@mega-yfue/eufy-sdk 0.5.0-beta.3 → 0.5.0-beta.30

package/dist/model/capabilities/arming.d.ts

@@ -79,7 +79,8 @@ export declare const ARMING_CMD: {
      */
     readonly SET_ARMING: 1224;
     /**
-     * The per-mode alarm/arm-delay configuration write. ✅ WIRE CAPTURED live on a T8030 (
+     * One guard mode's per-device action table (app `CMD_SET_ALL_ACTION`), which carries the alarm delays
+     * and each device's actions in that mode. ✅ WIRE CAPTURED live on a T8030 (
      * 2026-07-23, both directions): a **bare
      * JSON frame, no `1350`/`1700` envelope** — outer P2P cmd IS `1255` itself, station channel 255,
      * plaintext `{account_id, count_down_alarm:{channel_list,delay_time},
@@ -96,15 +97,23 @@ export declare const ARMING_CMD: {
      * corresponding GET command (`1310`/inner cmd `40003`, sent by the app right before editing) always
      * replied `{count:0,data:null}` in every capture — genuinely empty, not a decrypt failure (confirmed
      * via the same bidirectional decrypt this finding used) — so the app does NOT read the current
-     * config this way; how it does is still unknown. Without a working GET, safely PATCHING just one
-     * channel in or out of an existing list isn't possible without risking clobbering the rest — so
+     * config this way; a T8010 reports it on its own params instead, see below. Without a working GET,
+     * safely PATCHING just one channel in or out of an existing list isn't possible without risking
+     * clobbering the rest — so
      * this ships as a caller-supplies-everything write instead of guessing a merge.
      * `devices`/`siren_sensor_action` are even less understood (raw per-device action codes, meaning
      * unconfirmed) and MUST come from a value independently read/captured for the target mode —
      * see `AlarmDelayConfig`'s field docs.
+     *
+     * ✅ On a T8010 the app writes the same command for the Device Control screen: header channel 0, the
+     * whole table of the mode `{mode_id, devices, count_down_alarm, count_down_arm}`, acked by an all-zero
+     * 1255 reply. The T8010 reports each table on its own params, Home on 1157 and Away on 1158, and the
+     * reported table follows a write within 15 s. See {@link DEVICE_NOTIFY_FLAG}.
      */
-    readonly ALARM_DELAY_CONFIG: 1255;
+    readonly SET_ALL_ACTION: 1255;
 };
+/** The guard modes whose device notification is read and written: both replayed on a T8010. */
+export type DeviceNotificationMode = Extract<AlarmDelayMode, "home" | "away">;
 /**
  * Alarm-delay durations the app's OWN picker UI offers — `AlarmDelaySeconds` is both the const
  * value-object (`AlarmDelaySeconds.sec45`) and the union type of its values, so callers pass the
@@ -225,6 +234,24 @@ export declare const ARMING_MEMBERS: {
      * would be the same unverified guess `setMode` refuses.
      */
     readonly setAlarmDelayConfig: import("./members.js").MethodMember<(mode: AlarmDelayMode, config: AlarmDelayConfig) => Promise<void>>;
+    /**
+     * Whether the device on `channel` sends a push notification in `mode`: its {@link DEVICE_NOTIFY_FLAG}
+     * in the action table the station reports for that mode. `undefined` where the station reports no table
+     * or the table does not list `channel`. A device's channel is `EufyDevice.channel`.
+     */
+    readonly deviceNotification: import("./members.js").MethodMember<(mode: DeviceNotificationMode, channel: number) => boolean | undefined> & {
+        available: (ctx: CommandContext) => boolean;
+    };
+    /**
+     * Turn the push notification of the device on `channel` on or off in `mode` (cmd
+     * {@link ARMING_CMD.SET_ALL_ACTION}): the station's reported table written back with that one flag
+     * changed. Rejects, sending nothing, where the table does not list `channel`. A write builds on the last
+     * one sent for that mode until the station reports a table observed 15 s after it, so a second write does
+     * not revert it; a write whose dispatch rejects is not built on.
+     */
+    readonly setDeviceNotification: import("./members.js").MethodMember<(mode: DeviceNotificationMode, channel: number, on: boolean) => Promise<void>> & {
+        available: (ctx: CommandContext) => boolean;
+    };
 };
 /**
  * `arming` — guard/arming mode. `armingMode` (see {@link ARMING_CMD.SET_ARMING}) has a verified read/write

package/dist/model/capabilities/camera.d.ts

@@ -8,6 +8,8 @@ import { type Command, type MediaProvider } from "../../core/contracts.js";
  * `transport/p2p/commands.ts`). Each entry notes its app `CommandType` name.
  */
 export declare const CAMERA_CMD: {
+    /** Camera-reported Wi-Fi signal (app `CMD_GET_WIFI_RSSI`). */
+    readonly WIFI_RSSI: 1142;
     /** Camera on/off. Read and write polarity depend on the family and topology. */
     readonly CAMERA_ENABLE: 1035;
     /** Wrapped T8410 power switch on HomeBase 3. */
@@ -271,6 +273,14 @@ export type CameraActions = Surface<typeof CAMERA_MEMBERS> & {
  * @internal
  */
 export declare const CAMERA_MEMBERS: {
+    /** Reads the latest cached report and exposes no setter. */
+    readonly wifiRssi: {
+        readonly param: 1142;
+        readonly type: "number";
+        readonly kind: "scalar";
+        readonly provenance: "apk";
+        readonly description: "Camera-reported Wi-Fi signal; physical units and a quality scale are unspecified.";
+    };
     /**
      * The default READ is the *disable*-bit convention (1035 "0" ⇒ ON, 2001 direct); the WRITE polarity is
      * family-dependent — see `powerValue` / `isEnableBitPolarity`. Battery/solo cams report the state under
@@ -435,25 +445,29 @@ export declare const CAMERA_MEMBERS: {
      * Live-view quality, the pair to {@link CAMERA_MEMBERS.recordingQuality} and a different setting on a
      * different wire: changing one leaves the other's parameter untouched.
      *
-     * The READ is 1020, which reports the resolved tier as a plain integer. 1020 is also the name the
-     * param dictionary already gives that id, and `Device` keys state by NAME — a member claiming 2730
-     * under this name would collide with it on a device reporting both.
+     * The READ is 1020, which reports the resolved tier as a plain integer, while the WRITE rides 2730's
+     * `1350` payload. They are two ids for one setting because 2730 carries a per-mode config and 1020
+     * carries the tier in force; the tier is what this property means. 1020 is also the name the param
+     * dictionary already gives that id, and `Device` keys state by NAME — a member claiming 2730 under
+     * this name would collide with it on a device reporting both.
      *
-     * `unverified: true` with no `write`: the app's 2730 frame is captured byte-exact, but replaying it
-     * from this SDK produced no observable change on a standalone T8171, where the recording sibling's
-     * 2731 write on the same envelope and the same session does land. The one difference the capture
-     * shows is that the app's frame carries no `mChannel`/`mValue3`, which this envelope always emits.
-     * Until a send is confirmed, the setter is absent — a control that silently does nothing is worse
-     * than none — and the read ships ahead of it, which verification per direction allows.
+     * `transaction` is part of the frame that was captured, so it is sent. The recording sibling's own
+     * confirmed frame carries no such field; neither is inferred from the other.
      */
     readonly streamingQuality: {
+        readonly accepts: StreamingQualityName;
         readonly param: 1020;
         readonly type: "number";
         readonly kind: "enum";
         readonly enumValues: Readonly<Record<number, string>>;
         readonly provenance: "verified";
-        readonly unverified: true;
+        readonly args: readonly [{
+            readonly name: "quality";
+            readonly kind: "enum";
+            readonly description: "A tier, or the name it maps to. 0 is Auto.";
+        }];
         readonly description: string;
+        readonly write: (v: string | number | boolean, ctx: CommandContext) => Command | undefined;
     };
     /**
      * `type` is how the value is STORED, and 2731 stores the whole config — the ACTIVE tier is lifted out

package/dist/model/capabilities/dp-catalog.d.ts

@@ -15,10 +15,11 @@
 /** The parsed DP capability catalog for one product SKU. */
 export interface DpCatalog {
     /**
-     * For enum-type DPs: the valid integer values as declared in the catalog.
-     * Absent for non-enum DPs (bool, raw, integer, string).
+     * For enum-type DPs: the range members exactly as the catalog lists them, as strings — value names
+     * (`"Quiet"`) or numeric strings (`"0"`), whichever the SKU's catalog uses. What a member means is
+     * the reading capability's to decide. Absent for non-enum DPs (bool, raw, integer, string).
      */
-    readonly enumRanges: ReadonlyMap<number, readonly number[]>;
+    readonly enumRanges: ReadonlyMap<number, readonly string[]>;
 }
 /** Returned whenever the API call fails or the response shape is not recognised. */
 export declare const EMPTY_DP_CATALOG: DpCatalog;

package/dist/model/capabilities/light.d.ts

@@ -160,6 +160,9 @@ export declare const LIGHT_MEMBERS: {
      * This is the switch a user changes and expects to STAY changed. {@link isOn} is a different fact:
      * the lamp being lit right now, driven by whichever
      * client is streaming — the vendor app lights it for a live view and drops it on quitting.
+     *
+     * The T8423 write takes the session-chosen level; level-1 int+string was verified live on a standalone
+     * unit.
      */
     readonly spotlightEnabled: {
         readonly param: 1403;

package/dist/model/capabilities/motion.d.ts

@@ -271,6 +271,10 @@ export declare const MOTION_MEMBERS: {
      * The raw sensitivity an indoor camera reports, on the one id whose write takes a `1700` control
      * payload carrying an index rather than the `1350` envelope its siblings use — a frame-shape
      * difference `sensitivityCommand` resolves from the scale. `unexposed` like its three siblings.
+     *
+     * Some devices report 6041 as a base64 JSON list of per-sensor entries
+     * (`{"list":[{"sensor_id":…,"sensitivity":…}]}`) rather than a scalar. That value is stored verbatim
+     * and this getter answers `undefined` for it: only the scalar form is confirmed to be this step.
      */
     readonly indoorSensitivity: {
         readonly param: 6041;
@@ -279,6 +283,7 @@ export declare const MOTION_MEMBERS: {
         readonly provenance: "verified";
         readonly unexposed: true;
         readonly description: "Raw sensitivity an indoor camera reports (verified: param 6041).";
+        readonly decode: (raw: unknown) => number | undefined;
     };
     /**
      * The raw sensitivity on the INVERTED seven-step camera scale — a HIGHER number is LESS sensitive, so

package/dist/model/capabilities/suction.d.ts

@@ -15,7 +15,7 @@ export declare const SUCTION_DP: {
  * Suction levels — the app's `SuctionEnum` (`getSuctionEnumByValue`). This is a **fixed** value→label
  * map with **no model argument**: a given int means the same thing on every RoboVac. What varies per
  * model is only **availability** — a device's `get_product_data_point` range may expose a narrower
- * subset (the T2351 catalog lists 0-3) — so the `suction` property stays a raw int rather than being
+ * subset (the T2351 catalog lists `Quiet`–`Max`) — so the `suction` property stays a raw int rather than being
  * constrained per device, and {@link suctionLevelName} names a reported level.
  *
  * `BoostIQ` (4) is a real suction level in this scale. The separate `boostIq`
@@ -45,11 +45,11 @@ export declare function suctionLevelName(value: number): string | undefined;
 export type SuctionActions = Surface<typeof SUCTION_MEMBERS> & {
     /**
      * The suction levels this device supports, sourced from the per-SKU `get_product_data_point` catalog
-     * range for DP 158. Narrower than the full six {@link SuctionLevel} values on many models — a T2351
-     * reports `[0, 1, 2, 3]`.
+     * range for DP 158. Narrower than the full six {@link SuctionLevel} values on many models — a T2351's
+     * catalog lists `Quiet`, `Standard`, `Turbo` and `Max`, which answers `[0, 1, 2, 3]`.
      *
-     * `undefined` when the catalog is absent or does not cover DP 158. Only meaningful on devices where
-     * `setSuctionLevel` is installed (AIoT vacuums).
+     * `undefined` when the catalog is absent, does not cover DP 158, or lists only members outside the
+     * known scale. Only meaningful on devices where `setSuctionLevel` is installed (AIoT vacuums).
      */
     readonly supportedLevels?: readonly SuctionLevelValue[];
 };

package/dist/model/capabilities/types.d.ts

@@ -247,6 +247,12 @@ export interface AvailabilityContext {
     homeBaseAttached?: boolean;
     /** Serial of the covering station, when the device record names one. */
     stationSerial?: string;
+    /**
+     * The vendor DeviceType of the station the device hangs off, when it is attached
+     * and the station's record states one. Answers which station family a command addressed to an
+     * attached device is carried through.
+     */
+    stationDeviceType?: number;
 }
 export interface CommandContext extends AvailabilityContext {
     /** Device channel (0 for standalone, `device_channel` on a HomeBase). */

package/dist/model/capabilities/vacuum-clean.d.ts

@@ -169,12 +169,11 @@ export declare const TUYA_CLEAN_TYPES: readonly ["Sweep", "SweepMop", "Mop"];
 /** @internal */
 export type TuyaCleanType = (typeof TUYA_CLEAN_TYPES)[number];
 /**
- * `ModeCtrlRequest.method` values for DP 152. Live-verified on T2351: START_AUTO_CLEAN → 0
- * (omitted from the wire when zero), START_GOHOME → 6, PAUSE_TASK → 13.
+ * `ModeCtrlRequest.method` values for DP 152. Live-verified on T2351: START_GOHOME → 6,
+ * PAUSE_TASK → 13. An auto clean is `START_AUTO_CLEAN` (0) with a payload — see
+ * {@link ModeCtrlParamMethod}.
  */
 export declare const ModeCtrlMethod: {
-    /** Live-verified on a T2351. Zero, so it is omitted from the wire per the proto3 default rule. */
-    readonly START_AUTO_CLEAN: 0;
     /** Live-verified on a T2351. */
     readonly START_GOHOME: 6;
     /** Live-verified on a T2351. */
@@ -202,9 +201,11 @@ export declare const ModeCtrlMethod: {
  * its argument in the signature: {@link VACUUM_CLEAN_MEMBERS.startScene},
  * {@link VACUUM_CLEAN_MEMBERS.cleanRooms} and {@link VACUUM_CLEAN_MEMBERS.cleanZones}.
  *
- * The outer frame these ride in is byte-verified on a live T2351, and `SCENE`, `SELECT_ROOMS` and
- * `SELECT_ZONES` have each since been RUN on a T2351 and did what they name — so their numbers rest on
- * observed behaviour rather than on the vendor's definition alone.
+ * The outer frame these ride in is byte-verified on a live T2351, and `AUTO`, `SCENE`, `SELECT_ROOMS`
+ * and `SELECT_ZONES` have each since been RUN on a T2351 and did what they name — so their numbers rest
+ * on observed behaviour rather than on the vendor's definition alone. `AUTO` is RUN with its payload:
+ * the vendor's definition calls `AutoClean.clean_times` valid only when non-zero, and the T2351 did
+ * not start on method 0 sent without it.
  *
  * That distinction is the whole point of checking, and this is the one place it is argued: an AIoT
  * data-point write is fire-and-forget, so a wrong number would be a different command arriving and
@@ -215,6 +216,11 @@ export declare const ModeCtrlMethod: {
  * scene id and a map id both arrive on DP 180.
  */
 export declare const ModeCtrlParamMethod: {
+    /** `START_AUTO_CLEAN` with an `AutoClean` payload — clean the whole floor. */
+    readonly AUTO: {
+        readonly method: 0;
+        readonly param: 3;
+    };
     /** `START_SELECT_ROOMS_CLEAN` — clean the named rooms of a named map. */
     readonly SELECT_ROOMS: {
         readonly method: 1;
@@ -274,17 +280,17 @@ export declare function encodeSelectZonesClean(mapId: number, zones: readonly Va
  * @internal
  */
 export declare function encodeSceneClean(sceneId: number): string;
+/**
+ * Build a whole-floor auto clean carrying an `AutoClean` payload of one pass.
+ * @internal
+ */
+export declare function encodeAutoClean(): string;
 /**
  * Encode a `ModeCtrlRequest` protobuf (DP 152) as a DP value: `varint(bodyLen) ++ {method:1, seq:2}`.
  *
  * Built on {@link RawDpWriter} rather than hand-rolled bytes. The frame is unchanged and the existing
  * byte-level test is what proves it — that test was written against a live T2351 capture, so it holds
  * the writer to the wire rather than to this function's own idea of the wire.
- *
- * Method 0 (START_AUTO_CLEAN) is omitted rather than written as an explicit zero, per the proto3
- * default-field rule and confirmed on that same capture. The writer deliberately does not apply that
- * rule itself: whether an explicit zero and an absent field mean the same thing is the
- * message's business, not the encoder's.
  * @internal
  */
 export declare function encodeModeCtrl(method: number, seq: number): string;
@@ -1955,7 +1961,7 @@ export declare const VACUUM_CLEAN_MEMBERS: {
         readonly provenance: "mega";
         readonly description: "Stop smart-follow mode (ModeCtrlRequest method 18 over DP 152). Method number not captured — unverified.";
     };
-    /** Start an auto-clean run via ModeCtrlRequest method 0 (DP 152). AIoT only — Tuya write unverified. */
+    /** Start an auto-clean run via ModeCtrlRequest method 0 with one `AutoClean` pass (DP 152). AIoT only — Tuya write unverified. */
     readonly startCleaning: import("./members.js").MethodMember<() => Promise<void>> & {
         available: (ctx: import("./types.js").CommandContext) => boolean;
     };

package/dist/model/classify.d.ts

@@ -56,8 +56,7 @@ export declare function codecForType(deviceType: number): Codec | undefined;
  *  - `T74xx` → **lock** (SmartSafe 7400-series).
  *  - `T80xx` / `T8001` / `T8002` / `T8010` / `T8030` / `T8023` / `T8025` → **station**
  *    (HomeBase / HomeBase 2 / 3 / Mini), `T9000` (the app's own model registry files it as family
- *    `STATION_9000`, the one station family outside the T8 band), and `T8N00` (NVR) / `T8E00` (PoE
- *    NVR) → station.
+ *    `STATION_9000`, the one station family outside the T8 band), and `T8N00` (NVR) → station.
  *  - `T89xx` (entry/motion/water/siren sensors, e.g. T8900/T8910/T8920) → **sensor**.
  *  - `T87xx` keypad (`T8960`) → **keypad**.
  *  - any other `T8…` security T-code → **camera** (the default security family).

package/dist/model/device-family.d.ts

@@ -43,6 +43,10 @@ export declare const isOutdoorPanTilt: (ctx: FamilyContext) => boolean;
 export declare const isFloodLight: (ctx: FamilyContext) => boolean;
 /** HomeBase-family hub (has a speaker/alarm) — a station EXCLUDING the NVRs, per `HOMEBASE_TYPES`. */
 export declare const isHomeBase: (ctx: FamilyContext) => boolean;
+/** HomeBase S1 Pro (`STATION_9000`), the station the app drives over its WebRTC control channel. */
+export declare const isStation9000: (ctx: FamilyContext) => boolean;
+/** T8N00 NVR, identified by its reported model. */
+export declare const isNvrT8N00: (ctx: FamilyContext) => boolean;
 /** Wired doorbell (DeviceType.DOORBELL). */
 export declare const isWiredDoorbell: (ctx: FamilyContext) => boolean;
 /**

package/dist/model/registry.d.ts

@@ -48,7 +48,8 @@ export declare function resolveDevice(rec: CloudRecord): ResolvedDevice;
  * The property manifest for a device, from its capabilities and the record's facts. The single place
  * an {@link AvailabilityContext} is built — so a family-gate (`available`) and a per-model enum
  * (`enumValuesFor`) are decided from the same truthful, session-free view on every path (initial
- * resolve and {@link Device.reresolve}). Populated only from what a record carries, never transport
- * fields a live session hasn't produced.
+ * resolve and {@link Device.reresolve}). Populated only from what a record carries: its cloud params and
+ * the params its device reported over realtime, the same evidence a bound getter is gated on. Never
+ * transport fields a live session hasn't produced.
  */
 export declare function resolveProperties(rec: CloudRecord, codec: Codec, capabilities: Capability[]): PropertySpec[];

package/dist/model/types.d.ts

@@ -286,6 +286,12 @@ export interface CloudRecord {
     parentSn?: string;
     /** Reported param_type → raw value. Presence of a param is a capability signal. */
     params?: Record<number, string>;
+    /**
+     * Params the device reported over its realtime channel, keyed in the device's own namespace. A line
+     * whose state exists only on that channel carries none of it in {@link params}, so this is the
+     * evidence an availability gate on such a param is decided from.
+     */
+    dpParams?: Record<number, string>;
 }
 /** The fully-resolved device shape produced by the 3-tier resolver. */
 export interface ResolvedDevice {

package/dist/transport/abortable.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Settle `work` as it settles, or reject the moment `signal` aborts, whichever comes first.
+ *
+ * The underlying wait is left to finish on its own: it may be shared work other callers are waiting on, so a
+ * caller abandoning its own call does not cancel the work itself. This abandons WAITING, which is the only
+ * part that belonged to the caller.
+ */
+export declare function abortable<T>(work: Promise<T>, signal?: AbortSignal): Promise<T>;

package/dist/transport/http/mega-client.d.ts

@@ -209,6 +209,8 @@ export interface SignedRetry {
 export declare class MegaHttpClient {
     private readonly cfg;
     private region;
+    /** The host `estimate_domain` answered, persisted with the session. */
+    private estimatedDomain;
     private bootstrapDomain?;
     private sessionKey?;
     /** Per-host ECDH session keys for non-mega gateways (e.g. eufylife) keyed by host. */
@@ -275,6 +277,21 @@ export declare class MegaHttpClient {
     } | undefined;
     /** The active region shard (e.g. `"eu-pr"`, `"us-pr"`), set after {@link login} or a region override. */
     get regionShard(): RegionShard;
+    /**
+     * The shard the RTC signalling signs on: the regional prefix of the estimated domain
+     * (`…-ie-…`/`…-ie.` → `ie-pr`), else {@link regionShard}. The eu/us classification cannot name shards
+     * like `ie-pr`, whose accounts need the IE sign host and cluster.
+     */
+    get rtcShard(): string;
+    /**
+     * The credentials the RTC signalling needs; `undefined` while logged out. The sign is refused
+     * ("gtoken not equal userid") unless its gtoken is the one every authed HTTP call carries.
+     */
+    rtcIdentity(): {
+        authToken: string;
+        userId: string;
+        gtoken: string;
+    } | undefined;
     /**
      * The name commands attribute themselves to — {@link MegaClientConfig.accountName} when the config
      * pins one (trimmed; blank counts as unset), otherwise the logged-in account's display name, which
@@ -367,6 +384,15 @@ export declare class MegaHttpClient {
      * params instead, which also carry `{param_type, param_value, update_time}` and are not owner-gated.
      */
     getDeviceParamList<T = unknown>(deviceSn: string): Promise<T>;
+    /**
+     * Fetch the account's devices as the `devicerelation` service lists them, `{attribute: 7, house_id: ""}`.
+     *
+     * Each entry is `{device: {device_sn, dps, …}}`, and `dps` is the cloud's last-known value of every
+     * data point that device has reported, keyed by DP number. Answered for an account a device is shared
+     * with as well as for its owner. Sent with `category: eufy_home`, without which the service answers
+     * `10000`.
+     */
+    getDeviceRelationList<T = unknown>(): Promise<T>;
     /**
      * Fetch one page of a device's **cleaning history** from the mega `clean` service.
      *

package/dist/transport/p2p/command-router.d.ts

@@ -1,14 +1,3 @@
-/**
- * P2P command router — the transport-side owner of the ThroughTek PPCS sessions and every wire
- * operation over them: opening sessions, resolving a serial to its session + routing params,
- * mapping a transport-neutral {@link Command} to a concrete frame (encryption level, wire shape),
- * the fire-and-forget control senders, request/reply queries, and the media provider.
- *
- * Layering: this module knows P2P bytes; it does NOT know capabilities. Frame → semantic-event
- * decoding is a model concern, so raw frames are handed back to the client via {@link P2PRouterDeps.onFrame}
- * (the client gates them on device capabilities and emits typed events). This keeps transport free of
- * any `model/` import — the capability↔transport decorrelation invariant.
- */
 import type { MegaHttpClient } from "../http/mega-client.js";
 import type { EufyDevice } from "../../core/types.js";
 import type { Command, AutoLockSnapshot, MediaProvider, SharedSourceHints, AbortableCall } from "../../core/contracts.js";
@@ -258,11 +247,14 @@ export declare class P2PCommandRouter {
      */
     dispatchCommand(sn: string, cmd: Command): Promise<void>;
     /**
-     * Restart a HomeBase. `RESTART_HUB` (1034) is a station-scalar on the broadcast channel 255: a
-     * level-2 frame whose body is `[u32 value][account_id padded]` — the same shape as the hub
-     * alarm-volume control. ✅ Wire-confirmed byte-exact from a capture of the app's own Restart
-     * (2026-08-03) and HW-tested: the captured frame carried value `0` and rebooted the hub. Replays
-     * like every other level-2 control, so a single dropped datagram doesn't lose it.
+     * Restart the station that owns `sn`'s P2P session. `RESTART_HUB` (1034) is a station-scalar on the
+     * broadcast channel 255 whose body is `[u32 value][account_id padded]`, value `0`. ✅ Wire-confirmed
+     * byte-exact as a level-2 frame from a capture of the app's own HomeBase Restart (2026-08-03).
+     *
+     * The seal follows the session, as {@link sendBySessionLevel} defines it: a keyed session takes the
+     * level-2 frame, a keyless one — a standalone camera, which never negotiates a key — the same body
+     * sealed level-1. Both are replayed {@link DIRECT_CMD_SENDS}× at 200ms, as every other unacknowledged
+     * control here is.
      */
     rebootStation(sn: string): Promise<void>;
     /**
@@ -308,6 +300,11 @@ export declare class P2PCommandRouter {
      * stream costs nothing extra and a talkback on an otherwise idle camera opens the session it needs
      * instead of playing into silence.
      *
+     * **On a model in {@link ELD_TALKBACK_MODELS}, the speaker plays the codec the camera sends.** So the first
+     * audio frame of the media session this talkback holds decides its codec ({@link speakerCodec}), within
+     * {@link TALKBACK_CODEC_WAIT_MS} of the session's first frame, and the claim is re-checked after that wait as
+     * after the warm-up. Every other model opens `aac-lc` at once.
+     *
      * The level-2 key is waited for softly: only the HomeBase-attached path requires it, and
      * {@link Talkback.start} reports that failure precisely, so a hard wait here would reject an
      * own-session camera that legitimately never negotiates one.
@@ -453,15 +450,6 @@ export declare class P2PCommandRouter {
      * A still with no live sibling re-asserts, so a tile refreshing on a quiet station is
      * unaffected.
      */
-    /**
-     * Attach a consumer, unless the caller has already abandoned the call.
-     *
-     * The acquisition it just waited through can outlast the caller's interest, and a consumer attached for
-     * somebody who has gone keeps the pull warm for nobody. Detaching immediately gives the pull back, which
-     * lets it linger and fall away if this was the only thing holding it, and leaves it untouched if it was
-     * not.
-     */
-    private attachUnlessAborted;
     /**
      * Dispose one cached live source and forget it, so the next acquisition builds a fresh one. Its claim
      * on a session goes with it, and a media session opened for this source alone is closed: nothing else
@@ -687,7 +675,7 @@ export declare class P2PCommandRouter {
      * **`set-json-raw` intent** — bare JSON, no envelope: outer P2P cmd = `outerCmd` itself, plaintext
      * exactly `{account_id,...data}` (`session.sendRawLevel2` with no wrapper). Reversed from a live
      * capture of the app's own SET_SNOOZE_TIME (1271) frame — see `param-dictionary.ts`'s `1271` entry
-     * (`snoozeTime`); the alarm-delay config (1255, `arming.ts`'s `ARMING_CMD.ALARM_DELAY_CONFIG`) reuses
+     * (`snoozeTime`); the alarm-delay config (1255, `arming.ts`'s `ARMING_CMD.SET_ALL_ACTION`) reuses
      * the same bare-JSON shape.
      */
     private sendJsonRaw;

package/dist/transport/p2p/fmp4.d.ts

@@ -20,6 +20,8 @@ export declare class Fmp4Muxer {
     private lastVideoTimestampMs?;
     private readonly audioRequested;
     private audioCodec?;
+    /** Decoder config of an AAC-ELD track, taken from its frames; absent for AAC-LC, whose `esds` config is fixed. */
+    private audioConfig?;
     private audioDisabled;
     private audioSamples;
     private audioBaseDecodeTime;
@@ -37,7 +39,10 @@ export declare class Fmp4Muxer {
      * (e.g. delta frames before the first keyframe).
      */
     push(frame: LiveVideoFrame, timestampMs?: number): MediaFragment | undefined;
-    /** Add one station-declared AAC access unit to the audio track. G.711 remains available via `live()`. */
+    /**
+     * Add one station-declared AAC access unit to the audio track: an ADTS frame for AAC-LC, a raw access unit
+     * described by its frame's config for AAC-ELD. G.711 remains available via `live()`.
+     */
     pushAudio(frame: LiveAudioFrame, timestampMs?: number): MediaFragment | undefined;
     /** Permanently omit incompatible audio while allowing the video recording to continue. */
     private disableAudio;

package/dist/transport/p2p/live-stream.d.ts

@@ -103,6 +103,9 @@ export declare class LiveStream extends EventEmitter {
     private lastCodec;
     /** Rebuilds an access unit the station split across several frames — see {@link AccessUnitAssembler}. */
     private readonly units;
+    /** Whether a missing video datagram or incomplete unit invalidated the current reference chain. */
+    private awaitingKeyframeAfterGap;
+    private readonly videoGapHandler;
     /** The channel inbound media must be tagged with, once {@link acceptsMedia} trusts the station's tag. */
     private mediaChannel?;
     private tracedFirstVideoCommand;

package/dist/transport/p2p/p2p-session.d.ts

@@ -277,8 +277,8 @@ export declare class P2PSession extends EventEmitter {
     private decryptLevel2;
     get isConnected(): boolean;
     /**
-     * Ask the OS for {@link RECEIVE_BUFFER_BYTES} on a bound socket, and warn once per session when it grants
-     * less or refuses.
+     * Ask the OS for {@link RECEIVE_BUFFER_BYTES} on a bound socket, and log once per session when it grants
+     * less (debug) or refuses (warn).
      *
      * The request is made here rather than through `createSocket`'s `recvBufferSize`: Node applies that option
      * inside the bind callback, where a refusal is thrown out of reach of this session and ends the process.
@@ -435,6 +435,11 @@ export declare class P2PSession extends EventEmitter {
      * "direct" commands (e.g. CAMERA_SWITCH 1035) carry a binary struct, not JSON.
      */
     sendRawLevel2Bytes(payload: Buffer, channel: number, outerCmd?: number, signCode?: number): boolean;
+    /**
+     * The level-1 twin of {@link sendRawLevel2Bytes}: the plaintext `payload` sealed AES-128-ECB under the
+     * level-1 key, signCode 1 — the seal of the level-1 media start. Returns `false` when not connected.
+     */
+    sendRawLevel1Bytes(payload: Buffer, channel: number, outerCmd: number): boolean;
     /**
      * Stop the realtime media stream (`CMD_STOP_REALTIME_MEDIA`, 1004) on a camera `channel`, in the shape
      * its runtime topology takes, as {@link startLiveMedia} selects its start:
@@ -606,6 +611,18 @@ export declare class P2PSession extends EventEmitter {
         accountId?: string;
         channel?: number;
     }): void;
+    /**
+     * Read a date-ranged page of `history_record_info` from the station. The reply's `data` array groups
+     * recording rows with companion tables; each group retains its `table_name` and `payload`.
+     * `startTime` is `"0"` for the newest page or the oldest row's `yyyyMMddHHmmss` cursor for older rows.
+     */
+    queryRecordPage(opts: {
+        accountId?: string;
+        startDate: string;
+        endDate: string;
+        startTime?: string;
+        count?: number;
+    }): Promise<unknown[]>;
     /**
      * Query one on-station table and answer its rows, once the reply is whole.
      *
@@ -613,13 +630,15 @@ export declare class P2PSession extends EventEmitter {
      * several frames whose decrypted text is a fragment of one document, so the fragments are
      * accumulated here and scanned after each one. Answers that document's `data` rows. Rejects when
      * `signal` aborts, and when `timeoutMs` (default {@link DB_TABLE_TIMEOUT_MS}) elapses with no
-     * complete reply.
+     * complete reply, and when the station answers a non-zero `mIntRet`.
      *
      * One read at a time per session: while one is accumulating, every {@link queryDatabase} on the
      * session throws, so a second reply cannot land in this buffer.
      */
     readDatabase(table: string, opts?: {
         accountId?: string;
+        innerCmd?: number;
+        query?: Record<string, unknown>;
         timeoutMs?: number;
         signal?: AbortSignal;
     }): Promise<unknown[]>;

package/dist/transport/p2p/recording-download.d.ts

@@ -46,9 +46,10 @@ export declare function receiveRecording(session: P2PSession, request: {
     signal?: AbortSignal;
 }): RecordingTransfer;
 /**
- * Decode a recording's frames, in arrival order, into elementary streams. Keyframes go through one
- * {@link VideoFrameDecoder}, whose media key then opens the audio; a keyframe that does not open under
- * `eccPrivateKeyHex`, and every audio frame before the first media key, are dropped. Rejects with
+ * Decode a recording's frames, in arrival order, into elementary streams. Split pictures are assembled
+ * before they enter the output; an orphan continuation cannot become its own picture. Keyframes go
+ * through one {@link VideoFrameDecoder}, whose media key then opens the audio; a keyframe that does not
+ * open under `eccPrivateKeyHex`, and every audio frame before the first media key, are dropped. Rejects with
  * {@link RecordingDownloadError} `undecodable` when no video frame decodes.
  */
 export declare function decodeRecording(frames: readonly RecordingFrame[], eccPrivateKeyHex: string): RecordingDownload;

package/dist/transport/p2p/shared-live-source.d.ts

@@ -438,3 +438,12 @@ export declare class SharedLiveSource {
      */
     dispose(): void;
 }
+/**
+ * Attach a consumer, unless the caller has already abandoned the call.
+ *
+ * The acquisition it just waited through can outlast the caller's interest, and a consumer attached for
+ * somebody who has gone keeps the pull warm for nobody. Detaching immediately gives the pull back, which
+ * lets it linger and fall away if this was the only thing holding it, and leaves it untouched if it was
+ * not.
+ */
+export declare function attachUnlessAborted(source: SharedLiveSource, signal?: AbortSignal): Consumer;