@apocaliss92/nodedreame 1.3.0 → 1.4.0

package/dist/index.cjs

@@ -69,7 +69,7 @@ module.exports = __toCommonJS(index_exports);
 
 // src/support/version.ts
 var LIBRARY_NAME = "nodedreame";
-var LIBRARY_VERSION = "1.3.0";
+var LIBRARY_VERSION = "1.3.1";
 
 // src/transport/errors.ts
 var DreameError = class extends Error {
@@ -1221,7 +1221,14 @@ var VACUUM_PROP = {
   /** VERIFIED r2532a 2026-05-03 — task progress percentage 0..100. */
   TASK_PROGRESS_PCT: { siid: 4, piid: 63 },
   /** VERIFIED r2532a — mop-drying progress (minutes ticking during MopDrying). */
-  DRYING_PROGRESS: { siid: 4, piid: 64 }
+  DRYING_PROGRESS: { siid: 4, piid: 64 },
+  /**
+   * Map "PATH" push — the OSS object name of the latest map frame the robot
+   * uploaded (the value passed to {@link VacuumDevice.getMap}). Arrives via the
+   * MQTT push during/after cleaning; NOT in `DEFAULT_PROPS` because it is not
+   * polled (it is pushed). Read it through {@link VacuumDevice.mapFilename}.
+   */
+  MAP_PATH: { siid: 6, piid: 3 }
 };
 var VACUUM_ACTION = {
   /** ASSUMED Tasshack — start cleaning. */
@@ -2877,6 +2884,30 @@ var VacuumDevice = class _VacuumDevice extends BaseDevice {
   get lastMap() {
     return this.#lastMap;
   }
+  /**
+   * The OSS object name of the latest map frame the robot advertised via its
+   * PATH push (siid 6 piid 3), or `null` when none has been observed yet (the
+   * robot has not uploaded a map since connect). This is the `filename` to pass
+   * to {@link getMap} — or just call {@link fetchLatestMap}.
+   */
+  get mapFilename() {
+    const v = this.getProperty(VACUUM_PROP.MAP_PATH.siid, VACUUM_PROP.MAP_PATH.piid)?.value;
+    return typeof v === "string" && v.length > 0 ? v : null;
+  }
+  /**
+   * Convenience: fetch + decode the LATEST map frame the robot advertised,
+   * reading {@link mapFilename} and delegating to {@link getMap}. Returns `null`
+   * when no map filename has been observed yet (vs throwing) so a consumer can
+   * poll it safely; once a filename is present it behaves exactly like
+   * {@link getMap} (capability-gated on `canMap`, caches {@link lastMap}, emits
+   * `'map'`). The `fetcher`/`key`/`iv`/`host`/`timeoutMs`/`signal` overrides are
+   * forwarded verbatim.
+   */
+  async fetchLatestMap(opts = {}) {
+    const filename = this.mapFilename;
+    if (filename === null) return null;
+    return this.getMap({ filename, ...opts });
+  }
   /**
    * The current room/segment id, derived from the most-recently-decoded map's
    * active-segment set (`sa`). `null` when no map has been fetched or no
@@ -4158,6 +4189,10 @@ var REDACTED = "[redacted]";
 var SENSITIVE_KEY_FRAGMENTS = [
   // identity / secrets
   "did",
+  // `deviceid` is listed explicitly: the bare `did` fragment does NOT match
+  // `deviceid` (the substring `did` is absent from `d-e-v-i-c-e-i-d`), yet
+  // base-device sets the real `did` as `deviceId` on raw payloads (FIX 1).
+  "deviceid",
   "uid",
   "token",
   // accessToken, refreshToken, refresh_token, token_type stripped too (safe)
@@ -4196,14 +4231,24 @@ var SENSITIVE_KEY_FRAGMENTS = [
   "areaname",
   "segmentname",
   "segment_name",
+  // room/zone/map names are user-set PII (FIX 3).
+  "zone_name",
+  "zonename",
+  "map_name",
+  "mapname",
   // map binary / geometry (location-revealing)
   "map_info",
   "mapinfo",
   "mapblob",
   // free-text device names that may carry PII. NOTE: the bare fragment `name` is
   // intentionally NOT listed — it would over-match the catalog's command `name`
-  // field (an enum-derived, non-sensitive label). The specific custom-name
-  // fields below cover every PII-bearing case.
+  // field (an enum-derived, non-sensitive label like `START`). ACCEPTED
+  // TRADE-OFF: a bare `{ name: "..." }` in an event argument is NOT scrubbed by
+  // key. This is mitigated in practice by (a) the value-sanitizer below
+  // (sanitizeStringValue, applied to EVERY string scalar — it catches OSS
+  // paths / URLs / tokens regardless of key), and (b) the specific
+  // customName/deviceName/nickName/zoneName/mapName fragments which cover the
+  // realistic PII-bearing name cases.
   "customname",
   "devicename",
   "nickname"
@@ -4219,6 +4264,21 @@ function isSensitiveKey(key2) {
 function isPlainObject(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
+var RISKY_VALUE_PATTERNS = [
+  /:\/\//,
+  // any URL scheme (https://, mqtts://, …) — signed URLs carry tokens
+  /ali_dreame\//i,
+  // OSS object path embedding uid/did
+  /[A-Za-z0-9_-]{32,}/,
+  // a long opaque token run (base64/hex secrets)
+  /\b(did|uid|token)\s*=/i,
+  // query-param secrets (?did=…&token=…)
+  /access/i
+  // accessKey / access-token / x-access-key style markers
+];
+function sanitizeStringValue(s) {
+  return RISKY_VALUE_PATTERNS.some((re) => re.test(s)) ? REDACTED : s;
+}
 function redact(value) {
   if (Array.isArray(value)) {
     return value.map((v) => redact(v));
@@ -4230,6 +4290,9 @@ function redact(value) {
     }
     return out;
   }
+  if (typeof value === "string") {
+    return sanitizeStringValue(value);
+  }
   return value;
 }