@mega-yfue/eufy-sdk 0.5.0-beta.9 → 0.5.0-beta.91

package/dist/transport/p2p/p2p-session.d.ts

@@ -46,12 +46,18 @@ export interface P2PSessionConfig {
     /** Disable UDP broadcast local lookup (e.g. cloud-only). Default false. */
     noBroadcast?: boolean;
     /**
-     * Resolve a station `cipher_id` → its ECC private key hex (from cloud `get_ciphers`). When
-     * provided, the session auto-negotiates the **level-2** session key on connect: it reads the
-     * `cipher_id` + ECIES envelope from the `CMD_GATEWAYINFO` reply, derives the key, and calls
-     * `setLevel2Key()` — so signCode 2/8 frames (camera info, event DB, event images) decrypt live.
-     */
-    resolveCipherKey?: (cipherId: number) => Promise<string | undefined>;
+     * Resolve a station `cipher_id` → its private keys (from cloud `get_ciphers`): `ecc`, the ECC private
+     * key hex (`ecc_private_key`), and `rsa`, the RSA private key (`private_key`). A plain string is the ECC key. Called once per
+     * negotiation. When provided, the session auto-negotiates the **level-2** session key on connect: it
+     * reads the `cipher_id` + envelope from the `CMD_GATEWAYINFO` reply and derives the key. With an ECC
+     * key that is the ECIES unwrap and `setLevel2Key()` — so signCode 2/8 frames (camera info, event DB,
+     * event images) decrypt live. A cipher with no ECC key carries the key RSA-encrypted instead, and only
+     * {@link P2PSession.sendControlLevel2} seals with it.
+     */
+    resolveCipherKey?: (cipherId: number) => Promise<string | {
+        ecc?: string;
+        rsa?: string;
+    } | undefined>;
     /** Diagnostics sink. Omit for silence. */
     logger?: Logger;
 }
@@ -149,6 +155,12 @@ export declare class P2PSession extends EventEmitter {
     private readonly level1Key;
     /** Negotiated 32-byte level-2/gateway key (AES-256-GCM). Set via setLevel2Key once known. */
     private level2Key?;
+    /**
+     * Negotiated 16-byte level-2 key of a cipher with no ECC key (RSA-encrypted in `CMD_GATEWAYINFO`). Only
+     * {@link sendControlLevel2} seals with it, AES-128-ECB in the level-1 layout at encryption type 2; never
+     * held beside {@link level2Key}.
+     */
+    private level2EcbKey?;
     private level2Seq;
     private rsaPrivateKey?;
     private rsaModulusHex?;
@@ -173,6 +185,10 @@ export declare class P2PSession extends EventEmitter {
      * change (the level-2 key arrived after an initial level-1 start), otherwise sends the 1139 nudge.
      */
     private readonly liveStartedChannels;
+    /** The `cipher_id` this connection's `CMD_GATEWAYINFO` reply named, once its negotiation has read it. */
+    private gatewayCipherId?;
+    /** The `n` of the last `[0x01, n]` header this connection sent in the clear — see {@link nextClearCommandBytes}. */
+    private clearCommandCount;
     private readonly unackedLiveStarts;
     private liveStartRetransmitTimer?;
     private readonly logger;
@@ -204,10 +220,18 @@ export declare class P2PSession extends EventEmitter {
     private trace;
     /** Provide the negotiated 32-byte session key so level-2 (signCode 2/8) frames can be decrypted. */
     setLevel2Key(key: Buffer): void;
-    /** Whether the level-2 session key has been negotiated/set. */
+    /** Whether the AES-256-GCM level-2 session key has been negotiated/set. */
     get hasLevel2Key(): boolean;
+    /**
+     * Whether the held level-2 key can frame for `sender`: every level-2 sender needs the AES-256-GCM key,
+     * and `"set-payload"` ({@link sendControlLevel2}) also takes the AES-128-ECB key of an RSA cipher.
+     */
+    private level2KeyServes;
     /**
      * Resolve with whether a level-2 key is available, waiting only while waiting can still change that.
+     * `sender` names who will frame with it: by default every level-2 sender, which needs the AES-256-GCM
+     * key; `"set-payload"` is {@link sendControlLevel2} alone, which also takes the AES-128-ECB key of an RSA
+     * cipher, so `true` for it does not imply {@link hasLevel2Key}.
      *
      * A `"session"` grace is measured once, not restarted per call. Best-effort media uses it because every
      * egress asks this same session and can proceed without the key on an own-session camera; a per-call
@@ -232,7 +256,7 @@ export declare class P2PSession extends EventEmitter {
      * `terminal` outcome is the one already stated where the negotiation concluded, since that is where the
      * cipher and the cause are known, and re-stating it here would double every settled negotiation.
      */
-    awaitLevel2Key(graceMs: number, graceFrom?: "call" | "session"): Promise<boolean>;
+    awaitLevel2Key(graceMs: number, graceFrom?: "call" | "session", sender?: "every" | "set-payload"): Promise<boolean>;
     /**
      * Ask the station for its gateway info a second time, re-opening a negotiation that concluded without a key.
      *
@@ -253,9 +277,12 @@ export declare class P2PSession extends EventEmitter {
     private settleLevel2;
     /**
      * Negotiate the level-2 session key from the decrypted CMD_GATEWAYINFO payload: read its
-     * `cipher_id`, resolve that cipher's ECC private key (cloud `get_ciphers`, via the configured
-     * `resolveCipherKey`), run the ECIES unwrap, and `setLevel2Key()`. One-shot; emits `level2Ready`
-     * on success and `error` on failure (non-fatal — level-1 traffic keeps working regardless).
+     * `cipher_id`, resolve that cipher's private keys once (cloud `get_ciphers`, via the configured
+     * `resolveCipherKey`), run the ECIES unwrap with the ECC key, and `setLevel2Key()`. A cipher with no
+     * ECC key uses its RSA key instead and holds the RSA-decrypted 16-byte key as the AES-128-ECB level-2
+     * key. One-shot; emits `level2Ready` only when the AES-256-GCM key is negotiated, traces
+     * `level2-set-payload-only` instead for the AES-128-ECB key, and emits `error` on failure
+     * (non-fatal — level-1 traffic keeps working regardless).
      *
      * Every outcome settles the wait in {@link awaitLevel2Key}, because being one-shot is what makes a
      * failure final for this connection generation: nothing will retry it there, so a later command must be
@@ -373,6 +400,9 @@ export declare class P2PSession extends EventEmitter {
      * `video_type` is 12, and `transaction` is the millisecond timestamp as a string. The device answers a
      * start carrying these values with a keyframe; `encryptkey` is the modulus it RSA-wraps each keyframe's
      * AES media key with (unwrapped by {@link decodeVideoFrame}).
+     *
+     * With `clearMsgId`, the body of a start sent in the clear: `{accountId, encryptkey, msg_id, streamtype: 1}`
+     * only, `msg_id` being `clearMsgId`, which changes from one start to the next.
      */
     private startLiveJson;
     /**
@@ -380,8 +410,20 @@ export declare class P2PSession extends EventEmitter {
      * (GCM, signCode 8, frame type 10) when the session has a negotiated key, else level-1 (AES-128-ECB,
      * signCode 1, frame type 11) — chosen by the session key, not the device family. The camera RSA-wraps
      * each keyframe's AES media key with the `encryptkey` modulus (unwrapped by {@link decodeVideoFrame}).
+     * A session that {@link sendsInTheClear} sends it unencrypted instead: signCode 0, frame type 0, header
+     * bytes `[0x01, n]` from {@link nextClearCommandBytes}, and `n` as the body's `msg_id`.
      */
     private sendStartLiveOwnSession;
+    /**
+     * Whether this session's own-session start and stop go in the clear: its `CMD_GATEWAYINFO` reply named
+     * `cipher_id` 0.
+     */
+    private sendsInTheClear;
+    /**
+     * Header bytes 10-11 of this connection's next command sent in the clear: `[0x01, n]`, with `n` counting
+     * those commands from 1 and never 0. A retransmit repeats its `n`, and the device's reply echoes it.
+     */
+    private nextClearCommandBytes;
     /**
      * Repeat unacknowledged own-session live starts until the device takes one. Runs only while a start is
      * outstanding.
@@ -421,6 +463,10 @@ export declare class P2PSession extends EventEmitter {
      * mechanism proven for camera selection in media start. Use for control commands routed through a
      * HomeBase (where level-1 ECB is rejected). Returns `false` if the level-2 key isn't negotiated
      * yet (caller can fall back to {@link sendStringPayloadCommand}).
+     *
+     * On a session holding only the AES-128-ECB level-2 key of an RSA cipher, the frame is the level-1
+     * layout ({@link sendRawLevel1Bytes}) sealed under that key at encryption type 2: the encryption-type
+     * byte names the key the body is sealed with (1 = level-1 key, 2 = the negotiated key).
      */
     sendControlLevel2(cmd: number, channel: number, accountId: string, payload: Record<string, unknown>, mValue3?: number): boolean;
     /**
@@ -448,6 +494,8 @@ export declare class P2PSession extends EventEmitter {
      *    `uint32`, the same 4-byte body as the attached talkback frames. The app sends this frame on closing
      *    an own-session camera's live view; the camera stops streaming on it within a second, and keeps
      *    streaming through the 1350-wrapped form.
+     *  - own-session on a session that {@link sendsInTheClear}: the same 4-byte body unencrypted, signCode 0,
+     *    header bytes from {@link nextClearCommandBytes}.
      *  - without a level-2 key: the bare 1004 command.
      */
     stopLiveMedia(channel?: number, accountId?: string, homeBaseAttached?: boolean): void;
@@ -611,6 +659,18 @@ export declare class P2PSession extends EventEmitter {
         accountId?: string;
         channel?: number;
     }): void;
+    /**
+     * Read a date-ranged page of `history_record_info` from the station. The reply's `data` array groups
+     * recording rows with companion tables; each group retains its `table_name` and `payload`.
+     * `startTime` is `"0"` for the newest page or the oldest row's `yyyyMMddHHmmss` cursor for older rows.
+     */
+    queryRecordPage(opts: {
+        accountId?: string;
+        startDate: string;
+        endDate: string;
+        startTime?: string;
+        count?: number;
+    }): Promise<unknown[]>;
     /**
      * Query one on-station table and answer its rows, once the reply is whole.
      *
@@ -618,13 +678,15 @@ export declare class P2PSession extends EventEmitter {
      * several frames whose decrypted text is a fragment of one document, so the fragments are
      * accumulated here and scanned after each one. Answers that document's `data` rows. Rejects when
      * `signal` aborts, and when `timeoutMs` (default {@link DB_TABLE_TIMEOUT_MS}) elapses with no
-     * complete reply.
+     * complete reply, and when the station answers a non-zero `mIntRet`.
      *
      * One read at a time per session: while one is accumulating, every {@link queryDatabase} on the
      * session throws, so a second reply cannot land in this buffer.
      */
     readDatabase(table: string, opts?: {
         accountId?: string;
+        innerCmd?: number;
+        query?: Record<string, unknown>;
         timeoutMs?: number;
         signal?: AbortSignal;
     }): Promise<unknown[]>;
@@ -644,6 +706,10 @@ export declare class P2PSession extends EventEmitter {
      * Low-level: send a `CMD_SET_PAYLOAD` (1350) wrapping `{account_id, cmd:<subCmd>, mChannel,
      * payload, transaction}` over the level-1 channel. The reply arrives as a `NOTIFY_PAYLOAD`
      * (1351) frame (level-1 decrypted, surfaced via the `data` event / `frame.json`).
+     *
+     * `opts.key` makes it a keyed envelope: the sealed per-command key rides ahead of the other fields
+     * as the value's `key`, and the value goes out unencrypted, encryption-type 0, with `=` written
+     * `=` — the form the vendor app sends one in, and the one form the device reads it in.
      */
     sendSetPayload(subCmd: number, payload?: unknown, opts?: {
         accountId?: string;
@@ -651,6 +717,7 @@ export declare class P2PSession extends EventEmitter {
         omitPayload?: boolean;
         wrapCmd?: number;
         rawValue?: Record<string, unknown>;
+        key?: string;
     }): void;
     /**
      * Request the on-device edge-AI face roster over P2P. `COMMAND_GET_LOCAL_FACES` (1194) =
@@ -704,6 +771,7 @@ export declare class P2PSession extends EventEmitter {
      * Frames are packed back to back, so a frame header can itself be cut by a datagram boundary. The start
      * of a header left at the end of a datagram is carried into the next one rather than discarded; dropping
      * it would lose that frame and every frame after it until a datagram happened to begin on a header.
+     * Payload fragments retain their original slices and are copied once, when the complete frame is delivered.
      */
     private reassemble;
     /**
@@ -718,5 +786,6 @@ export declare class P2PSession extends EventEmitter {
     private ackTypeHeader;
     private handleFrame;
     private send;
+    /** Finish the END send on the current socket before closing it; send completion is not a peer ACK. */
     close(): Promise<void>;
 }

package/dist/transport/p2p/readable-egress.d.ts

@@ -17,11 +17,14 @@ import type { Consumer } from "./shared-live-source.js";
 export interface ReadableEgressOptions {
     /** Emit {@link LiveVideoFrame} objects instead of raw Annex-B bytes (default false = bytes). */
     objectMode?: boolean;
+    /** Yield ReceivedVideoFrame envelopes with original source-arrival times; ignored in raw mode. */
+    arrivalTime?: boolean;
     /** Readable highWaterMark (bytes, or object count in objectMode). */
     highWaterMark?: number;
 }
 /**
  * Wrap a shared-source {@link Consumer} in a fresh Readable. The consumer is detached when the
  * Readable is destroyed/ended, so callers own the lifetime by owning the stream.
+ * Frames arrive through onMedia, preserving their source-arrival metadata.
  */
 export declare function openReadableFromConsumer(consumer: Consumer, opts?: ReadableEgressOptions): Readable;

package/dist/transport/p2p/recording-download.d.ts

@@ -46,9 +46,10 @@ export declare function receiveRecording(session: P2PSession, request: {
     signal?: AbortSignal;
 }): RecordingTransfer;
 /**
- * Decode a recording's frames, in arrival order, into elementary streams. Keyframes go through one
- * {@link VideoFrameDecoder}, whose media key then opens the audio; a keyframe that does not open under
- * `eccPrivateKeyHex`, and every audio frame before the first media key, are dropped. Rejects with
+ * Decode a recording's frames, in arrival order, into elementary streams. Split pictures are assembled
+ * before they enter the output; an orphan continuation cannot become its own picture. Keyframes go
+ * through one {@link VideoFrameDecoder}, whose media key then opens the audio; a keyframe that does not
+ * open under `eccPrivateKeyHex`, and every audio frame before the first media key, are dropped. Rejects with
  * {@link RecordingDownloadError} `undecodable` when no video frame decodes.
  */
 export declare function decodeRecording(frames: readonly RecordingFrame[], eccPrivateKeyHex: string): RecordingDownload;

package/dist/transport/p2p/shared-live-source.d.ts

@@ -83,19 +83,19 @@ export interface SharedLiveSourceOptions {
      */
     onStopped?: () => void;
     /**
-     * A media start was abandoned unacknowledged before anything was delivered, so this session is not being
-     * heard. The owner is asked for a replacement and calls {@link SharedLiveSource.rewarm} once it has one.
+     * This session is not serving the warm-up: a media start was abandoned unacknowledged, or forced starts went
+     * unanswered by any media, before anything was delivered. The owner answers whether it is replacing the
+     * session, and calls {@link SharedLiveSource.rewarm} once it has the replacement.
      *
-     * Asked at most once per warm-up: further abandonments are the same session saying the same thing.
+     * Asked at most once per warm-up: further evidence is the same session saying the same thing.
      */
-    onSessionUnreachable?: () => void;
+    onSessionUnreachable?: () => boolean;
 }
 /**
  * A single consumer of a {@link SharedLiveSource}. A {@link LiveStreamConsumer} (so `live()` can hand it
  * back directly), plus the listener removal and arrival-timed feed the recording and readable egresses use.
  */
 export interface Consumer extends LiveStreamConsumer {
-    /** What this consumer holds the pull for. */
     /** Detach a previously registered listener (mirrors {@link LiveStreamHandle.on}). */
     off(event: "video", listener: (frame: LiveVideoFrame) => void): this;
     off(event: "audio", listener: (frame: LiveAudioFrame) => void): this;
@@ -103,18 +103,14 @@ export interface Consumer extends LiveStreamConsumer {
     off(event: "error", listener: (err: Error) => void): this;
     /** Subscribe to frames carrying the source-captured arrival time used by the prebuffer. */
     onMedia(listener: (item: TimedMediaFrame) => void): this;
-    /** True once the source has replayed a cached keyframe to this consumer (no GOP wait on join). */
-    readonly primed: boolean;
     /** Leave the source (refcount--). Idempotent. `stop()` is an alias (LiveStreamHandle). */
     detach(): void;
 }
 /**
  * One media frame retained with its transport-arrival time for prebuffer continuity.
  *
- * A video frame carries the coded configuration in force when it ARRIVED, because the item outlives that
- * moment: it is the unit a keyframe-prime replays to a consumer that joined later and the unit a prebuffer
- * drain hands over, and both have to announce the configuration their media was coded under rather than
- * whichever one is current by the time they are delivered.
+ * A video frame carries the coded configuration in force when it arrived, so a prebuffer drain
+ * announces the configuration its retained media was coded under.
  */
 export type TimedMediaFrame = {
     kind: "video";
@@ -144,8 +140,8 @@ export declare class SharedLiveSource {
      * {@link LiveStreamStartError}.
      */
     private delivered;
-    /** Last keyframe access unit seen — replayed to a joining consumer (keyframe-prime). */
-    private lastKeyframe?;
+    /** Whether the upstream has delivered a keyframe since its last teardown. */
+    private hasKeyframe;
     /** Last parameter sets the stream announced — see {@link parameterSets}. */
     private lastParamSets?;
     /**
@@ -163,14 +159,7 @@ export declare class SharedLiveSource {
     private warmRetryTimer?;
     /** Whether this warm-up has already asked its owner to replace the session. */
     private sessionReplacementAsked;
-    /**
-     * Whether the pending watch is a REUSE watch, which any frame settles.
-     *
-     * A cold warm-up needs a keyframe: nothing can be decoded without one. A join already holds the retained
-     * keyframe, so what its watch is missing is evidence the stream is still being served — and a delta frame is
-     * that evidence. Requiring a keyframe there let the deadline outlive an actively delivering stream whose
-     * group of pictures is longer than the window, and the timeout fails EVERY consumer.
-     */
+    /** A reuse watch settles on upstream media independently of each consumer's keyframe gate. */
     private reuseWatch;
     /** This source's opaque handle for tracing — see {@link SharedLiveSource.trace}. */
     private readonly traceId;
@@ -178,8 +167,8 @@ export declare class SharedLiveSource {
      * How many re-issues this watch has spent with nothing arriving since it was armed.
      *
      * What a stream delivered BEFORE the current watch is no evidence about now — a reused stream's upstream may
-     * have served plenty and since been dropped by the station, and the retained keyframe replayed to a joining
-     * consumer says nothing either. Only a frame arriving after the watch was armed does, and {@link delivered}
+     * have served plenty and since been dropped by the station. Only a frame arriving after the watch was
+     * armed proves current delivery, and {@link delivered}
      * is reset to track exactly that.
      *
      * The first re-issue is therefore a keepalive: a reuse cannot yet know which case it is in, and a keepalive
@@ -219,13 +208,13 @@ export declare class SharedLiveSource {
     get parameterSets(): ParamSets | undefined;
     /**
      * Attach a new consumer. Warms the stream on the first attach (or cancels a pending linger teardown
-     * and reuses the warm stream), then replays the cached keyframe so the consumer can decode at once.
+     * and reuses the warm stream). Delivery starts at the next live keyframe so every dependent
+     * picture follows its reference pictures without a gap from a cached keyframe.
      */
     attach(): Consumer;
     /**
      * Attach at the same instant a keyframe-aligned prebuffer snapshot is taken. The returned consumer
-     * is not separately keyframe-primed, so replaying `buffered` followed by its live events neither
-     * duplicates the newest IDR nor leaves a gap at the handoff.
+     * continues after `buffered` without waiting for another keyframe or duplicating the newest IDR.
      */
     attachWithPrebuffer(seconds: number): {
         consumer: Consumer;
@@ -251,18 +240,17 @@ export declare class SharedLiveSource {
      */
     private warm;
     /**
-     * A start was abandoned unacknowledged. Ask for a replacement session where nothing has been delivered yet.
+     * Ask the owner for a replacement session where nothing has been delivered yet, answering whether one is coming.
      *
-     * The abandonment is roughly twenty byte-identical sends with no reply, against acknowledgement latencies of
-     * 4–37 ms awake and 238 ms waking, so it is the session that is not being heard rather than a slow device —
-     * `P2PSession` says as much: the camera was never told to stream, so this warm-up can only time out. Where
-     * media has already flowed the abandonment means something else and this does nothing.
+     * An unacknowledged start is roughly twenty byte-identical sends with no reply, against acknowledgement latencies
+     * of 4–37 ms awake and 238 ms waking, so it is the session that is not being heard rather than a slow device: the
+     * camera was never told to stream. Where media has already flowed the abandonment means something else and this
+     * does nothing. The DEADLINE is left running: the window belongs to the attempt, not to the session it started on.
      *
-     * The retry ticker is stopped while a replacement is awaited, because every tick it issues goes to the same
-     * unheard session. The DEADLINE is left running: the window belongs to the attempt, not to the session it
-     * started on.
+     * The retry ticker is stopped only once the owner has said it is replacing the session: an owner that cannot
+     * (an attached camera shares its HomeBase session) leaves the source re-issuing as it always did.
      */
-    private onStartUnacknowledged;
+    private askForFreshSession;
     /**
      * Warm again on a session the owner has replaced, inside the deadline the first attempt started.
      *
@@ -290,27 +278,17 @@ export declare class SharedLiveSource {
      * {@link fruitlessReissues} for why one is not enough and why what the stream delivered earlier is not
      * evidence. Once media arrives the keepalive is what is wanted, and an attached camera re-sends a full start
      * either way.
+     *
+     * A forced start that a whole interval later has still produced nothing is a session that acknowledges and
+     * does not serve: a fresh session on the same camera delivers a keyframe within a second, so a warm-up asks
+     * for one rather than forcing starts onto this one until its deadline. Wired only: a cold battery camera is
+     * slow rather than deaf, measured at about 8 s to first media, and replacing its session would cost a wake.
      */
     private reissueStart;
     /**
-     * Watch a stream this consumer joined rather than warmed, so a dead one cannot pass for a live one.
-     *
-     * A reused stream hands a joining consumer the retained keyframe at once, which is evidence about the past:
-     * it says the stream WAS being served, not that it still is. A caller commits to media on that frame — a
-     * process, a negotiated session — so a stream the station has quietly stopped serving strands it with no
-     * deadline, because warming is what arms one and a reuse skips warming by definition.
-     *
-     * The watch is the warm-up's own, deadline and retry alike, and the first frame to arrive AFTER the join
-     * clears it, that being the only frame which says the stream is still being served. A stream still serving
-     * clears it long before the deadline fires; one that is not fails its consumers exactly as a cold start that
-     * never delivered would.
-     *
-     * The start is re-issued at once and then on the retry's cadence, because a station that stopped serving a
-     * channel when its last consumer left is the very case the retry recovers: waiting the whole window to
-     * report what one re-issued start can fix is a timeout where a stream was available.
-     *
-     * Nothing is armed while a watch is already pending, so several consumers joining one reused stream share the
-     * watch the first of them started.
+     * Watch an existing upstream with the warm-up retry and deadline. Any video or audio received after
+     * the watch begins confirms delivery and settles it. Each consumer's keyframe gate remains separate.
+     * Concurrent joins share a pending watch; the first join reissues the start immediately.
      */
     private watchReusedStream;
     /** Arm the battery budget timer (battery/solar sources) — replaces any pending budget/grace. */
@@ -323,7 +301,7 @@ export declare class SharedLiveSource {
     private onBudgetExpire;
     /** Re-push the battery budget (host called `extend()` from the notice), cancelling the auto-stop. */
     private extendBudget;
-    /** Settle a reuse watch on any frame — the join already holds a decodable picture. */
+    /** Settle a reuse watch on any upstream frame without changing consumer keyframe gates. */
     private settleReuseWatch;
     /** Stop the warm-up retry + deadline (the stream is confirmed live). */
     private clearWarmWatch;
@@ -338,7 +316,8 @@ export declare class SharedLiveSource {
      * at all, audio without a single video frame, or access units a decoder cannot begin at.
      *
      * Video takes precedence when both arrived: audio alongside video says nothing a caller needs, while video
-     * without a keyframe does.
+     * without a keyframe does. Every failed start is built here, so this is where its `start-failed` trace is
+     * emitted.
      */
     private startFailure;
     private onVideo;
@@ -404,7 +383,7 @@ export declare class SharedLiveSource {
     /** Refcount hit zero — arm the linger teardown. A new attach in the window cancels it. */
     private arm;
     /**
-     * Stop + drop the underlying stream and clear the prime/ring caches. Rebuildable via attach().
+     * Stop + drop the underlying stream and clear the keyframe/ring caches. Rebuildable via attach().
      *
      * The stream reference is dropped BEFORE stopping it, because `stop()` emits `"stop"` synchronously and
      * this source listens for that — so stopping re-enters `teardown` through {@link onUpstreamEnd}. Clearing
@@ -438,3 +417,12 @@ export declare class SharedLiveSource {
      */
     dispose(): void;
 }
+/**
+ * Attach a consumer, unless the caller has already abandoned the call.
+ *
+ * The acquisition it just waited through can outlast the caller's interest, and a consumer attached for
+ * somebody who has gone keeps the pull warm for nobody. Detaching immediately gives the pull back, which
+ * lets it linger and fall away if this was the only thing holding it, and leaves it untouched if it was
+ * not.
+ */
+export declare function attachUnlessAborted(source: SharedLiveSource, signal?: AbortSignal): Consumer;

package/dist/transport/p2p/talkback.d.ts

@@ -1,10 +1,12 @@
 /**
- * Managed talkback session over P2P — the send-side twin of `live-stream.ts`. Takes AAC-LC audio from
- * a host, recovers frame boundaries, and paces the frames onto the wire at their own playback rate,
- * bracketed by the device's start/stop control frames.
+ * Managed talkback session over P2P — the send-side twin of `live-stream.ts`. Takes audio from a host in
+ * the codec the camera's speaker plays (AAC-LC ADTS, or raw AAC-ELD access units), recovers frame
+ * boundaries, and paces the frames onto the wire at their own playback rate, bracketed by the device's
+ * start/stop control frames.
  *
  * Pacing is the reason this exists rather than a bare `sendAudioFrame` loop. Each AAC-LC frame at
- * 16 kHz is 1024 samples — exactly 64 ms of audio — and the device plays what arrives when it arrives.
+ * 16 kHz is 1024 samples — exactly 64 ms of audio — and each AAC-ELD access unit is 512 samples, 32 ms.
+ * The device plays what arrives when it arrives.
  * A host piping a file would otherwise deliver a minute of audio in a few hundred milliseconds and
  * lose all but the tail. A live source paces itself and simply keeps the queue near-empty.
  *
@@ -17,7 +19,7 @@
  */
 import { EventEmitter } from "node:events";
 import { Writable } from "node:stream";
-import type { AacEncoder, StreamBudgetNotice, TalkbackHandle } from "../../core/contracts.js";
+import type { AacEncoder, StreamBudgetNotice, TalkbackCodec, TalkbackHandle } from "../../core/contracts.js";
 import { type Logger } from "../../core/logger.js";
 /**
  * The subset of the session this needs — start/stop the path, push one frame, and report a frame the
@@ -66,7 +68,7 @@ export interface TalkbackOptions {
 export declare const DEFAULT_IDLE_TIMEOUT_MS = 30000;
 /**
  * A talkback session bound to one camera channel. Opens the device's path on construction via
- * {@link start}, then drains queued frames on a fixed 64 ms tick until {@link stop}.
+ * {@link start}, then drains queued frames on a tick of one frame's duration until {@link stop}.
  */
 export declare class Talkback extends EventEmitter implements TalkbackHandle {
     private readonly sink;
@@ -74,7 +76,8 @@ export declare class Talkback extends EventEmitter implements TalkbackHandle {
     private readonly reader;
     private readonly queue;
     private readonly logger;
-    private readonly highWater;
+    /** Playback duration of one queued frame, the pacer's step: 64 ms for `aac-lc`, 32 ms for `aac-eld`. */
+    private frameMs;
     private readonly idleTimeoutMs;
     private timer?;
     private started;
@@ -94,17 +97,24 @@ export declare class Talkback extends EventEmitter implements TalkbackHandle {
     private chain;
     private readonly onAudioGap;
     constructor(sink: TalkbackSink, opts: TalkbackOptions);
+    /** Frames the pacing queue holds before a writable applies backpressure: {@link HIGH_WATER_MS} of this codec. */
+    private get highWater();
+    /** The codec this talkback sends, set by {@link start}. */
+    codec: TalkbackCodec;
     /** Frames still queued for the wire. */
     get pending(): number;
     /**
      * Open the device's talkback path and begin the pacing tick. Throws when the topology's control
      * frame could not be sent — for a HomeBase-attached camera that means the level-2 key was never
      * negotiated, which would otherwise leave a silent session that accepts audio nobody hears.
+     *
+     * `codec` is the codec the camera's speaker plays; it fixes the input this talkback accepts and the pacing step.
      */
-    start(): this;
+    start(codec: TalkbackCodec): this;
     /**
-     * Queue audio. Bytes are ADTS AAC, or PCM when an encoder was supplied; either way the input is
-     * treated as a stream, so a chunk carrying part of a frame is held until the rest arrives.
+     * Queue audio in the codec this talkback sends. For `aac-lc` the bytes are ADTS, or PCM when an encoder was
+     * supplied, read as a stream, so a chunk carrying part of a frame is held until the rest arrives. For `aac-eld`
+     * each call is one whole access unit; a unit over the device's length limit is dropped with an `error`.
      *
      * Audio written after {@link end} is dropped with an `error` rather than queued: `finished` has
      * either already fired or is owed on the frames written before it, so a late chunk would either play
@@ -160,6 +170,7 @@ export declare class Talkback extends EventEmitter implements TalkbackHandle {
     /**
      * A Writable over {@link write} that withholds its callback while the queue is at the high-water
      * mark — which is what turns `pipe()` from a file into playback at speed rather than a memory spike.
+     * For `aac-eld` it is object-mode: each write is one access unit.
      */
     writable(): Writable;
     /** Drain an encoder's partial trailing block, so the last syllable is not lost. */

package/dist/transport/p2p/video.d.ts

@@ -71,6 +71,8 @@ export declare class VideoFrameDecoder {
 }
 /** One whole access unit recovered from the frame (or frames) the station sent it in. */
 export interface AssembledAccessUnit {
+    /** Unsigned 32-bit header timestamp from the first frame of this access unit. */
+    sourceTimestamp: number;
     /** True when the unit's own header flagged it a keyframe — a point a consumer may begin decoding at. */
     keyframe: boolean;
     /** Frame width the unit's header declared. */

package/dist/transport/push/push-client.d.ts

@@ -32,6 +32,11 @@ export declare class PushClient extends EventEmitter {
     private closing;
     /** Consecutive MCS login rejections — transient ones self-heal via reconnect (see {@link onMessage}). */
     private loginFailures;
+    /**
+     * How many of {@link persistentIds} the last `LoginRequest` reported; a successful `LoginResponse`
+     * acknowledges them, so they are dropped then.
+     */
+    private reportedIds;
     constructor(creds: FcmCredentials, logger?: Logger);
     /** Persistent ids already seen (set this from storage to avoid re-delivery). */
     setPersistentIds(ids: string[]): void;

package/dist/transport/rtc/call-live.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Live view of a T8223 doorbell (Video Doorbell C31) over a portal `call` {@link RtcSession}.
+ *
+ * The doorbell is its own station and streams no PTCS framing: its video arrives as plain RTP on the
+ * offer's H.264 video m-line, which a {@link RtcPeerOptions.mediaTrack} peer hands over as `rtp`. This
+ * stream depacketizes it into whole Annex-B access units, one per frame. Each stream owns its session:
+ * starting it places the call, stopping it hangs up.
+ */
+import { EventEmitter } from "node:events";
+import type { LiveStreamHandle } from "../../core/contracts.js";
+import { type Logger } from "../../core/logger.js";
+import type { RtcSession } from "./session.js";
+/**
+ * H.264 RTP depacketizer (RFC 6184 single NAL / STAP-A / FU-A). Feed whole RTP packets; it calls `onUnit`
+ * with each complete Annex-B access unit when the marker bit closes it. A unit with a sequence gap or an
+ * unterminated fragment is dropped, never delivered short. RTCP multiplexed on the same transport (PT
+ * 200-207, which reads as 72-79 in the RTP payload-type bits) is skipped.
+ */
+export declare class H264Depacketizer {
+    private readonly onUnit;
+    private nals;
+    private fu;
+    private lastSeq;
+    private broken;
+    constructor(onUnit: (unit: Buffer, timestamp: number) => void);
+    push(packet: Buffer): void;
+}
+/** A `LiveStreamHandle` over one portal `call` to a T8223 doorbell. */
+export declare class RtcCallLiveStream extends EventEmitter implements LiveStreamHandle {
+    private readonly session;
+    private readonly logger;
+    private running;
+    private readonly depacketizer;
+    /** `session` is a session on a {@link RtcPeerOptions.mediaTrack} peer, not yet connected. */
+    constructor(session: RtcSession, logger?: Logger);
+    start(): this;
+    stop(): void;
+    private onUnit;
+    private fail;
+    private teardown;
+}