@mega-yfue/eufy-sdk 0.5.0-beta.69 → 0.5.0-beta.70

package/dist/core/contracts.d.ts

@@ -329,6 +329,11 @@ export type Command = {
     channel: number;
     mValue3?: number;
     form?: ScalarForm;
+    /**
+     * `"set-payload"`: a level-2 key that seals only this envelope (an RSA cipher's AES-128-ECB key)
+     * may seal it. Absent, the send waits for the key every level-2 sender uses.
+     */
+    level2Sender?: "set-payload";
 } | {
     kind: "p2p-privacy-burst";
     enabled: boolean;

package/dist/index.js

@@ -11097,6 +11097,30 @@ var LOCATE = {
   }
 };
 
+// dist/model/capabilities/smart-drop.js
+var OPEN_LID_CMD = 2100;
+var SMART_DROP_MEMBERS = {
+  /**
+   * Opens the lid with `SET_PAYLOAD` 2100 at level 2. Verified on a standalone T8790, whose cipher has
+   * only an RSA key: the frame sealed AES-128-ECB opened the lid, the same frame at level 1 did not.
+   */
+  openLid: method(({ ctx, sink }) => () => sink.dispatch({
+    kind: "set-payload",
+    cmd: OPEN_LID_CMD,
+    payload: { isOpen: 1, userIndex: 0 },
+    channel: ctx.channel,
+    mValue3: 0,
+    level2Sender: "set-payload"
+  }), "Open the SmartDrop lid.")
+};
+var SMART_DROP = {
+  capability: "smart_drop",
+  description: "SmartDrop parcel box lid control.",
+  members: SMART_DROP_MEMBERS,
+  properties: propertiesOf(SMART_DROP_MEMBERS),
+  detection: { detect: (record) => record.model === "T8790" && record.parentSn === void 0 }
+};
+
 // dist/model/capabilities/info.js
 var MANUFACTURER = "eufy";
 function buildDeviceInfo(ctx) {
@@ -11178,6 +11202,7 @@ var MODULES = [
   SUCTION,
   MOWER,
   LOCATE,
+  SMART_DROP,
   DISPLAY,
   INFO
 ];
@@ -14980,7 +15005,7 @@ import { setTimeout as sleep2 } from "node:timers/promises";
 // dist/transport/p2p/p2p-session.js
 import { EventEmitter as EventEmitter2 } from "node:events";
 import dgram from "node:dgram";
-import { constants, createCipheriv as createCipheriv3, createDecipheriv as createDecipheriv4, generateKeyPairSync, privateDecrypt, randomBytes as randomBytes2 } from "node:crypto";
+import { constants as constants2, createCipheriv as createCipheriv3, createDecipheriv as createDecipheriv4, generateKeyPairSync, privateDecrypt as privateDecrypt2, randomBytes as randomBytes2 } from "node:crypto";
 
 // dist/transport/p2p/codec.js
 var codec_exports = {};
@@ -15005,6 +15030,7 @@ __export(codec_exports, {
   decodeP2PCloudIPs: () => decodeP2PCloudIPs,
   decryptP2PData: () => decryptP2PData,
   deriveLevel2KeyFromGatewayInfo: () => deriveLevel2KeyFromGatewayInfo,
+  deriveLevel2KeyFromRsaGatewayInfo: () => deriveLevel2KeyFromRsaGatewayInfo,
   eciesUnwrap: () => eciesUnwrap,
   encryptP2PData: () => encryptP2PData,
   frameMessage: () => frameMessage,
@@ -15018,7 +15044,7 @@ __export(codec_exports, {
   readNullTerminatedString: () => readNullTerminatedString,
   stringWithLength: () => stringWithLength
 });
-import { createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv3, createECDH as createECDH2, createHmac as createHmac2, timingSafeEqual } from "node:crypto";
+import { constants, createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv3, createECDH as createECDH2, createHmac as createHmac2, createPrivateKey, privateDecrypt, timingSafeEqual } from "node:crypto";
 var MAGIC_WORD = "XZYH";
 var RequestMessageType = {
   LOCAL_LOOKUP: Buffer.from([241, 48]),
@@ -15162,6 +15188,27 @@ function deriveLevel2KeyFromGatewayInfo(gwPayload, eccPrivateKeyHex) {
   const key = plain.subarray(0, 32);
   return key.length === 32 ? Buffer.from(key) : void 0;
 }
+function deriveLevel2KeyFromRsaGatewayInfo(gwPayload, rsaPrivateKey) {
+  try {
+    const key = createPrivateKey({ key: Buffer.from(rsaPrivateKey, "base64"), format: "der", type: "pkcs8" });
+    const modulusBits = key.asymmetricKeyDetails?.modulusLength;
+    if (!modulusBits)
+      return void 0;
+    const len = Math.ceil(modulusBits / 8);
+    if (gwPayload.length < 4 + len)
+      return void 0;
+    const block = privateDecrypt({ key, padding: constants.RSA_NO_PADDING }, gwPayload.subarray(4, 4 + len));
+    if (block[0] !== 0 || block[1] !== 2)
+      return void 0;
+    const separator = block.indexOf(0, 2);
+    if (separator < 10)
+      return void 0;
+    const sessionKey = block.subarray(separator + 1);
+    return sessionKey.length === 16 ? Buffer.from(sessionKey) : void 0;
+  } catch {
+    return void 0;
+  }
+}
 function buildLocalLookupPayload() {
   return Buffer.from([0, 0]);
 }
@@ -16023,6 +16070,12 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
   level1Key;
   /** Negotiated 32-byte level-2/gateway key (AES-256-GCM). Set via setLevel2Key once known. */
   level2Key;
+  /**
+   * Negotiated 16-byte level-2 key of a cipher with no ECC key (RSA-encrypted in `CMD_GATEWAYINFO`). Only
+   * {@link sendControlLevel2} seals with it, AES-128-ECB in the level-1 layout at encryption type 2; never
+   * held beside {@link level2Key}.
+   */
+  level2EcbKey;
   level2Seq = 0;
   rsaPrivateKey;
   rsaModulusHex;
@@ -16103,12 +16156,22 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
     this.level2Key = key;
     this.settleLevel2();
   }
-  /** Whether the level-2 session key has been negotiated/set. */
+  /** Whether the AES-256-GCM level-2 session key has been negotiated/set. */
   get hasLevel2Key() {
     return !!this.level2Key;
   }
+  /**
+   * Whether the held level-2 key can frame for `sender`: every level-2 sender needs the AES-256-GCM key,
+   * and `"set-payload"` ({@link sendControlLevel2}) also takes the AES-128-ECB key of an RSA cipher.
+   */
+  level2KeyServes(sender) {
+    return !!this.level2Key || sender === "set-payload" && !!this.level2EcbKey;
+  }
   /**
    * Resolve with whether a level-2 key is available, waiting only while waiting can still change that.
+   * `sender` names who will frame with it: by default every level-2 sender, which needs the AES-256-GCM
+   * key; `"set-payload"` is {@link sendControlLevel2} alone, which also takes the AES-128-ECB key of an RSA
+   * cipher, so `true` for it does not imply {@link hasLevel2Key}.
    *
    * A `"session"` grace is measured once, not restarted per call. Best-effort media uses it because every
    * egress asks this same session and can proceed without the key on an own-session camera; a per-call
@@ -16133,12 +16196,12 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
    * `terminal` outcome is the one already stated where the negotiation concluded, since that is where the
    * cipher and the cause are known, and re-stating it here would double every settled negotiation.
    */
-  async awaitLevel2Key(graceMs, graceFrom = "call") {
+  async awaitLevel2Key(graceMs, graceFrom = "call", sender = "every") {
     if (this.closed) {
       this.trace({ phase: "level2-unavailable", reason: "session-closed" });
       return false;
     }
-    if (this.level2Key)
+    if (this.level2KeyServes(sender))
       return true;
     if (!this.level2Pending) {
       this.trace({ phase: "level2-unavailable", reason: "not-negotiating" });
@@ -16172,16 +16235,17 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
       deadline.unref?.();
       waiters.push(wake);
     });
+    const served = outcome === "key" || outcome === "terminal" && this.level2KeyServes(sender);
     if (outcome === "timeout") {
       this.logger.debug(`[p2p] ${this.cfg.stationSn} level-2 key did not arrive within its grace`);
       this.trace({ phase: "level2-unavailable", reason: "grace-elapsed", waitedMs: remaining });
-    } else if (outcome === "terminal") {
+    } else if (outcome === "terminal" && !served) {
       this.logger.debug(`[p2p] ${this.cfg.stationSn} level-2 negotiation concluded without a key`);
     } else if (outcome === "closed") {
       this.logger.debug(`[p2p] ${this.cfg.stationSn} session closed before the level-2 key arrived`);
       this.trace({ phase: "level2-unavailable", reason: "session-closed" });
     }
-    return outcome === "key";
+    return served;
   }
   /**
    * Ask the station for its gateway info a second time, re-opening a negotiation that concluded without a key.
@@ -16199,7 +16263,7 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
    * use this: re-prompting on their behalf would be noise for an answer they do not need.
    */
   repromptLevel2Key() {
-    if (this.closed || this.level2Key || this.level2Reprompted)
+    if (this.closed || this.level2KeyServes("set-payload") || this.level2Reprompted)
       return false;
     if (!this.cfg.resolveCipherKey || !this.connectAddress)
       return false;
@@ -16218,9 +16282,12 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
   }
   /**
    * Negotiate the level-2 session key from the decrypted CMD_GATEWAYINFO payload: read its
-   * `cipher_id`, resolve that cipher's ECC private key (cloud `get_ciphers`, via the configured
-   * `resolveCipherKey`), run the ECIES unwrap, and `setLevel2Key()`. One-shot; emits `level2Ready`
-   * on success and `error` on failure (non-fatal — level-1 traffic keeps working regardless).
+   * `cipher_id`, resolve that cipher's private keys once (cloud `get_ciphers`, via the configured
+   * `resolveCipherKey`), run the ECIES unwrap with the ECC key, and `setLevel2Key()`. A cipher with no
+   * ECC key uses its RSA key instead and holds the RSA-decrypted 16-byte key as the AES-128-ECB level-2
+   * key. One-shot; emits `level2Ready` only when the AES-256-GCM key is negotiated, traces
+   * `level2-set-payload-only` instead for the AES-128-ECB key, and emits `error` on failure
+   * (non-fatal — level-1 traffic keeps working regardless).
    *
    * Every outcome settles the wait in {@link awaitLevel2Key}, because being one-shot is what makes a
    * failure final for this connection generation: nothing will retry it there, so a later command must be
@@ -16233,26 +16300,36 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
     this.trace({ phase: "level2-negotiating", cipherId });
     void (async () => {
       try {
-        const eccPrivHex = await this.cfg.resolveCipherKey?.(cipherId);
+        const resolved = await this.cfg.resolveCipherKey?.(cipherId);
         if (this.closed || generation !== this.connectionGeneration)
           return;
-        if (!eccPrivHex) {
-          this.logger.debug(`[p2p] ${this.cfg.stationSn} no ECC key for cipher_id ${cipherId}`);
+        const keys = typeof resolved === "string" ? { ecc: resolved } : resolved;
+        const eccPrivHex = keys?.ecc;
+        const rsaPrivKey = eccPrivHex ? void 0 : keys?.rsa;
+        if (!eccPrivHex && !rsaPrivKey) {
+          this.logger.debug(`[p2p] ${this.cfg.stationSn} no ECC or RSA key for cipher_id ${cipherId}`);
           this.trace({ phase: "level2-unavailable", reason: "no-cipher-key", cipherId });
           this.settleLevel2();
           return;
         }
-        const key = deriveLevel2KeyFromGatewayInfo(gwPayload, eccPrivHex);
+        const key = eccPrivHex ? deriveLevel2KeyFromGatewayInfo(gwPayload, eccPrivHex) : deriveLevel2KeyFromRsaGatewayInfo(gwPayload, rsaPrivKey);
         if (!key) {
           this.trace({ phase: "level2-unavailable", reason: "derivation-failed", cipherId });
           this.settleLevel2();
           this.emit("error", new Error(`level-2 key derivation failed (cipher_id ${cipherId})`));
           return;
         }
-        this.setLevel2Key(key);
-        this.logger.debug(`[p2p] ${this.cfg.stationSn} level-2 key negotiated (cipher_id ${cipherId})`);
-        this.trace({ phase: "level2-ready", cipherId });
-        this.emit("level2Ready", { cipherId });
+        if (eccPrivHex) {
+          this.setLevel2Key(key);
+          this.logger.debug(`[p2p] ${this.cfg.stationSn} level-2 key negotiated (cipher_id ${cipherId})`);
+          this.trace({ phase: "level2-ready", cipherId });
+          this.emit("level2Ready", { cipherId });
+        } else {
+          this.level2EcbKey = key;
+          this.logger.debug(`[p2p] ${this.cfg.stationSn} level-2 set-payload key negotiated (cipher_id ${cipherId})`);
+          this.trace({ phase: "level2-set-payload-only", cipherId });
+          this.settleLevel2();
+        }
       } catch (e) {
         if (this.closed || generation !== this.connectionGeneration)
           return;
@@ -16322,7 +16399,7 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
     this.closed = false;
     this.connectionGeneration += 1;
     this.resetInboundSequencing();
-    if (!this.level2Key) {
+    if (!this.level2KeyServes("set-payload")) {
       this.level2Pending = this.cfg.resolveCipherKey !== void 0;
       this.level2Negotiating = false;
       this.level2Reprompted = false;
@@ -16805,18 +16882,25 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
    * mechanism proven for camera selection in media start. Use for control commands routed through a
    * HomeBase (where level-1 ECB is rejected). Returns `false` if the level-2 key isn't negotiated
    * yet (caller can fall back to {@link sendStringPayloadCommand}).
+   *
+   * On a session holding only the AES-128-ECB level-2 key of an RSA cipher, the frame is the level-1
+   * layout ({@link sendRawLevel1Bytes}) sealed under that key at encryption type 2: the encryption-type
+   * byte names the key the body is sealed with (1 = level-1 key, 2 = the negotiated key).
    */
   sendControlLevel2(cmd, channel, accountId, payload, mValue3 = cmd) {
-    if (!this.connectAddress || !this.level2Key)
-      return false;
-    const value = JSON.stringify({ account_id: accountId, cmd, mChannel: channel, mValue3, payload });
-    const body = this.encryptLevel2(Buffer.from(value, "utf-8"));
-    if (!body)
+    if (!this.connectAddress || !this.level2KeyServes("set-payload"))
       return false;
-    const data = Buffer.concat([
-      buildCommandHeader(this.seqNumber, CMD_SET_PAYLOAD),
-      buildRawCommandPayload(body, channel, 8, [8, 0], 0)
-    ]);
+    const value = Buffer.from(JSON.stringify({ account_id: accountId, cmd, mChannel: channel, mValue3, payload }), "utf-8");
+    let sealed;
+    if (this.level2Key) {
+      const body = this.encryptLevel2(value);
+      if (!body)
+        return false;
+      sealed = buildRawCommandPayload(body, channel, 8, [8, 0], 0);
+    } else {
+      sealed = buildRawCommandPayload(encryptP2PData(paddingP2PData(value), this.level2EcbKey), channel, 2);
+    }
+    const data = Buffer.concat([buildCommandHeader(this.seqNumber, CMD_SET_PAYLOAD), sealed]);
     this.seqNumber = this.seqNumber + 1 & 65535;
     this.send(this.connectAddress, RequestMessageType.DATA, data);
     return true;
@@ -17152,7 +17236,7 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
     if (!this.rsaPrivateKey)
       return void 0;
     try {
-      return privateDecrypt({ key: this.rsaPrivateKey, padding: constants.RSA_PKCS1_PADDING }, wrapped);
+      return privateDecrypt2({ key: this.rsaPrivateKey, padding: constants2.RSA_PKCS1_PADDING }, wrapped);
     } catch {
       return void 0;
     }
@@ -17621,7 +17705,7 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
       } catch {
       }
     }
-    if (header.commandId === CMD_GATEWAYINFO && header.signCode <= 1 && !this.level2Key && !this.level2Negotiating && this.cfg.resolveCipherKey) {
+    if (header.commandId === CMD_GATEWAYINFO && header.signCode <= 1 && !this.level2KeyServes("set-payload") && !this.level2Negotiating && this.cfg.resolveCipherKey) {
       this.negotiateLevel2Key(data);
     }
     if (header.commandId === CMD_DATABASE && header.signCode > 0) {
@@ -17684,6 +17768,7 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
     this.stopPunchProbes();
     this.connectionGeneration += 1;
     this.level2Key = void 0;
+    this.level2EcbKey = void 0;
     this.level2Seq = 0;
     this.settleLevel2("closed");
     this.connected = false;
@@ -21565,7 +21650,7 @@ var P2PCommandRouter = class _P2PCommandRouter {
    * shared — see {@link P2PCommandRouter.openTalkback}.
    */
   talkbacks = /* @__PURE__ */ new Map();
-  /** cipher_id → ECC private key (one eufylife get_ciphers call per cipher), shared across (re)opens. */
+  /** cipher_id → its ECC and RSA private keys (one eufylife get_ciphers call per cipher), shared across (re)opens. */
   cipherKeyCache = /* @__PURE__ */ new Map();
   /** The recording download in flight per station; a station serves one at a time. */
   recordingDownloads = /* @__PURE__ */ new Map();
@@ -21757,7 +21842,7 @@ var P2PCommandRouter = class _P2PCommandRouter {
    * Build + wire a {@link P2PSession} for a station (NOT yet connected — the caller awaits `connect()`).
    *
    * `resolveCipherKey` auto-negotiates the level-2 session key from `CMD_GATEWAYINFO` by resolving the
-   * cipher's ECC private key via cloud `get_ciphers`, so signCode 2/8 frames decrypt live; results are
+   * cipher's private keys via cloud `get_ciphers`, so signCode 2/8 frames decrypt live; results are
    * cached on the router instance so a lazy re-open (after idle-detach) reuses the lookup. Only a
    * SUCCESSFUL lookup is cached — caching `undefined` after a transient failure would permanently
    * disable level-2 for the session's life.
@@ -21781,7 +21866,7 @@ var P2PCommandRouter = class _P2PCommandRouter {
       localAddress,
       dskKey,
       noBroadcast: this.deps.noBroadcast,
-      resolveCipherKey: (cipherId) => this.cipherKeyFor(session, cipherId, adminUserId, stationSn),
+      resolveCipherKey: (cipherId) => this.cipherKeysFor(session, cipherId, adminUserId, stationSn),
       logger: this.deps.logger ?? noopLogger
     });
     session.on("error", (e) => this.reportError(e));
@@ -21806,19 +21891,20 @@ var P2PCommandRouter = class _P2PCommandRouter {
     return session;
   }
   /**
-   * The ECC private key of `cipherId`, from the router's cache or one `get_ciphers` call. When the cloud
-   * answers with another cipher, that one is used and traced on `session`. Only a successful lookup is
-   * cached.
+   * The ECC and RSA private keys of `cipherId` (`ecc_private_key`, `private_key`), from the router's cache
+   * or one `get_ciphers` call. When the cloud answers with another cipher that carries an ECC key and the
+   * asked one does not, that one is used and traced on `session`. Only a successful lookup — one that
+   * yields either key — is cached.
    */
-  async cipherKeyFor(session, cipherId, userId, stationSn) {
+  async cipherKeysFor(session, cipherId, userId, stationSn) {
     if (this.cipherKeyCache.has(cipherId))
       return this.cipherKeyCache.get(cipherId);
-    let ecc;
+    let cipher;
     try {
       const ciphers = await this.deps.mega.getCiphers([cipherId], userId, stationSn);
-      ecc = ciphers.find((c) => Number(c.cipher_id) === cipherId)?.ecc_private_key;
-      if (ecc === void 0 && ciphers[0]?.ecc_private_key !== void 0) {
-        ecc = ciphers[0].ecc_private_key;
+      cipher = ciphers.find((c) => Number(c.cipher_id) === cipherId);
+      if (cipher?.ecc_private_key === void 0 && ciphers[0]?.ecc_private_key !== void 0) {
+        cipher = ciphers[0];
         this.traceOnStation(session, {
           phase: "cipher-fallback",
           cipherId,
@@ -21828,9 +21914,11 @@ var P2PCommandRouter = class _P2PCommandRouter {
     } catch (e) {
       this.deps.onError(e instanceof Error ? e : new Error(String(e)));
     }
-    if (ecc !== void 0)
-      this.cipherKeyCache.set(cipherId, ecc);
-    return ecc;
+    if (cipher?.ecc_private_key === void 0 && cipher?.private_key === void 0)
+      return void 0;
+    const keys = { ecc: cipher.ecc_private_key, rsa: cipher.private_key };
+    this.cipherKeyCache.set(cipherId, keys);
+    return keys;
   }
   /**
    * Open (or reuse) a station's P2P session and await its completed handshake. An optional abort only
@@ -21906,7 +21994,7 @@ var P2PCommandRouter = class _P2PCommandRouter {
         await this.sendJsonRaw(sn, cmd.cmd, cmd.data, cmd.channel);
         return;
       case "set-payload":
-        await this.sendSetPayloadEnvelope(sn, cmd.cmd, cmd.payload, cmd.channel, cmd.mValue3, void 0, cmd.form);
+        await this.sendSetPayloadEnvelope(sn, cmd.cmd, cmd.payload, cmd.channel, cmd.mValue3, void 0, cmd.form, cmd.level2Sender);
         return;
       case "p2p-station-scalar":
         await this.sendStationScalar(sn, cmd.cmd, cmd.value, cmd.channel);
@@ -22050,7 +22138,7 @@ var P2PCommandRouter = class _P2PCommandRouter {
     const path = homeBase2RecordingPath(channel, opts.recording);
     if (!path)
       throw new RecordingDownloadError("invalid-recording", `no recording named ${opts.recording}`);
-    const eccKey = await this.cipherKeyFor(session, opts.cipherId, accountId, parentSn);
+    const eccKey = (await this.cipherKeysFor(session, opts.cipherId, accountId, parentSn))?.ecc;
     if (!eccKey) {
       throw new RecordingDownloadError("key-unavailable", `cipher ${opts.cipherId} could not be obtained`);
     }
@@ -22791,9 +22879,10 @@ var P2PCommandRouter = class _P2PCommandRouter {
       const required = opts.waitLevel2 !== "soft" || opts.requireLevel2ForAttached === true && homeBaseAttached;
       if (!required)
         return { session, parentSn, channel, accountId, homeBaseAttached };
-      let ready = await abortable(session.awaitLevel2Key(LEVEL2_GRACE_MS, "call"), opts.signal);
+      const sender = opts.level2Sender ?? "every";
+      let ready = await abortable(session.awaitLevel2Key(LEVEL2_GRACE_MS, "call", sender), opts.signal);
       if (!ready && session.repromptLevel2Key()) {
-        ready = await abortable(session.awaitLevel2Key(LEVEL2_GRACE_MS, "call"), opts.signal);
+        ready = await abortable(session.awaitLevel2Key(LEVEL2_GRACE_MS, "call", sender), opts.signal);
       }
       if (!ready)
         throw new StationKeyUnavailableError(parentSn);
@@ -22868,7 +22957,9 @@ var P2PCommandRouter = class _P2PCommandRouter {
    * HomeBase-attached device takes the GCM signCode-8 form, a standalone one the level-1 form. A
    * standalone camera never negotiates a level-2 key, so pinning this to level 2 makes the envelope
    * unreachable on exactly the devices that serve their own RTSP stream. Verified live: a standalone
-   * camera accepts the level-1 form. With no `form` (default) it stays level-2 only.
+   * camera accepts the level-1 form. With no `form` (default) it stays level-2 only and waits for the
+   * key every level-2 sender uses; `level2Sender: "set-payload"` also takes an RSA cipher's AES-128-ECB
+   * key (see {@link P2PSession.sendControlLevel2}). A `resolved` session keeps the wait its caller gave it.
    *
    * Both seals REPLAY the frame {@link DIRECT_CMD_SENDS}× at 200ms, as every other fire-and-forget
    * control on this router does: these are unacknowledged datagrams, and a level-1 device is the one
@@ -22877,7 +22968,7 @@ var P2PCommandRouter = class _P2PCommandRouter {
    * throwing (`sendSetPayload` throws when the session has no address) rather than by returning a
    * boolean, so the first pass carries the failure and the rest are repeats.
    */
-  async sendSetPayloadEnvelope(sn, cmd, payload, channel, mValue3, resolved, form) {
+  async sendSetPayloadEnvelope(sn, cmd, payload, channel, mValue3, resolved, form, level2Sender) {
     if (form === "auto") {
       await this.sendBySessionLevel(sn, {
         l1: async ({ session, accountId }) => {
@@ -22894,7 +22985,7 @@ var P2PCommandRouter = class _P2PCommandRouter {
       });
       return;
     }
-    await this.replayLevel2Send(sn, `set-payload cmd ${cmd}`, ({ session, accountId }) => session.sendControlLevel2(cmd, channel, accountId, payload, mValue3 ?? cmd), resolved);
+    await this.replayLevel2Send(sn, `set-payload cmd ${cmd}`, ({ session, accountId }) => session.sendControlLevel2(cmd, channel, accountId, payload, mValue3 ?? cmd), resolved ?? await this.resolveSession(sn, { waitLevel2: true, level2Sender }));
   }
   /**
    * **`ff09-actuate` intent** — build the `ff09` AES-128-CBC frame ({@link buildFf09Frame}, shared with the
@@ -26016,7 +26107,7 @@ var HmacSigner = class {
 var TUYA_CHKEY = "7cbfe6d8";
 
 // dist/transport/tuya/client.js
-import { randomBytes as randomBytes5, createHash as createHash6, createPublicKey, publicEncrypt, constants as constants2 } from "node:crypto";
+import { randomBytes as randomBytes5, createHash as createHash6, createPublicKey, publicEncrypt, constants as constants3 } from "node:crypto";
 
 // dist/transport/tuya/et3.js
 import { createCipheriv as createCipheriv6, createDecipheriv as createDecipheriv8, createHmac as createHmac5, randomBytes as randomBytes4 } from "node:crypto";
@@ -26183,7 +26274,7 @@ function rsaEncryptPassword(password, publicKeyDecimal, exponentDecimal) {
     format: "jwk"
   });
   const md5Hex2 = createHash6("md5").update(password).digest("hex");
-  return publicEncrypt({ key: rsaKey, padding: constants2.RSA_PKCS1_PADDING }, Buffer.from(md5Hex2)).toString("hex");
+  return publicEncrypt({ key: rsaKey, padding: constants3.RSA_PKCS1_PADDING }, Buffer.from(md5Hex2)).toString("hex");
 }
 var TuyaClient = class {
   signer;
@@ -31558,6 +31649,7 @@ export {
   SECURITY_PARAMS,
   SERVER_STATIC_PUBLIC_KEY_HEX,
   SIREN_MEMBERS,
+  SMART_DROP_MEMBERS,
   SMART_LIGHT_MEMBERS,
   SMOKE_MEMBERS,
   SOLIX_ENERGY_METER_MEMBERS,