@mega-yfue/eufy-sdk 0.6.0-beta.13 → 0.6.0-beta.15

package/dist/index.js

@@ -106,8 +106,9 @@ function encryptLoginPassword(password) {
 }
 
 // dist/core/store.js
-import { mkdirSync, readFileSync, writeFileSync, rmSync } from "node:fs";
-import { dirname } from "node:path";
+import { randomUUID } from "node:crypto";
+import { lstatSync, mkdirSync, readFileSync, readlinkSync, realpathSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { dirname, resolve } from "node:path";
 var MemorySessionStore = class {
   s = null;
   load() {
@@ -120,6 +121,22 @@ var MemorySessionStore = class {
     this.s = null;
   }
 };
+var IN_PLACE_CODES = /* @__PURE__ */ new Set(["EACCES", "EPERM", "EBUSY", "EXDEV", "EROFS"]);
+function realTarget(path) {
+  try {
+    return realpathSync(path);
+  } catch (e) {
+    if (e.code !== "ENOENT")
+      throw e;
+    try {
+      if (!lstatSync(path).isSymbolicLink())
+        return path;
+    } catch {
+      return path;
+    }
+    return realTarget(resolve(dirname(path), readlinkSync(path)));
+  }
+}
 var FileSessionStore = class {
   path;
   constructor(path) {
@@ -133,11 +150,22 @@ var FileSessionStore = class {
     }
   }
   save(s) {
+    const target = realTarget(this.path);
     try {
-      mkdirSync(dirname(this.path), { recursive: true });
+      mkdirSync(dirname(target), { recursive: true });
     } catch {
     }
-    writeFileSync(this.path, JSON.stringify(s, null, 2), { mode: 384 });
+    const data = JSON.stringify(s, null, 2);
+    const tmp = `${target}.${randomUUID()}.tmp`;
+    try {
+      writeFileSync(tmp, data, { mode: 384, flag: "wx" });
+      renameSync(tmp, target);
+    } catch (e) {
+      rmSync(tmp, { force: true });
+      if (!IN_PLACE_CODES.has(e.code ?? ""))
+        throw e;
+      writeFileSync(target, data, { mode: 384 });
+    }
   }
   clear() {
     try {
@@ -1973,22 +2001,22 @@ ${this.auth_?.authToken ?? ""}`;
     return this.postSigned(`app-${service}-${this.region}.eufy.com`, path, body, true, {}, headerOverrides);
   }
   /**
-   * Fetch the per-station DSK key used in the P2P cloud-lookup payload. Mirrors
+   * Fetch the per-station DSK key using each station's reported cloud category. Mirrors
    * the legacy `get_dsk_keys` body shape on the mega devicerelation service.
    * The P2P *local* lookup path does not need this; only the cloud path does.
    */
-  async getDskKeys(stationSns, priorDsks = {}) {
+  async getDskKeys(stations, priorDsks = {}) {
     const invalid = {};
     const deviceDsks = [];
-    for (const sn of stationSns) {
+    for (const { sn, category } of stations) {
       const prev = priorDsks[sn] ?? "";
       invalid[sn] = prev;
-      deviceDsks.push({ invalid_dsk: prev, device_sn: sn, category: "eufy_security" });
+      deviceDsks.push({ invalid_dsk: prev, device_sn: sn, category: category || "eufy_security" });
     }
     const res = await this.post("devicerelation", "/app/devicerelation/get_dsk_keys", {
       device_dsks: deviceDsks,
       invalid_dsks: invalid,
-      station_sns: stationSns
+      station_sns: stations.map(({ sn }) => sn)
     });
     const out = {};
     for (const k of res.device_dsks ?? [])
@@ -2665,7 +2693,7 @@ var SecureMqtt = class extends EventEmitter {
     const port = c.endpoint_port ?? 8883;
     const pinned = this.o.instanceIp;
     const reconnectPeriod = this.o.reconnectPeriod ?? 5e3;
-    return await new Promise((resolve, reject) => {
+    return await new Promise((resolve2, reject) => {
       const client = pinned ? mqtt.connect({
         host: pinned,
         port,
@@ -2697,7 +2725,7 @@ var SecureMqtt = class extends EventEmitter {
       client.on("connect", () => {
         if (!settled) {
           settled = true;
-          resolve();
+          resolve2();
         }
         this.emit("connect");
       });
@@ -2840,7 +2868,7 @@ function parseStateInfoSignal(topic, raw) {
 }
 
 // dist/transport/mqtt/dp-codec.js
-import { randomUUID } from "node:crypto";
+import { randomUUID as randomUUID2 } from "node:crypto";
 var DP_MAGIC = [255, 9];
 var DP_HEADER_LEN = 9;
 function xorChecksum(buf) {
@@ -2878,7 +2906,7 @@ function buildDpEnvelope(opts) {
   };
   const head = {
     version: "1.0.0.1",
-    client_id: `ios-eufy_mega-${opts.accountId}-${randomUUID()}`,
+    client_id: `ios-eufy_mega-${opts.accountId}-${randomUUID2()}`,
     sess_id: "0000",
     msg_seq: 1,
     seed: "",
@@ -15560,7 +15588,7 @@ function readAddress(buf, offset) {
   };
 }
 function parseLookupAddr(msg) {
-  return readAddress(msg, 4);
+  return msg.length >= 12 ? readAddress(msg, 4) : void 0;
 }
 function parseRelayList(msg) {
   const out = [];
@@ -16209,6 +16237,27 @@ function traceLiveStart(logger, trace, source) {
 // dist/transport/p2p/level2-settle.js
 var LEVEL2_SETTLE_MS = 8e3;
 
+// dist/transport/p2p/database-wire.js
+var CMD_DATABASE_IMAGE = 1308;
+var CMD_DATABASE = 1306;
+var DB_QUERY = { FULL_TABLE: 1e4, COMBINATION_WITH_AI: 10011, QUERY_LOCAL: 10017 };
+var DB_TABLE_TIMEOUT_MS = 15e3;
+function fullTableQuery(count2 = 2e3) {
+  return {
+    count: count2,
+    start_date: "",
+    end_date: "",
+    start_id: 0,
+    end_id: 1,
+    flag: 0,
+    need_ai: 1,
+    res_unzip: 1,
+    update_time: "0",
+    start_time: "0",
+    alarm_id: ""
+  };
+}
+
 // dist/transport/p2p/p2p-session.js
 var LOCAL_LOOKUP_PORT = 32108;
 var HEARTBEAT_MS = 5e3;
@@ -16262,9 +16311,6 @@ var CMD_SET_PAYLOAD = 1350;
 var CMD_NOTIFY_PAYLOAD = 1351;
 var PADDED_RESULT_BYTES = 132;
 var CMD_CAMERA_INFO = 1103;
-var CMD_DATABASE_IMAGE = 1308;
-var CMD_DATABASE = 1306;
-var DB_QUERY = { FULL_TABLE: 1e4, COMBINATION_WITH_AI: 10011, QUERY_LOCAL: 10017 };
 var GCM_AAD = Buffer.from("eufy security");
 var LEVEL2_SEQ_BASE = 16909056;
 function paramReport(payload) {
@@ -16281,7 +16327,6 @@ function paramReport(payload) {
   return Object.keys(out).length ? out : void 0;
 }
 var traceSequence = 0;
-var DB_TABLE_TIMEOUT_MS = 15e3;
 function firstTableRows(text2) {
   const decoded = Buffer.from(text2, "latin1").toString("utf8");
   for (let start = decoded.indexOf("{"); start >= 0; start = decoded.indexOf("{", start + 1)) {
@@ -16408,11 +16453,14 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
   level2Seq = 0;
   rsaPrivateKey;
   rsaModulusHex;
-  /** Guards the one-shot level-2 key negotiation kicked off by the GATEWAYINFO reply. */
+  /**
+   * Whether a level-2 key negotiation kicked off by a GATEWAYINFO reply is in flight. Cleared when it
+   * settles, so a later reply — the answer to {@link repromptLevel2Key} — negotiates again.
+   */
   level2Negotiating = false;
   /**
    * Whether waiting for a level-2 key can still change the answer: `false` once one has been negotiated,
-   * once the one-shot negotiation concluded without one, and from the start when nothing can negotiate one.
+   * once a negotiation concluded without one, and from the start when nothing can negotiate one.
    */
   level2Pending;
   /** Waiters parked in {@link awaitLevel2Key}, woken the moment the negotiation settles either way. */
@@ -16517,7 +16565,8 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
    * The session grace runs from connect, when the station is prompted for `CMD_GATEWAYINFO`. A negotiation
    * beginning later does not restart it: best-effort media can proceed without the key, and restarting
    * would charge another grace to a source that may already be streaming. A session whose negotiation has
-   * settled answers without waiting at all, since being one-shot is what makes that answer final.
+   * settled answers without waiting at all: the answer stands until {@link repromptLevel2Key} re-opens the
+   * wait, since the station is prompted for `CMD_GATEWAYINFO` only on connect and on that re-prompt.
    *
    * An own-session camera whose grace expires here is NOT thereby a camera that will fail to stream. Measured
    * on one account: own-session cameras of two device types negotiated a key, three others never did, and
@@ -16550,7 +16599,7 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
     this.logger.debug(`[p2p] ${this.cfg.stationSn} waiting up to ${remaining}ms for the level-2 key`);
     this.trace({ phase: "level2-wait", waitMs: remaining });
     const waiters = this.level2Waiters;
-    const outcome = await new Promise((resolve) => {
+    const outcome = await new Promise((resolve2) => {
       let deadline;
       let settled = false;
       const finish = (result) => {
@@ -16561,7 +16610,7 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
         const at = waiters.indexOf(wake);
         if (at >= 0)
           waiters.splice(at, 1);
-        resolve(result);
+        resolve2(result);
       };
       const wake = (result) => finish(result);
       deadline = setTimeout(() => finish("timeout"), remaining);
@@ -16583,12 +16632,13 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
   /**
    * Ask the station for its gateway info a second time, re-opening a negotiation that concluded without a key.
    *
-   * The negotiation is one-shot per connection: the station is prompted once on connect, and a reply that
-   * never lands settles the wait so {@link awaitLevel2Key} answers `false` at once forever after. That is the
+   * Without this the station is prompted once on connect, and a negotiation that settles without a key
+   * leaves {@link awaitLevel2Key} answering `false` at once for the rest of that connection. That is the
    * right answer for best-effort media, which proceeds at level-1 — but an operation whose ONLY wire is
    * level-2 is then refused for the whole life of that connection, while a fresh session over the same
    * device negotiates a key normally. Measured: a session that had settled refused every such operation
-   * until it was rebuilt, at which point the station answered with a cipher id straight away.
+   * until it was rebuilt, at which point the station answered with a cipher id straight away. The reply to
+   * this ask runs the negotiation again and settles the re-opened wait either way.
    *
    * Bounded to one extra ask per connection, so a burst of such operations cannot turn a silent station into a
    * flood, and answers whether it asked — `false` when a key is already held, when nothing can negotiate one,
@@ -16609,6 +16659,7 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
   /** Record that the level-2 negotiation has finished, with or without a key, and wake every waiter. */
   settleLevel2(reason = "terminal") {
     this.level2Pending = false;
+    this.level2Negotiating = false;
     const outcome = this.level2Key ? "key" : reason;
     for (const wake of this.level2Waiters.splice(0))
       wake(outcome);
@@ -16618,13 +16669,14 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
    * `cipher_id`, resolve that cipher's private keys once (cloud `get_ciphers`, via the configured
    * `resolveCipherKey`), run the ECIES unwrap with the ECC key, and `setLevel2Key()`. A cipher with no
    * ECC key uses its RSA key instead and holds the RSA-decrypted 16-byte key as the AES-128-ECB level-2
-   * key. One-shot; emits `level2Ready` only when the AES-256-GCM key is negotiated, traces
+   * key. Emits `level2Ready` only when the AES-256-GCM key is negotiated, traces
    * `level2-set-payload-only` instead for the AES-128-ECB key, and emits `error` when the ECC unwrap
    * fails; an RSA unwrap failure is only traced (non-fatal either way — level-1 traffic keeps working).
    *
-   * Every outcome settles the wait in {@link awaitLevel2Key}, because being one-shot is what makes a
-   * failure final for this connection generation: nothing will retry it there, so a later command must be
-   * told at once rather than left to time out against a key that is not coming.
+   * Every outcome settles the wait in {@link awaitLevel2Key}, so a later command is told at once rather than
+   * left to time out against a key that is not coming. Settling also re-opens the negotiation, so a later
+   * GATEWAYINFO reply in the same connection generation runs it again; a lookup that completes after its
+   * generation ended settles nothing.
    */
   negotiateLevel2Key(gwPayload) {
     this.level2Negotiating = true;
@@ -16746,14 +16798,14 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
     this.socket = socket;
     socket.on("message", (msg, rinfo) => this.onMessage(msg, rinfo, socket));
     socket.on("error", (e) => this.emit("error", e));
-    await new Promise((resolve) => {
+    await new Promise((resolve2) => {
       socket.bind(() => {
         try {
           socket.setBroadcast(true);
         } catch {
         }
         this.requestReceiveBuffer(socket);
-        resolve();
+        resolve2();
       });
     });
     void _P2PSession.detectLocalIp().then((host) => {
@@ -16816,7 +16868,7 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
    */
   static detectLocalIp() {
     if (!_P2PSession.localIpPromise) {
-      _P2PSession.localIpPromise = new Promise((resolve) => {
+      _P2PSession.localIpPromise = new Promise((resolve2) => {
         const probe = dgram.createSocket("udp4");
         let settled = false;
         const finish = (result) => {
@@ -16828,7 +16880,7 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
             probe.close();
           } catch {
           }
-          resolve(result);
+          resolve2(result);
         };
         const timer = setTimeout(() => finish(void 0), 2e3);
         probe.connect(53, "8.8.8.8", () => {
@@ -16980,9 +17032,11 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
     } else if (hasHeader(msg, ResponseMessageType.LOOKUP_ADDR)) {
       if (!this.connected) {
         const addr = parseLookupAddr(msg);
-        this.logger.debug(`[p2p] ${this.cfg.stationSn} LOOKUP_ADDR -> ${addr.host}:${addr.port}`);
-        if (addr.host !== "0.0.0.0")
-          this.beginCheckCam(addr, socket);
+        if (addr) {
+          this.logger.debug(`[p2p] ${this.cfg.stationSn} LOOKUP_ADDR -> ${addr.host}:${addr.port}`);
+          if (addr.host !== "0.0.0.0")
+            this.beginCheckCam(addr, socket);
+        }
       }
     } else if (hasHeader(msg, ResponseMessageType.RLY_TO)) {
       const to = parseRelayTo(msg);
@@ -17036,7 +17090,7 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
       probe.on("error", (error) => this.logger.warn("[p2p] lookup socket error", error.message));
       probe.on("message", (msg, rinfo) => this.onMessage(msg, rinfo, probe));
       this.probeSockets.push(probe);
-      await new Promise((resolve) => {
+      await new Promise((resolve2) => {
         let settled = false;
         const finish = (bound) => {
           if (settled)
@@ -17051,7 +17105,7 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
             } catch {
             }
           }
-          resolve();
+          resolve2();
         };
         const onError = () => finish(false);
         const onClose = () => finish(false);
@@ -17837,25 +17891,6 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
   databasePayload(value, channel) {
     return !this.level2Key && this.sendsInTheClear() ? buildRawCommandPayload(Buffer.from(value, "utf-8"), channel, 0, this.nextClearCommandBytes(), 0) : buildStringCommandPayload(value, channel, this.level1Key, 1);
   }
-  /**
-   * Standard "give me the whole table" query params the eufy app uses for a direct
-   * `CMD_DATABASE` read (inner `cmd 10000`). `count` bounds the row count.
-   */
-  fullTableQuery(count2 = 2e3) {
-    return {
-      count: count2,
-      start_date: "",
-      end_date: "",
-      start_id: 0,
-      end_id: 1,
-      flag: 0,
-      need_ai: 1,
-      res_unzip: 1,
-      update_time: "0",
-      start_time: "0",
-      alarm_id: ""
-    };
-  }
   /**
    * Request the on-device edge-AI **face roster** over P2P — the phone-free path.
    *
@@ -17872,7 +17907,7 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
       accountId: opts.accountId,
       channel: opts.channel,
       innerCmd: DB_QUERY.FULL_TABLE,
-      query: this.fullTableQuery()
+      query: fullTableQuery()
     });
   }
   /**
@@ -17921,11 +17956,11 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
     this.queryDatabase(table, {
       accountId: opts.accountId,
       innerCmd: opts.innerCmd,
-      query: opts.query ?? this.fullTableQuery()
+      query: opts.query ?? fullTableQuery()
     });
     this.dbReadInFlight = true;
     try {
-      return await new Promise((resolve, reject) => {
+      return await new Promise((resolve2, reject) => {
         let text2 = "";
         const onChunk = (chunk) => {
           text2 += chunk.text;
@@ -17933,7 +17968,7 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
           if (result?.error !== void 0)
             settle(() => reject(new Error(`readDatabase: ${table} refused: ${result.error}`)));
           else if (result?.rows)
-            settle(() => resolve(result.rows));
+            settle(() => resolve2(result.rows));
         };
         const timer = setTimeout(() => settle(() => reject(new Error(`readDatabase: ${this.cfg.stationSn} sent no complete ${table}`))), opts.timeoutMs ?? DB_TABLE_TIMEOUT_MS);
         const onAbort = () => settle(() => reject(new Error("readDatabase: aborted")));
@@ -17963,7 +17998,7 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
       accountId: opts.accountId,
       channel: opts.channel,
       innerCmd: DB_QUERY.FULL_TABLE,
-      query: this.fullTableQuery()
+      query: fullTableQuery()
     });
   }
   /**
@@ -18027,8 +18062,12 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
    *
    * Only once the data type's reorder wait passes, or {@link REORDER_MAX_DATAGRAMS} pile up, is the datagram
    * treated as lost: a pending frame is discarded and delivery resumes from the earliest held datagram.
+   *
+   * A datagram shorter than the 8-byte DATA header carries no sequence number and is dropped unacknowledged.
    */
   onData(msg, addr) {
+    if (msg.length < 8)
+      return;
     const dataTypeBuffer = msg.subarray(4, 6);
     const seqNo = msg.subarray(6, 8).readUInt16BE();
     const dataType = dataTypeBuffer[1];
@@ -18194,6 +18233,13 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
         return P2PDataTypeHeader.DATA;
     }
   }
+  /**
+   * Decrypt and dispatch one inbound data frame.
+   *
+   * A `CMD_GATEWAYINFO` (1100) reply carries the ECIES envelope for the level-2 session key. When a
+   * cipher-key resolver is configured, no key that seals a set-payload is held and no negotiation is in
+   * flight, the reply starts one (async, fire-and-forget); a reply landing while one is in flight is ignored.
+   */
   handleFrame(header, payload, dataType) {
     let data = payload;
     const isMedia = header.commandId === CMD_VIDEO_FRAME || header.commandId === CMD_AUDIO_FRAME;
@@ -18299,12 +18345,12 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
     this.resetInboundSequencing();
     const socket = this.socket;
     if (socket && this.connectAddress) {
-      await new Promise((resolve) => this.send(this.connectAddress, RequestMessageType.END, void 0, socket, resolve));
+      await new Promise((resolve2) => this.send(this.connectAddress, RequestMessageType.END, void 0, socket, resolve2));
     }
-    await new Promise((resolve) => {
+    await new Promise((resolve2) => {
       if (!socket)
-        return resolve();
-      socket.close(() => resolve());
+        return resolve2();
+      socket.close(() => resolve2());
     });
     this.socket = void 0;
     this.emit("close");
@@ -19512,7 +19558,7 @@ async function captureSnapshotFromShared(source, opts = {}) {
   const skip = opts.skipKeyframes ?? (source.state === "live" ? 0 : 1);
   let burst;
   try {
-    burst = await new Promise((resolve, reject) => {
+    burst = await new Promise((resolve2, reject) => {
       const bufs = [];
       let sets = source.parameterSets;
       let codec = "h264";
@@ -19535,7 +19581,7 @@ async function captureSnapshotFromShared(source, opts = {}) {
         if (!settle)
           settle = setTimeout(() => {
             cleanup();
-            resolve({ h264: Buffer.concat(bufs), codec, sets });
+            resolve2({ h264: Buffer.concat(bufs), codec, sets });
           }, collectMs);
       };
       const onError = (err) => {
@@ -19579,7 +19625,7 @@ async function recordClip(session, seconds, opts = {}) {
   const stream = await openLiveStream(session, opts);
   let h264;
   try {
-    h264 = await new Promise((resolve, reject) => {
+    h264 = await new Promise((resolve2, reject) => {
       const bufs = [];
       let keyCount = 0, capturing = false;
       let sets;
@@ -19592,7 +19638,7 @@ async function recordClip(session, seconds, opts = {}) {
       };
       const collected = () => {
         detach();
-        resolve(primeForDecode(Buffer.concat(bufs), sets, codec2));
+        resolve2(primeForDecode(Buffer.concat(bufs), sets, codec2));
       };
       const failed = (reason, cause) => {
         detach();
@@ -19622,7 +19668,7 @@ async function recordClip(session, seconds, opts = {}) {
     stream.stop();
   }
   const codec = annexbFfmpegFormat(h264);
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     const ff = spawnFfmpeg([
       // prettier-ignore
       "-f",
@@ -19645,7 +19691,7 @@ async function recordClip(session, seconds, opts = {}) {
     ff.on("close", (code) => {
       const mp4 = Buffer.concat(out);
       if (mp4.length)
-        resolve(mp4);
+        resolve2(mp4);
       else
         reject(new Error(`ffmpeg mux failed (code ${code}): ${Buffer.concat(err).toString().slice(0, 200)}`));
     });
@@ -19684,7 +19730,7 @@ function jpegGeometry(jpeg) {
 }
 function annexbToJpeg(annexb, spawn2) {
   const codec = annexbFfmpegFormat(annexb);
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     const ff = spawnFfmpeg([
       // prettier-ignore
       "-f",
@@ -19711,7 +19757,7 @@ function annexbToJpeg(annexb, spawn2) {
       const encoded = jpeg.length >= 3 && jpeg.subarray(0, 3).toString("hex") === "ffd8ff";
       const geometry = encoded ? jpegGeometry(jpeg) : void 0;
       if (geometry)
-        return resolve({ jpeg, ...geometry });
+        return resolve2({ jpeg, ...geometry });
       const diagnostics = Buffer.concat(err).toString().slice(0, 200).trim();
       const what = code !== 0 ? `ffmpeg exited ${code}` : encoded ? "encoded image declares no frame header" : "no complete frame in the burst";
       reject(new LiveSnapshotUnavailableError("undecodable-burst", diagnostics ? `${what}: ${diagnostics}` : what));
@@ -19744,12 +19790,12 @@ function homeBase2RecordingPath(channel, recording) {
 function receiveRecording(session, request) {
   let resolveFrames;
   let rejectFrames;
-  const frames = new Promise((resolve, reject) => {
-    resolveFrames = resolve;
+  const frames = new Promise((resolve2, reject) => {
+    resolveFrames = resolve2;
     rejectFrames = reject;
   });
   let resolveDrained;
-  const drained = new Promise((resolve) => resolveDrained = resolve);
+  const drained = new Promise((resolve2) => resolveDrained = resolve2);
   const limitMs = request.timeoutMs ?? DEFAULT_TRANSFER_MS;
   let collected = [];
   const started = Date.now();
@@ -20287,7 +20333,8 @@ var SharedLiveSource = class {
    *
    * The previous stream is dropped rather than stopped through the state machine: it speaks to a session that
    * is gone, and its `stop` would be read as an upstream end. Only a warm-up that asked for a replacement
-   * rewarms, so this is inert on a source that is streaming or has already failed.
+   * rewarms, so this is inert on a source that is streaming or has already failed. Each call replaces the
+   * re-issue ticker rather than adding one, so the start goes out once per interval however often it runs.
    */
   rewarm() {
     if (this.disposed || !this.sessionReplacementAsked || this._state !== "warming")
@@ -20299,6 +20346,8 @@ var SharedLiveSource = class {
     this.openStream();
     this.warmAttempts++;
     this.logger.debug(`${this.tag} warming again on a replacement session (attempt ${this.warmAttempts})`);
+    if (this.warmRetryTimer)
+      clearInterval(this.warmRetryTimer);
     this.warmRetryTimer = setInterval(() => this.reissueStart(), this.warmRetryMs);
   }
   /**
@@ -21019,6 +21068,7 @@ function openReadableFromConsumer(consumer, opts = {}) {
     if (!readable.push(value))
       consumer.pause();
   });
+  consumer.on("budget", (notice) => readable.emit("budget", notice));
   consumer.on("stop", () => readable.push(null));
   consumer.on("error", (err) => readable.destroy(err));
   return readable;
@@ -21954,7 +22004,7 @@ var FragmentRecording = class extends EventEmitter6 {
           throw this.failure;
         if (this.ended)
           return;
-        await new Promise((resolve) => this.wake = resolve);
+        await new Promise((resolve2) => this.wake = resolve2);
       }
     } finally {
       this.stop();
@@ -22067,9 +22117,10 @@ var P2P_STATION_WAITS = {
 };
 var RTSP_URL_READ_TIMEOUT_MS = 12e3;
 var TALKBACK_CODEC_WAIT_MS = 3e3;
+var OWN_LIVE_SESSION_MODELS = /* @__PURE__ */ new Set(["T8030"]);
 var ELD_TALKBACK_MODELS = /* @__PURE__ */ new Set(["T8410C"]);
 function speakerCodec(consumer, talk, timeoutMs) {
-  return new Promise((resolve) => {
+  return new Promise((resolve2) => {
     let timer;
     const settle = (codec) => {
       clearTimeout(timer);
@@ -22077,7 +22128,7 @@ function speakerCodec(consumer, talk, timeoutMs) {
       consumer.off("audio", onAudio);
       consumer.off("stop", onStop);
       talk.off("stop", onStop);
-      resolve(codec);
+      resolve2(codec);
     };
     const onVideo = () => {
       timer ??= setTimeout(() => settle("aac-lc"), timeoutMs);
@@ -22129,6 +22180,18 @@ var P2PCommandRouter = class _P2PCommandRouter {
    * {@link liveSources} is a claim in flight.
    */
   liveSessionKeys = /* @__PURE__ */ new Map();
+  /**
+   * The live source build in flight per `${parentSn}:${channel}`, settled once its connection is opened
+   * or refused.
+   *
+   * A build awaits its media session before it can file the source in {@link liveSources}, so a second
+   * request for the same camera in that window finds nothing cached. Building a second source there
+   * overwrites the first, and the orphan's teardown then closes the connection the cached one streams
+   * on. A request that finds a build here waits for it, until its own signal aborts, then resolves its
+   * session again and reuses what the build filed, or builds its own when that build failed. The entry
+   * is removed when the build settles and its promise never rejects, so each wait ends on a later state.
+   */
+  liveSourceBuilds = /* @__PURE__ */ new Map();
   /**
    * The open talkback per `${parentSn}:${channel}`, if any. The device plays one audio stream at a
    * time and the session carries one audio sequence, so this path is exclusive where a live pull is
@@ -22308,17 +22371,30 @@ var P2PCommandRouter = class _P2PCommandRouter {
    * so a start issued before the key arrives is dropped as `media-command-unsent`, and the stream then
    * shows nothing until a later keepalive tick happens to find the key. A connected session that cannot
    * carry the start is not a connected session, so this refuses rather than returning one.
+   *
+   * A session refused its key within the grace, or never connected, is closed and dropped from the manager at
+   * once. Nothing else releases it: no source holds it, a wired station's session never idles out, and the
+   * manager hands the same session to every later open of the camera, so the next open dials a fresh
+   * connection instead. A session another open has since replaced is left to its own close.
    */
   async openMediaSession(parentSn, channel, signal) {
-    const session = await this.openSession(_P2PCommandRouter.mediaSessionKey(parentSn, channel), parentSn);
-    await this.awaitConnected(session, parentSn, signal);
-    let ready = await abortable(session.awaitLevel2Key(LEVEL2_GRACE_MS, "call"), signal);
-    if (!ready && session.repromptLevel2Key()) {
-      ready = await abortable(session.awaitLevel2Key(LEVEL2_GRACE_MS, "call"), signal);
-    }
-    if (!ready)
-      throw new StationKeyUnavailableError(parentSn);
-    return session;
+    const mediaKey = _P2PCommandRouter.mediaSessionKey(parentSn, channel);
+    const session = await this.openSession(mediaKey, parentSn);
+    try {
+      await this.awaitConnected(session, parentSn, signal);
+      let ready = await abortable(session.awaitLevel2Key(LEVEL2_GRACE_MS, "call"), signal);
+      if (!ready && session.repromptLevel2Key()) {
+        ready = await abortable(session.awaitLevel2Key(LEVEL2_GRACE_MS, "call"), signal);
+      }
+      if (!ready)
+        throw new StationKeyUnavailableError(parentSn);
+      return session;
+    } catch (error) {
+      if (!signal?.aborted && this.manager.get(mediaKey) === session) {
+        void this.manager.close(mediaKey).catch((e) => this.reportError(e instanceof Error ? e : new Error(String(e))));
+      }
+      throw error;
+    }
   }
   /**
    * Wait for `session` to connect, for up to the session's own connect deadline, and throw
@@ -22356,7 +22432,7 @@ var P2PCommandRouter = class _P2PCommandRouter {
         throw new Error(`no P2P endpoint (p2p_did) for station ${parentSn}`);
       let dskKey;
       try {
-        dskKey = (await this.deps.mega.getDskKeys([parentSn]))[parentSn]?.dskKey;
+        dskKey = (await this.deps.mega.getDskKeys([stationDev]))[parentSn]?.dskKey;
       } catch (e) {
         this.deps.onError(e instanceof Error ? e : new Error(String(e)));
       }
@@ -22458,7 +22534,7 @@ var P2PCommandRouter = class _P2PCommandRouter {
       const session = await this.openSession(parentSn, parentSn);
       if (session.isConnected)
         return;
-      await new Promise((resolve, reject) => {
+      await new Promise((resolve2, reject) => {
         const cleanup = () => {
           signal?.removeEventListener("abort", onAbort);
           session.off("connect", onConnect);
@@ -22467,7 +22543,7 @@ var P2PCommandRouter = class _P2PCommandRouter {
         };
         const onConnect = () => {
           cleanup();
-          resolve();
+          resolve2();
         };
         const onError = (error) => {
           cleanup();
@@ -22809,8 +22885,9 @@ var P2PCommandRouter = class _P2PCommandRouter {
    * {@link releaseLingeringSiblings}. A pull with consumers is never touched. The release runs before the
    * reuse branch, so a reuse frees the station as a cold start does.
    *
-   * `mayOpenOwnSession` decides whether a camera that finds the station's own session claimed may open a
-   * connection of its own for it. Only the continuous-pull egresses pass it. A still must not: it wants one
+   * `continuous` decides whether a camera that finds the station's own session claimed may open a
+   * connection of its own for it; on an {@link OWN_LIVE_SESSION_MODELS} station it always gets one, and an
+   * unwatched source left on the station's session is rebuilt there. Only the continuous-pull egresses pass it. A still must not: it wants one
    * frame, and a socket plus a level-2 negotiation per thumbnail is a cost a tile refresh cannot justify —
    * so a still asked for while a sibling is being watched contends as it always did, and the caller's
    * retained image answers it. A live view still outranks a tile; what changed is that two live views no
@@ -22819,23 +22896,31 @@ var P2PCommandRouter = class _P2PCommandRouter {
    * The session goes into a {@link HeldSession} cell, so it can be replaced under a source that stays in
    * place.
    */
-  async sharedLiveSourceFor(sn, opts = {}, mayOpenOwnSession = false) {
+  async sharedLiveSourceFor(sn, opts = {}, continuous = false) {
     const { session, parentSn, channel, accountId, homeBaseAttached } = await this.resolveSession(sn, {
       waitLevel2: "soft",
       requireLevel2ForAttached: true,
       signal: opts.signal
     });
     const key = `${parentSn}:${channel}`;
+    const build = this.liveSourceBuilds.get(key);
+    if (build) {
+      await abortable(build, opts.signal);
+      return this.sharedLiveSourceFor(sn, opts, continuous);
+    }
+    const ownSession = continuous && homeBaseAttached && this.ownsLiveSession(parentSn);
     let source = this.liveSources.get(key);
-    if (source && source.state === "stopped") {
+    if (source && (source.state === "stopped" || ownSession && source.state !== "idle" && source.consumerCount === 0 && this.liveSessionKeys.get(key) === parentSn)) {
       this.dropLiveSource(key);
       source = void 0;
     }
     this.releaseLingeringSiblings(parentSn, channel);
     if (!source) {
       const logger = this.deps.logger ?? noopLogger;
-      const sessionKey = mayOpenOwnSession && homeBaseAttached && this.stationSessionInUse(parentSn, key) ? _P2PCommandRouter.mediaSessionKey(parentSn, channel) : parentSn;
+      const sessionKey = ownSession || continuous && homeBaseAttached && this.stationSessionInUse(parentSn, key) ? _P2PCommandRouter.mediaSessionKey(parentSn, channel) : parentSn;
       this.liveSessionKeys.set(key, sessionKey);
+      const built = Promise.withResolvers();
+      this.liveSourceBuilds.set(key, built.promise);
       let held;
       try {
         held = {
@@ -22844,6 +22929,9 @@ var P2PCommandRouter = class _P2PCommandRouter {
       } catch (error) {
         this.liveSessionKeys.delete(key);
         throw error;
+      } finally {
+        this.liveSourceBuilds.delete(key);
+        built.resolve();
       }
       source = new SharedLiveSource({
         makeStream: (ctx) => new LiveStream(held.session, {
@@ -23128,11 +23216,18 @@ var P2PCommandRouter = class _P2PCommandRouter {
    * yield CMAF fragments (init segment first, then a `moof`+`mdat` per keyframe boundary) muxed by the
    * dependency-free internal fMP4 muxer. The returned recording handle exposes battery-budget notices
    * and detaches its consumer on `stop`, iterator return, or iterator throw. No ffmpeg.
+   *
+   * It is a continuous pull only on an {@link OWN_LIVE_SESSION_MODELS} station; elsewhere it never opens a
+   * connection of its own.
    */
   recordFragments(sn, opts = {}) {
-    const source = this.sharedLiveSourceFor(sn, opts);
+    const source = this.sharedLiveSourceFor(sn, opts, this.ownsLiveSession(this.stationKeyOf(sn)));
     return new FragmentRecording(source, opts);
   }
+  /** Whether `stationSn` is an {@link OWN_LIVE_SESSION_MODELS} station. */
+  ownsLiveSession(stationSn) {
+    return OWN_LIVE_SESSION_MODELS.has(this.recordFor(stationSn)?.model ?? "");
+  }
   /**
    * **Generic P2P request/reply query.** Sends a `SET_PAYLOAD` (1350) wrapper carrying `subCmd` on the
    * device channel, then resolves with the reply frame's `payload` — the `NOTIFY_PAYLOAD` (1351)
@@ -23141,7 +23236,7 @@ var P2PCommandRouter = class _P2PCommandRouter {
   async p2pQuery(sn, subCmd, opts = {}) {
     const { session, channel, accountId } = await this.resolveSession(sn, { waitLevel2: true });
     const timeoutMs = opts.timeoutMs ?? 15e3;
-    return await new Promise((resolve, reject) => {
+    return await new Promise((resolve2, reject) => {
       const timer = setTimeout(() => {
         cleanup();
         reject(new Error(`timeout waiting for p2p query ${subCmd} reply from ${sn}`));
@@ -23150,7 +23245,7 @@ var P2PCommandRouter = class _P2PCommandRouter {
         const j = f.json;
         if (f.channel === channel && f.commandId === CommandType.CMD_NOTIFY_PAYLOAD && j?.cmd === subCmd && j.payload && typeof j.payload === "object") {
           cleanup();
-          resolve(j.payload);
+          resolve2(j.payload);
         }
       };
       const cleanup = () => {
@@ -23180,7 +23275,7 @@ var P2PCommandRouter = class _P2PCommandRouter {
   async p2pControlQuery(sn, param, data, opts = {}) {
     const { session } = await this.resolveSession(sn, { waitLevel2: false });
     const timeoutMs = opts.timeoutMs ?? 15e3;
-    return await new Promise((resolve, reject) => {
+    return await new Promise((resolve2, reject) => {
       const timer = setTimeout(() => {
         cleanup();
         reject(new Error(`timeout waiting for p2p control query ${param} reply from ${sn}`));
@@ -23189,7 +23284,7 @@ var P2PCommandRouter = class _P2PCommandRouter {
         const j = f.json;
         if (j?.cmd === param && j.payload && typeof j.payload === "object") {
           cleanup();
-          resolve(j.payload);
+          resolve2(j.payload);
         }
       };
       const cleanup = () => {
@@ -23286,12 +23381,12 @@ var P2PCommandRouter = class _P2PCommandRouter {
    * is ignored rather than resolving the wrong read.
    */
   awaitRtspUrl(session, channel, signal) {
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve2, reject) => {
       const onUrl = (ev) => {
         if (ev.channel !== channel)
           return;
         cleanup();
-        resolve(ev.url);
+        resolve2(ev.url);
       };
       const onAbort = () => {
         cleanup();
@@ -23611,7 +23706,7 @@ var P2PCommandRouter = class _P2PCommandRouter {
    * wrapper has to share {@link serializeKeyed}.
    */
   awaitKeyedReply(sn, session, channel, engage, send) {
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve2, reject) => {
       let refused = false;
       let mark;
       let timer;
@@ -23631,7 +23726,7 @@ var P2PCommandRouter = class _P2PCommandRouter {
         if (refused)
           return;
         refused = true;
-        expire(_P2PCommandRouter.KEYED_REFUSAL_TWIN_MS, () => settle(() => resolve({ code: KEYED_PAYLOAD_SEQ_ERROR, mark })));
+        expire(_P2PCommandRouter.KEYED_REFUSAL_TWIN_MS, () => settle(() => resolve2({ code: KEYED_PAYLOAD_SEQ_ERROR, mark })));
       };
       const onResult = (r) => {
         if (r.channel !== channel)
@@ -23639,7 +23734,7 @@ var P2PCommandRouter = class _P2PCommandRouter {
         if (r.code === KEYED_PAYLOAD_SEQ_ERROR)
           refuse();
         else if (!refused)
-          settle(() => resolve({ code: r.code }));
+          settle(() => resolve2({ code: r.code }));
       };
       const onData = (f) => {
         if (f.channel !== channel || f.commandId !== CommandType.CMD_NOTIFY_PAYLOAD)
@@ -23651,7 +23746,7 @@ var P2PCommandRouter = class _P2PCommandRouter {
         }
         const code = keyedPayloadReportCode(f.json, engage);
         if (code !== void 0 && !refused)
-          settle(() => resolve({ code }));
+          settle(() => resolve2({ code }));
       };
       session.on("commandResult", onResult);
       session.on("data", onData);
@@ -23756,7 +23851,7 @@ var P2PCommandRouter = class _P2PCommandRouter {
       clearTimeout(timer);
       session.off("data", onData);
     };
-    const getReplyPromise = new Promise((resolve) => {
+    const getReplyPromise = new Promise((resolve2) => {
       onData = (f) => {
         const j = f.json;
         if (j?.cmd !== CMD_TRANSFER_PAYLOAD || !j.payload)
@@ -23769,11 +23864,11 @@ var P2PCommandRouter = class _P2PCommandRouter {
         if (keyTime === void 0 || keyTime !== query.time)
           return;
         cleanup();
-        resolve({ lockPayload, keyTime });
+        resolve2({ lockPayload, keyTime });
       };
       timer = setTimeout(() => {
         cleanup();
-        resolve(void 0);
+        resolve2(void 0);
       }, _P2PCommandRouter.FF09_SETTINGS_GET_TIMEOUT_MS);
       session.on("data", onData);
     });
@@ -23902,7 +23997,9 @@ var PORTAL_KEEPALIVE = Buffer.from("0009000010000000000000006300000000000000585a
 var PORTAL_KEEPALIVE_MS = 29e3;
 
 // dist/transport/rtc/portal-packet.js
+import { zstdDecompressSync } from "node:zlib";
 var MAGIC2 = Buffer.from("XZYH", "ascii");
+var ZSTD_MAGIC_LE = 4247762216;
 var PORTAL_HEADER_LENGTH = 16;
 var PORTAL_CMD_SET_PAYLOAD = 1350;
 var PORTAL_STATION_CHANNEL = 255;
@@ -23966,11 +24063,23 @@ function parseJsonBody(buf) {
     return text2;
   }
 }
+function unwrapZstd(buf) {
+  if (buf.length < 4 || buf.readUInt32LE(0) !== ZSTD_MAGIC_LE)
+    return buf;
+  try {
+    return zstdDecompressSync(buf);
+  } catch {
+    return void 0;
+  }
+}
 function parsePortalPacket(buf, linkType = PortalLinkType.COMMAND) {
-  const header = parsePortalHeader(buf);
+  const packet = unwrapZstd(buf);
+  if (!packet)
+    return void 0;
+  const header = parsePortalHeader(packet);
   if (!header)
     return void 0;
-  const body = buf.subarray(PORTAL_HEADER_LENGTH, PORTAL_HEADER_LENGTH + header.paramLength);
+  const body = packet.subarray(PORTAL_HEADER_LENGTH, PORTAL_HEADER_LENGTH + header.paramLength);
   if (linkType === PortalLinkType.NOTIFY) {
     const data = parseJsonBody(body);
     const cmd = typeof data === "object" && data !== null && "cmd" in data ? Number(data.cmd) : void 0;
@@ -24702,12 +24811,12 @@ var RtcPeer = class extends EventEmitter9 {
       this.remoteMid = media ? offer.match(/^a=mid:([^\r\n]+)/m)?.[1]?.trim() ?? HUB_SDP_MID : midOf(offer, "application") ?? HUB_SDP_MID;
       if (media)
         this.videoMid = midOf(offer, "video");
-      const answerWait = new Promise((resolve, reject) => {
+      const answerWait = new Promise((resolve2, reject) => {
         const timer = setTimeout(() => {
           this.localAnswer = void 0;
           reject(new Error("timed out waiting for the local SDP answer"));
         }, ANSWER_TIMEOUT_MS);
-        this.localAnswer = { resolve, reject, timer };
+        this.localAnswer = { resolve: resolve2, reject, timer };
       });
       pc.setRemoteDescription(offer, "offer");
       this.remoteSet = true;
@@ -24869,7 +24978,7 @@ var RtcPeer = class extends EventEmitter9 {
 
 // dist/transport/rtc/signaling.js
 import { EventEmitter as EventEmitter10 } from "node:events";
-import { createHmac as createHmac3, randomUUID as randomUUID2 } from "node:crypto";
+import { createHmac as createHmac3, randomUUID as randomUUID3 } from "node:crypto";
 var RTC_WS_PATH = "/v1/rtc/ws/join?reqtype=nvr";
 var RTC_SIGN_PATH = "/v1/smart/nvr/ws/sign";
 var PORTAL_ORIGIN = "https://security.eufy.com";
@@ -24909,7 +25018,7 @@ var RtcSignalingClient = class extends EventEmitter10 {
     this.createSocket = opts.createSocket ?? defaultSocket;
     this.logger = opts.logger ?? noopLogger;
     this.now = opts.now ?? Date.now;
-    this.makeMsgId = opts.makeMsgId ?? (() => randomUUID2().replace(/-/g, ""));
+    this.makeMsgId = opts.makeMsgId ?? (() => randomUUID3().replace(/-/g, ""));
   }
   get isOpen() {
     return this.ws?.readyState === WS_OPEN;
@@ -24953,7 +25062,7 @@ var RtcSignalingClient = class extends EventEmitter10 {
     };
     const protocols = ["v1", Buffer.from(JSON.stringify(auth)).toString("base64url")];
     this.logger.debug(`[rtc] ${this.opts.stationSn} signalling connect ${this.wsUrl}`);
-    await new Promise((resolve, reject) => {
+    await new Promise((resolve2, reject) => {
       const timer = setTimeout(() => {
         reject(new Error(`RTC signalling connect timeout after ${SIGNALING_CONNECT_TIMEOUT_MS}ms`));
         this.close();
@@ -24967,7 +25076,7 @@ var RtcSignalingClient = class extends EventEmitter10 {
         this.sendAuth(sign);
         this.startKeepalive();
         this.emit("open");
-        resolve();
+        resolve2();
       });
       ws.addEventListener("message", (ev) => {
         void this.handleWireMessage(ev.data);
@@ -25240,12 +25349,12 @@ var RtcSession = class extends EventEmitter11 {
   waitForAuth() {
     if (this.authOk)
       return Promise.resolve();
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve2, reject) => {
       const timer = setTimeout(() => {
         this.authWaiter = void 0;
         reject(new Error("RTC signalling auth timeout"));
       }, AUTH_TIMEOUT_MS);
-      this.authWaiter = { resolve, reject, timer };
+      this.authWaiter = { resolve: resolve2, reject, timer };
     });
   }
   /** Settle a pending auth wait: resolve it, or reject it with `err`; either way its timer stops. */
@@ -25372,6 +25481,7 @@ var RtcCommandRouter = class {
   lives = /* @__PURE__ */ new Map();
   warm = /* @__PURE__ */ new Map();
   callSources = /* @__PURE__ */ new Map();
+  lastTransaction = 0;
   constructor(deps) {
     this.deps = deps;
   }
@@ -25381,21 +25491,80 @@ var RtcCommandRouter = class {
     }
     if (route.mediaTrack)
       throw new Error(`rtc: ${route.stationSn} serves media only and takes no portal command`);
-    const identity = this.deps.identity();
-    if (!identity)
-      throw new Error(`rtc: not logged in, cannot drive ${route.stationSn}`);
-    const { stationSn } = route;
-    const adminUserId = route.adminUserId || identity.userId;
     const channel = route.attached ? cmd.channel : PORTAL_STATION_CHANNEL;
-    const st = await this.stationSession(route, adminUserId, identity);
-    const outerCmd = cmd.kind === "set-json" ? PORTAL_CMD_CONTROL_PAYLOAD : PORTAL_CMD_SET_PAYLOAD;
-    const innerCmd = cmd.kind === "set-json" ? cmd.param : cmd.cmd;
-    const payload = cmd.kind === "set-json" ? { account_id: adminUserId, cmd: cmd.param, commandType: cmd.param, data: cmd.data } : { account_id: adminUserId, cmd: cmd.cmd, mValue3: cmd.mValue3 ?? 0, payload: cmd.payload };
-    const segment = st.seg.next();
-    const packet = buildPortalPacket({ commandId: outerCmd, channel, segment, payload });
-    const run = st.queue.then(() => this.sendAwaitAck(stationSn, st, packet, outerCmd, innerCmd, channel, segment));
-    st.queue = run.catch(() => void 0);
-    return run;
+    if (cmd.kind === "set-json") {
+      return this.sendQueued(route, PORTAL_CMD_CONTROL_PAYLOAD, cmd.param, channel, {
+        cmd: cmd.param,
+        commandType: cmd.param,
+        data: cmd.data
+      });
+    }
+    return this.sendQueued(route, PORTAL_CMD_SET_PAYLOAD, cmd.cmd, channel, {
+      cmd: cmd.cmd,
+      mValue3: cmd.mValue3 ?? 0,
+      payload: cmd.payload
+    });
+  }
+  /**
+   * Query one on-station table over the station's control channel and answer its rows.
+   *
+   * Sends the `1350` envelope with inner `{cmd: 1306, payload: {cmd: 10000, table, payload, transaction}}`,
+   * the whole-table query, on the station channel. The hub ACKs on the command link and answers with one notify frame whose body
+   * carries `{cmd, table, data, mIntRet, msg, transaction, …}`, echoing the read's `transaction`; that echo
+   * is the only thing a reply is attributed by, and every read sends a `transaction` no other read on this
+   * router has sent. Resolves with the reply's `data` rows. Rejects with the hub's `msg` on a non-zero
+   * `mIntRet`, on an ACK refusing the envelope, at once when `signal` aborts (queued or sent), when the
+   * session closes, and when `timeoutMs` (default {@link DB_TABLE_TIMEOUT_MS}) elapses with no reply.
+   *
+   * One read or command at a time per station: the read holds the station's send queue until it settles.
+   */
+  readTable(route, table, opts = {}) {
+    const transaction = this.nextTransaction();
+    const inner = {
+      cmd: DB_QUERY.FULL_TABLE,
+      table,
+      payload: fullTableQuery(),
+      transaction
+    };
+    return this.sendQueued(route, PORTAL_CMD_SET_PAYLOAD, CMD_DATABASE, PORTAL_STATION_CHANNEL, { cmd: CMD_DATABASE, mValue3: 0, payload: inner }, {
+      timeoutMs: opts.timeoutMs,
+      signal: opts.signal,
+      pick: (body) => {
+        if (String(body.transaction) !== transaction)
+          return void 0;
+        if (typeof body.mIntRet === "number" && body.mIntRet !== 0) {
+          throw new Error(`rtc: ${route.stationSn} refused ${table}: ${body.msg ?? body.mIntRet} (${body.mIntRet})`);
+        }
+        return Array.isArray(body.data) ? body.data : void 0;
+      }
+    });
+  }
+  /**
+   * Fetch one stored image by its on-station path over the station's control channel.
+   *
+   * Sends the `1350` envelope with inner `{cmd: 1308, payload: [{file}]}` on the station channel. The hub
+   * ACKs on the command link and answers with one notify frame whose body is `{file, content}`, `content`
+   * the image in base64, and no `transaction`; the reply is the one whose `file` equals `filePath`. A reply
+   * arriving after an abandoned read of the same path carries that path's bytes, which are the bytes a
+   * later read of it asks for. Resolves with the decoded bytes. Rejects on an ACK refusing the envelope,
+   * at once when `signal` aborts (queued or sent), when the session closes, and when `timeoutMs` (default
+   * {@link DB_TABLE_TIMEOUT_MS}) elapses with no reply.
+   *
+   * One read or command at a time per station: the read holds the station's send queue until it settles.
+   */
+  readImage(route, filePath, opts = {}) {
+    return this.sendQueued(route, PORTAL_CMD_SET_PAYLOAD, CMD_DATABASE_IMAGE, PORTAL_STATION_CHANNEL, { cmd: CMD_DATABASE_IMAGE, mValue3: 0, payload: [{ file: filePath }] }, {
+      ...opts,
+      pick: (body) => body.file === filePath && typeof body.content === "string" ? Buffer.from(body.content, "base64") : void 0
+    });
+  }
+  /**
+   * A `transaction` stamp in the vendor app's shape, a decimal epoch-in-milliseconds string, strictly
+   * greater than the last one this router issued, so two reads in the same millisecond never share one.
+   */
+  nextTransaction() {
+    this.lastTransaction = Math.max(Date.now(), this.lastTransaction + 1);
+    return String(this.lastTransaction);
   }
   /**
    * The media of a camera on a T9000: live video, a readable feed and a live still over the station's
@@ -25571,45 +25740,109 @@ var RtcCommandRouter = class {
     return source;
   }
   /**
-   * Completes on the command ACK or a correlated control-result notification. The notification must
-   * match the request channel, parameter and segment and contain a structured payload. Receipt does
-   * not establish physical actuation. The command is sent once, bounded by {@link ACK_TIMEOUT_MS}.
+   * Send one envelope on the station's session, queued behind its other sends, and settle as
+   * {@link sendAwaitAck} does. `body` is the inner payload; the station session, the `account_id` it is
+   * stamped with and the packet are resolved here, so a command and a read reach the wire through the same
+   * steps. With `reply.signal`, the caller's wait rejects the moment it aborts, also while the send is still
+   * queued; a send not yet made by then is skipped.
    */
-  sendAwaitAck(sn, st, packet, outerCmd, innerCmd, channel, segment) {
-    return new Promise((resolve, reject) => {
+  async sendQueued(route, outerCmd, innerCmd, channel, body, reply) {
+    reply?.signal?.throwIfAborted();
+    const identity = this.deps.identity();
+    if (!identity)
+      throw new Error(`rtc: not logged in, cannot drive ${route.stationSn}`);
+    const adminUserId = route.adminUserId || identity.userId;
+    const st = await abortable(this.stationSession(route, adminUserId, identity), reply?.signal);
+    const segment = st.seg.next();
+    const packet = buildPortalPacket({
+      commandId: outerCmd,
+      channel,
+      segment,
+      payload: { account_id: adminUserId, ...body }
+    });
+    const run = st.queue.then(() => this.sendAwaitAck(route.stationSn, st, packet, outerCmd, innerCmd, channel, segment, reply));
+    st.queue = run.catch(() => void 0);
+    return abortable(run, reply?.signal);
+  }
+  /**
+   * Without `reply`, completes on the command ACK or a correlated control-result notification. The
+   * notification must match the request channel, parameter and segment and contain a structured payload.
+   * Receipt does not establish physical actuation. Bounded by {@link ACK_TIMEOUT_MS}.
+   *
+   * With `reply`, a zero-result ACK is not the answer: the first notify body (an object) for which
+   * `reply.pick` answers a value resolves with it, one `pick` throws on rejects with that error, and every
+   * other notify frame is left alone. Bounded by `reply.timeoutMs` (default {@link DB_TABLE_TIMEOUT_MS}),
+   * and ended by `reply.signal`; one already aborted is not sent.
+   *
+   * Either way an ACK with a non-zero result code rejects, and the command is sent once.
+   */
+  sendAwaitAck(sn, st, packet, outerCmd, innerCmd, channel, segment, reply) {
+    const timeoutMs = reply ? reply.timeoutMs ?? DB_TABLE_TIMEOUT_MS : ACK_TIMEOUT_MS;
+    const awaited = reply ? "reply" : "ACK";
+    return new Promise((resolve2, reject) => {
       const onData = (frame, linkType) => {
         const p = parsePortalPacket(frame, linkType);
-        if (!p || p.segment !== segment)
+        if (!p)
+          return;
+        if (reply && linkType === PortalLinkType.NOTIFY && typeof p.data === "object" && p.data !== null) {
+          let picked;
+          try {
+            picked = reply.pick(p.data);
+          } catch (e) {
+            cleanup();
+            reject(e instanceof Error ? e : new Error(String(e)));
+            return;
+          }
+          if (picked === void 0)
+            return;
+          cleanup();
+          this.deps.logger?.debug?.(`[rtc] ${sn} cmd ${innerCmd} answered`);
+          resolve2(picked);
+          return;
+        }
+        if (p.segment !== segment)
           return;
         const acknowledgement = linkType === PortalLinkType.COMMAND && p.commandId === outerCmd && !!p.isResponse;
         const d = p.data;
         const notification = outerCmd === PORTAL_CMD_CONTROL_PAYLOAD && linkType === PortalLinkType.NOTIFY && p.commandId === PORTAL_CMD_NOTIFY_PAYLOAD && p.isResponse === 0 && p.channel === channel && p.cmd === innerCmd && typeof d?.payload === "object" && d.payload !== null;
         if (!acknowledgement && !notification)
           return;
+        if (reply && p.errCode === 0)
+          return;
         cleanup();
         if (acknowledgement && p.errCode !== 0) {
           reject(new Error(`rtc: ${sn} rejected cmd ${innerCmd} (err ${p.errCode})`));
         } else {
           this.deps.logger?.debug?.(`[rtc] ${sn} cmd ${innerCmd} acked`);
-          resolve();
+          resolve2(void 0);
         }
       };
       const onClose = () => {
         cleanup();
-        reject(new Error(`rtc: ${sn} session closed while waiting for cmd ${innerCmd} ACK`));
+        reject(new Error(`rtc: ${sn} session closed while waiting for cmd ${innerCmd} ${awaited}`));
+      };
+      const onAbort = () => {
+        cleanup();
+        reject(reply?.signal?.reason);
       };
       const timer = setTimeout(() => {
         cleanup();
-        reject(new Error(`rtc: ${sn} cmd ${innerCmd} ACK timed out after ${ACK_TIMEOUT_MS}ms`));
-      }, ACK_TIMEOUT_MS);
+        reject(new Error(`rtc: ${sn} cmd ${innerCmd} ${awaited} timed out after ${timeoutMs}ms`));
+      }, timeoutMs);
       const cleanup = () => {
         clearTimeout(timer);
         st.session.off("commandData", onData);
         st.session.off("close", onClose);
+        reply?.signal?.removeEventListener("abort", onAbort);
         this.touch(sn, st);
       };
+      if (reply?.signal?.aborted) {
+        onAbort();
+        return;
+      }
       st.session.on("commandData", onData);
       st.session.on("close", onClose);
+      reply?.signal?.addEventListener("abort", onAbort, { once: true });
       if (!st.session.sendCommand(packet)) {
         cleanup();
         reject(new Error(`rtc: ${sn} command channel not open, cmd ${innerCmd} not sent`));
@@ -25665,7 +25898,7 @@ var RtcCommandRouter = class {
    * promise, so an early failure cannot leave a second one rejecting unheard.
    */
   bringUp(sn, session) {
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve2, reject) => {
       let settled = false;
       const finish = (err) => {
         if (settled)
@@ -25682,7 +25915,7 @@ var RtcCommandRouter = class {
           reject(err);
         } else {
           this.deps.logger?.info?.(`[rtc] ${sn} command channel up`);
-          resolve();
+          resolve2();
         }
       };
       const onConnected = () => finish();
@@ -26111,10 +26344,10 @@ function dpColorFields(spec) {
 }
 
 // dist/transport/mqtt/clean-codec.js
-import { randomUUID as randomUUID3 } from "node:crypto";
+import { randomUUID as randomUUID4 } from "node:crypto";
 function buildCleanDpEnvelope(accountId, deviceSn, dp, value, opts) {
   const payload = JSON.stringify({
-    t: opts?.uuid ?? randomUUID3(),
+    t: opts?.uuid ?? randomUUID4(),
     protocol: 2,
     account_id: accountId,
     device_sn: deviceSn,
@@ -26353,13 +26586,13 @@ var MqttCommandRouter = class _MqttCommandRouter {
    * timeout with no unhandled listener left behind either way.
    */
   waitForMqttMessage(mqtt, match, timeoutMs) {
-    return new Promise((resolve) => {
+    return new Promise((resolve2) => {
       const onMessage = (m) => {
         const result = match(m);
         if (result === void 0)
           return;
         cleanup();
-        resolve(result);
+        resolve2(result);
       };
       const cleanup = () => {
         clearTimeout(timer);
@@ -26367,7 +26600,7 @@ var MqttCommandRouter = class _MqttCommandRouter {
       };
       const timer = setTimeout(() => {
         cleanup();
-        resolve(void 0);
+        resolve2(void 0);
       }, timeoutMs);
       timer.unref?.();
       mqtt.on("message", onMessage);
@@ -26887,7 +27120,7 @@ function decryptReply(key, resultB64) {
 }
 
 // dist/transport/tuya/request.js
-import { randomUUID as randomUUID4 } from "node:crypto";
+import { randomUUID as randomUUID5 } from "node:crypto";
 var TUYA_API_ENDPOINT = "https://a1.tuyaeu.com/api.json";
 var TUYA_APP_KEY = "w8x4ppqkdxvqnd73ahj9";
 var TUYA_APP_SECRET = "pt585qhmt75hwcynchnps9dnxh9suhwd";
@@ -26919,7 +27152,7 @@ function buildApiParams(action, opts) {
     a: action.a,
     v: action.v,
     time: String(opts.time ?? Math.floor(Date.now() / 1e3)),
-    requestId: opts.requestId ?? randomUUID4(),
+    requestId: opts.requestId ?? randomUUID5(),
     sid: opts.session.sid,
     deviceId: opts.session.deviceId,
     chKey: opts.session.chKey,
@@ -28258,8 +28491,6 @@ var FcmRegistrar = class {
 };
 
 // dist/transport/push/store.js
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2, rmSync as rmSync2 } from "node:fs";
-import { dirname as dirname2 } from "node:path";
 var MemoryFcmStore = class {
   p = null;
   load() {
@@ -28272,31 +28503,7 @@ var MemoryFcmStore = class {
     this.p = null;
   }
 };
-var FileFcmStore = class {
-  path;
-  constructor(path) {
-    this.path = path;
-  }
-  load() {
-    try {
-      return JSON.parse(readFileSync2(this.path, "utf-8"));
-    } catch {
-      return null;
-    }
-  }
-  save(p) {
-    try {
-      mkdirSync2(dirname2(this.path), { recursive: true });
-    } catch {
-    }
-    writeFileSync2(this.path, JSON.stringify(p, null, 2), { mode: 384 });
-  }
-  clear() {
-    try {
-      rmSync2(this.path);
-    } catch {
-    }
-  }
+var FileFcmStore = class extends FileSessionStore {
 };
 
 // dist/transport/media-failure.js
@@ -28325,6 +28532,12 @@ var StoredImageCache = class {
   activeDevices = /* @__PURE__ */ new Set();
   activeDownloads = 0;
   generation = 0;
+  /**
+   * Bumped by {@link clearLifecycleErrors}. A lifecycle failure from a download started under an older
+   * count is not recorded; the candidate is queued again, unless a newer one is already queued, so the
+   * current session fetches it.
+   */
+  lifecycle = 0;
   constructor(downloader, logger, clock = Date.now, isLifecycleError = () => false) {
     this.downloader = downloader;
     this.logger = logger;
@@ -28380,6 +28593,18 @@ var StoredImageCache = class {
       return Promise.resolve(state.retained.image);
     return Promise.reject(new StoredSnapshotUnavailableError(reason, "No stored snapshot is available"));
   }
+  /**
+   * Forget every device's recorded lifecycle failure, keeping retained bytes and candidate state.
+   *
+   * A lifecycle failure describes the session that was current when the download ran, so it no longer
+   * holds once a login succeeds again; {@link snapshotStored} then answers from the retained image, or
+   * with the reason a stored image is absent. A download in flight across the call cannot record one.
+   */
+  clearLifecycleErrors() {
+    this.lifecycle += 1;
+    for (const state of this.devices.values())
+      state.lifecycleError = void 0;
+  }
   /** Invalidate all retained and candidate state. */
   clear() {
     this.generation += 1;
@@ -28395,18 +28620,23 @@ var StoredImageCache = class {
       state.inFlight = candidate;
       this.activeDownloads += 1;
       this.activeDevices.add(candidate.deviceKey);
-      void this.downloader(candidate.url, candidate.deviceKey).then((image) => this.complete(candidate, image), (error) => this.complete(candidate, void 0, error));
+      const lifecycle = this.lifecycle;
+      void this.downloader(candidate.url, candidate.deviceKey).then((image) => this.complete(candidate, lifecycle, image), (error) => this.complete(candidate, lifecycle, void 0, error));
     }
   }
-  complete(candidate, image, error) {
+  complete(candidate, lifecycle, image, error) {
     this.activeDownloads -= 1;
     this.activeDevices.delete(candidate.deviceKey);
     const state = this.devices.get(candidate.deviceKey);
     if (candidate.generation === this.generation && state?.inFlight === candidate) {
       state.inFlight = void 0;
       if (error !== void 0 && this.isLifecycleError(error)) {
-        state.lifecycleError = error;
-        state.reason = void 0;
+        if (lifecycle === this.lifecycle) {
+          state.lifecycleError = error;
+          state.reason = void 0;
+        } else {
+          state.queued ??= candidate;
+        }
       } else if (image === void 0 && this.retryLater(state, candidate, error)) {
         state.lifecycleError = void 0;
       } else if (image === void 0) {
@@ -28898,8 +29128,8 @@ var DeviceRegistry = class {
     const waiters = this.stateWaiters.get(sn);
     if (waiters) {
       this.stateWaiters.delete(sn);
-      for (const resolve of waiters)
-        resolve();
+      for (const resolve2 of waiters)
+        resolve2();
     }
   }
   /**
@@ -28944,15 +29174,15 @@ var DeviceRegistry = class {
   awaitRealtimeState(sn, timeoutMs) {
     if (this.hasRealtimeState(sn) || timeoutMs <= 0)
       return Promise.resolve();
-    return new Promise((resolve) => {
+    return new Promise((resolve2) => {
       const timer = setTimeout(() => {
         this.stateWaiters.get(sn)?.delete(done);
-        resolve();
+        resolve2();
       }, timeoutMs);
       timer.unref?.();
       const done = () => {
         clearTimeout(timer);
-        resolve();
+        resolve2();
       };
       const set = this.stateWaiters.get(sn) ?? /* @__PURE__ */ new Set();
       set.add(done);
@@ -29656,7 +29886,7 @@ var EufyMega = class extends EventEmitter14 {
           return true;
         const delay = Math.min(500, deadline - Date.now());
         if (delay > 0)
-          await new Promise((resolve) => setTimeout(resolve, delay));
+          await new Promise((resolve2) => setTimeout(resolve2, delay));
         if (refresh.expected !== void 0 && settled())
           return true;
       }
@@ -29705,7 +29935,7 @@ var EufyMega = class extends EventEmitter14 {
    * manager's own log, since by then nothing is waiting to receive it.
    */
   recycleStandaloneSession(sn) {
-    const releaseWrite = new Promise((resolve) => void setTimeout(resolve, SESSION_RECYCLE_WAIT_MS).unref?.());
+    const releaseWrite = new Promise((resolve2) => void setTimeout(resolve2, SESSION_RECYCLE_WAIT_MS).unref?.());
     return Promise.race([
       this.p2p.resetStandaloneSession(sn).finally(() => this.reopenWiredStation(sn)),
       releaseWrite.then(() => this.opts.logger?.debug(`[session ${sn}] recycle still waiting on an attached viewer \u2014 releasing the write that asked for it`))
@@ -29742,11 +29972,11 @@ var EufyMega = class extends EventEmitter14 {
   }
   /** Limit waiting on an unabortable dependency operation to the remaining semantic-event refresh window. */
   beforeDeadline(operation, timeoutMs) {
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve2, reject) => {
       const timeout = setTimeout(() => reject(new RefreshWindowClosedError("refresh window closed")), Math.max(0, timeoutMs));
       operation.then((value) => {
         clearTimeout(timeout);
-        resolve(value);
+        resolve2(value);
       }, (error) => {
         clearTimeout(timeout);
         reject(error);
@@ -29851,12 +30081,16 @@ var EufyMega = class extends EventEmitter14 {
   /**
    * On a successful login, kick off auto-realtime (unless `autoRealtime:false`). Fire-and-forget so
    * `login()` returns as soon as the session is ready — realtime channels come up in the background and
-   * surface failures via `error`. Idempotent through the retained generation promise.
+   * surface failures via `error`. Idempotent through the retained generation promise. A login for a
+   * different account drops every stored image; one for the same account drops only the lifecycle
+   * failures recorded against the session it replaces.
    */
   afterLogin(result) {
     if (result.status === LoginStatus.Ok) {
       if (this.storedImageAccount && this.storedImageAccount !== result.session.userId)
         this.storedImages?.clear();
+      else
+        this.storedImages?.clearLifecycleErrors();
       this.storedImageAccount = result.session.userId;
       const auth = this.mega.auth;
       if (auth?.userId)
@@ -29893,12 +30127,12 @@ var EufyMega = class extends EventEmitter14 {
     if (options.timeoutMs === void 0)
       return generation.promise;
     const timeoutMs = Math.max(0, options.timeoutMs);
-    return new Promise((resolve) => {
-      const timer = setTimeout(() => resolve(readinessSnapshot(generation.readiness, "timed-out")), timeoutMs);
+    return new Promise((resolve2) => {
+      const timer = setTimeout(() => resolve2(readinessSnapshot(generation.readiness, "timed-out")), timeoutMs);
       timer.unref?.();
       void generation.promise.then((result) => {
         clearTimeout(timer);
-        resolve(result);
+        resolve2(result);
       });
     });
   }
@@ -29939,10 +30173,10 @@ var EufyMega = class extends EventEmitter14 {
         let acknowledge;
         let reject;
         let acknowledged = false;
-        const acknowledgement = new Promise((resolve, rejectPromise) => {
+        const acknowledgement = new Promise((resolve2, rejectPromise) => {
           acknowledge = () => {
             acknowledged = true;
-            resolve();
+            resolve2();
           };
           reject = rejectPromise;
         });
@@ -30309,8 +30543,8 @@ var EufyMega = class extends EventEmitter14 {
     if (this.realtimeGeneration?.epoch === this.realtimeEpoch)
       return this.realtimeGeneration;
     const epoch = this.realtimeEpoch;
-    let resolve;
-    const promise = new Promise((done) => resolve = done);
+    let resolve2;
+    const promise = new Promise((done) => resolve2 = done);
     const generation = {
       epoch,
       readiness: {
@@ -30320,7 +30554,7 @@ var EufyMega = class extends EventEmitter14 {
         wiredP2p: createPlaneReadiness()
       },
       promise,
-      resolve,
+      resolve: resolve2,
       abort: new AbortController(),
       settled: false
     };
@@ -30471,6 +30705,9 @@ var EufyMega = class extends EventEmitter14 {
    * device absent from the previous pass is skipped — first sight is discovery, not a transition;
    * {@link deviceState} answers an initial reading.
    *
+   * A device with changed params is re-resolved by {@link widenCapabilities} once per pass, however many
+   * of its params moved, since each re-resolution is a cloud param-list read.
+   *
    * Then re-reads every Tuya clean-line robot from the Tuya cloud ({@link readTuyaDevices}): its state
    * is not in the cloud record this pass diffs and no live channel carries it, so the poll is where it
    * stays fresh. That read runs after the `try`, not inside it, so a cloud error on the list diff does
@@ -30489,8 +30726,8 @@ var EufyMega = class extends EventEmitter14 {
           this.emitSemantic(out.event, out.payload, { refresh: out.refresh });
       for (const dev of diff.reported)
         this.emit("deviceState", this.stateOf(dev));
-      for (const change of diff.params)
-        await this.widenCapabilities(change.deviceSn);
+      for (const sn of new Set(diff.params.map((c) => c.deviceSn)))
+        await this.widenCapabilities(sn);
     } catch (e) {
       this.reportError(e);
     }
@@ -30876,31 +31113,72 @@ var EufyMega = class extends EventEmitter14 {
     return this.p2p.getSessions();
   }
   /**
-   * The people enrolled on a station, read from its own `person_basic_info` table over P2P.
+   * The people enrolled on a station, read from its own `person_basic_info` table through
+   * {@link readStationTable}.
    *
    * The cloud roster (`api.getFaces()`) answers empty for an account that keeps its faces on the
    * station, because they were never uploaded — the station holds them.
    *
-   * Resolves with the rows the station returned. Rejects on a station that cannot be reached, on a
-   * record stating no `admin_user_id`, and on the reply not arriving whole in time. Assembling that
-   * reply is `P2PSession.readDatabase`'s; this resolves which station and which account id.
+   * Resolves with the rows the station returned that are objects. Rejects as {@link readStationTable}
+   * does.
    *
    * `stranger<n>` names are the station's own placeholders for a face nobody has named, and are
    * returned as they arrive; a caller that wants only named people filters them.
    */
   async getStationFaces(stationSn, opts = {}) {
+    const rows = await this.readStationTable(stationSn, "person_basic_info", opts);
+    return rows.filter((row) => typeof row === "object" && row !== null);
+  }
+  /**
+   * The rows of one of a station's own tables (`history_record_info`, `person_basic_info`, …), read over
+   * the transport the station speaks: the control channel of a HomeBase S1 Pro (T9000), P2P for any
+   * other station. The query is the table's whole content; the rows are the station's, shaped by it.
+   *
+   * Resolves with the rows the station returned. Rejects on a serial not in the device list, on a record
+   * stating no `admin_user_id`, on a station that cannot be reached, on a query the station refuses, and
+   * on the reply not arriving in time. Assembling the reply is the transport's; this resolves which
+   * station, which transport and which account id.
+   */
+  async readStationTable(stationSn, table, opts = {}) {
+    const { station, accountId, route } = await this.stationReadTarget("readStationTable", stationSn);
+    if (route)
+      return this.rtc.readTable(route, table, opts);
+    await this.p2p.ensureStation(station, opts.signal);
+    const session = this.p2p.getSessions().get(station);
+    if (!session)
+      throw new Error(`readStationTable: no P2P session for ${station}`);
+    return session.readDatabase(table, { accountId, ...opts });
+  }
+  /**
+   * One image stored on a HomeBase S1 Pro (T9000), by the on-station path a table row names
+   * (`thumb_path`, …), read over the station's control channel.
+   *
+   * Resolves with the image bytes as the station holds them. Rejects on a serial not in the device list,
+   * on a record stating no `admin_user_id`, on a station other than a T9000, on a station that cannot be
+   * reached, and on the reply not arriving in time. Fetching the image is the transport's; this resolves
+   * which station and which account id.
+   */
+  async readStationImage(stationSn, filePath, opts = {}) {
+    const { station, route } = await this.stationReadTarget("readStationImage", stationSn);
+    if (!route)
+      throw new Error(`readStationImage: ${station} is not a T9000; its stored images are not read here`);
+    return this.rtc.readImage(route, filePath, opts);
+  }
+  /**
+   * The station a database read goes to, its `admin_user_id` and, for a T9000, its RTC route. Throws,
+   * prefixed with `op`, on a serial the device list does not carry and on a record stating no admin id.
+   */
+  async stationReadTarget(op, stationSn) {
     if (!this.registry.list().length)
       await this.getDevices();
     const station = this.p2p.stationKeyOf(stationSn);
+    const found = this.stationOf(station);
+    if (!found.station)
+      throw new Error(`${op}: ${station} is not in the device list`);
     const accountId = this.adminUserIdOf(station);
     if (!accountId)
-      throw new Error(`getStationFaces: no admin_user_id on record for ${station}`);
-    await this.p2p.ensureStation(station, opts.signal);
-    const session = this.p2p.getSessions().get(station);
-    if (!session)
-      throw new Error(`getStationFaces: no P2P session for ${station}`);
-    const rows = await session.readDatabase("person_basic_info", { accountId, ...opts });
-    return rows.filter((row) => typeof row === "object" && row !== null);
+      throw new Error(`${op}: no admin_user_id on record for ${station}`);
+    return { station, accountId, route: found.t9000 ? this.rtcRouteFor(station) : void 0 };
   }
   /** The station's own `admin_user_id`, which its database refuses the query without. */
   adminUserIdOf(stationSn) {
@@ -31127,6 +31405,9 @@ var EufyMega = class extends EventEmitter14 {
    * Returns the connected client rather than installing it. Registration can outlive a `disconnect()`,
    * and {@link ensureRealtime} owns the decision of whether a finished bring-up is still the current
    * one — so this never overwrites a channel a later login already brought up.
+   *
+   * Persisting the seen ids after each push reports a failed `save` through `error` rather than throwing:
+   * the push handler runs inside the MCS socket's `data` callback, where a throw is an uncaught exception.
    */
   async startPush(signal) {
     if (!this.mega.auth)
@@ -31173,9 +31454,13 @@ var EufyMega = class extends EventEmitter14 {
         if (dsn)
           this.prewarmForEvent(out.event, dsn);
       }
-      store.save({ creds: persistedCreds, persistentIds: client.getPersistentIds() });
+      try {
+        store.save({ creds: persistedCreds, persistentIds: client.getPersistentIds() });
+      } catch (e) {
+        this.reportError(e);
+      }
     });
-    await new Promise((resolve, reject) => {
+    await new Promise((resolve2, reject) => {
       const cleanup = () => {
         signal?.removeEventListener("abort", onAbort);
         client.off("connect", onConnect);
@@ -31183,7 +31468,7 @@ var EufyMega = class extends EventEmitter14 {
       };
       const onConnect = () => {
         cleanup();
-        resolve();
+        resolve2();
       };
       const onError = (error) => {
         cleanup();