@mega-yfue/eufy-sdk 0.6.0-beta.3 → 0.6.0-beta.31

package/dist/model/capabilities/access.d.ts

@@ -76,9 +76,10 @@ export declare function setJsonRaw(cmd: number, data: Record<string, unknown>, c
 export declare function setPayload(cmd: number, payload: Record<string, unknown>, ctx: CommandContext, mValue3?: number, channel?: number, form?: ScalarForm): Command;
 /**
  * Set a station-scoped scalar (132-byte body, no channel field) on an EXPLICIT channel — for the
- * HomeBase's own controls on the station broadcast channel 255 (alarm/speaker volume 1235).
+ * HomeBase's own controls on the station broadcast channel 255 (alarm/speaker volume 1235). Level-2
+ * only, unless `form` is `"auto"`, which seals it at the session's own level.
  */
-export declare function setStationScalar(cmd: number, value: number, channel: number): Command;
+export declare function setStationScalar(cmd: number, value: number, channel: number, form?: "auto"): Command;
 /**
  * A one-line device descriptor for error messages — carries every identifier needed to reproduce or
  * triage from a log later (deviceType, model T-code, full serial, channel, codec), so a "capability

package/dist/model/capabilities/arming.d.ts

@@ -77,7 +77,8 @@ export declare const ARMING_CMD: {
      * was captured on holds a level-2 key and seals it level-2, while an own-session camera that never
      * negotiates one carries the same envelope level-1. See `armingCommand`.
      *
-     * A T8410C takes the mode as a direct frame instead of this envelope; see {@link DIRECT_ARMING_MODELS}.
+     * A T8410C and a T8410 take the mode as a direct frame instead of this envelope; see
+     * {@link DIRECT_ARMING_MODELS} and {@link BROADCAST_ARMING_MODELS}.
      */
     readonly SET_ARMING: 1224;
     /**

package/dist/model/capabilities/battery.d.ts

@@ -144,6 +144,9 @@ export declare const BATTERY_MEMBERS: {
      * The headline percentage, and this capability's detection evidence: reporting 1101 is what proves a
      * device is battery-powered, which is also the fact `MediaProvider` reads to decide a stream needs a
      * power budget. Published flat as `battery` — `level` alone is claimed by `suction` too.
+     *
+     * Withheld on a device that resolved `lock`, whose own `battery` member reads the same param 1101 and
+     * owns the `battery` property there, so the two do not both claim it.
      */
     readonly level: {
         readonly param: 1101;
@@ -152,6 +155,7 @@ export declare const BATTERY_MEMBERS: {
         readonly unit: "%";
         readonly kind: "percent";
         readonly provenance: "verified";
+        readonly available: (ctx: AvailabilityContext) => boolean;
         readonly description: "Battery level 0-100 (verified: param 1101).";
     };
     /**
@@ -170,7 +174,7 @@ export declare const BATTERY_MEMBERS: {
     /**
      * 1293 is the READABLE indicator (6445 is write-only/cloud-hidden). Verified live on a T8124R via an
      * app-toggle before/after diff: 0 = Battery, 1 = External Solar Panel. Values beyond 0/1 (some models
-     * report 5) are shown raw — `enumValues` only labels the two that are confirmed.
+     * report 5) read as `undefined` — `enumValues` holds only the two that are confirmed.
      *
      * The write is a `1350` SET_PAYLOAD, inner cmd 1293, `{charge_mode:N}`, `mValue3` 0 (the app uses 0,
      * not the cmd id), and the setter accepts a NAME as well as the index the getter answers.

package/dist/model/capabilities/camera.d.ts

@@ -439,6 +439,10 @@ export declare const CAMERA_MEMBERS: {
      * sensor omits it, and the wire accepts the value regardless — the device's own reported set is the
      * only statement of which of the three it has. `coerceEnumValue` rejects a value outside
      * {@link NightVision} rather than coercing it. The payload key on the wire is `night_sion`.
+     *
+     * 1277 carries more than these three on some models: the V6 app's per-model mappings put modes on
+     * 3, 5, 6 and 8 as well, and which model takes which mapping is not in the app bundle. A reported value
+     * outside the published options reads as `undefined` rather than as an unnamed number.
      */
     readonly nightVision: {
         readonly param: 1277;
@@ -475,6 +479,8 @@ export declare const CAMERA_MEMBERS: {
      *
      * `transaction` is part of the frame that was captured, so it is sent. The recording sibling's own
      * confirmed frame carries no such field; neither is inferred from the other.
+     *
+     * Not offered where the device reports the doorbell's own live-view quality (1705).
      */
     readonly streamingQuality: {
         readonly accepts: StreamingQualityName;
@@ -483,7 +489,7 @@ export declare const CAMERA_MEMBERS: {
         readonly kind: "enum";
         readonly enumValues: Readonly<Record<number, string>>;
         readonly provenance: "verified";
-        readonly available: typeof isCameraCodec;
+        readonly available: (ctx: AvailabilityContext) => boolean;
         readonly args: readonly [{
             readonly name: "quality";
             readonly kind: "enum";
@@ -596,6 +602,7 @@ export declare const CAMERA_MEMBERS: {
         timeoutMs?: number;
         skipKeyframes?: number;
     } | undefined) => Promise<Buffer<ArrayBufferLike>>)>;
+    /** The T8530 serves its live feed as a Readable too; its other media pulls stay withheld. */
     readonly openReadable: import("./members.js").ProvidedMember<"media", false | ((opts?: Parameters<NonNullable<MediaProvider["openReadable"]>>[0]) => Promise<import("node:stream").Readable>) | undefined>;
     readonly recordFragments: import("./members.js").ProvidedMember<"media", false | ((opts?: Parameters<NonNullable<MediaProvider["recordFragments"]>>[0]) => import("../../core/contracts.js").FragmentRecordingHandle) | undefined>;
     readonly downloadRecording: import("./members.js").ProvidedMember<"media", false | ((opts: Parameters<NonNullable<MediaProvider["downloadRecording"]>>[0]) => Promise<import("../../core/contracts.js").RecordingDownload>) | undefined>;

package/dist/model/capabilities/index.d.ts

@@ -388,7 +388,7 @@ export interface DeviceEventMap {
  * with the type. (Only capabilities whose module defines `actions()` appear.)
  */
 export interface DeviceActionMap {
-    /** Pan/tilt/zoom control: `rotate(dir, step)` + `left`/`right`/`up`/`down`, `zoom`, preset() namespace (goto/preview/save/setDefault/delete/list/image). */
+    /** Pan/tilt/zoom control: `rotate(dir, step)` + `left`/`right`/`up`/`down`, `rotate360`, `zoom`, preset() namespace (goto/preview/save/setDefault/delete/list/image). */
     ptz: PtzActions;
     /** Floodlight/spotlight: `on`/`off`/`set`, `setBrightness`/`setColorTemp`/`setEnabled`, `setAutoSpotlight`. */
     light: LightActions;

package/dist/model/capabilities/members.d.ts

@@ -576,12 +576,14 @@ export declare function memberWrite(name: string, m: ValueMember, value: boolean
  * is stored as a decoded object. Handing either through a getter typed `number` is the one lie this
  * table exists to prevent.
  *
+ * A number outside `values`, the options published for this device, answers `undefined`.
+ *
  * Exported so the ONE narrowing the getters use is also the one a property-change announcement carries.
  * A second conversion of the wire value is precisely how a payload comes to disagree with the getter
  * beside it, which would defeat the point of announcing the change at all.
  * @internal
  */
-export declare function narrow(type: PropertyValueType, read: CapabilityStateReader, prop: string): boolean | number | string | undefined;
+export declare function narrow(type: PropertyValueType, read: CapabilityStateReader, prop: string, values?: Record<number, string>): boolean | number | string | undefined;
 /**
  * Both presence gates at once: the params a member requires, and its own {@link ValueMember.available}.
  *

package/dist/model/capabilities/mower.d.ts

@@ -34,9 +34,9 @@ export declare const MOWER_DP: {
     readonly SPARSE_LAWN_OPTIMIZATION: 141;
 };
 /** The `net_media_type` (DP 134) range, as the schema lists it. */
-export declare const MOWER_NETWORKS: readonly ["None", "Wifi", "Cellular"];
+declare const MOWER_NETWORKS: readonly ["None", "Wifi", "Cellular"];
 /** The mower's network link (DP 134). */
-export type MowerNetwork = (typeof MOWER_NETWORKS)[number];
+type MowerNetwork = (typeof MOWER_NETWORKS)[number];
 /**
  * Every `mower` read, declared once.
  *
@@ -228,3 +228,4 @@ export declare const MOWER_MEMBERS: {
 export type MowerActions = Surface<typeof MOWER_MEMBERS>;
 /** `mower` — robot-mower state from its Tuya data points. */
 export declare const MOWER: CapabilityModule;
+export {};

package/dist/model/capabilities/ptz.d.ts

@@ -5,7 +5,7 @@ import type { Command } from "../../core/contracts.js";
  * The P2P **feature-command ids** this pan-tilt capability drives. Capability-owned wire vocabulary
  * (transport forwards `cmd.param` opaquely; full id→name catalog in the generated
  * `transport/p2p/commands.ts`). Distinct from the {@link PTZ_ROTATE} direction map below (which is
- * `rotate_type` 1..4, not a command id).
+ * `rotate_type` 0..4, not a command id).
  *
  * Ids + envelopes are taken from the V6 app's own command builders (the `Set*Parser`/`*PositionsParser`
  * classes in the decompiled JS), which is this project's wire ground truth — NOT a third-party
@@ -135,9 +135,11 @@ export declare const PtzDirection: {
     readonly down: "down";
 };
 export type PtzDirection = (typeof PtzDirection)[keyof typeof PtzDirection];
-/** Pan-tilt rotate direction → `rotate_type` (the on-wire code). Not re-exported by the barrel —
- * stays internal to the capability. Confirmed on hardware (T8425): 1=left, 2=right, 3=up, 4=down. */
+/** Pan-tilt rotate motion → `rotate_type` (the on-wire code). Not re-exported by the barrel —
+ * stays internal to the capability. Confirmed on hardware (T8425): 1=left, 2=right, 3=up, 4=down.
+ * `sweep` (0) is a full 360° pan (room scan), from the app's 360 button. */
 export declare const PTZ_ROTATE: {
+    readonly sweep: 0;
     readonly left: 1;
     readonly right: 2;
     readonly up: 3;
@@ -145,7 +147,7 @@ export declare const PTZ_ROTATE: {
 };
 /**
  * Pan-tilt rotate as a transport-neutral {@link Command}. CONFIRMED wire command (captured on
- * T8425 ch3 during live-view): `{"commandType":6030,"data":{"cmd_type":1,"rotate_type":1..4,
+ * T8425 ch3 during live-view): `{"commandType":6030,"data":{"cmd_type":1,"rotate_type":0..4,
  * "zoom":1.0}}` under the generic control wrapper `1700` on the camera channel. `cmd_type:1` =
  * move; `zoom` defaults to 1.0.
  *
@@ -153,7 +155,7 @@ export declare const PTZ_ROTATE: {
  * resolver picks the encryption level by topology (standalone → L1, HomeBase → L2). A PT cam can be
  * either, so the level is NOT fixed here.
  */
-export declare function rotateCommand(direction: PtzDirection, ctx: CommandContext, zoom?: number): Command;
+export declare function rotateCommand(direction: keyof typeof PTZ_ROTATE, ctx: CommandContext, zoom?: number): Command;
 /**
  * Digital-zoom as a transport-neutral {@link Command}. The V6 app's `SetPictureZoomParser` builds a
  * `SET_PAYLOAD` (1350) sub-command `COMMAND_DUAL_CAMERA_ZOOM` with the crop-window payload
@@ -266,6 +268,10 @@ export declare const PTZ_MEMBERS: {
     readonly up: import("./members.js").MethodMember<() => Promise<void>>;
     /** Rotate one step down. */
     readonly down: import("./members.js").MethodMember<() => Promise<void>>;
+    /** Pan a full 360° (room scan). */
+    readonly rotate360: import("./members.js").MethodMember<() => Promise<void>> & {
+        available: (ctx: CommandContext) => boolean;
+    };
     /**
      * Zoom rides a SECOND (telephoto) lens, so it is offered only where the device shows zoom evidence —
      * otherwise `dev.ptz()?.zoom` would be a silent no-op on a single-lens pan-tilt camera.

package/dist/model/capabilities/vacuum-clean.d.ts

@@ -280,6 +280,16 @@ export declare function encodeSelectZonesClean(mapId: number, zones: readonly Va
  * @internal
  */
 export declare function encodeSceneClean(sceneId: number): string;
+/**
+ * Build one of the two DP 153 writes the vendor app sends when its map view opens: the time in
+ * microseconds, and on the second write field 2 set to `1`.
+ *
+ * Captured from the vendor app on the device's `cmd/…/req` leg, three times with the same layout. The
+ * product catalogue lists DP 153 as uplink-only (`WorkStatus`); the vendor app writes this message to it
+ * all the same. {@link VACUUM_CLEAN_MEMBERS.requestMap} dispatches both.
+ * @internal
+ */
+export declare function encodeMapWatch(nowMs: number, watching: boolean): string;
 /**
  * Build a whole-floor auto clean carrying an `AutoClean` payload of one pass.
  * @internal
@@ -1986,6 +1996,19 @@ export declare const VACUUM_CLEAN_MEMBERS: {
     readonly startScene: import("./members.js").MethodMember<(sceneId: number) => Promise<void>> & {
         available: (ctx: import("./types.js").CommandContext) => boolean;
     };
+    /**
+     * Ask the robot to push its whole map — plane, room outline, room list and restricted zones — on the
+     * map stream, as the vendor app does when its map view opens: two DP 153 writes, the time and then the
+     * time with field 2 set (see {@link encodeMapWatch}).
+     *
+     * A docked robot sends no map of its own accord, so this is how its room ids and names become
+     * readable without a clean. The map arrives on the stream like any other, not as this call's result.
+     *
+     * WATCHED: sent to a docked robot, it pushed its whole map within a second.
+     */
+    readonly requestMap: import("./members.js").MethodMember<() => Promise<void>> & {
+        available: (ctx: import("./types.js").CommandContext) => boolean;
+    };
     /**
      * State the cleaning settings a run uses — `CleanParamRequest.clean_param` over DP 154.
      *

package/dist/model/device-family.d.ts

@@ -52,7 +52,7 @@ export declare const isHomeBase: (ctx: FamilyContext) => boolean;
 export declare const isStation9000: (ctx: FamilyContext) => boolean;
 /** T8N00 NVR, identified by its reported model. */
 export declare const isNvrT8N00: (ctx: FamilyContext) => boolean;
-/** PoE cameras whose media is served by their NVR's portal call. */
+/** A camera attached to a T8N00 whose media the NVR's call serves. */
 export declare const isNvrMediaCamera: (ctx: FamilyContext) => boolean;
 /** PoE S4 camera with independently streamed fixed and movable optical views. */
 export declare const isNvrDualLensCamera: (ctx: FamilyContext) => boolean;

package/dist/model/device-types.d.ts

@@ -112,6 +112,7 @@ export declare const DeviceType: {
     readonly LOCK_85D0: 202;
     readonly LOCK_85V0: 203;
     readonly LOCK_85P0: 209;
+    readonly WALL_LIGHT_CAM_T86C1: 298;
     readonly NVR_S4_MAX: 300;
     readonly CAMERA_POE_S4: 301;
     readonly WALL_LIGHT_CAM_81A0: 10005;

package/dist/transport/http/mega-client.d.ts

@@ -1,6 +1,7 @@
 import { type SessionEntry } from "../../core/crypto.js";
 import { type SessionStore } from "../../core/store.js";
 import { type Logger } from "../../core/logger.js";
+import type { EufyDevice } from "../../core/types.js";
 import type { SecureMqttCredentials } from "../mqtt/secure-mqtt.js";
 export type RegionShard = "eu-pr" | "us-pr";
 /**
@@ -354,11 +355,11 @@ export declare class MegaHttpClient {
     /** Authed call to a mega service host: app-{service}-{region}.eufy.com. */
     post<T = unknown>(service: string, path: string, body?: unknown, headerOverrides?: Record<string, string>): Promise<T>;
     /**
-     * Fetch the per-station DSK key used in the P2P cloud-lookup payload. Mirrors
+     * Fetch the per-station DSK key using each station's reported cloud category. Mirrors
      * the legacy `get_dsk_keys` body shape on the mega devicerelation service.
      * The P2P *local* lookup path does not need this; only the cloud path does.
      */
-    getDskKeys(stationSns: string[], priorDsks?: Record<string, string>): Promise<Record<string, {
+    getDskKeys(stations: ReadonlyArray<Pick<EufyDevice, "sn" | "category">>, priorDsks?: Record<string, string>): Promise<Record<string, {
         dskKey: string;
         expiration: number;
     }>>;

package/dist/transport/mqtt/biz-stream.d.ts

@@ -12,44 +12,41 @@ export declare const BIZ_PROTOCOL: {
     readonly LIVE_PHOTO: 43;
 };
 /**
- * The channels a map frame can arrive on, by id.
+ * The channels a map frame arrives on, by id, as a robot's own frames identify them.
  *
- * **The trap.** Ids 1–10 come from `Metadata.ChanIds` in `stream.proto`, where each *field* names a
- * message and each field's *value* is the id the device chose for it. The names below pair each
- * channel with its field NUMBER, because that is the numbering the vendor ships and the one a live
- * capture shows — but a device announcing a `Metadata` frame is announcing its own numbering, and a
- * firmware that renumbers would make this table wrong without making it look wrong. Anything that
- * *decodes* a channel's bytes must therefore prefer a device-declared mapping when one has been seen;
- * this table is the default to fall back on, not an authority.
+ * Each id is paired with the `stream.proto` message whose field layout its frames carry, which is not
+ * the field-number order of `Metadata.ChanIds`: the cell plane (`Map`) arrives on 2, its room outline
+ * on 4, the room list on 5, the restricted zones on 6, the robot's pose (`DynamicData`) on 7, the map's
+ * `MapDescription` on 60 and a whole `MapBackup` on 68. A `Metadata` frame would declare a device's own numbering; none has been seen,
+ * so none is read, and this table is the numbering every frame is read by.
  *
- * Channel 0 is the exception and is not in `ChanIds` at all: the app hard-codes it, routing it to a
- * scene-data event rather than a map one, and asks for the scene list on it by number. That one is
- * fixed.
+ * Only channels whose message is identified are listed. A channel whose frames carry too little to
+ * identify, or that carries a message nothing here reads, is absent.
+ *
+ * Channel 0 is not in `ChanIds` at all: the app hard-codes it, routing it to a scene-data event rather
+ * than a map one, and asks for the scene list on it by number.
  */
 export declare const BIZ_CHANNEL: {
     /** Scene (room-group) data. Hard-coded in the app, not part of `ChanIds`. */
     readonly SCENES: 0;
-    readonly MAP_INFO: 1;
-    readonly PATH: 2;
-    readonly ROOM_OUTLINE: 3;
-    readonly ROOM_PARAMS: 4;
-    readonly RESTRICTED_ZONE: 5;
-    readonly DYNAMIC_DATA: 6;
-    readonly TEMPORARY_DATA: 7;
-    readonly OBSTACLE_INFO: 8;
-    readonly MAP_DATA: 9;
-    readonly CRUISE_DATA: 10;
+    readonly MAP_DATA: 2;
+    readonly ROOM_OUTLINE: 4;
+    readonly ROOM_PARAMS: 5;
+    readonly RESTRICTED_ZONE: 6;
+    readonly DYNAMIC_DATA: 7;
+    readonly MAP_DESCRIPTION: 60;
+    readonly MAP_BACKUP: 68;
 };
-/** A channel's name under the default numbering — see the trap in {@link BIZ_CHANNEL}. */
+/** A channel's name under the {@link BIZ_CHANNEL} numbering. */
 export type BizChannel = keyof typeof BIZ_CHANNEL;
 /**
- * Name a channel id under the default numbering, or `undefined` for an id the vendor's table does not
- * list. Not a substitute for a device-declared mapping where one exists.
+ * Name a channel id under the {@link BIZ_CHANNEL} numbering, or `undefined` for an id it does not list.
+ * Not a substitute for a device-declared mapping where one exists.
  */
 export declare function bizChannelName(id: number): BizChannel | undefined;
 /** One frame off the map stream, unwrapped as far as its bytes but not decoded. */
 export interface BizMapFrame {
-    /** Which channel the bytes belong to. Compare against {@link BIZ_CHANNEL}, mindful of its trap. */
+    /** Which channel the bytes belong to. Compare against {@link BIZ_CHANNEL}. */
     readonly channelId: number;
     /**
      * The vendor's `clear_type`. Forwarded, not interpreted: the app passes it straight through to its

package/dist/transport/p2p/audio-frame.d.ts

@@ -12,3 +12,16 @@ export declare const AUDIO_TYPE_OFFSET = 5;
  * itself when a stream produces no audio at all, to feed its decoder silence.
  */
 export declare const AUDIO_CODECS: Readonly<Record<number, AudioCodec>>;
+/**
+ * Whether an audio frame is sealed: after its header, a 16-byte GCM tag and a 12-byte nonce precede the
+ * `u32@0` bytes its header declares, where a frame in the clear carries those bytes straight after the header.
+ * A stream whose keyframes wrap their media key in an ECIES envelope seals its audio this way, measured on
+ * HomeBase recordings and on HomeBase 3 live streams answering a P-256 start.
+ */
+export declare function isSealedAudio(frame: Buffer): boolean;
+/**
+ * The payload of a sealed audio frame ({@link isSealedAudio}), opened with AES-256-GCM under `mediaKey`, the
+ * media key of the keyframe before it, with the video frames' AAD. Answers `undefined` for a frame that is not
+ * sealed or does not authenticate under that key.
+ */
+export declare function openSealedAudio(frame: Buffer, mediaKey: Buffer): Buffer | undefined;

package/dist/transport/p2p/codec.d.ts

@@ -224,8 +224,8 @@ export declare function buildRawCommandPayload(data: Buffer, channel?: number, s
 export declare function buildAckPayload(dataTypeHeader: Buffer, seqNo: number): Buffer;
 /** Parse the 16-byte data-frame header that follows the "XZYH" magic. */
 export declare function parseDataFrameHeader(frame: Buffer): P2PDataFrameHeader;
-/** Parse a LOOKUP_ADDR or RLY_TO message's leading address record. */
-export declare function parseLookupAddr(msg: Buffer): Address;
+/** A LOOKUP_ADDR message's leading address record, or `undefined` for a message too short to carry it. */
+export declare function parseLookupAddr(msg: Buffer): Address | undefined;
 /** The relay servers a LIST_REQ_ACK names, in the order listed, without the unspecified address; records past the message's end are dropped. */
 export declare function parseRelayList(msg: Buffer): Address[];
 /** A RLY_PORT_ACK's mark and relay port, or `undefined` for a message too short to carry them. */

package/dist/transport/p2p/command-router.d.ts

@@ -62,6 +62,8 @@ export interface P2PRouterDeps {
     onClose: (stationSn: string) => void;
     onError: (err: Error) => void;
     onLevel2Ready: (stationSn: string, cipherId: number) => void;
+    /** The station answered on its own session at `atMs` — a PONG or an ACK from the connected peer. */
+    onPeerAnswer?: (stationSn: string, atMs: number) => void;
     /** A raw decoded frame — the client emits the low-level `p2p` event + runs the semantic decode. */
     onFrame: (stationSn: string, frame: P2PFrame) => void;
     /**
@@ -102,6 +104,18 @@ export declare class P2PCommandRouter {
      * {@link liveSources} is a claim in flight.
      */
     private readonly liveSessionKeys;
+    /**
+     * The live source build in flight per `${parentSn}:${channel}`, settled once its connection is opened
+     * or refused.
+     *
+     * A build awaits its media session before it can file the source in {@link liveSources}, so a second
+     * request for the same camera in that window finds nothing cached. Building a second source there
+     * overwrites the first, and the orphan's teardown then closes the connection the cached one streams
+     * on. A request that finds a build here waits for it, until its own signal aborts, then resolves its
+     * session again and reuses what the build filed, or builds its own when that build failed. The entry
+     * is removed when the build settles and its promise never rejects, so each wait ends on a later state.
+     */
+    private readonly liveSourceBuilds;
     /**
      * The open talkback per `${parentSn}:${channel}`, if any. The device plays one audio stream at a
      * time and the session carries one audio sequence, so this path is exclusive where a live pull is
@@ -220,6 +234,11 @@ export declare class P2PCommandRouter {
      * so a start issued before the key arrives is dropped as `media-command-unsent`, and the stream then
      * shows nothing until a later keepalive tick happens to find the key. A connected session that cannot
      * carry the start is not a connected session, so this refuses rather than returning one.
+     *
+     * A session refused its key within the grace, or never connected, is closed and dropped from the manager at
+     * once. Nothing else releases it: no source holds it, a wired station's session never idles out, and the
+     * manager hands the same session to every later open of the camera, so the next open dials a fresh
+     * connection instead. A session another open has since replaced is left to its own close.
      */
     private openMediaSession;
     /**
@@ -295,24 +314,28 @@ export declare class P2PCommandRouter {
      */
     mediaProviderFor(sn: string): MediaProvider;
     /**
-     * Whether `sn` is a camera attached to a HomeBase 2 (T8010), the one station whose recording path layout
-     * and frame formats are confirmed.
+     * The {@link RecordingStation} of the station `sn` is attached to, when `sn` is a camera attached to a
+     * station with an entry in {@link RECORDING_STATIONS}. A standalone device, or a camera on any other
+     * station, answers `undefined`.
      */
-    private downloadsRecordings;
+    private recordingStationFor;
     /**
-     * Download one recording a HomeBase 2 holds for an attached camera, then decode it
-     * ({@link decodeRecording}). Downloads queue per station: the station streams one recording at a time
-     * on the camera's channel, so a download starts only once the previous one has drained
-     * ({@link RecordingTransfer.drained}), even when that one's caller already has its answer. An abort
-     * while waiting rejects without sending anything; an abort mid-transfer rejects at once and the station's
-     * turn is held until the transfer drains.
+     * Download one recording `station` holds for the attached camera `sn`, then decode it
+     * ({@link decodeRecording}). `station` is the entry {@link mediaProviderFor} bound. Downloads queue per
+     * station: the station streams one recording at a time on the camera's channel, so a download starts only
+     * once the previous one has drained ({@link RecordingTransfer.drained}), even when that one's caller already
+     * has its answer. An abort while waiting rejects without sending anything; an abort mid-transfer rejects at
+     * once and the station's turn is held until the transfer drains.
      */
     private downloadRecording;
     /** Resolve once `previous` settles, or reject as soon as `signal` aborts. */
     private waitTurn;
     /**
      * Start one recording download, once the station's previous download has drained: the decoded recording,
-     * and when the station is done sending it.
+     * and when the station is done sending it. The path is `station.path(channel, opts.recording)`, and a name
+     * it refuses rejects `invalid-recording` before anything is sent. On a sealed station the cipher's ECC key
+     * is looked up, and its absence rejects `key-unavailable` before anything is sent. A station in the clear
+     * reads no cipher, and `opts.cipherId` is not read.
      */
     private startRecordingDownload;
     /**
@@ -394,8 +417,9 @@ export declare class P2PCommandRouter {
      * {@link releaseLingeringSiblings}. A pull with consumers is never touched. The release runs before the
      * reuse branch, so a reuse frees the station as a cold start does.
      *
-     * `mayOpenOwnSession` decides whether a camera that finds the station's own session claimed may open a
-     * connection of its own for it. Only the continuous-pull egresses pass it. A still must not: it wants one
+     * `continuous` decides whether a camera that finds the station's own session claimed may open a
+     * connection of its own for it; on an {@link OWN_LIVE_SESSION_MODELS} station it always gets one, and an
+     * unwatched source left on the station's session is rebuilt there. Only the continuous-pull egresses pass it. A still must not: it wants one
      * frame, and a socket plus a level-2 negotiation per thumbnail is a cost a tile refresh cannot justify —
      * so a still asked for while a sibling is being watched contends as it always did, and the caller's
      * retained image answers it. A live view still outranks a tile; what changed is that two live views no
@@ -404,7 +428,7 @@ export declare class P2PCommandRouter {
      * The session goes into a {@link HeldSession} cell, so it can be replaced under a source that stays in
      * place.
      */
-    sharedLiveSourceFor(sn: string, opts?: SharedLiveOpts, mayOpenOwnSession?: boolean): Promise<SharedLiveSource>;
+    sharedLiveSourceFor(sn: string, opts?: SharedLiveOpts, continuous?: boolean): Promise<SharedLiveSource>;
     /**
      * Tear down any pull on this station that is lingering for ANOTHER camera, before starting this one.
      *
@@ -559,12 +583,17 @@ export declare class P2PCommandRouter {
      * yield CMAF fragments (init segment first, then a `moof`+`mdat` per keyframe boundary) muxed by the
      * dependency-free internal fMP4 muxer. The returned recording handle exposes battery-budget notices
      * and detaches its consumer on `stop`, iterator return, or iterator throw. No ffmpeg.
+     *
+     * It is a continuous pull only on an {@link OWN_LIVE_SESSION_MODELS} station; elsewhere it never opens a
+     * connection of its own.
      */
     recordFragments(sn: string, opts?: {
         fragmentSeconds?: number;
         eccPrivateKey?: Buffer;
         keepAliveMs?: number;
     } & SharedSourceHints): FragmentRecording;
+    /** Whether `stationSn` is an {@link OWN_LIVE_SESSION_MODELS} station. */
+    private ownsLiveSession;
     /**
      * **Generic P2P request/reply query.** Sends a `SET_PAYLOAD` (1350) wrapper carrying `subCmd` on the
      * device channel, then resolves with the reply frame's `payload` — the `NOTIFY_PAYLOAD` (1351)
@@ -693,6 +722,9 @@ export declare class P2PCommandRouter {
      * **Station-scoped scalar** (`p2p-station-scalar` intent): the 132-byte channel-less body
      * ({@link buildDirectBinaryBody} with no `channel`) on an EXPLICIT channel, signCode 8. The
      * HomeBase's own controls ride the station broadcast channel 255 (alarm/speaker volume 1235).
+     *
+     * `form` `"auto"` seals it at the session's level, as {@link sendBySessionLevel} defines it: level-2 on a
+     * keyed session, the same body sealed level-1 on a keyless one. Absent, the send waits for the level-2 key.
      */
     private sendStationScalar;
     /** Send a level-1 int-plus-string frame with authenticated account identity injected by the transport. */

package/dist/transport/p2p/database-wire.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Database wire — the ids and the whole-table query a station's on-station table and stored-image
+ * reads are built from.
+ *
+ * A HomeBase answers them over its P2P session and a T9000 over its portal control channel, with the
+ * same inner payloads, so both transports build their reads from this one module. The barrel does not
+ * re-export it: these are wire ids, not part of the package surface.
+ *
+ * @module p2p/database-wire
+ */
+/** CMD_DATABASE_IMAGE (1308) — fetch one stored image by its on-station path. */
+export declare const CMD_DATABASE_IMAGE = 1308;
+/** CMD_DATABASE (1306) — query one on-station table; reply carries `{cmd:10000,count,data:[…]}`. */
+export declare const CMD_DATABASE = 1306;
+/**
+ * Inner query cmds carried in a {@link CMD_DATABASE} payload. `FULL_TABLE` reads one table whole;
+ * `COMBINATION_WITH_AI` is the AI event-history read that bundles the face roster.
+ */
+export declare const DB_QUERY: {
+    readonly FULL_TABLE: 10000;
+    readonly COMBINATION_WITH_AI: 10011;
+    readonly QUERY_LOCAL: 10017;
+};
+/** How long a station's database reply has to arrive whole, when the caller states no bound. */
+export declare const DB_TABLE_TIMEOUT_MS = 15000;
+/**
+ * The query params the vendor app sends with a whole-table `CMD_DATABASE` read (inner `cmd 10000`).
+ * `count` bounds the row count.
+ */
+export declare function fullTableQuery(count?: number): Record<string, unknown>;

package/dist/transport/p2p/level2-settle.d.ts

@@ -0,0 +1,9 @@
+/**
+ * The bound a caller waits for the level-2 negotiation to SETTLE, measured from connect.
+ *
+ * For a caller that picks its seal once from `P2PSession.hasLevel2Key` and has no second chance. A media
+ * start reads the key on every send and is re-issued by the warm-up, so it needs no wait; a property write
+ * framed level-1 to a family that only accepts level-2 is ignored, and nothing re-frames it. Session-scoped,
+ * so a station that offers no key does not charge this to every later command.
+ */
+export declare const LEVEL2_SETTLE_MS = 8000;

package/dist/transport/p2p/live-stream.d.ts

@@ -7,9 +7,11 @@
  *  - **Plaintext** (`signCode 0`, e.g. HomeBase-attached cameras): a fixed 22-byte frame header
  *    (`parseVideoFrameHeader`) followed directly by Annex-B NAL units — verified live (960×540,
  *    keyframe = header flag bit0). We strip the 22-byte header.
- *  - **Encrypted** (E2E cameras): the body is AES-256-GCM under a per-stream media key wrapped in a
- *    keyframe ECIES envelope. If an `eccPrivateKey` is supplied we run `VideoFrameDecoder`; otherwise
- *    those frames are skipped (no key → no video).
+ *  - **Encrypted keyframes**: either the AES-256-GCM body under a media key wrapped in an ECIES envelope
+ *    for an offered P-256 key ({@link VideoFrameDecoder}), or an AES-ECB head under a media key wrapped for
+ *    the session's RSA key ({@link P2PSession.decodeVideoFrame}). An attached camera's start on a station
+ *    with a {@link P2PSession.mediaEccPrivateKey} offers that P-256 key first, so its stream decodes with
+ *    that pair unless `eccPrivateKey` names another.
  *
  * Emits: `video` ({@link LiveVideoFrame} — Annex-B), `audio` ({@link LiveAudioFrame}), `start`, `stop`,
  * `error`.
@@ -54,7 +56,10 @@ export interface LiveStreamOptions {
      * however long the station keeps serving that sibling instead of this one.
      */
     channel?: number;
-    /** Camera ECC private key (32B) for E2E/encrypted cameras; omit for plaintext cameras. */
+    /**
+     * P-256 private key (32B) whose public point the camera wraps each keyframe's media key for. Defaults, on an
+     * attached camera, to the session's `P2PSession.mediaEccPrivateKey`, the pair its start offers.
+     */
     eccPrivateKey?: Buffer;
     /** Admin account id — required for the level-2 (`signCode 8`) media-start payload selecting a camera. */
     accountId?: string;
@@ -112,6 +117,8 @@ export declare class LiveStream extends EventEmitter {
     private tracedFirstVideoUnit;
     private tracedFirstKeyframe;
     private tracedDecodeFailures;
+    /** How the frame that opened the latest access unit was read; see {@link settleStartKey}. */
+    private unitOpenedBy;
     private tracedFirstForeignFrame;
     private stallTimer?;
     /**
@@ -173,6 +180,7 @@ export declare class LiveStream extends EventEmitter {
     stop(): void;
     /** Extract the Annex-B payload from a plaintext 1300 frame (fixed 22-byte header), or undefined. */
     private plaintextAnnexB;
+    /** Emit one accepted media frame; an audio frame with no bytes past its header emits nothing. */
     private onFrame;
     /**
      * Whether this stream may take `frame` — the demultiplexer for a station that serves several cameras.
@@ -198,11 +206,30 @@ export declare class LiveStream extends EventEmitter {
      */
     private acceptsMedia;
     /**
-     * The Annex-B payload of a frame that starts an access unit. The session decodes it when it can (it
-     * holds the RSA private key, and handles the plaintext form); the legacy header-strip and the ECIES
-     * {@link VideoFrameDecoder} are the fallbacks for an E2E camera.
+     * The Annex-B payload of a frame that starts an access unit. The authenticated ECIES/GCM
+     * {@link VideoFrameDecoder} goes first: its HMAC and GCM checks fail closed on a frame not sealed for its
+     * key. The session's RSA path cannot: on Node ≥ 24.5, PKCS#1 v1.5 decryption of a key not wrapped for it
+     * returns pseudo-random bytes instead of throwing (implicit rejection), which would decode an ECC
+     * keyframe into noise. The session's decode, which also passes plaintext frames, and the header strip
+     * follow. A payload that opens an access unit records how it was read: by the ECIES path, or otherwise by
+     * its sign code, sealed (`"rsa"`) or in the clear (`"plain"`).
      */
     private annexbOf;
+    /**
+     * Tell the session how this keyframe was opened, which answers the attached starts on this channel
+     * ({@link P2PSession.settleAttachedKey}), and re-issue the start when the session asks for one: a plaintext
+     * keyframe answering the session's P-256 offer, from a camera that did not use the point, which the next
+     * start asks with RSA. Only a delivered keyframe answers: a frame no key opens, or a continuation without the
+     * frame that opened its unit, delivers nothing.
+     */
+    private settleStartKey;
+    /**
+     * The payload of an audio frame. On a stream with an ECIES decoder, a sealed frame ({@link isSealedAudio}) is
+     * opened under the media key of the latest keyframe, and answers `undefined` when it does not open or arrives
+     * before any keyframe gave a media key, since its bytes are ciphertext. Every other frame is the bytes after
+     * its header, empty for a frame that carries only its header.
+     */
+    private audioPayload;
     /**
      * Report an access unit the transport could not complete.
      *