@mega-yfue/eufy-sdk 0.4.0-beta.2 → 0.4.0-beta.20

package/dist/index.js

@@ -1070,6 +1070,409 @@ function normalizePushImage(data, p2pDid) {
   return decodeImageV1(data, p2pDid) ?? data;
 }
 
+// dist/core/types.js
+var PRINTER_CATEGORY_RE = /ankermake|eufymake|fdm|3d_?print/i;
+function classifyDevice(raw) {
+  const category = raw.category ?? "";
+  const hasP2p = typeof raw.p2p_did === "string" && raw.p2p_did.length > 0;
+  if (category === "eufy_security" || hasP2p)
+    return { category, api: "mega", realtime: "p2p" };
+  if (PRINTER_CATEGORY_RE.test(category))
+    return { category, api: "ankermake", realtime: "ankermake-mqtt" };
+  return { category, api: "mega", realtime: "smqtt" };
+}
+
+// dist/core/contracts.js
+var StoredSnapshotUnavailableError = class extends Error {
+  reason;
+  constructor(reason, message, options) {
+    super(message, options);
+    this.reason = reason;
+    this.name = "StoredSnapshotUnavailableError";
+  }
+};
+var RETRYABLE_LIVE_SNAPSHOT_REASONS = [
+  "no-keyframe",
+  "source-failed",
+  "undecodable-burst"
+];
+var LiveSnapshotUnavailableError = class extends Error {
+  reason;
+  /** Whether another attempt could plausibly succeed without the host changing anything. */
+  retryable;
+  constructor(reason, message, options) {
+    super(message, options);
+    this.reason = reason;
+    this.name = "LiveSnapshotUnavailableError";
+    this.retryable = RETRYABLE_LIVE_SNAPSHOT_REASONS.includes(reason);
+  }
+};
+var CameraDisabledError = class extends Error {
+  camera;
+  constructor(camera, options) {
+    super(`camera${camera ? ` ${camera}` : ""} is disabled \u2014 no live stream possible`, options);
+    this.camera = camera;
+    this.name = "CameraDisabledError";
+  }
+};
+var StationKeyUnavailableError = class extends Error {
+  stationSn;
+  /** Always true: the negotiation is per connection, so a later one may still produce a key. */
+  retryable = true;
+  constructor(stationSn, options) {
+    super(`station ${stationSn} did not provide its session key, so nothing that requires one could be sent`, options);
+    this.stationSn = stationSn;
+    this.name = "StationKeyUnavailableError";
+  }
+};
+var StationUnreachableError = class extends Error {
+  stationSn;
+  waitedMs;
+  /** Always true: a station unreachable now may answer on a later attempt. */
+  retryable = true;
+  constructor(stationSn, waitedMs, options) {
+    super(`station ${stationSn}'s P2P session did not connect within ${waitedMs}ms, so nothing could be sent to it`, options);
+    this.stationSn = stationSn;
+    this.waitedMs = waitedMs;
+    this.name = "StationUnreachableError";
+  }
+};
+var DeviceChannelUnresolvedError = class extends Error {
+  sn;
+  stationSn;
+  constructor(sn, stationSn, options) {
+    super(`${sn} has no usable channel on station ${stationSn}, so nothing was sent to it`, options);
+    this.sn = sn;
+    this.stationSn = stationSn;
+    this.name = "DeviceChannelUnresolvedError";
+  }
+};
+var RecordingDownloadError = class extends Error {
+  reason;
+  constructor(reason, message, options) {
+    super(message, options);
+    this.reason = reason;
+    this.name = "RecordingDownloadError";
+  }
+};
+var LiveStreamStartError = class extends Error {
+  reason;
+  stage;
+  timeoutMs;
+  attempts;
+  constructor(failure) {
+    super(`live stream failed to start (${failure.reason} at ${failure.stage} after ${failure.attempts} attempts; ${failure.timeoutMs}ms deadline)`, failure.cause === void 0 ? void 0 : { cause: failure.cause });
+    this.name = "LiveStreamStartError";
+    this.reason = failure.reason;
+    this.stage = failure.stage;
+    this.timeoutMs = failure.timeoutMs;
+    this.attempts = failure.attempts;
+  }
+};
+var StateConvergenceError = class extends Error {
+  sn;
+  property;
+  param;
+  expected;
+  observed;
+  timeoutMs;
+  constructor(failure) {
+    super(`device ${failure.sn} did not report ${failure.property} as ${String(failure.expected)} within ${failure.timeoutMs}ms (param ${failure.param} read ${String(failure.observed)})`);
+    this.name = "StateConvergenceError";
+    this.sn = failure.sn;
+    this.property = failure.property;
+    this.param = failure.param;
+    this.expected = failure.expected;
+    this.observed = failure.observed;
+    this.timeoutMs = failure.timeoutMs;
+  }
+};
+var COMMAND_OBSERVATION = /* @__PURE__ */ Symbol("command-observation");
+function observeCommand(command, observation) {
+  return Object.defineProperty(command, COMMAND_OBSERVATION, { configurable: true, value: observation });
+}
+function commandObservation(command) {
+  return command[COMMAND_OBSERVATION];
+}
+
+// dist/core/raw-dp-writer.js
+var WIRE = { VARINT: 0, LENGTH_DELIMITED: 2 };
+function encodeVarint(value) {
+  if (!Number.isSafeInteger(value) || value < 0) {
+    throw new Error(`varint: ${value} is not a non-negative safe integer`);
+  }
+  const out = [];
+  let v = value;
+  while (v > 127) {
+    out.push(v % 128 + 128);
+    v = Math.floor(v / 128);
+  }
+  out.push(v);
+  return out;
+}
+function zigzag(value) {
+  if (!Number.isSafeInteger(value))
+    throw new Error(`zigzag: ${value} is not a safe integer`);
+  return value < 0 ? -2 * value - 1 : 2 * value;
+}
+var RawDpWriter = class _RawDpWriter {
+  body = [];
+  /** A varint-valued field (`int32`, `uint32`, `bool`, an enum member). */
+  int(field, value) {
+    this.body.push(...encodeVarint(tag(field, WIRE.VARINT)), ...encodeVarint(value));
+    return this;
+  }
+  /** A signed varint field (`sint32`, `sint64`), ZigZag-encoded — see {@link zigzag}. */
+  sint(field, value) {
+    return this.int(field, zigzag(value));
+  }
+  /** A boolean field, on protobuf's own terms: `1` or `0` in a varint. */
+  bool(field, value) {
+    return this.int(field, value ? 1 : 0);
+  }
+  /** A length-delimited field carrying raw bytes — a string, a blob, or a message built elsewhere. */
+  bytes(field, value) {
+    const bytes2 = value instanceof Uint8Array ? Array.from(value) : [...value];
+    this.body.push(...encodeVarint(tag(field, WIRE.LENGTH_DELIMITED)), ...encodeVarint(bytes2.length), ...bytes2);
+    return this;
+  }
+  /**
+   * A nested sub-message, built by `build` into a writer of its own.
+   *
+   * The sub-message is emitted even when `build` writes nothing into it. That is not an oversight: an
+   * EMPTY sub-message is how these protocols say "this subsystem exists and is in its zero state", as
+   * opposed to saying nothing about it, and the readers on the other side of this file depend on the
+   * distinction. Omitting the call is what says nothing about it.
+   */
+  sub(field, build) {
+    const inner = new _RawDpWriter();
+    build(inner);
+    return this.bytes(field, inner.toBytes());
+  }
+  /** The message body on its own, unframed — for nesting into another writer. */
+  toBytes() {
+    return [...this.body];
+  }
+  /**
+   * The finished DP value: `varint(bodyLength) ++ body`, base64-encoded.
+   *
+   * This is the envelope `RawDpCodec.decode` unwraps, so a value produced here and read back through the
+   * codec is a genuine round-trip rather than two implementations of the same guess.
+   */
+  finish() {
+    return Buffer.from([...encodeVarint(this.body.length), ...this.body]).toString("base64");
+  }
+};
+function tag(field, wire) {
+  if (!Number.isSafeInteger(field) || field < 1)
+    throw new Error(`field number: ${field} is not a positive integer`);
+  return field * 8 + wire;
+}
+function rawDp(build) {
+  const w = new RawDpWriter();
+  build(w);
+  return w.finish();
+}
+
+// dist/core/raw-dp-hex.js
+function hexToRawDp(hex) {
+  if (hex.length === 0 || hex.length % 2 !== 0 || !/^[0-9a-fA-F]+$/.test(hex))
+    return void 0;
+  return Buffer.from(hex, "hex").toString("base64");
+}
+
+// dist/core/util.js
+var Timer = class {
+  handle;
+  /** (Re)arm to run `fn` after `ms`, cancelling any already-pending fire. */
+  arm(ms, fn) {
+    this.cancel();
+    this.handle = setTimeout(() => {
+      this.handle = void 0;
+      fn();
+    }, ms);
+    this.handle.unref?.();
+  }
+  /** Cancel a pending fire. No-op if not armed. */
+  cancel() {
+    if (this.handle) {
+      clearTimeout(this.handle);
+      this.handle = void 0;
+    }
+  }
+  /** Whether a fire is currently scheduled. */
+  get pending() {
+    return this.handle !== void 0;
+  }
+};
+function assertNever(value) {
+  throw new Error(`unhandled variant: ${JSON.stringify(value)}`);
+}
+function asBool(value) {
+  if (typeof value === "string")
+    return value === "1" || value.toLowerCase() === "true";
+  return value === true || value === 1;
+}
+function clamp(value, min, max) {
+  if (Number.isNaN(value))
+    return min;
+  return Math.max(min, Math.min(max, Math.round(value)));
+}
+function structuralEqual(a, b) {
+  if (Object.is(a, b))
+    return true;
+  if (typeof a !== "object" || typeof b !== "object" || a === null || b === null)
+    return false;
+  const aArr = Array.isArray(a);
+  const bArr = Array.isArray(b);
+  if (aArr !== bArr)
+    return false;
+  if (aArr && bArr) {
+    if (a.length !== b.length)
+      return false;
+    for (let i = 0; i < a.length; i++)
+      if (!structuralEqual(a[i], b[i]))
+        return false;
+    return true;
+  }
+  const aObj = a;
+  const bObj = b;
+  const aKeys = Object.keys(aObj);
+  const bKeys = Object.keys(bObj);
+  if (aKeys.length !== bKeys.length)
+    return false;
+  for (const k of aKeys) {
+    if (!Object.prototype.hasOwnProperty.call(bObj, k))
+      return false;
+    if (!structuralEqual(aObj[k], bObj[k]))
+      return false;
+  }
+  return true;
+}
+function coerceEnumValue(enumObj, value) {
+  const n = Number(value);
+  return Number.isInteger(n) && Object.values(enumObj).includes(n) ? n : void 0;
+}
+function enumValues(enumObj) {
+  return Object.values(enumObj).join("/");
+}
+function enumLabels(enumObj) {
+  return Object.fromEntries(Object.entries(enumObj).map(([name, value]) => [value, name]));
+}
+function jsonObject(text2) {
+  if (typeof text2 !== "string")
+    return void 0;
+  try {
+    const v = JSON.parse(text2);
+    return v && typeof v === "object" && !Array.isArray(v) ? v : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function u16le(n) {
+  const b = Buffer.alloc(2);
+  b.writeUInt16LE(n & 65535);
+  return b;
+}
+function u16be(n) {
+  const b = Buffer.alloc(2);
+  b.writeUInt16BE(n & 65535);
+  return b;
+}
+function u32le(n) {
+  const b = Buffer.alloc(4);
+  b.writeUInt32LE(n >>> 0);
+  return b;
+}
+function u32be(n) {
+  const b = Buffer.alloc(4);
+  b.writeUInt32BE(n >>> 0);
+  return b;
+}
+
+// dist/core/lz4-block.js
+var MAX_OUTPUT = 64 * 1024 * 1024;
+function lz4BlockDecompress(block, size) {
+  if (!Number.isSafeInteger(size) || size < 0 || size > MAX_OUTPUT)
+    return void 0;
+  const out = Buffer.alloc(size);
+  const end = block.length;
+  let pos = 0;
+  let written = 0;
+  const extend2 = (base) => {
+    let len = base;
+    if (base !== 15)
+      return len;
+    for (; ; ) {
+      if (pos >= end)
+        return void 0;
+      const extra = block[pos++];
+      len += extra;
+      if (extra !== 255)
+        return len;
+    }
+  };
+  while (pos < end) {
+    const token = block[pos++];
+    const literals = extend2(token >> 4);
+    if (literals === void 0)
+      return void 0;
+    if (pos + literals > end || written + literals > size)
+      return void 0;
+    for (let i = 0; i < literals; i++)
+      out[written++] = block[pos++];
+    if (pos === end)
+      break;
+    if (pos + 2 > end)
+      return void 0;
+    const offset = block[pos] | block[pos + 1] << 8;
+    pos += 2;
+    if (offset === 0 || offset > written)
+      return void 0;
+    const match = extend2(token & 15);
+    if (match === void 0)
+      return void 0;
+    const length = match + 4;
+    if (written + length > size)
+      return void 0;
+    let from = written - offset;
+    for (let i = 0; i < length; i++)
+      out[written++] = out[from++];
+  }
+  return written === size ? out : void 0;
+}
+
+// dist/transport/http/passport.js
+function loginCredentials(email, password, country) {
+  const { clientPublicKeyHex, encryptedPassword } = encryptLoginPassword(password);
+  return { email, password: encryptedPassword, ab: country, client_secret_info: { public_key: clientPublicKeyHex } };
+}
+function readLoginReply(data) {
+  const userId = data.ap_cloud_user_id ?? data.user_id ?? data.userId;
+  const authToken = data.auth_token ?? data.token;
+  if (!userId || !authToken)
+    return void 0;
+  return {
+    userId,
+    accountUserId: data.user_id ?? data.userId,
+    authToken,
+    geoKey: data.geo_key,
+    tokenExpiresAt: Number(data.token_expires_at ?? 0) || 0,
+    twoFactorPending: !!(data.fa_info ?? {}).info
+  };
+}
+function signedHeaders(entry, encBody) {
+  const ts = nowSec();
+  const once = genId();
+  return {
+    "x-encryption-info": "algo_ecdh",
+    "x-key-ident": entry.keyIdent,
+    "x-request-ts": ts,
+    "x-request-once": once,
+    "x-signature": signRequest(entry.shareKey, ts, once, encBody)
+  };
+}
+
 // dist/transport/http/mega-client.js
 function parseMaybeJson(text2) {
   if (text2.length === 0)
@@ -1437,17 +1840,11 @@ ${this.auth_?.authToken ?? ""}`;
     const order = preferred === "text/plain" ? ["text/plain", "application/json"] : ["application/json", "text/plain"];
     let last;
     for (const contentType of order) {
-      const ts = nowSec();
-      const once = genId();
       const headers = {
         ...this.baseHeaders(),
         "content-type": contentType,
-        "x-encryption-info": "algo_ecdh",
+        ...signedHeaders(entry, encBody),
         "x-replay-info": "replay",
-        "x-key-ident": entry.keyIdent,
-        "x-request-ts": ts,
-        "x-request-once": once,
-        "x-signature": signRequest(entry.shareKey, ts, once, encBody),
         // Per-call header overrides (e.g. app-name=eufy_security to request a security-scoped
         // MQTT cert on an existing eufy_mega session — see EufyMega.getUserMqttInfo).
         ...headerOverrides
@@ -1746,13 +2143,7 @@ ${this.auth_?.authToken ?? ""}`;
   }
   /** Build the /passport/login body (verify_code empty unless 2FA). */
   loginBody(opts) {
-    const { clientPublicKeyHex, encryptedPassword } = encryptLoginPassword(this.cfg.password);
-    const base = {
-      email: this.cfg.email,
-      password: encryptedPassword,
-      ab: this.cfg.countryCode,
-      client_secret_info: { public_key: clientPublicKeyHex }
-    };
+    const base = loginCredentials(this.cfg.email, this.cfg.password, this.cfg.countryCode);
     if (opts.verifyCode)
       return { ...base, verify_code: opts.verifyCode, login_id: "" };
     if (opts.captchaId)
@@ -1990,15 +2381,12 @@ ${this.auth_?.authToken ?? ""}`;
       if (cap.length)
         this.logger.debug("[mega] captcha/fa:", JSON.stringify(Object.fromEntries(cap.map((k) => [k, res[k]]))));
     }
-    const userId = res.ap_cloud_user_id ?? res.user_id ?? res.userId;
-    const accountUserId = res.user_id ?? res.userId;
-    const authToken = res.auth_token ?? res.token;
-    if (!userId || !authToken)
+    const reply = readLoginReply(res);
+    if (!reply)
       throw new Error(`login returned no session: ${JSON.stringify(res).slice(0, 200)}`);
-    const faInfo = res.fa_info ?? {};
-    const needs2fa = !isVerify && !!faInfo.info;
-    if (needs2fa) {
-      this.auth_ = { userId, accountUserId, authToken, geoKey: res.geo_key };
+    const { userId, accountUserId, authToken, geoKey } = reply;
+    if (!isVerify && reply.twoFactorPending) {
+      this.auth_ = { userId, accountUserId, authToken, geoKey };
       this.pendingCaptchaId = void 0;
       this.pending2fa = true;
       await this.sendVerifyCode(messageType);
@@ -2006,8 +2394,8 @@ ${this.auth_?.authToken ?? ""}`;
     }
     this.pendingCaptchaId = void 0;
     this.pending2fa = false;
-    this.auth_ = { userId, accountUserId, authToken, geoKey: res.geo_key };
-    this.tokenExpiresAt = Number(res.token_expires_at ?? 0) || 0;
+    this.auth_ = { userId, accountUserId, authToken, geoKey };
+    this.tokenExpiresAt = reply.tokenExpiresAt;
     this.sessionKey = void 0;
     await this.ensureSessionKey();
     this.persist();
@@ -2125,6 +2513,10 @@ function solixUserTopics(appName, userId) {
 
 // dist/transport/mqtt/secure-mqtt.js
 var SUBACK_FAILURE = 128;
+function isRefusal(err) {
+  const granted = err?.packet?.granted;
+  return Array.isArray(granted) && granted.some((g) => typeof g === "number" && (g & SUBACK_FAILURE) !== 0);
+}
 function isNotAuthorized(err) {
   return err instanceof Error && /connection refused/i.test(err.message) && /not authori[sz]ed/i.test(err.message);
 }
@@ -2227,19 +2619,16 @@ var SecureMqtt = class extends EventEmitter {
   }
   /**
    * Subscribe every inbound leg this device's line uses (see `topics.ts` — one `/res` for most lines,
-   * four topics for `eufy_life`).
+   * four topics for `eufy_life` and the clean line).
    *
-   * The grants are INSPECTED, not assumed: AWS IoT answers a policy-denied filter with a
-   * SUBACK_FAILURE (`0x80`) grant rather than failing the SUBSCRIBE, so subscribing with a credential
-   * whose scope doesn't cover the topic looks identical to success and then delivers nothing. A denied
-   * topic is reported via `error` naming the credential scope; only an all-denied device throws, so a
-   * line that grants its state channel but refuses (say) the OTA leg still works.
+   * The grants are INSPECTED, not assumed: AWS IoT refuses a policy-denied filter with a
+   * {@link SUBACK_FAILURE} grant rather than failing the connection. A denied topic is reported via
+   * `error` naming the credential scope; only an all-denied device throws, so a line that grants its
+   * state channel but refuses (say) a business leg still works.
    */
   async subscribeDevice(device) {
-    if (!this.client)
-      throw new Error("SecureMqtt not connected");
     const topics = [...subscribeTopics(device)];
-    const { denied } = this.partitionGrants(await this.client.subscribeAsync(topics, { qos: 1 }));
+    const { denied } = await this.subscribeEach(topics);
     const scope = this.o.credentials.app_name ?? "default";
     if (denied.length === topics.length) {
       throw new Error(`subscribe ${device.sn}: every topic denied on credential scope "${scope}" \u2014 this line's topics are granted to a different scope (${denied.join(", ")})`);
@@ -2250,25 +2639,43 @@ var SecureMqtt = class extends EventEmitter {
   }
   /**
    * Subscribe to explicit topic filters, returning the topics that were granted. A scope-denied filter
-   * comes back with SUBACK_FAILURE rather than an error (AWS IoT quirk), so it is dropped from the result
-   * instead of throwing — callers that need every leg check the returned list. Used by lines whose topic
-   * vocabulary isn't the eufy `subscribeTopics` shape (e.g. Anker Solix `dt/{app}/{pn}/{sn}`).
+   * is dropped from the result instead of throwing — callers that need every leg check the returned
+   * list. Used by lines whose topic vocabulary isn't the eufy `subscribeTopics` shape (e.g. Anker Solix
+   * `dt/{app}/{pn}/{sn}`).
    */
   async subscribe(topics) {
-    if (!this.client)
-      throw new Error("SecureMqtt not connected");
-    return this.partitionGrants(await this.client.subscribeAsync(topics, { qos: 1 })).granted;
+    return (await this.subscribeEach(topics)).granted;
   }
   /**
-   * Split SUBACK grants into granted vs scope-denied topics. AWS IoT marks a policy-denied filter with a
-   * SUBACK_FAILURE (`0x80`) grant rather than failing the SUBSCRIBE, so the two subscribe paths share
-   * this split and layer their own policy (drop vs report) on top.
+   * Subscribe each filter in a SUBSCRIBE of its own and split the outcome into granted vs refused.
+   *
+   * One request per filter because the MQTT engine treats a SUBACK as all-or-nothing: one refused grant
+   * rejects the whole request, and it forgets EVERY filter of that request for resubscription after a
+   * reconnect — so a batch holding one denied leg would lose the granted legs on the next drop. Alone,
+   * a refused filter costs only itself. A rejection that carries no SUBACK is a transport failure and
+   * is thrown.
+   *
+   * The cost is one SUBSCRIBE and one SUBACK per filter instead of one per device — four for a
+   * four-leg line. They are sent concurrently, so the wall-clock cost is one round trip. Folding them
+   * back into one request brings back the lost resubscription.
    */
-  partitionGrants(grants) {
+  async subscribeEach(topics) {
+    const client = this.client;
+    if (!client)
+      throw new Error("SecureMqtt not connected");
+    const outcomes = await Promise.allSettled(topics.map((topic) => client.subscribeAsync(topic, { qos: 1 })));
     const granted = [];
     const denied = [];
-    for (const g of grants)
-      (g.qos === SUBACK_FAILURE ? denied : granted).push(g.topic);
+    outcomes.forEach((outcome, i) => {
+      const topic = topics[i];
+      if (outcome.status === "fulfilled") {
+        granted.push(topic);
+        return;
+      }
+      if (!isRefusal(outcome.reason))
+        throw outcome.reason;
+      denied.push(topic);
+    });
     return { granted, denied };
   }
   /**
@@ -2278,139 +2685,30 @@ var SecureMqtt = class extends EventEmitter {
    *
    * NOTE: which cert scope is used does NOT gate publishing to a security device's topic — confirmed
    * live, an `eufy_mega`-scoped cert and an `eufy_security`-scoped cert get the identical grant/deny
-   * pattern. What actually matters is landing on the broker instance that currently holds the device's
-   * session (`ensureSecurityMqttFor`/`broker-discovery.ts` — the NLB fronts several instances that
-   * don't share subscribe/publish routing).
-   */
-  async publish(topic, body, opts = {}) {
-    if (!this.client)
-      throw new Error("SecureMqtt not connected");
-    await this.client.publishAsync(topic, body, { qos: opts.qos ?? 1 });
-  }
-  async disconnect() {
-    this.connecting = void 0;
-    await this.client?.endAsync(true);
-    this.client = void 0;
-  }
-};
-
-// dist/transport/mqtt/app-client-id.js
-import { createHash as createHash4 } from "node:crypto";
-function buildAppShapedClientId(input) {
-  const ts = input.timestamp ?? Math.floor(Date.now() / 1e3);
-  return `android-${input.appName}-${input.uid}-${input.mqttUuid}-${ts}`;
-}
-function mqttUuidFrom(installId) {
-  return createHash4("sha256").update(installId).digest("hex").slice(0, 16);
-}
-
-// dist/core/util.js
-var Timer = class {
-  handle;
-  /** (Re)arm to run `fn` after `ms`, cancelling any already-pending fire. */
-  arm(ms, fn) {
-    this.cancel();
-    this.handle = setTimeout(() => {
-      this.handle = void 0;
-      fn();
-    }, ms);
-    this.handle.unref?.();
-  }
-  /** Cancel a pending fire. No-op if not armed. */
-  cancel() {
-    if (this.handle) {
-      clearTimeout(this.handle);
-      this.handle = void 0;
-    }
-  }
-  /** Whether a fire is currently scheduled. */
-  get pending() {
-    return this.handle !== void 0;
-  }
-};
-function assertNever(value) {
-  throw new Error(`unhandled variant: ${JSON.stringify(value)}`);
-}
-function asBool(value) {
-  if (typeof value === "string")
-    return value === "1" || value.toLowerCase() === "true";
-  return value === true || value === 1;
-}
-function clamp(value, min, max) {
-  if (Number.isNaN(value))
-    return min;
-  return Math.max(min, Math.min(max, Math.round(value)));
-}
-function structuralEqual(a, b) {
-  if (Object.is(a, b))
-    return true;
-  if (typeof a !== "object" || typeof b !== "object" || a === null || b === null)
-    return false;
-  const aArr = Array.isArray(a);
-  const bArr = Array.isArray(b);
-  if (aArr !== bArr)
-    return false;
-  if (aArr && bArr) {
-    if (a.length !== b.length)
-      return false;
-    for (let i = 0; i < a.length; i++)
-      if (!structuralEqual(a[i], b[i]))
-        return false;
-    return true;
-  }
-  const aObj = a;
-  const bObj = b;
-  const aKeys = Object.keys(aObj);
-  const bKeys = Object.keys(bObj);
-  if (aKeys.length !== bKeys.length)
-    return false;
-  for (const k of aKeys) {
-    if (!Object.prototype.hasOwnProperty.call(bObj, k))
-      return false;
-    if (!structuralEqual(aObj[k], bObj[k]))
-      return false;
-  }
-  return true;
-}
-function coerceEnumValue(enumObj, value) {
-  const n = Number(value);
-  return Number.isInteger(n) && Object.values(enumObj).includes(n) ? n : void 0;
-}
-function enumValues(enumObj) {
-  return Object.values(enumObj).join("/");
-}
-function enumLabels(enumObj) {
-  return Object.fromEntries(Object.entries(enumObj).map(([name, value]) => [value, name]));
-}
-function jsonObject(text2) {
-  if (typeof text2 !== "string")
-    return void 0;
-  try {
-    const v = JSON.parse(text2);
-    return v && typeof v === "object" && !Array.isArray(v) ? v : void 0;
-  } catch {
-    return void 0;
-  }
-}
-function u16le(n) {
-  const b = Buffer.alloc(2);
-  b.writeUInt16LE(n & 65535);
-  return b;
-}
-function u16be(n) {
-  const b = Buffer.alloc(2);
-  b.writeUInt16BE(n & 65535);
-  return b;
-}
-function u32le(n) {
-  const b = Buffer.alloc(4);
-  b.writeUInt32LE(n >>> 0);
-  return b;
+   * pattern. What actually matters is landing on the broker instance that currently holds the device's
+   * session (`ensureSecurityMqttFor`/`broker-discovery.ts` — the NLB fronts several instances that
+   * don't share subscribe/publish routing).
+   */
+  async publish(topic, body, opts = {}) {
+    if (!this.client)
+      throw new Error("SecureMqtt not connected");
+    await this.client.publishAsync(topic, body, { qos: opts.qos ?? 1 });
+  }
+  async disconnect() {
+    this.connecting = void 0;
+    await this.client?.endAsync(true);
+    this.client = void 0;
+  }
+};
+
+// dist/transport/mqtt/app-client-id.js
+import { createHash as createHash4 } from "node:crypto";
+function buildAppShapedClientId(input) {
+  const ts = input.timestamp ?? Math.floor(Date.now() / 1e3);
+  return `android-${input.appName}-${input.uid}-${input.mqttUuid}-${ts}`;
 }
-function u32be(n) {
-  const b = Buffer.alloc(4);
-  b.writeUInt32BE(n >>> 0);
-  return b;
+function mqttUuidFrom(installId) {
+  return createHash4("sha256").update(installId).digest("hex").slice(0, 16);
 }
 
 // dist/transport/mqtt/availability.js
@@ -2537,13 +2835,6 @@ function parseAiotDpReport(raw) {
   return Object.keys(out).length ? out : void 0;
 }
 
-// dist/core/raw-dp-hex.js
-function hexToRawDp(hex) {
-  if (hex.length === 0 || hex.length % 2 !== 0 || !/^[0-9a-fA-F]+$/.test(hex))
-    return void 0;
-  return Buffer.from(hex, "hex").toString("base64");
-}
-
 // dist/transport/mqtt/biz-stream.js
 var BIZ_PROTOCOL = {
   /** Map-stream data: the frames this module parses. */
@@ -2727,18 +3018,6 @@ var DeviceType = {
   CAMERA_C35: 10035
 };
 
-// dist/core/types.js
-var PRINTER_CATEGORY_RE = /ankermake|eufymake|fdm|3d_?print/i;
-function classifyDevice(raw) {
-  const category = raw.category ?? "";
-  const hasP2p = typeof raw.p2p_did === "string" && raw.p2p_did.length > 0;
-  if (category === "eufy_security" || hasP2p)
-    return { category, api: "mega", realtime: "p2p" };
-  if (PRINTER_CATEGORY_RE.test(category))
-    return { category, api: "ankermake", realtime: "ankermake-mqtt" };
-  return { category, api: "mega", realtime: "smqtt" };
-}
-
 // dist/model/classify.js
 var STATION_TYPES = /* @__PURE__ */ new Set([
   DeviceType.STATION,
@@ -2877,111 +3156,6 @@ function inferName(rec) {
   return void 0;
 }
 
-// dist/core/contracts.js
-var StoredSnapshotUnavailableError = class extends Error {
-  reason;
-  constructor(reason, message, options) {
-    super(message, options);
-    this.reason = reason;
-    this.name = "StoredSnapshotUnavailableError";
-  }
-};
-var RETRYABLE_LIVE_SNAPSHOT_REASONS = [
-  "no-keyframe",
-  "source-failed",
-  "undecodable-burst"
-];
-var LiveSnapshotUnavailableError = class extends Error {
-  reason;
-  /** Whether another attempt could plausibly succeed without the host changing anything. */
-  retryable;
-  constructor(reason, message, options) {
-    super(message, options);
-    this.reason = reason;
-    this.name = "LiveSnapshotUnavailableError";
-    this.retryable = RETRYABLE_LIVE_SNAPSHOT_REASONS.includes(reason);
-  }
-};
-var CameraDisabledError = class extends Error {
-  camera;
-  constructor(camera, options) {
-    super(`camera${camera ? ` ${camera}` : ""} is disabled \u2014 no live stream possible`, options);
-    this.camera = camera;
-    this.name = "CameraDisabledError";
-  }
-};
-var StationKeyUnavailableError = class extends Error {
-  stationSn;
-  /** Always true: the negotiation is per connection, so a later one may still produce a key. */
-  retryable = true;
-  constructor(stationSn, options) {
-    super(`station ${stationSn} did not provide its session key, so nothing that requires one could be sent`, options);
-    this.stationSn = stationSn;
-    this.name = "StationKeyUnavailableError";
-  }
-};
-var StationUnreachableError = class extends Error {
-  stationSn;
-  waitedMs;
-  /** Always true: a station unreachable now may answer on a later attempt. */
-  retryable = true;
-  constructor(stationSn, waitedMs, options) {
-    super(`station ${stationSn}'s P2P session did not connect within ${waitedMs}ms, so nothing could be sent to it`, options);
-    this.stationSn = stationSn;
-    this.waitedMs = waitedMs;
-    this.name = "StationUnreachableError";
-  }
-};
-var DeviceChannelUnresolvedError = class extends Error {
-  sn;
-  stationSn;
-  constructor(sn, stationSn, options) {
-    super(`${sn} has no usable channel on station ${stationSn}, so nothing was sent to it`, options);
-    this.sn = sn;
-    this.stationSn = stationSn;
-    this.name = "DeviceChannelUnresolvedError";
-  }
-};
-var LiveStreamStartError = class extends Error {
-  reason;
-  stage;
-  timeoutMs;
-  attempts;
-  constructor(failure) {
-    super(`live stream failed to start (${failure.reason} at ${failure.stage} after ${failure.attempts} attempts; ${failure.timeoutMs}ms deadline)`, failure.cause === void 0 ? void 0 : { cause: failure.cause });
-    this.name = "LiveStreamStartError";
-    this.reason = failure.reason;
-    this.stage = failure.stage;
-    this.timeoutMs = failure.timeoutMs;
-    this.attempts = failure.attempts;
-  }
-};
-var StateConvergenceError = class extends Error {
-  sn;
-  property;
-  param;
-  expected;
-  observed;
-  timeoutMs;
-  constructor(failure) {
-    super(`device ${failure.sn} did not report ${failure.property} as ${String(failure.expected)} within ${failure.timeoutMs}ms (param ${failure.param} read ${String(failure.observed)})`);
-    this.name = "StateConvergenceError";
-    this.sn = failure.sn;
-    this.property = failure.property;
-    this.param = failure.param;
-    this.expected = failure.expected;
-    this.observed = failure.observed;
-    this.timeoutMs = failure.timeoutMs;
-  }
-};
-var COMMAND_OBSERVATION = /* @__PURE__ */ Symbol("command-observation");
-function observeCommand(command, observation) {
-  return Object.defineProperty(command, COMMAND_OBSERVATION, { configurable: true, value: observation });
-}
-function commandObservation(command) {
-  return command[COMMAND_OBSERVATION];
-}
-
 // dist/model/capabilities/access.js
 function setScalar(param, value, ctx, form = "auto") {
   return { kind: "set-param", param, value, form, channel: ctx.channel };
@@ -3254,11 +3428,17 @@ var unreflectedMembers = (surface) => statement(surface, UNREFLECTED);
 // dist/model/capabilities/manifest.js
 function describeBound(modules, bound, ctx) {
   const out = [];
+  const anyBound = Object.values(bound).some((obj) => obj && typeof obj === "object");
   for (const m of modules) {
     const accessor = camelCase(m.capability);
     const obj = bound[accessor];
-    if (!obj || typeof obj !== "object")
+    if (!obj || typeof obj !== "object") {
+      const events = anyBound ? emitsOf(m, [], ctx) : [];
+      if (events.length && ctx?.capabilities?.has(m.capability)) {
+        out.push({ capability: m.capability, reads: [], actions: [], undescribedActions: [], events });
+      }
       continue;
+    }
     const descriptors = Object.getOwnPropertyDescriptors(obj);
     const reads2 = [];
     const actions = [];
@@ -3781,7 +3961,6 @@ var MOTION_CMD = {
    * payload key AND pass mChannel 0 explicitly; the two are separate choices, not linked.)
    *
    * ⚠️ Replay + readback confirmed on a HomeBase-attached T8425 (1719 `0`→`1`→`0`), NOT byte-captured.
-   * Provenance is `apk`, not `verified`: a divergent-but-also-accepted frame can't be ruled out.
    */
   HUMAN_ONLY_AT_NIGHT: 1719,
   /**
@@ -3795,7 +3974,7 @@ var MOTION_CMD = {
    * form, so a feature that is on reads as off.
    * Decoded by {@link decodeRadarWdSwitch} to match the app.
    *
-   * ⚠️ Replay + readback confirmed on a T8214 (2706 `0`→`1`→`0`), NOT byte-captured. Provenance `apk`.
+   * ⚠️ Replay + readback confirmed on a T8214 (2706 `0`→`1`→`0`), NOT byte-captured.
    */
   LOITERING_DETECTION: 2706,
   /**
@@ -4119,7 +4298,7 @@ var MOTION_MEMBERS = {
     param: MOTION_CMD.HUMAN_ONLY_AT_NIGHT,
     type: "bool",
     kind: "boolean",
-    provenance: "apk",
+    provenance: "verified",
     description: "Restrict AI classification to night-time only (1719). \u26A0\uFE0F Replay + readback confirmed on a HomeBase-attached T8425, not byte-captured.",
     requires: [MOTION_CMD.HUMAN_ONLY_AT_NIGHT],
     write: (v, ctx) => {
@@ -4135,7 +4314,7 @@ var MOTION_MEMBERS = {
     param: MOTION_CMD.LOITERING_DETECTION,
     type: "bool",
     kind: "boolean",
-    provenance: "apk",
+    provenance: "verified",
     coerce: (raw) => decodeRadarWdSwitch(raw) ?? false,
     description: "Loitering detection \u2014 alert on lingering rather than passing (2706). Observed on the T8214 doorbell only; the read is object-OR-scalar, matching the app's own decode.",
     requires: [MOTION_CMD.LOITERING_DETECTION],
@@ -4241,6 +4420,7 @@ var MOTION = {
 };
 
 // dist/model/capabilities/person-detection.js
+var IDENTIFIED_PERSON_CLAIM = { homeBaseAttached: true };
 var PERSON_DETECTION = {
   capability: "person_detection",
   description: "AI human detection enable switch and live detected state.",
@@ -4257,8 +4437,18 @@ var PERSON_DETECTION = {
    */
   events: [
     { source: "push", match: DoorbellPushEvent.FACE_DETECTION, emit: "personDetected" },
-    { source: "push", match: HB3PairedDevicePushEvent.IDENTITY_PERSON_DETECTION, emit: "personDetected" },
-    { source: "push", match: HB3PairedDevicePushEvent.STRANGER_PERSON_DETECTION, emit: "strangerDetected" }
+    {
+      source: "push",
+      match: HB3PairedDevicePushEvent.IDENTITY_PERSON_DETECTION,
+      emit: "personDetected",
+      claim: IDENTIFIED_PERSON_CLAIM
+    },
+    {
+      source: "push",
+      match: HB3PairedDevicePushEvent.STRANGER_PERSON_DETECTION,
+      emit: "strangerDetected",
+      claim: IDENTIFIED_PERSON_CLAIM
+    }
   ]
 };
 
@@ -4326,7 +4516,7 @@ function decodePowerSource(raw) {
 function recordSetting(param, value, ctx) {
   return setStationScalar(param, value, ctx.channel);
 }
-var MAINS_CAMERA_MODELS = ["T8425", "T8419", "T8410", "T84A1"];
+var MAINS_CAMERA_MODELS = ["T8425", "T8419", "T8410", "T84A1", "T8423"];
 function cameraPowerTier(model, capabilities) {
   return capabilities.has("battery") && notMainsCamera({ model }) ? "battery" : "wired";
 }
@@ -5536,6 +5726,7 @@ var CAMERA_MEMBERS = {
     refuseWhenDisabled(ctx, read);
     return m.recordFragments({ powered: poweredOf(ctx), ...opts });
   }), "Continuous fragmented-MP4 (CMAF) recording."),
+  downloadRecording: provided("media", (m) => m.downloadRecording && ((opts) => m.downloadRecording(opts)), "Download a recording the station holds \u2192 H.264 and AAC elementary streams."),
   /**
    * Push audio from the host to this camera's speaker. Gated on the **speaker** param specifically —
    * not the `audio` capability, which resolves on a microphone alone and would advertise a speaker the
@@ -5577,7 +5768,7 @@ var SIREN_CMD = {
   ALARM_TEST: 1826,
   /** Manually stop a sounding alarm (app `APP_CMD_SIREN_SENSOR_MANUAL_STOP_ALARM`). */
   MANUAL_STOP: 1871,
-  /** Station-family HomeBase duration alarm, verified live on T8010 (app `SET_TONE_FILE`). */
+  /** Station-family HomeBase duration alarm, verified live on T8010 and T8030 (app `SET_TONE_FILE`). */
   HOMEBASE_TONE: 1201,
   /** HomeBase alarm volume percentage (app `CMD_SET_HUB_SPK_VOLUME`). */
   HUB_SPK_VOLUME: 1235,
@@ -5592,7 +5783,7 @@ var SirenAlarmDuration = { Min1: 60, Min5: 300, Min10: 600, Min15: 900 };
 var HubAlarmTone = { Tone1: 1, Tone2: 2 };
 var HUB_ALARM_EVIDENCE = [SIREN_CMD.HUB_ALARM_TONE, 1282];
 function isStationAlarmOutput(ctx) {
-  return ctx.deviceType === DeviceType.STATION;
+  return ctx.deviceType === DeviceType.STATION || ctx.deviceType === DeviceType.HB3;
 }
 function isEvidencedStationAlarm(ctx) {
   return isStationAlarmOutput(ctx) && HUB_ALARM_EVIDENCE.some((param) => ctx.paramIds.has(param));
@@ -6714,9 +6905,9 @@ function parseQuickResponses(voiceList) {
 var DOORBELL_MEMBERS = {
   /**
    * The HOMEBASE as the doorbell's chime — the hub plays the ring, not the wired chime box
-   * `mechanicalChimeSwitch` drives. `provenance` is "verified" on our own decrypt of the app's frame,
-   * not merely the param id observed live: direct-binary `[ch][value][acct]`, 1=on/0=off, the same shape
-   * as its 1703 sibling — captured, not inferred from the shared param range.
+   * `mechanicalChimeSwitch` drives. `provenance` is "verified" on our own decrypt of the app's frame:
+   * direct-binary `[ch][value][acct]`, 1=on/0=off, the same shape as its 1703 sibling — captured, not
+   * inferred from the shared param range.
    */
   chimeSwitch: {
     param: DOORBELL_CMD.CHIME_SWITCH,
@@ -6727,9 +6918,8 @@ var DOORBELL_MEMBERS = {
     write: (v, ctx) => setScalar(DOORBELL_CMD.CHIME_SWITCH, asBool(v) ? 1 : 0, ctx, "direct-binary")
   },
   /**
-   * `provenance` is "verified" not "mega": the actual write wire is confirmed (
-   * our own P2P decrypt), not merely the param id observed on a live device. Direct-binary
-   * `[ch][value][acct]`, 1=on/0=off — verified live on a T8214 (ON then OFF).
+   * `provenance` is "verified" on our own P2P decrypt of the write wire: direct-binary
+   * `[ch][value][acct]`, 1=on/0=off, verified live on a T8214 (ON then OFF).
    */
   mechanicalChimeSwitch: {
     param: DOORBELL_CMD.MECHANICAL_CHIME_SWITCH,
@@ -6760,7 +6950,7 @@ var DOORBELL_MEMBERS = {
     type: "number",
     unit: "%",
     kind: "percent",
-    provenance: "mega",
+    provenance: "verified",
     writtenElsewhere: true,
     description: "Ringtone volume (1708; confirmed on T8214, observed value 80). The WRITE is `audio`'s setRingtoneVolume \u2014 that capability owns every volume wire."
   },
@@ -6865,7 +7055,7 @@ var DOORBELL_MEMBERS = {
     param: 1710,
     type: "string",
     kind: "text",
-    provenance: "mega",
+    provenance: "verified",
     description: "Notification config JSON {notification_motion_onoff,notification_ring_onoff,notification_style} (1710; confirmed on T8214)."
   },
   /**
@@ -7533,113 +7723,34 @@ var ARMING = {
   detection: { evidenceParams: [ARMING_CMD.SET_ARMING], codecs: ["station"] },
   ownedByStation: true,
   /**
-   * Station-scoped push events. The hub reports a guard-mode switch and the alarm lifecycle on the
-   * generic `CusPushEvent` channel, so these ids are shared with other families and resolve by
-   * capability (see the barrel's event index).
-   *
-   * The alarm ids carry a static `phase` so one event name covers the whole lifecycle, the same shape
-   * `battery` uses for its threshold pushes. The mode-switch push is known to identify WHICH mode and
-   * what triggered the change, but neither has been observed on the wire here, so this emits the bare
-   * transition and refreshes the `mode` read rather than trusting a decoded field.
-   */
-  events: [
-    {
-      source: "push",
-      match: CusPushEvent.MODE_SWITCH,
-      emit: "armingModeChanged",
-      refresh: { member: "mode" }
-    },
-    { source: "push", match: CusPushEvent.ALARM, emit: "alarm", payload: { phase: "triggered" } },
-    { source: "push", match: CusPushEvent.ALARM_DELAY, emit: "alarm", payload: { phase: "delayed" } }
-  ]
-};
-
-// dist/model/capabilities/storage.js
-var STORAGE = {
-  capability: "storage",
-  description: "Local storage (SD card / eMMC / HDD). Behaviour-only until a capacity param is captured.",
-  properties: [],
-  detection: { codecs: ["station"] }
-};
-
-// dist/core/raw-dp-writer.js
-var WIRE = { VARINT: 0, LENGTH_DELIMITED: 2 };
-function encodeVarint(value) {
-  if (!Number.isSafeInteger(value) || value < 0) {
-    throw new Error(`varint: ${value} is not a non-negative safe integer`);
-  }
-  const out = [];
-  let v = value;
-  while (v > 127) {
-    out.push(v % 128 + 128);
-    v = Math.floor(v / 128);
-  }
-  out.push(v);
-  return out;
-}
-function zigzag(value) {
-  if (!Number.isSafeInteger(value))
-    throw new Error(`zigzag: ${value} is not a safe integer`);
-  return value < 0 ? -2 * value - 1 : 2 * value;
-}
-var RawDpWriter = class _RawDpWriter {
-  body = [];
-  /** A varint-valued field (`int32`, `uint32`, `bool`, an enum member). */
-  int(field, value) {
-    this.body.push(...encodeVarint(tag(field, WIRE.VARINT)), ...encodeVarint(value));
-    return this;
-  }
-  /** A signed varint field (`sint32`, `sint64`), ZigZag-encoded — see {@link zigzag}. */
-  sint(field, value) {
-    return this.int(field, zigzag(value));
-  }
-  /** A boolean field, on protobuf's own terms: `1` or `0` in a varint. */
-  bool(field, value) {
-    return this.int(field, value ? 1 : 0);
-  }
-  /** A length-delimited field carrying raw bytes — a string, a blob, or a message built elsewhere. */
-  bytes(field, value) {
-    const bytes2 = value instanceof Uint8Array ? Array.from(value) : [...value];
-    this.body.push(...encodeVarint(tag(field, WIRE.LENGTH_DELIMITED)), ...encodeVarint(bytes2.length), ...bytes2);
-    return this;
-  }
-  /**
-   * A nested sub-message, built by `build` into a writer of its own.
-   *
-   * The sub-message is emitted even when `build` writes nothing into it. That is not an oversight: an
-   * EMPTY sub-message is how these protocols say "this subsystem exists and is in its zero state", as
-   * opposed to saying nothing about it, and the readers on the other side of this file depend on the
-   * distinction. Omitting the call is what says nothing about it.
-   */
-  sub(field, build) {
-    const inner = new _RawDpWriter();
-    build(inner);
-    return this.bytes(field, inner.toBytes());
-  }
-  /** The message body on its own, unframed — for nesting into another writer. */
-  toBytes() {
-    return [...this.body];
-  }
-  /**
-   * The finished DP value: `varint(bodyLength) ++ body`, base64-encoded.
+   * Station-scoped push events. The hub reports a guard-mode switch and the alarm lifecycle on the
+   * generic `CusPushEvent` channel, so these ids are shared with other families and resolve by
+   * capability (see the barrel's event index).
    *
-   * This is the envelope `RawDpCodec.decode` unwraps, so a value produced here and read back through the
-   * codec is a genuine round-trip rather than two implementations of the same guess.
+   * The alarm ids carry a static `phase` so one event name covers the whole lifecycle, the same shape
+   * `battery` uses for its threshold pushes. The mode-switch push is known to identify WHICH mode and
+   * what triggered the change, but neither has been observed on the wire here, so this emits the bare
+   * transition and refreshes the `mode` read rather than trusting a decoded field.
    */
-  finish() {
-    return Buffer.from([...encodeVarint(this.body.length), ...this.body]).toString("base64");
-  }
+  events: [
+    {
+      source: "push",
+      match: CusPushEvent.MODE_SWITCH,
+      emit: "armingModeChanged",
+      refresh: { member: "mode" }
+    },
+    { source: "push", match: CusPushEvent.ALARM, emit: "alarm", payload: { phase: "triggered" } },
+    { source: "push", match: CusPushEvent.ALARM_DELAY, emit: "alarm", payload: { phase: "delayed" } }
+  ]
+};
+
+// dist/model/capabilities/storage.js
+var STORAGE = {
+  capability: "storage",
+  description: "Local storage (SD card / eMMC / HDD). Behaviour-only until a capacity param is captured.",
+  properties: [],
+  detection: { codecs: ["station"] }
 };
-function tag(field, wire) {
-  if (!Number.isSafeInteger(field) || field < 1)
-    throw new Error(`field number: ${field} is not a positive integer`);
-  return field * 8 + wire;
-}
-function rawDp(build) {
-  const w = new RawDpWriter();
-  build(w);
-  return w.finish();
-}
 
 // dist/model/capabilities/vacuum-dock.js
 var VACUUM_DOCK_DP = 173;
@@ -13345,58 +13456,6 @@ function parseCleanRecordDetail(blob, codec) {
   };
 }
 
-// dist/core/lz4-block.js
-var MAX_OUTPUT = 64 * 1024 * 1024;
-function lz4BlockDecompress(block, size) {
-  if (!Number.isSafeInteger(size) || size < 0 || size > MAX_OUTPUT)
-    return void 0;
-  const out = Buffer.alloc(size);
-  const end = block.length;
-  let pos = 0;
-  let written = 0;
-  const extend2 = (base) => {
-    let len = base;
-    if (base !== 15)
-      return len;
-    for (; ; ) {
-      if (pos >= end)
-        return void 0;
-      const extra = block[pos++];
-      len += extra;
-      if (extra !== 255)
-        return len;
-    }
-  };
-  while (pos < end) {
-    const token = block[pos++];
-    const literals = extend2(token >> 4);
-    if (literals === void 0)
-      return void 0;
-    if (pos + literals > end || written + literals > size)
-      return void 0;
-    for (let i = 0; i < literals; i++)
-      out[written++] = block[pos++];
-    if (pos === end)
-      break;
-    if (pos + 2 > end)
-      return void 0;
-    const offset = block[pos] | block[pos + 1] << 8;
-    pos += 2;
-    if (offset === 0 || offset > written)
-      return void 0;
-    const match = extend2(token & 15);
-    if (match === void 0)
-      return void 0;
-    const length = match + 4;
-    if (written + length > size)
-      return void 0;
-    let from = written - offset;
-    for (let i = 0; i < length; i++)
-      out[written++] = out[from++];
-  }
-  return written === size ? out : void 0;
-}
-
 // dist/model/vacuum-map.js
 var DOCK_KINDS = ["charger", "station"];
 var MAP_QUALITIES = ["incomplete", "rough", "effective", "listFull"];
@@ -14307,6 +14366,7 @@ __export(codec_exports, {
   buildLookupWithKeyPayload2: () => buildLookupWithKeyPayload2,
   buildRawCommandPayload: () => buildRawCommandPayload,
   buildStringCommandPayload: () => buildStringCommandPayload,
+  buildStringPairCommandPayload: () => buildStringPairCommandPayload,
   buildVoidCommandPayload: () => buildVoidCommandPayload,
   decodeP2PCloudIPs: () => decodeP2PCloudIPs,
   decryptP2PData: () => decryptP2PData,
@@ -14343,6 +14403,11 @@ var ResponseMessageType = {
   LOOKUP_ADDR: Buffer.from([241, 64]),
   LOOKUP_ADDR2: Buffer.from([241, 130]),
   CAM_ID: Buffer.from([241, 66]),
+  /**
+   * The device's own address record, sent in answer to CHECK_CAM ahead of CAM_ID: its 20-byte device id, one
+   * record in `encodeSelfAddress`'s shape naming the address it answers from, then 8 zero bytes (44-byte payload).
+   */
+  CAM_ADDR: Buffer.from([241, 67]),
   TURN_SERVER_CAM_ID: Buffer.from([241, 132]),
   PING: Buffer.from([241, 224]),
   PONG: Buffer.from([241, 225]),
@@ -14554,6 +14619,12 @@ function buildIntStringCommandPayload(value, valueSub, strValue, channel = 0, ke
     data
   ]);
 }
+function buildStringPairCommandPayload(strValue, strValueSub, channel = 0, key, encType = 1) {
+  const encrypted = !!key && key.length === 16;
+  const body = Buffer.concat([Buffer.alloc(5), stringWithLength(strValue), stringWithLength(strValueSub)]);
+  const data = encrypted ? encryptP2PData(paddingP2PData(body), key) : body;
+  return buildRawCommandPayload(data, channel, encrypted ? encType : 0);
+}
 function buildRawCommandPayload(data, channel = 0, signCode = 0, magic = [1, 0], streamId = 0) {
   const header = Buffer.allocUnsafe(2);
   header.writeUInt16LE(data.length, 0);
@@ -15159,6 +15230,7 @@ var LOCAL_LOOKUP_PORT = 32108;
 var HEARTBEAT_MS = 5e3;
 var PATH_SILENCE_MS = HEARTBEAT_MS * 3;
 var LOOKUP_RETRY_MS = 1e3;
+var RECEIVE_BUFFER_BYTES = 4 * 1024 * 1024;
 var CONNECT_TIMEOUT_MS = 15e3;
 var STATION_CHANNEL3 = 255;
 var CMD_GATEWAYINFO = 1100;
@@ -15194,6 +15266,7 @@ var CMD_DATABASE_IMAGE = 1308;
 var CMD_DATABASE = 1306;
 var DB_QUERY = { FULL_TABLE: 1e4, COMBINATION_WITH_AI: 10011 };
 var GCM_AAD = Buffer.from("eufy security");
+var LEVEL2_SEQ_BASE = 16909056;
 function paramReport(payload) {
   const list = payload?.params;
   if (!Array.isArray(list))
@@ -15208,12 +15281,57 @@ function paramReport(payload) {
   return Object.keys(out).length ? out : void 0;
 }
 var traceSequence = 0;
+var DB_TABLE_TIMEOUT_MS = 15e3;
+function firstTableRows(text2) {
+  const decoded = Buffer.from(text2, "latin1").toString("utf8");
+  for (let start = decoded.indexOf("{"); start >= 0; start = decoded.indexOf("{", start + 1)) {
+    const end = closingBrace(decoded, start);
+    if (end < 0)
+      return void 0;
+    let parsed;
+    try {
+      parsed = JSON.parse(decoded.slice(start, end + 1));
+    } catch {
+      continue;
+    }
+    const data = parsed?.data;
+    if (Array.isArray(data))
+      return data;
+  }
+  return void 0;
+}
+function closingBrace(text2, start) {
+  let depth = 0;
+  let inString = false;
+  let escaped = false;
+  for (let i = start; i < text2.length; i++) {
+    const c = text2[i];
+    if (inString) {
+      if (escaped)
+        escaped = false;
+      else if (c === "\\")
+        escaped = true;
+      else if (c === '"')
+        inString = false;
+      continue;
+    }
+    if (c === '"')
+      inString = true;
+    else if (c === "{")
+      depth++;
+    else if (c === "}" && --depth === 0)
+      return i;
+  }
+  return -1;
+}
 var P2PSession = class _P2PSession extends EventEmitter2 {
   cfg;
   socket;
   connected = false;
   connecting = false;
   closed = false;
+  /** Whether a short receive buffer has been reported, so a reconnect does not repeat the same warning. */
+  receiveBufferReported = false;
   connectAddress;
   seqNumber = 0;
   /**
@@ -15240,8 +15358,8 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
   audioStalled = false;
   audioRetransmitTimer;
   lastPongData;
-  /** When this connection last received a PONG — `undefined` until the first, see {@link pathSilentMs}. */
-  lastPongAt;
+  /** When the selected peer last answered outbound P2P traffic on this connection. */
+  lastPeerAt;
   /** Whether the silence has already been stated, so it is traced once per connection rather than per read. */
   pathStaleTraced = false;
   lookupTimer;
@@ -15253,7 +15371,10 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
   cloudLookup;
   /** Local outbound IPv4 reported inside LOOKUP_WITH_KEY requests. */
   selfHost;
-  /** In-flight multi-datagram frame per data channel (see onData). */
+  /**
+   * In-flight multi-datagram frame per data channel (see reassemble): the payload gathered so far under its
+   * parsed header, or, without a header, the start of a frame header cut by the datagram boundary.
+   */
   pendingByDataType = /* @__PURE__ */ new Map();
   /** Last delivered datagram sequence number per data type. */
   lastSeqByType = /* @__PURE__ */ new Map();
@@ -15307,17 +15428,17 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
   /**
    * How long this connection's path has been silent, or nothing where it has never answered.
    *
-   * A PONG is the station stating that the path is alive. `undefined` is neither alive nor dead: it is a station
-   * that has said nothing either way.
+   * PONG and ACK from the selected peer prove the path answers outbound traffic. `undefined` means no such reply
+   * has arrived since connection, so silence alone does not establish a stale path.
    */
   get pathSilentMs() {
-    return this.lastPongAt === void 0 ? void 0 : Date.now() - this.lastPongAt;
+    return this.lastPeerAt === void 0 ? void 0 : Date.now() - this.lastPeerAt;
   }
   /**
    * Whether this path can still be committed to, on the evidence the heartbeat gives.
    *
-   * False where a pong arrived and then stopped for {@link PATH_SILENCE_MS}. A station that has never ponged is
-   * not known to be dead, so it answers true.
+   * False where selected-peer replies arrived and then stopped for {@link PATH_SILENCE_MS}. A connection with
+   * no post-connect reply is not known to be dead, so it answers true.
    *
    * Traces the silence once per connection, on the read that first observes it.
    */
@@ -15533,6 +15654,26 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
   get isConnected() {
     return this.connected;
   }
+  /**
+   * Ask the OS for {@link RECEIVE_BUFFER_BYTES} on a bound socket, and warn once per session when it grants
+   * less or refuses.
+   *
+   * The request is made here rather than through `createSocket`'s `recvBufferSize`: Node applies that option
+   * inside the bind callback, where a refusal is thrown out of reach of this session and ends the process.
+   */
+  requestReceiveBuffer(socket) {
+    let granted;
+    try {
+      socket.setRecvBufferSize(RECEIVE_BUFFER_BYTES);
+      granted = socket.getRecvBufferSize();
+    } catch {
+      granted = 0;
+    }
+    if (granted >= RECEIVE_BUFFER_BYTES || this.receiveBufferReported)
+      return;
+    this.receiveBufferReported = true;
+    this.logger.warn(`[p2p] ${this.cfg.stationSn} UDP receive buffer below the ${RECEIVE_BUFFER_BYTES} bytes requested` + (granted > 0 ? ` (granted ${granted})` : " (request refused)") + `; live video can lose keyframes. Raise the OS limit (net.core.rmem_max on Linux, kern.ipc.maxsockbuf on BSD) to at least ${RECEIVE_BUFFER_BYTES}.`);
+  }
   /** Open the socket and start the lookup → hole-punch handshake. */
   async connect() {
     if (this.connecting || this.connected)
@@ -15556,6 +15697,7 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
           socket.setBroadcast(true);
         } catch {
         }
+        this.requestReceiveBuffer(socket);
         resolve();
       });
     });
@@ -15674,10 +15816,18 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
    * straddling a level-2 wait on a camera whose failure to deliver video had a separate cause, and did not
    * recur across later probes of it. Correlate an unmodelled type against a WORKING session before reading it
    * as a cause.
+   *
+   * CAM_ADDR is recognised and dropped: it names the address the device is already answering from, and the
+   * CAM_ID that follows it is what completes the connect.
    */
   onMessage(msg, rinfo, socket = this.socket) {
     if (!socket)
       return;
+    const fromConnectedPeer = this.connected && this.connectAddress?.host === rinfo.address && this.connectAddress.port === rinfo.port;
+    if (fromConnectedPeer && (hasHeader(msg, ResponseMessageType.PONG) || hasHeader(msg, ResponseMessageType.ACK))) {
+      this.lastPeerAt = Date.now();
+      this.pathStaleTraced = false;
+    }
     if (!hasHeader(msg, ResponseMessageType.DATA)) {
       this.logger.debug(`[p2p] ${this.cfg.stationSn} <<< ${rinfo.address}:${rinfo.port} header=${msg.subarray(0, 2).toString("hex")} len=${msg.length}`);
     }
@@ -15695,8 +15845,6 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
       this.onConnected({ host: rinfo.address, port: rinfo.port }, socket);
     } else if (hasHeader(msg, ResponseMessageType.PONG)) {
       this.lastPongData = msg.length > 4 ? msg.subarray(4) : void 0;
-      this.lastPongAt = Date.now();
-      this.pathStaleTraced = false;
     } else if (hasHeader(msg, ResponseMessageType.PING)) {
       this.send({ host: rinfo.address, port: rinfo.port }, RequestMessageType.PONG, void 0, socket);
     } else if (hasHeader(msg, ResponseMessageType.ACK)) {
@@ -15704,7 +15852,7 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
     } else if (hasHeader(msg, ResponseMessageType.DATA)) {
       if (this.connected)
         this.onData(msg, { host: rinfo.address, port: rinfo.port });
-    } else {
+    } else if (!hasHeader(msg, ResponseMessageType.CAM_ADDR)) {
       this.logger.debug(`[p2p] ${this.cfg.stationSn} UNHANDLED payload hex: ${msg.toString("hex")}`);
     }
   }
@@ -15995,6 +16143,17 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
     this.seqNumber = this.seqNumber + 1 & 65535;
     this.send(this.connectAddress, RequestMessageType.DATA, data);
   }
+  /** Send a level-1 {@link buildStringPairCommandPayload} command on `channel`. */
+  sendStringPairCommand(commandType, strValue, strValueSub, channel) {
+    if (!this.connectAddress)
+      throw new Error(`P2P session ${this.cfg.stationSn} is not connected`);
+    const data = Buffer.concat([
+      buildCommandHeader(this.seqNumber, commandType),
+      buildStringPairCommandPayload(strValue, strValueSub, channel, this.level1Key, 1)
+    ]);
+    this.seqNumber = this.seqNumber + 1 & 65535;
+    this.send(this.connectAddress, RequestMessageType.DATA, data);
+  }
   /**
    * Send a **level-2 (AES-256-GCM, signCode 8) control payload** to a HomeBase-attached device. The
    * target camera is selected by `channel` (= device_channel) + the `mChannel` envelope — the same
@@ -16272,11 +16431,6 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
     this.seqNumber = this.seqNumber + 1 & 65535;
     this.send(this.connectAddress, RequestMessageType.DATA, data);
   }
-  /**
-   * Encrypt a level-2 command body (signCode 8): `tag(16) ‖ nonce(12) ‖ [seq,03,02,01](4) ‖
-   * ciphertext`, AES-256-GCM under the negotiated session key, AAD "eufy security". Inverse of
-   * `decryptLevel2`. The 4-byte sub-header is cleartext (skipped on decrypt); `seq` is a counter.
-   */
   /**
    * Decode a `CMD_VIDEO_FRAME` (1300) payload into clean Annex-B H.264 (the 22-byte frame header
    * stripped). Reversed from the V6 app + live H.264 captures: the 22-byte header is
@@ -16343,6 +16497,11 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
     }
     return this.rsaModulusHex;
   }
+  /**
+   * Encrypt a level-2 command body (signCode 8): `tag(16) ‖ nonce(12) ‖ seq(4) ‖ ciphertext`,
+   * AES-256-GCM under the negotiated session key, AAD "eufy security". Inverse of `decryptLevel2`.
+   * The 4-byte sub-header is cleartext (skipped on decrypt); `seq` counts up from {@link LEVEL2_SEQ_BASE}.
+   */
   encryptLevel2(plaintext) {
     if (!this.level2Key)
       return void 0;
@@ -16350,8 +16509,8 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
     const c = createCipheriv3("aes-256-gcm", this.level2Key, nonce);
     c.setAAD(GCM_AAD);
     const ct = Buffer.concat([c.update(plaintext), c.final()]);
-    const sub2 = Buffer.from([this.level2Seq & 255, 3, 2, 1]);
-    this.level2Seq = this.level2Seq + 1 & 255;
+    const sub2 = Buffer.alloc(4);
+    sub2.writeUInt32LE(LEVEL2_SEQ_BASE + this.level2Seq++ >>> 0);
     return Buffer.concat([c.getAuthTag(), nonce, sub2, ct]);
   }
   /** Send a no-arg command frame (e.g. CMD_GATEWAYINFO) on a channel (default: the station channel). */
@@ -16397,8 +16556,14 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
    * The HomeBase streams back `CMD_DATABASE` (1306) frames `{cmd:10000,count,data:[…]}`,
    * level-1-encrypted — decoded and emitted as `dbChunk` (decrypted text) per frame.
    * Tables: `familiar_faces`, `person_basic_info`, `event_person_list`, `history_record_info`.
+   *
+   * Throws while a {@link readDatabase} is accumulating: every table answers `{data:[…]}` and the
+   * frames tie no chunk to its request, so a second query's reply would be assembled into the first
+   * one's buffer and answered as its rows.
    */
   queryDatabase(table, opts = {}) {
+    if (this.dbReadInFlight)
+      throw new Error(`queryDatabase: ${this.cfg.stationSn} is already reading a table`);
     if (!this.connectAddress)
       throw new Error("not connected");
     const channel = opts.channel ?? STATION_CHANNEL3;
@@ -16461,6 +16626,49 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
       query: this.fullTableQuery()
     });
   }
+  /**
+   * Query one on-station table and answer its rows, once the reply is whole.
+   *
+   * The request half of {@link queryDatabase} with its reply assembled: `CMD_DATABASE` arrives as
+   * several frames whose decrypted text is a fragment of one document, so the fragments are
+   * accumulated here and scanned after each one. Answers that document's `data` rows. Rejects when
+   * `signal` aborts, and when `timeoutMs` (default {@link DB_TABLE_TIMEOUT_MS}) elapses with no
+   * complete reply.
+   *
+   * One read at a time per session: while one is accumulating, every {@link queryDatabase} on the
+   * session throws, so a second reply cannot land in this buffer.
+   */
+  async readDatabase(table, opts = {}) {
+    if (opts.signal?.aborted)
+      throw new Error("readDatabase: aborted");
+    this.queryDatabase(table, { accountId: opts.accountId, query: this.fullTableQuery() });
+    this.dbReadInFlight = true;
+    try {
+      return await new Promise((resolve, reject) => {
+        let text2 = "";
+        const onChunk = (chunk) => {
+          text2 += chunk.text;
+          const rows = firstTableRows(text2);
+          if (rows)
+            settle(() => resolve(rows));
+        };
+        const timer = setTimeout(() => settle(() => reject(new Error(`readDatabase: ${this.cfg.stationSn} sent no complete ${table}`))), opts.timeoutMs ?? DB_TABLE_TIMEOUT_MS);
+        const onAbort = () => settle(() => reject(new Error("readDatabase: aborted")));
+        const settle = (finish) => {
+          clearTimeout(timer);
+          this.off("dbChunk", onChunk);
+          opts.signal?.removeEventListener("abort", onAbort);
+          finish();
+        };
+        this.on("dbChunk", onChunk);
+        opts.signal?.addEventListener("abort", onAbort, { once: true });
+      });
+    } finally {
+      this.dbReadInFlight = false;
+    }
+  }
+  /** Whether a {@link readDatabase} is accumulating; see {@link queryDatabase} for what it bars. */
+  dbReadInFlight = false;
   /**
    * Request the **face feature rows** over P2P (`face_feature_info`, inner `cmd 10000`). Each row
    * carries `{person_id, face_name, face_id, face_picture_content, face_feature_file_path}` — where
@@ -16628,7 +16836,13 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
     clearTimeout(reorder.timer);
     reorder.timer = void 0;
   }
-  /** Reassemble one in-sequence datagram body into logical frames. */
+  /**
+   * Reassemble one in-sequence datagram body into logical frames.
+   *
+   * Frames are packed back to back, so a frame header can itself be cut by a datagram boundary. The start
+   * of a header left at the end of a datagram is carried into the next one rather than discarded; dropping
+   * it would lose that frame and every frame after it until a datagram happened to begin on a header.
+   */
   reassemble(dataType, datagramBody) {
     const pending = this.pendingByDataType.get(dataType);
     let body = pending ? Buffer.concat([pending.buf, datagramBody]) : datagramBody;
@@ -16652,6 +16866,9 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
       this.handleFrame(header, payload.subarray(0, header.bytesToRead), dataType);
       body = body.subarray(P2P_DATA_HEADER_BYTES + header.bytesToRead);
     }
+    if (body.length > 0 && body.length < P2P_DATA_HEADER_BYTES && MAGIC_WORD.startsWith(body.subarray(0, 4).toString())) {
+      this.pendingByDataType.set(dataType, { buf: body });
+    }
   }
   /**
    * Forget where each data type's sequence numbering had reached, and drop any half-reassembled frame.
@@ -18114,61 +18331,337 @@ function jpegGeometry(jpeg) {
         return void 0;
       return { height: jpeg.readUInt16BE(at + 5), width: jpeg.readUInt16BE(at + 7) };
     }
-    if (JPEG_STANDALONE_MARKERS.has(marker))
-      at += 2;
-    else if (at + 4 <= jpeg.length)
-      at += 2 + jpeg.readUInt16BE(at + 2);
+    if (JPEG_STANDALONE_MARKERS.has(marker))
+      at += 2;
+    else if (at + 4 <= jpeg.length)
+      at += 2 + jpeg.readUInt16BE(at + 2);
+    else
+      return void 0;
+  }
+  return void 0;
+}
+function annexbToJpeg(annexb, spawn2) {
+  const codec = annexbFfmpegFormat(annexb);
+  return new Promise((resolve, reject) => {
+    const ff = spawnFfmpeg([
+      // prettier-ignore
+      "-f",
+      codec,
+      "-i",
+      "pipe:0",
+      "-frames:v",
+      "1",
+      "-pix_fmt",
+      "yuvj420p",
+      "-f",
+      "image2",
+      "-vcodec",
+      "mjpeg",
+      "pipe:1"
+    ], spawn2);
+    const out = [];
+    const err = [];
+    ff.stdout.on("data", (d) => out.push(d));
+    ff.stderr.on("data", (d) => err.push(d));
+    ff.on("error", (e) => reject(new LiveSnapshotUnavailableError("decoder-unavailable", `ffmpeg not runnable: ${e instanceof Error ? e.message : e}`, { cause: e })));
+    ff.on("close", (code) => {
+      const jpeg = Buffer.concat(out);
+      const encoded = jpeg.length >= 3 && jpeg.subarray(0, 3).toString("hex") === "ffd8ff";
+      const geometry = encoded ? jpegGeometry(jpeg) : void 0;
+      if (geometry)
+        return resolve({ jpeg, ...geometry });
+      const diagnostics = Buffer.concat(err).toString().slice(0, 200).trim();
+      const what = code !== 0 ? `ffmpeg exited ${code}` : encoded ? "encoded image declares no frame header" : "no complete frame in the burst";
+      reject(new LiveSnapshotUnavailableError("undecodable-burst", diagnostics ? `${what}: ${diagnostics}` : what));
+    });
+    ff.stdin.on("error", () => {
+    });
+    ff.stdin.write(annexb);
+    ff.stdin.end();
+  });
+}
+
+// dist/transport/p2p/recording-download.js
+import { createDecipheriv as createDecipheriv7 } from "node:crypto";
+
+// dist/transport/p2p/adts.js
+var PROFILE_AAC_LC = 1;
+var FREQ_INDEX_16K = 8;
+var CHANNELS_MONO = 1;
+var AAC_SAMPLES_PER_FRAME = 1024;
+var AAC_SAMPLE_RATE = 16e3;
+var AAC_FRAME_MS = AAC_SAMPLES_PER_FRAME * 1e3 / AAC_SAMPLE_RATE;
+var MAX_AUDIO_FRAME_BYTES = 640;
+var HEADER_LEN_NO_CRC = 7;
+function parseAdtsHeader(buf, offset = 0) {
+  if (offset + HEADER_LEN_NO_CRC > buf.length)
+    return void 0;
+  if (buf[offset] !== 255 || (buf[offset + 1] & 240) !== 240)
+    return void 0;
+  const headerLength = buf[offset + 1] & 1 ? 7 : 9;
+  const frameLength = (buf[offset + 3] & 3) << 11 | buf[offset + 4] << 3 | (buf[offset + 5] & 224) >> 5;
+  if (frameLength < headerLength)
+    return void 0;
+  return {
+    frameLength,
+    headerLength,
+    profile: (buf[offset + 2] & 192) >> 6,
+    frequencyIndex: (buf[offset + 2] & 60) >> 2,
+    channels: (buf[offset + 2] & 1) << 2 | (buf[offset + 3] & 192) >> 6
+  };
+}
+function buildAdtsHeader(payloadLength) {
+  const frameLength = payloadLength + HEADER_LEN_NO_CRC;
+  return Buffer.from([
+    255,
+    241,
+    PROFILE_AAC_LC << 6 | FREQ_INDEX_16K << 2 | CHANNELS_MONO >> 2,
+    (CHANNELS_MONO & 3) << 6 | frameLength >> 11 & 3,
+    frameLength >> 3 & 255,
+    (frameLength & 7) << 5 | 31,
+    252
+  ]);
+}
+function isSupportedAdts(h) {
+  return h.profile === PROFILE_AAC_LC && h.frequencyIndex === FREQ_INDEX_16K && h.channels === CHANNELS_MONO;
+}
+function describeAdts(h) {
+  const rate = ADTS_SAMPLE_RATES[h.frequencyIndex] ?? `index ${h.frequencyIndex}`;
+  const profile = h.profile === PROFILE_AAC_LC ? "AAC-LC" : `profile field ${h.profile}`;
+  return `${profile}, ${rate} Hz, ${h.channels} channel(s)`;
+}
+var ADTS_SAMPLE_RATES = [
+  96e3,
+  88200,
+  64e3,
+  48e3,
+  44100,
+  32e3,
+  24e3,
+  22050,
+  16e3,
+  12e3,
+  11025,
+  8e3,
+  7350
+];
+var AdtsFrameReader = class {
+  buffered = Buffer.alloc(0);
+  /**
+   * Append `chunk` and return every complete frame now available, each a standalone buffer that still
+   * carries its own ADTS header (the device expects the header on the wire).
+   */
+  push(chunk) {
+    this.buffered = this.buffered.length ? Buffer.concat([this.buffered, chunk]) : chunk;
+    const frames = [];
+    let at = 0;
+    for (; ; ) {
+      const h = parseAdtsHeader(this.buffered, at);
+      if (!h) {
+        if (at + HEADER_LEN_NO_CRC > this.buffered.length)
+          break;
+        at++;
+        continue;
+      }
+      if (at + h.frameLength > this.buffered.length)
+        break;
+      frames.push(this.buffered.subarray(at, at + h.frameLength));
+      at += h.frameLength;
+    }
+    this.buffered = at ? this.buffered.subarray(at) : this.buffered;
+    return frames;
+  }
+  /** Bytes held back awaiting the rest of their frame — non-zero mid-stream, zero on a clean boundary. */
+  get pending() {
+    return this.buffered.length;
+  }
+};
+
+// dist/transport/p2p/recording-download.js
+var RECORDING_DATA_TYPE = 3;
+var VIDEO_HEADER_LEN2 = 22;
+var AUDIO_HEADER_LEN2 = 16;
+var AUDIO_NONCE_START = 32;
+var AUDIO_BODY_START = 44;
+var AUDIO_CODEC_AAC_LC = 0;
+var FIRST_FRAME_WAIT_MS = 2e4;
+var IDLE_END_MS = 15e3;
+var DEFAULT_TRANSFER_MS = 12e4;
+var MAX_TRANSFER_BYTES = 32 * 1024 * 1024;
+function homeBase2RecordingPath(channel, recording) {
+  if (!/^\d{14}$/.test(recording) || !Number.isInteger(channel) || channel < 0 || channel > 99)
+    return void 0;
+  return `/media/mmcblk0p1/Camera${String(channel).padStart(2, "0")}/${recording}.dat`;
+}
+function receiveRecording(session, request) {
+  let resolveFrames;
+  let rejectFrames;
+  const frames = new Promise((resolve, reject) => {
+    resolveFrames = resolve;
+    rejectFrames = reject;
+  });
+  let resolveDrained;
+  const drained = new Promise((resolve) => resolveDrained = resolve);
+  const limitMs = request.timeoutMs ?? DEFAULT_TRANSFER_MS;
+  let collected = [];
+  const started = Date.now();
+  let lastFrameAt = started;
+  let received = false;
+  let bytes2 = 0;
+  let draining;
+  let delivered = false;
+  let listening = true;
+  const deliver = (error) => {
+    if (delivered)
+      return;
+    delivered = true;
+    request.signal?.removeEventListener("abort", onAbort);
+    if (error)
+      rejectFrames(error);
     else
-      return void 0;
+      resolveFrames(collected);
+  };
+  const stop = () => {
+    if (!listening)
+      return;
+    listening = false;
+    clearInterval(tick);
+    session.off("data", onData);
+    resolveDrained();
+  };
+  const incomplete = (why) => deliver(new RecordingDownloadError("incomplete", `the recording transfer ${why} before its finish frame`));
+  const drain = (why) => {
+    draining ??= why;
+    collected = [];
+  };
+  const onData = (frame) => {
+    if (frame.channel !== request.channel)
+      return;
+    if (frame.commandId === CommandType.CMD_DOWNLOAD_FINISH) {
+      if (draining)
+        incomplete(draining);
+      else
+        deliver();
+      return stop();
+    }
+    if (frame.commandId !== CommandType.CMD_VIDEO_FRAME && frame.commandId !== CommandType.CMD_AUDIO_FRAME)
+      return;
+    if (frame.dataType !== RECORDING_DATA_TYPE)
+      return;
+    received = true;
+    lastFrameAt = Date.now();
+    if (draining)
+      return;
+    collected.push({ commandId: frame.commandId, signCode: frame.signCode, raw: Buffer.from(frame.raw) });
+    bytes2 += frame.raw.length;
+    if (bytes2 >= MAX_TRANSFER_BYTES)
+      drain(`reached ${MAX_TRANSFER_BYTES} bytes`);
+  };
+  const onAbort = () => {
+    deliver(request.signal?.reason instanceof Error ? request.signal.reason : new Error("aborted"));
+    drain("was aborted");
+  };
+  const tick = setInterval(() => {
+    const now2 = Date.now();
+    if (!received && now2 - started > FIRST_FRAME_WAIT_MS) {
+      deliver(new RecordingDownloadError("no-data", `the station sent nothing within ${FIRST_FRAME_WAIT_MS} ms`));
+      stop();
+    } else if (received && now2 - lastFrameAt > IDLE_END_MS) {
+      incomplete(draining ?? `went quiet for ${IDLE_END_MS} ms`);
+      stop();
+    } else if (now2 - started > 2 * limitMs && draining) {
+      incomplete(draining);
+      stop();
+    } else if (now2 - started > limitMs) {
+      drain(`ran past ${limitMs} ms`);
+    }
+  }, 250);
+  if (request.signal?.aborted) {
+    onAbort();
+    stop();
+    return { frames, drained };
+  }
+  request.signal?.addEventListener("abort", onAbort, { once: true });
+  session.on("data", onData);
+  try {
+    session.sendStringPairCommand(CommandType.CMD_DOWNLOAD_VIDEO, request.path, request.accountId, request.channel);
+  } catch (error) {
+    deliver(error instanceof Error ? error : new Error(String(error)));
+    stop();
   }
-  return void 0;
+  return { frames, drained };
 }
-function annexbToJpeg(annexb, spawn2) {
-  const codec = annexbFfmpegFormat(annexb);
-  return new Promise((resolve, reject) => {
-    const ff = spawnFfmpeg([
-      // prettier-ignore
-      "-f",
-      codec,
-      "-i",
-      "pipe:0",
-      "-frames:v",
-      "1",
-      "-pix_fmt",
-      "yuvj420p",
-      "-f",
-      "image2",
-      "-vcodec",
-      "mjpeg",
-      "pipe:1"
-    ], spawn2);
-    const out = [];
-    const err = [];
-    ff.stdout.on("data", (d) => out.push(d));
-    ff.stderr.on("data", (d) => err.push(d));
-    ff.on("error", (e) => reject(new LiveSnapshotUnavailableError("decoder-unavailable", `ffmpeg not runnable: ${e instanceof Error ? e.message : e}`, { cause: e })));
-    ff.on("close", (code) => {
-      const jpeg = Buffer.concat(out);
-      const encoded = jpeg.length >= 3 && jpeg.subarray(0, 3).toString("hex") === "ffd8ff";
-      const geometry = encoded ? jpegGeometry(jpeg) : void 0;
-      if (geometry)
-        return resolve({ jpeg, ...geometry });
-      const diagnostics = Buffer.concat(err).toString().slice(0, 200).trim();
-      const what = code !== 0 ? `ffmpeg exited ${code}` : encoded ? "encoded image declares no frame header" : "no complete frame in the burst";
-      reject(new LiveSnapshotUnavailableError("undecodable-burst", diagnostics ? `${what}: ${diagnostics}` : what));
-    });
-    ff.stdin.on("error", () => {
-    });
-    ff.stdin.write(annexb);
-    ff.stdin.end();
-  });
+function openAudio(key, nonce, tag2, body) {
+  try {
+    const decipher = createDecipheriv7("aes-256-gcm", key, nonce);
+    decipher.setAAD(VIDEO_GCM_AAD);
+    decipher.setAuthTag(tag2);
+    return Buffer.concat([decipher.update(body), decipher.final()]);
+  } catch {
+    return void 0;
+  }
+}
+function decodeRecording(frames, eccPrivateKeyHex) {
+  const eccPrivateKey = Buffer.from(eccPrivateKeyHex, "hex");
+  if (eccPrivateKey.length !== 32)
+    throw new RecordingDownloadError("undecodable", "the cipher key is not a P-256 key");
+  const decoder = new VideoFrameDecoder(eccPrivateKey);
+  const video = [];
+  const audio = [];
+  const numbers = /* @__PURE__ */ new Set();
+  let firstStamp;
+  let lastStamp;
+  for (const { commandId, raw } of frames) {
+    if (commandId === CommandType.CMD_VIDEO_FRAME) {
+      const header = parseVideoFrameHeader(raw);
+      if (!header)
+        continue;
+      const h264 = header.keyframe ? decoder.decodeFrame(raw)?.h264 : raw.length >= VIDEO_HEADER_LEN2 + header.payloadLength ? raw.subarray(VIDEO_HEADER_LEN2, VIDEO_HEADER_LEN2 + header.payloadLength) : void 0;
+      if (!h264?.length)
+        continue;
+      video.push(h264);
+      numbers.add(header.sequence);
+      const stamp = raw.readUIntLE(14, 6);
+      firstStamp ??= stamp;
+      lastStamp = stamp;
+    } else if (commandId === CommandType.CMD_AUDIO_FRAME) {
+      const mediaKey = decoder.currentMediaKey;
+      if (!mediaKey || raw.length < AUDIO_BODY_START || raw[5] !== AUDIO_CODEC_AAC_LC)
+        continue;
+      const len = raw.readUInt32LE(0);
+      if (raw.length < AUDIO_BODY_START + len)
+        continue;
+      const aac = openAudio(mediaKey, raw.subarray(AUDIO_NONCE_START, AUDIO_BODY_START), raw.subarray(AUDIO_HEADER_LEN2, AUDIO_NONCE_START), raw.subarray(AUDIO_BODY_START, AUDIO_BODY_START + len));
+      if (aac?.length)
+        audio.push(buildAdtsHeader(aac.length), aac);
+    }
+  }
+  if (!video.length)
+    throw new RecordingDownloadError("undecodable", "no video frame of the recording decoded");
+  const ordered = [...numbers];
+  let missingFrames = 0;
+  for (let i = 1; i < ordered.length; i++) {
+    const step = ordered[i] - ordered[i - 1] & 65535;
+    if (step > 1 && step < 32768)
+      missingFrames += step - 1;
+  }
+  const span = ordered.length > 1 ? ordered[ordered.length - 1] - ordered[0] & 65535 : 0;
+  const durationMs = (lastStamp ?? 0) - (firstStamp ?? 0);
+  return {
+    video: Buffer.concat(video),
+    ...audio.length ? { audio: Buffer.concat(audio) } : {},
+    frames: ordered.length,
+    missingFrames,
+    durationMs,
+    fps: durationMs > 0 && span > 0 ? Math.round(span * 1e5 / durationMs) / 100 : 0
+  };
 }
 
 // dist/transport/p2p/shared-live-source.js
 import { EventEmitter as EventEmitter4 } from "node:events";
-function durationMs(seconds) {
-  const milliseconds = (seconds ?? 0) * 1e3;
-  return Number.isFinite(milliseconds) && milliseconds > 0 ? milliseconds : 0;
+var MAX_TIMER_DELAY_MS = 2147483647;
+function timerMs(value, fallback) {
+  return value !== void 0 && Number.isFinite(value) && value >= 1 && value <= MAX_TIMER_DELAY_MS ? value : fallback;
 }
 function sameConfig(a, b) {
   return b !== void 0 && a.codec === b.codec && a.width === b.width && a.height === b.height;
@@ -18421,14 +18914,14 @@ var SharedLiveSource = class {
   tag;
   constructor(opts) {
     this.opts = opts;
-    this.lingerMs = opts.lingerMs ?? 8e3;
+    this.lingerMs = opts.lingerMs === 0 ? 1 : timerMs(opts.lingerMs, 8e3);
     this.maxQueue = opts.maxQueue ?? 900;
-    this.preBufferMs = durationMs(opts.preBufferSeconds);
-    this.warmRetryMs = opts.warmRetryMs ?? 2e3;
-    this.warmTimeoutMs = opts.warmTimeoutMs ?? 2e4;
+    this.preBufferMs = timerMs((opts.preBufferSeconds ?? 0) * 1e3, 0);
+    this.warmRetryMs = timerMs(opts.warmRetryMs, 2e3);
+    this.warmTimeoutMs = timerMs(opts.warmTimeoutMs, 2e4);
     this.powered = opts.powered ?? "wired";
-    this.batteryBudgetMs = opts.batteryBudgetMs ?? 45e3;
-    this.budgetGraceMs = opts.budgetGraceMs ?? 1e4;
+    this.batteryBudgetMs = timerMs(opts.batteryBudgetMs, 45e3);
+    this.budgetGraceMs = timerMs(opts.budgetGraceMs, 1e4);
     this.logger = opts.logger ?? noopLogger;
     this.tag = opts.label ? `[live ${opts.label}]` : "[live]";
     this.traceId = `pull-${++pullSequence}`;
@@ -18676,7 +19169,7 @@ var SharedLiveSource = class {
     if (this.disposed || !this.stream)
       return;
     this.clearBudget();
-    this.budgetTimer.arm(ms ?? this.batteryBudgetMs, () => this.onBudgetExpire());
+    this.budgetTimer.arm(timerMs(ms, this.batteryBudgetMs), () => this.onBudgetExpire());
   }
   /** Settle a reuse watch on any frame — the join already holds a decodable picture. */
   settleReuseWatch() {
@@ -18817,7 +19310,7 @@ var SharedLiveSource = class {
     return this.bufferedMedia(seconds).filter((item) => item.kind === "video").map((item) => item.frame);
   }
   bufferedMedia(seconds) {
-    const requested = Math.min(durationMs(seconds), this.preBufferMs);
+    const requested = Number.isFinite(seconds) ? Math.min(seconds * 1e3, this.preBufferMs) : 0;
     if (requested <= 0 || !this.ring.length)
       return [];
     const start = this.windowStart(Date.now() - requested);
@@ -19286,89 +19779,6 @@ function openReadableFromConsumer(consumer, opts = {}) {
 // dist/transport/p2p/talkback.js
 import { EventEmitter as EventEmitter5 } from "node:events";
 import { Writable } from "node:stream";
-
-// dist/transport/p2p/adts.js
-var PROFILE_AAC_LC = 1;
-var FREQ_INDEX_16K = 8;
-var CHANNELS_MONO = 1;
-var AAC_SAMPLES_PER_FRAME = 1024;
-var AAC_SAMPLE_RATE = 16e3;
-var AAC_FRAME_MS = AAC_SAMPLES_PER_FRAME * 1e3 / AAC_SAMPLE_RATE;
-var MAX_AUDIO_FRAME_BYTES = 640;
-var HEADER_LEN_NO_CRC = 7;
-function parseAdtsHeader(buf, offset = 0) {
-  if (offset + HEADER_LEN_NO_CRC > buf.length)
-    return void 0;
-  if (buf[offset] !== 255 || (buf[offset + 1] & 240) !== 240)
-    return void 0;
-  const headerLength = buf[offset + 1] & 1 ? 7 : 9;
-  const frameLength = (buf[offset + 3] & 3) << 11 | buf[offset + 4] << 3 | (buf[offset + 5] & 224) >> 5;
-  if (frameLength < headerLength)
-    return void 0;
-  return {
-    frameLength,
-    headerLength,
-    profile: (buf[offset + 2] & 192) >> 6,
-    frequencyIndex: (buf[offset + 2] & 60) >> 2,
-    channels: (buf[offset + 2] & 1) << 2 | (buf[offset + 3] & 192) >> 6
-  };
-}
-function isSupportedAdts(h) {
-  return h.profile === PROFILE_AAC_LC && h.frequencyIndex === FREQ_INDEX_16K && h.channels === CHANNELS_MONO;
-}
-function describeAdts(h) {
-  const rate = ADTS_SAMPLE_RATES[h.frequencyIndex] ?? `index ${h.frequencyIndex}`;
-  const profile = h.profile === PROFILE_AAC_LC ? "AAC-LC" : `profile field ${h.profile}`;
-  return `${profile}, ${rate} Hz, ${h.channels} channel(s)`;
-}
-var ADTS_SAMPLE_RATES = [
-  96e3,
-  88200,
-  64e3,
-  48e3,
-  44100,
-  32e3,
-  24e3,
-  22050,
-  16e3,
-  12e3,
-  11025,
-  8e3,
-  7350
-];
-var AdtsFrameReader = class {
-  buffered = Buffer.alloc(0);
-  /**
-   * Append `chunk` and return every complete frame now available, each a standalone buffer that still
-   * carries its own ADTS header (the device expects the header on the wire).
-   */
-  push(chunk) {
-    this.buffered = this.buffered.length ? Buffer.concat([this.buffered, chunk]) : chunk;
-    const frames = [];
-    let at = 0;
-    for (; ; ) {
-      const h = parseAdtsHeader(this.buffered, at);
-      if (!h) {
-        if (at + HEADER_LEN_NO_CRC > this.buffered.length)
-          break;
-        at++;
-        continue;
-      }
-      if (at + h.frameLength > this.buffered.length)
-        break;
-      frames.push(this.buffered.subarray(at, at + h.frameLength));
-      at += h.frameLength;
-    }
-    this.buffered = at ? this.buffered.subarray(at) : this.buffered;
-    return frames;
-  }
-  /** Bytes held back awaiting the rest of their frame — non-zero mid-stream, zero on a clean boundary. */
-  get pending() {
-    return this.buffered.length;
-  }
-};
-
-// dist/transport/p2p/talkback.js
 var DEFAULT_HIGH_WATER_FRAMES = Math.ceil(2e3 / AAC_FRAME_MS);
 var DEFAULT_IDLE_TIMEOUT_MS = 3e4;
 var Talkback = class extends EventEmitter5 {
@@ -20344,6 +20754,8 @@ var P2PCommandRouter = class _P2PCommandRouter {
   talkbacks = /* @__PURE__ */ new Map();
   /** cipher_id → ECC private key (one eufylife get_ciphers call per cipher), shared across (re)opens. */
   cipherKeyCache = /* @__PURE__ */ new Map();
+  /** The recording download in flight per station; a station serves one at a time. */
+  recordingDownloads = /* @__PURE__ */ new Map();
   constructor(deps) {
     this.deps = deps;
     this.manager = new SessionManager({
@@ -20556,28 +20968,7 @@ var P2PCommandRouter = class _P2PCommandRouter {
       localAddress,
       dskKey,
       noBroadcast: this.deps.noBroadcast,
-      resolveCipherKey: async (cipherId) => {
-        if (this.cipherKeyCache.has(cipherId))
-          return this.cipherKeyCache.get(cipherId);
-        let ecc;
-        try {
-          const ciphers = await this.deps.mega.getCiphers([cipherId], adminUserId, stationSn);
-          ecc = ciphers.find((c) => Number(c.cipher_id) === cipherId)?.ecc_private_key;
-          if (ecc === void 0 && ciphers[0]?.ecc_private_key !== void 0) {
-            ecc = ciphers[0].ecc_private_key;
-            this.traceOnStation(session, {
-              phase: "cipher-fallback",
-              cipherId,
-              answeredCipherId: Number(ciphers[0].cipher_id)
-            });
-          }
-        } catch (e) {
-          this.deps.onError(e instanceof Error ? e : new Error(String(e)));
-        }
-        if (ecc !== void 0)
-          this.cipherKeyCache.set(cipherId, ecc);
-        return ecc;
-      },
+      resolveCipherKey: (cipherId) => this.cipherKeyFor(session, cipherId, adminUserId, stationSn),
       logger: this.deps.logger ?? noopLogger
     });
     session.on("error", (e) => this.reportError(e));
@@ -20601,6 +20992,33 @@ var P2PCommandRouter = class _P2PCommandRouter {
     session.on("data", (f) => this.deps.onFrame(stationSn, f));
     return session;
   }
+  /**
+   * The ECC private key of `cipherId`, from the router's cache or one `get_ciphers` call. When the cloud
+   * answers with another cipher, that one is used and traced on `session`. Only a successful lookup is
+   * cached.
+   */
+  async cipherKeyFor(session, cipherId, userId, stationSn) {
+    if (this.cipherKeyCache.has(cipherId))
+      return this.cipherKeyCache.get(cipherId);
+    let ecc;
+    try {
+      const ciphers = await this.deps.mega.getCiphers([cipherId], userId, stationSn);
+      ecc = ciphers.find((c) => Number(c.cipher_id) === cipherId)?.ecc_private_key;
+      if (ecc === void 0 && ciphers[0]?.ecc_private_key !== void 0) {
+        ecc = ciphers[0].ecc_private_key;
+        this.traceOnStation(session, {
+          phase: "cipher-fallback",
+          cipherId,
+          answeredCipherId: Number(ciphers[0].cipher_id)
+        });
+      }
+    } catch (e) {
+      this.deps.onError(e instanceof Error ? e : new Error(String(e)));
+    }
+    if (ecc !== void 0)
+      this.cipherKeyCache.set(cipherId, ecc);
+    return ecc;
+  }
   /**
    * Open (or reuse) a station's P2P session and await its completed handshake. An optional abort only
    * stops this wait; session ownership remains with {@link SessionManager} and its normal teardown.
@@ -20728,7 +21146,9 @@ var P2PCommandRouter = class _P2PCommandRouter {
    * start has no level-1 form for.
    */
   mediaProviderFor(sn) {
+    const recordings = this.downloadsRecordings(sn) ? { downloadRecording: (opts) => this.downloadRecording(sn, opts) } : {};
     return {
+      ...recordings,
       snapshotLive: async (opts) => {
         const source = await this.sharedLiveSourceFor(sn, opts ?? {});
         return captureSnapshotFromShared(source, {
@@ -20767,6 +21187,63 @@ var P2PCommandRouter = class _P2PCommandRouter {
       }
     };
   }
+  /**
+   * Whether `sn` is a camera attached to a HomeBase 2 (T8010), the one station whose recording path layout
+   * and frame formats are confirmed.
+   */
+  downloadsRecordings(sn) {
+    const dev = this.recordFor(sn);
+    if (!dev)
+      return false;
+    const parentSn = stationOf(dev);
+    return parentSn !== sn && this.recordFor(parentSn)?.model === "T8010";
+  }
+  /**
+   * Download one recording a HomeBase 2 holds for an attached camera, then decode it
+   * ({@link decodeRecording}). Downloads queue per station: the station streams one recording at a time
+   * on the camera's channel, so a download starts only once the previous one has drained
+   * ({@link RecordingTransfer.drained}), even when that one's caller already has its answer. An abort
+   * while waiting rejects without sending anything; an abort mid-transfer rejects at once and the station's
+   * turn is held until the transfer drains.
+   */
+  async downloadRecording(sn, opts) {
+    opts.signal?.throwIfAborted();
+    const parentSn = this.stationKeyOf(sn);
+    const previous = this.recordingDownloads.get(parentSn) ?? Promise.resolve();
+    const started = this.waitTurn(previous, opts.signal).then(() => this.startRecordingDownload(sn, opts));
+    const turn = Promise.allSettled([previous, started.then((t) => t.drained)]).then(() => {
+      if (this.recordingDownloads.get(parentSn) === turn)
+        this.recordingDownloads.delete(parentSn);
+    });
+    this.recordingDownloads.set(parentSn, turn);
+    return started.then((t) => t.recording);
+  }
+  /** Resolve once `previous` settles, or reject as soon as `signal` aborts. */
+  waitTurn(previous, signal) {
+    return abortable(previous.then(() => void 0, () => void 0), signal);
+  }
+  /**
+   * Start one recording download, once the station's previous download has drained: the decoded recording,
+   * and when the station is done sending it.
+   */
+  async startRecordingDownload(sn, opts) {
+    const { session, parentSn, channel, accountId } = await this.resolveSession(sn, { signal: opts.signal });
+    const path = homeBase2RecordingPath(channel, opts.recording);
+    if (!path)
+      throw new RecordingDownloadError("invalid-recording", `no recording named ${opts.recording}`);
+    const eccKey = await this.cipherKeyFor(session, opts.cipherId, accountId, parentSn);
+    if (!eccKey) {
+      throw new RecordingDownloadError("key-unavailable", `cipher ${opts.cipherId} could not be obtained`);
+    }
+    const transfer = receiveRecording(session, {
+      path,
+      accountId,
+      channel,
+      timeoutMs: opts.timeoutMs,
+      signal: opts.signal
+    });
+    return { recording: transfer.frames.then((frames) => decodeRecording(frames, eccKey)), drained: transfer.drained };
+  }
   /**
    * Open a {@link Talkback} on a device's camera channel.
    *
@@ -24292,6 +24769,7 @@ var MEDIA_FAILURE_REASONS = [
 // dist/transport/stored-image-cache.js
 var MAX_JPEG_BYTES = 10 * 1024 * 1024;
 var MAX_REMEMBERED_URLS = 64;
+var NOT_YET_PUBLISHED_RETRY_MS = [2e3, 4e3];
 var DIAGNOSTIC_INTERVAL_MS = 6e4;
 var StoredImageCache = class {
   downloader;
@@ -24329,6 +24807,8 @@ var StoredImageCache = class {
     if (state.seenUrls.has(url))
       return;
     state.seenUrls.add(url);
+    clearTimeout(state.retrying);
+    state.retrying = void 0;
     while (state.seenUrls.size > MAX_REMEMBERED_URLS) {
       const oldest = state.seenUrls.values().next();
       if (oldest.done)
@@ -24340,14 +24820,15 @@ var StoredImageCache = class {
       url,
       sequence: ++state.nextSequence,
       observedAt: this.clock(),
-      generation: this.generation
+      generation: this.generation,
+      retries: 0
     };
     this.pump();
   }
   /** Return retained bytes without starting or awaiting network work. */
   snapshotStored(deviceKey) {
     const state = this.devices.get(deviceKey);
-    const reason = state?.queued || state?.inFlight ? "pending" : state?.reason ?? "not-observed";
+    const reason = state?.queued || state?.inFlight || state?.retrying ? "pending" : state?.reason ?? "not-observed";
     if (reason !== "pending" && state?.lifecycleError)
       return Promise.reject(state.lifecycleError);
     if (state?.retained)
@@ -24381,6 +24862,8 @@ var StoredImageCache = class {
       if (error !== void 0 && this.isLifecycleError(error)) {
         state.lifecycleError = error;
         state.reason = void 0;
+      } else if (image === void 0 && this.retryLater(state, candidate, error)) {
+        state.lifecycleError = void 0;
       } else if (image === void 0) {
         state.lifecycleError = void 0;
         state.reason = "download-failed";
@@ -24397,6 +24880,21 @@ var StoredImageCache = class {
     }
     this.pump();
   }
+  /** Schedule the next attempt after a 404; answers whether one was scheduled. */
+  retryLater(state, candidate, error) {
+    const delay = NOT_YET_PUBLISHED_RETRY_MS[candidate.retries];
+    const tag2 = mediaFailureTag(error);
+    if (delay === void 0 || tag2.cause !== "http-status" || tag2.status !== 404 || state.queued)
+      return false;
+    const timer = setTimeout(() => {
+      state.retrying = void 0;
+      state.queued = { ...candidate, retries: candidate.retries + 1 };
+      this.pump();
+    }, delay);
+    timer.unref?.();
+    state.retrying = timer;
+    return true;
+  }
   isValidJpeg(image) {
     return Buffer.isBuffer(image) && image.length > 0 && image.length <= MAX_JPEG_BYTES && image.length >= 5 && image[0] === 255 && image[1] === 216 && image[2] === 255 && image[image.length - 2] === 255 && image[image.length - 1] === 217;
   }
@@ -24992,6 +25490,11 @@ function recordString(raw, key) {
   const v = typeof nested === "string" && nested ? nested : raw[key];
   return typeof v === "string" && v ? v : void 0;
 }
+function adminUserIdFrom(raw) {
+  const member = (raw ?? {}).member;
+  const id = member?.admin_user_id;
+  return typeof id === "string" && id ? id : void 0;
+}
 function tuyaDevIdFrom(raw) {
   for (const field of ["tuya_uuid", "tuya_virtual_id", "tuya_device_id", "virtualId"]) {
     const v = recordString(raw, field);
@@ -25149,13 +25652,7 @@ var EufyMega = class extends EventEmitter9 {
       onError: (e) => this.reportError(e),
       // The `a2` account id an `eufy_life` DP frame embeds — the owning member's `admin_user_id`,
       // falling back to the logged-in account's user id (the confirmed script path does the same).
-      resolveAccountId: (dev) => {
-        const member = (dev.raw ?? {}).member;
-        const adminId = member?.admin_user_id;
-        if (typeof adminId === "string" && adminId)
-          return adminId;
-        return this.mega.auth?.userId ?? "";
-      },
+      resolveAccountId: (dev) => adminUserIdFrom(dev.raw) ?? this.mega.auth?.userId ?? "",
       // Fetch + parse a gallery effect from the HTTP catalogue into the serializable spec. The catalogue
       // lives in the http layer (transport/http/light-catalog); the mqtt router owns the frame bytes.
       resolvePreset: (presetId) => resolveLightEffect(this.mega, presetId),
@@ -26602,6 +27099,37 @@ var EufyMega = class extends EventEmitter9 {
   getP2pSessions() {
     return this.p2p.getSessions();
   }
+  /**
+   * The people enrolled on a station, read from its own `person_basic_info` table over P2P.
+   *
+   * The cloud roster (`api.getFaces()`) answers empty for an account that keeps its faces on the
+   * station, because they were never uploaded — the station holds them.
+   *
+   * Resolves with the rows the station returned. Rejects on a station that cannot be reached, on a
+   * record stating no `admin_user_id`, and on the reply not arriving whole in time. Assembling that
+   * reply is `P2PSession.readDatabase`'s; this resolves which station and which account id.
+   *
+   * `stranger<n>` names are the station's own placeholders for a face nobody has named, and are
+   * returned as they arrive; a caller that wants only named people filters them.
+   */
+  async getStationFaces(stationSn, opts = {}) {
+    if (!this.registry.list().length)
+      await this.getDevices();
+    const station = this.p2p.stationKeyOf(stationSn);
+    const accountId = this.adminUserIdOf(station);
+    if (!accountId)
+      throw new Error(`getStationFaces: no admin_user_id on record for ${station}`);
+    await this.p2p.ensureStation(station, opts.signal);
+    const session = this.p2p.getSessions().get(station);
+    if (!session)
+      throw new Error(`getStationFaces: no P2P session for ${station}`);
+    const rows = await session.readDatabase("person_basic_info", { accountId, ...opts });
+    return rows.filter((row) => typeof row === "object" && row !== null);
+  }
+  /** The station's own `admin_user_id`, which its database refuses the query without. */
+  adminUserIdOf(stationSn) {
+    return adminUserIdFrom(this.registry.list().find((d) => d.sn === stationSn)?.raw);
+  }
   /**
    * The liveness facts for one device — see {@link DeviceState}. Facts, not an `online` verdict: "how
    * long is too long" is a threshold that belongs to the caller, and it differs per device class.
@@ -26839,7 +27367,7 @@ var EufyMega = class extends EventEmitter9 {
       if (ev.eventName === void 0 && ev.eventType != null)
         ev.eventName = detectionName(ev.eventType);
       if (ev.thumbnailCandidate)
-        void this.observeStoredImage(ev.thumbnailCandidate);
+        void this.observeStoredImage(ev.thumbnailCandidate, ev.deviceSn);
       this.emit("push", ev);
       const signal2 = {
         source: "push",
@@ -26888,9 +27416,16 @@ var EufyMega = class extends EventEmitter9 {
     client.on("error", (e) => this.reportError(e));
     return client;
   }
-  /** Admit only exact, account-known devices with resolved snapshot evidence into the passive store. */
-  async observeStoredImage(candidate) {
-    if (!this.storedImages || candidate.attribution.kind !== "device")
+  /**
+   * Admit only exact, account-known devices with resolved snapshot evidence into the passive store; a
+   * station-only candidate is admitted under the event's device serial.
+   */
+  async observeStoredImage(candidate, eventDeviceSn) {
+    if (!this.storedImages)
+      return;
+    const { attribution } = candidate;
+    const deviceSn = attribution.kind === "device" ? attribution.deviceSn : attribution.kind === "station" ? eventDeviceSn : void 0;
+    if (!deviceSn)
       return;
     const account = this.mega.auth?.userId;
     if (!account)
@@ -26900,9 +27435,9 @@ var EufyMega = class extends EventEmitter9 {
         await this.registry.getDevices();
       if (this.mega.auth?.userId !== account)
         return;
-      const caps = this.registry.capabilitiesForDevice(candidate.attribution.deviceSn);
+      const caps = this.registry.capabilitiesForDevice(deviceSn);
       if (caps && hasProvidedAction(caps, "snapshotStored")) {
-        this.storedImages.observe(candidate.attribution.deviceSn, candidate.url);
+        this.storedImages.observe(deviceSn, candidate.url);
       }
     } catch (e) {
       this.reportError(e);
@@ -27127,26 +27662,16 @@ var SolixClient = class _SolixClient {
   }
   /** Build the encrypted, signed `/passport/login` request body + headers for the negotiated key. */
   async postLogin(kx, verifyCode, limitedToken) {
-    const { clientPublicKeyHex, encryptedPassword } = encryptLoginPassword(this.password);
     const bodyObj = {
-      email: this.email,
-      password: encryptedPassword,
-      ab: this.country,
-      client_secret_info: { public_key: clientPublicKeyHex },
+      ...loginCredentials(this.email, this.password, this.country),
       answer: "",
       captcha_id: "",
       verify_code: verifyCode ?? "",
       login_id: ""
     };
     const encBody = encryptBody(JSON.stringify(bodyObj), kx.shareKey);
-    const ts = nowSec();
-    const once = genId();
     return this.post(this.apiHost, SOLIX_ENDPOINTS.login, encBody, this.authHeaders({
-      "x-encryption-info": "algo_ecdh",
-      "x-key-ident": kx.keyIdent,
-      "x-request-ts": ts,
-      "x-request-once": once,
-      "x-signature": signRequest(kx.shareKey, ts, once, encBody),
+      ...signedHeaders(kx, encBody),
       ...limitedToken ? { "x-auth-token": limitedToken } : {}
     }));
   }
@@ -27161,13 +27686,12 @@ var SolixClient = class _SolixClient {
    * observed refusing the header, which is consistent with the two ids agreeing on the accounts seen.
    */
   classifyLogin(data, isVerify) {
-    const userId = data.ap_cloud_user_id ?? data.user_id;
-    const authToken = data.auth_token;
-    if (!userId || !authToken)
+    const reply = readLoginReply(data);
+    if (!reply)
       throw new Error(`Solix login returned no session: ${JSON.stringify(data).slice(0, 160)}`);
-    const faInfo = data.fa_info ?? {};
-    if (!isVerify && faInfo.info) {
-      this.pending2fa = { limitedToken: authToken, userId, geoKey: data.geo_key };
+    const { userId, authToken } = reply;
+    if (!isVerify && reply.twoFactorPending) {
+      this.pending2fa = { limitedToken: authToken, userId, geoKey: reply.geoKey };
       return { status: "2fa", method: "code sent by the passport" };
     }
     this.pending2fa = void 0;
@@ -27176,7 +27700,7 @@ var SolixClient = class _SolixClient {
       userId,
       gtoken: gtoken(userId),
       apiHost: this.apiHost,
-      tokenExpiresAt: Number(data.token_expires_at ?? 0) || 0
+      tokenExpiresAt: reply.tokenExpiresAt
     };
     this.persist();
     return { status: "ok", session: this.session_ };
@@ -27331,14 +27855,8 @@ var SolixClient = class _SolixClient {
       throw new Error("not authenticated \u2014 call login() first");
     const kx = await this.keyExchange();
     const encBody = encryptBody(JSON.stringify(payload), kx.shareKey);
-    const ts = nowSec();
-    const once = genId();
     const env = await this.post(this.apiHost, path, encBody, this.baseHeaders({
-      "x-encryption-info": "algo_ecdh",
-      "x-key-ident": kx.keyIdent,
-      "x-request-ts": ts,
-      "x-request-once": once,
-      "x-signature": signRequest(kx.shareKey, ts, once, encBody),
+      ...signedHeaders(kx, encBody),
       "x-auth-token": this.session_.authToken,
       gtoken: this.session_.gtoken
     }));
@@ -28106,6 +28624,7 @@ export {
   ROOM_SUCTIONS,
   RTSP_MEMBERS,
   RawDpWriter,
+  RecordingDownloadError,
   RecordingQuality,
   RtspRecordingMode,
   SCENE_INVALID_REASONS,
@@ -28149,6 +28668,7 @@ export {
   VACUUM_DOCK_MEMBERS,
   VACUUM_SCHEDULE_ACTIONS,
   VACUUM_SCHEDULE_WEEKDAYS,
+  VIDEO_GCM_AAD,
   VacuumMapStore,
   VideoFrameDecoder,
   WORKING_MODE_MAPS,