eufy-security-client 4.0.0 → 4.1.0-dev.37

package/build/http/megaCrypto.js

@@ -0,0 +1,129 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.megaDecryptBody = exports.megaEncryptBody = exports.sharedKeyToAesKey = exports.sharedKeySigningKey = exports.finalizeKeyExchange = exports.buildKeyExchange = exports.presetDecrypt = exports.presetEncrypt = exports.generateKeyIdent = exports.xSignature = exports.MEGA_PRESET_KEY = void 0;
+const crypto_1 = require("crypto");
+/**
+ * Eufy "eufy_mega" v6 transport crypto.
+ *
+ * Two layers:
+ *  1. Bootstrap (handshake): body + signature use a STATIC per-app `presetKey`.
+ *  2. Regular requests (post-handshake): body + signature use the per-cluster
+ *     ECDH `sharedKey` derived from the key/exchange.
+ */
+/** Static preset key for the `eufy_security` category (`*.eufy.com`). Extracted from the app's
+ *  `ESIotAppConfig`, stored in `MegaAppDomain.presetKeyMap` (one key per product category). */
+exports.MEGA_PRESET_KEY = "2500a7d5617812f9d52515b2c8f20a3d";
+/** NIST P-256 (prime256v1) — same curve the lib already uses for login. */
+const CURVE = "prime256v1";
+/**
+ * X-Signature = HMAC-SHA256, hex lowercase, over `${ts}+${nonce}+${encryptedBody}`.
+ * The HMAC key is the **ASCII string** of the key material (NOT hex-decoded).
+ *
+ * @param keyAscii presetKey (bootstrap) or sharedKey hex string (regular requests)
+ */
+const xSignature = (keyAscii, ts, nonce, encryptedBody) => {
+    const parts = encryptedBody !== undefined ? [ts, nonce, encryptedBody] : [ts, nonce];
+    return (0, crypto_1.createHmac)("sha256", Buffer.from(keyAscii, "utf8")).update(parts.join("+")).digest("hex");
+};
+exports.xSignature = xSignature;
+/** Random 32-hex client-generated X-Key-Ident (one per cluster identity). */
+const generateKeyIdent = () => (0, crypto_1.randomBytes)(16).toString("hex");
+exports.generateKeyIdent = generateKeyIdent;
+/**
+ * Encrypt a payload AES-128-CBC/PKCS7 under the preset key, output `base64(IV ++ ciphertext)`.
+ * The AES key is `bytes.fromhex(presetKey)` (16 bytes); a fresh random IV is prepended.
+ * Used to wrap the client's EC public key in the key/exchange request body.
+ */
+const presetEncrypt = (plaintext, presetKeyHex = exports.MEGA_PRESET_KEY) => {
+    const key = Buffer.from(presetKeyHex, "hex");
+    const iv = (0, crypto_1.randomBytes)(16);
+    const cipher = (0, crypto_1.createCipheriv)("aes-128-cbc", key, iv);
+    const ct = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+    return Buffer.concat([iv, ct]).toString("base64");
+};
+exports.presetEncrypt = presetEncrypt;
+/** Inverse of {@link presetEncrypt}: decode `base64(IV ++ ciphertext)` → plaintext. */
+const presetDecrypt = (b64, presetKeyHex = exports.MEGA_PRESET_KEY) => {
+    const blob = Buffer.from(b64, "base64");
+    const key = Buffer.from(presetKeyHex, "hex");
+    const decipher = (0, crypto_1.createDecipheriv)("aes-128-cbc", key, blob.subarray(0, 16));
+    return Buffer.concat([decipher.update(blob.subarray(16)), decipher.final()]).toString("utf8");
+};
+exports.presetDecrypt = presetDecrypt;
+/**
+ * Build the key/exchange request material.
+ *
+ * The exchange is ECIES-bootstrapped: the client's ephemeral EC public key is wrapped
+ * with the static `presetKey`. The SESSION sharedKey is NOT derivable yet — it is
+ * `ECDH(clientPriv, server_public_key)` where server_public_key comes back in the
+ * response (see {@link finalizeKeyExchange}). We keep the ECDH object so the caller can
+ * finish the derivation once the server replies.
+ *
+ * @returns the ECDH object (holds the client private key), the wrapped client_public_key
+ *          body value, the client public key hex, and a fresh client-generated keyIdent.
+ */
+const buildKeyExchange = () => {
+    const ecdh = (0, crypto_1.createECDH)(CURVE);
+    ecdh.generateKeys();
+    const clientPubHex = ecdh.getPublicKey("hex");
+    const clientPublicKeyBody = (0, exports.presetEncrypt)(clientPubHex);
+    return { ecdh, clientPublicKeyBody, clientPublicKey: clientPubHex, keyIdent: (0, exports.generateKeyIdent)() };
+};
+exports.buildKeyExchange = buildKeyExchange;
+/**
+ * Finalize the handshake: derive the session sharedKey from our ECDH private key and the
+ * server's public key returned (preset-encrypted) in the key/exchange response.
+ *
+ * @param ecdh the ECDH object from {@link buildKeyExchange} (holds clientPriv)
+ * @param serverPublicKeyEnc base64 `server_public_key` from the response (preset-wrapped)
+ * @param keyIdent the client keyIdent used for this cluster
+ * @param clientPublicKey our public key hex (for reference)
+ */
+const finalizeKeyExchange = (ecdh, serverPublicKeyEnc, keyIdent, clientPublicKey) => {
+    const serverPubHex = (0, exports.presetDecrypt)(serverPublicKeyEnc);
+    if (!/^04[0-9a-f]{128}$/i.test(serverPubHex)) {
+        throw new Error("key/exchange: unexpected server public key format");
+    }
+    let sharedKey;
+    try {
+        sharedKey = ecdh.computeSecret(Buffer.from(serverPubHex, "hex")).toString("hex");
+    }
+    catch (err) {
+        throw new Error(`key/exchange: ECDH computeSecret failed (${err.message})`);
+    }
+    return { keyIdent, sharedKey, clientPublicKey };
+};
+exports.finalizeKeyExchange = finalizeKeyExchange;
+/**
+ * Per-request key material derived from the handshake sharedKey.
+ *
+ * The sharedKey is the ECDH X-coordinate as a 64-char hex string. For regular requests:
+ *  - **HMAC/signature key** = the first 32 hex CHARS of sharedKey, used as an ASCII string.
+ *  - **AES body key**       = `bytes.fromhex(sharedKey[:32])` → 16 bytes (AES-128); iv = key[:16].
+ *
+ * NOTE: only the first 32 hex chars (16 bytes) of the 64-char sharedKey are used.
+ */
+const sharedKeySigningKey = (sharedKeyHex) => sharedKeyHex.slice(0, 32);
+exports.sharedKeySigningKey = sharedKeySigningKey;
+/** AES key buffer for body encryption: bytes.fromhex(sharedKey[:32]) = 16 bytes (AES-128). */
+const sharedKeyToAesKey = (sharedKeyHex) => Buffer.from(sharedKeyHex.slice(0, 32), "hex");
+exports.sharedKeyToAesKey = sharedKeyToAesKey;
+/**
+ * Encrypt a regular (post-handshake) request/response body: AES-128-CBC/PKCS7 with a fresh
+ * RANDOM IV, output `base64(IV ++ ciphertext)` — same envelope as the key/exchange body.
+ */
+const megaEncryptBody = (plaintext, aesKey) => {
+    const iv = (0, crypto_1.randomBytes)(16);
+    const cipher = (0, crypto_1.createCipheriv)("aes-128-cbc", aesKey, iv);
+    const ct = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+    return Buffer.concat([iv, ct]).toString("base64");
+};
+exports.megaEncryptBody = megaEncryptBody;
+/** Inverse of {@link megaEncryptBody}: decode `base64(IV ++ ciphertext)` → plaintext. */
+const megaDecryptBody = (b64, aesKey) => {
+    const blob = Buffer.from(b64, "base64");
+    const decipher = (0, crypto_1.createDecipheriv)("aes-128-cbc", aesKey, blob.subarray(0, 16));
+    return Buffer.concat([decipher.update(blob.subarray(16)), decipher.final()]).toString("utf8");
+};
+exports.megaDecryptBody = megaDecryptBody;
+//# sourceMappingURL=megaCrypto.js.map

package/build/http/megaCrypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"megaCrypto.js","sourceRoot":"","sources":["../../src/http/megaCrypto.ts"],"names":[],"mappings":";;;AAAA,mCAAqG;AAErG;;;;;;;GAOG;AAEH;+FAC+F;AAClF,QAAA,eAAe,GAAG,kCAAkC,CAAC;AAElE,2EAA2E;AAC3E,MAAM,KAAK,GAAG,YAAY,CAAC;AAE3B;;;;;GAKG;AACI,MAAM,UAAU,GAAG,CAAC,QAAgB,EAAE,EAAU,EAAE,KAAa,EAAE,aAAsB,EAAU,EAAE;IACxG,MAAM,KAAK,GAAG,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IACrF,OAAO,IAAA,mBAAU,EAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnG,CAAC,CAAC;AAHW,QAAA,UAAU,cAGrB;AAEF,6EAA6E;AACtE,MAAM,gBAAgB,GAAG,GAAW,EAAE,CAAC,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAAjE,QAAA,gBAAgB,oBAAiD;AAE9E;;;;GAIG;AACI,MAAM,aAAa,GAAG,CAAC,SAAiB,EAAE,YAAY,GAAG,uBAAe,EAAU,EAAE;IACzF,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IAC7C,MAAM,EAAE,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,IAAA,uBAAc,EAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC7E,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACpD,CAAC,CAAC;AANW,QAAA,aAAa,iBAMxB;AAEF,uFAAuF;AAChF,MAAM,aAAa,GAAG,CAAC,GAAW,EAAE,YAAY,GAAG,uBAAe,EAAU,EAAE;IACnF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,IAAA,yBAAgB,EAAC,aAAa,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAC5E,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAChG,CAAC,CAAC;AALW,QAAA,aAAa,iBAKxB;AAWF;;;;;;;;;;;GAWG;AACI,MAAM,gBAAgB,GAAG,GAK9B,EAAE;IACF,MAAM,IAAI,GAAG,IAAA,mBAAU,EAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,CAAC,YAAY,EAAE,CAAC;IACpB,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,mBAAmB,GAAG,IAAA,qBAAa,EAAC,YAAY,CAAC,CAAC;IACxD,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,eAAe,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAA,wBAAgB,GAAE,EAAE,CAAC;AACpG,CAAC,CAAC;AAXW,QAAA,gBAAgB,oBAW3B;AAEF;;;;;;;;GAQG;AACI,MAAM,mBAAmB,GAAG,CACjC,IAAU,EACV,kBAA0B,EAC1B,QAAgB,EAChB,eAAuB,EACT,EAAE;IAChB,MAAM,YAAY,GAAG,IAAA,qBAAa,EAAC,kBAAkB,CAAC,CAAC;IACvD,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACnF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,4CAA6C,GAAa,CAAC,OAAO,GAAG,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC;AAClD,CAAC,CAAC;AAjBW,QAAA,mBAAmB,uBAiB9B;AAEF;;;;;;;;GAQG;AACI,MAAM,mBAAmB,GAAG,CAAC,YAAoB,EAAU,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAAlF,QAAA,mBAAmB,uBAA+D;AAE/F,8FAA8F;AACvF,MAAM,iBAAiB,GAAG,CAAC,YAAoB,EAAU,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;AAApG,QAAA,iBAAiB,qBAAmF;AAEjH;;;GAGG;AACI,MAAM,eAAe,GAAG,CAAC,SAAiB,EAAE,MAAc,EAAU,EAAE;IAC3E,MAAM,EAAE,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,IAAA,uBAAc,EAAC,aAAa,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IACzD,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC7E,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACpD,CAAC,CAAC;AALW,QAAA,eAAe,mBAK1B;AAEF,yFAAyF;AAClF,MAAM,eAAe,GAAG,CAAC,GAAW,EAAE,MAAc,EAAU,EAAE;IACrE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,IAAA,yBAAgB,EAAC,aAAa,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAC/E,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAChG,CAAC,CAAC;AAJW,QAAA,eAAe,mBAI1B"}

package/build/http/megaInterfaces.d.ts

@@ -0,0 +1,83 @@
+import { MegaIdentity } from "./megaCrypto";
+export interface MegaResult {
+    code: number;
+    msg: string;
+    data?: unknown;
+    trace_id?: string;
+}
+/** Picture-captcha challenge returned by `passport/generate/captcha`. `item` is a base64 image. */
+export interface MegaCaptcha {
+    captcha_id: string;
+    item: string;
+}
+/** Caller's captcha answer, passed back into the login call. */
+export interface MegaCaptchaAnswer {
+    captchaId: string;
+    answer: string;
+}
+/** Raw `devicemanage/get_user_mqtt_info` payload (AWS IoT mutual-TLS credentials). */
+export interface MegaUserMqttInfo {
+    endpoint_addr: string;
+    certificate_pem: string;
+    private_key: string;
+    aws_root_ca1_pem: string;
+    thing_name: string;
+    certificate_id: string;
+    user_id: string;
+    app_name: string;
+}
+/**
+ * Everything needed to open the v6 AWS IoT (mutual-TLS) MQTT connection, assembled so a consumer
+ * never has to reach into MegaHTTPApi internals. Topics use `PN`/`SN` placeholders to fill per
+ * device (`cmd/eufy_security/PN/SN/res`, …) — see SecurityMqttConstant in the v6 app.
+ */
+export interface MegaMqttConnectConfig {
+    endpoint: string;
+    port: number;
+    clientId: string;
+    thingName: string;
+    userId: string;
+    certificatePem: string;
+    privateKey: string;
+    awsRootCaPem: string;
+    topics: {
+        subCmd: string;
+        stateInfo: string;
+        pubCmd: string;
+    };
+}
+export interface MegaApiOptions {
+    /** Region/AB code, e.g. "fr", "us". Drives estimate_domain. */
+    ab: string;
+    /** os-type — MUST be "android" for the identity to route events via FCM. */
+    osType?: "android" | "iOS";
+    appName?: string;
+    appVersion?: string;
+    osVersion?: string;
+    phoneModel?: string;
+    /** Stable per-install device id. Seed it from the existing persisted openudid so the v6 client
+     *  presents the same device as the legacy path instead of a fresh id each run. */
+    openudid?: string;
+    /** Min delay between requests in ms (WAF-friendly). Default 3000. */
+    minRequestIntervalMs?: number;
+}
+/**
+ * Serializable session for resume-without-relogin (see {@link MegaHTTPApi.exportSession}).
+ *
+ * Field names intentionally mirror the legacy `EufySecurityPersistentData` / `HTTPApiPersistentData`
+ * conventions (`openudid`, `cloud_token`, `cloud_token_expiration`, `login_hash`, `user_id`) so this
+ * can slot into the existing persistence layer. `login_hash = md5(user:pass)` lets the consumer
+ * invalidate the cached session when credentials change — exactly like HTTPApi does.
+ */
+export interface MegaSession {
+    ab: string;
+    openudid: string;
+    login_hash?: string;
+    cloud_token?: string;
+    cloud_token_expiration?: number;
+    user_id?: string;
+    domains?: Record<string, string>;
+    megaDomain?: string;
+    /** Per-cluster ECDH identities (keyIdent + sharedKey + clientPublicKey). */
+    identities?: Record<string, MegaIdentity>;
+}

package/build/http/megaInterfaces.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=megaInterfaces.js.map

package/build/http/megaInterfaces.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"megaInterfaces.js","sourceRoot":"","sources":["../../src/http/megaInterfaces.ts"],"names":[],"mappings":""}

package/build/http/megaTransition.d.ts

@@ -0,0 +1,103 @@
+import { HTTPApi } from "./api";
+import { MegaHTTPApi } from "./megaApi";
+import type { HTTPApiPersistentData, LoginOptions } from "./interfaces";
+import type { EufySecurityConfig, EufySecurityPersistentData } from "../interfaces";
+/**
+ * Everything specific to the transitional v6 "eufy_mega" backend lives in this single file so it can
+ * be removed in one block once a native v6 data layer (the new library) takes over.
+ *
+ * {@link MegaTransition} is the connect coordinator: v6-first login, legacy as best-effort
+ * afterwards, the app-ready signal fired exactly once at the end. It owns all the v6 state (mega
+ * client, pending challenge, serialisation) and talks to {@link EufySecurity} only through the
+ * narrow {@link MegaTransitionHost} surface, so neither file leaks the other's internals.
+ *
+ * For now v6 is used only for login + FCM push registration: a migrated account logs in there and
+ * receives events over its push channel, while the data layer keeps using the legacy transport. The
+ * data endpoints differ on v6 (signed/encrypted, different paths/bodies) and belong in the new lib,
+ * so we deliberately do NOT route legacy endpoints through mega here.
+ *
+ * Nothing here modifies {@link MegaHTTPApi}: this layer only consumes its public API.
+ */
+/** The result of one v6 login attempt. */
+export type MegaLoginResult = "ok" | "tfa_required" | "captcha_required" | "locked" | "failed";
+/** Which backend a submitted 2FA code / captcha must be routed to. */
+export type ChallengeSource = "mega" | "legacy";
+/**
+ * The narrow surface {@link MegaTransition} needs from {@link EufySecurity}. It is satisfied with a
+ * small closure object (not `this`) so neither side has to expose private members nor import the
+ * other — keeping the transition layer self-contained and removable.
+ */
+export interface MegaTransitionHost {
+    readonly config: EufySecurityConfig;
+    readonly persistentData: EufySecurityPersistentData;
+    /** The live (legacy) transport, set once by {@link MegaTransition.createTransport}. */
+    readonly api: HTTPApi;
+    writePersistentData(): void;
+    /** Re-emit the 2FA prompt to the consumer (ws / plugin). */
+    emitTfaRequest(): void;
+    /** Re-emit the captcha prompt to the consumer (ws / plugin). */
+    emitCaptchaRequest(id: string, captcha: string): void;
+    /** The original upstream `connect()` (login + trust device), unchanged. */
+    legacyConnect(options?: LoginOptions): Promise<void>;
+    /** Signal the app as connected (refresh + push + mqtt). Fired once at the end of the sequence. */
+    onAPIConnect(): Promise<void>;
+    onConnectionError(error: Error): void;
+}
+/**
+ * Coordinates the v6-first login sequence. The v6 "eufy_mega" backend is the primary login (it
+ * carries push and is where the account is heading); the legacy login runs afterwards as
+ * best-effort and never blocks. Each backend has its OWN 2FA email + captcha; whichever asks
+ * records itself in {@link pendingChallenge} so the code/captcha from the next connect() is routed
+ * to the backend that asked for it. The app-ready signal fires ONCE, at the very end, and only if a
+ * login succeeded.
+ */
+export declare class MegaTransition {
+    private readonly host;
+    private megaApi?;
+    /**
+     * Which backend a submitted 2FA code / captcha must be routed to. Set when WE emit the challenge,
+     * so the next connect({verifyCode|captcha}) goes to the backend that asked for it — no guessing.
+     * `undefined` = no challenge outstanding (start a fresh sequence).
+     */
+    private pendingChallenge?;
+    /** Whether the v6 login succeeded this sequence (gates signalling the app as connected). */
+    private megaLoggedIn;
+    /** Serialises connect(): concurrent calls await the in-flight one instead of racing the sequence. */
+    private connectInProgress?;
+    constructor(host: MegaTransitionHost);
+    /** Record that the LEGACY login asked for a code/captcha (called from the host's api-event hooks). */
+    recordLegacyChallenge(): void;
+    /**
+     * Build the live transport. Today this is just the upstream legacy {@link HTTPApi}; the v6 mega
+     * client is created lazily on demand (login / push) via {@link getMegaApi}. Kept as a single
+     * factory so the transport can be swapped here if v6 ever needs to drive data requests too.
+     */
+    createTransport(persistentHttpApi: HTTPApiPersistentData | undefined): Promise<HTTPApi>;
+    /**
+     * Lazily create (and restore) the v6 mega client. The persisted session (token ~30 days) is
+     * reused so normal startups need no extra login/2FA; it is dropped if the credentials changed.
+     */
+    getMegaApi(): Promise<MegaHTTPApi>;
+    /**
+     * Register the FCM token on the v6 backend, best-effort. No-ops with a log when there is no valid
+     * v6 session yet (not-yet-migrated account); a v6 failure is swallowed so legacy push is unaffected.
+     */
+    registerMegaPushToken(token: string): Promise<boolean>;
+    /**
+     * Authenticate against the v6 backend.
+     *  1. first call -> on `26052` triggers the email code and returns "tfa_required"; on a captcha
+     *     challenge it emits "captcha request" and returns "captcha_required".
+     *  2. with a code/captcha -> completes login; the session is persisted (token ~30 days) so later
+     *     startups reuse it with no relogin/2FA.
+     *
+     * Backend-enforced lockout (too many incorrect / max login limit) is surfaced as "locked" so the
+     * caller stops retrying instead of deepening the lockout.
+     */
+    loginMega(verifyCode?: string, captcha?: {
+        captchaId: string;
+        answer: string;
+    }): Promise<MegaLoginResult>;
+    /** Serialised connect(): concurrent callers await the in-flight run instead of racing it. */
+    connect(options?: LoginOptions): Promise<void>;
+    private runConnect;
+}

package/build/http/megaTransition.js

@@ -0,0 +1,203 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MegaTransition = void 0;
+const api_1 = require("./api");
+const megaApi_1 = require("./megaApi");
+const logging_1 = require("../logging");
+const types_1 = require("./types");
+const error_1 = require("../error");
+const utils_1 = require("../utils");
+/**
+ * Coordinates the v6-first login sequence. The v6 "eufy_mega" backend is the primary login (it
+ * carries push and is where the account is heading); the legacy login runs afterwards as
+ * best-effort and never blocks. Each backend has its OWN 2FA email + captcha; whichever asks
+ * records itself in {@link pendingChallenge} so the code/captcha from the next connect() is routed
+ * to the backend that asked for it. The app-ready signal fires ONCE, at the very end, and only if a
+ * login succeeded.
+ */
+class MegaTransition {
+    host;
+    megaApi;
+    /**
+     * Which backend a submitted 2FA code / captcha must be routed to. Set when WE emit the challenge,
+     * so the next connect({verifyCode|captcha}) goes to the backend that asked for it — no guessing.
+     * `undefined` = no challenge outstanding (start a fresh sequence).
+     */
+    pendingChallenge;
+    /** Whether the v6 login succeeded this sequence (gates signalling the app as connected). */
+    megaLoggedIn = false;
+    /** Serialises connect(): concurrent calls await the in-flight one instead of racing the sequence. */
+    connectInProgress;
+    constructor(host) {
+        this.host = host;
+    }
+    /** Record that the LEGACY login asked for a code/captcha (called from the host's api-event hooks). */
+    recordLegacyChallenge() {
+        this.pendingChallenge = "legacy";
+    }
+    /**
+     * Build the live transport. Today this is just the upstream legacy {@link HTTPApi}; the v6 mega
+     * client is created lazily on demand (login / push) via {@link getMegaApi}. Kept as a single
+     * factory so the transport can be swapped here if v6 ever needs to drive data requests too.
+     */
+    async createTransport(persistentHttpApi) {
+        return api_1.HTTPApi.initialize(this.host.config.country, this.host.config.username, this.host.config.password, persistentHttpApi);
+    }
+    /**
+     * Lazily create (and restore) the v6 mega client. The persisted session (token ~30 days) is
+     * reused so normal startups need no extra login/2FA; it is dropped if the credentials changed.
+     */
+    async getMegaApi() {
+        if (!this.megaApi) {
+            this.megaApi = new megaApi_1.MegaHTTPApi({
+                ab: this.host.config.country ?? "US",
+                osType: "android",
+                phoneModel: this.host.config.trustedDeviceName,
+                openudid: this.host.persistentData.openudid || undefined,
+            });
+            await this.megaApi.init();
+            const saved = this.host.persistentData.megaApi;
+            if (saved) {
+                const currentHash = (0, megaApi_1.megaLoginHash)(this.host.config.username, this.host.config.password, this.host.persistentData.openudid);
+                if (saved.login_hash && saved.login_hash !== currentHash) {
+                    logging_1.rootMainLogger.debug("v6: credentials changed since last login, ignoring stored mega session");
+                }
+                else {
+                    this.megaApi.restoreSession(saved);
+                }
+            }
+        }
+        return this.megaApi;
+    }
+    /**
+     * Register the FCM token on the v6 backend, best-effort. No-ops with a log when there is no valid
+     * v6 session yet (not-yet-migrated account); a v6 failure is swallowed so legacy push is unaffected.
+     */
+    async registerMegaPushToken(token) {
+        try {
+            const mega = await this.getMegaApi();
+            if (!mega.hasValidSession()) {
+                logging_1.rootMainLogger.debug("v6 push: no valid mega session yet, skipping register (legacy still active)");
+                return false;
+            }
+            const result = await mega.registerPushToken(token);
+            if (result.code === 0) {
+                logging_1.rootMainLogger.info("v6 push: FCM token registered on the eufy_mega backend");
+                return true;
+            }
+            logging_1.rootMainLogger.warn("v6 push: register_push_token returned a non-zero code", {
+                code: result.code,
+                msg: result.msg,
+            });
+            return false;
+        }
+        catch (err) {
+            logging_1.rootMainLogger.warn("v6 push: register failed (legacy push unaffected)", { error: (0, utils_1.getError)((0, error_1.ensureError)(err)) });
+            return false;
+        }
+    }
+    /**
+     * Authenticate against the v6 backend.
+     *  1. first call -> on `26052` triggers the email code and returns "tfa_required"; on a captcha
+     *     challenge it emits "captcha request" and returns "captcha_required".
+     *  2. with a code/captcha -> completes login; the session is persisted (token ~30 days) so later
+     *     startups reuse it with no relogin/2FA.
+     *
+     * Backend-enforced lockout (too many incorrect / max login limit) is surfaced as "locked" so the
+     * caller stops retrying instead of deepening the lockout.
+     */
+    async loginMega(verifyCode, captcha) {
+        try {
+            const mega = await this.getMegaApi();
+            if (mega.hasValidSession() && !verifyCode && !captcha)
+                return "ok";
+            await mega.estimateDomain();
+            await mega.keyExchange(mega.clusterHost("openapi"));
+            const result = await mega.login(this.host.config.username, this.host.config.password, verifyCode, captcha);
+            if (result.code === types_1.ResponseErrorCode.CODE_NEED_VERIFY_CODE) {
+                await mega.sendVerifyCode();
+                this.pendingChallenge = "mega";
+                this.host.emitTfaRequest();
+                logging_1.rootMainLogger.info("v6 login: email 2FA required — call loginMega(code) with the received code");
+                return "tfa_required";
+            }
+            if (result.code === types_1.ResponseErrorCode.LOGIN_NEED_CAPTCHA ||
+                result.code === types_1.ResponseErrorCode.LOGIN_CAPTCHA_ERROR) {
+                const c = await mega.generateCaptcha();
+                this.pendingChallenge = "mega";
+                this.host.emitCaptchaRequest(c.captcha_id, c.item);
+                logging_1.rootMainLogger.info("v6 login: captcha required — call loginMega(undefined, {captchaId, answer})");
+                return "captcha_required";
+            }
+            if (result.code === types_1.ResponseErrorCode.CODE_PASSWORD_TOO_MANY_INCORRECT ||
+                result.code === types_1.ResponseErrorCode.CODE_PASSWORD_WRONG_FIVE_TIMES ||
+                result.code === types_1.ResponseErrorCode.CODE_MAX_LOGIN_LIMIT) {
+                logging_1.rootMainLogger.warn("v6 login temporarily locked by the backend — stop retrying", {
+                    code: result.code,
+                    msg: result.msg,
+                });
+                return "locked";
+            }
+            if (result.code !== 0) {
+                logging_1.rootMainLogger.warn("v6 login failed", { code: result.code, msg: result.msg });
+                return "failed";
+            }
+            this.host.persistentData.megaApi = mega.exportSession((0, megaApi_1.megaLoginHash)(this.host.config.username, this.host.config.password, this.host.persistentData.openudid));
+            this.host.writePersistentData();
+            logging_1.rootMainLogger.info("v6 login: success, mega session persisted");
+            return "ok";
+        }
+        catch (err) {
+            logging_1.rootMainLogger.error("v6 login error", { error: (0, utils_1.getError)((0, error_1.ensureError)(err)) });
+            return "failed";
+        }
+    }
+    /** Serialised connect(): concurrent callers await the in-flight run instead of racing it. */
+    connect(options) {
+        if (this.connectInProgress)
+            return this.connectInProgress;
+        this.connectInProgress = this.runConnect(options).finally(() => {
+            this.connectInProgress = undefined;
+        });
+        return this.connectInProgress;
+    }
+    async runConnect(options) {
+        const megaCaptcha = options?.captcha
+            ? { captchaId: options.captcha.captchaId, answer: options.captcha.captchaCode }
+            : undefined;
+        // PHASE 1 — v6 first. Run it unless a challenge is currently outstanding for the LEGACY side.
+        if (this.pendingChallenge !== "legacy") {
+            const megaResult = await this.loginMega(options?.verifyCode, megaCaptcha);
+            if (megaResult === "tfa_required" || megaResult === "captcha_required") {
+                // loginMega already recorded pendingChallenge="mega" and prompted the consumer.
+                return;
+            }
+            this.megaLoggedIn = megaResult === "ok";
+            this.pendingChallenge = undefined;
+        }
+        // PHASE 2 — legacy afterwards, best-effort. A code/captcha just used by mega is not valid here;
+        // the legacy login emits its OWN tfa/captcha event (which records pendingChallenge="legacy" via
+        // the host) and we wait for the next connect(). If legacy has been decommissioned, its login
+        // simply fails and we carry on with v6 only.
+        if (!this.host.api.isConnected()) {
+            const legacyOptions = this.pendingChallenge === "legacy"
+                ? options
+                : { ...options, verifyCode: undefined, captcha: undefined };
+            this.pendingChallenge = undefined;
+            await this.host.legacyConnect(legacyOptions);
+            // legacyConnect may have recorded pendingChallenge="legacy" via the host's api-event hooks.
+            if (this.pendingChallenge === "legacy" && !this.host.api.isConnected())
+                return;
+        }
+        // PHASE 3 — both backends settled. Signal the app ONCE, only if a login actually succeeded.
+        if (this.megaLoggedIn || this.host.api.isConnected()) {
+            await this.host.onAPIConnect();
+        }
+        else {
+            logging_1.rootMainLogger.warn("connect: neither v6 nor legacy login succeeded — not signalling connected");
+            this.host.onConnectionError(new Error("Login failed on both backends"));
+        }
+    }
+}
+exports.MegaTransition = MegaTransition;
+//# sourceMappingURL=megaTransition.js.map

package/build/http/megaTransition.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"megaTransition.js","sourceRoot":"","sources":["../../src/http/megaTransition.ts"],"names":[],"mappings":";;;AAAA,+BAAgC;AAChC,uCAAuD;AACvD,wCAA4C;AAG5C,mCAA4C;AAC5C,oCAAuC;AACvC,oCAAoC;AA+CpC;;;;;;;GAOG;AACH,MAAa,cAAc;IACR,IAAI,CAAqB;IAClC,OAAO,CAAe;IAC9B;;;;OAIG;IACK,gBAAgB,CAAmB;IAC3C,4FAA4F;IACpF,YAAY,GAAG,KAAK,CAAC;IAC7B,qGAAqG;IAC7F,iBAAiB,CAAiB;IAE1C,YAAY,IAAwB;QAClC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,sGAAsG;IAC/F,qBAAqB;QAC1B,IAAI,CAAC,gBAAgB,GAAG,QAAQ,CAAC;IACnC,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,eAAe,CAAC,iBAAoD;QAC/E,OAAO,aAAO,CAAC,UAAU,CACvB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAQ,EACzB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAS,EAC1B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAS,EAC1B,iBAAiB,CAClB,CAAC;IACJ,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,UAAU;QACrB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,IAAI,CAAC,OAAO,GAAG,IAAI,qBAAW,CAAC;gBAC7B,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI;gBACpC,MAAM,EAAE,SAAS;gBACjB,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB;gBAC9C,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,IAAI,SAAS;aACzD,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC;YAC/C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,WAAW,GAAG,IAAA,uBAAa,EAC/B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EACzB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EACzB,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAClC,CAAC;gBACF,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,UAAU,KAAK,WAAW,EAAE,CAAC;oBACzD,wBAAc,CAAC,KAAK,CAAC,wEAAwE,CAAC,CAAC;gBACjG,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;gBACrC,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,qBAAqB,CAAC,KAAa;QAC9C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;YACrC,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;gBAC5B,wBAAc,CAAC,KAAK,CAAC,6EAA6E,CAAC,CAAC;gBACpG,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;YACnD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACtB,wBAAc,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;gBAC9E,OAAO,IAAI,CAAC;YACd,CAAC;YACD,wBAAc,CAAC,IAAI,CAAC,uDAAuD,EAAE;gBAC3E,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,GAAG,EAAE,MAAM,CAAC,GAAG;aAChB,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,wBAAc,CAAC,IAAI,CAAC,mDAAmD,EAAE,EAAE,KAAK,EAAE,IAAA,gBAAQ,EAAC,IAAA,mBAAW,EAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;YAChH,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACI,KAAK,CAAC,SAAS,CACpB,UAAmB,EACnB,OAA+C;QAE/C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;YACrC,IAAI,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,UAAU,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAEnE,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;YAC5B,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC;YACpD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAS,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAS,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;YAE7G,IAAI,MAAM,CAAC,IAAI,KAAK,yBAAiB,CAAC,qBAAqB,EAAE,CAAC;gBAC5D,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;gBAC5B,IAAI,CAAC,gBAAgB,GAAG,MAAM,CAAC;gBAC/B,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;gBAC3B,wBAAc,CAAC,IAAI,CAAC,4EAA4E,CAAC,CAAC;gBAClG,OAAO,cAAc,CAAC;YACxB,CAAC;YACD,IACE,MAAM,CAAC,IAAI,KAAK,yBAAiB,CAAC,kBAAkB;gBACpD,MAAM,CAAC,IAAI,KAAK,yBAAiB,CAAC,mBAAmB,EACrD,CAAC;gBACD,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;gBACvC,IAAI,CAAC,gBAAgB,GAAG,MAAM,CAAC;gBAC/B,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;gBACnD,wBAAc,CAAC,IAAI,CAAC,6EAA6E,CAAC,CAAC;gBACnG,OAAO,kBAAkB,CAAC;YAC5B,CAAC;YACD,IACE,MAAM,CAAC,IAAI,KAAK,yBAAiB,CAAC,gCAAgC;gBAClE,MAAM,CAAC,IAAI,KAAK,yBAAiB,CAAC,8BAA8B;gBAChE,MAAM,CAAC,IAAI,KAAK,yBAAiB,CAAC,oBAAoB,EACtD,CAAC;gBACD,wBAAc,CAAC,IAAI,CAAC,4DAA4D,EAAE;oBAChF,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,GAAG,EAAE,MAAM,CAAC,GAAG;iBAChB,CAAC,CAAC;gBACH,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACtB,wBAAc,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;gBAC/E,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,GAAG,IAAI,CAAC,aAAa,CACnD,IAAA,uBAAa,EAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CACvG,CAAC;YACF,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAChC,wBAAc,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;YACjE,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,wBAAc,CAAC,KAAK,CAAC,gBAAgB,EAAE,EAAE,KAAK,EAAE,IAAA,gBAAQ,EAAC,IAAA,mBAAW,EAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;YAC9E,OAAO,QAAQ,CAAC;QAClB,CAAC;IACH,CAAC;IAED,6FAA6F;IACtF,OAAO,CAAC,OAAsB;QACnC,IAAI,IAAI,CAAC,iBAAiB;YAAE,OAAO,IAAI,CAAC,iBAAiB,CAAC;QAC1D,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YAC7D,IAAI,CAAC,iBAAiB,GAAG,SAAS,CAAC;QACrC,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAChC,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,OAAsB;QAC7C,MAAM,WAAW,GAAG,OAAO,EAAE,OAAO;YAClC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE;YAC/E,CAAC,CAAC,SAAS,CAAC;QAEd,8FAA8F;QAC9F,IAAI,IAAI,CAAC,gBAAgB,KAAK,QAAQ,EAAE,CAAC;YACvC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;YAC1E,IAAI,UAAU,KAAK,cAAc,IAAI,UAAU,KAAK,kBAAkB,EAAE,CAAC;gBACvE,gFAAgF;gBAChF,OAAO;YACT,CAAC;YACD,IAAI,CAAC,YAAY,GAAG,UAAU,KAAK,IAAI,CAAC;YACxC,IAAI,CAAC,gBAAgB,GAAG,SAAS,CAAC;QACpC,CAAC;QAED,gGAAgG;QAChG,gGAAgG;QAChG,6FAA6F;QAC7F,6CAA6C;QAC7C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC;YACjC,MAAM,aAAa,GACjB,IAAI,CAAC,gBAAgB,KAAK,QAAQ;gBAChC,CAAC,CAAC,OAAO;gBACT,CAAC,CAAE,EAAE,GAAG,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAmB,CAAC;YAClF,IAAI,CAAC,gBAAgB,GAAG,SAAS,CAAC;YAClC,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;YAC7C,4FAA4F;YAC5F,IAAI,IAAI,CAAC,gBAAgB,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE;gBAAE,OAAO;QACjF,CAAC;QAED,4FAA4F;QAC5F,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC;YACrD,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,wBAAc,CAAC,IAAI,CAAC,2EAA2E,CAAC,CAAC;YACjG,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;CACF;AAhND,wCAgNC"}

package/build/http/station.d.ts

@@ -383,6 +383,7 @@ export declare class Station extends TypedEmitter<StationEvents> {
     getLockStatus(): void;
     private onSequenceError;
     private onHubNotifyUpdate;
+    private onPushNotification;
     updateUsername(device: Device, username: string, passwordId: string): void;
     setOpenMethod(device: Device, value: number): void;
     setMotionActivatedPrompt(device: Device, value: boolean): void;

package/build/http/station.js

@@ -81,6 +81,7 @@ class Station extends tiny_typed_emitter_1.TypedEmitter {
         this.p2pSession.on("storage info hb3", (channel, storageInfo) => this.onStorageInfoHB3(channel, storageInfo));
         this.p2pSession.on("sequence error", (channel, command, sequence, serialnumber) => this.onSequenceError(channel, command, sequence, serialnumber));
         this.p2pSession.on("hub notify update", () => this.onHubNotifyUpdate());
+        this.p2pSession.on("push notification", (message) => this.onPushNotification(message));
     }
     initializeState() {
         this.update(this.rawStation);
@@ -15609,6 +15610,9 @@ class Station extends tiny_typed_emitter_1.TypedEmitter {
     onHubNotifyUpdate() {
         this.emit("hub notify update", this);
     }
+    onPushNotification(message) {
+        this.emit("push notification", this, message);
+    }
     updateUsername(device, username, passwordId) {
         const commandData = {
             name: types_1.CommandName.DeviceUpdateUsername,