@mega-yfue/eufy-sdk 0.4.0-beta.9 → 0.5.0-beta.0

package/dist/model/capabilities/camera.d.ts

@@ -1,5 +1,5 @@
 import { type Surface } from "./members.js";
-import type { CapabilityModule, CommandContext } from "./types.js";
+import type { AvailabilityContext, CapabilityModule, CommandContext } from "./types.js";
 import { type Command, type MediaProvider } from "../../core/contracts.js";
 /**
  * The P2P **feature-command ids** this camera capability drives (direct-binary switches + `1350`
@@ -8,8 +8,10 @@ import { type Command, type MediaProvider } from "../../core/contracts.js";
  * `transport/p2p/commands.ts`). Each entry notes its app `CommandType` name.
  */
 export declare const CAMERA_CMD: {
-    /** Camera on/off. switch is inverted: camera ON ⇒ 0, OFF ⇒ 1. */
+    /** Camera on/off. Read and write polarity depend on the family and topology. */
     readonly CAMERA_ENABLE: 1035;
+    /** Wrapped T8410 power switch on HomeBase 3. */
+    readonly PRIVACY_MODE: 6250;
     /**
      * Camera status LED on/off — the "power/recording" indicator. The
      * app JS has a sibling param `1056` (`APP_CMD_LIVEVIEW_LED_SWITCH`) for the SAME UI "Status Light"
@@ -270,17 +272,17 @@ export type CameraActions = Surface<typeof CAMERA_MEMBERS> & {
  */
 export declare const CAMERA_MEMBERS: {
     /**
-     * The READ is the *disable*-bit convention (1035 "0" ⇒ ON, 2001 direct); the WRITE polarity is
+     * The default READ is the *disable*-bit convention (1035 "0" ⇒ ON, 2001 direct); the WRITE polarity is
      * family-dependent — see `powerValue` / `isEnableBitPolarity`. Battery/solo cams report the state under
      * 1035, standalone indoor/outdoor cams under 2001 OPEN_DEVICE with direct polarity, so 2001 is a
      * read-alias. Both verified live, and the write polarity is confirmed against the app's own frames.
      *
-     * The read and the setter observe the SAME wire on every family — see `powerCommand` — which is what
-     * makes this value track what it is told, and what lets `enablementReflection` confirm a write.
+     * T8410 on HomeBase 3 reports 1035 as an enable bit ("1" ⇒ ON). That reported state does not reliably
+     * reflect the privacy command. `readReflectsWrite` states this distinction.
      *
      * The privacy param (6250) is reported by the outdoor-PT family and by no other camera measured, and both
      * of its polarities are observed. It is deliberately NOT aliased here: it moved in the same step as 1035, so
-     * the reading cannot say whether power and privacy are one state or two, and the app drives 1035 — so
+     * the reading cannot say whether power and privacy are one state or two — so
      * aliasing a second param could only fold two possible states into one getter for no gain.
      */
     readonly enabled: {
@@ -289,10 +291,12 @@ export declare const CAMERA_MEMBERS: {
         readonly kind: "boolean";
         readonly provenance: "verified";
         readonly invert: true;
+        readonly invertFor: (ctx: AvailabilityContext) => false | undefined;
         readonly readAliases: readonly [{
             readonly paramType: 2001;
             readonly invert: false;
         }];
+        readonly readReflectsWrite: (ctx: CommandContext) => boolean;
         readonly description: string;
         readonly observation: {
             readonly event: "cameraEnabledChanged";
@@ -512,10 +516,10 @@ export declare const CAMERA_MEMBERS: {
         readonly type: "bool";
         readonly kind: "boolean";
         readonly provenance: "verified";
-        readonly readAvailable: (ctx: import("./types.js").AvailabilityContext) => boolean;
+        readonly readAvailable: (ctx: AvailabilityContext) => boolean;
         readonly readAliases: readonly [{
             readonly paramType: 1716;
-            readonly available: (ctx: import("./types.js").AvailabilityContext) => boolean;
+            readonly available: (ctx: AvailabilityContext) => boolean;
         }];
         readonly requiresRead: true;
         readonly description: "Camera status LED. Video doorbells report the same state under their button-ring LED parameter.";
@@ -526,7 +530,7 @@ export declare const CAMERA_MEMBERS: {
      * value, and it exists only on a device bound to a provider. Each is declared once, with its
      * signature taken FROM {@link MediaProvider} — so a change there is a compile error here, not a drift.
      *
-     * Every pull is refused where {@link CAMERA_MEMBERS.enabled} reads false, with {@link CameraDisabledError} —
+     * Every pull is refused where a reliable {@link CAMERA_MEMBERS.enabled} reads false, with {@link CameraDisabledError} —
      * `live`, `snapshotLive`, `record`, `openReadable` and `recordFragments` alike, since each opens media on a
      * camera that serves none. That reading is the on/off source; a live probe is not one, since a disabled
      * camera answers a start with audio and never a video frame.
@@ -552,6 +556,7 @@ export declare const CAMERA_MEMBERS: {
     } | undefined) => Promise<Buffer<ArrayBufferLike>>>;
     readonly openReadable: import("./members.js").ProvidedMember<"media", ((opts?: Parameters<NonNullable<MediaProvider["openReadable"]>>[0]) => Promise<import("node:stream").Readable>) | undefined>;
     readonly recordFragments: import("./members.js").ProvidedMember<"media", ((opts?: Parameters<NonNullable<MediaProvider["recordFragments"]>>[0]) => import("../../core/contracts.js").FragmentRecordingHandle) | undefined>;
+    readonly downloadRecording: import("./members.js").ProvidedMember<"media", ((opts: Parameters<NonNullable<MediaProvider["downloadRecording"]>>[0]) => Promise<import("../../core/contracts.js").RecordingDownload>) | undefined>;
     /**
      * Push audio from the host to this camera's speaker. Gated on the **speaker** param specifically —
      * not the `audio` capability, which resolves on a microphone alone and would advertise a speaker the

package/dist/model/capabilities/doorbell.d.ts

@@ -164,7 +164,7 @@ export declare function parseQuickResponses(voiceList: Array<{
 }>): QuickResponse[];
 /**
  * `doorbell` — chime / ringtone configuration. CONFIRMED against a real Video Doorbell (T8214):
- * the live ids are the `1702-1719` `CMD_BAT_DOORBELL_*` range (provenance "mega", observed). The
+ * the live ids are the `1702-1719` `CMD_BAT_DOORBELL_*` range, observed on that device. The
  * legacy `2015/2022/1306` ids are excluded — they appear on NO owned device. The button-
  * press *event* (ring) is delivered out-of-band via `CMD_DOORBELL_NOTIFY_PAYLOAD` (1701) /
  * push/MQTT — it is handled by the Phase-1 event normalizers, not as a device-list param.
@@ -185,9 +185,9 @@ export declare function parseQuickResponses(voiceList: Array<{
 export declare const DOORBELL_MEMBERS: {
     /**
      * The HOMEBASE as the doorbell's chime — the hub plays the ring, not the wired chime box
-     * `mechanicalChimeSwitch` drives. `provenance` is "verified" on our own decrypt of the app's frame,
-     * not merely the param id observed live: direct-binary `[ch][value][acct]`, 1=on/0=off, the same shape
-     * as its 1703 sibling — captured, not inferred from the shared param range.
+     * `mechanicalChimeSwitch` drives. `provenance` is "verified" on our own decrypt of the app's frame:
+     * direct-binary `[ch][value][acct]`, 1=on/0=off, the same shape as its 1703 sibling — captured, not
+     * inferred from the shared param range.
      */
     readonly chimeSwitch: {
         readonly param: 1702;
@@ -198,9 +198,8 @@ export declare const DOORBELL_MEMBERS: {
         readonly write: (v: string | number | boolean, ctx: import("./types.js").CommandContext) => import("../../core/contracts.js").Command;
     };
     /**
-     * `provenance` is "verified" not "mega": the actual write wire is confirmed (
-     * our own P2P decrypt), not merely the param id observed on a live device. Direct-binary
-     * `[ch][value][acct]`, 1=on/0=off — verified live on a T8214 (ON then OFF).
+     * `provenance` is "verified" on our own P2P decrypt of the write wire: direct-binary
+     * `[ch][value][acct]`, 1=on/0=off, verified live on a T8214 (ON then OFF).
      */
     readonly mechanicalChimeSwitch: {
         readonly param: 1703;
@@ -231,7 +230,7 @@ export declare const DOORBELL_MEMBERS: {
         readonly type: "number";
         readonly unit: "%";
         readonly kind: "percent";
-        readonly provenance: "mega";
+        readonly provenance: "verified";
         readonly writtenElsewhere: true;
         readonly description: string;
     };
@@ -325,7 +324,7 @@ export declare const DOORBELL_MEMBERS: {
         readonly param: 1710;
         readonly type: "string";
         readonly kind: "text";
-        readonly provenance: "mega";
+        readonly provenance: "verified";
         readonly description: string;
     };
     /**

package/dist/model/capabilities/index.d.ts

@@ -19,7 +19,7 @@ export { SirenVolume, type SirenVolumeValue, SirenAlarmDuration, type SirenAlarm
  */
 export { unobservableMembers, unreflectedMembers } from "./members.js";
 export { Watermark, type WatermarkValue, NightVision, type NightVisionValue, RecordingQuality, type RecordingQualityName, RECORDING_QUALITY_TIERS, StreamingQuality, type StreamingQualityName, STREAMING_QUALITY_TIERS, resolveStreamingQuality, resolveStreamingQualityTier, resolveRecordingQuality, resolveRecordingQualityValue, resolveRecordingQualityTier, } from "./camera.js";
-export { WorkingMode, PowerSource, resolveWorkingMode, resolveWorkingModeValue, WORKING_MODE_MAPS, type WorkingModeName, type PowerSourceName, } from "./battery.js";
+export { WorkingMode, PowerSource, resolveWorkingMode, resolveWorkingModeValue, cameraPowerTier, WORKING_MODE_MAPS, type WorkingModeName, type PowerSourceName, } from "./battery.js";
 export { type DpCatalog, EMPTY_DP_CATALOG } from "./dp-catalog.js";
 import type { PtzActions } from "./ptz.js";
 import type { LightActions } from "./light.js";

package/dist/model/capabilities/manifest.d.ts

@@ -61,8 +61,14 @@ export interface ActionDescriptor extends ActionSpec {
 /** What one capability exposes on a device — the join of its bound object and its own declaration. */
 export interface CapabilityDescriptor {
     capability: Capability;
-    /** The fluent accessor this capability is reached under: `dev[accessor]()`. */
-    accessor: string;
+    /**
+     * The fluent accessor this capability is reached under: `dev[accessor]()`.
+     *
+     * Absent for a capability with nothing to bind — one whose whole surface is inbound events, so it
+     * declares no members and no `actions()` and therefore has no object to reach. Such a capability is
+     * described for its {@link events} alone; every other field is empty.
+     */
+    accessor?: string;
     /** The reads INSTALLED on this device, never the theoretical set. */
     reads: readonly ReadDescriptor[];
     /** The installed actions that carry a description. */
@@ -102,6 +108,16 @@ export interface DeviceManifest {
  * Parameterised over the module list; the barrel binds it to the real one. A capability the device did
  * not bind — because it does not have it, or because nothing is bound yet — contributes no descriptor
  * at all.
+ *
+ * With ONE exception, and it is not a bound object: a capability whose whole surface is inbound events
+ * declares no members and no `actions()`, so `buildActions` builds nothing for it and there is no
+ * object here to walk. Its events are still device truth, and the resolved set in {@link
+ * AvailabilityContext.capabilities} is what says this device has it — so it is described from its own
+ * declaration, with no {@link CapabilityDescriptor.accessor} and every other field empty, and only on
+ * a device with at least one bound object.
+ *
+ * Claims resolve against an empty read set there, which is the truthful evidence — a module that binds
+ * nothing installs no getter, so a `reads` claim cannot hold. A topology claim still applies.
  * @internal
  */
 export declare function describeBound(modules: readonly CapabilityModule[], bound: Readonly<Record<string, unknown>>, ctx?: AvailabilityContext): CapabilityDescriptor[];

package/dist/model/capabilities/members.d.ts

@@ -48,6 +48,8 @@ export interface ValueMember {
     enumValuesFor?: (ctx: AvailabilityContext) => Record<number, string> | undefined;
     provenance?: PropertySpec["provenance"];
     invert?: boolean;
+    /** Per-device read polarity; undefined retains the static default. */
+    invertFor?: (ctx: AvailabilityContext) => boolean | undefined;
     description: string;
     /** The wire, or absent for read-only. `undefined` from it = this value is not one we accept. */
     write?: (value: boolean | number | string, ctx: CommandContext) => Command | undefined;

package/dist/model/capabilities/motion.d.ts

@@ -98,7 +98,6 @@ export declare const MOTION_CMD: {
      * payload key AND pass mChannel 0 explicitly; the two are separate choices, not linked.)
      *
      * ⚠️ Replay + readback confirmed on a HomeBase-attached T8425 (1719 `0`→`1`→`0`), NOT byte-captured.
-     * Provenance is `apk`, not `verified`: a divergent-but-also-accepted frame can't be ruled out.
      */
     readonly HUMAN_ONLY_AT_NIGHT: 1719;
     /**
@@ -112,7 +111,7 @@ export declare const MOTION_CMD: {
      * form, so a feature that is on reads as off.
      * Decoded by {@link decodeRadarWdSwitch} to match the app.
      *
-     * ⚠️ Replay + readback confirmed on a T8214 (2706 `0`→`1`→`0`), NOT byte-captured. Provenance `apk`.
+     * ⚠️ Replay + readback confirmed on a T8214 (2706 `0`→`1`→`0`), NOT byte-captured.
      */
     readonly LOITERING_DETECTION: 2706;
     /**
@@ -354,7 +353,7 @@ export declare const MOTION_MEMBERS: {
         readonly param: 1719;
         readonly type: "bool";
         readonly kind: "boolean";
-        readonly provenance: "apk";
+        readonly provenance: "verified";
         readonly description: string;
         readonly requires: readonly [1719];
         readonly write: (v: string | number | boolean, ctx: CommandContext) => Command;
@@ -367,7 +366,7 @@ export declare const MOTION_MEMBERS: {
         readonly param: 2706;
         readonly type: "bool";
         readonly kind: "boolean";
-        readonly provenance: "apk";
+        readonly provenance: "verified";
         readonly coerce: (raw: string | number | boolean) => boolean;
         readonly description: string;
         readonly requires: readonly [2706];

package/dist/model/capabilities/siren.d.ts

@@ -27,7 +27,7 @@ export declare const SIREN_CMD: {
     readonly ALARM_TEST: 1826;
     /** Manually stop a sounding alarm (app `APP_CMD_SIREN_SENSOR_MANUAL_STOP_ALARM`). */
     readonly MANUAL_STOP: 1871;
-    /** Station-family HomeBase duration alarm, verified live on T8010 (app `SET_TONE_FILE`). */
+    /** Station-family HomeBase duration alarm, verified live on T8010 and T8030 (app `SET_TONE_FILE`). */
     readonly HOMEBASE_TONE: 1201;
     /** HomeBase alarm volume percentage (app `CMD_SET_HUB_SPK_VOLUME`). */
     readonly HUB_SPK_VOLUME: 1235;

package/dist/model/capabilities/types.d.ts

@@ -245,6 +245,8 @@ export interface AvailabilityContext {
      * cannot do what its name promises there.
      */
     homeBaseAttached?: boolean;
+    /** Serial of the covering station, when the device record names one. */
+    stationSerial?: string;
 }
 export interface CommandContext extends AvailabilityContext {
     /** Device channel (0 for standalone, `device_channel` on a HomeBase). */

package/dist/model/param-dictionary.d.ts

@@ -5,10 +5,10 @@
  * Two namespaces (params are per-transport, NOT globally unique):
  *  - SECURITY_PARAMS — eufy P2P param space (ids 1000+). **Membership is the observation**: an id is
  *    listed only because the sweep saw it on a real owned device, so the id is real/accepted.
- *    `provenance` is the trust of the NAME/meaning: "verified" (our captures) > "apk" (the app's own
- *    decompiled constant name) > "guessed" (no name source — needs toggle-diff).
+ *    `provenance` is the trust of the NAME/meaning; the tiers are defined on `PropertySource` in
+ *    `types.ts`.
  *  - CLEAN_PARAMS — RoboVac Tuya DP space (ids 1 and above), names from the cloud
- *    `get_product_data_point` data_point_list (provenance "mega" — authoritative).
+ *    `get_product_data_point` data_point_list, hence provenance `mega`.
  *
  * Which models reported an id, and the capture that named it, are in the commit that adds the entry.
  */

package/dist/model/types.d.ts

@@ -104,18 +104,17 @@ export type ValueKind = KnownValueKind | (string & {});
  */
 export declare function isKnownValueKind(kind: ValueKind): kind is KnownValueKind;
 /**
- * Trust provenance of a property's `param_type` mapping, most-trusted first:
- *  - `mega`     — confirmed against the live mega API / a real device's reported params.
- *  - `apk`      — extracted from the v6 app itself (the ids the app actually sends — authoritative).
- *  - `verified` — confirmed by our own capture/observation.
- *  - `guessed`  — a plausible placeholder; lowest trust.
+ * How much a param's name and meaning can be trusted, most-trusted first. This is the one definition;
+ * the param dictionary and every `provenance` field use it.
+ *  - `mega`     — the vendor's cloud names it: its data-point catalog (`get_product_data_point`), or a
+ *                 reported value that matches what the cloud record already says (a model name or code).
+ *  - `verified` — confirmed on a real device by this project: our own capture or observation, or
+ *                 identified by someone who has the hardware.
+ *  - `apk`      — the v6 app's own decompiled constant name, not yet confirmed on a device.
+ *  - `guessed`  — no name source; a plausible placeholder until a toggle-diff settles it.
  *
- * This project never relies on a third-party reverse-engineering project as a source of trust —
- * every id/behavior we ship is grounded in the app's
- * own decompiled code (`apk`) or our own capture/observation (`verified`), never someone else's
- * unverified guess. Absent provenance is treated as `guessed`.
- *
- * Provenance of a property definition — an internal trust label used when curating the model.
+ * A third-party reverse-engineering project is never a source: every name we ship comes from the
+ * vendor's cloud, our own observation or the app itself. Absent provenance is treated as `guessed`.
  * @internal
  */
 export type PropertySource = "mega" | "apk" | "verified" | "guessed";

package/dist/transport/http/passport.d.ts

@@ -0,0 +1,21 @@
+/**
+ * The `algo_ecdh` passport steps the eufy and Solix clients share byte for byte. Hosts, header sets, key
+ * caching, 2FA delivery and the `gtoken` id differ per app line and stay in each client.
+ */
+import { type SessionEntry } from "../../core/index.js";
+/** The credential fields every `/passport/login` body starts with; each client adds its own challenge fields. */
+export declare function loginCredentials(email: string, password: string, country: string): Record<string, unknown>;
+/**
+ * Read a decrypted `/passport/login` reply; `undefined` when it carries no id or no token. `twoFactorPending`
+ * is true while `fa_info.info` is non-empty and false once 2FA is satisfied.
+ */
+export declare function readLoginReply(data: Record<string, unknown>): {
+    userId: string;
+    accountUserId: string | undefined;
+    authToken: string;
+    geoKey: string | undefined;
+    tokenExpiresAt: number;
+    twoFactorPending: boolean;
+} | undefined;
+/** The headers that mark `encBody` as `algo_ecdh`-encrypted under `entry` and sign it. */
+export declare function signedHeaders(entry: SessionEntry, encBody: string): Record<string, string>;

package/dist/transport/http/solix-client.d.ts

@@ -3,12 +3,11 @@
  * eufy client uses.
  *
  * Why this is separate from the eufy device client: Solix shares Anker's `algo_ecdh` passport (so
- * {@link prepareKeyExchange} / {@link encryptLoginPassword} / {@link signRequest} are reused verbatim
- * for the login handshake) but exposes a different device backend — its own `app-name`, host, and
- * bootstrap key (`SOLIX_APP_NAME`, `SOLIX_DEFAULT_API_HOST`, {@link SOLIX_LOCAL_KEY_HEX}) —
- * and its authenticated resource reads are PLAIN JSON, carrying only the auth token and a
- * `gtoken = md5(user_id)`, with no per-request encryption or signature. This client therefore does
- * the encrypted passport handshake to obtain a token, then makes plain authenticated reads.
+ * {@link prepareKeyExchange} and the steps in `./passport.ts` are shared with it) but exposes a different device
+ * backend — its own `app-name`, host, and bootstrap key (`SOLIX_APP_NAME`, `SOLIX_DEFAULT_API_HOST`,
+ * {@link SOLIX_LOCAL_KEY_HEX}) — and its authenticated resource reads are PLAIN JSON, carrying only the auth token
+ * and a `gtoken = md5(user_id)`, with no per-request encryption or signature. This client therefore does the
+ * encrypted passport handshake to obtain a token, then makes plain authenticated reads.
  *
  * This is the wire client (transport layer): it returns the vendor's typed JSON as received. Building
  * those records into capability-driven `SolixDevice` models is the model layer's job — see

package/dist/transport/p2p/codec.d.ts

@@ -22,6 +22,11 @@ export declare const ResponseMessageType: {
     readonly LOOKUP_ADDR: Buffer<ArrayBuffer>;
     readonly LOOKUP_ADDR2: Buffer<ArrayBuffer>;
     readonly CAM_ID: Buffer<ArrayBuffer>;
+    /**
+     * The device's own address record, sent in answer to CHECK_CAM ahead of CAM_ID: its 20-byte device id, one
+     * record in `encodeSelfAddress`'s shape naming the address it answers from, then 8 zero bytes (44-byte payload).
+     */
+    readonly CAM_ADDR: Buffer<ArrayBuffer>;
     readonly TURN_SERVER_CAM_ID: Buffer<ArrayBuffer>;
     readonly PING: Buffer<ArrayBuffer>;
     readonly PONG: Buffer<ArrayBuffer>;
@@ -149,6 +154,14 @@ export declare function buildStringCommandPayload(value: string, channel?: numbe
  * length prefix ({@link stringWithLength}).
  */
 export declare function buildIntStringCommandPayload(value: number, valueSub: number, strValue: string, channel?: number, key?: Buffer, encType?: number): Buffer;
+/**
+ * Build a **string-pair** command body: five zero bytes, then `strValue` and `strValueSub`, each in the
+ * 128-byte-chunk length form ({@link stringWithLength}), AES-128-ECB encrypted (level-1) like
+ * {@link buildStringCommandPayload} when `key` is given. `CMD_DOWNLOAD_VIDEO` (1024) takes this shape on a
+ * HomeBase 2: `strValue` = the recording's path on the station, `strValueSub` = the station admin
+ * `account_id`, on the camera's channel.
+ */
+export declare function buildStringPairCommandPayload(strValue: string, strValueSub: string, channel?: number, key?: Buffer, encType?: number): Buffer;
 /**
  * Build a command body around an ALREADY-encrypted (or plaintext) `data` buffer with an explicit
  * `signCode` — used for level-2 (`signCode 8`, AES-256-GCM) commands like the media-start 1350 the

package/dist/transport/p2p/command-router.d.ts

@@ -121,6 +121,8 @@ export declare class P2PCommandRouter {
     private readonly talkbacks;
     /** cipher_id → ECC private key (one eufylife get_ciphers call per cipher), shared across (re)opens. */
     private readonly cipherKeyCache;
+    /** The recording download in flight per station; a station serves one at a time. */
+    private readonly recordingDownloads;
     constructor(deps: P2PRouterDeps);
     /** Forward one P2P failure once even when both the session listener and startup waiter observe it. */
     private reportError;
@@ -237,6 +239,12 @@ export declare class P2PCommandRouter {
      * while its own session is still serving.
      */
     private makeSession;
+    /**
+     * The ECC private key of `cipherId`, from the router's cache or one `get_ciphers` call. When the cloud
+     * answers with another cipher, that one is used and traced on `session`. Only a successful lookup is
+     * cached.
+     */
+    private cipherKeyFor;
     /**
      * Open (or reuse) a station's P2P session and await its completed handshake. An optional abort only
      * stops this wait; session ownership remains with {@link SessionManager} and its normal teardown.
@@ -269,6 +277,27 @@ export declare class P2PCommandRouter {
      * start has no level-1 form for.
      */
     mediaProviderFor(sn: string): MediaProvider;
+    /**
+     * Whether `sn` is a camera attached to a HomeBase 2 (T8010), the one station whose recording path layout
+     * and frame formats are confirmed.
+     */
+    private downloadsRecordings;
+    /**
+     * Download one recording a HomeBase 2 holds for an attached camera, then decode it
+     * ({@link decodeRecording}). Downloads queue per station: the station streams one recording at a time
+     * on the camera's channel, so a download starts only once the previous one has drained
+     * ({@link RecordingTransfer.drained}), even when that one's caller already has its answer. An abort
+     * while waiting rejects without sending anything; an abort mid-transfer rejects at once and the station's
+     * turn is held until the transfer drains.
+     */
+    private downloadRecording;
+    /** Resolve once `previous` settles, or reject as soon as `signal` aborts. */
+    private waitTurn;
+    /**
+     * Start one recording download, once the station's previous download has drained: the decoded recording,
+     * and when the station is done sending it.
+     */
+    private startRecordingDownload;
     /**
      * Open a {@link Talkback} on a device's camera channel.
      *
@@ -461,9 +490,9 @@ export declare class P2PCommandRouter {
      *
      * Reached two ways, both idempotent: the session's own `close` event, when it died while still the
      * station's registered session, and {@link SessionManagerOpts.onAutoClose}, when the manager closed it
-     * unasked. A close a CALLER made is deliberately not routed here — {@link closeAll} disposes its own
-     * sources first, and {@link replaceUnreachableSession} keeps its source alive on purpose to rewarm it
-     * on the replacement session.
+     * unasked. A close a CALLER made is deliberately not routed here — {@link closeAll} and
+     * {@link resolveSession} dispose their own sources first, while {@link replaceUnreachableSession} keeps
+     * its source alive on purpose to rewarm it on the replacement session.
      */
     private tearDownStation;
     /**
@@ -621,9 +650,10 @@ export declare class P2PCommandRouter {
      *
      * A session whose {@link P2PSession.pathAnswering} is false is closed and re-resolved before it is handed
      * over: the station answers every heartbeat, so a path silent past several of them is gone. A session
-     * reporting nothing about its path is not reporting that evidence and is handed over as it is. Replaced at
-     * most once per resolution, so a station whose replacement is silent too is returned rather than closed
-     * again.
+     * reporting nothing about its path is not reporting that evidence and is handed over as it is. Cached live
+     * sources on the replaced session are discarded before closing it (see {@link tearDownStation}).
+     * Replaced at most once per resolution, so a station whose replacement is silent too is returned rather
+     * than closed again.
      */
     private resolveSession;
     /**

package/dist/transport/p2p/live-trace.d.ts

@@ -71,11 +71,16 @@ export type LiveTrace =
  * an address to ask. A connect that had one channel failed for that channel's reason alone, and a connect
  * that had neither could not have succeeded — outcomes a station that is switched off is otherwise
  * indistinguishable from, because nothing else in a failed connect states what was even attempted.
+ *
+ * `cloudMissing` names the input the cloud channel lacked, present exactly when `cloud` is false: `dsk-key`
+ * where no key was held for the station, `cloud-addresses` where its record named no address to ask. The key
+ * is named where both are absent.
  */
  | {
     phase: "lookup-channels";
     local: boolean;
     cloud: boolean;
+    cloudMissing?: "dsk-key" | "cloud-addresses";
 }
 /**
  * Work on a station is holding for its session to connect, with the milliseconds it will wait.

package/dist/transport/p2p/p2p-session.d.ts

@@ -123,8 +123,8 @@ export declare class P2PSession extends EventEmitter {
     private audioStalled;
     private audioRetransmitTimer?;
     private lastPongData?;
-    /** When this connection last received a PONG — `undefined` until the first, see {@link pathSilentMs}. */
-    private lastPongAt?;
+    /** When the selected peer last answered outbound P2P traffic on this connection. */
+    private lastPeerAt?;
     /** Whether the silence has already been stated, so it is traced once per connection rather than per read. */
     private pathStaleTraced;
     private lookupTimer?;
@@ -187,15 +187,15 @@ export declare class P2PSession extends EventEmitter {
     /**
      * How long this connection's path has been silent, or nothing where it has never answered.
      *
-     * A PONG is the station stating that the path is alive. `undefined` is neither alive nor dead: it is a station
-     * that has said nothing either way.
+     * PONG and ACK from the selected peer prove the path answers outbound traffic. `undefined` means no such reply
+     * has arrived since connection, so silence alone does not establish a stale path.
      */
     get pathSilentMs(): number | undefined;
     /**
      * Whether this path can still be committed to, on the evidence the heartbeat gives.
      *
-     * False where a pong arrived and then stopped for {@link PATH_SILENCE_MS}. A station that has never ponged is
-     * not known to be dead, so it answers true.
+     * False where selected-peer replies arrived and then stopped for {@link PATH_SILENCE_MS}. A connection with
+     * no post-connect reply is not known to be dead, so it answers true.
      *
      * Traces the silence once per connection, on the read that first observes it.
      */
@@ -326,6 +326,9 @@ export declare class P2PSession extends EventEmitter {
      * straddling a level-2 wait on a camera whose failure to deliver video had a separate cause, and did not
      * recur across later probes of it. Correlate an unmodelled type against a WORKING session before reading it
      * as a cause.
+     *
+     * CAM_ADDR is recognised and dropped: it names the address the device is already answering from, and the
+     * CAM_ID that follows it is what completes the connect.
      */
     private onMessage;
     private beginCheckCam;
@@ -410,6 +413,8 @@ export declare class P2PSession extends EventEmitter {
      * `strValue` (admin `account_id`). See {@link buildIntStringCommandPayload}. Fire-and-forget.
      */
     sendIntStringCommand(commandType: number, value: number, valueSub: number, strValue: string, channel?: number): void;
+    /** Send a level-1 {@link buildStringPairCommandPayload} command on `channel`. */
+    sendStringPairCommand(commandType: number, strValue: string, strValueSub: string, channel: number): void;
     /**
      * Send a **level-2 (AES-256-GCM, signCode 8) control payload** to a HomeBase-attached device. The
      * target camera is selected by `channel` (= device_channel) + the `mChannel` envelope — the same
@@ -430,8 +435,17 @@ export declare class P2PSession extends EventEmitter {
      * "direct" commands (e.g. CAMERA_SWITCH 1035) carry a binary struct, not JSON.
      */
     sendRawLevel2Bytes(payload: Buffer, channel: number, outerCmd?: number, signCode?: number): boolean;
-    /** Stop the realtime media stream (`CMD_STOP_REALTIME_MEDIA`, 1004) on a camera `channel`. */
-    stopLiveMedia(channel?: number, accountId?: string): void;
+    /**
+     * Stop the realtime media stream (`CMD_STOP_REALTIME_MEDIA`, 1004) on a camera `channel`, in the shape
+     * its runtime topology takes, as {@link startLiveMedia} selects its start:
+     *  - `homeBaseAttached`: `CMD_SET_PAYLOAD` (1350) wrapping `{cmd:1004, mChannel:channel}` at level-2.
+     *  - own-session at level-2: the direct 1004 frame whose entire plaintext is the camera channel as a
+     *    `uint32`, the same 4-byte body as the attached talkback frames. The app sends this frame on closing
+     *    an own-session camera's live view; the camera stops streaming on it within a second, and keeps
+     *    streaming through the 1350-wrapped form.
+     *  - without a level-2 key: the bare 1004 command.
+     */
+    stopLiveMedia(channel?: number, accountId?: string, homeBaseAttached?: boolean): void;
     /**
      * Open the device's talkback (host→device audio) path on a camera `channel`, after which
      * {@link sendAudioFrame} is accepted until {@link stopTalkback}. Two protocols, selected by runtime
@@ -510,11 +524,6 @@ export declare class P2PSession extends EventEmitter {
      * camera is selected by `mChannel` (= the device's `device_channel`) AND the frame-header channel.
      */
     private sendMediaPayloadLevel2;
-    /**
-     * Encrypt a level-2 command body (signCode 8): `tag(16) ‖ nonce(12) ‖ [seq,03,02,01](4) ‖
-     * ciphertext`, AES-256-GCM under the negotiated session key, AAD "eufy security". Inverse of
-     * `decryptLevel2`. The 4-byte sub-header is cleartext (skipped on decrypt); `seq` is a counter.
-     */
     /**
      * Decode a `CMD_VIDEO_FRAME` (1300) payload into clean Annex-B H.264 (the 22-byte frame header
      * stripped). Reversed from the V6 app + live H.264 captures: the 22-byte header is
@@ -538,6 +547,11 @@ export declare class P2PSession extends EventEmitter {
      * key. Lazily generates a keypair; `rsaPrivateKey` decrypts the media key the station returns.
      */
     private rsaModulus;
+    /**
+     * Encrypt a level-2 command body (signCode 8): `tag(16) ‖ nonce(12) ‖ seq(4) ‖ ciphertext`,
+     * AES-256-GCM under the negotiated session key, AAD "eufy security". Inverse of `decryptLevel2`.
+     * The 4-byte sub-header is cleartext (skipped on decrypt); `seq` counts up from {@link LEVEL2_SEQ_BASE}.
+     */
     private encryptLevel2;
     /** Send a no-arg command frame (e.g. CMD_GATEWAYINFO) on a channel (default: the station channel). */
     private sendCommand;
@@ -561,6 +575,10 @@ export declare class P2PSession extends EventEmitter {
      * The HomeBase streams back `CMD_DATABASE` (1306) frames `{cmd:10000,count,data:[…]}`,
      * level-1-encrypted — decoded and emitted as `dbChunk` (decrypted text) per frame.
      * Tables: `familiar_faces`, `person_basic_info`, `event_person_list`, `history_record_info`.
+     *
+     * Throws while a {@link readDatabase} is accumulating: every table answers `{data:[…]}` and the
+     * frames tie no chunk to its request, so a second query's reply would be assembled into the first
+     * one's buffer and answered as its rows.
      */
     queryDatabase(table: string, opts?: {
         accountId?: string;
@@ -588,6 +606,25 @@ export declare class P2PSession extends EventEmitter {
         accountId?: string;
         channel?: number;
     }): void;
+    /**
+     * Query one on-station table and answer its rows, once the reply is whole.
+     *
+     * The request half of {@link queryDatabase} with its reply assembled: `CMD_DATABASE` arrives as
+     * several frames whose decrypted text is a fragment of one document, so the fragments are
+     * accumulated here and scanned after each one. Answers that document's `data` rows. Rejects when
+     * `signal` aborts, and when `timeoutMs` (default {@link DB_TABLE_TIMEOUT_MS}) elapses with no
+     * complete reply.
+     *
+     * One read at a time per session: while one is accumulating, every {@link queryDatabase} on the
+     * session throws, so a second reply cannot land in this buffer.
+     */
+    readDatabase(table: string, opts?: {
+        accountId?: string;
+        timeoutMs?: number;
+        signal?: AbortSignal;
+    }): Promise<unknown[]>;
+    /** Whether a {@link readDatabase} is accumulating; see {@link queryDatabase} for what it bars. */
+    private dbReadInFlight;
     /**
      * Request the **face feature rows** over P2P (`face_feature_info`, inner `cmd 10000`). Each row
      * carries `{person_id, face_name, face_id, face_picture_content, face_feature_file_path}` — where
@@ -640,7 +677,7 @@ export declare class P2PSession extends EventEmitter {
      * if the missing one arrives. A logical frame's payload spans datagrams that carry no header of their
      * own, so reassembling around a hole is impossible; waiting for it is what keeps the frame whole.
      *
-     * Only once {@link REORDER_WAIT_MS} passes, or {@link REORDER_MAX_DATAGRAMS} pile up, is the datagram
+     * Only once the data type's reorder wait passes, or {@link REORDER_MAX_DATAGRAMS} pile up, is the datagram
      * treated as lost: a pending frame is discarded and delivery resumes from the earliest held datagram.
      */
     private onData;