveSourceOpts.clear();
+    this.liveSessionKeys.clear();
     await this.manager.closeAll();
   }
   /** This serial's loaded record, or `undefined` — the one place the cached list is searched by serial. */
@@ -18999,8 +19525,55 @@ var P2PCommandRouter = class _P2PCommandRouter {
    * when present, else the freshest private IP in the record ({@link freshestLanIp}) — so P2P works
    * on-LAN even when broadcast is blocked (AP isolation) or the record's `ip_addr` went stale.
    */
-  async openStation(parentSn) {
-    return this.manager.acquire(parentSn, async (register) => {
+  /**
+   * The key a camera's own media session is filed under, distinct from every station serial because a
+   * serial contains no `#`.
+   */
+  static mediaSessionKey(parentSn, channel) {
+    return `${parentSn}#live:${channel}`;
+  }
+  /** Whether `key` names a media session rather than a station's own. */
+  static isMediaSessionKey(key) {
+    return key.includes("#live:");
+  }
+  /**
+   * Open (or reuse) a SECOND connection to a station, carrying one camera's media and nothing else.
+   *
+   * One session serves one camera: a station fans its cameras over a session and answers the most recent
+   * start on it, so two cameras down one tunnel take it from each other in turn. Another connection is
+   * how a station serves another camera.
+   *
+   * The hardware was shown to do this before the SDK did. A first-party display showing four tiles was
+   * captured opening one PPCS session per camera, with three cameras' video arriving in the same second
+   * at 2304x1296, 1600x1200 and 3840x2160 — three geometries at once, which no composed stream can be.
+   * Reproduced here afterwards on a base carrying two attached cameras, one at 3840x2160, both holding
+   * full frame rate at once over a session each, where the same pair down one session could only take
+   * turns.
+   *
+   * It carries media alone. The station announces its state to every client that connects, so a session
+   * wired to the same fan-out would report every event a second time; {@link makeSession} leaves this one
+   * unannounced, and the station's own session stays the single source of connection state, control
+   * notifications and frames.
+   *
+   * The level-2 key is waited for here on the same terms the station's own session gets, because a
+   * connection is not usable for this without one: an attached camera's media start has no level-1 form,
+   * so a start issued before the key arrives is dropped as `media-command-unsent`, and the stream then
+   * shows nothing until a later keepalive tick happens to find the key. A connected session that cannot
+   * carry the start is not a connected session, so this refuses rather than returning one.
+   */
+  async openMediaSession(parentSn, channel, signal) {
+    const session = await this.openSession(_P2PCommandRouter.mediaSessionKey(parentSn, channel), parentSn);
+    let ready = await abortable(session.awaitLevel2Key(LEVEL2_GRACE_MS, "call"), signal);
+    if (!ready && session.repromptLevel2Key()) {
+      ready = await abortable(session.awaitLevel2Key(LEVEL2_GRACE_MS, "call"), signal);
+    }
+    if (!ready)
+      throw new StationKeyUnavailableError(parentSn);
+    return session;
+  }
+  /** Open (or reuse) the session filed under `key`, dialling `parentSn`'s endpoint. */
+  async openSession(key, parentSn) {
+    return this.manager.acquire(key, async (register) => {
       const stationDev = this.recordFor(parentSn);
       if (!stationDev)
         throw new Error(`station ${parentSn} is not in the device list`);
@@ -19015,11 +19588,11 @@ var P2PCommandRouter = class _P2PCommandRouter {
         this.deps.onError(e instanceof Error ? e : new Error(String(e)));
       }
       const localAddress = this.deps.localAddresses?.[parentSn] ?? freshestLanIp(raw);
-      const session = this.makeSession(parentSn, did, raw, dskKey, localAddress);
+      const session = this.makeSession(parentSn, did, raw, dskKey, localAddress, key, key === parentSn);
       register(session);
       await session.connect();
       return session;
-    });
+    }, parentSn);
   }
   /**
    * Build + wire a {@link P2PSession} for a station (NOT yet connected — the caller awaits `connect()`).
@@ -19032,8 +19605,14 @@ var P2PCommandRouter = class _P2PCommandRouter {
    *
    * The `close` handler drops the session from the {@link SessionManager} and disposes any shared live
    * source riding this station (consumers get `stop`; a later attach rebuilds via the factory).
+   *
+   * A session filed under a media key is wired for errors and its own teardown ONLY. Connection state,
+   * level-2 readiness and inbound frames all reach the owner through the station's own session, and a
+   * station announces those to every client that connects — so fanning a second connection's copies out
+   * under the same station serial would report each one twice, and a close would tear down the station
+   * while its own session is still serving.
    */
-  makeSession(stationSn, did, raw, dskKey, localAddress) {
+  makeSession(stationSn, did, raw, dskKey, localAddress, key, announces) {
     const conn = raw?.p2p_conn ?? raw?.app_conn;
     const adminUserId = raw?.member?.admin_user_id || this.deps.mega.auth?.userId || "";
     const session = new P2PSession({
@@ -19049,7 +19628,15 @@ var P2PCommandRouter = class _P2PCommandRouter {
         let ecc;
         try {
           const ciphers = await this.deps.mega.getCiphers([cipherId], adminUserId, stationSn);
-          ecc = ciphers.find((c) => Number(c.cipher_id) === cipherId)?.ecc_private_key ?? ciphers[0]?.ecc_private_key;
+          ecc = ciphers.find((c) => Number(c.cipher_id) === cipherId)?.ecc_private_key;
+          if (ecc === void 0 && ciphers[0]?.ecc_private_key !== void 0) {
+            ecc = ciphers[0].ecc_private_key;
+            this.traceOnStation(session, {
+              phase: "cipher-fallback",
+              cipherId,
+              answeredCipherId: Number(ciphers[0].cipher_id)
+            });
+          }
         } catch (e) {
           this.deps.onError(e instanceof Error ? e : new Error(String(e)));
         }
@@ -19059,6 +19646,14 @@ var P2PCommandRouter = class _P2PCommandRouter {
       },
       logger: this.deps.logger ?? noopLogger
     });
+    session.on("error", (e) => this.reportError(e));
+    if (!announces) {
+      session.on("close", () => {
+        if (this.manager.get(key) === session)
+          this.tearDownMediaSession(key);
+      });
+      return session;
+    }
     session.on("connect", () => {
       if (this.manager.get(stationSn) === session)
         this.deps.onConnect(stationSn);
@@ -19068,7 +19663,6 @@ var P2PCommandRouter = class _P2PCommandRouter {
         return;
       this.tearDownStation(stationSn);
     });
-    session.on("error", (e) => this.reportError(e));
     session.on("level2Ready", ({ cipherId }) => this.deps.onLevel2Ready(stationSn, cipherId));
     session.on("data", (f) => this.deps.onFrame(stationSn, f));
     return session;
@@ -19079,7 +19673,7 @@ var P2PCommandRouter = class _P2PCommandRouter {
    */
   async ensureStation(parentSn, signal) {
     try {
-      const session = await this.openStation(parentSn);
+      const session = await this.openSession(parentSn, parentSn);
       if (session.isConnected)
         return;
       await new Promise((resolve, reject) => {
@@ -19127,7 +19721,7 @@ var P2PCommandRouter = class _P2PCommandRouter {
     const dev = this.recordFor(sn);
     if (!dev)
       throw new Error(`device ${sn} not found`);
-    await this.openStation(this.stationKeyFor(dev));
+    await this.openSession(this.stationKeyFor(dev), this.stationKeyFor(dev));
     return dev;
   }
   /**
@@ -19203,19 +19797,19 @@ var P2PCommandRouter = class _P2PCommandRouter {
     return {
       snapshotLive: async (opts) => {
         const source = await this.sharedLiveSourceFor(sn, opts ?? {});
-        return abortable(captureSnapshotFromShared(source, {
+        return captureSnapshotFromShared(source, {
           ...opts,
           logger: this.deps.logger ?? noopLogger,
           ffmpegLevel: this.deps.ffmpegLogLevel,
           ffmpegPath: this.deps.ffmpegPath
-        }), opts?.signal);
+        });
       },
       live: async (opts) => {
-        const source = await this.sharedLiveSourceFor(sn, opts);
+        const source = await this.sharedLiveSourceFor(sn, opts, true);
         return this.attachUnlessAborted(source, opts?.signal);
       },
       openReadable: async (opts) => {
-        const source = await this.sharedLiveSourceFor(sn, opts ?? {});
+        const source = await this.sharedLiveSourceFor(sn, opts ?? {}, true);
         return openReadableFromConsumer(this.attachUnlessAborted(source, opts?.signal), opts);
       },
       recordFragments: (opts) => this.recordFragments(sn, opts),
@@ -19356,10 +19950,17 @@ var P2PCommandRouter = class _P2PCommandRouter {
    * {@link releaseLingeringSiblings}. A pull with consumers is never touched. The release runs before the
    * reuse branch, so a reuse frees the station as a cold start does.
    *
+   * `mayOpenOwnSession` decides whether a camera that finds the station's own session claimed may open a
+   * connection of its own for it. Only the continuous-pull egresses pass it. A still must not: it wants one
+   * frame, and a socket plus a level-2 negotiation per thumbnail is a cost a tile refresh cannot justify —
+   * so a still asked for while a sibling is being watched contends as it always did, and the caller's
+   * retained image answers it. A live view still outranks a tile; what changed is that two live views no
+   * longer have to outrank each other.
+   *
    * The session goes into a {@link HeldSession} cell, so it can be replaced under a source that stays in
    * place.
    */
-  async sharedLiveSourceFor(sn, opts = {}) {
+  async sharedLiveSourceFor(sn, opts = {}, mayOpenOwnSession = false) {
     const { session, parentSn, channel, accountId, homeBaseAttached } = await this.resolveSession(sn, {
       waitLevel2: "soft",
       requireLevel2ForAttached: true,
@@ -19372,14 +19973,19 @@ var P2PCommandRouter = class _P2PCommandRouter {
       source = void 0;
     }
     this.releaseLingeringSiblings(parentSn, channel);
-    if (homeBaseAttached) {
-      const serving = this.occupiedSiblingChannel(parentSn, key);
-      if (serving !== void 0)
-        throw new StationBusyError(serving);
-    }
     if (!source) {
       const logger = this.deps.logger ?? noopLogger;
-      const held = { session };
+      const sessionKey = mayOpenOwnSession && homeBaseAttached && this.stationSessionInUse(parentSn, key) ? _P2PCommandRouter.mediaSessionKey(parentSn, channel) : parentSn;
+      this.liveSessionKeys.set(key, sessionKey);
+      let held;
+      try {
+        held = {
+          session: sessionKey === parentSn ? session : await this.openMediaSession(parentSn, channel, opts.signal)
+        };
+      } catch (error) {
+        this.liveSessionKeys.delete(key);
+        throw error;
+      }
       source = new SharedLiveSource({
         makeStream: (ctx) => new LiveStream(held.session, {
           channel,
@@ -19397,8 +20003,9 @@ var P2PCommandRouter = class _P2PCommandRouter {
         budgetGraceMs: opts.budgetGraceMs,
         logger,
         label: key,
-        onActive: () => this.manager.retain(parentSn),
-        onIdle: () => this.manager.release(parentSn),
+        onActive: () => this.manager.retain(sessionKey),
+        onIdle: () => this.manager.release(sessionKey),
+        onStopped: () => this.closeMediaSession(key),
         onStartFailed: () => this.onLiveStartFailed(sn, key),
         onSessionUnreachable: () => this.replaceUnreachableSession(sn, key, held)
       });
@@ -19413,14 +20020,25 @@ var P2PCommandRouter = class _P2PCommandRouter {
    * Tear down any pull on this station that is lingering for ANOTHER camera, before starting this one.
    *
    * A lingering pull has no consumers but is still held open, and on an attached camera holding it open means
-   * re-sending the full media start every keepalive tick. Two channels doing that at once on a station that
-   * serves one camera at a time leaves the new stream receiving nothing but the old camera's frames for as
-   * long as the linger lasts.
+   * re-sending the full media start every keepalive tick. Two channels doing that at once over ONE session,
+   * which serves one camera at a time, leaves the new stream receiving nothing but the old camera's frames
+   * for as long as the linger lasts.
    *
    * Several cameras genuinely being WATCHED together are never disturbed — the linger exists to make
    * re-opening the SAME camera cheap, and it keeps doing that. What it may not do is keep a camera nobody is
    * looking at competing with one somebody just asked for.
    *
+   * An `idle` source is skipped, because it is not a linger and holds nothing: it has never warmed, so it
+   * has sent no media start and is competing for nothing. Without that, two cameras opened at the same
+   * moment destroy each other — the second finds the first's source built but not yet attached to, reads
+   * zero consumers as a linger, and disposes the source its caller is holding. Which is the four-tile case
+   * this whole path exists for.
+   *
+   * A sibling lingering on a connection of its OWN is skipped for the same reason stated the other way: the
+   * contention this releases is contention over one session, and that sibling is not on this one. Dropping
+   * it would close a socket and throw away the cheap re-attach the linger exists to provide, to relieve a
+   * competition that is not happening.
+   *
    * A snapshot tile is nobody looking. Opening a live view in the Home app takes that cell fullscreen, so the
    * pulls refreshing the other cells are off screen, yet each goes on re-issuing its own media start every
    * retry tick — measured as four pulls warming together off one HomeBase, a live request landing 1.4 s later,
@@ -19434,28 +20052,49 @@ var P2PCommandRouter = class _P2PCommandRouter {
     for (const [key, source] of [...this.liveSources]) {
       if (!key.startsWith(`${parentSn}:`) || key === own || source.consumerCount > 0)
         continue;
-      (this.deps.logger ?? noopLogger).debug(`[live ${key}] releasing a pull nothing is attached to so ${own} can start \u2014 one station serves one camera at a time`);
+      if (source.state === "idle")
+        continue;
+      if (this.liveSessionKeys.get(key) !== parentSn)
+        continue;
+      (this.deps.logger ?? noopLogger).debug(`[live ${key}] releasing a pull nothing is attached to so ${own} can start \u2014 one session serves one camera at a time`);
       this.dropLiveSource(key);
     }
   }
   /**
-   * The channel a live viewer already holds on this station, if any, ignoring `key` itself.
+   * Whether another camera has already claimed this station's OWN session, ignoring `key`.
+   *
+   * The question a newcomer has to answer is not whether the station is busy — it can serve one camera
+   * per connection — but whether the connection it would otherwise share is taken. A camera on a media
+   * session of its own does not hold this one, so a station whose first camera has since stopped hands
+   * its own session to the next arrival rather than opening a socket beside an idle one.
+   *
+   * A claim counts while its source is still `idle`, source or no source. That is a start that has been
+   * handed to its caller but not yet attached to, and it is the only state in which two cameras asked for
+   * at the same moment can see each other: consumers attach after this method has already run for both.
+   *
+   * The cost is that a pull genuinely abandoned before its first attach goes on holding the station's own
+   * session, and the next camera pays for a connection of its own rather than reclaiming it. That is one
+   * socket against destroying a start someone is waiting on, which is not a close trade.
    *
    * A stopped source is skipped even when consumers are still attached to it. A failed start fails its
    * consumers without detaching them, so a caller still holding a dead handle leaves the count non-zero,
-   * and counting that as a viewer would refuse every later stream on the station until the client
-   * restarted. Only a source that can still deliver holds a place.
+   * and counting that as a viewer would put every later camera on a connection of its own until the
+   * client restarted. Only a source that can still deliver holds a place.
    */
-  occupiedSiblingChannel(parentSn, key) {
-    for (const [siblingKey, sibling] of this.liveSources) {
-      if (siblingKey === key || !siblingKey.startsWith(`${parentSn}:`))
+  stationSessionInUse(parentSn, key) {
+    for (const [siblingKey, sessionKey] of this.liveSessionKeys) {
+      if (siblingKey === key || sessionKey !== parentSn)
+        continue;
+      const sibling = this.liveSources.get(siblingKey);
+      if (!sibling)
+        return true;
+      if (sibling.state === "stopped")
         continue;
-      if (sibling.state === "stopped" || sibling.consumerCount === 0)
+      if (sibling.state !== "idle" && sibling.consumerCount === 0)
         continue;
-      const channel = Number(siblingKey.slice(parentSn.length + 1));
-      return Number.isFinite(channel) ? channel : void 0;
+      return true;
     }
-    return void 0;
+    return false;
   }
   /**
    * Whether the stream on `key` should re-assert its channel to hold the station.
@@ -19466,8 +20105,8 @@ var P2PCommandRouter = class _P2PCommandRouter {
    *  - Nothing attached: no. There is nobody to take the station for.
    *  - A live viewer attached: yes. That is the picture someone is looking at.
    *  - Held only for stills, while a sibling on this station has a live viewer: no. A still refreshes a
-   *    tile that is off screen while the live view is on it, and a station serving one camera at a time
-   *    cannot satisfy both. Measured: a still on a sibling halved a live view's frame rate for as long as
+   *    tile that is off screen while the live view is on it, and one session serving one camera at a time
+   *    cannot satisfy both — and a still does not open a connection of its own. Measured: a still on a sibling halved a live view's frame rate for as long as
    *    it took, and its own capture then took fifteen seconds because it was contending.
    *
    * A still with no live sibling re-asserts, so a tile refreshing on a quiet station is
@@ -19489,7 +20128,13 @@ var P2PCommandRouter = class _P2PCommandRouter {
     }
     return consumer;
   }
-  /** Dispose one cached live source and forget it, so the next acquisition builds a fresh one. */
+  /**
+   * Dispose one cached live source and forget it, so the next acquisition builds a fresh one. Its claim
+   * on a session goes with it, and a media session opened for this source alone is closed: nothing else
+   * can reach that connection, so leaving it open would hold a socket and a station keepalive for a
+   * camera no longer being pulled. A claim on the STATION's own session is released without closing
+   * anything — that connection carries the station's control traffic and outlives any one camera.
+   */
   dropLiveSource(key) {
     const source = this.liveSources.get(key);
     if (!source)
@@ -19497,6 +20142,34 @@ var P2PCommandRouter = class _P2PCommandRouter {
     source.dispose();
     this.liveSources.delete(key);
     this.liveSourceOpts.delete(key);
+    this.closeMediaSession(key);
+  }
+  /** Close and forget the media session `key`'s live source owned, if it owned one. */
+  closeMediaSession(key) {
+    const sessionKey = this.liveSessionKeys.get(key);
+    if (sessionKey === void 0)
+      return;
+    this.liveSessionKeys.delete(key);
+    if (!_P2PCommandRouter.isMediaSessionKey(sessionKey))
+      return;
+    void this.manager.close(sessionKey).catch((error) => this.reportError(error instanceof Error ? error : new Error(String(error))));
+  }
+  /**
+   * Drop the live source a media session was carrying, after that session closed on its own.
+   *
+   * The source holds the closed connection and never re-resolves it, so it can only answer its retained
+   * keyframe and then fail on its warm-up deadline. Its consumers get `stop`, and the next attach builds
+   * a fresh source — which, finding the station busy again, opens a fresh media session for it.
+   */
+  tearDownMediaSession(sessionKey) {
+    this.manager.remove(sessionKey);
+    for (const [key, owned] of this.liveSessionKeys) {
+      if (owned === sessionKey) {
+        this.liveSessionKeys.delete(key);
+        this.dropLiveSource(key);
+        return;
+      }
+    }
   }
   /**
    * Drop everything that was riding a station's session, and report the station closed.
@@ -19680,9 +20353,9 @@ var P2PCommandRouter = class _P2PCommandRouter {
           s.sendStringPayloadCommand(P2P_ENVELOPE.CONTROL_PAYLOAD, json, ch);
           return Promise.resolve();
         },
-        l2: async ({ session: s, channel: ch }) => {
+        l2: async ({ session: s, channel: ch, parentSn }) => {
           if (!await s.awaitLevel2Key(LEVEL2_GRACE_MS, "call")) {
-            throw new Error(`level-2 key not ready for ${sn} \u2014 cannot query`);
+            throw new StationKeyUnavailableError(parentSn);
           }
           s.sendRawLevel2(json, ch, P2P_ENVELOPE.CONTROL_PAYLOAD);
         }
@@ -19840,24 +20513,38 @@ var P2PCommandRouter = class _P2PCommandRouter {
     const parentSn = homeBaseAttached ? raw.parent_sn : dev.stationSn ?? sn;
     const session = this.manager.get(parentSn) ?? this.manager.get(sn) ?? (dev.stationSn ? this.manager.get(dev.stationSn) : void 0);
     if (!session) {
-      throw new Error(`no P2P session for ${sn} (known: ${this.manager.keys().join(", ") || "none"})`);
+      const stations = this.manager.keys().filter((k) => !_P2PCommandRouter.isMediaSessionKey(k));
+      throw new Error(`no P2P session for ${sn} (known: ${stations.join(", ") || "none"})`);
     }
     if (session.pathAnswering === false && !rebuilt) {
       (this.deps.logger ?? noopLogger).debug(`[p2p] ${parentSn} path stopped answering \u2014 rebuilding before use`);
       await this.manager.close(parentSn).catch((error) => this.reportError(error instanceof Error ? error : new Error(String(error))));
       return await this.resolveSession(sn, opts, true);
     }
-    this.manager.bumpCommand(parentSn);
+    this.manager.bumpCommand(parentSn, parentSn);
     const channel = typeof raw.device_channel === "number" ? raw.device_channel : 0;
-    const accountId = raw.member?.admin_user_id ?? this.deps.mega.auth?.userId ?? "";
+    const stationAdminId = raw.member?.admin_user_id;
+    const accountId = stationAdminId ?? this.deps.mega.auth?.userId ?? "";
     const t0 = Date.now();
-    while (!session.isConnected && Date.now() - t0 < CONNECT_WAIT_MS) {
-      opts.signal?.throwIfAborted();
-      await sleep2(200);
+    let waitedMs = 0;
+    if (!session.isConnected) {
+      this.traceOnStation(session, { phase: "session-connect-wait", waitMs: CONNECT_WAIT_MS });
+      while (!session.isConnected && Date.now() - t0 < CONNECT_WAIT_MS) {
+        opts.signal?.throwIfAborted();
+        await sleep2(200);
+      }
+      waitedMs = Date.now() - t0;
+      this.traceOnStation(session, session.isConnected ? { phase: "session-connected", waitedMs } : { phase: "session-unreachable", waitedMs });
     }
     opts.signal?.throwIfAborted();
     if (!session.isConnected)
-      throw new Error(`P2P session for ${parentSn} did not connect`);
+      throw new StationUnreachableError(parentSn, waitedMs);
+    this.traceOnStation(session, {
+      phase: "station-resolved",
+      topology: homeBaseAttached ? "attached" : "own",
+      channel,
+      stationAdmin: typeof stationAdminId !== "string" ? "unstated" : stationAdminId === this.deps.mega.auth?.userId ? "self" : "other"
+    });
     if (opts.waitLevel2) {
       if (opts.waitLevel2 === "settle") {
         await abortable(session.awaitLevel2Key(LEVEL2_SETTLE_MS, "session"), opts.signal);
@@ -19871,7 +20558,7 @@ var P2PCommandRouter = class _P2PCommandRouter {
         ready = await abortable(session.awaitLevel2Key(LEVEL2_GRACE_MS, "call"), opts.signal);
       }
       if (!ready)
-        throw new Error(`level-2 key not ready for ${parentSn}`);
+        throw new StationKeyUnavailableError(parentSn);
     }
     return { session, parentSn, channel, accountId, homeBaseAttached };
   }
@@ -21358,8 +22045,8 @@ function rsaEncryptPassword(password, publicKeyDecimal, exponentDecimal) {
     },
     format: "jwk"
   });
-  const md5Hex = createHash6("md5").update(password).digest("hex");
-  return publicEncrypt({ key: rsaKey, padding: constants2.RSA_PKCS1_PADDING }, Buffer.from(md5Hex)).toString("hex");
+  const md5Hex2 = createHash6("md5").update(password).digest("hex");
+  return publicEncrypt({ key: rsaKey, padding: constants2.RSA_PKCS1_PADDING }, Buffer.from(md5Hex2)).toString("hex");
 }
 var TuyaClient = class {
   signer;
@@ -23986,8 +24673,8 @@ var EufyMega = class extends EventEmitter9 {
    * @example
    * ```ts
    * const res = await eufy.login();
-   * if (res.status === "captcha") await eufy.solveCaptcha(await ask(res.image));
-   * else if (res.status === "2fa") await eufy.submitVerifyCode(await ask());
+   * if (res.status === "captcha") await eufy.solveCaptcha(await promptUser(res.image));
+   * else if (res.status === "2fa") await eufy.submitVerifyCode(await promptUser());
    * ```
    */
   async login(opts = {}) {
@@ -24141,9 +24828,9 @@ var EufyMega = class extends EventEmitter9 {
   /**
    * Combine explicit P2P media with the optional passive push-thumbnail provider.
    *
-   * The retained still also becomes the answer for a live still that could not be captured. A station
-   * serves one camera at a time and a live view outranks a tile, so a still asked for while a sibling is
-   * being watched is refused at the transport. Answering the retained bytes answers the read rather than
+   * The retained still also becomes the answer for a live still that could not be captured. One session
+   * serves one camera at a time and a live view outranks a tile — a still does not open a connection of its
+   * own — so a still asked for while a sibling is being watched is refused at the transport. Answering the retained bytes answers the read rather than
    * failing it, marked {@link MediaProvider.snapshotLive} `retained` so the caller knows they are not
    * current. With nothing retained the refusal stands.
    */
@@ -24312,7 +24999,7 @@ var EufyMega = class extends EventEmitter9 {
    * @example
    * ```ts
    * const dev = await eufy.getDevice(sn);
-   * if (dev.has("camera")) await dev.camera()?.snapshotStored();
+   * if (dev.has("camera")) await dev.camera?.()?.snapshotStored?.();
    * console.log(dev.getProperty("battery"));
    * ```
    */
@@ -24896,10 +25583,15 @@ var EufyMega = class extends EventEmitter9 {
       await sink.dispatch(cmd);
   }
   /**
-   * Stations with a live P2P session. P2P is auto-managed: wired stations are warmed at login, battery
+   * The open P2P sessions, by key. P2P is auto-managed: wired stations are warmed at login, battery
    * stations open on demand (command / stream, or an opted-in event pre-warm) and idle-detach — so this
-   * map grows and shrinks over time. `p2pConnect(stationSn)` / `p2pClose(stationSn)` events track the
-   * changes.
+   * map grows and shrinks over time.
+   *
+   * A station's own session is keyed by its serial, and `p2pConnect(stationSn)` / `p2pClose(stationSn)`
+   * track those. A station serving more than one camera at once also holds a session per extra camera,
+   * keyed `<stationSn>#live:<channel>` — these carry media alone and raise no connection events, because
+   * a station announces its state to every client that connects and reporting each copy would double
+   * every event the station's own session already delivers.
    */
   getP2pSessions() {
     return this.p2p.getSessions();
@@ -25272,6 +25964,553 @@ var EufyMega = class extends EventEmitter9 {
   }
 };
 
+// dist/transport/http/solix-constants.js
+var SOLIX_APP_NAME = "anker_power";
+var SOLIX_ESTIMATE_HOST = "uniapp-api-pr.anker.com";
+var SOLIX_DEFAULT_API_HOST = "ankerpower-api-eu.anker.com";
+var SOLIX_ENDPOINTS = {
+  estimateDomain: "/passport/estimate_domain",
+  keyExchange: "/openapi/oauth/key/exchange",
+  login: "/passport/login",
+  /** Bound devices for the account (flat list). */
+  getRelateAndBindDevices: "/power_service/v1/app/get_relate_and_bind_devices",
+  /** Sites (systems) the account owns; devices are grouped under a site. */
+  getSiteList: "/power_service/v1/site/get_site_list",
+  /** Per-user AWS-IoT MQTT credentials (cert/key/endpoint/thing) for the real-time device plane. */
+  getUserMqttInfo: "/v1/openapi/devicemanage/get_user_mqtt_info",
+  /** GET: the pairable-product catalog (categories → products), for labelling model codes. */
+  productCategories: "/power_service/v1/product_categories"
+};
+
+// dist/transport/http/solix-client.js
+function solixSessionFresh(s) {
+  return !!s?.authToken && tokenNotExpired(s.tokenExpiresAt);
+}
+var uuidFromHex = (hex) => `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20, 32)}`;
+var SolixClient = class {
+  email;
+  password;
+  country;
+  appVersion;
+  doFetch;
+  store;
+  openudid;
+  apiHost;
+  session_;
+  /** Carried between {@link login} and {@link submitVerifyCode} while a 2FA code is outstanding. */
+  pending2fa;
+  /**
+   * Resolve the device id (explicit → stored → deterministic from the email, so it is stable and does
+   * not re-trigger 2FA) and adopt a stored session that has not expired, so a warm start skips the
+   * handshake. An explicit `opts.apiHost` outranks a stored session's host in both cases: it is an
+   * override that also skips domain-estimate, and every read goes through `this.apiHost`.
+   */
+  constructor(opts) {
+    this.email = opts.email;
+    this.password = opts.password;
+    this.country = (opts.countryCode ?? "US").toUpperCase();
+    this.appVersion = opts.appVersion ?? "3.23.0";
+    this.doFetch = opts.fetchImpl ?? fetch;
+    this.apiHost = opts.apiHost ?? SOLIX_DEFAULT_API_HOST;
+    this.store = opts.store;
+    const saved = this.store?.load();
+    this.openudid = opts.openudid ?? saved?.openudid ?? uuidFromHex(md5Hex(`anker-solix:${opts.email}`));
+    if (saved?.session && solixSessionFresh(saved.session)) {
+      this.session_ = saved.session;
+      this.apiHost = opts.apiHost ?? saved.session.apiHost;
+    }
+  }
+  /** Persist the current device id (+ session, if any) when a store is configured. */
+  persist() {
+    this.store?.save({ openudid: this.openudid, session: this.session_ });
+  }
+  /** The authenticated session, once {@link login} has resolved to `ok`. */
+  get session() {
+    return this.session_;
+  }
+  /**
+   * Headers for the login/key-exchange path, which carry the device id. Authenticated resource reads
+   * must NOT send `openudid` — the gateway rejects a token-bearing read that also carries a device id
+   * (`401 token error`) — so those use {@link baseHeaders} directly.
+   */
+  authHeaders(extra = {}) {
+    return this.baseHeaders({ openudid: this.openudid, "x-terminal-id": this.openudid, ...extra });
+  }
+  /** Base headers common to every Solix request. */
+  baseHeaders(extra = {}) {
+    return {
+      "content-type": "application/json",
+      "app-name": SOLIX_APP_NAME,
+      "model-type": "PHONE",
+      "os-type": "android",
+      "os-version": "36",
+      "app-version": this.appVersion,
+      country: this.country,
+      timezone: "GMT+00:00",
+      language: "en",
+      "user-agent": "ktor-client",
+      accept: "application/json",
+      ...extra
+    };
+  }
+  /** One request path for every Solix call (GET or POST) — always parses through the non-JSON guard. */
+  async send(method2, host, path, headers, body) {
+    const res = await this.doFetch(`https://${host}${path}`, {
+      method: method2,
+      headers,
+      body,
+      signal: AbortSignal.timeout(2e4)
+    });
+    const text2 = await res.text();
+    try {
+      return JSON.parse(text2);
+    } catch {
+      throw new Error(`Solix ${path} \u2192 HTTP ${res.status}, non-JSON: ${text2.slice(0, 120)}`);
+    }
+  }
+  /** POST helper for the login/key-exchange path (which builds its own bespoke headers per request). */
+  post(host, path, body, headers) {
+    return this.send("POST", host, path, headers, body);
+  }
+  /** Resolve the regional API host via domain-estimate (best-effort; keeps the default on failure). */
+  async estimateHost() {
+    try {
+      const env = await this.post(SOLIX_ESTIMATE_HOST, SOLIX_ENDPOINTS.estimateDomain, JSON.stringify({ ab: this.country, mode: 1 }), this.baseHeaders());
+      const domain = env.data?.domain;
+      if (domain)
+        this.apiHost = domain;
+    } catch {
+    }
+  }
+  /** Do the localKey-bootstrapped ECDH key exchange and return the negotiated session key. */
+  async keyExchange() {
+    const prep = prepareKeyExchange(SOLIX_LOCAL_KEY_HEX);
+    const env = await this.post(this.apiHost, SOLIX_ENDPOINTS.keyExchange, JSON.stringify({ client_public_key: prep.encryptedClientPublicKey }), this.authHeaders(prep.headers));
+    const spk = env.data?.server_public_key;
+    if (env.code !== 0 || !spk)
+      throw new Error(`Solix key/exchange failed (${env.code}): ${env.msg}`);
+    return finishKeyExchange(prep, spk);
+  }
+  /** Build the encrypted, signed `/passport/login` request body + headers for the negotiated key. */
+  async postLogin(kx, verifyCode, limitedToken) {
+    const { clientPublicKeyHex, encryptedPassword } = encryptLoginPassword(this.password);
+    const bodyObj = {
+      email: this.email,
+      password: encryptedPassword,
+      ab: this.country,
+      client_secret_info: { public_key: clientPublicKeyHex },
+      answer: "",
+      captcha_id: "",
+      verify_code: verifyCode ?? "",
+      login_id: ""
+    };
+    const encBody = encryptBody(JSON.stringify(bodyObj), kx.shareKey);
+    const ts = nowSec();
+    const once = genId();
+    return this.post(this.apiHost, SOLIX_ENDPOINTS.login, encBody, this.authHeaders({
+      "x-encryption-info": "algo_ecdh",
+      "x-key-ident": kx.keyIdent,
+      "x-request-ts": ts,
+      "x-request-once": once,
+      "x-signature": signRequest(kx.shareKey, ts, once, encBody),
+      ...limitedToken ? { "x-auth-token": limitedToken } : {}
+    }));
+  }
+  /**
+   * Turn a decrypted `/passport/login` payload into an `ok`/`2fa` result, establishing the session on
+   * `ok`. The passport marks a pending 2FA with a non-empty `fa_info.info`, and empties it once the code
+   * has been satisfied.
+   */
+  classifyLogin(data, isVerify) {
+    const userId = data.ap_cloud_user_id ?? data.user_id;
+    const authToken = data.auth_token;
+    if (!userId || !authToken)
+      throw new Error(`Solix login returned no session: ${JSON.stringify(data).slice(0, 160)}`);
+    const faInfo = data.fa_info ?? {};
+    if (!isVerify && faInfo.info) {
+      this.pending2fa = { limitedToken: authToken, userId, geoKey: data.geo_key };
+      return { status: "2fa", method: "code sent by the passport" };
+    }
+    this.pending2fa = void 0;
+    this.session_ = {
+      authToken,
+      userId,
+      gtoken: gtoken(userId),
+      apiHost: this.apiHost,
+      tokenExpiresAt: Number(data.token_expires_at ?? 0) || 0
+    };
+    this.persist();
+    return { status: "ok", session: this.session_ };
+  }
+  /** Decrypt a login envelope's `data` (base64 `IV(16)||AES-128-CBC`, keyed by the share key). */
+  decryptLogin(env, kx) {
+    if (typeof env.data !== "string")
+      throw new Error(`Solix login (${env.code}): ${env.msg}`);
+    return JSON.parse(decryptBody(env.data, kx.shareKey).toString("utf-8"));
+  }
+  /**
+   * Authenticate with the account credentials. Resolves to `ok` with a {@link SolixSession}, or `2fa`
+   * when the passport sent a code — then call {@link submitVerifyCode}. A session that is already fresh
+   * (adopted from a store) is answered without a handshake.
+   */
+  async login() {
+    if (solixSessionFresh(this.session_)) {
+      return { status: "ok", session: this.session_ };
+    }
+    await this.estimateHost();
+    const kx = await this.keyExchange();
+    const env = await this.postLogin(kx);
+    return this.classifyLogin(this.decryptLogin(env, kx), false);
+  }
+  /** Complete a `2fa` login with the code the passport sent. */
+  async submitVerifyCode(code) {
+    if (!this.pending2fa)
+      throw new Error("no 2FA login is pending");
+    const kx = await this.keyExchange();
+    const env = await this.postLogin(kx, code, this.pending2fa.limitedToken);
+    return this.classifyLogin(this.decryptLogin(env, kx), true);
+  }
+  /**
+   * One authenticated PLAIN read for both GET and POST endpoints (no per-request encryption; carries
+   * the auth token + `gtoken` only). Routes through {@link send} so every read keeps the non-JSON guard.
+   */
+  async authed(method2, path, body) {
+    if (!this.session_)
+      throw new Error("not authenticated \u2014 call login() first");
+    const env = await this.send(method2, this.apiHost, path, this.baseHeaders({ gtoken: this.session_.gtoken, "x-auth-token": this.session_.authToken }), body ? JSON.stringify(body) : void 0);
+    if (env.code !== 0)
+      throw new Error(`Solix ${path} failed (${env.code}): ${env.msg}`);
+    return env.data ?? null;
+  }
+  /**
+   * The account's bound Solix devices (flat list; may be empty when devices live under sites). The
+   * gateway's JSON is asserted to {@link SolixDeviceRecord} here, at the one trust boundary — every field
+   * beyond `device_sn`/`product_code` is optional on the record, so a caller reads them defensively.
+   */
+  async getDevices() {
+    const data = await this.authed("POST", SOLIX_ENDPOINTS.getRelateAndBindDevices, {});
+    return Array.isArray(data) ? data : data?.data ?? [];
+  }
+  /** The account's sites (systems); devices are typically grouped under a site. */
+  async getSites() {
+    const data = await this.authed("POST", SOLIX_ENDPOINTS.getSiteList, {});
+    return data?.site_list ?? [];
+  }
+  /** Per-user AWS-IoT MQTT credentials (cert/key/endpoint/thing) for the real-time device plane. */
+  async getUserMqttInfo() {
+    return this.authed("POST", SOLIX_ENDPOINTS.getUserMqttInfo, {});
+  }
+  /**
+   * The pairable-product catalog (categories → products). This is Anker's product registry, not the
+   * account's devices — fetch it to label a discovered device's model code with a marketing name and
+   * category. Pair with {@link buildModelIndex}. It is a live endpoint, so it stays current without a
+   * baked-in table.
+   */
+  async getProductCatalog() {
+    return await this.authed("GET", SOLIX_ENDPOINTS.productCategories) ?? [];
+  }
+};
+
+// dist/transport/mqtt/solix-mqtt.js
+import { EventEmitter as EventEmitter10 } from "node:events";
+var SOLIX_METER_FIELD_NAMES = {
+  172: "meterVoltageL1"
+};
+function readSolixChannel(value) {
+  if (!value || value.length < 1)
+    return void 0;
+  const raw = value.subarray(1);
+  const ch = { type: value[0], raw };
+  if (raw.length === 4) {
+    ch.float = raw.readFloatLE(0);
+    ch.uint = raw.readUInt32LE(0);
+  }
+  return ch;
+}
+function decodeSolixParamFrame(buf) {
+  if (buf.length < 10 || buf[0] !== 255 || buf[1] !== 9)
+    return null;
+  const declaredLen = buf.readUInt16LE(2);
+  if (declaredLen < 5 || declaredLen > buf.length)
+    return null;
+  let xor = 0;
+  for (let i = 0; i < declaredLen; i++)
+    xor ^= buf[i];
+  if (xor !== 0)
+    return null;
+  const end = declaredLen - 1;
+  const start = buf.indexOf(161, 4);
+  if (start < 0 || start >= end)
+    return { fields: /* @__PURE__ */ new Map() };
+  const fields = walkFf09Tlv(buf, start, end);
+  let deviceSn;
+  const a2 = fields.get(162);
+  if (a2 && a2.length > 1)
+    deviceSn = a2.subarray(1).toString("latin1").replace(/\0+$/, "") || void 0;
+  return { deviceSn, fields };
+}
+function solixReadings(frame) {
+  const out = {};
+  for (const [tag2, value] of frame.fields) {
+    if (tag2 < 166)
+      continue;
+    const ch = readSolixChannel(value);
+    if (ch?.type !== 5 || ch.float === void 0)
+      continue;
+    out[`channel_${tag2.toString(16)}`] = ch.float;
+    const name = SOLIX_METER_FIELD_NAMES[tag2];
+    if (name)
+      out[name] = ch.float;
+  }
+  return out;
+}
+var SolixMqtt = class extends EventEmitter10 {
+  transport;
+  appName;
+  userId;
+  appClientId;
+  armIntervalMs;
+  logger;
+  siteId;
+  watched = /* @__PURE__ */ new Map();
+  seq = 0;
+  armTimer;
+  /**
+   * Bind to one account's MQTT plane. The envelope `client_id` takes the app's shape
+   * (`android-{app}-{uid}-{mqttUuid}-{ts}`); its `mqttUuid` half must be stable across restarts, or every
+   * restart presents itself to the broker as a new client, so it defaults deterministically from the user
+   * id (see {@link SolixMqttOptions.mqttUuid}) rather than a fresh random per instance.
+   */
+  constructor(opts) {
+    super();
+    this.appName = opts.mqttInfo.app_name ?? "anker_power";
+    this.userId = opts.userId ?? opts.mqttInfo.user_id;
+    this.armIntervalMs = opts.armIntervalMs ?? 25e3;
+    this.siteId = opts.siteId;
+    this.logger = opts.logger;
+    const uid = this.userId ?? "anonymous";
+    this.appClientId = opts.appClientId ?? buildAppShapedClientId({
+      appName: this.appName,
+      uid,
+      mqttUuid: opts.mqttUuid ?? mqttUuidFrom(`anker-solix-mqtt:${uid}`)
+    });
+    this.transport = new SecureMqtt({
+      credentials: opts.mqttInfo,
+      clientId: opts.clientId ?? opts.mqttInfo.thing_name,
+      reconnectPeriod: 5e3,
+      logger: opts.logger
+    });
+    this.transport.on("error", (e) => this.emit("error", e));
+    this.transport.on("message", (msg) => this.onMessage(msg));
+  }
+  /**
+   * Connect, subscribe to the device's telemetry (+ command-reply) topics, ARM realtime reporting, and
+   * start the re-arm/heartbeat timer so telemetry keeps flowing without the app. Idempotent per device.
+   *
+   * Subscribes ONLY to what the device sends — `param_info` plus the device and account command-reply
+   * channels — never the `…/req` channels, which are the app→device request side this arms on, and would
+   * echo its own publishes back.
+   *
+   * Throws when `param_info` was not granted. A scope-denied filter comes back as SUBACK_FAILURE rather
+   * than an error (see `SecureMqtt.subscribe`), so an unusable subscription otherwise looks like
+   * success: the call would resolve and arm on every interval while no reading ever arrives.
+   *
+   * The re-arm timer is unreffed, so a caller that watches and returns can still exit.
+   */
+  async watch(device) {
+    await this.transport.connect();
+    const topics = solixDeviceTopics(this.appName, device.product_code, device.device_sn);
+    const granted = await this.transport.subscribe([
+      topics.paramInfo,
+      topics.cmdRes,
+      ...this.userId ? [solixUserTopics(this.appName, this.userId).cmdRes] : []
+    ]);
+    if (!granted.includes(topics.paramInfo)) {
+      const scope = this.appName;
+      throw new Error(`watch ${device.device_sn}: telemetry topic "${topics.paramInfo}" denied on credential scope "${scope}" \u2014 the subscription would arm but never deliver a reading`);
+    }
+    this.watched.set(device.device_sn, device);
+    if (this.armIntervalMs > 0) {
+      await this.armAll();
+      if (!this.armTimer) {
+        this.armTimer = setInterval(() => void this.armAll(), this.armIntervalMs);
+        this.armTimer.unref?.();
+      }
+    }
+  }
+  /** Tear down the connection and stop the re-arm timer. */
+  async close() {
+    if (this.armTimer) {
+      clearInterval(this.armTimer);
+      this.armTimer = void 0;
+    }
+    this.watched.clear();
+    await this.transport.disconnect();
+  }
+  /**
+   * Re-arm every watched device and send the site heartbeat. The device only pushes `param_info` while
+   * a client keeps requesting it — this replays the app's `requestDeviceInfo` (cmd 17) + `power_site`
+   * heartbeat (cmd 10); the request frames are reproduced byte-for-byte by {@link buildFf09Request}
+   * (checksum-verified against captured frames in its spec). Best-effort: a publish failure is emitted,
+   * not thrown, so one bad device doesn't stop the rest or kill the timer.
+   */
+  async armAll() {
+    for (const device of this.watched.values()) {
+      try {
+        await this.arm(device);
+      } catch (e) {
+        this.emit("error", e);
+      }
+    }
+    if (this.userId) {
+      try {
+        await this.transport.publish(solixUserTopics(this.appName, this.userId).powerSite, this.heartbeatEnvelope(), {
+          qos: 1
+        });
+      } catch (e) {
+        this.emit("error", e);
+      }
+    }
+  }
+  /** Publish the device-info arming request (both the "info" and "realtime" ff09 variants the app sends). */
+  async arm(device) {
+    const topic = solixDeviceTopics(this.appName, device.product_code, device.device_sn).req;
+    for (const variant of ["info", "realtime"]) {
+      const body = this.commandEnvelope(device, buildFf09Request(variant), variant === "info" ? { encoding_type: 2 } : {});
+      await this.transport.publish(topic, body, { qos: 1 });
+    }
+    this.logger?.debug?.(`[solix] armed ${device.device_sn} (param_info reporting requested)`);
+  }
+  /** The common `head` fields for every cmd envelope; callers add `cmd` + the per-message variable bits. */
+  makeHead(cmd, extra) {
+    return {
+      version: "1.0.0.1",
+      client_id: this.appClientId,
+      timestamp: Math.floor(Date.now() / 1e3),
+      cmd_status: 2,
+      sign_code: 1,
+      cmd,
+      ...extra
+    };
+  }
+  /**
+   * Build the `{head, payload}` cmd-17 (requestDeviceInfo) envelope carrying a base64 ff09 request.
+   * `account_id` is omitted when the user id is unknown: a live broker cannot tell an empty placeholder
+   * from a real value, so sending `""` would claim an account this client does not have.
+   */
+  commandEnvelope(device, frame, extra) {
+    this.seq += 1;
+    return JSON.stringify({
+      head: this.makeHead(17, {
+        sess_id: genId(),
+        msg_seq: this.seq,
+        seed: genId(),
+        device_pn: device.product_code,
+        device_sn: device.device_sn
+      }),
+      payload: JSON.stringify({
+        device_sn: device.device_sn,
+        ...this.userId ? { account_id: this.userId } : {},
+        data: frame.toString("base64"),
+        ...extra
+      })
+    });
+  }
+  /**
+   * The `power_site` heartbeat (cmd 10) envelope the app sends on a timer to keep the session alive.
+   * `site_id` is omitted when unknown, for the same reason `account_id` is in {@link commandEnvelope}.
+   */
+  heartbeatEnvelope() {
+    return JSON.stringify({
+      head: this.makeHead(10, { sess_id: "1", msg_seq: 1, seed: "1" }),
+      payload: JSON.stringify({ user_id: this.userId ?? "", ...this.siteId ? { site_id: this.siteId } : {} })
+    });
+  }
+  /**
+   * Decode one inbound MQTT message envelope and emit a `reading` if it carries an ff09 param frame. The
+   * product code and the fallback serial come from the topic (`dt/{app}/{pn}/{sn}/param_info`); the frame's
+   * own `a2` field wins for the serial when it carries one.
+   */
+  onMessage(msg) {
+    const topic = msg.topic ?? "";
+    const buf = extractFf09Payload(msg.raw);
+    if (!buf)
+      return;
+    const frame = decodeSolixParamFrame(buf);
+    if (!frame)
+      return;
+    const parts = topic.split("/");
+    const reading = {
+      deviceSn: frame.deviceSn ?? parts[3] ?? "",
+      productCode: parts[2] ?? "",
+      topic,
+      frame,
+      values: solixReadings(frame)
+    };
+    this.emit("reading", reading);
+  }
+};
+function extractFf09Payload(raw) {
+  if (Buffer.isBuffer(raw))
+    return raw;
+  if (!raw || typeof raw !== "object")
+    return null;
+  const env = raw;
+  let payload = env.payload;
+  if (typeof payload === "string") {
+    try {
+      payload = JSON.parse(payload);
+    } catch {
+      return null;
+    }
+  }
+  const p = payload;
+  const data = p?.data ?? p?.trans ?? env.data;
+  if (typeof data !== "string")
+    return null;
+  const buf = Buffer.from(data, "base64");
+  return buf.length ? buf : null;
+}
+function buildFf09Request(variant, atUnixSec) {
+  const ts = Buffer.alloc(4);
+  ts.writeUInt32LE((atUnixSec ?? Math.floor(Date.now() / 1e3)) >>> 0);
+  const body = variant === "info" ? Buffer.concat([Buffer.from([3, 0, 15, 0, 64, 161, 1, 34, 254, 4]), ts]) : Buffer.concat([
+    Buffer.from([
+      3,
+      0,
+      15,
+      0,
+      87,
+      161,
+      1,
+      34,
+      162,
+      2,
+      1,
+      1,
+      163,
+      3,
+      2,
+      44,
+      1,
+      254,
+      5,
+      3
+    ]),
+    ts
+  ]);
+  const frame = Buffer.alloc(body.length + 5);
+  frame[0] = 255;
+  frame[1] = 9;
+  frame.writeUInt16LE(frame.length, 2);
+  body.copy(frame, 4);
+  let xor = 0;
+  for (let i = 0; i < frame.length - 1; i++)
+    xor ^= frame[i];
+  frame[frame.length - 1] = xor;
+  return frame;
+}
+
 // dist/transport/tuya/index.js
 var tuya_exports = {};
 __export(tuya_exports, {
@@ -25312,6 +26551,7 @@ export {
   AUDIO_MEMBERS,
   AccessUnitAssembler,
   AiDetectType,
+  AlarmDelayMode,
   ArmingMode,
   BATTERY_MEMBERS,
   BIZ_CHANNEL,
@@ -25332,6 +26572,7 @@ export {
   CusPushEvent,
   CusPushMode,
   DEFAULT_KEEPALIVE_MS,
+  DISPLAY_MEMBERS,
   DOCK_ACTIVITIES,
   DOCK_KINDS,
   DOORBELL_MEMBERS,
@@ -25385,6 +26626,7 @@ export {
   P256,
   P2PSession,
   P2P_ENVELOPE,
+  P2P_STATION_WAITS,
   PRINTER_CATEGORY_RE,
   PTZ_MEMBERS,
   PowerSource,
@@ -25404,6 +26646,8 @@ export {
   SIREN_MEMBERS,
   SMART_LIGHT_MEMBERS,
   SMOKE_MEMBERS,
+  SOLIX_ENERGY_METER_MEMBERS,
+  SOLIX_LOCAL_KEY_HEX,
   STATE_EVENT_FIELDS,
   STATION_CHANNEL3 as STATION_CHANNEL,
   STATION_CHUNK_BYTES,
@@ -25416,8 +26660,12 @@ export {
   SirenAlarmDuration,
   SirenVolume,
   SmartDropPushEvent,
+  SolixClient,
+  SolixDevice,
+  SolixMqtt,
   StateConvergenceError,
-  StationBusyError,
+  StationKeyUnavailableError,
+  StationUnreachableError,
   StoredSnapshotUnavailableError,
   StreamingQuality,
   SuctionLevel,
@@ -25448,6 +26696,7 @@ export {
   buildDeviceNameBody,
   buildDirectBinaryBody,
   buildEventIndex,
+  buildModelIndex,
   buildRealtimeInit,
   captureSnapshotFromShared,
   cellAtPoint,
@@ -25485,6 +26734,7 @@ export {
   detectCapabilities,
   detectionName,
   discoverReachableInstance,
+  discoverSolixDevices,
   encodeAiDetectType,
   encodeVarint,
   encryptBody,
@@ -25522,6 +26772,7 @@ export {
   lz4BlockDecompress,
   mapCellValue,
   mapCellValueAt,
+  md5Hex,
   mergeCandidateIps,
   mergeProperties,
   mqttAppName,
@@ -25566,9 +26817,12 @@ export {
   secureTopic,
   signKey,
   signRequest,
+  solixDeviceTopics,
+  solixUserTopics,
   structuralEqual,
   subscribeTopics,
   suctionLevelName,
+  tokenNotExpired,
   tuya_exports as tuya,
   u16be,
   u16le,