@mega-yfue/eufy-sdk 0.5.0-beta.7 → 0.5.0-beta.71

package/dist/model/capabilities/types.d.ts

@@ -60,6 +60,8 @@ export type ProductLine = "security" | "life" | "clean" | "print" | "display" |
  * `p2p-frame` shape of {@link InboundSignal}.
  */
 export interface CapabilityFrame {
+    /** Cloud device type resolved from the reporting station/channel. */
+    deviceType?: number;
     stationSn: string;
     commandId: number;
     channel: number;
@@ -247,8 +249,16 @@ export interface AvailabilityContext {
     homeBaseAttached?: boolean;
     /** Serial of the covering station, when the device record names one. */
     stationSerial?: string;
+    /**
+     * The vendor DeviceType of the station the device hangs off, when it is attached
+     * and the station's record states one. Answers which station family a command addressed to an
+     * attached device is carried through.
+     */
+    stationDeviceType?: number;
 }
 export interface CommandContext extends AvailabilityContext {
+    /** Vendor-formatted timezone reported by the station; never inferred from the host. */
+    timezone?: string;
     /** Device channel (0 for standalone, `device_channel` on a HomeBase). */
     channel: number;
     /** eufy DeviceType, when known. */

package/dist/model/capabilities/vacuum-clean.d.ts

@@ -169,12 +169,11 @@ export declare const TUYA_CLEAN_TYPES: readonly ["Sweep", "SweepMop", "Mop"];
 /** @internal */
 export type TuyaCleanType = (typeof TUYA_CLEAN_TYPES)[number];
 /**
- * `ModeCtrlRequest.method` values for DP 152. Live-verified on T2351: START_AUTO_CLEAN → 0
- * (omitted from the wire when zero), START_GOHOME → 6, PAUSE_TASK → 13.
+ * `ModeCtrlRequest.method` values for DP 152. Live-verified on T2351: START_GOHOME → 6,
+ * PAUSE_TASK → 13. An auto clean is `START_AUTO_CLEAN` (0) with a payload — see
+ * {@link ModeCtrlParamMethod}.
  */
 export declare const ModeCtrlMethod: {
-    /** Live-verified on a T2351. Zero, so it is omitted from the wire per the proto3 default rule. */
-    readonly START_AUTO_CLEAN: 0;
     /** Live-verified on a T2351. */
     readonly START_GOHOME: 6;
     /** Live-verified on a T2351. */
@@ -202,9 +201,11 @@ export declare const ModeCtrlMethod: {
  * its argument in the signature: {@link VACUUM_CLEAN_MEMBERS.startScene},
  * {@link VACUUM_CLEAN_MEMBERS.cleanRooms} and {@link VACUUM_CLEAN_MEMBERS.cleanZones}.
  *
- * The outer frame these ride in is byte-verified on a live T2351, and `SCENE`, `SELECT_ROOMS` and
- * `SELECT_ZONES` have each since been RUN on a T2351 and did what they name — so their numbers rest on
- * observed behaviour rather than on the vendor's definition alone.
+ * The outer frame these ride in is byte-verified on a live T2351, and `AUTO`, `SCENE`, `SELECT_ROOMS`
+ * and `SELECT_ZONES` have each since been RUN on a T2351 and did what they name — so their numbers rest
+ * on observed behaviour rather than on the vendor's definition alone. `AUTO` is RUN with its payload:
+ * the vendor's definition calls `AutoClean.clean_times` valid only when non-zero, and the T2351 did
+ * not start on method 0 sent without it.
  *
  * That distinction is the whole point of checking, and this is the one place it is argued: an AIoT
  * data-point write is fire-and-forget, so a wrong number would be a different command arriving and
@@ -215,6 +216,11 @@ export declare const ModeCtrlMethod: {
  * scene id and a map id both arrive on DP 180.
  */
 export declare const ModeCtrlParamMethod: {
+    /** `START_AUTO_CLEAN` with an `AutoClean` payload — clean the whole floor. */
+    readonly AUTO: {
+        readonly method: 0;
+        readonly param: 3;
+    };
     /** `START_SELECT_ROOMS_CLEAN` — clean the named rooms of a named map. */
     readonly SELECT_ROOMS: {
         readonly method: 1;
@@ -274,17 +280,17 @@ export declare function encodeSelectZonesClean(mapId: number, zones: readonly Va
  * @internal
  */
 export declare function encodeSceneClean(sceneId: number): string;
+/**
+ * Build a whole-floor auto clean carrying an `AutoClean` payload of one pass.
+ * @internal
+ */
+export declare function encodeAutoClean(): string;
 /**
  * Encode a `ModeCtrlRequest` protobuf (DP 152) as a DP value: `varint(bodyLen) ++ {method:1, seq:2}`.
  *
  * Built on {@link RawDpWriter} rather than hand-rolled bytes. The frame is unchanged and the existing
  * byte-level test is what proves it — that test was written against a live T2351 capture, so it holds
  * the writer to the wire rather than to this function's own idea of the wire.
- *
- * Method 0 (START_AUTO_CLEAN) is omitted rather than written as an explicit zero, per the proto3
- * default-field rule and confirmed on that same capture. The writer deliberately does not apply that
- * rule itself: whether an explicit zero and an absent field mean the same thing is the
- * message's business, not the encoder's.
  * @internal
  */
 export declare function encodeModeCtrl(method: number, seq: number): string;
@@ -1955,7 +1961,7 @@ export declare const VACUUM_CLEAN_MEMBERS: {
         readonly provenance: "mega";
         readonly description: "Stop smart-follow mode (ModeCtrlRequest method 18 over DP 152). Method number not captured — unverified.";
     };
-    /** Start an auto-clean run via ModeCtrlRequest method 0 (DP 152). AIoT only — Tuya write unverified. */
+    /** Start an auto-clean run via ModeCtrlRequest method 0 with one `AutoClean` pass (DP 152). AIoT only — Tuya write unverified. */
     readonly startCleaning: import("./members.js").MethodMember<() => Promise<void>> & {
         available: (ctx: import("./types.js").CommandContext) => boolean;
     };

package/dist/model/classify.d.ts

@@ -56,8 +56,7 @@ export declare function codecForType(deviceType: number): Codec | undefined;
  *  - `T74xx` → **lock** (SmartSafe 7400-series).
  *  - `T80xx` / `T8001` / `T8002` / `T8010` / `T8030` / `T8023` / `T8025` → **station**
  *    (HomeBase / HomeBase 2 / 3 / Mini), `T9000` (the app's own model registry files it as family
- *    `STATION_9000`, the one station family outside the T8 band), and `T8N00` (NVR) / `T8E00` (PoE
- *    NVR) → station.
+ *    `STATION_9000`, the one station family outside the T8 band), and `T8N00` (NVR) → station.
  *  - `T89xx` (entry/motion/water/siren sensors, e.g. T8900/T8910/T8920) → **sensor**.
  *  - `T87xx` keypad (`T8960`) → **keypad**.
  *  - any other `T8…` security T-code → **camera** (the default security family).

package/dist/model/device-family.d.ts

@@ -43,6 +43,12 @@ export declare const isOutdoorPanTilt: (ctx: FamilyContext) => boolean;
 export declare const isFloodLight: (ctx: FamilyContext) => boolean;
 /** HomeBase-family hub (has a speaker/alarm) — a station EXCLUDING the NVRs, per `HOMEBASE_TYPES`. */
 export declare const isHomeBase: (ctx: FamilyContext) => boolean;
+/** HomeBase S1 Pro (`STATION_9000`), the station the app drives over its WebRTC control channel. */
+export declare const isStation9000: (ctx: FamilyContext) => boolean;
+/** T8N00 NVR, identified by its reported model. */
+export declare const isNvrT8N00: (ctx: FamilyContext) => boolean;
+/** Video Doorbell C31 (T8223), identified by its reported model. */
+export declare const isDoorbellT8223: (ctx: FamilyContext) => boolean;
 /** Wired doorbell (DeviceType.DOORBELL). */
 export declare const isWiredDoorbell: (ctx: FamilyContext) => boolean;
 /**
@@ -72,3 +78,5 @@ export declare const isAiotVacuum: (ctx: FamilyContext) => boolean;
  * vacuums receive the same write actions as AIoT ones, routed by the facade's `routeCommand`.
  */
 export declare const isTuyaVacuum: (ctx: FamilyContext) => boolean;
+/** Video Smart Lock S330, identified by its distinct cloud device type. */
+export declare const isVideoSmartLock: (ctx: FamilyContext) => boolean;

package/dist/model/param-dictionary.d.ts

@@ -9,6 +9,7 @@
  *    `types.ts`.
  *  - CLEAN_PARAMS — RoboVac Tuya DP space (ids 1 and above), names from the cloud
  *    `get_product_data_point` data_point_list, hence provenance `mega`.
+ *  - MOWER_PARAMS — robot-mower Tuya DP space, names from the mower's Tuya product schema.
  *
  * Which models reported an id, and the capture that named it, are in the commit that adds the entry.
  */
@@ -50,3 +51,8 @@ export declare const CLEAN_PARAMS: Record<number, ParamDef>;
  * display settings screen, one control at a time, params diffed after each.
  */
 export declare const DISPLAY_PARAMS: Record<number, ParamDef>;
+/**
+ * Robot-mower Tuya DP space — names from the E15's Tuya product schema (`schemaInfo.schema`), each id
+ * also reported by a live E15. Only the scalar data points the `mower` capability reads are listed.
+ */
+export declare const MOWER_PARAMS: Record<number, ParamDef>;

package/dist/model/param-namespace.d.ts

@@ -14,7 +14,7 @@
 import type { Codec } from "./types.js";
 import { type ParamDef } from "./param-dictionary.js";
 /** The param id spaces this SDK models. */
-export type ParamNamespace = "security" | "clean" | "life" | "print" | "display";
+export type ParamNamespace = "security" | "clean" | "mower" | "life" | "print" | "display";
 /** Look up a param def in the given namespace. */
 export declare function paramDef(ns: ParamNamespace, paramType: number): ParamDef | undefined;
 /** The param namespace a device's ids live in, from its codec, via the module-local `NAMESPACE_BY_CODEC` table. */

package/dist/model/registry.d.ts

@@ -48,7 +48,8 @@ export declare function resolveDevice(rec: CloudRecord): ResolvedDevice;
  * The property manifest for a device, from its capabilities and the record's facts. The single place
  * an {@link AvailabilityContext} is built — so a family-gate (`available`) and a per-model enum
  * (`enumValuesFor`) are decided from the same truthful, session-free view on every path (initial
- * resolve and {@link Device.reresolve}). Populated only from what a record carries, never transport
- * fields a live session hasn't produced.
+ * resolve and {@link Device.reresolve}). Populated only from what a record carries: its cloud params and
+ * the params its device reported over realtime, the same evidence a bound getter is gated on. Never
+ * transport fields a live session hasn't produced.
  */
 export declare function resolveProperties(rec: CloudRecord, codec: Codec, capabilities: Capability[]): PropertySpec[];

package/dist/model/types.d.ts

@@ -39,7 +39,7 @@ export type Codec = "station" | "camera" | "sensor" | "lock" | "keypad" | "vacuu
  * it maps to a {@link CapabilityModule} that owns its property schema. Extend this union as
  * new capabilities are modelled — adding one never requires a subclass.
  */
-export type Capability = "video" | "snapshot" | "motion" | "person_detection" | "battery" | "light" | "ptz" | "doorbell" | "contact" | "leak" | "smoke" | "co" | "siren" | "lock" | "keypad" | "arming" | "storage" | "rtsp" | "camera" | "audio" | "vacuum_clean" | "vacuum_dock" | "suction" | "locate" | "smart_light" | "display" | "info";
+export type Capability = "video" | "snapshot" | "motion" | "person_detection" | "battery" | "light" | "ptz" | "doorbell" | "contact" | "leak" | "smoke" | "co" | "siren" | "lock" | "keypad" | "arming" | "storage" | "rtsp" | "camera" | "audio" | "vacuum_clean" | "vacuum_dock" | "suction" | "locate" | "mower" | "smart_drop" | "smart_light" | "display" | "info";
 /** Value type of a property. */
 export type PropertyValueType = "bool" | "number" | "string" | "enum";
 /**
@@ -52,11 +52,12 @@ export type PropertyValueType = "bool" | "number" | "string" | "enum";
  * one as the other is wrong in a way no type check catches.
  *
  *  - `boolean` — an on/off state (always paired with `type: "bool"`).
- *  - `percent` / `celsius` / `dbm` / `seconds` / `hours` / `megabytes` / `degrees` — a measured quantity
- *    in the unit the device reports it in; each pairs with the matching `unit`. Values are
- *    never converted on the way out — a converted reading is an invented one. `seconds` and `hours`
- *    are separate kinds for exactly that reason: a robot reports a run in seconds and a consumable's
- *    wear in hours, and normalising one into the other would publish a number the device never sent.
+ *  - `percent` / `celsius` / `dbm` / `seconds` / `hours` / `minutes` / `millimetres` / `megabytes` /
+ *    `degrees` — a measured quantity in the unit the device reports it in; each pairs with the
+ *    matching `unit`. Values are never converted on the way out — a converted reading is an invented
+ *    one. `seconds`, `minutes` and `hours` are separate kinds for exactly that reason: a robot reports
+ *    a run in seconds, a mower its blade wear in minutes and a vacuum's consumable wear in hours, and
+ *    normalising one into another would publish a number the device never sent.
  *  - `scalar` — a plain number in no unit at all: a step on a ladder, a mode index, a raw level, a
  *    segment count. Ordered and comparable, but its range and direction are the device's, so nothing
  *    but the device says what a given value means.
@@ -83,7 +84,7 @@ export type PropertyValueType = "bool" | "number" | "string" | "enum";
  *    decodes them and are exported beside that decoder; unlike an enum's options they are not carried
  *    here, which is a gap this vocabulary does not close on its own.
  */
-export declare const KNOWN_VALUE_KINDS: readonly ["boolean", "percent", "celsius", "dbm", "seconds", "hours", "megabytes", "degrees", "scalar", "bitfield", "enum", "identifier", "timestamp", "text"];
+export declare const KNOWN_VALUE_KINDS: readonly ["boolean", "percent", "celsius", "dbm", "seconds", "hours", "minutes", "millimetres", "megabytes", "degrees", "scalar", "bitfield", "enum", "identifier", "timestamp", "text"];
 /** One of the kinds this version models — the closed half of {@link ValueKind}. */
 export type KnownValueKind = (typeof KNOWN_VALUE_KINDS)[number];
 /**
@@ -106,7 +107,8 @@ export declare function isKnownValueKind(kind: ValueKind): kind is KnownValueKin
 /**
  * How much a param's name and meaning can be trusted, most-trusted first. This is the one definition;
  * the param dictionary and every `provenance` field use it.
- *  - `mega`     — the vendor's cloud names it: its data-point catalog (`get_product_data_point`), or a
+ *  - `mega`     — the vendor's cloud names it: its data-point catalog (`get_product_data_point`), the
+ *                 Tuya product schema of an `eufy_home_tuya` device (`thing.m.device.ref.info.list`), or a
  *                 reported value that matches what the cloud record already says (a model name or code).
  *  - `verified` — confirmed on a real device by this project: our own capture or observation, or
  *                 identified by someone who has the hardware.
@@ -140,6 +142,11 @@ export interface PropertySpec {
     kind?: ValueKind;
     /** Whether the value can be written back to the device (a setter exists). */
     writable: boolean;
+    /**
+     * Whether the device has reported this value: its own param, a read alias, or the payload it reads
+     * from. `false` means it never has. Absent when the manifest was built without the device's params.
+     */
+    reported?: boolean;
     /** Allowed values for `type: "enum"` (raw → label). */
     enumValues?: Record<number, string>;
     /**
@@ -170,10 +177,11 @@ export interface PropertySpec {
      * consumable counters are `"number"` over one base64 string, and reading the value as a number is
      * exactly what must NOT happen at ingest.
      *
-     * Storage already keeps such a value intact — a non-numeric string cannot be coerced to a number, so
-     * it is passed through. What this flag changes is that the pass-through stops being reported as a
-     * mistake: a robot reporting ten Raw DPs on every push logged ten warnings a time saying its
-     * properties were misdeclared, which is how a real warning goes unread.
+     * Storage keeps such a value intact: a non-numeric string passes a `number` coercion unchanged, and
+     * on a `bool` property a string that is not a boolean wire form (`"0"`, `"1"`, `"true"`, `"false"`)
+     * is kept rather than read as `false`. The pass-through is not reported as a mistake: a robot
+     * reporting ten Raw DPs on every push logged ten warnings a time saying its properties were
+     * misdeclared, which is how a real warning goes unread.
      */
     raw?: true;
     /**
@@ -286,6 +294,12 @@ export interface CloudRecord {
     parentSn?: string;
     /** Reported param_type → raw value. Presence of a param is a capability signal. */
     params?: Record<number, string>;
+    /**
+     * Params the device reported over its realtime channel, keyed in the device's own namespace. A line
+     * whose state exists only on that channel carries none of it in {@link params}, so this is the
+     * evidence an availability gate on such a param is decided from.
+     */
+    dpParams?: Record<number, string>;
 }
 /** The fully-resolved device shape produced by the 3-tier resolver. */
 export interface ResolvedDevice {

package/dist/transport/abortable.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Settle `work` as it settles, or reject the moment `signal` aborts, whichever comes first.
+ *
+ * The underlying wait is left to finish on its own: it may be shared work other callers are waiting on, so a
+ * caller abandoning its own call does not cancel the work itself. This abandons WAITING, which is the only
+ * part that belonged to the caller.
+ */
+export declare function abortable<T>(work: Promise<T>, signal?: AbortSignal): Promise<T>;

package/dist/transport/http/mega-client.d.ts

@@ -209,6 +209,8 @@ export interface SignedRetry {
 export declare class MegaHttpClient {
     private readonly cfg;
     private region;
+    /** The host `estimate_domain` answered, persisted with the session. */
+    private estimatedDomain;
     private bootstrapDomain?;
     private sessionKey?;
     /** Per-host ECDH session keys for non-mega gateways (e.g. eufylife) keyed by host. */
@@ -228,6 +230,8 @@ export declare class MegaHttpClient {
     /** True while a 2FA code is outstanding: `auth_` holds only the limited pre-verify token, so the
      *  restored-session short-circuit must NOT treat it as a usable session. Cleared on Ok/reset. */
     private pending2fa;
+    /** An autonomous re-login answered captcha/2FA; see {@link canReauthenticate}. */
+    private reloginChallenged;
     private tokenExpiresAt;
     /**
      * Stable per-install device id: `openudid` as configured, as restored from the session store, or as
@@ -259,10 +263,12 @@ export declare class MegaHttpClient {
     constructor(cfg: MegaClientConfig);
     /**
      * Install the session the store holds, if it holds a usable one: the token + its bound ECDH key, skipping
-     * estimate/key-exchange/login/2FA entirely. Answers the token adopted, or `undefined`.
+     * estimate/key-exchange/login/2FA entirely. Answers the token adopted, or `undefined`. A session logged in
+     * with a country other than the configured one is not usable: its shard is the other country's.
      *
      * Read at construction, and again when a rejection is being recovered from — a store SHARED with another
      * client may already hold the session that client obtained, which is cheaper to adopt than to compete with.
+     * An adopted session is a complete one, so it ends any 2FA or challenged re-login this client was left with.
      *
      * Note: the device identity (openudid + phone model + media UA) is NOT restored here — it is resolved once
      * in the constructor, where an explicit config wins over the stored value, and must not be re-derived from a
@@ -275,6 +281,21 @@ export declare class MegaHttpClient {
     } | undefined;
     /** The active region shard (e.g. `"eu-pr"`, `"us-pr"`), set after {@link login} or a region override. */
     get regionShard(): RegionShard;
+    /**
+     * The shard the RTC signalling signs on: the regional prefix of the estimated domain
+     * (`…-ie-…`/`…-ie.` → `ie-pr`), else {@link regionShard}. The eu/us classification cannot name shards
+     * like `ie-pr`, whose accounts need the IE sign host and cluster.
+     */
+    get rtcShard(): string;
+    /**
+     * The credentials the RTC signalling needs; `undefined` while logged out. The sign is refused
+     * ("gtoken not equal userid") unless its gtoken is the one every authed HTTP call carries.
+     */
+    rtcIdentity(): {
+        authToken: string;
+        userId: string;
+        gtoken: string;
+    } | undefined;
     /**
      * The name commands attribute themselves to — {@link MegaClientConfig.accountName} when the config
      * pins one (trimmed; blank counts as unset), otherwise the logged-in account's display name, which
@@ -367,6 +388,15 @@ export declare class MegaHttpClient {
      * params instead, which also carry `{param_type, param_value, update_time}` and are not owner-gated.
      */
     getDeviceParamList<T = unknown>(deviceSn: string): Promise<T>;
+    /**
+     * Fetch the account's devices as the `devicerelation` service lists them, `{attribute: 7, house_id: ""}`.
+     *
+     * Each entry is `{device: {device_sn, dps, …}}`, and `dps` is the cloud's last-known value of every
+     * data point that device has reported, keyed by DP number. Answered for an account a device is shared
+     * with as well as for its owner. Sent with `category: eufy_home`, without which the service answers
+     * `10000`.
+     */
+    getDeviceRelationList<T = unknown>(): Promise<T>;
     /**
      * Fetch one page of a device's **cleaning history** from the mega `clean` service.
      *
@@ -563,7 +593,9 @@ export declare class MegaHttpClient {
      * Structural rather than a list of paths: a login round trip is itself an authenticated call while a limited
      * token is held, so re-logging in from inside one would recurse — and a path list would have to be
      * maintained alongside every request the login flow makes. A 2FA code already outstanding is a login a human
-     * is part-way through, and restarting it silently would discard it. No credentials means nothing to try,
+     * is part-way through, and restarting it silently would discard it. A re-login that already came back needing
+     * a captcha or a 2FA code would need the same again, and each attempt sends the account another code, so
+     * none is tried until a login completes or a stored session is adopted. No credentials means nothing to try,
      * so the rejection surfaces instead.
      */
     private canReauthenticate;

package/dist/transport/mqtt/broker-discovery.d.ts

@@ -8,8 +8,9 @@ export interface BrokerCredentials {
 }
 export interface ProbeResult {
     ip: string;
-    /** True iff SUBSCRIBE to the target topic was granted (qos 0/1/2, not the 0x80 deny code). */
+    /** True iff SUBSCRIBE to the target topic was granted (qos 0/1/2). */
     granted: boolean;
+    /** The SUBACK return code for the topic, the 0x80 deny code included. */
     grantedQos?: number;
     error?: string;
     ms: number;

package/dist/transport/mqtt/command-router.d.ts

@@ -136,8 +136,9 @@ export declare class MqttCommandRouter {
      * One exception is known: a single garage unit whose own-cert SUBSCRIBE was denied on every candidate
      * while a phone-extracted cert granted on the same one, with a sibling of the same model on the same
      * account granting fine. That is a per-device authorization gap on the vendor's backend, not a
-     * broker-instance problem and not something this SDK works around — such a device reports as offline
-     * (the throw below) until the backend grants the account's own credentials.
+     * broker-instance problem and not something this SDK works around — the throw below names each
+     * candidate's outcome (its SUBACK deny code, a timeout or a connection error) until the backend grants
+     * the account's own credentials.
      *
      * One fresh, explicitly non-reconnecting (`reconnectPeriod: 0`) connection per call — it repays the
      * full mTLS handshake every command and tears the socket down right after (see

package/dist/transport/p2p/codec.d.ts

@@ -111,6 +111,22 @@ export declare function eciesUnwrap(envelope: Buffer, eccPrivateKeyHex: string,
  * Returns the 32-byte key, or undefined if the inputs don't parse.
  */
 export declare function deriveLevel2KeyFromGatewayInfo(gwPayload: Buffer, eccPrivateKeyHex: string): Buffer | undefined;
+/**
+ * Derive the P2P **level-2** AES-128-ECB session key from a *decrypted* `CMD_GATEWAYINFO` (1100)
+ * payload and the RSA private key of a cipher whose `get_ciphers` answer carries no ECC key.
+ *
+ * Layout of the decrypted payload: `cipher_id(2 LE) ‖ 0000 ‖ RSA ciphertext ‖ …`, the ciphertext as
+ * long as the key's modulus. It is the 16-byte session key under PKCS#1 v1.5 encryption padding
+ * (`00 02 ‖ ≥8 non-zero bytes ‖ 00 ‖ key`). The padding is checked here over the raw RSA result so a wrong
+ * key fails closed: under OpenSSL's implicit rejection, `RSA_PKCS1_PADDING` answers random bytes for it
+ * instead of throwing, and those can be 16 bytes long.
+ *
+ * `rsaPrivateKey` is the `get_ciphers` `private_key`: base64 PKCS#8 DER.
+ *
+ * Returns the 16-byte key, or `undefined` when the key does not parse, the payload is short, or the
+ * padding or key length is wrong (fails closed, never throws).
+ */
+export declare function deriveLevel2KeyFromRsaGatewayInfo(gwPayload: Buffer, rsaPrivateKey: string): Buffer | undefined;
 /** Local-lookup payload: two zero bytes. */
 export declare function buildLocalLookupPayload(): Buffer;
 /** Cloud-lookup payload (variant 2): `[p2pDid:20][dskKey][0x00000000]`. */

package/dist/transport/p2p/command-router.d.ts

@@ -1,14 +1,3 @@
-/**
- * P2P command router — the transport-side owner of the ThroughTek PPCS sessions and every wire
- * operation over them: opening sessions, resolving a serial to its session + routing params,
- * mapping a transport-neutral {@link Command} to a concrete frame (encryption level, wire shape),
- * the fire-and-forget control senders, request/reply queries, and the media provider.
- *
- * Layering: this module knows P2P bytes; it does NOT know capabilities. Frame → semantic-event
- * decoding is a model concern, so raw frames are handed back to the client via {@link P2PRouterDeps.onFrame}
- * (the client gates them on device capabilities and emits typed events). This keeps transport free of
- * any `model/` import — the capability↔transport decorrelation invariant.
- */
 import type { MegaHttpClient } from "../http/mega-client.js";
 import type { EufyDevice } from "../../core/types.js";
 import type { Command, AutoLockSnapshot, MediaProvider, SharedSourceHints, AbortableCall } from "../../core/contracts.js";
@@ -119,7 +108,7 @@ export declare class P2PCommandRouter {
      * shared — see {@link P2PCommandRouter.openTalkback}.
      */
     private readonly talkbacks;
-    /** cipher_id → ECC private key (one eufylife get_ciphers call per cipher), shared across (re)opens. */
+    /** cipher_id → its ECC and RSA private keys (one eufylife get_ciphers call per cipher), shared across (re)opens. */
     private readonly cipherKeyCache;
     /** The recording download in flight per station; a station serves one at a time. */
     private readonly recordingDownloads;
@@ -224,7 +213,7 @@ export declare class P2PCommandRouter {
      * Build + wire a {@link P2PSession} for a station (NOT yet connected — the caller awaits `connect()`).
      *
      * `resolveCipherKey` auto-negotiates the level-2 session key from `CMD_GATEWAYINFO` by resolving the
-     * cipher's ECC private key via cloud `get_ciphers`, so signCode 2/8 frames decrypt live; results are
+     * cipher's private keys via cloud `get_ciphers`, so signCode 2/8 frames decrypt live; results are
      * cached on the router instance so a lazy re-open (after idle-detach) reuses the lookup. Only a
      * SUCCESSFUL lookup is cached — caching `undefined` after a transient failure would permanently
      * disable level-2 for the session's life.
@@ -240,11 +229,12 @@ export declare class P2PCommandRouter {
      */
     private makeSession;
     /**
-     * The ECC private key of `cipherId`, from the router's cache or one `get_ciphers` call. When the cloud
-     * answers with another cipher, that one is used and traced on `session`. Only a successful lookup is
-     * cached.
+     * The ECC and RSA private keys of `cipherId` (`ecc_private_key`, `private_key`), from the router's cache
+     * or one `get_ciphers` call. When the cloud answers with another cipher that carries an ECC key and the
+     * asked one does not, that one is used and traced on `session`. Only a successful lookup — one that
+     * yields either key — is cached.
      */
-    private cipherKeyFor;
+    private cipherKeysFor;
     /**
      * Open (or reuse) a station's P2P session and await its completed handshake. An optional abort only
      * stops this wait; session ownership remains with {@link SessionManager} and its normal teardown.
@@ -258,11 +248,14 @@ export declare class P2PCommandRouter {
      */
     dispatchCommand(sn: string, cmd: Command): Promise<void>;
     /**
-     * Restart a HomeBase. `RESTART_HUB` (1034) is a station-scalar on the broadcast channel 255: a
-     * level-2 frame whose body is `[u32 value][account_id padded]` — the same shape as the hub
-     * alarm-volume control. ✅ Wire-confirmed byte-exact from a capture of the app's own Restart
-     * (2026-08-03) and HW-tested: the captured frame carried value `0` and rebooted the hub. Replays
-     * like every other level-2 control, so a single dropped datagram doesn't lose it.
+     * Restart the station that owns `sn`'s P2P session. `RESTART_HUB` (1034) is a station-scalar on the
+     * broadcast channel 255 whose body is `[u32 value][account_id padded]`, value `0`. ✅ Wire-confirmed
+     * byte-exact as a level-2 frame from a capture of the app's own HomeBase Restart (2026-08-03).
+     *
+     * The seal follows the session, as {@link sendBySessionLevel} defines it: a keyed session takes the
+     * level-2 frame, a keyless one — a standalone camera, which never negotiates a key — the same body
+     * sealed level-1. Both are replayed {@link DIRECT_CMD_SENDS}× at 200ms, as every other unacknowledged
+     * control here is.
      */
     rebootStation(sn: string): Promise<void>;
     /**
@@ -308,6 +301,11 @@ export declare class P2PCommandRouter {
      * stream costs nothing extra and a talkback on an otherwise idle camera opens the session it needs
      * instead of playing into silence.
      *
+     * **On a model in {@link ELD_TALKBACK_MODELS}, the speaker plays the codec the camera sends.** So the first
+     * audio frame of the media session this talkback holds decides its codec ({@link speakerCodec}), within
+     * {@link TALKBACK_CODEC_WAIT_MS} of the session's first frame, and the claim is re-checked after that wait as
+     * after the warm-up. Every other model opens `aac-lc` at once.
+     *
      * The level-2 key is waited for softly: only the HomeBase-attached path requires it, and
      * {@link Talkback.start} reports that failure precisely, so a hard wait here would reject an
      * own-session camera that legitimately never negotiates one.
@@ -453,15 +451,6 @@ export declare class P2PCommandRouter {
      * A still with no live sibling re-asserts, so a tile refreshing on a quiet station is
      * unaffected.
      */
-    /**
-     * Attach a consumer, unless the caller has already abandoned the call.
-     *
-     * The acquisition it just waited through can outlast the caller's interest, and a consumer attached for
-     * somebody who has gone keeps the pull warm for nobody. Detaching immediately gives the pull back, which
-     * lets it linger and fall away if this was the only thing holding it, and leaves it untouched if it was
-     * not.
-     */
-    private attachUnlessAborted;
     /**
      * Dispose one cached live source and forget it, so the next acquisition builds a fresh one. Its claim
      * on a session goes with it, and a media session opened for this source alone is closed: nothing else
@@ -521,11 +510,11 @@ export declare class P2PCommandRouter {
      */
     private onLiveStartFailed;
     /**
-     * Replace the session under a warming source whose media start nothing acknowledged, and warm again on it.
+     * Replace the session under a warming source it is not serving, and warm again on it.
      *
      * Only a STANDALONE device's session is replaced, for the reason {@link onLiveStartFailed} gives: an attached
      * camera shares its HomeBase session with every other camera on it, and closing that to recover one would
-     * drop the rest. Such a source keeps the re-issue it always had.
+     * drop the rest. Such a source keeps the re-issue it always had, which the answer (false) tells it.
      *
      * The source is left warming throughout, holding the deadline it started, so this either produces a stream
      * within that window or fails exactly as it would have. A replacement that cannot be opened leaves the
@@ -559,6 +548,7 @@ export declare class P2PCommandRouter {
      */
     p2pQuery(sn: string, subCmd: number, opts?: {
         timeoutMs?: number;
+        payload?: Record<string, unknown>;
     }): Promise<Record<string, unknown>>;
     /**
      * **Generic control-payload request/reply query.** Sends a `CONTROL_PAYLOAD` (1700) `{commandType,
@@ -687,7 +677,7 @@ export declare class P2PCommandRouter {
      * **`set-json-raw` intent** — bare JSON, no envelope: outer P2P cmd = `outerCmd` itself, plaintext
      * exactly `{account_id,...data}` (`session.sendRawLevel2` with no wrapper). Reversed from a live
      * capture of the app's own SET_SNOOZE_TIME (1271) frame — see `param-dictionary.ts`'s `1271` entry
-     * (`snoozeTime`); the alarm-delay config (1255, `arming.ts`'s `ARMING_CMD.ALARM_DELAY_CONFIG`) reuses
+     * (`snoozeTime`); the alarm-delay config (1255, `arming.ts`'s `ARMING_CMD.SET_ALL_ACTION`) reuses
      * the same bare-JSON shape.
      */
     private sendJsonRaw;
@@ -702,7 +692,9 @@ export declare class P2PCommandRouter {
      * HomeBase-attached device takes the GCM signCode-8 form, a standalone one the level-1 form. A
      * standalone camera never negotiates a level-2 key, so pinning this to level 2 makes the envelope
      * unreachable on exactly the devices that serve their own RTSP stream. Verified live: a standalone
-     * camera accepts the level-1 form. With no `form` (default) it stays level-2 only.
+     * camera accepts the level-1 form. With no `form` (default) it stays level-2 only and waits for the
+     * key every level-2 sender uses; `level2Sender: "set-payload"` also takes an RSA cipher's AES-128-ECB
+     * key (see {@link P2PSession.sendControlLevel2}). A `resolved` session keeps the wait its caller gave it.
      *
      * Both seals REPLAY the frame {@link DIRECT_CMD_SENDS}× at 200ms, as every other fire-and-forget
      * control on this router does: these are unacknowledged datagrams, and a level-1 device is the one

package/dist/transport/p2p/fmp4.d.ts

@@ -17,9 +17,12 @@ export declare class Fmp4Muxer {
     private baseDecodeTime;
     private fragTicks;
     private samples;
-    private lastVideoTimestampMs?;
+    /** Ticks from the first video sample's start to the newest sample's end, at its provisional duration. */
+    private videoTicks;
     private readonly audioRequested;
     private audioCodec?;
+    /** Decoder config of an AAC-ELD track, taken from its frames; absent for AAC-LC, whose `esds` config is fixed. */
+    private audioConfig?;
     private audioDisabled;
     private audioSamples;
     private audioBaseDecodeTime;
@@ -35,9 +38,16 @@ export declare class Fmp4Muxer {
      * Push one access unit. Returns any completed segments: the `init` on the first keyframe, and/or a
      * media fragment when this frame closed the open one. Returns `undefined` if nothing is emitted yet
      * (e.g. delta frames before the first keyframe).
+     *
+     * A sample lasts until the next frame's `timestampMs`, measured from the first keyframe's, so the video
+     * timeline follows the arrival clock; a frame that shares the previous one's timestamp leaves that
+     * sample one tick long, and the next frame's duration absorbs the difference.
      */
     push(frame: LiveVideoFrame, timestampMs?: number): MediaFragment | undefined;
-    /** Add one station-declared AAC access unit to the audio track. G.711 remains available via `live()`. */
+    /**
+     * Add one station-declared AAC access unit to the audio track: an ADTS frame for AAC-LC, a raw access unit
+     * described by its frame's config for AAC-ELD. G.711 remains available via `live()`.
+     */
     pushAudio(frame: LiveAudioFrame, timestampMs?: number): MediaFragment | undefined;
     /** Permanently omit incompatible audio while allowing the video recording to continue. */
     private disableAudio;

package/dist/transport/p2p/live-trace.d.ts

@@ -118,11 +118,19 @@ export type LiveTrace =
     phase: "level2-wait";
     waitMs: number;
 }
-/** The station's level-2 key was negotiated, under the cipher it selected. */
+/** The station's AES-256-GCM level-2 key was negotiated, under the cipher it selected. */
  | {
     phase: "level2-ready";
     cipherId: number;
 }
+/**
+ * The station's cipher negotiated only the AES-128-ECB level-2 key of an RSA cipher, under the cipher it
+ * selected. That key seals a level-2 set-payload and nothing else, so this is not `level2-ready`.
+ */
+ | {
+    phase: "level2-set-payload-only";
+    cipherId: number;
+}
 /**
  * The station's key is not coming, why, and the cipher where a station named one.
  *
@@ -145,7 +153,8 @@ export type LiveTrace =
  * A station's cipher was answered with material for a DIFFERENT cipher, which was used in its place.
  *
  * The one lookup outcome no other phase accounts for: material for the cipher the station named is followed
- * by `level2-ready` or by `level2-unavailable` with `derivation-failed`, an answer holding none by
+ * by `level2-ready`, `level2-set-payload-only` or `level2-unavailable` with `derivation-failed`, an answer
+ * holding none by
  * `no-cipher-key`, and a lookup that threw is reported as an error. Substituted material derives to
  * nothing and otherwise reads as a station fault. `cipherId` is the cipher the station asked for,
  * `answeredCipherId` the one whose material was used.