@mega-yfue/eufy-sdk 0.2.0-beta.3 → 0.2.0-beta.30

package/dist/model/solix-device.d.ts

@@ -0,0 +1,137 @@
+import { type SolixCapability, type SolixEnergyMeterReads } from "./capabilities/solix.js";
+import { type SolixProductFamily } from "./solix-family.js";
+import type { SolixDeviceRecord, SolixProductCategory, SolixSiteScene } from "../core/solix-types.js";
+/**
+ * The device record shape, re-exported from the model surface. It lives in `core/solix-types` so the
+ * transport client can return it without crossing the transport↔model line.
+ */
+export type { SolixDeviceRecord } from "../core/solix-types.js";
+export interface SolixIdentity {
+    serial: string;
+    productCode: string;
+    /** Friendly name — the catalog marketing name if resolvable, else the record's alias/name. */
+    name: string;
+    /** Anker catalog category (e.g. "Accessory", "Portable Power Station"), if resolvable. */
+    category?: string;
+    /**
+     * Normalized product family — the "what kind of thing is this" answer (power station, Solarbank,
+     * smart meter, …), decorrelated from the marketing `category` string. See {@link SolixDevice.family}.
+     */
+    family: SolixProductFamily;
+}
+export interface SolixConnectivity {
+    online: boolean;
+    rssi?: number;
+    ssid?: string;
+}
+/**
+ * The `dev.energyMeter()` handle: the members-derived reads ({@link SolixEnergyMeterReads} —
+ * `meterVoltageL1` is present only once a frame carrying its tag has landed). Every not-yet-named meter
+ * quantity is read from {@link SolixDevice.telemetry} under its `channel_<hex tag>` key instead, which a
+ * static members table cannot enumerate.
+ */
+export type SolixEnergyMeter = SolixEnergyMeterReads;
+/** Options for {@link SolixDevice}. */
+export interface SolixDeviceOptions {
+    /** Catalog categories (from `SolixClient.getProductCatalog()`) — used to resolve name + category. */
+    catalog?: SolixProductCategory[];
+}
+/**
+ * A discovered Solix device with resolved category + capabilities. Feed live telemetry with
+ * {@link applyReading} (from {@link SolixMqtt}'s `reading` events) to populate value accessors.
+ */
+export declare class SolixDevice {
+    readonly serial: string;
+    readonly productCode: string;
+    readonly record: SolixDeviceRecord;
+    private readonly caps;
+    private readonly identity_;
+    private values;
+    constructor(record: SolixDeviceRecord, opts?: SolixDeviceOptions);
+    /**
+     * The device's {@link SolixProductFamily} — the classification a caller branches on to SORT devices
+     * (a site's power stations vs its meters), the Solix analogue of eufy's `isHomeBase()`. Distinct from
+     * {@link has}, which answers what the device can DO; family answers what KIND of device it is.
+     */
+    get family(): SolixProductFamily;
+    /** All capabilities this device carries. */
+    get capabilities(): SolixCapability[];
+    /** Whether the device carries a capability — the only correct way to branch on behaviour. */
+    has(capability: SolixCapability): boolean;
+    /**
+     * Merge a live telemetry reading (a `SolixMqtt` `reading` event) so accessors reflect it. Takes the
+     * WHOLE reading, not just its values, and drops one addressed to a different device: the documented
+     * wiring is `mqtt.on("reading", r => device.applyReading(r))`, and one MQTT stream carries every
+     * watched meter on the account — so without this filter two meters would cross-feed each other's floats.
+     * A reading with no `deviceSn` (a hand-built one) is accepted as-is.
+     */
+    applyReading(reading: {
+        deviceSn?: string;
+        values: Record<string, number>;
+    }): void;
+    /** All decoded float telemetry channels from the latest applied reading (raw, `channel_<tag>` keys). */
+    telemetry(): Record<string, number>;
+    identity(): SolixIdentity;
+    firmware(): {
+        version: string;
+    } | undefined;
+    connectivity(): SolixConnectivity | undefined;
+    /**
+     * The members-derived `energyMeter` reads, or `undefined` when the device has no meter. Each getter is
+     * installed only for a tag this device has actually reported, and reads `this.values` LIVE — a handle
+     * held across an {@link applyReading} reflects the newer values. Getter INSTALLATION is fixed at the
+     * time of this call, so re-call it to pick up a tag first seen since.
+     */
+    energyMeter(): SolixEnergyMeter | undefined;
+    /**
+     * The {@link MemberDeps} the members engine needs: a read closure over the live values store, and the
+     * evidence gate (`ctx.paramIds`) rebuilt from the ff09 tags this device has reported. No `codec` — the
+     * codecs are eufy transport families and a Solix device belongs to none of them. The sink is a no-op:
+     * Solix telemetry is read-only, no member here dispatches a command.
+     */
+    private meterDeps;
+    /** The ff09 tags this device has reported, derived from the decoder's `channel_<hex>` keys. */
+    private seenTags;
+}
+/**
+ * The minimum a client must offer to be discovered against — the two wire reads {@link discoverSolixDevices}
+ * composes. Typed STRUCTURALLY (not as `SolixClient`) so the model layer never imports the transport
+ * client: the hard `transport ⊥ model` rule forbids it, and a structural shape needs no import.
+ */
+export interface SolixDeviceReader {
+    getDevices(): Promise<SolixDeviceRecord[]>;
+    getProductCatalog(): Promise<SolixProductCategory[]>;
+}
+/**
+ * Resolve the product catalog for a discovery: a caller-supplied `opts.catalog` short-circuits the wire
+ * read, and a failed `getProductCatalog()` degrades to no categories (names/families just go unresolved,
+ * never a thrown discovery). Shared by {@link discoverSolixDevices} and `discoverSolixSites` so that
+ * "a failed catalog is non-fatal" decision lives in exactly one place.
+ */
+export declare function resolveSolixCatalog(client: SolixDeviceReader, opts: {
+    catalog?: SolixProductCategory[];
+}): Promise<SolixProductCategory[]>;
+/**
+ * Discover an account's Solix devices as capability-driven {@link SolixDevice} objects — the wire+model
+ * composition (a transport read + the product catalog) that used to be `SolixClient.discoverDevices()`.
+ * It lives in the model layer because it builds `SolixDevice`; the wire client (now `transport/http`)
+ * cannot, and passing it structurally keeps the layers decorrelated. Feed live telemetry to each result
+ * via `SolixDevice.applyReading`.
+ */
+export declare function discoverSolixDevices(client: SolixDeviceReader, opts?: {
+    catalog?: SolixProductCategory[];
+}): Promise<SolixDevice[]>;
+/**
+ * Reduce a site "scene" snapshot to per-device telemetry readings — the BACKSTOP counterpart to the
+ * realtime `ff09` decode. It emits the fields the scene reliably carries that the fast MQTT frame does
+ * NOT: `batteryTemperature` (the realtime frame's BMS blob is empty, so `solixReadings` withholds it),
+ * `batterySoc` (a cross-check/seed for the `0xa3` SOC), and `expansionPacks` — the count of ATTACHED
+ * add-on battery packs (0 on a standalone main unit). Each reading is shaped exactly like a `SolixMqtt`
+ * `reading` event — `{ deviceSn, values }` — so a caller can feed it straight into
+ * {@link SolixDevice.applyReading} and broadcast it on the same path as a live frame. Entries with no
+ * usable value are dropped.
+ */
+export declare function solarbankSceneReadings(scene: SolixSiteScene): {
+    deviceSn: string;
+    values: Record<string, number>;
+}[];

package/dist/model/solix-family.d.ts

@@ -0,0 +1,31 @@
+/**
+ * A Solix device's product family — the normalized "what kind of thing is this" answer, decorrelated
+ * from the Anker catalog's marketing category strings. `unknown` when neither the product code nor the
+ * category identifies a family (never a guess).
+ */
+export type SolixProductFamily = "powerStation" | "solarbank" | "smartMeter" | "powerBank" | "cooler" | "evCharger" | "charger" | "unknown";
+/** The pure evidence a family decision reads: the product code, and the catalog category when resolved. */
+export interface SolixFamilyInput {
+    /** SKU / model code, e.g. `A1782`, `AE103`, `AE1X0`. */
+    product_code: string;
+    /** Anker catalog category, when a catalog resolved one (e.g. `"Portable Power Station"`). */
+    category?: string;
+}
+/** Grid-tie Solarbank / plug-in home battery family (by product code, catalog-independent). */
+export declare const isSolixSolarbank: (input: SolixFamilyInput) => boolean;
+/** Smart energy meter / grid-CT family (by product code, catalog-independent). */
+export declare const isSolixSmartMeter: (input: SolixFamilyInput) => boolean;
+/** Portable Power Station (SOLIX F-series) family — resolved from the catalog category. */
+export declare const isSolixPowerStation: (input: SolixFamilyInput) => boolean;
+/**
+ * Resolve a Solix device's {@link SolixProductFamily} by consulting the family predicates first (they are
+ * catalog-independent, so a device classifies even before a catalog is fetched), then the catalog
+ * category for the families that have no prefix set yet. Returns `"unknown"` when neither identifies one —
+ * never a guess, mirroring `device-family.ts` returning `false` on an unknown device type.
+ *
+ * The meter is checked before the Solarbank: both can present a battery-ish catalog category, but the
+ * meter's `AE1X0` prefix is unambiguous and a meter is never a Solarbank. The Solarbank case reuses
+ * {@link isSolixSolarbank} (prefix OR the home-battery category) rather than re-testing the prefix here,
+ * so the two never drift.
+ */
+export declare function solixProductFamily(input: SolixFamilyInput): SolixProductFamily;

package/dist/model/solix-site.d.ts

@@ -0,0 +1,70 @@
+/**
+ * A capability-driven model for an Anker Solix **site** — the account's home energy system, the "My
+ * Home" the app shows. A site is the Solix analogue of a eufy HomeBase in its GROUPING role: it is the
+ * system that member devices belong to, so it is what a caller reaches for to ask "what's in this
+ * system" and to sort the members by family ({@link SolixSite.powerStations} / {@link solarbanks} /
+ * {@link smartMeters}) or by capability ({@link SolixSite.withCapability}).
+ *
+ * A site is a *grouping*, not a device: it carries no telemetry of its own. Its members are full
+ * {@link SolixDevice} models (each with its own capabilities + live telemetry), resolved by
+ * {@link discoverSolixSites} from the site record's member list joined to the account's device records.
+ * The realtime SYSTEM aggregate the app draws (instantaneous battery SoC + solar + grid flow) is not
+ * modelled here: it has no confirmed, stable read surface for the current device generation, and this
+ * layer does not fabricate a getter for a value it cannot ground — a caller reads each member device's
+ * telemetry instead.
+ */
+import { SolixDevice, type SolixDeviceReader } from "./solix-device.js";
+import type { SolixProductFamily } from "./solix-family.js";
+import type { SolixCapability } from "./capabilities/solix.js";
+import type { SolixProductCategory, SolixSiteRecord } from "../core/solix-types.js";
+/**
+ * The minimum a client must offer to discover an account's SITES against — {@link SolixDeviceReader}
+ * (the device + catalog reads {@link discoverSolixDevices} already composes) plus the site read.
+ * Structural (not `SolixClient`) so the model layer never imports the transport client: the hard
+ * `transport ⊥ model` rule forbids it, and a structural shape needs no import.
+ */
+export interface SolixSiteReader extends SolixDeviceReader {
+    getSites(): Promise<SolixSiteRecord[]>;
+}
+/** Options for {@link SolixSite} / {@link discoverSolixSites} — the same catalog the device model takes. */
+export interface SolixSiteOptions {
+    catalog?: SolixProductCategory[];
+}
+/**
+ * A discovered Solix site with its member devices resolved to {@link SolixDevice} models. Build one
+ * directly from a record + members, or discover an account's sites with {@link discoverSolixSites}.
+ */
+export declare class SolixSite {
+    readonly id: string;
+    /** Friendly site name (e.g. "My Home"), or the site id when the record carries none. */
+    readonly name: string;
+    /** Anker's site-type discriminator (e.g. 20 for a Solarbank-anchored home system), when present. */
+    readonly powerSiteType?: number;
+    readonly record: SolixSiteRecord;
+    readonly devices: SolixDevice[];
+    constructor(record: SolixSiteRecord, devices: SolixDevice[]);
+    /** The member device with this serial, if it belongs to the site. */
+    device(serial: string): SolixDevice | undefined;
+    /** Member devices of a given product {@link SolixProductFamily} — the grouping accessor. */
+    withFamily(family: SolixProductFamily): SolixDevice[];
+    /** Member devices that carry a given capability (e.g. every `battery` in the system). */
+    withCapability(capability: SolixCapability): SolixDevice[];
+    /** The Solarbank / plug-in home-battery members of the system. */
+    solarbanks(): SolixDevice[];
+    /** The smart-meter (grid-CT) members of the system. */
+    smartMeters(): SolixDevice[];
+    /** The portable power-station members of the system. */
+    powerStations(): SolixDevice[];
+}
+/**
+ * Discover an account's Solix sites as {@link SolixSite} groupings of capability-driven
+ * {@link SolixDevice} members — the site analogue of {@link discoverSolixDevices}. Composes three wire
+ * reads (the sites, the account's device records, the product catalog) entirely model-side, so the
+ * transport client is passed structurally and the layers stay decorrelated.
+ *
+ * A site member is resolved to its FULL device record from `getDevices()` when the account lists one
+ * (so the member carries firmware/connectivity + telemetry identity); a member the flat device list
+ * omits is built from the site entry alone (serial + product code + name), so the system is never
+ * missing a device it declares.
+ */
+export declare function discoverSolixSites(client: SolixSiteReader, opts?: SolixSiteOptions): Promise<SolixSite[]>;

package/dist/model/types.d.ts

@@ -28,10 +28,10 @@
  *
  * `display` is the T87Ax Smart Display line — its own codec because its `device_type` collides with
  * the security residual range (confirmed live, 2026-09-04: it connects over secure MQTT with no
- * `p2p_did`, never P2P). Its param namespace and product line are nonetheless grouped into `security`
- * by maintainer decision, not wire evidence — see {@link namespaceForCodec}. No capability module
- * targets it yet: no screen/audio/assistant param has been observed, only its own small cloud-param
- * namespace (ids 8001-8006).
+ * `p2p_did`, never P2P). It owns its own param namespace (ids 8001-8006) and its own product line, so
+ * no other line's capability can attach to it — see `namespaceForCodec` and `CODEC_LINE`. The `display`
+ * capability targets it and reads the charge; no screen/audio/assistant param has been observed, so
+ * those are absent rather than deferred.
  */
 export type Codec = "station" | "camera" | "sensor" | "lock" | "keypad" | "vacuum" | "mower" | "light" | "printer" | "display";
 /**
@@ -39,7 +39,7 @@ export type Codec = "station" | "camera" | "sensor" | "lock" | "keypad" | "vacuu
  * it maps to a {@link CapabilityModule} that owns its property schema. Extend this union as
  * new capabilities are modelled — adding one never requires a subclass.
  */
-export type Capability = "video" | "snapshot" | "motion" | "person_detection" | "battery" | "light" | "ptz" | "doorbell" | "contact" | "leak" | "smoke" | "co" | "siren" | "lock" | "keypad" | "arming" | "storage" | "rtsp" | "camera" | "audio" | "vacuum_clean" | "vacuum_dock" | "suction" | "locate" | "smart_light" | "info";
+export type Capability = "video" | "snapshot" | "motion" | "person_detection" | "battery" | "light" | "ptz" | "doorbell" | "contact" | "leak" | "smoke" | "co" | "siren" | "lock" | "keypad" | "arming" | "storage" | "rtsp" | "camera" | "audio" | "vacuum_clean" | "vacuum_dock" | "suction" | "locate" | "smart_light" | "display" | "info";
 /** Value type of a property. */
 export type PropertyValueType = "bool" | "number" | "string" | "enum";
 /**

package/dist/transport/ff09.d.ts

@@ -397,6 +397,13 @@ export interface Ff09SettingsResponse {
  * padding past the last real field.
  */
 export declare function parseFf09SettingsResponse(plain: Buffer): Ff09SettingsResponse;
+/**
+ * Walk a bounded `tag|len|value` TLV region into a `tag → bytes` map. Stops at a `0x00` tag (only ever
+ * trailing zero-padding, never a real field — real tags start at `0xa1`) and refuses a field whose
+ * declared length would overrun `end`, so a corrupt length can't read past the region (e.g. into a
+ * trailing checksum). Shared by {@link parseFf09SettingsResponse} and the Solix param decoder.
+ */
+export declare function walkFf09Tlv(buf: Buffer, start: number, end: number): Map<number, Buffer>;
 /** Read a little-endian u16 out of a TLV field buffer (throws on a missing/short field — a caller-side bug, not a wire ambiguity). */
 export declare function readFf09U16LE(field: Buffer | undefined, name: string): number;
 /** Read a single byte out of a TLV field buffer (throws on a missing field — same convention as {@link readFf09U16LE}). */

package/dist/transport/http/decodeImageV2.d.ts

@@ -1,19 +1,13 @@
-/**
- * Per-channel auto-contrast, a byte-exact port of PIL `ImageOps.autocontrast` (cutoff 0.5%). The lost
- * quant tables leave the reconstruction low-contrast ("foggy"); stretching each channel's clipped range
- * to full scale restores a natural-looking image. Mutates `data` (RGBA) in place.
- *
- * Parity notes vs PIL: the cutoff count is `n * cutoff // 100` (integer floor); it is trimmed off each
- * end by zeroing whole histogram bins until the count is spent; the range is then the first/last
- * non-empty bins; and the LUT truncates toward zero (`int()`), NOT rounds — rounding would shift pixels.
- */
-export declare function autoContrast(data: Uint8Array, width: number, height: number, cutoff?: number): void;
 /** True if the blob is a v2 `v2_eufysecurity:` push thumbnail. */
 export declare function isV2Image(data: Buffer): boolean;
 /**
- * Decode a v2 blob to a plain JPEG buffer by reconstructing its header, or null if it isn't v2 or the
- * plaintext scan can't be located. The search first chooses subsampling and coarse geometry, derives
- * the fixed MCU count, refines width by row shear, and pins the exact fill height before applying
- * auto-contrast and re-encoding. See the module doc for the keyless-splice rationale.
+ * Decode a v2 blob to a plain JPEG buffer by reconstructing its header, or null if it isn't v2, the
+ * plaintext scan can't be located, or no frame shape explains it.
+ *
+ * Three steps and no pixel rewrite: the frame shape is read out of the entropy scan,
+ * one probe decode both proves the spliced JPEG decodes and measures how far the substitute quant
+ * tables fall short of the camera's, and the answer is the same tail under a header carrying the
+ * corrected tables. See the module doc for the keyless-splice rationale and for why neither the search
+ * nor the correction decodes candidate frames or re-encodes the picture.
  */
 export declare function decodeImageV2(data: Buffer): Buffer | null;

package/dist/transport/http/index.d.ts

@@ -3,3 +3,4 @@ export { randomPhoneModel, randomUserAgent } from "./phone-model.js";
 export * from "./decodeImageV1.js";
 export * from "./decodeImageV2.js";
 export { listLightEffects, listAiSceneRecommendations, type LightEffectSummary } from "./light-catalog.js";
+export { SolixClient, type SolixClientOptions, type SolixLoginResult, type SolixSession, type SolixPersisted, type SolixSessionStore, } from "./solix-client.js";

package/dist/transport/http/jpeg-scan.d.ts

@@ -0,0 +1,59 @@
+/**
+ * A baseline-JPEG entropy scanner that decodes no pixels.
+ *
+ * The v2 thumbnail decoder next door has to discover a frame geometry its blob does not state, and the
+ * only evidence is the plaintext entropy-coded scan: how many MCUs it carries, and whether it carries
+ * them under a given chroma subsampling. A JPEG decoder answers that — it throws on a frame the scan
+ * does not fill — and charges a full set of component and output buffers for each question.
+ *
+ * That bill is fatal for a caller under a hard memory cap. Each `jpeg-js` decode churns roughly a
+ * megabyte of typed arrays, glibc keeps the arenas rather than handing them back, and a search asking
+ * the question of every candidate geometry costs tens of megabytes per thumbnail — permanently, and
+ * more than an embedded host gives an app in total.
+ *
+ * This module asks the same question by walking the Huffman-coded coefficients and throwing them away:
+ * no IDCT, no component planes, no output image. What it keeps is one number per MCU — the DC
+ * coefficient of its luma block(s), i.e. that block's average brightness — which is all the geometry
+ * search needs to tell a sheared row apart from a continuous one. Allocation is a single `Int32Array`
+ * of MCU count, and the walk is linear in the scan's length.
+ *
+ * Baseline sequential only (SOF0), which is what the v2 tail is: no progressive refinement, no
+ * arithmetic coding. Restart markers are tolerated — the scan resynchronises and resets its DC
+ * predictors, exactly as a decoder would.
+ *
+ * @module transport/http/jpeg-scan
+ */
+/** What the scan carried, under one subsampling hypothesis. */
+export interface EntropyScan {
+    /** Complete MCUs decoded before the data ran out. */
+    mcus: number;
+    /**
+     * Mean luma DC per MCU, in scan order — a thumbnail of the picture at MCU resolution.
+     *
+     * Quantized units (the quant tables are lost with the v2 head), so the values are a scale of their
+     * own. Differences between neighbours are what the geometry search reads, and those survive.
+     */
+    luma: Int32Array;
+    /**
+     * Whether the scan ended where a whole MCU ended, with nothing but the EOI marker left.
+     *
+     * The discriminator between hypotheses: a wrong one reads a block with the wrong Huffman table,
+     * diverges, and either dies mid-MCU or stops with data still ahead of it. Only the subsampling the
+     * encoder used walks the scan to its last byte on an MCU boundary.
+     */
+    complete: boolean;
+}
+/**
+ * Walk the plaintext tail's scan under one subsampling hypothesis.
+ *
+ * `extraTables` carries the DHT segments that are NOT in the tail — for a v2 thumbnail, the standard
+ * luma tables the reconstructed header supplies, since only the chroma ones survive in plaintext.
+ * Returns null when the tail is not a baseline scan at all (no SOS, missing tables).
+ *
+ * The walk stops at the first byte it cannot read as this hypothesis's next block, and the result is
+ * `complete` only when that happened on an MCU boundary with nothing but a marker left. The DC array
+ * grows as the scan turns out to be long rather than being sized from the scan's byte length: a wrong
+ * hypothesis dies after a handful of MCUs, and provisioning three whole-scan arrays to discover that is
+ * the kind of allocation this module exists to avoid.
+ */
+export declare function scanEntropy(tail: Uint8Array, subsampling: number, extraTables: readonly Uint8Array[]): EntropyScan | null;

package/dist/transport/http/media-download.d.ts

@@ -1,7 +1,10 @@
+import type { MediaFailureReason } from "../media-failure.js";
 type ResolveHost = (hostname: string) => Promise<readonly {
     address: string;
     family: number;
 }[]>;
+/** Tag a failure OUTSIDE the transfer itself — the push-image decoder refusing bytes that did arrive. @internal */
+export declare function mediaFailureError(message: string, reason: MediaFailureReason, cause?: unknown): Error;
 /** Signals rejection of the active Eufy session without exposing response content. @internal */
 export declare class MediaDownloadAuthenticationError extends Error {
 }

package/dist/transport/http/mega-client.d.ts

@@ -32,6 +32,14 @@ export interface MegaClientConfig {
      * an explicit value pins a fixed one. Not the account identity — that's `phoneModel`.
      */
     mediaUserAgent?: string;
+    /**
+     * Acting name written into the commands that carry an actor field — guard mode and HomeBase alarm
+     * output (`user_name`), a lock's acting username. Trimmed, and blank counts as unset: the default
+     * is the login email's local-part (the whole string when it has no `@`). Attribution only — the
+     * device stores it for its own activity record, and no captured frame shows it being validated
+     * against the account.
+     */
+    accountName?: string;
     /** Persist + reuse the session (token + session key) across runs. Default: in-memory. */
     store?: SessionStore;
     /** Diagnostics sink. Omit for silence; pass a `Logger` (or `new ConsoleLogger()`) to see logs. */
@@ -63,9 +71,34 @@ export declare class MegaApiError extends Error {
  * device-list params carry the same `{param_type, param_value, update_time}` and are not owner-gated.
  */
 export declare const OWNER_ONLY_CODE = 20004;
-/** Thrown when a persisted/expired session is rejected (401). Re-login to recover. */
+/**
+ * Thrown when a persisted/expired session is rejected (401). Re-login to recover.
+ *
+ * It carries the rate the client has already worked out for replacing a rejected token, because the
+ * rejection is where that rate stops being the client's alone: a login driven from here spends the same
+ * session the client's own recovery would have, and repeated logins are what makes an account start
+ * demanding captchas. {@link retryAfterMs} is how long the next replacement is barred for, and
+ * {@link contended} whether this rejection landed inside that bar — the shape repeated displacement has.
+ */
 export declare class SessionExpiredError extends Error {
-    constructor(message: string);
+    /**
+     * How long the next session replacement is barred for, in milliseconds; `0` when nothing bars one now.
+     *
+     * The remainder of the client's own hold-off, which doubles per consecutive replacement and is capped —
+     * and which every replacement extends, whether the client spent it or a login made on this error did.
+     */
+    readonly retryAfterMs: number;
+    /**
+     * Whether this rejection landed inside that bar — a token replaced recently and rejected again since.
+     *
+     * It says the session is being DISPLACED rather than expiring: something else is signing in on this
+     * account, and replacing the token again only trades one login for another.
+     */
+    readonly contended: boolean;
+    constructor(message: string, opts?: {
+        retryAfterMs?: number;
+        contended?: boolean;
+    });
 }
 /**
  * eufy cloud gateway error codes — the numeric `code` carried in a response envelope alongside the
@@ -179,6 +212,13 @@ export declare class MegaHttpClient {
     private sessionKey?;
     /** Per-host ECDH session keys for non-mega gateways (e.g. eufylife) keyed by host. */
     private readonly sessionKeys;
+    /**
+     * The held credential. `userId` is the login reply's `ap_cloud_user_id` where it has one — the Anker
+     * Passport cloud's id — while `accountUserId` is the eufy account's own `user_id`.
+     *
+     * The `gtoken` header is hashed from `accountUserId`: that is the id the gateway recomputes the header
+     * from, rejecting a disagreement with `"gtoken not equal userid error"`.
+     */
     private auth_?;
     /** captcha_id of an in-flight challenge, held between login() and solveCaptcha(). */
     private pendingCaptchaId?;
@@ -208,9 +248,11 @@ export declare class MegaHttpClient {
     private loggingIn;
     /** The one in-flight re-login every call rejected on the same dead token waits on. */
     private reauthAttempt?;
-    /** Replacements since the held session last proved stable, and when the last one ran — see {@link recoveryDue}. */
+    /** Replacements since the held session last proved stable, and when the last one ran — see {@link holdOffRemainingMs}. */
     private recoveries;
     private lastRecoveryAt;
+    /** A token of ours has been rejected and not yet replaced — see {@link noteTokenReplacement}. */
+    private rejectedTokenPending;
     constructor(cfg: MegaClientConfig);
     /**
      * Install the session the store holds, if it holds a usable one: the token + its bound ECDH key, skipping
@@ -231,10 +273,15 @@ export declare class MegaHttpClient {
     /** The active region shard (e.g. `"eu-pr"`, `"us-pr"`), set after {@link login} or a region override. */
     get regionShard(): RegionShard;
     /**
-     * The logged-in account's display name — the login email's local-part (e.g. `someone+tag` for
-     * `someone+tag@example.com`). This is the string the app writes into the ff09 command's acting
-     * "username" field (verified against a captured T8531 unlock frame). Falls back to the whole email
-     * if it has no `@`.
+     * The name commands attribute themselves to — {@link MegaClientConfig.accountName} when the config
+     * pins one (trimmed; blank counts as unset), otherwise the logged-in account's display name, which
+     * is the login email's local-part (e.g. `someone+tag` for `someone+tag@example.com`) and falls back
+     * to the whole email if it has no `@`.
+     *
+     * The local-part is the string the app writes into the ff09 command's acting "username" field
+     * (verified against a captured T8531 unlock frame), so it is the faithful default. An override is a
+     * different LABEL for the same account, not a different identity: the session authenticates on the
+     * token and the device record's member ids, neither of which this touches.
      */
     get accountName(): string;
     /**
@@ -246,7 +293,14 @@ export declare class MegaHttpClient {
      */
     private baseHeaders;
     /**
-     * The account-credential headers every authed call carries — `x-auth-token` + `gtoken` (`md5(userId)`).
+     * The id `gtoken` is hashed from — the account's own `user_id`, which is what the gateway recomputes the
+     * header from. One place so the two header paths cannot drift on which of the session's ids that is.
+     *
+     * Call only where `auth_` is already established; every header path guards it.
+     */
+    private gtokenUserId;
+    /**
+     * The account-credential headers every authed call carries — `x-auth-token` + `gtoken`.
      * One place so the signed path, the key-exchange and the bearer path can't drift on what "authed" means.
      */
     private authTokenHeaders;
@@ -353,7 +407,13 @@ export declare class MegaHttpClient {
     registerPushToken(token: string): Promise<void>;
     /** Download raw bytes from a push-media URL using the active account session. */
     downloadMedia(url: string): Promise<Buffer>;
-    /** Download push image bytes and decrypt a recognized v1 wrapper when its device key input is available. */
+    /**
+     * Download push image bytes and decrypt a recognized v1 wrapper when its device key input is available.
+     *
+     * A decoder throw is tagged `decode-failed`: to anything downstream, the difference between "the
+     * bytes never arrived" and "the bytes arrived and the wrapper would not decrypt" is the difference
+     * between a network problem and a key problem, and one of them is this SDK's to fix.
+     */
     downloadImage(url: string, p2pDid?: string): Promise<Buffer>;
     /** The security-app data host for this region (face recognition, media, etc.). */
     private securityAppHost;
@@ -467,6 +527,26 @@ export declare class MegaHttpClient {
      * and a caller is told the honest reason instead of being served a fight.
      */
     private recoveryDue;
+    /**
+     * How much longer a token replacement must wait, in milliseconds; `0` when one may run now.
+     *
+     * The wait doubles per consecutive replacement and is capped, and it is what {@link recoveryDue} gates
+     * this client's own recovery on — and what {@link SessionExpiredError.retryAfterMs} hands a host that
+     * drives its own. One function so the two cannot disagree about the rate, which they would have to for
+     * a host to be told it may retry while this client is still holding off.
+     */
+    private holdOffRemainingMs;
+    /**
+     * Count one token replacement against the hold-off, and clear the rejection it answered.
+     *
+     * Every replacement passes through here, wherever it was spent from: {@link recoverRejectedSession}, and
+     * a {@link login} that follows a rejection this client surfaced. A hold-off that counted only its own
+     * would be no bound at all — the wait would sit at its first value however many sessions had been spent,
+     * and {@link SessionExpiredError.retryAfterMs} would report a minute while logins ran every few seconds.
+     * Which of the two counted a given replacement is the flag: the recovery path clears it before logging
+     * in, so the login cannot count the same one again.
+     */
+    private noteTokenReplacement;
     /**
      * Note that the held session is working. A replacement that keeps serving calls for long enough is not
      * contention, so the hold-off is forgotten and the next genuine expiry recovers immediately.