@mega-yfue/eufy-sdk 0.4.0-beta.10 → 0.4.0-beta.12

package/dist/index.js

@@ -1070,6 +1070,401 @@ function normalizePushImage(data, p2pDid) {
   return decodeImageV1(data, p2pDid) ?? data;
 }
 
+// dist/core/types.js
+var PRINTER_CATEGORY_RE = /ankermake|eufymake|fdm|3d_?print/i;
+function classifyDevice(raw) {
+  const category = raw.category ?? "";
+  const hasP2p = typeof raw.p2p_did === "string" && raw.p2p_did.length > 0;
+  if (category === "eufy_security" || hasP2p)
+    return { category, api: "mega", realtime: "p2p" };
+  if (PRINTER_CATEGORY_RE.test(category))
+    return { category, api: "ankermake", realtime: "ankermake-mqtt" };
+  return { category, api: "mega", realtime: "smqtt" };
+}
+
+// dist/core/contracts.js
+var StoredSnapshotUnavailableError = class extends Error {
+  reason;
+  constructor(reason, message, options) {
+    super(message, options);
+    this.reason = reason;
+    this.name = "StoredSnapshotUnavailableError";
+  }
+};
+var RETRYABLE_LIVE_SNAPSHOT_REASONS = [
+  "no-keyframe",
+  "source-failed",
+  "undecodable-burst"
+];
+var LiveSnapshotUnavailableError = class extends Error {
+  reason;
+  /** Whether another attempt could plausibly succeed without the host changing anything. */
+  retryable;
+  constructor(reason, message, options) {
+    super(message, options);
+    this.reason = reason;
+    this.name = "LiveSnapshotUnavailableError";
+    this.retryable = RETRYABLE_LIVE_SNAPSHOT_REASONS.includes(reason);
+  }
+};
+var CameraDisabledError = class extends Error {
+  camera;
+  constructor(camera, options) {
+    super(`camera${camera ? ` ${camera}` : ""} is disabled \u2014 no live stream possible`, options);
+    this.camera = camera;
+    this.name = "CameraDisabledError";
+  }
+};
+var StationKeyUnavailableError = class extends Error {
+  stationSn;
+  /** Always true: the negotiation is per connection, so a later one may still produce a key. */
+  retryable = true;
+  constructor(stationSn, options) {
+    super(`station ${stationSn} did not provide its session key, so nothing that requires one could be sent`, options);
+    this.stationSn = stationSn;
+    this.name = "StationKeyUnavailableError";
+  }
+};
+var StationUnreachableError = class extends Error {
+  stationSn;
+  waitedMs;
+  /** Always true: a station unreachable now may answer on a later attempt. */
+  retryable = true;
+  constructor(stationSn, waitedMs, options) {
+    super(`station ${stationSn}'s P2P session did not connect within ${waitedMs}ms, so nothing could be sent to it`, options);
+    this.stationSn = stationSn;
+    this.waitedMs = waitedMs;
+    this.name = "StationUnreachableError";
+  }
+};
+var DeviceChannelUnresolvedError = class extends Error {
+  sn;
+  stationSn;
+  constructor(sn, stationSn, options) {
+    super(`${sn} has no usable channel on station ${stationSn}, so nothing was sent to it`, options);
+    this.sn = sn;
+    this.stationSn = stationSn;
+    this.name = "DeviceChannelUnresolvedError";
+  }
+};
+var LiveStreamStartError = class extends Error {
+  reason;
+  stage;
+  timeoutMs;
+  attempts;
+  constructor(failure) {
+    super(`live stream failed to start (${failure.reason} at ${failure.stage} after ${failure.attempts} attempts; ${failure.timeoutMs}ms deadline)`, failure.cause === void 0 ? void 0 : { cause: failure.cause });
+    this.name = "LiveStreamStartError";
+    this.reason = failure.reason;
+    this.stage = failure.stage;
+    this.timeoutMs = failure.timeoutMs;
+    this.attempts = failure.attempts;
+  }
+};
+var StateConvergenceError = class extends Error {
+  sn;
+  property;
+  param;
+  expected;
+  observed;
+  timeoutMs;
+  constructor(failure) {
+    super(`device ${failure.sn} did not report ${failure.property} as ${String(failure.expected)} within ${failure.timeoutMs}ms (param ${failure.param} read ${String(failure.observed)})`);
+    this.name = "StateConvergenceError";
+    this.sn = failure.sn;
+    this.property = failure.property;
+    this.param = failure.param;
+    this.expected = failure.expected;
+    this.observed = failure.observed;
+    this.timeoutMs = failure.timeoutMs;
+  }
+};
+var COMMAND_OBSERVATION = /* @__PURE__ */ Symbol("command-observation");
+function observeCommand(command, observation) {
+  return Object.defineProperty(command, COMMAND_OBSERVATION, { configurable: true, value: observation });
+}
+function commandObservation(command) {
+  return command[COMMAND_OBSERVATION];
+}
+
+// dist/core/raw-dp-writer.js
+var WIRE = { VARINT: 0, LENGTH_DELIMITED: 2 };
+function encodeVarint(value) {
+  if (!Number.isSafeInteger(value) || value < 0) {
+    throw new Error(`varint: ${value} is not a non-negative safe integer`);
+  }
+  const out = [];
+  let v = value;
+  while (v > 127) {
+    out.push(v % 128 + 128);
+    v = Math.floor(v / 128);
+  }
+  out.push(v);
+  return out;
+}
+function zigzag(value) {
+  if (!Number.isSafeInteger(value))
+    throw new Error(`zigzag: ${value} is not a safe integer`);
+  return value < 0 ? -2 * value - 1 : 2 * value;
+}
+var RawDpWriter = class _RawDpWriter {
+  body = [];
+  /** A varint-valued field (`int32`, `uint32`, `bool`, an enum member). */
+  int(field, value) {
+    this.body.push(...encodeVarint(tag(field, WIRE.VARINT)), ...encodeVarint(value));
+    return this;
+  }
+  /** A signed varint field (`sint32`, `sint64`), ZigZag-encoded — see {@link zigzag}. */
+  sint(field, value) {
+    return this.int(field, zigzag(value));
+  }
+  /** A boolean field, on protobuf's own terms: `1` or `0` in a varint. */
+  bool(field, value) {
+    return this.int(field, value ? 1 : 0);
+  }
+  /** A length-delimited field carrying raw bytes — a string, a blob, or a message built elsewhere. */
+  bytes(field, value) {
+    const bytes2 = value instanceof Uint8Array ? Array.from(value) : [...value];
+    this.body.push(...encodeVarint(tag(field, WIRE.LENGTH_DELIMITED)), ...encodeVarint(bytes2.length), ...bytes2);
+    return this;
+  }
+  /**
+   * A nested sub-message, built by `build` into a writer of its own.
+   *
+   * The sub-message is emitted even when `build` writes nothing into it. That is not an oversight: an
+   * EMPTY sub-message is how these protocols say "this subsystem exists and is in its zero state", as
+   * opposed to saying nothing about it, and the readers on the other side of this file depend on the
+   * distinction. Omitting the call is what says nothing about it.
+   */
+  sub(field, build) {
+    const inner = new _RawDpWriter();
+    build(inner);
+    return this.bytes(field, inner.toBytes());
+  }
+  /** The message body on its own, unframed — for nesting into another writer. */
+  toBytes() {
+    return [...this.body];
+  }
+  /**
+   * The finished DP value: `varint(bodyLength) ++ body`, base64-encoded.
+   *
+   * This is the envelope `RawDpCodec.decode` unwraps, so a value produced here and read back through the
+   * codec is a genuine round-trip rather than two implementations of the same guess.
+   */
+  finish() {
+    return Buffer.from([...encodeVarint(this.body.length), ...this.body]).toString("base64");
+  }
+};
+function tag(field, wire) {
+  if (!Number.isSafeInteger(field) || field < 1)
+    throw new Error(`field number: ${field} is not a positive integer`);
+  return field * 8 + wire;
+}
+function rawDp(build) {
+  const w = new RawDpWriter();
+  build(w);
+  return w.finish();
+}
+
+// dist/core/raw-dp-hex.js
+function hexToRawDp(hex) {
+  if (hex.length === 0 || hex.length % 2 !== 0 || !/^[0-9a-fA-F]+$/.test(hex))
+    return void 0;
+  return Buffer.from(hex, "hex").toString("base64");
+}
+
+// dist/core/util.js
+var Timer = class {
+  handle;
+  /** (Re)arm to run `fn` after `ms`, cancelling any already-pending fire. */
+  arm(ms, fn) {
+    this.cancel();
+    this.handle = setTimeout(() => {
+      this.handle = void 0;
+      fn();
+    }, ms);
+    this.handle.unref?.();
+  }
+  /** Cancel a pending fire. No-op if not armed. */
+  cancel() {
+    if (this.handle) {
+      clearTimeout(this.handle);
+      this.handle = void 0;
+    }
+  }
+  /** Whether a fire is currently scheduled. */
+  get pending() {
+    return this.handle !== void 0;
+  }
+};
+function assertNever(value) {
+  throw new Error(`unhandled variant: ${JSON.stringify(value)}`);
+}
+function asBool(value) {
+  if (typeof value === "string")
+    return value === "1" || value.toLowerCase() === "true";
+  return value === true || value === 1;
+}
+function clamp(value, min, max) {
+  if (Number.isNaN(value))
+    return min;
+  return Math.max(min, Math.min(max, Math.round(value)));
+}
+function structuralEqual(a, b) {
+  if (Object.is(a, b))
+    return true;
+  if (typeof a !== "object" || typeof b !== "object" || a === null || b === null)
+    return false;
+  const aArr = Array.isArray(a);
+  const bArr = Array.isArray(b);
+  if (aArr !== bArr)
+    return false;
+  if (aArr && bArr) {
+    if (a.length !== b.length)
+      return false;
+    for (let i = 0; i < a.length; i++)
+      if (!structuralEqual(a[i], b[i]))
+        return false;
+    return true;
+  }
+  const aObj = a;
+  const bObj = b;
+  const aKeys = Object.keys(aObj);
+  const bKeys = Object.keys(bObj);
+  if (aKeys.length !== bKeys.length)
+    return false;
+  for (const k of aKeys) {
+    if (!Object.prototype.hasOwnProperty.call(bObj, k))
+      return false;
+    if (!structuralEqual(aObj[k], bObj[k]))
+      return false;
+  }
+  return true;
+}
+function coerceEnumValue(enumObj, value) {
+  const n = Number(value);
+  return Number.isInteger(n) && Object.values(enumObj).includes(n) ? n : void 0;
+}
+function enumValues(enumObj) {
+  return Object.values(enumObj).join("/");
+}
+function enumLabels(enumObj) {
+  return Object.fromEntries(Object.entries(enumObj).map(([name, value]) => [value, name]));
+}
+function jsonObject(text2) {
+  if (typeof text2 !== "string")
+    return void 0;
+  try {
+    const v = JSON.parse(text2);
+    return v && typeof v === "object" && !Array.isArray(v) ? v : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function u16le(n) {
+  const b = Buffer.alloc(2);
+  b.writeUInt16LE(n & 65535);
+  return b;
+}
+function u16be(n) {
+  const b = Buffer.alloc(2);
+  b.writeUInt16BE(n & 65535);
+  return b;
+}
+function u32le(n) {
+  const b = Buffer.alloc(4);
+  b.writeUInt32LE(n >>> 0);
+  return b;
+}
+function u32be(n) {
+  const b = Buffer.alloc(4);
+  b.writeUInt32BE(n >>> 0);
+  return b;
+}
+
+// dist/core/lz4-block.js
+var MAX_OUTPUT = 64 * 1024 * 1024;
+function lz4BlockDecompress(block, size) {
+  if (!Number.isSafeInteger(size) || size < 0 || size > MAX_OUTPUT)
+    return void 0;
+  const out = Buffer.alloc(size);
+  const end = block.length;
+  let pos = 0;
+  let written = 0;
+  const extend2 = (base) => {
+    let len = base;
+    if (base !== 15)
+      return len;
+    for (; ; ) {
+      if (pos >= end)
+        return void 0;
+      const extra = block[pos++];
+      len += extra;
+      if (extra !== 255)
+        return len;
+    }
+  };
+  while (pos < end) {
+    const token = block[pos++];
+    const literals = extend2(token >> 4);
+    if (literals === void 0)
+      return void 0;
+    if (pos + literals > end || written + literals > size)
+      return void 0;
+    for (let i = 0; i < literals; i++)
+      out[written++] = block[pos++];
+    if (pos === end)
+      break;
+    if (pos + 2 > end)
+      return void 0;
+    const offset = block[pos] | block[pos + 1] << 8;
+    pos += 2;
+    if (offset === 0 || offset > written)
+      return void 0;
+    const match = extend2(token & 15);
+    if (match === void 0)
+      return void 0;
+    const length = match + 4;
+    if (written + length > size)
+      return void 0;
+    let from = written - offset;
+    for (let i = 0; i < length; i++)
+      out[written++] = out[from++];
+  }
+  return written === size ? out : void 0;
+}
+
+// dist/transport/http/passport.js
+function loginCredentials(email, password, country) {
+  const { clientPublicKeyHex, encryptedPassword } = encryptLoginPassword(password);
+  return { email, password: encryptedPassword, ab: country, client_secret_info: { public_key: clientPublicKeyHex } };
+}
+function readLoginReply(data) {
+  const userId = data.ap_cloud_user_id ?? data.user_id ?? data.userId;
+  const authToken = data.auth_token ?? data.token;
+  if (!userId || !authToken)
+    return void 0;
+  return {
+    userId,
+    accountUserId: data.user_id ?? data.userId,
+    authToken,
+    geoKey: data.geo_key,
+    tokenExpiresAt: Number(data.token_expires_at ?? 0) || 0,
+    twoFactorPending: !!(data.fa_info ?? {}).info
+  };
+}
+function signedHeaders(entry, encBody) {
+  const ts = nowSec();
+  const once = genId();
+  return {
+    "x-encryption-info": "algo_ecdh",
+    "x-key-ident": entry.keyIdent,
+    "x-request-ts": ts,
+    "x-request-once": once,
+    "x-signature": signRequest(entry.shareKey, ts, once, encBody)
+  };
+}
+
 // dist/transport/http/mega-client.js
 function parseMaybeJson(text2) {
   if (text2.length === 0)
@@ -1437,17 +1832,11 @@ ${this.auth_?.authToken ?? ""}`;
     const order = preferred === "text/plain" ? ["text/plain", "application/json"] : ["application/json", "text/plain"];
     let last;
     for (const contentType of order) {
-      const ts = nowSec();
-      const once = genId();
       const headers = {
         ...this.baseHeaders(),
         "content-type": contentType,
-        "x-encryption-info": "algo_ecdh",
+        ...signedHeaders(entry, encBody),
         "x-replay-info": "replay",
-        "x-key-ident": entry.keyIdent,
-        "x-request-ts": ts,
-        "x-request-once": once,
-        "x-signature": signRequest(entry.shareKey, ts, once, encBody),
         // Per-call header overrides (e.g. app-name=eufy_security to request a security-scoped
         // MQTT cert on an existing eufy_mega session — see EufyMega.getUserMqttInfo).
         ...headerOverrides
@@ -1746,13 +2135,7 @@ ${this.auth_?.authToken ?? ""}`;
   }
   /** Build the /passport/login body (verify_code empty unless 2FA). */
   loginBody(opts) {
-    const { clientPublicKeyHex, encryptedPassword } = encryptLoginPassword(this.cfg.password);
-    const base = {
-      email: this.cfg.email,
-      password: encryptedPassword,
-      ab: this.cfg.countryCode,
-      client_secret_info: { public_key: clientPublicKeyHex }
-    };
+    const base = loginCredentials(this.cfg.email, this.cfg.password, this.cfg.countryCode);
     if (opts.verifyCode)
       return { ...base, verify_code: opts.verifyCode, login_id: "" };
     if (opts.captchaId)
@@ -1990,15 +2373,12 @@ ${this.auth_?.authToken ?? ""}`;
       if (cap.length)
         this.logger.debug("[mega] captcha/fa:", JSON.stringify(Object.fromEntries(cap.map((k) => [k, res[k]]))));
     }
-    const userId = res.ap_cloud_user_id ?? res.user_id ?? res.userId;
-    const accountUserId = res.user_id ?? res.userId;
-    const authToken = res.auth_token ?? res.token;
-    if (!userId || !authToken)
+    const reply = readLoginReply(res);
+    if (!reply)
       throw new Error(`login returned no session: ${JSON.stringify(res).slice(0, 200)}`);
-    const faInfo = res.fa_info ?? {};
-    const needs2fa = !isVerify && !!faInfo.info;
-    if (needs2fa) {
-      this.auth_ = { userId, accountUserId, authToken, geoKey: res.geo_key };
+    const { userId, accountUserId, authToken, geoKey } = reply;
+    if (!isVerify && reply.twoFactorPending) {
+      this.auth_ = { userId, accountUserId, authToken, geoKey };
       this.pendingCaptchaId = void 0;
       this.pending2fa = true;
       await this.sendVerifyCode(messageType);
@@ -2006,8 +2386,8 @@ ${this.auth_?.authToken ?? ""}`;
     }
     this.pendingCaptchaId = void 0;
     this.pending2fa = false;
-    this.auth_ = { userId, accountUserId, authToken, geoKey: res.geo_key };
-    this.tokenExpiresAt = Number(res.token_expires_at ?? 0) || 0;
+    this.auth_ = { userId, accountUserId, authToken, geoKey };
+    this.tokenExpiresAt = reply.tokenExpiresAt;
     this.sessionKey = void 0;
     await this.ensureSessionKey();
     this.persist();
@@ -2323,115 +2703,6 @@ function mqttUuidFrom(installId) {
   return createHash4("sha256").update(installId).digest("hex").slice(0, 16);
 }
 
-// dist/core/util.js
-var Timer = class {
-  handle;
-  /** (Re)arm to run `fn` after `ms`, cancelling any already-pending fire. */
-  arm(ms, fn) {
-    this.cancel();
-    this.handle = setTimeout(() => {
-      this.handle = void 0;
-      fn();
-    }, ms);
-    this.handle.unref?.();
-  }
-  /** Cancel a pending fire. No-op if not armed. */
-  cancel() {
-    if (this.handle) {
-      clearTimeout(this.handle);
-      this.handle = void 0;
-    }
-  }
-  /** Whether a fire is currently scheduled. */
-  get pending() {
-    return this.handle !== void 0;
-  }
-};
-function assertNever(value) {
-  throw new Error(`unhandled variant: ${JSON.stringify(value)}`);
-}
-function asBool(value) {
-  if (typeof value === "string")
-    return value === "1" || value.toLowerCase() === "true";
-  return value === true || value === 1;
-}
-function clamp(value, min, max) {
-  if (Number.isNaN(value))
-    return min;
-  return Math.max(min, Math.min(max, Math.round(value)));
-}
-function structuralEqual(a, b) {
-  if (Object.is(a, b))
-    return true;
-  if (typeof a !== "object" || typeof b !== "object" || a === null || b === null)
-    return false;
-  const aArr = Array.isArray(a);
-  const bArr = Array.isArray(b);
-  if (aArr !== bArr)
-    return false;
-  if (aArr && bArr) {
-    if (a.length !== b.length)
-      return false;
-    for (let i = 0; i < a.length; i++)
-      if (!structuralEqual(a[i], b[i]))
-        return false;
-    return true;
-  }
-  const aObj = a;
-  const bObj = b;
-  const aKeys = Object.keys(aObj);
-  const bKeys = Object.keys(bObj);
-  if (aKeys.length !== bKeys.length)
-    return false;
-  for (const k of aKeys) {
-    if (!Object.prototype.hasOwnProperty.call(bObj, k))
-      return false;
-    if (!structuralEqual(aObj[k], bObj[k]))
-      return false;
-  }
-  return true;
-}
-function coerceEnumValue(enumObj, value) {
-  const n = Number(value);
-  return Number.isInteger(n) && Object.values(enumObj).includes(n) ? n : void 0;
-}
-function enumValues(enumObj) {
-  return Object.values(enumObj).join("/");
-}
-function enumLabels(enumObj) {
-  return Object.fromEntries(Object.entries(enumObj).map(([name, value]) => [value, name]));
-}
-function jsonObject(text2) {
-  if (typeof text2 !== "string")
-    return void 0;
-  try {
-    const v = JSON.parse(text2);
-    return v && typeof v === "object" && !Array.isArray(v) ? v : void 0;
-  } catch {
-    return void 0;
-  }
-}
-function u16le(n) {
-  const b = Buffer.alloc(2);
-  b.writeUInt16LE(n & 65535);
-  return b;
-}
-function u16be(n) {
-  const b = Buffer.alloc(2);
-  b.writeUInt16BE(n & 65535);
-  return b;
-}
-function u32le(n) {
-  const b = Buffer.alloc(4);
-  b.writeUInt32LE(n >>> 0);
-  return b;
-}
-function u32be(n) {
-  const b = Buffer.alloc(4);
-  b.writeUInt32BE(n >>> 0);
-  return b;
-}
-
 // dist/transport/mqtt/availability.js
 function parseStateInfoSignal(topic, raw) {
   const parsedTopic = parseSecureTopic(topic);
@@ -2556,13 +2827,6 @@ function parseAiotDpReport(raw) {
   return Object.keys(out).length ? out : void 0;
 }
 
-// dist/core/raw-dp-hex.js
-function hexToRawDp(hex) {
-  if (hex.length === 0 || hex.length % 2 !== 0 || !/^[0-9a-fA-F]+$/.test(hex))
-    return void 0;
-  return Buffer.from(hex, "hex").toString("base64");
-}
-
 // dist/transport/mqtt/biz-stream.js
 var BIZ_PROTOCOL = {
   /** Map-stream data: the frames this module parses. */
@@ -2735,28 +2999,16 @@ var DeviceType = {
   LOCK_85D0: 202,
   LOCK_85V0: 203,
   LOCK_85P0: 209,
-  NVR_S4_MAX: 300,
-  CAMERA_POE_S4: 301,
-  WALL_LIGHT_CAM_81A0: 10005,
-  INDOOR_8W11: 10006,
-  INDOOR_PT_CAMERA_C220: 10008,
-  INDOOR_PT_CAMERA_C210: 10009,
-  INDOOR_PT_CAMERA_C220_V2: 10010,
-  INDOOR_PT_CAMERA_C220_V3: 10011,
-  CAMERA_C35: 10035
-};
-
-// dist/core/types.js
-var PRINTER_CATEGORY_RE = /ankermake|eufymake|fdm|3d_?print/i;
-function classifyDevice(raw) {
-  const category = raw.category ?? "";
-  const hasP2p = typeof raw.p2p_did === "string" && raw.p2p_did.length > 0;
-  if (category === "eufy_security" || hasP2p)
-    return { category, api: "mega", realtime: "p2p" };
-  if (PRINTER_CATEGORY_RE.test(category))
-    return { category, api: "ankermake", realtime: "ankermake-mqtt" };
-  return { category, api: "mega", realtime: "smqtt" };
-}
+  NVR_S4_MAX: 300,
+  CAMERA_POE_S4: 301,
+  WALL_LIGHT_CAM_81A0: 10005,
+  INDOOR_8W11: 10006,
+  INDOOR_PT_CAMERA_C220: 10008,
+  INDOOR_PT_CAMERA_C210: 10009,
+  INDOOR_PT_CAMERA_C220_V2: 10010,
+  INDOOR_PT_CAMERA_C220_V3: 10011,
+  CAMERA_C35: 10035
+};
 
 // dist/model/classify.js
 var STATION_TYPES = /* @__PURE__ */ new Set([
@@ -2896,111 +3148,6 @@ function inferName(rec) {
   return void 0;
 }
 
-// dist/core/contracts.js
-var StoredSnapshotUnavailableError = class extends Error {
-  reason;
-  constructor(reason, message, options) {
-    super(message, options);
-    this.reason = reason;
-    this.name = "StoredSnapshotUnavailableError";
-  }
-};
-var RETRYABLE_LIVE_SNAPSHOT_REASONS = [
-  "no-keyframe",
-  "source-failed",
-  "undecodable-burst"
-];
-var LiveSnapshotUnavailableError = class extends Error {
-  reason;
-  /** Whether another attempt could plausibly succeed without the host changing anything. */
-  retryable;
-  constructor(reason, message, options) {
-    super(message, options);
-    this.reason = reason;
-    this.name = "LiveSnapshotUnavailableError";
-    this.retryable = RETRYABLE_LIVE_SNAPSHOT_REASONS.includes(reason);
-  }
-};
-var CameraDisabledError = class extends Error {
-  camera;
-  constructor(camera, options) {
-    super(`camera${camera ? ` ${camera}` : ""} is disabled \u2014 no live stream possible`, options);
-    this.camera = camera;
-    this.name = "CameraDisabledError";
-  }
-};
-var StationKeyUnavailableError = class extends Error {
-  stationSn;
-  /** Always true: the negotiation is per connection, so a later one may still produce a key. */
-  retryable = true;
-  constructor(stationSn, options) {
-    super(`station ${stationSn} did not provide its session key, so nothing that requires one could be sent`, options);
-    this.stationSn = stationSn;
-    this.name = "StationKeyUnavailableError";
-  }
-};
-var StationUnreachableError = class extends Error {
-  stationSn;
-  waitedMs;
-  /** Always true: a station unreachable now may answer on a later attempt. */
-  retryable = true;
-  constructor(stationSn, waitedMs, options) {
-    super(`station ${stationSn}'s P2P session did not connect within ${waitedMs}ms, so nothing could be sent to it`, options);
-    this.stationSn = stationSn;
-    this.waitedMs = waitedMs;
-    this.name = "StationUnreachableError";
-  }
-};
-var DeviceChannelUnresolvedError = class extends Error {
-  sn;
-  stationSn;
-  constructor(sn, stationSn, options) {
-    super(`${sn} has no usable channel on station ${stationSn}, so nothing was sent to it`, options);
-    this.sn = sn;
-    this.stationSn = stationSn;
-    this.name = "DeviceChannelUnresolvedError";
-  }
-};
-var LiveStreamStartError = class extends Error {
-  reason;
-  stage;
-  timeoutMs;
-  attempts;
-  constructor(failure) {
-    super(`live stream failed to start (${failure.reason} at ${failure.stage} after ${failure.attempts} attempts; ${failure.timeoutMs}ms deadline)`, failure.cause === void 0 ? void 0 : { cause: failure.cause });
-    this.name = "LiveStreamStartError";
-    this.reason = failure.reason;
-    this.stage = failure.stage;
-    this.timeoutMs = failure.timeoutMs;
-    this.attempts = failure.attempts;
-  }
-};
-var StateConvergenceError = class extends Error {
-  sn;
-  property;
-  param;
-  expected;
-  observed;
-  timeoutMs;
-  constructor(failure) {
-    super(`device ${failure.sn} did not report ${failure.property} as ${String(failure.expected)} within ${failure.timeoutMs}ms (param ${failure.param} read ${String(failure.observed)})`);
-    this.name = "StateConvergenceError";
-    this.sn = failure.sn;
-    this.property = failure.property;
-    this.param = failure.param;
-    this.expected = failure.expected;
-    this.observed = failure.observed;
-    this.timeoutMs = failure.timeoutMs;
-  }
-};
-var COMMAND_OBSERVATION = /* @__PURE__ */ Symbol("command-observation");
-function observeCommand(command, observation) {
-  return Object.defineProperty(command, COMMAND_OBSERVATION, { configurable: true, value: observation });
-}
-function commandObservation(command) {
-  return command[COMMAND_OBSERVATION];
-}
-
 // dist/model/capabilities/access.js
 function setScalar(param, value, ctx, form = "auto") {
   return { kind: "set-param", param, value, form, channel: ctx.channel };
@@ -7581,85 +7728,6 @@ var STORAGE = {
   detection: { codecs: ["station"] }
 };
 
-// dist/core/raw-dp-writer.js
-var WIRE = { VARINT: 0, LENGTH_DELIMITED: 2 };
-function encodeVarint(value) {
-  if (!Number.isSafeInteger(value) || value < 0) {
-    throw new Error(`varint: ${value} is not a non-negative safe integer`);
-  }
-  const out = [];
-  let v = value;
-  while (v > 127) {
-    out.push(v % 128 + 128);
-    v = Math.floor(v / 128);
-  }
-  out.push(v);
-  return out;
-}
-function zigzag(value) {
-  if (!Number.isSafeInteger(value))
-    throw new Error(`zigzag: ${value} is not a safe integer`);
-  return value < 0 ? -2 * value - 1 : 2 * value;
-}
-var RawDpWriter = class _RawDpWriter {
-  body = [];
-  /** A varint-valued field (`int32`, `uint32`, `bool`, an enum member). */
-  int(field, value) {
-    this.body.push(...encodeVarint(tag(field, WIRE.VARINT)), ...encodeVarint(value));
-    return this;
-  }
-  /** A signed varint field (`sint32`, `sint64`), ZigZag-encoded — see {@link zigzag}. */
-  sint(field, value) {
-    return this.int(field, zigzag(value));
-  }
-  /** A boolean field, on protobuf's own terms: `1` or `0` in a varint. */
-  bool(field, value) {
-    return this.int(field, value ? 1 : 0);
-  }
-  /** A length-delimited field carrying raw bytes — a string, a blob, or a message built elsewhere. */
-  bytes(field, value) {
-    const bytes2 = value instanceof Uint8Array ? Array.from(value) : [...value];
-    this.body.push(...encodeVarint(tag(field, WIRE.LENGTH_DELIMITED)), ...encodeVarint(bytes2.length), ...bytes2);
-    return this;
-  }
-  /**
-   * A nested sub-message, built by `build` into a writer of its own.
-   *
-   * The sub-message is emitted even when `build` writes nothing into it. That is not an oversight: an
-   * EMPTY sub-message is how these protocols say "this subsystem exists and is in its zero state", as
-   * opposed to saying nothing about it, and the readers on the other side of this file depend on the
-   * distinction. Omitting the call is what says nothing about it.
-   */
-  sub(field, build) {
-    const inner = new _RawDpWriter();
-    build(inner);
-    return this.bytes(field, inner.toBytes());
-  }
-  /** The message body on its own, unframed — for nesting into another writer. */
-  toBytes() {
-    return [...this.body];
-  }
-  /**
-   * The finished DP value: `varint(bodyLength) ++ body`, base64-encoded.
-   *
-   * This is the envelope `RawDpCodec.decode` unwraps, so a value produced here and read back through the
-   * codec is a genuine round-trip rather than two implementations of the same guess.
-   */
-  finish() {
-    return Buffer.from([...encodeVarint(this.body.length), ...this.body]).toString("base64");
-  }
-};
-function tag(field, wire) {
-  if (!Number.isSafeInteger(field) || field < 1)
-    throw new Error(`field number: ${field} is not a positive integer`);
-  return field * 8 + wire;
-}
-function rawDp(build) {
-  const w = new RawDpWriter();
-  build(w);
-  return w.finish();
-}
-
 // dist/model/capabilities/vacuum-dock.js
 var VACUUM_DOCK_DP = 173;
 var VACUUM_DOCK_INFO_DP = 169;
@@ -13364,58 +13432,6 @@ function parseCleanRecordDetail(blob, codec) {
   };
 }
 
-// dist/core/lz4-block.js
-var MAX_OUTPUT = 64 * 1024 * 1024;
-function lz4BlockDecompress(block, size) {
-  if (!Number.isSafeInteger(size) || size < 0 || size > MAX_OUTPUT)
-    return void 0;
-  const out = Buffer.alloc(size);
-  const end = block.length;
-  let pos = 0;
-  let written = 0;
-  const extend2 = (base) => {
-    let len = base;
-    if (base !== 15)
-      return len;
-    for (; ; ) {
-      if (pos >= end)
-        return void 0;
-      const extra = block[pos++];
-      len += extra;
-      if (extra !== 255)
-        return len;
-    }
-  };
-  while (pos < end) {
-    const token = block[pos++];
-    const literals = extend2(token >> 4);
-    if (literals === void 0)
-      return void 0;
-    if (pos + literals > end || written + literals > size)
-      return void 0;
-    for (let i = 0; i < literals; i++)
-      out[written++] = block[pos++];
-    if (pos === end)
-      break;
-    if (pos + 2 > end)
-      return void 0;
-    const offset = block[pos] | block[pos + 1] << 8;
-    pos += 2;
-    if (offset === 0 || offset > written)
-      return void 0;
-    const match = extend2(token & 15);
-    if (match === void 0)
-      return void 0;
-    const length = match + 4;
-    if (written + length > size)
-      return void 0;
-    let from = written - offset;
-    for (let i = 0; i < length; i++)
-      out[written++] = out[from++];
-  }
-  return written === size ? out : void 0;
-}
-
 // dist/model/vacuum-map.js
 var DOCK_KINDS = ["charger", "station"];
 var MAP_QUALITIES = ["incomplete", "rough", "effective", "listFull"];
@@ -15214,6 +15230,7 @@ var CMD_DATABASE_IMAGE = 1308;
 var CMD_DATABASE = 1306;
 var DB_QUERY = { FULL_TABLE: 1e4, COMBINATION_WITH_AI: 10011 };
 var GCM_AAD = Buffer.from("eufy security");
+var LEVEL2_SEQ_BASE = 16909056;
 function paramReport(payload) {
   const list = payload?.params;
   if (!Array.isArray(list))
@@ -16318,11 +16335,6 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
     this.seqNumber = this.seqNumber + 1 & 65535;
     this.send(this.connectAddress, RequestMessageType.DATA, data);
   }
-  /**
-   * Encrypt a level-2 command body (signCode 8): `tag(16) ‖ nonce(12) ‖ [seq,03,02,01](4) ‖
-   * ciphertext`, AES-256-GCM under the negotiated session key, AAD "eufy security". Inverse of
-   * `decryptLevel2`. The 4-byte sub-header is cleartext (skipped on decrypt); `seq` is a counter.
-   */
   /**
    * Decode a `CMD_VIDEO_FRAME` (1300) payload into clean Annex-B H.264 (the 22-byte frame header
    * stripped). Reversed from the V6 app + live H.264 captures: the 22-byte header is
@@ -16389,6 +16401,11 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
     }
     return this.rsaModulusHex;
   }
+  /**
+   * Encrypt a level-2 command body (signCode 8): `tag(16) ‖ nonce(12) ‖ seq(4) ‖ ciphertext`,
+   * AES-256-GCM under the negotiated session key, AAD "eufy security". Inverse of `decryptLevel2`.
+   * The 4-byte sub-header is cleartext (skipped on decrypt); `seq` counts up from {@link LEVEL2_SEQ_BASE}.
+   */
   encryptLevel2(plaintext) {
     if (!this.level2Key)
       return void 0;
@@ -16396,8 +16413,8 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
     const c = createCipheriv3("aes-256-gcm", this.level2Key, nonce);
     c.setAAD(GCM_AAD);
     const ct = Buffer.concat([c.update(plaintext), c.final()]);
-    const sub2 = Buffer.from([this.level2Seq & 255, 3, 2, 1]);
-    this.level2Seq = this.level2Seq + 1 & 255;
+    const sub2 = Buffer.alloc(4);
+    sub2.writeUInt32LE(LEVEL2_SEQ_BASE + this.level2Seq++ >>> 0);
     return Buffer.concat([c.getAuthTag(), nonce, sub2, ct]);
   }
   /** Send a no-arg command frame (e.g. CMD_GATEWAYINFO) on a channel (default: the station channel). */
@@ -27189,26 +27206,16 @@ var SolixClient = class _SolixClient {
   }
   /** Build the encrypted, signed `/passport/login` request body + headers for the negotiated key. */
   async postLogin(kx, verifyCode, limitedToken) {
-    const { clientPublicKeyHex, encryptedPassword } = encryptLoginPassword(this.password);
     const bodyObj = {
-      email: this.email,
-      password: encryptedPassword,
-      ab: this.country,
-      client_secret_info: { public_key: clientPublicKeyHex },
+      ...loginCredentials(this.email, this.password, this.country),
       answer: "",
       captcha_id: "",
       verify_code: verifyCode ?? "",
       login_id: ""
     };
     const encBody = encryptBody(JSON.stringify(bodyObj), kx.shareKey);
-    const ts = nowSec();
-    const once = genId();
     return this.post(this.apiHost, SOLIX_ENDPOINTS.login, encBody, this.authHeaders({
-      "x-encryption-info": "algo_ecdh",
-      "x-key-ident": kx.keyIdent,
-      "x-request-ts": ts,
-      "x-request-once": once,
-      "x-signature": signRequest(kx.shareKey, ts, once, encBody),
+      ...signedHeaders(kx, encBody),
       ...limitedToken ? { "x-auth-token": limitedToken } : {}
     }));
   }
@@ -27223,13 +27230,12 @@ var SolixClient = class _SolixClient {
    * observed refusing the header, which is consistent with the two ids agreeing on the accounts seen.
    */
   classifyLogin(data, isVerify) {
-    const userId = data.ap_cloud_user_id ?? data.user_id;
-    const authToken = data.auth_token;
-    if (!userId || !authToken)
+    const reply = readLoginReply(data);
+    if (!reply)
       throw new Error(`Solix login returned no session: ${JSON.stringify(data).slice(0, 160)}`);
-    const faInfo = data.fa_info ?? {};
-    if (!isVerify && faInfo.info) {
-      this.pending2fa = { limitedToken: authToken, userId, geoKey: data.geo_key };
+    const { userId, authToken } = reply;
+    if (!isVerify && reply.twoFactorPending) {
+      this.pending2fa = { limitedToken: authToken, userId, geoKey: reply.geoKey };
       return { status: "2fa", method: "code sent by the passport" };
     }
     this.pending2fa = void 0;
@@ -27238,7 +27244,7 @@ var SolixClient = class _SolixClient {
       userId,
       gtoken: gtoken(userId),
       apiHost: this.apiHost,
-      tokenExpiresAt: Number(data.token_expires_at ?? 0) || 0
+      tokenExpiresAt: reply.tokenExpiresAt
     };
     this.persist();
     return { status: "ok", session: this.session_ };
@@ -27393,14 +27399,8 @@ var SolixClient = class _SolixClient {
       throw new Error("not authenticated \u2014 call login() first");
     const kx = await this.keyExchange();
     const encBody = encryptBody(JSON.stringify(payload), kx.shareKey);
-    const ts = nowSec();
-    const once = genId();
     const env = await this.post(this.apiHost, path, encBody, this.baseHeaders({
-      "x-encryption-info": "algo_ecdh",
-      "x-key-ident": kx.keyIdent,
-      "x-request-ts": ts,
-      "x-request-once": once,
-      "x-signature": signRequest(kx.shareKey, ts, once, encBody),
+      ...signedHeaders(kx, encBody),
       "x-auth-token": this.session_.authToken,
       gtoken: this.session_.gtoken
     }));