@mega-yfue/eufy-sdk 0.6.0-beta.14 → 0.6.0-beta.16

package/dist/index.js

@@ -106,8 +106,9 @@ function encryptLoginPassword(password) {
 }
 
 // dist/core/store.js
-import { mkdirSync, readFileSync, writeFileSync, rmSync } from "node:fs";
-import { dirname } from "node:path";
+import { randomUUID } from "node:crypto";
+import { lstatSync, mkdirSync, readFileSync, readlinkSync, realpathSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { dirname, resolve } from "node:path";
 var MemorySessionStore = class {
   s = null;
   load() {
@@ -120,6 +121,22 @@ var MemorySessionStore = class {
     this.s = null;
   }
 };
+var IN_PLACE_CODES = /* @__PURE__ */ new Set(["EACCES", "EPERM", "EBUSY", "EXDEV", "EROFS"]);
+function realTarget(path) {
+  try {
+    return realpathSync(path);
+  } catch (e) {
+    if (e.code !== "ENOENT")
+      throw e;
+    try {
+      if (!lstatSync(path).isSymbolicLink())
+        return path;
+    } catch {
+      return path;
+    }
+    return realTarget(resolve(dirname(path), readlinkSync(path)));
+  }
+}
 var FileSessionStore = class {
   path;
   constructor(path) {
@@ -133,11 +150,22 @@ var FileSessionStore = class {
     }
   }
   save(s) {
+    const target = realTarget(this.path);
     try {
-      mkdirSync(dirname(this.path), { recursive: true });
+      mkdirSync(dirname(target), { recursive: true });
     } catch {
     }
-    writeFileSync(this.path, JSON.stringify(s, null, 2), { mode: 384 });
+    const data = JSON.stringify(s, null, 2);
+    const tmp = `${target}.${randomUUID()}.tmp`;
+    try {
+      writeFileSync(tmp, data, { mode: 384, flag: "wx" });
+      renameSync(tmp, target);
+    } catch (e) {
+      rmSync(tmp, { force: true });
+      if (!IN_PLACE_CODES.has(e.code ?? ""))
+        throw e;
+      writeFileSync(target, data, { mode: 384 });
+    }
   }
   clear() {
     try {
@@ -1973,22 +2001,22 @@ ${this.auth_?.authToken ?? ""}`;
     return this.postSigned(`app-${service}-${this.region}.eufy.com`, path, body, true, {}, headerOverrides);
   }
   /**
-   * Fetch the per-station DSK key used in the P2P cloud-lookup payload. Mirrors
+   * Fetch the per-station DSK key using each station's reported cloud category. Mirrors
    * the legacy `get_dsk_keys` body shape on the mega devicerelation service.
    * The P2P *local* lookup path does not need this; only the cloud path does.
    */
-  async getDskKeys(stationSns, priorDsks = {}) {
+  async getDskKeys(stations, priorDsks = {}) {
     const invalid = {};
     const deviceDsks = [];
-    for (const sn of stationSns) {
+    for (const { sn, category } of stations) {
       const prev = priorDsks[sn] ?? "";
       invalid[sn] = prev;
-      deviceDsks.push({ invalid_dsk: prev, device_sn: sn, category: "eufy_security" });
+      deviceDsks.push({ invalid_dsk: prev, device_sn: sn, category: category || "eufy_security" });
     }
     const res = await this.post("devicerelation", "/app/devicerelation/get_dsk_keys", {
       device_dsks: deviceDsks,
       invalid_dsks: invalid,
-      station_sns: stationSns
+      station_sns: stations.map(({ sn }) => sn)
     });
     const out = {};
     for (const k of res.device_dsks ?? [])
@@ -2665,7 +2693,7 @@ var SecureMqtt = class extends EventEmitter {
     const port = c.endpoint_port ?? 8883;
     const pinned = this.o.instanceIp;
     const reconnectPeriod = this.o.reconnectPeriod ?? 5e3;
-    return await new Promise((resolve, reject) => {
+    return await new Promise((resolve2, reject) => {
       const client = pinned ? mqtt.connect({
         host: pinned,
         port,
@@ -2697,7 +2725,7 @@ var SecureMqtt = class extends EventEmitter {
       client.on("connect", () => {
         if (!settled) {
           settled = true;
-          resolve();
+          resolve2();
         }
         this.emit("connect");
       });
@@ -2840,7 +2868,7 @@ function parseStateInfoSignal(topic, raw) {
 }
 
 // dist/transport/mqtt/dp-codec.js
-import { randomUUID } from "node:crypto";
+import { randomUUID as randomUUID2 } from "node:crypto";
 var DP_MAGIC = [255, 9];
 var DP_HEADER_LEN = 9;
 function xorChecksum(buf) {
@@ -2878,7 +2906,7 @@ function buildDpEnvelope(opts) {
   };
   const head = {
     version: "1.0.0.1",
-    client_id: `ios-eufy_mega-${opts.accountId}-${randomUUID()}`,
+    client_id: `ios-eufy_mega-${opts.accountId}-${randomUUID2()}`,
     sess_id: "0000",
     msg_seq: 1,
     seed: "",
@@ -15560,7 +15588,7 @@ function readAddress(buf, offset) {
   };
 }
 function parseLookupAddr(msg) {
-  return readAddress(msg, 4);
+  return msg.length >= 12 ? readAddress(msg, 4) : void 0;
 }
 function parseRelayList(msg) {
   const out = [];
@@ -16198,7 +16226,7 @@ import { EventEmitter as EventEmitter2 } from "node:events";
 import dgram from "node:dgram";
 import { resolve4 } from "node:dns/promises";
 import { isIP as isIP2 } from "node:net";
-import { constants as constants2, createCipheriv as createCipheriv4, createDecipheriv as createDecipheriv4, generateKeyPairSync, privateDecrypt as privateDecrypt2, randomBytes as randomBytes4 } from "node:crypto";
+import { constants as constants2, createCipheriv as createCipheriv4, createECDH as createECDH3, createDecipheriv as createDecipheriv4, generateKeyPairSync, privateDecrypt as privateDecrypt2, randomBytes as randomBytes4 } from "node:crypto";
 
 // dist/transport/p2p/live-trace.js
 var LIVE_TRACE_MESSAGE = "[live] start trace";
@@ -16209,6 +16237,27 @@ function traceLiveStart(logger, trace, source) {
 // dist/transport/p2p/level2-settle.js
 var LEVEL2_SETTLE_MS = 8e3;
 
+// dist/transport/p2p/database-wire.js
+var CMD_DATABASE_IMAGE = 1308;
+var CMD_DATABASE = 1306;
+var DB_QUERY = { FULL_TABLE: 1e4, COMBINATION_WITH_AI: 10011, QUERY_LOCAL: 10017 };
+var DB_TABLE_TIMEOUT_MS = 15e3;
+function fullTableQuery(count2 = 2e3) {
+  return {
+    count: count2,
+    start_date: "",
+    end_date: "",
+    start_id: 0,
+    end_id: 1,
+    flag: 0,
+    need_ai: 1,
+    res_unzip: 1,
+    update_time: "0",
+    start_time: "0",
+    alarm_id: ""
+  };
+}
+
 // dist/transport/p2p/p2p-session.js
 var LOCAL_LOOKUP_PORT = 32108;
 var HEARTBEAT_MS = 5e3;
@@ -16262,9 +16311,6 @@ var CMD_SET_PAYLOAD = 1350;
 var CMD_NOTIFY_PAYLOAD = 1351;
 var PADDED_RESULT_BYTES = 132;
 var CMD_CAMERA_INFO = 1103;
-var CMD_DATABASE_IMAGE = 1308;
-var CMD_DATABASE = 1306;
-var DB_QUERY = { FULL_TABLE: 1e4, COMBINATION_WITH_AI: 10011, QUERY_LOCAL: 10017 };
 var GCM_AAD = Buffer.from("eufy security");
 var LEVEL2_SEQ_BASE = 16909056;
 function paramReport(payload) {
@@ -16281,7 +16327,6 @@ function paramReport(payload) {
   return Object.keys(out).length ? out : void 0;
 }
 var traceSequence = 0;
-var DB_TABLE_TIMEOUT_MS = 15e3;
 function firstTableRows(text2) {
   const decoded = Buffer.from(text2, "latin1").toString("utf8");
   for (let start = decoded.indexOf("{"); start >= 0; start = decoded.indexOf("{", start + 1)) {
@@ -16408,11 +16453,21 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
   level2Seq = 0;
   rsaPrivateKey;
   rsaModulusHex;
-  /** Guards the one-shot level-2 key negotiation kicked off by the GATEWAYINFO reply. */
+  /** The P-256 pair an attached camera's media start offers; see {@link mediaEccPrivateKey}. */
+  mediaEcc;
+  /**
+   * Per attached channel, the media-key type its latest start offered on this connection, or that last answered,
+   * and whether a keyframe has answered it. See {@link attachedStartKey} and {@link settleAttachedKey}.
+   */
+  attachedStartKeys = /* @__PURE__ */ new Map();
+  /**
+   * Whether a level-2 key negotiation kicked off by a GATEWAYINFO reply is in flight. Cleared when it
+   * settles, so a later reply — the answer to {@link repromptLevel2Key} — negotiates again.
+   */
   level2Negotiating = false;
   /**
    * Whether waiting for a level-2 key can still change the answer: `false` once one has been negotiated,
-   * once the one-shot negotiation concluded without one, and from the start when nothing can negotiate one.
+   * once a negotiation concluded without one, and from the start when nothing can negotiate one.
    */
   level2Pending;
   /** Waiters parked in {@link awaitLevel2Key}, woken the moment the negotiation settles either way. */
@@ -16517,7 +16572,8 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
    * The session grace runs from connect, when the station is prompted for `CMD_GATEWAYINFO`. A negotiation
    * beginning later does not restart it: best-effort media can proceed without the key, and restarting
    * would charge another grace to a source that may already be streaming. A session whose negotiation has
-   * settled answers without waiting at all, since being one-shot is what makes that answer final.
+   * settled answers without waiting at all: the answer stands until {@link repromptLevel2Key} re-opens the
+   * wait, since the station is prompted for `CMD_GATEWAYINFO` only on connect and on that re-prompt.
    *
    * An own-session camera whose grace expires here is NOT thereby a camera that will fail to stream. Measured
    * on one account: own-session cameras of two device types negotiated a key, three others never did, and
@@ -16550,7 +16606,7 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
     this.logger.debug(`[p2p] ${this.cfg.stationSn} waiting up to ${remaining}ms for the level-2 key`);
     this.trace({ phase: "level2-wait", waitMs: remaining });
     const waiters = this.level2Waiters;
-    const outcome = await new Promise((resolve) => {
+    const outcome = await new Promise((resolve2) => {
       let deadline;
       let settled = false;
       const finish = (result) => {
@@ -16561,7 +16617,7 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
         const at = waiters.indexOf(wake);
         if (at >= 0)
           waiters.splice(at, 1);
-        resolve(result);
+        resolve2(result);
       };
       const wake = (result) => finish(result);
       deadline = setTimeout(() => finish("timeout"), remaining);
@@ -16583,12 +16639,13 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
   /**
    * Ask the station for its gateway info a second time, re-opening a negotiation that concluded without a key.
    *
-   * The negotiation is one-shot per connection: the station is prompted once on connect, and a reply that
-   * never lands settles the wait so {@link awaitLevel2Key} answers `false` at once forever after. That is the
+   * Without this the station is prompted once on connect, and a negotiation that settles without a key
+   * leaves {@link awaitLevel2Key} answering `false` at once for the rest of that connection. That is the
    * right answer for best-effort media, which proceeds at level-1 — but an operation whose ONLY wire is
    * level-2 is then refused for the whole life of that connection, while a fresh session over the same
    * device negotiates a key normally. Measured: a session that had settled refused every such operation
-   * until it was rebuilt, at which point the station answered with a cipher id straight away.
+   * until it was rebuilt, at which point the station answered with a cipher id straight away. The reply to
+   * this ask runs the negotiation again and settles the re-opened wait either way.
    *
    * Bounded to one extra ask per connection, so a burst of such operations cannot turn a silent station into a
    * flood, and answers whether it asked — `false` when a key is already held, when nothing can negotiate one,
@@ -16609,6 +16666,7 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
   /** Record that the level-2 negotiation has finished, with or without a key, and wake every waiter. */
   settleLevel2(reason = "terminal") {
     this.level2Pending = false;
+    this.level2Negotiating = false;
     const outcome = this.level2Key ? "key" : reason;
     for (const wake of this.level2Waiters.splice(0))
       wake(outcome);
@@ -16618,13 +16676,14 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
    * `cipher_id`, resolve that cipher's private keys once (cloud `get_ciphers`, via the configured
    * `resolveCipherKey`), run the ECIES unwrap with the ECC key, and `setLevel2Key()`. A cipher with no
    * ECC key uses its RSA key instead and holds the RSA-decrypted 16-byte key as the AES-128-ECB level-2
-   * key. One-shot; emits `level2Ready` only when the AES-256-GCM key is negotiated, traces
+   * key. Emits `level2Ready` only when the AES-256-GCM key is negotiated, traces
    * `level2-set-payload-only` instead for the AES-128-ECB key, and emits `error` when the ECC unwrap
    * fails; an RSA unwrap failure is only traced (non-fatal either way — level-1 traffic keeps working).
    *
-   * Every outcome settles the wait in {@link awaitLevel2Key}, because being one-shot is what makes a
-   * failure final for this connection generation: nothing will retry it there, so a later command must be
-   * told at once rather than left to time out against a key that is not coming.
+   * Every outcome settles the wait in {@link awaitLevel2Key}, so a later command is told at once rather than
+   * left to time out against a key that is not coming. Settling also re-opens the negotiation, so a later
+   * GATEWAYINFO reply in the same connection generation runs it again; a lookup that completes after its
+   * generation ended settles nothing.
    */
   negotiateLevel2Key(gwPayload) {
     this.level2Negotiating = true;
@@ -16726,7 +16785,15 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
     const [level, outcome] = granted > 0 ? ["debug", ` (granted ${granted})`] : ["warn", " (request refused)"];
     this.logger[level](`[p2p] ${this.cfg.stationSn} UDP receive buffer below the ${RECEIVE_BUFFER_BYTES} bytes requested` + outcome + `; live video can lose keyframes. Raise the OS limit (net.core.rmem_max on Linux, kern.ipc.maxsockbuf on BSD) to at least ${RECEIVE_BUFFER_BYTES}.`);
   }
-  /** Open the socket and start the lookup → hole-punch handshake. */
+  /**
+   * Open the socket and start the lookup → hole-punch handshake.
+   *
+   * A socket closed or failing while binding never invokes its bind callback, so the bind wait also
+   * settles on the socket's `close` and `error`. On `close`, a connect whose session was closed meanwhile
+   * returns without starting the handshake, so it never sends a lookup or arms a timer on a closed
+   * session. On `error`, connect closes the session and rejects with {@link StationUnreachableError}
+   * carrying the bind error as its `cause`.
+   */
   async connect() {
     if (this.connecting || this.connected)
       return;
@@ -16734,6 +16801,7 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
     this.closed = false;
     this.connectionGeneration += 1;
     this.ackedRounds = void 0;
+    this.attachedStartKeys.clear();
     this.resetInboundSequencing();
     if (!this.level2KeyServes("set-payload")) {
       this.level2Pending = this.cfg.resolveCipherKey !== void 0;
@@ -16746,16 +16814,25 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
     this.socket = socket;
     socket.on("message", (msg, rinfo) => this.onMessage(msg, rinfo, socket));
     socket.on("error", (e) => this.emit("error", e));
-    await new Promise((resolve) => {
+    const generation = this.connectionGeneration;
+    await new Promise((resolve2, reject) => {
+      socket.once("close", resolve2);
+      socket.once("error", reject);
       socket.bind(() => {
+        socket.off("error", reject);
         try {
           socket.setBroadcast(true);
         } catch {
         }
         this.requestReceiveBuffer(socket);
-        resolve();
+        resolve2();
       });
+    }).catch(async (error) => {
+      await this.close();
+      throw new StationUnreachableError(this.cfg.stationSn, 0, { cause: error });
     });
+    if (generation !== this.connectionGeneration)
+      return;
     void _P2PSession.detectLocalIp().then((host) => {
       if (host && !this.closed)
         this.selfHost = host;
@@ -16763,7 +16840,6 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
     const { dskKey, cloudAddresses } = this.cfg;
     this.cloudLookup = dskKey && cloudAddresses?.length ? { key: dskKey, addresses: cloudAddresses } : void 0;
     if (this.cloudLookup && cloudAddresses) {
-      const generation = this.connectionGeneration;
       void resolveLookupServers(cloudAddresses).then((addresses) => {
         if (this.cloudLookup && !this.closed && generation === this.connectionGeneration)
           this.cloudLookup.addresses = addresses;
@@ -16816,7 +16892,7 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
    */
   static detectLocalIp() {
     if (!_P2PSession.localIpPromise) {
-      _P2PSession.localIpPromise = new Promise((resolve) => {
+      _P2PSession.localIpPromise = new Promise((resolve2) => {
         const probe = dgram.createSocket("udp4");
         let settled = false;
         const finish = (result) => {
@@ -16828,7 +16904,7 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
             probe.close();
           } catch {
           }
-          resolve(result);
+          resolve2(result);
         };
         const timer = setTimeout(() => finish(void 0), 2e3);
         probe.connect(53, "8.8.8.8", () => {
@@ -16980,9 +17056,11 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
     } else if (hasHeader(msg, ResponseMessageType.LOOKUP_ADDR)) {
       if (!this.connected) {
         const addr = parseLookupAddr(msg);
-        this.logger.debug(`[p2p] ${this.cfg.stationSn} LOOKUP_ADDR -> ${addr.host}:${addr.port}`);
-        if (addr.host !== "0.0.0.0")
-          this.beginCheckCam(addr, socket);
+        if (addr) {
+          this.logger.debug(`[p2p] ${this.cfg.stationSn} LOOKUP_ADDR -> ${addr.host}:${addr.port}`);
+          if (addr.host !== "0.0.0.0")
+            this.beginCheckCam(addr, socket);
+        }
       }
     } else if (hasHeader(msg, ResponseMessageType.RLY_TO)) {
       const to = parseRelayTo(msg);
@@ -17036,7 +17114,7 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
       probe.on("error", (error) => this.logger.warn("[p2p] lookup socket error", error.message));
       probe.on("message", (msg, rinfo) => this.onMessage(msg, rinfo, probe));
       this.probeSockets.push(probe);
-      await new Promise((resolve) => {
+      await new Promise((resolve2) => {
         let settled = false;
         const finish = (bound) => {
           if (settled)
@@ -17051,7 +17129,7 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
             } catch {
             }
           }
-          resolve();
+          resolve2();
         };
         const onError = () => finish(false);
         const onClose = () => finish(false);
@@ -17129,13 +17207,15 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
   startLiveMedia(channel = STATION_CHANNEL3, accountId = "", homeBaseAttached = false, opts) {
     if (homeBaseAttached) {
       this.tracedDatagramGaps = 0;
+      const key = this.connectAddress && this.level2Key ? this.attachedStartKey(channel) : void 0;
       this.trace({
         phase: "media-command",
         topology: "attached",
         action: "start",
-        level2: !!this.level2Key
+        level2: !!this.level2Key,
+        key
       });
-      this.sendMediaPayloadLevel2(CMD_START_REALTIME_MEDIA, channel, accountId, {});
+      this.sendMediaPayloadLevel2(CMD_START_REALTIME_MEDIA, channel, accountId, {}, key);
       return;
     }
     const want = this.level2Key ? "l2" : this.sendsInTheClear() ? "clear" : "l1";
@@ -17635,8 +17715,12 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
    * Send a CMD_SET_PAYLOAD(1350) wrapping `{account_id, cmd:<subCmd>, mChannel, mValue3:<subCmd>,
    * payload}`, encrypted level-2 (AES-256-GCM, signCode 8) — the app's media-control path. The
    * camera is selected by `mChannel` (= the device's `device_channel`) AND the frame-header channel.
+   * A start (HomeBase-controlled camera path, the V6 app's media-start envelope) also carries an
+   * `accountId` inside its payload and the media key `key` offers (see {@link attachedStartKey}). A start
+   * offering the P-256 point labels itself `ClientOS: "IOS"`, as every simple attached start in the app
+   * captures that carry that key form does; the RSA start keeps `"Android"`.
    */
-  sendMediaPayloadLevel2(subCmd, channel, accountId, payload) {
+  sendMediaPayloadLevel2(subCmd, channel, accountId, payload, key) {
     if (!this.connectAddress || !this.level2Key) {
       this.trace({
         phase: "media-command-unsent",
@@ -17646,11 +17730,11 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
     }
     const isStart = subCmd === CMD_START_REALTIME_MEDIA;
     const innerPayload = isStart ? {
-      ClientOS: "Android",
+      ClientOS: key === "ecc" ? "IOS" : "Android",
       accountId,
       camera_type: 0,
       entrytype: 0,
-      key: this.rsaModulus(),
+      key: key === "ecc" ? this.mediaEccPair().point : this.rsaModulus(),
       streamtype: 2,
       ...payload
     } : payload;
@@ -17725,6 +17809,70 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
       return void 0;
     }
   }
+  /**
+   * The media-key type the next attached start sent on `channel` offers, recorded as offered: ECC, the current
+   * app's form, for the first start this connection sends there; RSA for every start after one that no keyframe
+   * answered before it was re-issued; and, once a keyframe has answered, the type that opened it, until
+   * {@link settleAttachedKey} records another. Only an opened keyframe answers: frames no key opens, and deltas,
+   * do not. A re-issue is a full restart on an attached camera, so a camera that cannot read the point is asked
+   * with RSA, the start every station answers, and is not asked with the point again while that goes unanswered.
+   * A stream decoding with the session's pair reads either answer. A station without {@link mediaEccPrivateKey}
+   * is offered RSA only. A start that cannot be sent offers nothing and records nothing.
+   */
+  attachedStartKey(channel) {
+    if (!this.mediaEccPrivateKey)
+      return "rsa";
+    const last = this.attachedStartKeys.get(channel);
+    if (last?.answered)
+      return last.kind;
+    const kind = last ? "rsa" : "ecc";
+    this.attachedStartKeys.set(channel, { kind, answered: false });
+    return kind;
+  }
+  /**
+   * Record how a keyframe of `channel` was opened, which answers the starts there. A keyframe opened under a
+   * key type is an answer of that type, whichever type the latest start offered: a station can serve the
+   * P-256 start after the RSA re-issue went out. A plaintext keyframe
+   * answering an unanswered P-256 offer is a camera that did not use the point, and the next start there offers
+   * RSA; once a P-256 answer has been opened it changes nothing, and answering RSA, it settles RSA. Answers
+   * whether a new start is needed. A channel no attached start has offered a key on is left as it is.
+   */
+  settleAttachedKey(channel, opened) {
+    const last = this.attachedStartKeys.get(channel);
+    if (!last)
+      return false;
+    if (opened === "plain" && last.kind === "ecc")
+      return !last.answered;
+    this.attachedStartKeys.set(channel, { kind: opened === "ecc" ? "ecc" : "rsa", answered: true });
+    return false;
+  }
+  /**
+   * The 32-byte P-256 private scalar paired with the point an attached camera's media start offers as `key`.
+   * A camera answering that start wraps each keyframe's AES-256-GCM media key in an ECIES envelope for this
+   * key ({@link VideoFrameDecoder}). Generated once per session, like the RSA pair.
+   *
+   * `undefined` unless the station is a HomeBase 3 (`T8030`): the app's P-256 start and the device runs
+   * that answered it were both observed on that station only.
+   */
+  get mediaEccPrivateKey() {
+    return this.cfg.stationSn.startsWith("T8030") ? this.mediaEccPair().privateKey : void 0;
+  }
+  /**
+   * The session's P-256 pair: the private scalar as 32 bytes, and the public point as 128 hex characters,
+   * `x ‖ y` without the uncompressed-point prefix, the form the current app's attached-camera start carries in
+   * `key`. `ECDH.getPrivateKey()` drops a scalar's leading zero bytes, so the scalar is padded back to 32.
+   */
+  mediaEccPair() {
+    if (!this.mediaEcc) {
+      const ecdh = createECDH3("prime256v1");
+      ecdh.generateKeys();
+      this.mediaEcc = {
+        privateKey: Buffer.from(ecdh.getPrivateKey("hex").padStart(64, "0"), "hex"),
+        point: ecdh.getPublicKey().subarray(1).toString("hex")
+      };
+    }
+    return this.mediaEcc;
+  }
   /**
    * The RSA-1024 public-key modulus (128-byte hex) the station uses to wrap the per-stream media
    * key. Lazily generates a keypair; `rsaPrivateKey` decrypts the media key the station returns.
@@ -17837,25 +17985,6 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
   databasePayload(value, channel) {
     return !this.level2Key && this.sendsInTheClear() ? buildRawCommandPayload(Buffer.from(value, "utf-8"), channel, 0, this.nextClearCommandBytes(), 0) : buildStringCommandPayload(value, channel, this.level1Key, 1);
   }
-  /**
-   * Standard "give me the whole table" query params the eufy app uses for a direct
-   * `CMD_DATABASE` read (inner `cmd 10000`). `count` bounds the row count.
-   */
-  fullTableQuery(count2 = 2e3) {
-    return {
-      count: count2,
-      start_date: "",
-      end_date: "",
-      start_id: 0,
-      end_id: 1,
-      flag: 0,
-      need_ai: 1,
-      res_unzip: 1,
-      update_time: "0",
-      start_time: "0",
-      alarm_id: ""
-    };
-  }
   /**
    * Request the on-device edge-AI **face roster** over P2P — the phone-free path.
    *
@@ -17872,7 +18001,7 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
       accountId: opts.accountId,
       channel: opts.channel,
       innerCmd: DB_QUERY.FULL_TABLE,
-      query: this.fullTableQuery()
+      query: fullTableQuery()
     });
   }
   /**
@@ -17921,11 +18050,11 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
     this.queryDatabase(table, {
       accountId: opts.accountId,
       innerCmd: opts.innerCmd,
-      query: opts.query ?? this.fullTableQuery()
+      query: opts.query ?? fullTableQuery()
     });
     this.dbReadInFlight = true;
     try {
-      return await new Promise((resolve, reject) => {
+      return await new Promise((resolve2, reject) => {
         let text2 = "";
         const onChunk = (chunk) => {
           text2 += chunk.text;
@@ -17933,7 +18062,7 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
           if (result?.error !== void 0)
             settle(() => reject(new Error(`readDatabase: ${table} refused: ${result.error}`)));
           else if (result?.rows)
-            settle(() => resolve(result.rows));
+            settle(() => resolve2(result.rows));
         };
         const timer = setTimeout(() => settle(() => reject(new Error(`readDatabase: ${this.cfg.stationSn} sent no complete ${table}`))), opts.timeoutMs ?? DB_TABLE_TIMEOUT_MS);
         const onAbort = () => settle(() => reject(new Error("readDatabase: aborted")));
@@ -17963,7 +18092,7 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
       accountId: opts.accountId,
       channel: opts.channel,
       innerCmd: DB_QUERY.FULL_TABLE,
-      query: this.fullTableQuery()
+      query: fullTableQuery()
     });
   }
   /**
@@ -18027,8 +18156,12 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
    *
    * Only once the data type's reorder wait passes, or {@link REORDER_MAX_DATAGRAMS} pile up, is the datagram
    * treated as lost: a pending frame is discarded and delivery resumes from the earliest held datagram.
+   *
+   * A datagram shorter than the 8-byte DATA header carries no sequence number and is dropped unacknowledged.
    */
   onData(msg, addr) {
+    if (msg.length < 8)
+      return;
     const dataTypeBuffer = msg.subarray(4, 6);
     const seqNo = msg.subarray(6, 8).readUInt16BE();
     const dataType = dataTypeBuffer[1];
@@ -18194,6 +18327,13 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
         return P2PDataTypeHeader.DATA;
     }
   }
+  /**
+   * Decrypt and dispatch one inbound data frame.
+   *
+   * A `CMD_GATEWAYINFO` (1100) reply carries the ECIES envelope for the level-2 session key. When a
+   * cipher-key resolver is configured, no key that seals a set-payload is held and no negotiation is in
+   * flight, the reply starts one (async, fire-and-forget); a reply landing while one is in flight is ignored.
+   */
   handleFrame(header, payload, dataType) {
     let data = payload;
     const isMedia = header.commandId === CMD_VIDEO_FRAME || header.commandId === CMD_AUDIO_FRAME;
@@ -18299,12 +18439,12 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
     this.resetInboundSequencing();
     const socket = this.socket;
     if (socket && this.connectAddress) {
-      await new Promise((resolve) => this.send(this.connectAddress, RequestMessageType.END, void 0, socket, resolve));
+      await new Promise((resolve2) => this.send(this.connectAddress, RequestMessageType.END, void 0, socket, resolve2));
     }
-    await new Promise((resolve) => {
+    await new Promise((resolve2) => {
       if (!socket)
-        return resolve();
-      socket.close(() => resolve());
+        return resolve2();
+      socket.close(() => resolve2());
     });
     this.socket = void 0;
     this.emit("close");
@@ -19138,10 +19278,29 @@ function h265Geometry(sps) {
 }
 
 // dist/transport/p2p/audio-frame.js
+import { createDecipheriv as createDecipheriv7 } from "node:crypto";
 var CMD_AUDIO_FRAME2 = 1301;
 var AUDIO_HEADER_LEN = 16;
 var AUDIO_TYPE_OFFSET = 5;
 var AUDIO_CODECS = { 0: "aac-lc", 2: "g711a", 7: "aac-eld" };
+var AUDIO_NONCE_START = 32;
+var AUDIO_BODY_START = 44;
+function isSealedAudio(frame) {
+  return frame.length >= AUDIO_BODY_START && frame.length >= AUDIO_BODY_START + frame.readUInt32LE(0);
+}
+function openSealedAudio(frame, mediaKey) {
+  if (!isSealedAudio(frame))
+    return void 0;
+  try {
+    const decipher = createDecipheriv7("aes-256-gcm", mediaKey, frame.subarray(AUDIO_NONCE_START, AUDIO_BODY_START));
+    decipher.setAAD(VIDEO_GCM_AAD);
+    decipher.setAuthTag(frame.subarray(AUDIO_HEADER_LEN, AUDIO_NONCE_START));
+    const body = frame.subarray(AUDIO_BODY_START, AUDIO_BODY_START + frame.readUInt32LE(0));
+    return Buffer.concat([decipher.update(body), decipher.final()]);
+  } catch {
+    return void 0;
+  }
+}
 
 // dist/transport/p2p/live-stream.js
 var CMD_VIDEO_FRAME2 = 1300;
@@ -19173,6 +19332,8 @@ var LiveStream = class extends EventEmitter3 {
   tracedFirstVideoUnit = false;
   tracedFirstKeyframe = false;
   tracedDecodeFailures = 0;
+  /** How the frame that opened the latest access unit was read; see {@link settleStartKey}. */
+  unitOpenedBy = "plain";
   tracedFirstForeignFrame = false;
   stallTimer;
   /**
@@ -19195,8 +19356,9 @@ var LiveStream = class extends EventEmitter3 {
     this.channel = opts.channel ?? STATION_CHANNEL3;
     if (opts.homeBaseAttached && opts.channel !== void 0)
       this.mediaChannel = opts.channel;
-    if (opts.eccPrivateKey)
-      this.decoder = new VideoFrameDecoder(opts.eccPrivateKey);
+    const eccPrivateKey = opts.eccPrivateKey ?? (opts.homeBaseAttached ? session.mediaEccPrivateKey : void 0);
+    if (eccPrivateKey)
+      this.decoder = new VideoFrameDecoder(eccPrivateKey);
   }
   /** Emit a live trace under its session's handle and the channel this stream pulls. */
   trace(trace) {
@@ -19357,8 +19519,10 @@ var LiveStream = class extends EventEmitter3 {
             this.tracedFirstKeyframe = true;
             this.trace({ phase: "first-keyframe" });
           }
-          if (unit.keyframe)
+          if (unit.keyframe) {
             this.lastCodec = sniffAnnexbCodec(unit.data) ?? this.lastCodec;
+            this.settleStartKey();
+          }
           this.settleKeepalive();
           this.emit("video", {
             sourceTimestamp: unit.sourceTimestamp,
@@ -19370,8 +19534,8 @@ var LiveStream = class extends EventEmitter3 {
           });
         }
       } else if (f.commandId === CMD_AUDIO_FRAME2) {
-        const audio = f.data.length > AUDIO_HEADER_LEN ? f.data.subarray(AUDIO_HEADER_LEN) : f.data;
-        if (audio.length) {
+        const audio = this.audioPayload(f.data);
+        if (audio?.length) {
           const codecId = f.data.length > AUDIO_TYPE_OFFSET ? f.data.readUInt8(AUDIO_TYPE_OFFSET) : void 0;
           const codec = codecId === void 0 ? void 0 : AUDIO_CODECS[codecId];
           if (!codec) {
@@ -19422,19 +19586,54 @@ var LiveStream = class extends EventEmitter3 {
     return false;
   }
   /**
-   * The Annex-B payload of a frame that starts an access unit. The session decodes it when it can (it
-   * holds the RSA private key, and handles the plaintext form); the legacy header-strip and the ECIES
-   * {@link VideoFrameDecoder} are the fallbacks for an E2E camera.
+   * The Annex-B payload of a frame that starts an access unit. The authenticated ECIES/GCM
+   * {@link VideoFrameDecoder} goes first: its HMAC and GCM checks fail closed on a frame not sealed for its
+   * key. The session's RSA path cannot: on Node ≥ 24.5, PKCS#1 v1.5 decryption of a key not wrapped for it
+   * returns pseudo-random bytes instead of throwing (implicit rejection), which would decode an ECC
+   * keyframe into noise. The session's decode, which also passes plaintext frames, and the header strip
+   * follow. A payload that opens an access unit records how it was read: by the ECIES path, or otherwise by
+   * its sign code, sealed (`"rsa"`) or in the clear (`"plain"`).
    */
   annexbOf(payload, signCode) {
-    const annexb = this.session.decodeVideoFrame?.(payload, signCode) ?? this.plaintextAnnexB(payload);
-    if (annexb)
-      return annexb;
     const decoded = this.decoder?.decodeFrame(payload)?.h264;
-    if (!decoded && this.tracedDecodeFailures++ < MAX_TRACED_DECODE_FAILURES) {
+    if (decoded) {
+      if (beginsAccessUnit(decoded))
+        this.unitOpenedBy = "ecc";
+      return decoded;
+    }
+    const annexb = this.session.decodeVideoFrame?.(payload, signCode) ?? this.plaintextAnnexB(payload);
+    if (!annexb && this.tracedDecodeFailures++ < MAX_TRACED_DECODE_FAILURES) {
       this.trace({ phase: "video-decode-empty", signCode });
     }
-    return decoded;
+    if (annexb && beginsAccessUnit(annexb))
+      this.unitOpenedBy = signCode > 0 ? "rsa" : "plain";
+    return annexb;
+  }
+  /**
+   * Tell the session how this keyframe was opened, which answers the attached starts on this channel
+   * ({@link P2PSession.settleAttachedKey}), and re-issue the start when the session asks for one: a plaintext
+   * keyframe answering the session's P-256 offer, from a camera that did not use the point, which the next
+   * start asks with RSA. Only a delivered keyframe answers: a frame no key opens, or a continuation without the
+   * frame that opened its unit, delivers nothing.
+   */
+  settleStartKey() {
+    if (!this.session.settleAttachedKey?.(this.channel, this.unitOpenedBy))
+      return;
+    this.logger.debug(`[live ch${this.channel}] plaintext keyframe answered the P-256 offer \u2014 re-starting with RSA`);
+    this.sendStart();
+  }
+  /**
+   * The payload of an audio frame. On a stream with an ECIES decoder, a sealed frame ({@link isSealedAudio}) is
+   * opened under the media key of the latest keyframe, and answers `undefined` when it does not open or arrives
+   * before any keyframe gave a media key, since its bytes are ciphertext. Every other frame is the bytes after
+   * its header.
+   */
+  audioPayload(frame) {
+    if (!this.decoder || !isSealedAudio(frame)) {
+      return frame.length > AUDIO_HEADER_LEN ? frame.subarray(AUDIO_HEADER_LEN) : frame;
+    }
+    const mediaKey = this.decoder.currentMediaKey;
+    return mediaKey ? openSealedAudio(frame, mediaKey) : void 0;
   }
   /**
    * Report an access unit the transport could not complete.
@@ -19512,7 +19711,7 @@ async function captureSnapshotFromShared(source, opts = {}) {
   const skip = opts.skipKeyframes ?? (source.state === "live" ? 0 : 1);
   let burst;
   try {
-    burst = await new Promise((resolve, reject) => {
+    burst = await new Promise((resolve2, reject) => {
       const bufs = [];
       let sets = source.parameterSets;
       let codec = "h264";
@@ -19535,7 +19734,7 @@ async function captureSnapshotFromShared(source, opts = {}) {
         if (!settle)
           settle = setTimeout(() => {
             cleanup();
-            resolve({ h264: Buffer.concat(bufs), codec, sets });
+            resolve2({ h264: Buffer.concat(bufs), codec, sets });
           }, collectMs);
       };
       const onError = (err) => {
@@ -19579,7 +19778,7 @@ async function recordClip(session, seconds, opts = {}) {
   const stream = await openLiveStream(session, opts);
   let h264;
   try {
-    h264 = await new Promise((resolve, reject) => {
+    h264 = await new Promise((resolve2, reject) => {
       const bufs = [];
       let keyCount = 0, capturing = false;
       let sets;
@@ -19592,7 +19791,7 @@ async function recordClip(session, seconds, opts = {}) {
       };
       const collected = () => {
         detach();
-        resolve(primeForDecode(Buffer.concat(bufs), sets, codec2));
+        resolve2(primeForDecode(Buffer.concat(bufs), sets, codec2));
       };
       const failed = (reason, cause) => {
         detach();
@@ -19622,7 +19821,7 @@ async function recordClip(session, seconds, opts = {}) {
     stream.stop();
   }
   const codec = annexbFfmpegFormat(h264);
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     const ff = spawnFfmpeg([
       // prettier-ignore
       "-f",
@@ -19645,7 +19844,7 @@ async function recordClip(session, seconds, opts = {}) {
     ff.on("close", (code) => {
       const mp4 = Buffer.concat(out);
       if (mp4.length)
-        resolve(mp4);
+        resolve2(mp4);
       else
         reject(new Error(`ffmpeg mux failed (code ${code}): ${Buffer.concat(err).toString().slice(0, 200)}`));
     });
@@ -19684,7 +19883,7 @@ function jpegGeometry(jpeg) {
 }
 function annexbToJpeg(annexb, spawn2) {
   const codec = annexbFfmpegFormat(annexb);
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     const ff = spawnFfmpeg([
       // prettier-ignore
       "-f",
@@ -19711,7 +19910,7 @@ function annexbToJpeg(annexb, spawn2) {
       const encoded = jpeg.length >= 3 && jpeg.subarray(0, 3).toString("hex") === "ffd8ff";
       const geometry = encoded ? jpegGeometry(jpeg) : void 0;
       if (geometry)
-        return resolve({ jpeg, ...geometry });
+        return resolve2({ jpeg, ...geometry });
       const diagnostics = Buffer.concat(err).toString().slice(0, 200).trim();
       const what = code !== 0 ? `ffmpeg exited ${code}` : encoded ? "encoded image declares no frame header" : "no complete frame in the burst";
       reject(new LiveSnapshotUnavailableError("undecodable-burst", diagnostics ? `${what}: ${diagnostics}` : what));
@@ -19724,12 +19923,8 @@ function annexbToJpeg(annexb, spawn2) {
 }
 
 // dist/transport/p2p/recording-download.js
-import { createDecipheriv as createDecipheriv7 } from "node:crypto";
 var RECORDING_DATA_TYPE = 3;
 var VIDEO_HEADER_LEN2 = 22;
-var AUDIO_HEADER_LEN2 = 16;
-var AUDIO_NONCE_START = 32;
-var AUDIO_BODY_START = 44;
 var AUDIO_CODEC_AAC_LC = 0;
 var FINISH_CHANNEL = 0;
 var FIRST_FRAME_WAIT_MS = 2e4;
@@ -19744,12 +19939,12 @@ function homeBase2RecordingPath(channel, recording) {
 function receiveRecording(session, request) {
   let resolveFrames;
   let rejectFrames;
-  const frames = new Promise((resolve, reject) => {
-    resolveFrames = resolve;
+  const frames = new Promise((resolve2, reject) => {
+    resolveFrames = resolve2;
     rejectFrames = reject;
   });
   let resolveDrained;
-  const drained = new Promise((resolve) => resolveDrained = resolve);
+  const drained = new Promise((resolve2) => resolveDrained = resolve2);
   const limitMs = request.timeoutMs ?? DEFAULT_TRANSFER_MS;
   let collected = [];
   const started = Date.now();
@@ -19841,16 +20036,6 @@ function receiveRecording(session, request) {
   }
   return { frames, drained };
 }
-function openAudio(key, nonce, tag2, body) {
-  try {
-    const decipher = createDecipheriv7("aes-256-gcm", key, nonce);
-    decipher.setAAD(VIDEO_GCM_AAD);
-    decipher.setAuthTag(tag2);
-    return Buffer.concat([decipher.update(body), decipher.final()]);
-  } catch {
-    return void 0;
-  }
-}
 function decodeRecording(frames, eccPrivateKeyHex) {
   const eccPrivateKey = Buffer.from(eccPrivateKeyHex, "hex");
   if (eccPrivateKey.length !== 32)
@@ -19879,12 +20064,9 @@ function decodeRecording(frames, eccPrivateKeyHex) {
       }
     } else if (commandId === CommandType.CMD_AUDIO_FRAME) {
       const mediaKey = decoder.currentMediaKey;
-      if (!mediaKey || raw.length < AUDIO_BODY_START || raw[5] !== AUDIO_CODEC_AAC_LC)
+      if (!mediaKey || raw[5] !== AUDIO_CODEC_AAC_LC)
         continue;
-      const len = raw.readUInt32LE(0);
-      if (raw.length < AUDIO_BODY_START + len)
-        continue;
-      const aac = openAudio(mediaKey, raw.subarray(AUDIO_NONCE_START, AUDIO_BODY_START), raw.subarray(AUDIO_HEADER_LEN2, AUDIO_NONCE_START), raw.subarray(AUDIO_BODY_START, AUDIO_BODY_START + len));
+      const aac = openSealedAudio(raw, mediaKey);
       if (aac?.length)
         audio.push(aac);
     }
@@ -20287,7 +20469,8 @@ var SharedLiveSource = class {
    *
    * The previous stream is dropped rather than stopped through the state machine: it speaks to a session that
    * is gone, and its `stop` would be read as an upstream end. Only a warm-up that asked for a replacement
-   * rewarms, so this is inert on a source that is streaming or has already failed.
+   * rewarms, so this is inert on a source that is streaming or has already failed. Each call replaces the
+   * re-issue ticker rather than adding one, so the start goes out once per interval however often it runs.
    */
   rewarm() {
     if (this.disposed || !this.sessionReplacementAsked || this._state !== "warming")
@@ -20299,6 +20482,8 @@ var SharedLiveSource = class {
     this.openStream();
     this.warmAttempts++;
     this.logger.debug(`${this.tag} warming again on a replacement session (attempt ${this.warmAttempts})`);
+    if (this.warmRetryTimer)
+      clearInterval(this.warmRetryTimer);
     this.warmRetryTimer = setInterval(() => this.reissueStart(), this.warmRetryMs);
   }
   /**
@@ -21019,6 +21204,7 @@ function openReadableFromConsumer(consumer, opts = {}) {
     if (!readable.push(value))
       consumer.pause();
   });
+  consumer.on("budget", (notice) => readable.emit("budget", notice));
   consumer.on("stop", () => readable.push(null));
   consumer.on("error", (err) => readable.destroy(err));
   return readable;
@@ -21954,7 +22140,7 @@ var FragmentRecording = class extends EventEmitter6 {
           throw this.failure;
         if (this.ended)
           return;
-        await new Promise((resolve) => this.wake = resolve);
+        await new Promise((resolve2) => this.wake = resolve2);
       }
     } finally {
       this.stop();
@@ -22070,7 +22256,7 @@ var TALKBACK_CODEC_WAIT_MS = 3e3;
 var OWN_LIVE_SESSION_MODELS = /* @__PURE__ */ new Set(["T8030"]);
 var ELD_TALKBACK_MODELS = /* @__PURE__ */ new Set(["T8410C"]);
 function speakerCodec(consumer, talk, timeoutMs) {
-  return new Promise((resolve) => {
+  return new Promise((resolve2) => {
     let timer;
     const settle = (codec) => {
       clearTimeout(timer);
@@ -22078,7 +22264,7 @@ function speakerCodec(consumer, talk, timeoutMs) {
       consumer.off("audio", onAudio);
       consumer.off("stop", onStop);
       talk.off("stop", onStop);
-      resolve(codec);
+      resolve2(codec);
     };
     const onVideo = () => {
       timer ??= setTimeout(() => settle("aac-lc"), timeoutMs);
@@ -22130,6 +22316,18 @@ var P2PCommandRouter = class _P2PCommandRouter {
    * {@link liveSources} is a claim in flight.
    */
   liveSessionKeys = /* @__PURE__ */ new Map();
+  /**
+   * The live source build in flight per `${parentSn}:${channel}`, settled once its connection is opened
+   * or refused.
+   *
+   * A build awaits its media session before it can file the source in {@link liveSources}, so a second
+   * request for the same camera in that window finds nothing cached. Building a second source there
+   * overwrites the first, and the orphan's teardown then closes the connection the cached one streams
+   * on. A request that finds a build here waits for it, until its own signal aborts, then resolves its
+   * session again and reuses what the build filed, or builds its own when that build failed. The entry
+   * is removed when the build settles and its promise never rejects, so each wait ends on a later state.
+   */
+  liveSourceBuilds = /* @__PURE__ */ new Map();
   /**
    * The open talkback per `${parentSn}:${channel}`, if any. The device plays one audio stream at a
    * time and the session carries one audio sequence, so this path is exclusive where a live pull is
@@ -22309,17 +22507,30 @@ var P2PCommandRouter = class _P2PCommandRouter {
    * so a start issued before the key arrives is dropped as `media-command-unsent`, and the stream then
    * shows nothing until a later keepalive tick happens to find the key. A connected session that cannot
    * carry the start is not a connected session, so this refuses rather than returning one.
+   *
+   * A session refused its key within the grace, or never connected, is closed and dropped from the manager at
+   * once. Nothing else releases it: no source holds it, a wired station's session never idles out, and the
+   * manager hands the same session to every later open of the camera, so the next open dials a fresh
+   * connection instead. A session another open has since replaced is left to its own close.
    */
   async openMediaSession(parentSn, channel, signal) {
-    const session = await this.openSession(_P2PCommandRouter.mediaSessionKey(parentSn, channel), parentSn);
-    await this.awaitConnected(session, parentSn, signal);
-    let ready = await abortable(session.awaitLevel2Key(LEVEL2_GRACE_MS, "call"), signal);
-    if (!ready && session.repromptLevel2Key()) {
-      ready = await abortable(session.awaitLevel2Key(LEVEL2_GRACE_MS, "call"), signal);
-    }
-    if (!ready)
-      throw new StationKeyUnavailableError(parentSn);
-    return session;
+    const mediaKey = _P2PCommandRouter.mediaSessionKey(parentSn, channel);
+    const session = await this.openSession(mediaKey, parentSn);
+    try {
+      await this.awaitConnected(session, parentSn, signal);
+      let ready = await abortable(session.awaitLevel2Key(LEVEL2_GRACE_MS, "call"), signal);
+      if (!ready && session.repromptLevel2Key()) {
+        ready = await abortable(session.awaitLevel2Key(LEVEL2_GRACE_MS, "call"), signal);
+      }
+      if (!ready)
+        throw new StationKeyUnavailableError(parentSn);
+      return session;
+    } catch (error) {
+      if (!signal?.aborted && this.manager.get(mediaKey) === session) {
+        void this.manager.close(mediaKey).catch((e) => this.reportError(e instanceof Error ? e : new Error(String(e))));
+      }
+      throw error;
+    }
   }
   /**
    * Wait for `session` to connect, for up to the session's own connect deadline, and throw
@@ -22357,7 +22568,7 @@ var P2PCommandRouter = class _P2PCommandRouter {
         throw new Error(`no P2P endpoint (p2p_did) for station ${parentSn}`);
       let dskKey;
       try {
-        dskKey = (await this.deps.mega.getDskKeys([parentSn]))[parentSn]?.dskKey;
+        dskKey = (await this.deps.mega.getDskKeys([stationDev]))[parentSn]?.dskKey;
       } catch (e) {
         this.deps.onError(e instanceof Error ? e : new Error(String(e)));
       }
@@ -22459,7 +22670,7 @@ var P2PCommandRouter = class _P2PCommandRouter {
       const session = await this.openSession(parentSn, parentSn);
       if (session.isConnected)
         return;
-      await new Promise((resolve, reject) => {
+      await new Promise((resolve2, reject) => {
         const cleanup = () => {
           signal?.removeEventListener("abort", onAbort);
           session.off("connect", onConnect);
@@ -22468,7 +22679,7 @@ var P2PCommandRouter = class _P2PCommandRouter {
         };
         const onConnect = () => {
           cleanup();
-          resolve();
+          resolve2();
         };
         const onError = (error) => {
           cleanup();
@@ -22828,6 +23039,11 @@ var P2PCommandRouter = class _P2PCommandRouter {
       signal: opts.signal
     });
     const key = `${parentSn}:${channel}`;
+    const build = this.liveSourceBuilds.get(key);
+    if (build) {
+      await abortable(build, opts.signal);
+      return this.sharedLiveSourceFor(sn, opts, continuous);
+    }
     const ownSession = continuous && homeBaseAttached && this.ownsLiveSession(parentSn);
     let source = this.liveSources.get(key);
     if (source && (source.state === "stopped" || ownSession && source.state !== "idle" && source.consumerCount === 0 && this.liveSessionKeys.get(key) === parentSn)) {
@@ -22839,6 +23055,8 @@ var P2PCommandRouter = class _P2PCommandRouter {
       const logger = this.deps.logger ?? noopLogger;
       const sessionKey = ownSession || continuous && homeBaseAttached && this.stationSessionInUse(parentSn, key) ? _P2PCommandRouter.mediaSessionKey(parentSn, channel) : parentSn;
       this.liveSessionKeys.set(key, sessionKey);
+      const built = Promise.withResolvers();
+      this.liveSourceBuilds.set(key, built.promise);
       let held;
       try {
         held = {
@@ -22847,6 +23065,9 @@ var P2PCommandRouter = class _P2PCommandRouter {
       } catch (error) {
         this.liveSessionKeys.delete(key);
         throw error;
+      } finally {
+        this.liveSourceBuilds.delete(key);
+        built.resolve();
       }
       source = new SharedLiveSource({
         makeStream: (ctx) => new LiveStream(held.session, {
@@ -23151,7 +23372,7 @@ var P2PCommandRouter = class _P2PCommandRouter {
   async p2pQuery(sn, subCmd, opts = {}) {
     const { session, channel, accountId } = await this.resolveSession(sn, { waitLevel2: true });
     const timeoutMs = opts.timeoutMs ?? 15e3;
-    return await new Promise((resolve, reject) => {
+    return await new Promise((resolve2, reject) => {
       const timer = setTimeout(() => {
         cleanup();
         reject(new Error(`timeout waiting for p2p query ${subCmd} reply from ${sn}`));
@@ -23160,7 +23381,7 @@ var P2PCommandRouter = class _P2PCommandRouter {
         const j = f.json;
         if (f.channel === channel && f.commandId === CommandType.CMD_NOTIFY_PAYLOAD && j?.cmd === subCmd && j.payload && typeof j.payload === "object") {
           cleanup();
-          resolve(j.payload);
+          resolve2(j.payload);
         }
       };
       const cleanup = () => {
@@ -23190,7 +23411,7 @@ var P2PCommandRouter = class _P2PCommandRouter {
   async p2pControlQuery(sn, param, data, opts = {}) {
     const { session } = await this.resolveSession(sn, { waitLevel2: false });
     const timeoutMs = opts.timeoutMs ?? 15e3;
-    return await new Promise((resolve, reject) => {
+    return await new Promise((resolve2, reject) => {
       const timer = setTimeout(() => {
         cleanup();
         reject(new Error(`timeout waiting for p2p control query ${param} reply from ${sn}`));
@@ -23199,7 +23420,7 @@ var P2PCommandRouter = class _P2PCommandRouter {
         const j = f.json;
         if (j?.cmd === param && j.payload && typeof j.payload === "object") {
           cleanup();
-          resolve(j.payload);
+          resolve2(j.payload);
         }
       };
       const cleanup = () => {
@@ -23296,12 +23517,12 @@ var P2PCommandRouter = class _P2PCommandRouter {
    * is ignored rather than resolving the wrong read.
    */
   awaitRtspUrl(session, channel, signal) {
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve2, reject) => {
       const onUrl = (ev) => {
         if (ev.channel !== channel)
           return;
         cleanup();
-        resolve(ev.url);
+        resolve2(ev.url);
       };
       const onAbort = () => {
         cleanup();
@@ -23621,7 +23842,7 @@ var P2PCommandRouter = class _P2PCommandRouter {
    * wrapper has to share {@link serializeKeyed}.
    */
   awaitKeyedReply(sn, session, channel, engage, send) {
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve2, reject) => {
       let refused = false;
       let mark;
       let timer;
@@ -23641,7 +23862,7 @@ var P2PCommandRouter = class _P2PCommandRouter {
         if (refused)
           return;
         refused = true;
-        expire(_P2PCommandRouter.KEYED_REFUSAL_TWIN_MS, () => settle(() => resolve({ code: KEYED_PAYLOAD_SEQ_ERROR, mark })));
+        expire(_P2PCommandRouter.KEYED_REFUSAL_TWIN_MS, () => settle(() => resolve2({ code: KEYED_PAYLOAD_SEQ_ERROR, mark })));
       };
       const onResult = (r) => {
         if (r.channel !== channel)
@@ -23649,7 +23870,7 @@ var P2PCommandRouter = class _P2PCommandRouter {
         if (r.code === KEYED_PAYLOAD_SEQ_ERROR)
           refuse();
         else if (!refused)
-          settle(() => resolve({ code: r.code }));
+          settle(() => resolve2({ code: r.code }));
       };
       const onData = (f) => {
         if (f.channel !== channel || f.commandId !== CommandType.CMD_NOTIFY_PAYLOAD)
@@ -23661,7 +23882,7 @@ var P2PCommandRouter = class _P2PCommandRouter {
         }
         const code = keyedPayloadReportCode(f.json, engage);
         if (code !== void 0 && !refused)
-          settle(() => resolve({ code }));
+          settle(() => resolve2({ code }));
       };
       session.on("commandResult", onResult);
       session.on("data", onData);
@@ -23766,7 +23987,7 @@ var P2PCommandRouter = class _P2PCommandRouter {
       clearTimeout(timer);
       session.off("data", onData);
     };
-    const getReplyPromise = new Promise((resolve) => {
+    const getReplyPromise = new Promise((resolve2) => {
       onData = (f) => {
         const j = f.json;
         if (j?.cmd !== CMD_TRANSFER_PAYLOAD || !j.payload)
@@ -23779,11 +24000,11 @@ var P2PCommandRouter = class _P2PCommandRouter {
         if (keyTime === void 0 || keyTime !== query.time)
           return;
         cleanup();
-        resolve({ lockPayload, keyTime });
+        resolve2({ lockPayload, keyTime });
       };
       timer = setTimeout(() => {
         cleanup();
-        resolve(void 0);
+        resolve2(void 0);
       }, _P2PCommandRouter.FF09_SETTINGS_GET_TIMEOUT_MS);
       session.on("data", onData);
     });
@@ -23912,7 +24133,9 @@ var PORTAL_KEEPALIVE = Buffer.from("0009000010000000000000006300000000000000585a
 var PORTAL_KEEPALIVE_MS = 29e3;
 
 // dist/transport/rtc/portal-packet.js
+import { zstdDecompressSync } from "node:zlib";
 var MAGIC2 = Buffer.from("XZYH", "ascii");
+var ZSTD_MAGIC_LE = 4247762216;
 var PORTAL_HEADER_LENGTH = 16;
 var PORTAL_CMD_SET_PAYLOAD = 1350;
 var PORTAL_STATION_CHANNEL = 255;
@@ -23976,11 +24199,23 @@ function parseJsonBody(buf) {
     return text2;
   }
 }
+function unwrapZstd(buf) {
+  if (buf.length < 4 || buf.readUInt32LE(0) !== ZSTD_MAGIC_LE)
+    return buf;
+  try {
+    return zstdDecompressSync(buf);
+  } catch {
+    return void 0;
+  }
+}
 function parsePortalPacket(buf, linkType = PortalLinkType.COMMAND) {
-  const header = parsePortalHeader(buf);
+  const packet = unwrapZstd(buf);
+  if (!packet)
+    return void 0;
+  const header = parsePortalHeader(packet);
   if (!header)
     return void 0;
-  const body = buf.subarray(PORTAL_HEADER_LENGTH, PORTAL_HEADER_LENGTH + header.paramLength);
+  const body = packet.subarray(PORTAL_HEADER_LENGTH, PORTAL_HEADER_LENGTH + header.paramLength);
   if (linkType === PortalLinkType.NOTIFY) {
     const data = parseJsonBody(body);
     const cmd = typeof data === "object" && data !== null && "cmd" in data ? Number(data.cmd) : void 0;
@@ -24712,12 +24947,12 @@ var RtcPeer = class extends EventEmitter9 {
       this.remoteMid = media ? offer.match(/^a=mid:([^\r\n]+)/m)?.[1]?.trim() ?? HUB_SDP_MID : midOf(offer, "application") ?? HUB_SDP_MID;
       if (media)
         this.videoMid = midOf(offer, "video");
-      const answerWait = new Promise((resolve, reject) => {
+      const answerWait = new Promise((resolve2, reject) => {
         const timer = setTimeout(() => {
           this.localAnswer = void 0;
           reject(new Error("timed out waiting for the local SDP answer"));
         }, ANSWER_TIMEOUT_MS);
-        this.localAnswer = { resolve, reject, timer };
+        this.localAnswer = { resolve: resolve2, reject, timer };
       });
       pc.setRemoteDescription(offer, "offer");
       this.remoteSet = true;
@@ -24879,7 +25114,7 @@ var RtcPeer = class extends EventEmitter9 {
 
 // dist/transport/rtc/signaling.js
 import { EventEmitter as EventEmitter10 } from "node:events";
-import { createHmac as createHmac3, randomUUID as randomUUID2 } from "node:crypto";
+import { createHmac as createHmac3, randomUUID as randomUUID3 } from "node:crypto";
 var RTC_WS_PATH = "/v1/rtc/ws/join?reqtype=nvr";
 var RTC_SIGN_PATH = "/v1/smart/nvr/ws/sign";
 var PORTAL_ORIGIN = "https://security.eufy.com";
@@ -24919,7 +25154,7 @@ var RtcSignalingClient = class extends EventEmitter10 {
     this.createSocket = opts.createSocket ?? defaultSocket;
     this.logger = opts.logger ?? noopLogger;
     this.now = opts.now ?? Date.now;
-    this.makeMsgId = opts.makeMsgId ?? (() => randomUUID2().replace(/-/g, ""));
+    this.makeMsgId = opts.makeMsgId ?? (() => randomUUID3().replace(/-/g, ""));
   }
   get isOpen() {
     return this.ws?.readyState === WS_OPEN;
@@ -24963,7 +25198,7 @@ var RtcSignalingClient = class extends EventEmitter10 {
     };
     const protocols = ["v1", Buffer.from(JSON.stringify(auth)).toString("base64url")];
     this.logger.debug(`[rtc] ${this.opts.stationSn} signalling connect ${this.wsUrl}`);
-    await new Promise((resolve, reject) => {
+    await new Promise((resolve2, reject) => {
       const timer = setTimeout(() => {
         reject(new Error(`RTC signalling connect timeout after ${SIGNALING_CONNECT_TIMEOUT_MS}ms`));
         this.close();
@@ -24977,7 +25212,7 @@ var RtcSignalingClient = class extends EventEmitter10 {
         this.sendAuth(sign);
         this.startKeepalive();
         this.emit("open");
-        resolve();
+        resolve2();
       });
       ws.addEventListener("message", (ev) => {
         void this.handleWireMessage(ev.data);
@@ -25144,10 +25379,7 @@ var RtcSession = class extends EventEmitter11 {
         this.emit("error", e instanceof Error ? e : new Error(String(e)));
       });
     });
-    this.signaling.on("close", () => {
-      this.connected = false;
-      this.announceClose();
-    });
+    this.signaling.on("close", () => this.shutdown());
     this.signaling.on("error", (e) => this.emit("error", e));
     this.peer.on("iceCandidate", (c) => this.trickle(toWireCandidate(c)));
     this.peer.on("iceGatheringComplete", () => this.trickle(""));
@@ -25250,12 +25482,12 @@ var RtcSession = class extends EventEmitter11 {
   waitForAuth() {
     if (this.authOk)
       return Promise.resolve();
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve2, reject) => {
       const timer = setTimeout(() => {
         this.authWaiter = void 0;
         reject(new Error("RTC signalling auth timeout"));
       }, AUTH_TIMEOUT_MS);
-      this.authWaiter = { resolve, reject, timer };
+      this.authWaiter = { resolve: resolve2, reject, timer };
     });
   }
   /** Settle a pending auth wait: resolve it, or reject it with `err`; either way its timer stops. */
@@ -25382,6 +25614,7 @@ var RtcCommandRouter = class {
   lives = /* @__PURE__ */ new Map();
   warm = /* @__PURE__ */ new Map();
   callSources = /* @__PURE__ */ new Map();
+  lastTransaction = 0;
   constructor(deps) {
     this.deps = deps;
   }
@@ -25391,21 +25624,80 @@ var RtcCommandRouter = class {
     }
     if (route.mediaTrack)
       throw new Error(`rtc: ${route.stationSn} serves media only and takes no portal command`);
-    const identity = this.deps.identity();
-    if (!identity)
-      throw new Error(`rtc: not logged in, cannot drive ${route.stationSn}`);
-    const { stationSn } = route;
-    const adminUserId = route.adminUserId || identity.userId;
     const channel = route.attached ? cmd.channel : PORTAL_STATION_CHANNEL;
-    const st = await this.stationSession(route, adminUserId, identity);
-    const outerCmd = cmd.kind === "set-json" ? PORTAL_CMD_CONTROL_PAYLOAD : PORTAL_CMD_SET_PAYLOAD;
-    const innerCmd = cmd.kind === "set-json" ? cmd.param : cmd.cmd;
-    const payload = cmd.kind === "set-json" ? { account_id: adminUserId, cmd: cmd.param, commandType: cmd.param, data: cmd.data } : { account_id: adminUserId, cmd: cmd.cmd, mValue3: cmd.mValue3 ?? 0, payload: cmd.payload };
-    const segment = st.seg.next();
-    const packet = buildPortalPacket({ commandId: outerCmd, channel, segment, payload });
-    const run = st.queue.then(() => this.sendAwaitAck(stationSn, st, packet, outerCmd, innerCmd, channel, segment));
-    st.queue = run.catch(() => void 0);
-    return run;
+    if (cmd.kind === "set-json") {
+      return this.sendQueued(route, PORTAL_CMD_CONTROL_PAYLOAD, cmd.param, channel, {
+        cmd: cmd.param,
+        commandType: cmd.param,
+        data: cmd.data
+      });
+    }
+    return this.sendQueued(route, PORTAL_CMD_SET_PAYLOAD, cmd.cmd, channel, {
+      cmd: cmd.cmd,
+      mValue3: cmd.mValue3 ?? 0,
+      payload: cmd.payload
+    });
+  }
+  /**
+   * Query one on-station table over the station's control channel and answer its rows.
+   *
+   * Sends the `1350` envelope with inner `{cmd: 1306, payload: {cmd: 10000, table, payload, transaction}}`,
+   * the whole-table query, on the station channel. The hub ACKs on the command link and answers with one notify frame whose body
+   * carries `{cmd, table, data, mIntRet, msg, transaction, …}`, echoing the read's `transaction`; that echo
+   * is the only thing a reply is attributed by, and every read sends a `transaction` no other read on this
+   * router has sent. Resolves with the reply's `data` rows. Rejects with the hub's `msg` on a non-zero
+   * `mIntRet`, on an ACK refusing the envelope, at once when `signal` aborts (queued or sent), when the
+   * session closes, and when `timeoutMs` (default {@link DB_TABLE_TIMEOUT_MS}) elapses with no reply.
+   *
+   * One read or command at a time per station: the read holds the station's send queue until it settles.
+   */
+  readTable(route, table, opts = {}) {
+    const transaction = this.nextTransaction();
+    const inner = {
+      cmd: DB_QUERY.FULL_TABLE,
+      table,
+      payload: fullTableQuery(),
+      transaction
+    };
+    return this.sendQueued(route, PORTAL_CMD_SET_PAYLOAD, CMD_DATABASE, PORTAL_STATION_CHANNEL, { cmd: CMD_DATABASE, mValue3: 0, payload: inner }, {
+      timeoutMs: opts.timeoutMs,
+      signal: opts.signal,
+      pick: (body) => {
+        if (String(body.transaction) !== transaction)
+          return void 0;
+        if (typeof body.mIntRet === "number" && body.mIntRet !== 0) {
+          throw new Error(`rtc: ${route.stationSn} refused ${table}: ${body.msg ?? body.mIntRet} (${body.mIntRet})`);
+        }
+        return Array.isArray(body.data) ? body.data : void 0;
+      }
+    });
+  }
+  /**
+   * Fetch one stored image by its on-station path over the station's control channel.
+   *
+   * Sends the `1350` envelope with inner `{cmd: 1308, payload: [{file}]}` on the station channel. The hub
+   * ACKs on the command link and answers with one notify frame whose body is `{file, content}`, `content`
+   * the image in base64, and no `transaction`; the reply is the one whose `file` equals `filePath`. A reply
+   * arriving after an abandoned read of the same path carries that path's bytes, which are the bytes a
+   * later read of it asks for. Resolves with the decoded bytes. Rejects on an ACK refusing the envelope,
+   * at once when `signal` aborts (queued or sent), when the session closes, and when `timeoutMs` (default
+   * {@link DB_TABLE_TIMEOUT_MS}) elapses with no reply.
+   *
+   * One read or command at a time per station: the read holds the station's send queue until it settles.
+   */
+  readImage(route, filePath, opts = {}) {
+    return this.sendQueued(route, PORTAL_CMD_SET_PAYLOAD, CMD_DATABASE_IMAGE, PORTAL_STATION_CHANNEL, { cmd: CMD_DATABASE_IMAGE, mValue3: 0, payload: [{ file: filePath }] }, {
+      ...opts,
+      pick: (body) => body.file === filePath && typeof body.content === "string" ? Buffer.from(body.content, "base64") : void 0
+    });
+  }
+  /**
+   * A `transaction` stamp in the vendor app's shape, a decimal epoch-in-milliseconds string, strictly
+   * greater than the last one this router issued, so two reads in the same millisecond never share one.
+   */
+  nextTransaction() {
+    this.lastTransaction = Math.max(Date.now(), this.lastTransaction + 1);
+    return String(this.lastTransaction);
   }
   /**
    * The media of a camera on a T9000: live video, a readable feed and a live still over the station's
@@ -25581,45 +25873,109 @@ var RtcCommandRouter = class {
     return source;
   }
   /**
-   * Completes on the command ACK or a correlated control-result notification. The notification must
-   * match the request channel, parameter and segment and contain a structured payload. Receipt does
-   * not establish physical actuation. The command is sent once, bounded by {@link ACK_TIMEOUT_MS}.
+   * Send one envelope on the station's session, queued behind its other sends, and settle as
+   * {@link sendAwaitAck} does. `body` is the inner payload; the station session, the `account_id` it is
+   * stamped with and the packet are resolved here, so a command and a read reach the wire through the same
+   * steps. With `reply.signal`, the caller's wait rejects the moment it aborts, also while the send is still
+   * queued; a send not yet made by then is skipped.
+   */
+  async sendQueued(route, outerCmd, innerCmd, channel, body, reply) {
+    reply?.signal?.throwIfAborted();
+    const identity = this.deps.identity();
+    if (!identity)
+      throw new Error(`rtc: not logged in, cannot drive ${route.stationSn}`);
+    const adminUserId = route.adminUserId || identity.userId;
+    const st = await abortable(this.stationSession(route, adminUserId, identity), reply?.signal);
+    const segment = st.seg.next();
+    const packet = buildPortalPacket({
+      commandId: outerCmd,
+      channel,
+      segment,
+      payload: { account_id: adminUserId, ...body }
+    });
+    const run = st.queue.then(() => this.sendAwaitAck(route.stationSn, st, packet, outerCmd, innerCmd, channel, segment, reply));
+    st.queue = run.catch(() => void 0);
+    return abortable(run, reply?.signal);
+  }
+  /**
+   * Without `reply`, completes on the command ACK or a correlated control-result notification. The
+   * notification must match the request channel, parameter and segment and contain a structured payload.
+   * Receipt does not establish physical actuation. Bounded by {@link ACK_TIMEOUT_MS}.
+   *
+   * With `reply`, a zero-result ACK is not the answer: the first notify body (an object) for which
+   * `reply.pick` answers a value resolves with it, one `pick` throws on rejects with that error, and every
+   * other notify frame is left alone. Bounded by `reply.timeoutMs` (default {@link DB_TABLE_TIMEOUT_MS}),
+   * and ended by `reply.signal`; one already aborted is not sent.
+   *
+   * Either way an ACK with a non-zero result code rejects, and the command is sent once.
    */
-  sendAwaitAck(sn, st, packet, outerCmd, innerCmd, channel, segment) {
-    return new Promise((resolve, reject) => {
+  sendAwaitAck(sn, st, packet, outerCmd, innerCmd, channel, segment, reply) {
+    const timeoutMs = reply ? reply.timeoutMs ?? DB_TABLE_TIMEOUT_MS : ACK_TIMEOUT_MS;
+    const awaited = reply ? "reply" : "ACK";
+    return new Promise((resolve2, reject) => {
       const onData = (frame, linkType) => {
         const p = parsePortalPacket(frame, linkType);
-        if (!p || p.segment !== segment)
+        if (!p)
+          return;
+        if (reply && linkType === PortalLinkType.NOTIFY && typeof p.data === "object" && p.data !== null) {
+          let picked;
+          try {
+            picked = reply.pick(p.data);
+          } catch (e) {
+            cleanup();
+            reject(e instanceof Error ? e : new Error(String(e)));
+            return;
+          }
+          if (picked === void 0)
+            return;
+          cleanup();
+          this.deps.logger?.debug?.(`[rtc] ${sn} cmd ${innerCmd} answered`);
+          resolve2(picked);
+          return;
+        }
+        if (p.segment !== segment)
           return;
         const acknowledgement = linkType === PortalLinkType.COMMAND && p.commandId === outerCmd && !!p.isResponse;
         const d = p.data;
         const notification = outerCmd === PORTAL_CMD_CONTROL_PAYLOAD && linkType === PortalLinkType.NOTIFY && p.commandId === PORTAL_CMD_NOTIFY_PAYLOAD && p.isResponse === 0 && p.channel === channel && p.cmd === innerCmd && typeof d?.payload === "object" && d.payload !== null;
         if (!acknowledgement && !notification)
           return;
+        if (reply && p.errCode === 0)
+          return;
         cleanup();
         if (acknowledgement && p.errCode !== 0) {
           reject(new Error(`rtc: ${sn} rejected cmd ${innerCmd} (err ${p.errCode})`));
         } else {
           this.deps.logger?.debug?.(`[rtc] ${sn} cmd ${innerCmd} acked`);
-          resolve();
+          resolve2(void 0);
         }
       };
       const onClose = () => {
         cleanup();
-        reject(new Error(`rtc: ${sn} session closed while waiting for cmd ${innerCmd} ACK`));
+        reject(new Error(`rtc: ${sn} session closed while waiting for cmd ${innerCmd} ${awaited}`));
+      };
+      const onAbort = () => {
+        cleanup();
+        reject(reply?.signal?.reason);
       };
       const timer = setTimeout(() => {
         cleanup();
-        reject(new Error(`rtc: ${sn} cmd ${innerCmd} ACK timed out after ${ACK_TIMEOUT_MS}ms`));
-      }, ACK_TIMEOUT_MS);
+        reject(new Error(`rtc: ${sn} cmd ${innerCmd} ${awaited} timed out after ${timeoutMs}ms`));
+      }, timeoutMs);
       const cleanup = () => {
         clearTimeout(timer);
         st.session.off("commandData", onData);
         st.session.off("close", onClose);
+        reply?.signal?.removeEventListener("abort", onAbort);
         this.touch(sn, st);
       };
+      if (reply?.signal?.aborted) {
+        onAbort();
+        return;
+      }
       st.session.on("commandData", onData);
       st.session.on("close", onClose);
+      reply?.signal?.addEventListener("abort", onAbort, { once: true });
       if (!st.session.sendCommand(packet)) {
         cleanup();
         reject(new Error(`rtc: ${sn} command channel not open, cmd ${innerCmd} not sent`));
@@ -25675,7 +26031,7 @@ var RtcCommandRouter = class {
    * promise, so an early failure cannot leave a second one rejecting unheard.
    */
   bringUp(sn, session) {
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve2, reject) => {
       let settled = false;
       const finish = (err) => {
         if (settled)
@@ -25692,7 +26048,7 @@ var RtcCommandRouter = class {
           reject(err);
         } else {
           this.deps.logger?.info?.(`[rtc] ${sn} command channel up`);
-          resolve();
+          resolve2();
         }
       };
       const onConnected = () => finish();
@@ -26121,10 +26477,10 @@ function dpColorFields(spec) {
 }
 
 // dist/transport/mqtt/clean-codec.js
-import { randomUUID as randomUUID3 } from "node:crypto";
+import { randomUUID as randomUUID4 } from "node:crypto";
 function buildCleanDpEnvelope(accountId, deviceSn, dp, value, opts) {
   const payload = JSON.stringify({
-    t: opts?.uuid ?? randomUUID3(),
+    t: opts?.uuid ?? randomUUID4(),
     protocol: 2,
     account_id: accountId,
     device_sn: deviceSn,
@@ -26363,13 +26719,13 @@ var MqttCommandRouter = class _MqttCommandRouter {
    * timeout with no unhandled listener left behind either way.
    */
   waitForMqttMessage(mqtt, match, timeoutMs) {
-    return new Promise((resolve) => {
+    return new Promise((resolve2) => {
       const onMessage = (m) => {
         const result = match(m);
         if (result === void 0)
           return;
         cleanup();
-        resolve(result);
+        resolve2(result);
       };
       const cleanup = () => {
         clearTimeout(timer);
@@ -26377,7 +26733,7 @@ var MqttCommandRouter = class _MqttCommandRouter {
       };
       const timer = setTimeout(() => {
         cleanup();
-        resolve(void 0);
+        resolve2(void 0);
       }, timeoutMs);
       timer.unref?.();
       mqtt.on("message", onMessage);
@@ -26897,7 +27253,7 @@ function decryptReply(key, resultB64) {
 }
 
 // dist/transport/tuya/request.js
-import { randomUUID as randomUUID4 } from "node:crypto";
+import { randomUUID as randomUUID5 } from "node:crypto";
 var TUYA_API_ENDPOINT = "https://a1.tuyaeu.com/api.json";
 var TUYA_APP_KEY = "w8x4ppqkdxvqnd73ahj9";
 var TUYA_APP_SECRET = "pt585qhmt75hwcynchnps9dnxh9suhwd";
@@ -26929,7 +27285,7 @@ function buildApiParams(action, opts) {
     a: action.a,
     v: action.v,
     time: String(opts.time ?? Math.floor(Date.now() / 1e3)),
-    requestId: opts.requestId ?? randomUUID4(),
+    requestId: opts.requestId ?? randomUUID5(),
     sid: opts.session.sid,
     deviceId: opts.session.deviceId,
     chKey: opts.session.chKey,
@@ -28268,8 +28624,6 @@ var FcmRegistrar = class {
 };
 
 // dist/transport/push/store.js
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2, rmSync as rmSync2 } from "node:fs";
-import { dirname as dirname2 } from "node:path";
 var MemoryFcmStore = class {
   p = null;
   load() {
@@ -28282,31 +28636,7 @@ var MemoryFcmStore = class {
     this.p = null;
   }
 };
-var FileFcmStore = class {
-  path;
-  constructor(path) {
-    this.path = path;
-  }
-  load() {
-    try {
-      return JSON.parse(readFileSync2(this.path, "utf-8"));
-    } catch {
-      return null;
-    }
-  }
-  save(p) {
-    try {
-      mkdirSync2(dirname2(this.path), { recursive: true });
-    } catch {
-    }
-    writeFileSync2(this.path, JSON.stringify(p, null, 2), { mode: 384 });
-  }
-  clear() {
-    try {
-      rmSync2(this.path);
-    } catch {
-    }
-  }
+var FileFcmStore = class extends FileSessionStore {
 };
 
 // dist/transport/media-failure.js
@@ -28335,6 +28665,12 @@ var StoredImageCache = class {
   activeDevices = /* @__PURE__ */ new Set();
   activeDownloads = 0;
   generation = 0;
+  /**
+   * Bumped by {@link clearLifecycleErrors}. A lifecycle failure from a download started under an older
+   * count is not recorded; the candidate is queued again, unless a newer one is already queued, so the
+   * current session fetches it.
+   */
+  lifecycle = 0;
   constructor(downloader, logger, clock = Date.now, isLifecycleError = () => false) {
     this.downloader = downloader;
     this.logger = logger;
@@ -28390,6 +28726,18 @@ var StoredImageCache = class {
       return Promise.resolve(state.retained.image);
     return Promise.reject(new StoredSnapshotUnavailableError(reason, "No stored snapshot is available"));
   }
+  /**
+   * Forget every device's recorded lifecycle failure, keeping retained bytes and candidate state.
+   *
+   * A lifecycle failure describes the session that was current when the download ran, so it no longer
+   * holds once a login succeeds again; {@link snapshotStored} then answers from the retained image, or
+   * with the reason a stored image is absent. A download in flight across the call cannot record one.
+   */
+  clearLifecycleErrors() {
+    this.lifecycle += 1;
+    for (const state of this.devices.values())
+      state.lifecycleError = void 0;
+  }
   /** Invalidate all retained and candidate state. */
   clear() {
     this.generation += 1;
@@ -28405,18 +28753,23 @@ var StoredImageCache = class {
       state.inFlight = candidate;
       this.activeDownloads += 1;
       this.activeDevices.add(candidate.deviceKey);
-      void this.downloader(candidate.url, candidate.deviceKey).then((image) => this.complete(candidate, image), (error) => this.complete(candidate, void 0, error));
+      const lifecycle = this.lifecycle;
+      void this.downloader(candidate.url, candidate.deviceKey).then((image) => this.complete(candidate, lifecycle, image), (error) => this.complete(candidate, lifecycle, void 0, error));
     }
   }
-  complete(candidate, image, error) {
+  complete(candidate, lifecycle, image, error) {
     this.activeDownloads -= 1;
     this.activeDevices.delete(candidate.deviceKey);
     const state = this.devices.get(candidate.deviceKey);
     if (candidate.generation === this.generation && state?.inFlight === candidate) {
       state.inFlight = void 0;
       if (error !== void 0 && this.isLifecycleError(error)) {
-        state.lifecycleError = error;
-        state.reason = void 0;
+        if (lifecycle === this.lifecycle) {
+          state.lifecycleError = error;
+          state.reason = void 0;
+        } else {
+          state.queued ??= candidate;
+        }
       } else if (image === void 0 && this.retryLater(state, candidate, error)) {
         state.lifecycleError = void 0;
       } else if (image === void 0) {
@@ -28908,8 +29261,8 @@ var DeviceRegistry = class {
     const waiters = this.stateWaiters.get(sn);
     if (waiters) {
       this.stateWaiters.delete(sn);
-      for (const resolve of waiters)
-        resolve();
+      for (const resolve2 of waiters)
+        resolve2();
     }
   }
   /**
@@ -28954,15 +29307,15 @@ var DeviceRegistry = class {
   awaitRealtimeState(sn, timeoutMs) {
     if (this.hasRealtimeState(sn) || timeoutMs <= 0)
       return Promise.resolve();
-    return new Promise((resolve) => {
+    return new Promise((resolve2) => {
       const timer = setTimeout(() => {
         this.stateWaiters.get(sn)?.delete(done);
-        resolve();
+        resolve2();
       }, timeoutMs);
       timer.unref?.();
       const done = () => {
         clearTimeout(timer);
-        resolve();
+        resolve2();
       };
       const set = this.stateWaiters.get(sn) ?? /* @__PURE__ */ new Set();
       set.add(done);
@@ -29143,6 +29496,12 @@ var EufyMega = class extends EventEmitter14 {
   /** Shared in-flight/settled `startMqtt()` promise PER SCOPE — so realtime bring-up and an on-demand
    * publish await the SAME fully-connected transport instead of racing (and never open two). */
   mqttReady = /* @__PURE__ */ new Map();
+  /**
+   * Serials {@link subscribeMqttDevices} has subscribed or is subscribing, per transport, so a later pass
+   * subscribes only devices that transport has not carried yet. Keyed by transport, so a new connection
+   * starts empty.
+   */
+  mqttSubscribed = /* @__PURE__ */ new WeakMap();
   /** Device list/record/capability resolution + the frame→caps cache. */
   registry;
   pushClient;
@@ -29666,7 +30025,7 @@ var EufyMega = class extends EventEmitter14 {
           return true;
         const delay = Math.min(500, deadline - Date.now());
         if (delay > 0)
-          await new Promise((resolve) => setTimeout(resolve, delay));
+          await new Promise((resolve2) => setTimeout(resolve2, delay));
         if (refresh.expected !== void 0 && settled())
           return true;
       }
@@ -29715,7 +30074,7 @@ var EufyMega = class extends EventEmitter14 {
    * manager's own log, since by then nothing is waiting to receive it.
    */
   recycleStandaloneSession(sn) {
-    const releaseWrite = new Promise((resolve) => void setTimeout(resolve, SESSION_RECYCLE_WAIT_MS).unref?.());
+    const releaseWrite = new Promise((resolve2) => void setTimeout(resolve2, SESSION_RECYCLE_WAIT_MS).unref?.());
     return Promise.race([
       this.p2p.resetStandaloneSession(sn).finally(() => this.reopenWiredStation(sn)),
       releaseWrite.then(() => this.opts.logger?.debug(`[session ${sn}] recycle still waiting on an attached viewer \u2014 releasing the write that asked for it`))
@@ -29752,11 +30111,11 @@ var EufyMega = class extends EventEmitter14 {
   }
   /** Limit waiting on an unabortable dependency operation to the remaining semantic-event refresh window. */
   beforeDeadline(operation, timeoutMs) {
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve2, reject) => {
       const timeout = setTimeout(() => reject(new RefreshWindowClosedError("refresh window closed")), Math.max(0, timeoutMs));
       operation.then((value) => {
         clearTimeout(timeout);
-        resolve(value);
+        resolve2(value);
       }, (error) => {
         clearTimeout(timeout);
         reject(error);
@@ -29861,12 +30220,16 @@ var EufyMega = class extends EventEmitter14 {
   /**
    * On a successful login, kick off auto-realtime (unless `autoRealtime:false`). Fire-and-forget so
    * `login()` returns as soon as the session is ready — realtime channels come up in the background and
-   * surface failures via `error`. Idempotent through the retained generation promise.
+   * surface failures via `error`. Idempotent through the retained generation promise. A login for a
+   * different account drops every stored image; one for the same account drops only the lifecycle
+   * failures recorded against the session it replaces.
    */
   afterLogin(result) {
     if (result.status === LoginStatus.Ok) {
       if (this.storedImageAccount && this.storedImageAccount !== result.session.userId)
         this.storedImages?.clear();
+      else
+        this.storedImages?.clearLifecycleErrors();
       this.storedImageAccount = result.session.userId;
       const auth = this.mega.auth;
       if (auth?.userId)
@@ -29903,12 +30266,12 @@ var EufyMega = class extends EventEmitter14 {
     if (options.timeoutMs === void 0)
       return generation.promise;
     const timeoutMs = Math.max(0, options.timeoutMs);
-    return new Promise((resolve) => {
-      const timer = setTimeout(() => resolve(readinessSnapshot(generation.readiness, "timed-out")), timeoutMs);
+    return new Promise((resolve2) => {
+      const timer = setTimeout(() => resolve2(readinessSnapshot(generation.readiness, "timed-out")), timeoutMs);
       timer.unref?.();
       void generation.promise.then((result) => {
         clearTimeout(timer);
-        resolve(result);
+        resolve2(result);
       });
     });
   }
@@ -29949,10 +30312,10 @@ var EufyMega = class extends EventEmitter14 {
         let acknowledge;
         let reject;
         let acknowledged = false;
-        const acknowledgement = new Promise((resolve, rejectPromise) => {
+        const acknowledgement = new Promise((resolve2, rejectPromise) => {
           acknowledge = () => {
             acknowledged = true;
-            resolve();
+            resolve2();
           };
           reject = rejectPromise;
         });
@@ -30319,8 +30682,8 @@ var EufyMega = class extends EventEmitter14 {
     if (this.realtimeGeneration?.epoch === this.realtimeEpoch)
       return this.realtimeGeneration;
     const epoch = this.realtimeEpoch;
-    let resolve;
-    const promise = new Promise((done) => resolve = done);
+    let resolve2;
+    const promise = new Promise((done) => resolve2 = done);
     const generation = {
       epoch,
       readiness: {
@@ -30330,7 +30693,7 @@ var EufyMega = class extends EventEmitter14 {
         wiredP2p: createPlaneReadiness()
       },
       promise,
-      resolve,
+      resolve: resolve2,
       abort: new AbortController(),
       settled: false
     };
@@ -30481,6 +30844,12 @@ var EufyMega = class extends EventEmitter14 {
    * device absent from the previous pass is skipped — first sight is discovery, not a transition;
    * {@link deviceState} answers an initial reading.
    *
+   * A device with changed params is re-resolved by {@link widenCapabilities} once per pass, however many
+   * of its params moved, since each re-resolution is a cloud param-list read.
+   *
+   * Then brings the secure-MQTT plane up to the roster ({@link syncMqttRoster}): the startup bring-up
+   * sized it from the roster at login, which is empty when the cloud was unreachable then.
+   *
    * Then re-reads every Tuya clean-line robot from the Tuya cloud ({@link readTuyaDevices}): its state
    * is not in the cloud record this pass diffs and no live channel carries it, so the poll is where it
    * stays fresh. That read runs after the `try`, not inside it, so a cloud error on the list diff does
@@ -30499,8 +30868,9 @@ var EufyMega = class extends EventEmitter14 {
           this.emitSemantic(out.event, out.payload, { refresh: out.refresh });
       for (const dev of diff.reported)
         this.emit("deviceState", this.stateOf(dev));
-      for (const change of diff.params)
-        await this.widenCapabilities(change.deviceSn);
+      for (const sn of new Set(diff.params.map((c) => c.deviceSn)))
+        await this.widenCapabilities(sn);
+      await this.syncMqttRoster();
     } catch (e) {
       this.reportError(e);
     }
@@ -30840,12 +31210,21 @@ var EufyMega = class extends EventEmitter14 {
   /**
    * Subscribe the devices on one credential scope; a failing subscribe is reported, not fatal (one
    * unreachable device must not stop the rest of the roster from coming up).
+   * A device is recorded in that transport's {@link mqttSubscribed} entry before its subscribe is awaited,
+   * whatever the outcome, so a pass running alongside or after skips it: each device is attempted once
+   * per transport.
    *
    * A Tuya clean-line device (`eufy_home_tuya`) is not subscribed: its state lives on the Tuya cloud,
    * and the broker refuses its `eufy_home` topics on every credential.
    */
   async subscribeMqttDevices(scope, transport) {
+    let subscribed = this.mqttSubscribed.get(transport);
+    if (!subscribed)
+      this.mqttSubscribed.set(transport, subscribed = /* @__PURE__ */ new Set());
     for (const d of this.getMqttDevices().filter((dev) => !isTuyaVacuum(dev) && mqttScopeFor(dev) === scope)) {
+      if (subscribed.has(d.sn))
+        continue;
+      subscribed.add(d.sn);
       try {
         await transport.subscribeDevice(d);
         await this.sendRealtimeInit(d.sn);
@@ -30854,6 +31233,23 @@ var EufyMega = class extends EventEmitter14 {
       }
     }
   }
+  /**
+   * Start every credential scope the roster now needs and has no transport for, and subscribe the
+   * devices that joined a scope already up — each scope's failure reported, not thrown. A no-op once
+   * the realtime generation is superseded or was never started.
+   */
+  async syncMqttRoster() {
+    if (this.realtimeGeneration?.epoch !== this.realtimeEpoch)
+      return;
+    await Promise.all(this.mqttScopesInUse().map(async (scope) => {
+      const transport = this.transports.get(scope);
+      try {
+        await (transport ? this.subscribeMqttDevices(scope, transport) : this.ensureMqttStarted(scope));
+      } catch (e) {
+        this.reportError(e);
+      }
+    }));
+  }
   /**
    * Send whatever a device's capabilities want sent once its realtime channel is up — for a line whose
    * state is pushed on change with no heartbeat, the request that makes its state readable before the
@@ -30886,31 +31282,72 @@ var EufyMega = class extends EventEmitter14 {
     return this.p2p.getSessions();
   }
   /**
-   * The people enrolled on a station, read from its own `person_basic_info` table over P2P.
+   * The people enrolled on a station, read from its own `person_basic_info` table through
+   * {@link readStationTable}.
    *
    * The cloud roster (`api.getFaces()`) answers empty for an account that keeps its faces on the
    * station, because they were never uploaded — the station holds them.
    *
-   * Resolves with the rows the station returned. Rejects on a station that cannot be reached, on a
-   * record stating no `admin_user_id`, and on the reply not arriving whole in time. Assembling that
-   * reply is `P2PSession.readDatabase`'s; this resolves which station and which account id.
+   * Resolves with the rows the station returned that are objects. Rejects as {@link readStationTable}
+   * does.
    *
    * `stranger<n>` names are the station's own placeholders for a face nobody has named, and are
    * returned as they arrive; a caller that wants only named people filters them.
    */
   async getStationFaces(stationSn, opts = {}) {
+    const rows = await this.readStationTable(stationSn, "person_basic_info", opts);
+    return rows.filter((row) => typeof row === "object" && row !== null);
+  }
+  /**
+   * The rows of one of a station's own tables (`history_record_info`, `person_basic_info`, …), read over
+   * the transport the station speaks: the control channel of a HomeBase S1 Pro (T9000), P2P for any
+   * other station. The query is the table's whole content; the rows are the station's, shaped by it.
+   *
+   * Resolves with the rows the station returned. Rejects on a serial not in the device list, on a record
+   * stating no `admin_user_id`, on a station that cannot be reached, on a query the station refuses, and
+   * on the reply not arriving in time. Assembling the reply is the transport's; this resolves which
+   * station, which transport and which account id.
+   */
+  async readStationTable(stationSn, table, opts = {}) {
+    const { station, accountId, route } = await this.stationReadTarget("readStationTable", stationSn);
+    if (route)
+      return this.rtc.readTable(route, table, opts);
+    await this.p2p.ensureStation(station, opts.signal);
+    const session = this.p2p.getSessions().get(station);
+    if (!session)
+      throw new Error(`readStationTable: no P2P session for ${station}`);
+    return session.readDatabase(table, { accountId, ...opts });
+  }
+  /**
+   * One image stored on a HomeBase S1 Pro (T9000), by the on-station path a table row names
+   * (`thumb_path`, …), read over the station's control channel.
+   *
+   * Resolves with the image bytes as the station holds them. Rejects on a serial not in the device list,
+   * on a record stating no `admin_user_id`, on a station other than a T9000, on a station that cannot be
+   * reached, and on the reply not arriving in time. Fetching the image is the transport's; this resolves
+   * which station and which account id.
+   */
+  async readStationImage(stationSn, filePath, opts = {}) {
+    const { station, route } = await this.stationReadTarget("readStationImage", stationSn);
+    if (!route)
+      throw new Error(`readStationImage: ${station} is not a T9000; its stored images are not read here`);
+    return this.rtc.readImage(route, filePath, opts);
+  }
+  /**
+   * The station a database read goes to, its `admin_user_id` and, for a T9000, its RTC route. Throws,
+   * prefixed with `op`, on a serial the device list does not carry and on a record stating no admin id.
+   */
+  async stationReadTarget(op, stationSn) {
     if (!this.registry.list().length)
       await this.getDevices();
     const station = this.p2p.stationKeyOf(stationSn);
+    const found = this.stationOf(station);
+    if (!found.station)
+      throw new Error(`${op}: ${station} is not in the device list`);
     const accountId = this.adminUserIdOf(station);
     if (!accountId)
-      throw new Error(`getStationFaces: no admin_user_id on record for ${station}`);
-    await this.p2p.ensureStation(station, opts.signal);
-    const session = this.p2p.getSessions().get(station);
-    if (!session)
-      throw new Error(`getStationFaces: no P2P session for ${station}`);
-    const rows = await session.readDatabase("person_basic_info", { accountId, ...opts });
-    return rows.filter((row) => typeof row === "object" && row !== null);
+      throw new Error(`${op}: no admin_user_id on record for ${station}`);
+    return { station, accountId, route: found.t9000 ? this.rtcRouteFor(station) : void 0 };
   }
   /** The station's own `admin_user_id`, which its database refuses the query without. */
   adminUserIdOf(stationSn) {
@@ -31137,6 +31574,9 @@ var EufyMega = class extends EventEmitter14 {
    * Returns the connected client rather than installing it. Registration can outlive a `disconnect()`,
    * and {@link ensureRealtime} owns the decision of whether a finished bring-up is still the current
    * one — so this never overwrites a channel a later login already brought up.
+   *
+   * Persisting the seen ids after each push reports a failed `save` through `error` rather than throwing:
+   * the push handler runs inside the MCS socket's `data` callback, where a throw is an uncaught exception.
    */
   async startPush(signal) {
     if (!this.mega.auth)
@@ -31183,9 +31623,13 @@ var EufyMega = class extends EventEmitter14 {
         if (dsn)
           this.prewarmForEvent(out.event, dsn);
       }
-      store.save({ creds: persistedCreds, persistentIds: client.getPersistentIds() });
+      try {
+        store.save({ creds: persistedCreds, persistentIds: client.getPersistentIds() });
+      } catch (e) {
+        this.reportError(e);
+      }
     });
-    await new Promise((resolve, reject) => {
+    await new Promise((resolve2, reject) => {
       const cleanup = () => {
         signal?.removeEventListener("abort", onAbort);
         client.off("connect", onConnect);
@@ -31193,7 +31637,7 @@ var EufyMega = class extends EventEmitter14 {
       };
       const onConnect = () => {
         cleanup();
-        resolve();
+        resolve2();
       };
       const onError = (error) => {
         cleanup();
@@ -32483,6 +32927,7 @@ export {
   aesKey,
   asBool,
   assertNever,
+  beginsAccessUnit,
   bizChannelName,
   buildActions,
   buildAppShapedClientId,