scrypted-kasa 1.0.0

package/src/camera/api.ts

@@ -0,0 +1,329 @@
+import { once } from 'events';
+import https from 'https';
+import type { IncomingMessage } from 'http';
+import type { Readable } from 'stream';
+
+// Kasa cameras serve a non-standard mixed multipart stream over HTTPS on this port/path.
+// Reverse-engineered: https://medium.com/@hu3vjeen/reverse-engineering-tp-link-kc100-bac4641bf1cd
+export const KASA_DEFAULT_PORT = 19443;
+export const KASA_STREAM_PATH = '/https/stream/mixed';
+
+// Real headers from this camera fit in well under 1 KB. Cap at 32 KB so a malformed framing
+// (or an attacker who substitutes a non-Kasa endpoint) can't grow the queued chunks until
+// the stream eventually ends. Throwing here surfaces the problem instead of silently
+// retaining memory.
+const MAX_HEADER_BYTES = 32 * 1024;
+
+// Socket idle timeout. Doubles as a connect timeout (a camera that's reachable on TCP but
+// never finishes TLS / never sends headers will hit this) AND as a stream-stall timeout
+// (real cameras stream continuously; a 10 s silence means the camera or network is dead).
+// Without this, a hung camera causes getVideoStream to block indefinitely.
+const KASA_STREAM_IDLE_TIMEOUT_MS = 10000;
+
+export const KasaMimeVideo = 'video/x-h264';
+export const KasaMimeG711U = 'audio/g711u';
+
+const H264_NAL_TYPE_SPS = 7;
+const H264_NAL_TYPE_PPS = 8;
+
+export interface H264SpsPps {
+    sps?: Buffer;
+    pps?: Buffer;
+}
+
+// Scans an annex-b H.264 buffer (NALs prefixed by 00 00 01 or 00 00 00 01) for SPS (type 7)
+// and PPS (type 8). Mutates `found` so callers can accumulate across multiple parts; once both
+// are set further calls are cheap and idempotent.
+export function findSpsPps(annexb: Buffer, found: H264SpsPps = {}): H264SpsPps {
+    const len = annexb.length;
+    let i = 0;
+    while (i < len) {
+        let nalStart = -1;
+        if (i + 2 < len && annexb[i] === 0 && annexb[i + 1] === 0) {
+            if (annexb[i + 2] === 1) nalStart = i + 3;
+            else if (i + 3 < len && annexb[i + 2] === 0 && annexb[i + 3] === 1) nalStart = i + 4;
+        }
+        if (nalStart < 0) {
+            i++;
+            continue;
+        }
+        // Walk forward to the next start code; if none, the NAL runs to end-of-buffer.
+        let nalEnd = len;
+        for (let j = nalStart + 1; j + 2 < len; j++) {
+            if (
+                annexb[j] === 0 &&
+                annexb[j + 1] === 0 &&
+                (annexb[j + 2] === 1 || (j + 3 < len && annexb[j + 2] === 0 && annexb[j + 3] === 1))
+            ) {
+                nalEnd = j;
+                break;
+            }
+        }
+        const nalType = annexb[nalStart] & 0x1f;
+        if (nalType === H264_NAL_TYPE_SPS && !found.sps) found.sps = annexb.subarray(nalStart, nalEnd);
+        else if (nalType === H264_NAL_TYPE_PPS && !found.pps) found.pps = annexb.subarray(nalStart, nalEnd);
+        i = nalEnd;
+    }
+    return found;
+}
+
+export interface KasaConnectOptions {
+    ip: string;
+    port?: number;
+    username: string;
+    password: string;
+}
+
+export interface KasaPart {
+    contentType: string;
+    body: Buffer;
+}
+
+// Camera quirk: the Basic auth password must itself be base64(plaintext) before the standard
+// Basic auth base64(user:pass) wrapping. Username is the plaintext Kasa account email.
+function encodeKasaPassword(plaintext: string) {
+    return Buffer.from(plaintext, 'utf8').toString('base64');
+}
+
+export class KasaClient {
+    body!: IncomingMessage;
+    boundary!: string;
+
+    static async connect(options: KasaConnectOptions): Promise<KasaClient> {
+        const port = options.port || KASA_DEFAULT_PORT;
+        // Pre-emptive Basic auth — the camera doesn't send a 401 challenge before serving
+        // the multipart stream; the very first request must already include credentials.
+        // (No need for the auth-fetch challenge/retry dance other endpoints use.)
+        const auth =
+            'Basic ' + Buffer.from(`${options.username}:${encodeKasaPassword(options.password)}`).toString('base64');
+
+        // Cameras present a self-signed cert. The body is consumed as a long-lived stream
+        // rather than buffered to completion, so we don't read the response body here.
+        // The setTimeout below covers both the initial connect/handshake and ongoing stream
+        // idleness — Node's socket idle timeout resets on activity, so a continuously
+        // streaming camera never trips it; only stalls or unanswered handshakes do.
+        const response = await new Promise<IncomingMessage>((resolve, reject) => {
+            const req = https.request(
+                {
+                    host: options.ip,
+                    port,
+                    method: 'GET',
+                    path: KASA_STREAM_PATH,
+                    rejectUnauthorized: false,
+                    headers: {
+                        Authorization: auth,
+                        Accept: '*/*',
+                        Connection: 'keep-alive',
+                    },
+                },
+                resolve,
+            );
+            req.setTimeout(KASA_STREAM_IDLE_TIMEOUT_MS, () => {
+                req.destroy(new Error(`kasa stream socket idle timeout after ${KASA_STREAM_IDLE_TIMEOUT_MS}ms`));
+            });
+            req.on('error', reject);
+            req.end();
+        });
+
+        if (response.statusCode && response.statusCode >= 400) {
+            response.destroy();
+            throw new Error(`kasa stream HTTP ${response.statusCode}`);
+        }
+
+        const contentType = (response.headers['content-type'] || '') as string;
+        if (!/multipart\/x-mixed-replace/i.test(contentType)) {
+            response.destroy();
+            throw new Error(`unexpected content-type: ${contentType}`);
+        }
+
+        const m = /boundary=([^;\s]+)/i.exec(contentType);
+        if (!m) {
+            response.destroy();
+            throw new Error(`missing boundary in content-type: ${contentType}`);
+        }
+
+        const client = new KasaClient();
+        client.body = response;
+        client.boundary = m[1];
+        return client;
+    }
+
+    destroy() {
+        this.body?.destroy();
+    }
+
+    async readPart(): Promise<KasaPart> {
+        const expected = '--' + this.boundary;
+
+        // Read the boundary + header block as one buffer (terminated by a blank line) and
+        // walk it byte-wise to extract just content-type and content-length. At ~30 parts/s
+        // this avoids the regex split and ~6 string allocations per part that a per-line
+        // approach would do.
+        const headerBlock = await readUntilDoubleCrlf(this.body);
+        const len = headerBlock.length;
+
+        // Pull out the next \r\n- or \n-terminated line as a string. Returns the slice plus
+        // the index just after the line terminator. Skips leading blank lines so a stray
+        // CRLF before the boundary (some firmwares) doesn't break parsing.
+        const nextLine = (start: number): { line: string; next: number } => {
+            let i = start;
+            // Find next LF.
+            while (i < len && headerBlock[i] !== 0x0a) i++;
+            // Trim a trailing CR if present.
+            const end = i > start && headerBlock[i - 1] === 0x0d ? i - 1 : i;
+            return { line: headerBlock.toString('utf8', start, end), next: i + 1 };
+        };
+
+        let pos = 0;
+        // Tolerate leading empty lines.
+        while (pos < len) {
+            const { line, next } = nextLine(pos);
+            if (line) {
+                if (line !== expected) throw new Error(`unexpected boundary line: ${JSON.stringify(line)}`);
+                pos = next;
+                break;
+            }
+            pos = next;
+        }
+
+        let contentType = '';
+        let length = -1;
+        while (pos < len) {
+            const { line, next } = nextLine(pos);
+            pos = next;
+            if (!line) break;
+            // Header names from this camera are stable (`Content-Type:`, `Content-Length:`),
+            // but match case-insensitively to tolerate firmware revisions.
+            if (line.length > 13 && line.charCodeAt(12) === 0x3a /* : */) {
+                const name = line.slice(0, 12);
+                if (name === 'Content-Type' || name.toLowerCase() === 'content-type') {
+                    contentType = line.slice(13).trim();
+                    continue;
+                }
+            }
+            if (line.length > 15 && line.charCodeAt(14) === 0x3a) {
+                const name = line.slice(0, 14);
+                if (name === 'Content-Length' || name.toLowerCase() === 'content-length') {
+                    const n = parseInt(line.slice(15).trim(), 10);
+                    if (Number.isFinite(n) && n >= 0) length = n;
+                    continue;
+                }
+            }
+        }
+
+        if (length < 0) throw new Error('multipart: no/invalid content length');
+
+        const body = length === 0 ? Buffer.alloc(0) : await readLength(this.body, length);
+        return { contentType, body };
+    }
+}
+
+// Read exactly `length` bytes from a Readable. Returns when the bytes are available;
+// throws if the stream ends before that.
+async function readLength(readable: Readable, length: number): Promise<Buffer> {
+    if (readable.readableEnded || readable.destroyed) throw new Error('kasa stream ended before readLength');
+
+    {
+        const ret = readable.read(length);
+        if (ret) return ret;
+    }
+
+    return new Promise<Buffer>((resolve, reject) => {
+        const onReadable = () => {
+            const ret = readable.read(length);
+            if (ret) {
+                cleanup();
+                resolve(ret);
+            }
+        };
+        const onEnd = () => {
+            cleanup();
+            reject(new Error('kasa stream ended during readLength'));
+        };
+        const cleanup = () => {
+            readable.removeListener('readable', onReadable);
+            readable.removeListener('end', onEnd);
+            readable.removeListener('close', onEnd);
+            readable.removeListener('error', onError);
+        };
+        const onError = (e: Error) => {
+            cleanup();
+            reject(e);
+        };
+        readable.on('readable', onReadable);
+        readable.on('end', onEnd);
+        readable.on('close', onEnd);
+        readable.on('error', onError);
+    });
+}
+
+// Read up to and including the first blank line (CRLF CRLF or LF LF) and return everything
+// up to and including the terminator as a Buffer. Whatever bytes come after are unshifted
+// back so the body that follows can be read intact. Enforces MAX_HEADER_BYTES so a malformed
+// stream that never sends a terminator can't grow queued chunks unbounded.
+async function readUntilDoubleCrlf(readable: Readable): Promise<Buffer> {
+    const queued: Buffer[] = [];
+    let queuedLen = 0;
+    // crlf encodes how many bytes of \r\n\r\n we've matched: 0,1=\r, 2=\r\n, 3=\r\n\r, 4=done.
+    // lfOnly counts consecutive \n bytes (some firmwares emit LF-only framing).
+    let crlf = 0;
+    let lfOnly = 0;
+    while (true) {
+        if (readable.readableEnded || readable.destroyed) throw new Error('kasa stream ended before headers');
+        const chunk: Buffer | null = readable.read();
+        if (!chunk) {
+            // Race 'readable' against 'end'/'close'/'error': if the stream has already ended
+            // (or terminates while we're waiting), 'readable' will never fire and the await
+            // would strand this promise forever. Re-checking readableEnded on the next loop
+            // turn lets us throw a real error instead of hanging.
+            //
+            // AbortController removes the losing once() listeners; without it each iteration
+            // would leave 2 dangling listeners attached for the lifetime of the stream and
+            // eventually trip MaxListenersExceededWarning on a long stream with many parts.
+            const ac = new AbortController();
+            try {
+                await Promise.race([
+                    once(readable, 'readable', { signal: ac.signal }).catch(() => {
+                        /* aborted or end */
+                    }),
+                    once(readable, 'end', { signal: ac.signal }).catch(() => {}),
+                    once(readable, 'close', { signal: ac.signal }).catch(() => {}),
+                ]);
+            } finally {
+                ac.abort();
+            }
+            continue;
+        }
+        let split = -1;
+        for (let i = 0; i < chunk.length; i++) {
+            const b = chunk[i];
+            if (crlf === 0 && b === 0x0d) crlf = 1;
+            else if (crlf === 1 && b === 0x0a) crlf = 2;
+            else if (crlf === 2 && b === 0x0d) crlf = 3;
+            else if (crlf === 3 && b === 0x0a) {
+                split = i + 1;
+                break;
+            } else crlf = b === 0x0d ? 1 : 0;
+            if (b === 0x0a) {
+                if (++lfOnly === 2) {
+                    split = i + 1;
+                    break;
+                }
+            } else lfOnly = 0;
+        }
+        if (split < 0) {
+            queuedLen += chunk.length;
+            if (queuedLen > MAX_HEADER_BYTES)
+                throw new Error(`multipart header exceeded ${MAX_HEADER_BYTES} bytes without terminator`);
+            queued.push(chunk);
+            continue;
+        }
+        const headerPart = chunk.subarray(0, split);
+        const rest = chunk.subarray(split);
+        if (queuedLen + headerPart.length > MAX_HEADER_BYTES)
+            throw new Error(`multipart header exceeded ${MAX_HEADER_BYTES} bytes`);
+        queued.push(headerPart);
+        if (rest.length) readable.unshift(rest);
+        return queued.length === 1 ? queued[0] : Buffer.concat(queued);
+    }
+}

package/src/camera/intercom.ts

@@ -0,0 +1,163 @@
+import crypto from 'crypto';
+import { ClientRequest } from 'http';
+import https from 'https';
+import { PassThrough } from 'stream';
+
+export const KASA_TALK_PORT = 18443;
+const KASA_TALK_PATH = '/https/speaker/audio/g711block';
+const TALK_BOUNDARY = 'audio-boundary--';
+
+// Talk-channel auth uses md5(plaintext) as the password rather than the base64(plaintext)
+// the receive stream uses. Same camera, different scheme — observed on KC420WS firmware
+// 2.3.26 via mitmproxy capture of the official Kasa iOS app.
+function md5Hex(plaintext: string): string {
+    return crypto.createHash('md5').update(plaintext, 'utf8').digest('hex');
+}
+
+// The Kasa app sends X-APP-ID/playerId of the form "tty.<32 base64-ish chars>". The token
+// looks app-generated (not negotiated with the camera), so we mint our own per-session.
+function generatePlayerId(): string {
+    return 'tty.' + crypto.randomBytes(24).toString('base64').replace(/[+/=]/g, '').slice(0, 32);
+}
+
+export interface KasaTalkOptions {
+    ip: string;
+    port?: number;
+    username: string;
+    password: string;
+    console?: Console;
+}
+
+// One ongoing POST per talk session. Multipart parts wrap raw G.711 µ-law audio blocks
+// (Content-Type: audio/g711u) interleaved with empty audio/heartbeat parts that the app
+// uses to keep the connection alive during silence (~one every 3 s). The body is chunked
+// transfer encoded; the request never completes until the session is closed.
+export class KasaTalkSession {
+    private request?: ClientRequest;
+    private body = new PassThrough();
+    private playerId = '';
+    private heartbeatTimer?: NodeJS.Timeout;
+    private closed = false;
+    private closeCallbacks?: (() => void)[] = [];
+    // Resolves once the session is torn down (by the caller, by the camera ending the
+    // response, or by an error). Lets the camera's startIntercom await teardown to clean
+    // up its ffmpeg process when the uplink dies on its own.
+    readonly closedPromise: Promise<void>;
+    private resolveClosed!: () => void;
+
+    constructor(public options: KasaTalkOptions) {
+        this.closedPromise = new Promise<void>(resolve => {
+            this.resolveClosed = resolve;
+        });
+    }
+
+    async start(): Promise<void> {
+        this.playerId = generatePlayerId();
+        const port = this.options.port || KASA_TALK_PORT;
+        const auth =
+            'Basic ' + Buffer.from(`${this.options.username}:${md5Hex(this.options.password)}`).toString('base64');
+
+        const search = new URLSearchParams({ playerId: this.playerId });
+
+        const req = https.request({
+            host: this.options.ip,
+            port,
+            method: 'POST',
+            path: `${KASA_TALK_PATH}?${search.toString()}`,
+            rejectUnauthorized: false,
+            headers: {
+                Authorization: auth,
+                'X-APP-ID': this.playerId,
+                'Content-Type': `multipart/x-mixed-replace;boundary=${TALK_BOUNDARY}`,
+                'Transfer-Encoding': 'chunked',
+                Connection: 'keep-alive',
+                Accept: '*/*',
+            },
+        });
+
+        this.request = req;
+
+        req.on('error', e => {
+            // Suppress when the close came first (deliberate teardown via close()): ending
+            // the body mid-flight makes the in-flight HTTPS request emit "socket hang up"
+            // one tick later, which isn't a real error.
+            if (!this.closed) this.options.console?.warn('kasa talk request error', e.message);
+            this.close();
+        });
+
+        req.on('response', res => {
+            this.options.console?.log(`kasa talk response: ${res.statusCode}`);
+            res.on('data', () => {
+                /* drain */
+            });
+            res.on('end', () => this.close());
+        });
+
+        // Body is a PassThrough so we can write parts incrementally; pipe it into the request.
+        this.body.pipe(req);
+
+        // Heartbeat immediately + every 3 s, mirroring the Kasa app's idle pattern.
+        this.writePart('audio/heartbeat', Buffer.alloc(0));
+        this.heartbeatTimer = setInterval(() => {
+            this.writePart('audio/heartbeat', Buffer.alloc(0));
+        }, 3000);
+    }
+
+    // Returns false when the underlying stream is asking for backpressure (Node's standard
+    // contract). Caller should pause its source until `drain` fires on `body`. We surface
+    // this so an unhealthy/slow camera socket can't grow the PassThrough buffer without bound.
+    writeAudio(chunk: Buffer): boolean {
+        if (!chunk.length) return true;
+        return this.writePart('audio/g711u', chunk);
+    }
+
+    onDrain(cb: () => void): void {
+        this.body.once('drain', cb);
+    }
+
+    // Subscribe to the session's teardown event. If the session is already closed, the
+    // callback is invoked on the next microtask so callers don't have to special-case timing.
+    onClose(cb: () => void): void {
+        if (this.closed) {
+            queueMicrotask(cb);
+            return;
+        }
+        this.closeCallbacks!.push(cb);
+    }
+
+    private writePart(contentType: string, body: Buffer): boolean {
+        if (this.closed) return true;
+        const header = `--${TALK_BOUNDARY}\r\nContent-Length: ${body.length}\r\nContent-Type: ${contentType}\r\n\r\n`;
+        // Only the last write's return value matters for backpressure — if any of these
+        // fills the buffer, Node will emit `drain` after the buffer empties.
+        this.body.write(header);
+        if (body.length) this.body.write(body);
+        return this.body.write('\r\n');
+    }
+
+    close(): void {
+        if (this.closed) return;
+        this.closed = true;
+        clearInterval(this.heartbeatTimer);
+        try {
+            this.body.end();
+        } catch {}
+        try {
+            this.request?.end();
+        } catch {}
+        const cbs = this.closeCallbacks;
+        // Drop the array reference before invoking callbacks so V8 can reclaim it; any
+        // late onClose() registration after this point will be served via queueMicrotask.
+        this.closeCallbacks = undefined;
+        if (cbs) {
+            for (const cb of cbs) {
+                try {
+                    cb();
+                } catch (e) {
+                    this.options.console?.warn('kasa talk onClose handler threw', e);
+                }
+            }
+        }
+        this.resolveClosed();
+    }
+}

package/src/camera/linkie.ts

@@ -0,0 +1,185 @@
+import crypto from 'crypto';
+import https from 'https';
+import { xorDecryptInPlace, xorEncryptInPlace } from '../shared/cipher';
+
+export const KASA_LINKIE_PORT = 10443;
+const KASA_LINKIE_PATH = '/data/LINKIE2.json';
+const KASA_LINKIE_TIMEOUT_MS = 5000;
+
+// Same auth quirk as the talk channel: the camera wants md5_hex(plaintext) as the password.
+// (The receive endpoint takes base64(plaintext) instead — same camera, three different
+// places, three subtly different conventions.)
+function md5Hex(plaintext: string): string {
+    return crypto.createHash('md5').update(plaintext, 'utf8').digest('hex');
+}
+
+export interface KasaLinkieOptions {
+    ip: string;
+    port?: number;
+    username: string;
+    password: string;
+}
+
+export interface KasaLinkieClientLogger {
+    warn?: Console['warn'];
+}
+
+// Speaks the Kasa "LINKIE2" control protocol used by the iOS app for everything that isn't
+// streaming or talk: spotlight, siren, mic config, SD card status, etc. Wire format:
+//   - HTTPS POST to https://<ip>:10443/data/LINKIE2.json
+//   - Body: application/x-www-form-urlencoded `content=<base64(xor_ab(json))>`
+//   - Each request body adds a `context.source` UUID — the camera ignores it but the field
+//     is always present in captures, so we generate one per call.
+//   - Response: same encoding, with the result merged under the same module/method keys.
+export class KasaLinkieClient {
+    constructor(
+        public options: KasaLinkieOptions,
+        public logger?: KasaLinkieClientLogger,
+    ) {}
+
+    async call(command: Record<string, any>): Promise<any> {
+        const body = {
+            ...command,
+            context: { source: crypto.randomUUID() },
+        };
+        const json = JSON.stringify(body);
+        // Encrypt in-place: the Buffer.from we just allocated isn't shared anywhere else.
+        const encrypted = xorEncryptInPlace(Buffer.from(json, 'utf8'));
+        const formBody = Buffer.from(`content=${encodeURIComponent(encrypted.toString('base64'))}`);
+
+        // Send Basic auth pre-emptively. The camera does not respond at all to unauthenticated
+        // requests (no 401, no anything), so the standard "wait for challenge then retry"
+        // pattern would just hang. Pre-emptive auth matches what curl with `-u` does.
+        const auth =
+            'Basic ' + Buffer.from(`${this.options.username}:${md5Hex(this.options.password)}`).toString('base64');
+
+        const respBuffer = await new Promise<Buffer>((resolve, reject) => {
+            const req = https.request(
+                {
+                    host: this.options.ip,
+                    port: this.options.port || KASA_LINKIE_PORT,
+                    method: 'POST',
+                    path: KASA_LINKIE_PATH,
+                    rejectUnauthorized: false,
+                    // Mirror the Kasa iOS app's headers — the camera gates /data/LINKIE2.json on the
+                    // User-Agent (silently drops requests that don't look like the Kasa app).
+                    headers: {
+                        Authorization: auth,
+                        'Content-Type': 'application/x-www-form-urlencoded; charset=utf-8',
+                        'Content-Length': formBody.length,
+                        'User-Agent': 'Kasa/1752 CFNetwork/3860.500.112 Darwin/25.4.0',
+                        Accept: '*/*',
+                        'Accept-Language': 'en-US,en;q=0.9',
+                        // We don't decompress responses (camera never sends compressed today, but
+                        // advertising 'gzip' would let a future firmware break our base64+XOR decode).
+                        'Accept-Encoding': 'identity',
+                        Connection: 'keep-alive',
+                    },
+                },
+                res => {
+                    if (res.statusCode && res.statusCode >= 400) {
+                        res.resume();
+                        reject(new Error(`kasa linkie HTTP ${res.statusCode}`));
+                        return;
+                    }
+                    const chunks: Buffer[] = [];
+                    res.on('data', c => chunks.push(c));
+                    res.on('end', () => resolve(Buffer.concat(chunks)));
+                    res.on('error', reject);
+                },
+            );
+            req.setTimeout(KASA_LINKIE_TIMEOUT_MS, () => {
+                req.destroy(new Error(`kasa linkie request timeout after ${KASA_LINKIE_TIMEOUT_MS}ms`));
+            });
+            req.on('error', reject);
+            req.write(formBody);
+            req.end();
+        });
+
+        const respB64 = respBuffer.toString('utf8').trim();
+        // Same here: the base64-decoded buffer is freshly ours, decrypt in-place.
+        const respDecrypted = xorDecryptInPlace(Buffer.from(respB64, 'base64'));
+        return JSON.parse(respDecrypted.toString('utf8'));
+    }
+
+    // Spotlight controls under smartlife.cam.ipcamera.dayNight (called "force_lamp" at the
+    // protocol level, "spotlight" in the Kasa app UI).
+    // Returns 'on' / 'off' for cameras that support it, undefined for cameras that don't
+    // (request fails or the module is missing from the response).
+
+    async getForceLampState(): Promise<'on' | 'off' | undefined> {
+        try {
+            const r = await this.call({
+                'smartlife.cam.ipcamera.dayNight': { get_force_lamp_state: {} },
+            });
+            const v = r?.['smartlife.cam.ipcamera.dayNight']?.get_force_lamp_state?.value;
+            return v === 'on' || v === 'off' ? v : undefined;
+        } catch (e) {
+            this.logger?.warn?.('kasa linkie get_force_lamp_state failed:', (e as Error).message);
+            return undefined;
+        }
+    }
+
+    async setForceLampState(on: boolean): Promise<void> {
+        const r = await this.call({
+            'smartlife.cam.ipcamera.dayNight': {
+                set_force_lamp_state: { value: on ? 'on' : 'off' },
+            },
+        });
+        const errCode = r?.['smartlife.cam.ipcamera.dayNight']?.set_force_lamp_state?.err_code;
+        if (errCode !== 0) throw new Error(`set_force_lamp_state err_code=${errCode}`);
+    }
+
+    // Status LED on the camera body, controlled via smartlife.cam.ipcamera.led. Used to
+    // back HomeKit's CameraOperatingModeIndicator characteristic via OnOff on the camera.
+
+    async getLedStatus(): Promise<'on' | 'off' | undefined> {
+        try {
+            const r = await this.call({
+                'smartlife.cam.ipcamera.led': { get_status: {} },
+            });
+            const v = r?.['smartlife.cam.ipcamera.led']?.get_status?.value;
+            return v === 'on' || v === 'off' ? v : undefined;
+        } catch (e) {
+            this.logger?.warn?.('kasa linkie get_status (led) failed:', (e as Error).message);
+            return undefined;
+        }
+    }
+
+    async setLedStatus(on: boolean): Promise<void> {
+        const r = await this.call({
+            'smartlife.cam.ipcamera.led': {
+                set_status: { value: on ? 'on' : 'off' },
+            },
+        });
+        const errCode = r?.['smartlife.cam.ipcamera.led']?.set_status?.err_code;
+        if (errCode !== 0) throw new Error(`led set_status err_code=${errCode}`);
+    }
+
+    // Siren under smartlife.cam.ipcamera.siren. The camera auto-stops after the duration
+    // configured in the Kasa app (default 30 s); we just send on/off and let the camera
+    // handle the timer.
+
+    async getSirenState(): Promise<'on' | 'off' | undefined> {
+        try {
+            const r = await this.call({
+                'smartlife.cam.ipcamera.siren': { get_state: {} },
+            });
+            const v = r?.['smartlife.cam.ipcamera.siren']?.get_state?.value;
+            return v === 'on' || v === 'off' ? v : undefined;
+        } catch (e) {
+            this.logger?.warn?.('kasa linkie get_state (siren) failed:', (e as Error).message);
+            return undefined;
+        }
+    }
+
+    async setSirenState(on: boolean): Promise<void> {
+        const r = await this.call({
+            'smartlife.cam.ipcamera.siren': {
+                set_state: { value: on ? 'on' : 'off' },
+            },
+        });
+        const errCode = r?.['smartlife.cam.ipcamera.siren']?.set_state?.err_code;
+        if (errCode !== 0) throw new Error(`siren set_state err_code=${errCode}`);
+    }
+}