scrypted-kasa 1.3.1 → 1.3.3

package/src/camera/intercom.ts

@@ -1,186 +0,0 @@
-import crypto from 'crypto';
-import { ClientRequest } from 'http';
-import https from 'https';
-import net from 'net';
-import { PassThrough } from 'stream';
-
-export const KASA_TALK_PORT = 18443;
-const KASA_TALK_PATH = '/https/speaker/audio/g711block';
-const TALK_BOUNDARY = 'audio-boundary--';
-
-// Talk-channel auth uses md5(plaintext) as the password rather than the base64(plaintext)
-// the receive stream uses. Same camera, different scheme — observed on KC420WS firmware
-// 2.3.26 via mitmproxy capture of the official Kasa iOS app.
-function md5Hex(plaintext: string): string {
-    return crypto.createHash('md5').update(plaintext, 'utf8').digest('hex');
-}
-
-// The Kasa app sends X-APP-ID/playerId of the form "tty.<32 base64-ish chars>". The token
-// looks app-generated (not negotiated with the camera), so we mint our own per-session.
-function generatePlayerId(): string {
-    return 'tty.' + crypto.randomBytes(24).toString('base64').replace(/[+/=]/g, '').slice(0, 32);
-}
-
-export interface KasaTalkOptions {
-    ip: string;
-    port?: number;
-    username: string;
-    password: string;
-    console?: Console;
-}
-
-// One ongoing POST per talk session. Multipart parts wrap raw G.711 µ-law audio blocks
-// (Content-Type: audio/g711u) interleaved with empty audio/heartbeat parts that the app
-// uses to keep the connection alive during silence (~one every 3 s). The body is chunked
-// transfer encoded; the request never completes until the session is closed.
-export class KasaTalkSession {
-    private request?: ClientRequest;
-    private body = new PassThrough();
-    private playerId = '';
-    private heartbeatTimer?: NodeJS.Timeout;
-    private closed = false;
-    private closeCallbacks?: (() => void)[] = [];
-    // Resolves once the session is torn down (by the caller, by the camera ending the
-    // response, or by an error). Lets the camera's startIntercom await teardown to clean
-    // up its ffmpeg process when the uplink dies on its own.
-    readonly closedPromise: Promise<void>;
-    private resolveClosed!: () => void;
-
-    constructor(public options: KasaTalkOptions) {
-        this.closedPromise = new Promise<void>(resolve => {
-            this.resolveClosed = resolve;
-        });
-    }
-
-    async start(): Promise<void> {
-        this.playerId = generatePlayerId();
-        const port = this.options.port || KASA_TALK_PORT;
-        const auth =
-            'Basic ' + Buffer.from(`${this.options.username}:${md5Hex(this.options.password)}`).toString('base64');
-
-        const search = new URLSearchParams({ playerId: this.playerId });
-
-        const req = https.request({
-            host: this.options.ip,
-            port,
-            method: 'POST',
-            path: `${KASA_TALK_PATH}?${search.toString()}`,
-            rejectUnauthorized: false,
-            headers: {
-                Authorization: auth,
-                'X-APP-ID': this.playerId,
-                'Content-Type': `multipart/x-mixed-replace;boundary=${TALK_BOUNDARY}`,
-                'Transfer-Encoding': 'chunked',
-                Connection: 'keep-alive',
-                Accept: '*/*',
-            },
-        });
-
-        this.request = req;
-
-        // Disable Nagle on the underlying TCP socket as soon as it's available. Each 20 ms
-        // audio part we write is small (~230 B) and fewer than the segment size, so Nagle
-        // would coalesce parts waiting for an ACK or for the 200 ms deadline — adding
-        // user-perceptible chunkiness on top of the inherent network round-trip. The talk
-        // session is a constant low-rate stream, exactly the workload Nagle hurts.
-        //
-        // Cover both timings: the default https.Agent pools connections and may assign a
-        // pooled socket synchronously inside https.request(), in which case `'socket'`
-        // already fired by the time we get here and our once-listener would never run.
-        // Check `req.socket` immediately, and otherwise register a once-listener for the
-        // fresh-connection path.
-        const setSocketNoDelay = (socket: net.Socket) => socket.setNoDelay(true);
-        if (req.socket) setSocketNoDelay(req.socket as net.Socket);
-        else req.once('socket', setSocketNoDelay);
-
-        req.on('error', e => {
-            // Suppress when the close came first (deliberate teardown via close()): ending
-            // the body mid-flight makes the in-flight HTTPS request emit "socket hang up"
-            // one tick later, which isn't a real error.
-            if (!this.closed) this.options.console?.warn('kasa talk request error', e.message);
-            this.close();
-        });
-
-        req.on('response', res => {
-            this.options.console?.log(`kasa talk response: ${res.statusCode}`);
-            res.on('data', () => {
-                /* drain */
-            });
-            res.on('end', () => this.close());
-        });
-
-        // Body is a PassThrough so we can write parts incrementally; pipe it into the request.
-        this.body.pipe(req);
-
-        // Heartbeat immediately + every 3 s, mirroring the Kasa app's idle pattern.
-        this.writePart('audio/heartbeat', Buffer.alloc(0));
-        this.heartbeatTimer = setInterval(() => {
-            this.writePart('audio/heartbeat', Buffer.alloc(0));
-        }, 3000);
-    }
-
-    // Returns false when the underlying stream is asking for backpressure (Node's standard
-    // contract). Caller should pause its source until `drain` fires on `body`. We surface
-    // this so an unhealthy/slow camera socket can't grow the PassThrough buffer without bound.
-    writeAudio(chunk: Buffer): boolean {
-        if (!chunk.length) return true;
-        return this.writePart('audio/g711u', chunk);
-    }
-
-    onDrain(cb: () => void): void {
-        this.body.once('drain', cb);
-    }
-
-    // Subscribe to the session's teardown event. If the session is already closed, the
-    // callback is invoked on the next microtask so callers don't have to special-case timing.
-    onClose(cb: () => void): void {
-        if (this.closed) {
-            queueMicrotask(cb);
-            return;
-        }
-        this.closeCallbacks!.push(cb);
-    }
-
-    private writePart(contentType: string, body: Buffer): boolean {
-        if (this.closed) return true;
-        const header = Buffer.from(
-            `--${TALK_BOUNDARY}\r\nContent-Length: ${body.length}\r\nContent-Type: ${contentType}\r\n\r\n`,
-        );
-        // Concat header + body + CRLF into one write. Three separate writes would each
-        // become its own chunked-encoding chunk on the HTTP body and (worse) its own TLS
-        // record + TCP segment. Cameras and Node's HTTP/TLS stack both prefer one part
-        // arriving as one segment — fewer per-packet ACKs and no risk of the camera
-        // partially parsing a part header before the body lands.
-        const trailer = Buffer.from('\r\n');
-        const out = body.length
-            ? Buffer.concat([header, body, trailer], header.length + body.length + trailer.length)
-            : Buffer.concat([header, trailer], header.length + trailer.length);
-        return this.body.write(out);
-    }
-
-    close(): void {
-        if (this.closed) return;
-        this.closed = true;
-        clearInterval(this.heartbeatTimer);
-        try {
-            this.body.end();
-        } catch {}
-        try {
-            this.request?.end();
-        } catch {}
-        const cbs = this.closeCallbacks;
-        // Drop the array reference before invoking callbacks so V8 can reclaim it; any
-        // late onClose() registration after this point will be served via queueMicrotask.
-        this.closeCallbacks = undefined;
-        if (cbs) {
-            for (const cb of cbs) {
-                try {
-                    cb();
-                } catch (e) {
-                    this.options.console?.warn('kasa talk onClose handler threw', e);
-                }
-            }
-        }
-        this.resolveClosed();
-    }
-}

package/src/camera/linkie.ts

@@ -1,185 +0,0 @@
-import crypto from 'crypto';
-import https from 'https';
-import { xorDecryptInPlace, xorEncryptInPlace } from '../shared/cipher';
-
-export const KASA_LINKIE_PORT = 10443;
-const KASA_LINKIE_PATH = '/data/LINKIE2.json';
-const KASA_LINKIE_TIMEOUT_MS = 5000;
-
-// Same auth quirk as the talk channel: the camera wants md5_hex(plaintext) as the password.
-// (The receive endpoint takes base64(plaintext) instead — same camera, three different
-// places, three subtly different conventions.)
-function md5Hex(plaintext: string): string {
-    return crypto.createHash('md5').update(plaintext, 'utf8').digest('hex');
-}
-
-export interface KasaLinkieOptions {
-    ip: string;
-    port?: number;
-    username: string;
-    password: string;
-}
-
-export interface KasaLinkieClientLogger {
-    warn?: Console['warn'];
-}
-
-// Speaks the Kasa "LINKIE2" control protocol used by the iOS app for everything that isn't
-// streaming or talk: spotlight, siren, mic config, SD card status, etc. Wire format:
-//   - HTTPS POST to https://<ip>:10443/data/LINKIE2.json
-//   - Body: application/x-www-form-urlencoded `content=<base64(xor_ab(json))>`
-//   - Each request body adds a `context.source` UUID — the camera ignores it but the field
-//     is always present in captures, so we generate one per call.
-//   - Response: same encoding, with the result merged under the same module/method keys.
-export class KasaLinkieClient {
-    constructor(
-        public options: KasaLinkieOptions,
-        public logger?: KasaLinkieClientLogger,
-    ) {}
-
-    async call(command: Record<string, any>): Promise<any> {
-        const body = {
-            ...command,
-            context: { source: crypto.randomUUID() },
-        };
-        const json = JSON.stringify(body);
-        // Encrypt in-place: the Buffer.from we just allocated isn't shared anywhere else.
-        const encrypted = xorEncryptInPlace(Buffer.from(json, 'utf8'));
-        const formBody = Buffer.from(`content=${encodeURIComponent(encrypted.toString('base64'))}`);
-
-        // Send Basic auth pre-emptively. The camera does not respond at all to unauthenticated
-        // requests (no 401, no anything), so the standard "wait for challenge then retry"
-        // pattern would just hang. Pre-emptive auth matches what curl with `-u` does.
-        const auth =
-            'Basic ' + Buffer.from(`${this.options.username}:${md5Hex(this.options.password)}`).toString('base64');
-
-        const respBuffer = await new Promise<Buffer>((resolve, reject) => {
-            const req = https.request(
-                {
-                    host: this.options.ip,
-                    port: this.options.port || KASA_LINKIE_PORT,
-                    method: 'POST',
-                    path: KASA_LINKIE_PATH,
-                    rejectUnauthorized: false,
-                    // Mirror the Kasa iOS app's headers — the camera gates /data/LINKIE2.json on the
-                    // User-Agent (silently drops requests that don't look like the Kasa app).
-                    headers: {
-                        Authorization: auth,
-                        'Content-Type': 'application/x-www-form-urlencoded; charset=utf-8',
-                        'Content-Length': formBody.length,
-                        'User-Agent': 'Kasa/1752 CFNetwork/3860.500.112 Darwin/25.4.0',
-                        Accept: '*/*',
-                        'Accept-Language': 'en-US,en;q=0.9',
-                        // We don't decompress responses (camera never sends compressed today, but
-                        // advertising 'gzip' would let a future firmware break our base64+XOR decode).
-                        'Accept-Encoding': 'identity',
-                        Connection: 'keep-alive',
-                    },
-                },
-                res => {
-                    if (res.statusCode && res.statusCode >= 400) {
-                        res.resume();
-                        reject(new Error(`kasa linkie HTTP ${res.statusCode}`));
-                        return;
-                    }
-                    const chunks: Buffer[] = [];
-                    res.on('data', c => chunks.push(c));
-                    res.on('end', () => resolve(Buffer.concat(chunks)));
-                    res.on('error', reject);
-                },
-            );
-            req.setTimeout(KASA_LINKIE_TIMEOUT_MS, () => {
-                req.destroy(new Error(`kasa linkie request timeout after ${KASA_LINKIE_TIMEOUT_MS}ms`));
-            });
-            req.on('error', reject);
-            req.write(formBody);
-            req.end();
-        });
-
-        const respB64 = respBuffer.toString('utf8').trim();
-        // Same here: the base64-decoded buffer is freshly ours, decrypt in-place.
-        const respDecrypted = xorDecryptInPlace(Buffer.from(respB64, 'base64'));
-        return JSON.parse(respDecrypted.toString('utf8'));
-    }
-
-    // Spotlight controls under smartlife.cam.ipcamera.dayNight (called "force_lamp" at the
-    // protocol level, "spotlight" in the Kasa app UI).
-    // Returns 'on' / 'off' for cameras that support it, undefined for cameras that don't
-    // (request fails or the module is missing from the response).
-
-    async getForceLampState(): Promise<'on' | 'off' | undefined> {
-        try {
-            const r = await this.call({
-                'smartlife.cam.ipcamera.dayNight': { get_force_lamp_state: {} },
-            });
-            const v = r?.['smartlife.cam.ipcamera.dayNight']?.get_force_lamp_state?.value;
-            return v === 'on' || v === 'off' ? v : undefined;
-        } catch (e) {
-            this.logger?.warn?.('kasa linkie get_force_lamp_state failed:', (e as Error).message);
-            return undefined;
-        }
-    }
-
-    async setForceLampState(on: boolean): Promise<void> {
-        const r = await this.call({
-            'smartlife.cam.ipcamera.dayNight': {
-                set_force_lamp_state: { value: on ? 'on' : 'off' },
-            },
-        });
-        const errCode = r?.['smartlife.cam.ipcamera.dayNight']?.set_force_lamp_state?.err_code;
-        if (errCode !== 0) throw new Error(`set_force_lamp_state err_code=${errCode}`);
-    }
-
-    // Status LED on the camera body, controlled via smartlife.cam.ipcamera.led. Used to
-    // back HomeKit's CameraOperatingModeIndicator characteristic via OnOff on the camera.
-
-    async getLedStatus(): Promise<'on' | 'off' | undefined> {
-        try {
-            const r = await this.call({
-                'smartlife.cam.ipcamera.led': { get_status: {} },
-            });
-            const v = r?.['smartlife.cam.ipcamera.led']?.get_status?.value;
-            return v === 'on' || v === 'off' ? v : undefined;
-        } catch (e) {
-            this.logger?.warn?.('kasa linkie get_status (led) failed:', (e as Error).message);
-            return undefined;
-        }
-    }
-
-    async setLedStatus(on: boolean): Promise<void> {
-        const r = await this.call({
-            'smartlife.cam.ipcamera.led': {
-                set_status: { value: on ? 'on' : 'off' },
-            },
-        });
-        const errCode = r?.['smartlife.cam.ipcamera.led']?.set_status?.err_code;
-        if (errCode !== 0) throw new Error(`led set_status err_code=${errCode}`);
-    }
-
-    // Siren under smartlife.cam.ipcamera.siren. The camera auto-stops after the duration
-    // configured in the Kasa app (default 30 s); we just send on/off and let the camera
-    // handle the timer.
-
-    async getSirenState(): Promise<'on' | 'off' | undefined> {
-        try {
-            const r = await this.call({
-                'smartlife.cam.ipcamera.siren': { get_state: {} },
-            });
-            const v = r?.['smartlife.cam.ipcamera.siren']?.get_state?.value;
-            return v === 'on' || v === 'off' ? v : undefined;
-        } catch (e) {
-            this.logger?.warn?.('kasa linkie get_state (siren) failed:', (e as Error).message);
-            return undefined;
-        }
-    }
-
-    async setSirenState(on: boolean): Promise<void> {
-        const r = await this.call({
-            'smartlife.cam.ipcamera.siren': {
-                set_state: { value: on ? 'on' : 'off' },
-            },
-        });
-        const errCode = r?.['smartlife.cam.ipcamera.siren']?.set_state?.err_code;
-        if (errCode !== 0) throw new Error(`siren set_state err_code=${errCode}`);
-    }
-}

package/src/camera/rtp.ts

@@ -1,238 +0,0 @@
-import { randomBytes } from 'crypto';
-
-// Native RTP packetization for H.264 (RFC 6184) and G.711 µ-law (RFC 3551). Replaces
-// the ffmpeg subprocess we used purely for codec-copy RTP packetization — the camera
-// already gives us H.264 + G.711, so spawning ffmpeg per stream just to wrap the bytes
-// in RTP headers was waste (one process, two pipes, two UDP socket pairs per camera).
-// This module produces the same wire format consumers already speak.
-
-const RTP_VERSION = 2;
-const RTP_HEADER_LEN = 12;
-export const PT_H264 = 96;
-export const PT_PCMU = 0;
-export const H264_CLOCK_HZ = 90000;
-export const G711_CLOCK_HZ = 8000;
-
-// RTCP Sender Report: 28 bytes, no report blocks (RC=0). RFC 3550 § 6.4.1.
-const RTCP_SR_LEN = 28;
-const RTCP_PT_SR = 200;
-// NTP epoch (1900-01-01) precedes Unix epoch (1970-01-01) by this many seconds.
-const NTP_UNIX_EPOCH_OFFSET_S = 2208988800;
-
-export interface NtpTime {
-    seconds: number;
-    fraction: number;
-}
-
-// Wall-clock as an NTP 64-bit fixed-point timestamp (32-bit seconds since 1900,
-// 32-bit fraction-of-second). Used in RTCP Sender Reports so receivers can map
-// each track's RTP timeline back to a common wall-clock — required for A/V sync
-// across two RTP streams that have independent random initial timestamps.
-export function nowNtp(): NtpTime {
-    const ms = Date.now();
-    const seconds = Math.floor(ms / 1000) + NTP_UNIX_EPOCH_OFFSET_S;
-    // 2^32 / 1000 = 4294967.296 — multiply ms-fraction by that to get the 32-bit
-    // fraction word. Math.floor (not round) so the result is always strictly less
-    // than 2^32; otherwise an unlucky float rounding to exactly 2^32 would wrap to
-    // 0 via `>>> 0` without carrying into `seconds`.
-    const fraction = Math.floor(((ms % 1000) / 1000) * 0x1_0000_0000);
-    return { seconds: seconds >>> 0, fraction: fraction >>> 0 };
-}
-
-function writeSenderReport(
-    ssrc: number,
-    ntp: NtpTime,
-    rtpTimestamp: number,
-    packetCount: number,
-    octetCount: number,
-): Buffer {
-    const buf = Buffer.allocUnsafe(RTCP_SR_LEN);
-    // V=2, P=0, RC=0 → 0b10_0_00000 = 0x80
-    buf[0] = RTP_VERSION << 6;
-    buf[1] = RTCP_PT_SR;
-    // Length in 32-bit words minus 1 → (28/4) - 1 = 6.
-    buf.writeUInt16BE(6, 2);
-    buf.writeUInt32BE(ssrc >>> 0, 4);
-    buf.writeUInt32BE(ntp.seconds >>> 0, 8);
-    buf.writeUInt32BE(ntp.fraction >>> 0, 12);
-    buf.writeUInt32BE(rtpTimestamp >>> 0, 16);
-    buf.writeUInt32BE(packetCount >>> 0, 20);
-    buf.writeUInt32BE(octetCount >>> 0, 24);
-    return buf;
-}
-
-// FU-A fragmentation cutoff. We serve via RTSP/TCP-interleaved (no MTU constraint),
-// but H.264 RTP receivers expect large NAL units to come as FU-A — fragmenting matches
-// the wire shape they would see from any standard RTSP server. 1400 keeps headroom
-// under a 1500-byte Ethernet MTU even though we never hit a real link.
-const RTP_PAYLOAD_MTU = 1400;
-// FU-A header overhead inside the RTP payload: 1 byte FU indicator + 1 byte FU header.
-const FU_A_HEADER_OVERHEAD = 2;
-
-// G.711 µ-law: 8 kHz mono, 1 byte per sample. 20 ms = 160 samples = 160 bytes per RTP
-// packet, the standard sizing in RFC 3551.
-const G711_SAMPLES_PER_PACKET = 160;
-
-function writeRtpHeader(
-    buf: Buffer,
-    payloadType: number,
-    seq: number,
-    timestamp: number,
-    ssrc: number,
-    marker: boolean,
-): void {
-    buf[0] = RTP_VERSION << 6;
-    buf[1] = (marker ? 0x80 : 0) | (payloadType & 0x7f);
-    buf.writeUInt16BE(seq & 0xffff, 2);
-    buf.writeUInt32BE(timestamp >>> 0, 4);
-    buf.writeUInt32BE(ssrc >>> 0, 8);
-}
-
-// Yields each NAL unit body (without the start code) found in an annex-b H.264 buffer.
-// Handles both 3-byte (00 00 01) and 4-byte (00 00 00 01) start codes.
-//
-// Single-pass via Buffer.indexOf — each byte is examined at most once, and the inner
-// scan is in native code (Boyer–Moore-ish), which matters for large IDR access units
-// containing many slice NALs (KC420WS IDRs run 80+ KB across dozens of slices).
-const NAL_START_CODE_3 = Buffer.from([0, 0, 1]);
-export function* annexbNalUnits(annexb: Buffer): IterableIterator<Buffer> {
-    const len = annexb.length;
-    // body offset of the currently-open NAL, or -1 until the first start code is seen.
-    let nalStart = -1;
-    let searchFrom = 0;
-    while (searchFrom < len) {
-        const hit = annexb.indexOf(NAL_START_CODE_3, searchFrom);
-        if (hit < 0) break;
-        // 4-byte form (00 00 00 01) shows up as a 3-byte hit one byte in; treat the
-        // leading 0 as part of the start code so the NAL we're closing ends just before
-        // the full 4-byte sequence.
-        const codeStart = hit > 0 && annexb[hit - 1] === 0 ? hit - 1 : hit;
-        if (nalStart >= 0 && codeStart > nalStart) {
-            // Skip empty NALs (back-to-back start codes) defensively — not valid in a
-            // well-formed bitstream but a malformed part shouldn't poison the stream.
-            yield annexb.subarray(nalStart, codeStart);
-        }
-        nalStart = hit + 3;
-        searchFrom = nalStart;
-    }
-    if (nalStart >= 0 && len > nalStart) yield annexb.subarray(nalStart, len);
-}
-
-export type RtpSink = (packet: Buffer) => void;
-
-// One packetizer per stream session — owns the seq counter and SSRC. RTP requires both
-// to be stable across all packets of a stream, with seq monotonically increasing.
-export class H264RtpPacketizer {
-    private seq: number;
-    private packetCount = 0;
-    private octetCount = 0;
-    private lastTimestamp = 0;
-    readonly ssrc: number;
-
-    constructor() {
-        this.seq = randomBytes(2).readUInt16BE(0);
-        this.ssrc = randomBytes(4).readUInt32BE(0);
-    }
-
-    // Emits RTP packets for one access unit. All packets share `timestamp` (90 kHz),
-    // and the marker bit is set on the last packet of the AU per RFC 6184 § 5.1. Caller
-    // typically passes one annex-b buffer per video part = one AU.
-    packetize(annexb: Buffer, timestamp: number, sink: RtpSink): void {
-        const nals: Buffer[] = [];
-        for (const nal of annexbNalUnits(annexb)) nals.push(nal);
-        if (nals.length === 0) return;
-
-        for (let i = 0; i < nals.length; i++) {
-            const nal = nals[i];
-            const isLastNal = i === nals.length - 1;
-
-            if (nal.length <= RTP_PAYLOAD_MTU) {
-                const pkt = Buffer.allocUnsafe(RTP_HEADER_LEN + nal.length);
-                writeRtpHeader(pkt, PT_H264, this.seq++, timestamp, this.ssrc, isLastNal);
-                nal.copy(pkt, RTP_HEADER_LEN);
-                sink(pkt);
-                this.packetCount++;
-                this.octetCount = (this.octetCount + nal.length) >>> 0;
-                continue;
-            }
-
-            // FU-A: split nal[0]'s F+NRI bits into the FU indicator (with type=28), and
-            // its 5-bit NAL type into the FU header along with start/end markers. The
-            // payload is nal.subarray(1) — the original NAL header byte is reconstructed
-            // by the receiver from FU indicator NRI + FU header type.
-            const nalHeader = nal[0];
-            const fuIndicator = (nalHeader & 0xe0) | 28;
-            const fuTypeBits = nalHeader & 0x1f;
-            const payload = nal.subarray(1);
-            const chunkSize = RTP_PAYLOAD_MTU - FU_A_HEADER_OVERHEAD;
-            let offset = 0;
-            while (offset < payload.length) {
-                const remaining = payload.length - offset;
-                const take = Math.min(chunkSize, remaining);
-                const isFirstFu = offset === 0;
-                const isLastFu = take === remaining;
-                const fuHeader = (isFirstFu ? 0x80 : 0) | (isLastFu ? 0x40 : 0) | fuTypeBits;
-                const pkt = Buffer.allocUnsafe(RTP_HEADER_LEN + FU_A_HEADER_OVERHEAD + take);
-                writeRtpHeader(pkt, PT_H264, this.seq++, timestamp, this.ssrc, isLastNal && isLastFu);
-                pkt[RTP_HEADER_LEN] = fuIndicator;
-                pkt[RTP_HEADER_LEN + 1] = fuHeader;
-                payload.copy(pkt, RTP_HEADER_LEN + FU_A_HEADER_OVERHEAD, offset, offset + take);
-                sink(pkt);
-                this.packetCount++;
-                this.octetCount = (this.octetCount + FU_A_HEADER_OVERHEAD + take) >>> 0;
-                offset += take;
-            }
-        }
-        this.lastTimestamp = timestamp >>> 0;
-    }
-
-    // Build an RTCP Sender Report describing the latest emission. `ntp` should be sampled
-    // close to the moment of the SR's wire emission so the NTP↔RTP timestamp pair stays
-    // accurate. Returns undefined when no packets have been emitted yet — receivers can
-    // tolerate a missing first SR, and emitting one with all zeros confuses jitter math.
-    senderReport(ntp: NtpTime): Buffer | undefined {
-        if (this.packetCount === 0) return;
-        return writeSenderReport(this.ssrc, ntp, this.lastTimestamp, this.packetCount, this.octetCount);
-    }
-}
-
-// G.711 µ-law packetizer — chunks a µ-law byte stream into 20 ms RTP packets. The caller
-// supplies the timestamp of the FIRST sample in `mulaw`; the packetizer advances by
-// sample count internally to keep packet-to-packet timing exact regardless of how the
-// camera batched samples into multipart parts. Returns the next-sample timestamp so the
-// caller can chain across parts if it wants sample-accurate timing.
-export class G711RtpPacketizer {
-    private seq: number;
-    private packetCount = 0;
-    private octetCount = 0;
-    private lastTimestamp = 0;
-    readonly ssrc: number;
-
-    constructor() {
-        this.seq = randomBytes(2).readUInt16BE(0);
-        this.ssrc = randomBytes(4).readUInt32BE(0);
-    }
-
-    packetize(mulaw: Buffer, timestampStart: number, sink: RtpSink): number {
-        let offset = 0;
-        let ts = timestampStart >>> 0;
-        while (offset < mulaw.length) {
-            const take = Math.min(G711_SAMPLES_PER_PACKET, mulaw.length - offset);
-            const pkt = Buffer.allocUnsafe(RTP_HEADER_LEN + take);
-            writeRtpHeader(pkt, PT_PCMU, this.seq++, ts, this.ssrc, false);
-            mulaw.copy(pkt, RTP_HEADER_LEN, offset, offset + take);
-            sink(pkt);
-            this.packetCount++;
-            this.octetCount = (this.octetCount + take) >>> 0;
-            this.lastTimestamp = ts;
-            ts = (ts + take) >>> 0;
-            offset += take;
-        }
-        return ts;
-    }
-
-    senderReport(ntp: NtpTime): Buffer | undefined {
-        if (this.packetCount === 0) return;
-        return writeSenderReport(this.ssrc, ntp, this.lastTimestamp, this.packetCount, this.octetCount);
-    }
-}