@honor-claw/yoyo 1.1.2 → 1.1.4-beta.1

package/src/gateway-client/device/identity.ts

@@ -1,251 +1,251 @@
-import crypto from "node:crypto";
-import fs from "node:fs";
-import path from "node:path";
-import os from "node:os";
-import type { DeviceIdentity } from "./types.js";
-
-type StoredIdentity = {
-  version: 1;
-  deviceId: string;
-  publicKeyPem: string;
-  privateKeyPem: string;
-  createdAtMs: number;
-};
-
-/**
- * Resolve default identity path
- * Uses OS-specific state directory
- */
-function resolveDefaultIdentityPath(): string {
-  const platform = process.platform;
-  let stateDir: string;
-
-  if (platform === "darwin") {
-    stateDir = path.join(os.homedir(), "Library", "Application Support", "xh-gateway-client");
-  } else if (platform === "win32") {
-    stateDir = path.join(os.homedir(), "AppData", "Local", "xh-gateway-client");
-  } else {
-    // Linux and others
-    stateDir = process.env.XDG_STATE_HOME
-      ? path.join(process.env.XDG_STATE_HOME, "xh-gateway-client")
-      : path.join(os.homedir(), ".local", "state", "xh-gateway-client");
-  }
-
-  return path.join(stateDir, "identity", "device.json");
-}
-
-/**
- * Ensure directory exists
- */
-function ensureDir(filePath: string): void {
-  fs.mkdirSync(path.dirname(filePath), { recursive: true });
-}
-
-/**
- * ED25519 SPKI prefix for public key extraction
- */
-const ED25519_SPKI_PREFIX = Buffer.from("302a300506032b6570032100", "hex");
-
-/**
- * Base64 URL encode a buffer
- */
-function base64UrlEncode(buf: Buffer): string {
-  return buf.toString("base64").replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/g, "");
-}
-
-/**
- * Base64 URL decode a string
- */
-function base64UrlDecode(input: string): Buffer {
-  const normalized = input.replaceAll("-", "+").replaceAll("_", "/");
-  const padded = normalized + "=".repeat((4 - (normalized.length % 4)) % 4);
-  return Buffer.from(padded, "base64");
-}
-
-/**
- * Derive raw public key from PEM format
- */
-function derivePublicKeyRaw(publicKeyPem: string): Buffer {
-  const key = crypto.createPublicKey(publicKeyPem);
-  const spki = key.export({ type: "spki", format: "der" }) as Buffer;
-  if (
-    spki.length === ED25519_SPKI_PREFIX.length + 32 &&
-    spki.subarray(0, ED25519_SPKI_PREFIX.length).equals(ED25519_SPKI_PREFIX)
-  ) {
-    return spki.subarray(ED25519_SPKI_PREFIX.length);
-  }
-  return spki;
-}
-
-/**
- * Generate fingerprint from public key
- */
-function fingerprintPublicKey(publicKeyPem: string): string {
-  const raw = derivePublicKeyRaw(publicKeyPem);
-  return crypto.createHash("sha256").update(raw).digest("hex");
-}
-
-/**
- * Generate a new device identity with ED25519 key pair
- */
-function generateIdentity(): DeviceIdentity {
-  const { publicKey, privateKey } = crypto.generateKeyPairSync("ed25519");
-  const publicKeyPem = publicKey.export({ type: "spki", format: "pem" }).toString();
-  const privateKeyPem = privateKey.export({ type: "pkcs8", format: "pem" }).toString();
-  const deviceId = fingerprintPublicKey(publicKeyPem);
-  return { deviceId, publicKeyPem, privateKeyPem };
-}
-
-/**
- * Load or create device identity from file
- * @param filePath - Optional path to identity file (defaults to OS-specific location)
- * @returns Device identity
- */
-export function loadOrCreateDeviceIdentity(
-  filePath: string = resolveDefaultIdentityPath(),
-): DeviceIdentity {
-  try {
-    if (fs.existsSync(filePath)) {
-      const raw = fs.readFileSync(filePath, "utf8");
-      const parsed = JSON.parse(raw) as StoredIdentity;
-      if (
-        parsed?.version === 1 &&
-        typeof parsed.deviceId === "string" &&
-        typeof parsed.publicKeyPem === "string" &&
-        typeof parsed.privateKeyPem === "string"
-      ) {
-        const derivedId = fingerprintPublicKey(parsed.publicKeyPem);
-        if (derivedId && derivedId !== parsed.deviceId) {
-          // Update stored deviceId if it doesn't match fingerprint
-          const updated: StoredIdentity = {
-            ...parsed,
-            deviceId: derivedId,
-          };
-          fs.writeFileSync(filePath, `${JSON.stringify(updated, null, 2)}\n`, { mode: 0o600 });
-          try {
-            fs.chmodSync(filePath, 0o600);
-          } catch {
-            // best-effort
-          }
-          return {
-            deviceId: derivedId,
-            publicKeyPem: parsed.publicKeyPem,
-            privateKeyPem: parsed.privateKeyPem,
-          };
-        }
-        return {
-          deviceId: parsed.deviceId,
-          publicKeyPem: parsed.publicKeyPem,
-          privateKeyPem: parsed.privateKeyPem,
-        };
-      }
-    }
-  } catch {
-    // fall through to regenerate on error
-  }
-
-  // Generate new identity
-  const identity = generateIdentity();
-  ensureDir(filePath);
-  const stored: StoredIdentity = {
-    version: 1,
-    deviceId: identity.deviceId,
-    publicKeyPem: identity.publicKeyPem,
-    privateKeyPem: identity.privateKeyPem,
-    createdAtMs: Date.now(),
-  };
-  fs.writeFileSync(filePath, `${JSON.stringify(stored, null, 2)}\n`, { mode: 0o600 });
-  try {
-    fs.chmodSync(filePath, 0o600);
-  } catch {
-    // best-effort
-  }
-  return identity;
-}
-
-/**
- * Sign a payload using device private key
- * @param privateKeyPem - Private key in PEM format
- * @param payload - Payload string to sign
- * @returns Base64 URL encoded signature
- */
-export function signDevicePayload(privateKeyPem: string, payload: string): string {
-  const key = crypto.createPrivateKey(privateKeyPem);
-  const sig = crypto.sign(null, Buffer.from(payload, "utf8"), key);
-  return base64UrlEncode(sig);
-}
-
-/**
- * Normalize device public key to base64 URL format
- * @param publicKey - Public key in PEM or base64 format
- * @returns Base64 URL encoded public key or null on error
- */
-export function normalizeDevicePublicKeyBase64Url(publicKey: string): string | null {
-  try {
-    if (publicKey.includes("BEGIN")) {
-      return base64UrlEncode(derivePublicKeyRaw(publicKey));
-    }
-    const raw = base64UrlDecode(publicKey);
-    return base64UrlEncode(raw);
-  } catch {
-    return null;
-  }
-}
-
-/**
- * Derive device ID from public key
- * @param publicKey - Public key in PEM or base64 format
- * @returns Device ID (SHA256 hash) or null on error
- */
-export function deriveDeviceIdFromPublicKey(publicKey: string): string | null {
-  try {
-    const raw = publicKey.includes("BEGIN")
-      ? derivePublicKeyRaw(publicKey)
-      : base64UrlDecode(publicKey);
-    return crypto.createHash("sha256").update(raw).digest("hex");
-  } catch {
-    return null;
-  }
-}
-
-/**
- * Convert public key PEM to raw base64 URL format
- * @param publicKeyPem - Public key in PEM format
- * @returns Base64 URL encoded raw public key
- */
-export function publicKeyRawBase64UrlFromPem(publicKeyPem: string): string {
-  return base64UrlEncode(derivePublicKeyRaw(publicKeyPem));
-}
-
-/**
- * Verify device signature
- * @param publicKey - Public key in PEM or base64 format
- * @param payload - Original payload string
- * @param signatureBase64Url - Base64 URL encoded signature
- * @returns True if signature is valid, false otherwise
- */
-export function verifyDeviceSignature(
-  publicKey: string,
-  payload: string,
-  signatureBase64Url: string,
-): boolean {
-  try {
-    const key = publicKey.includes("BEGIN")
-      ? crypto.createPublicKey(publicKey)
-      : crypto.createPublicKey({
-          key: Buffer.concat([ED25519_SPKI_PREFIX, base64UrlDecode(publicKey)]),
-          type: "spki",
-          format: "der",
-        });
-    const sig = (() => {
-      try {
-        return base64UrlDecode(signatureBase64Url);
-      } catch {
-        return Buffer.from(signatureBase64Url, "base64");
-      }
-    })();
-    return crypto.verify(null, Buffer.from(payload, "utf8"), key, sig);
-  } catch {
-    return false;
-  }
-}
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import os from "node:os";
+import type { DeviceIdentity } from "./types.js";
+
+type StoredIdentity = {
+  version: 1;
+  deviceId: string;
+  publicKeyPem: string;
+  privateKeyPem: string;
+  createdAtMs: number;
+};
+
+/**
+ * Resolve default identity path
+ * Uses OS-specific state directory
+ */
+function resolveDefaultIdentityPath(): string {
+  const platform = process.platform;
+  let stateDir: string;
+
+  if (platform === "darwin") {
+    stateDir = path.join(os.homedir(), "Library", "Application Support", "xh-gateway-client");
+  } else if (platform === "win32") {
+    stateDir = path.join(os.homedir(), "AppData", "Local", "xh-gateway-client");
+  } else {
+    // Linux and others
+    stateDir = process.env.XDG_STATE_HOME
+      ? path.join(process.env.XDG_STATE_HOME, "xh-gateway-client")
+      : path.join(os.homedir(), ".local", "state", "xh-gateway-client");
+  }
+
+  return path.join(stateDir, "identity", "device.json");
+}
+
+/**
+ * Ensure directory exists
+ */
+function ensureDir(filePath: string): void {
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+}
+
+/**
+ * ED25519 SPKI prefix for public key extraction
+ */
+const ED25519_SPKI_PREFIX = Buffer.from("302a300506032b6570032100", "hex");
+
+/**
+ * Base64 URL encode a buffer
+ */
+function base64UrlEncode(buf: Buffer): string {
+  return buf.toString("base64").replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/g, "");
+}
+
+/**
+ * Base64 URL decode a string
+ */
+function base64UrlDecode(input: string): Buffer {
+  const normalized = input.replaceAll("-", "+").replaceAll("_", "/");
+  const padded = normalized + "=".repeat((4 - (normalized.length % 4)) % 4);
+  return Buffer.from(padded, "base64");
+}
+
+/**
+ * Derive raw public key from PEM format
+ */
+function derivePublicKeyRaw(publicKeyPem: string): Buffer {
+  const key = crypto.createPublicKey(publicKeyPem);
+  const spki = key.export({ type: "spki", format: "der" }) as Buffer;
+  if (
+    spki.length === ED25519_SPKI_PREFIX.length + 32 &&
+    spki.subarray(0, ED25519_SPKI_PREFIX.length).equals(ED25519_SPKI_PREFIX)
+  ) {
+    return spki.subarray(ED25519_SPKI_PREFIX.length);
+  }
+  return spki;
+}
+
+/**
+ * Generate fingerprint from public key
+ */
+function fingerprintPublicKey(publicKeyPem: string): string {
+  const raw = derivePublicKeyRaw(publicKeyPem);
+  return crypto.createHash("sha256").update(raw).digest("hex");
+}
+
+/**
+ * Generate a new device identity with ED25519 key pair
+ */
+function generateIdentity(): DeviceIdentity {
+  const { publicKey, privateKey } = crypto.generateKeyPairSync("ed25519");
+  const publicKeyPem = publicKey.export({ type: "spki", format: "pem" }).toString();
+  const privateKeyPem = privateKey.export({ type: "pkcs8", format: "pem" }).toString();
+  const deviceId = fingerprintPublicKey(publicKeyPem);
+  return { deviceId, publicKeyPem, privateKeyPem };
+}
+
+/**
+ * Load or create device identity from file
+ * @param filePath - Optional path to identity file (defaults to OS-specific location)
+ * @returns Device identity
+ */
+export function loadOrCreateDeviceIdentity(
+  filePath: string = resolveDefaultIdentityPath(),
+): DeviceIdentity {
+  try {
+    if (fs.existsSync(filePath)) {
+      const raw = fs.readFileSync(filePath, "utf8");
+      const parsed = JSON.parse(raw) as StoredIdentity;
+      if (
+        parsed?.version === 1 &&
+        typeof parsed.deviceId === "string" &&
+        typeof parsed.publicKeyPem === "string" &&
+        typeof parsed.privateKeyPem === "string"
+      ) {
+        const derivedId = fingerprintPublicKey(parsed.publicKeyPem);
+        if (derivedId && derivedId !== parsed.deviceId) {
+          // Update stored deviceId if it doesn't match fingerprint
+          const updated: StoredIdentity = {
+            ...parsed,
+            deviceId: derivedId,
+          };
+          fs.writeFileSync(filePath, `${JSON.stringify(updated, null, 2)}\n`, { mode: 0o600 });
+          try {
+            fs.chmodSync(filePath, 0o600);
+          } catch {
+            // best-effort
+          }
+          return {
+            deviceId: derivedId,
+            publicKeyPem: parsed.publicKeyPem,
+            privateKeyPem: parsed.privateKeyPem,
+          };
+        }
+        return {
+          deviceId: parsed.deviceId,
+          publicKeyPem: parsed.publicKeyPem,
+          privateKeyPem: parsed.privateKeyPem,
+        };
+      }
+    }
+  } catch {
+    // fall through to regenerate on error
+  }
+
+  // Generate new identity
+  const identity = generateIdentity();
+  ensureDir(filePath);
+  const stored: StoredIdentity = {
+    version: 1,
+    deviceId: identity.deviceId,
+    publicKeyPem: identity.publicKeyPem,
+    privateKeyPem: identity.privateKeyPem,
+    createdAtMs: Date.now(),
+  };
+  fs.writeFileSync(filePath, `${JSON.stringify(stored, null, 2)}\n`, { mode: 0o600 });
+  try {
+    fs.chmodSync(filePath, 0o600);
+  } catch {
+    // best-effort
+  }
+  return identity;
+}
+
+/**
+ * Sign a payload using device private key
+ * @param privateKeyPem - Private key in PEM format
+ * @param payload - Payload string to sign
+ * @returns Base64 URL encoded signature
+ */
+export function signDevicePayload(privateKeyPem: string, payload: string): string {
+  const key = crypto.createPrivateKey(privateKeyPem);
+  const sig = crypto.sign(null, Buffer.from(payload, "utf8"), key);
+  return base64UrlEncode(sig);
+}
+
+/**
+ * Normalize device public key to base64 URL format
+ * @param publicKey - Public key in PEM or base64 format
+ * @returns Base64 URL encoded public key or null on error
+ */
+export function normalizeDevicePublicKeyBase64Url(publicKey: string): string | null {
+  try {
+    if (publicKey.includes("BEGIN")) {
+      return base64UrlEncode(derivePublicKeyRaw(publicKey));
+    }
+    const raw = base64UrlDecode(publicKey);
+    return base64UrlEncode(raw);
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Derive device ID from public key
+ * @param publicKey - Public key in PEM or base64 format
+ * @returns Device ID (SHA256 hash) or null on error
+ */
+export function deriveDeviceIdFromPublicKey(publicKey: string): string | null {
+  try {
+    const raw = publicKey.includes("BEGIN")
+      ? derivePublicKeyRaw(publicKey)
+      : base64UrlDecode(publicKey);
+    return crypto.createHash("sha256").update(raw).digest("hex");
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Convert public key PEM to raw base64 URL format
+ * @param publicKeyPem - Public key in PEM format
+ * @returns Base64 URL encoded raw public key
+ */
+export function publicKeyRawBase64UrlFromPem(publicKeyPem: string): string {
+  return base64UrlEncode(derivePublicKeyRaw(publicKeyPem));
+}
+
+/**
+ * Verify device signature
+ * @param publicKey - Public key in PEM or base64 format
+ * @param payload - Original payload string
+ * @param signatureBase64Url - Base64 URL encoded signature
+ * @returns True if signature is valid, false otherwise
+ */
+export function verifyDeviceSignature(
+  publicKey: string,
+  payload: string,
+  signatureBase64Url: string,
+): boolean {
+  try {
+    const key = publicKey.includes("BEGIN")
+      ? crypto.createPublicKey(publicKey)
+      : crypto.createPublicKey({
+          key: Buffer.concat([ED25519_SPKI_PREFIX, base64UrlDecode(publicKey)]),
+          type: "spki",
+          format: "der",
+        });
+    const sig = (() => {
+      try {
+        return base64UrlDecode(signatureBase64Url);
+      } catch {
+        return Buffer.from(signatureBase64Url, "base64");
+      }
+    })();
+    return crypto.verify(null, Buffer.from(payload, "utf8"), key, sig);
+  } catch {
+    return false;
+  }
+}

package/src/gateway-client/device/index.ts

@@ -1,40 +1,40 @@
-/**
- * XH Gateway Client
- *
- * A library for device authentication and gateway connection utilities.
- * Provides device identity management, authentication payload building,
- * and device information generation for OpenClaw gateway connections.
- */
-
-// Types
-export type {
-  DeviceIdentity,
-  DeviceAuthPayloadParams,
-  DeviceAuthPayloadV3Params,
-  DeviceInfo,
-  DeviceBuilderOptions,
-} from "./types.js";
-
-// Device identity management
-export {
-  loadOrCreateDeviceIdentity,
-  signDevicePayload,
-  normalizeDevicePublicKeyBase64Url,
-  deriveDeviceIdFromPublicKey,
-  publicKeyRawBase64UrlFromPem,
-  verifyDeviceSignature,
-} from "./identity.js";
-
-// Device authentication
-export {
-  buildDeviceAuthPayload,
-  buildDeviceAuthPayloadV3,
-  normalizeDeviceMetadataForAuth,
-} from "./auth.js";
-
-// Device builder
-export {
-  buildDeviceInfo,
-  buildNodeDeviceInfo,
-  buildOperatorDeviceInfo,
-} from "./builder.js";
+/**
+ * XH Gateway Client
+ *
+ * A library for device authentication and gateway connection utilities.
+ * Provides device identity management, authentication payload building,
+ * and device information generation for OpenClaw gateway connections.
+ */
+
+// Types
+export type {
+  DeviceIdentity,
+  DeviceAuthPayloadParams,
+  DeviceAuthPayloadV3Params,
+  DeviceInfo,
+  DeviceBuilderOptions,
+} from "./types.js";
+
+// Device identity management
+export {
+  loadOrCreateDeviceIdentity,
+  signDevicePayload,
+  normalizeDevicePublicKeyBase64Url,
+  deriveDeviceIdFromPublicKey,
+  publicKeyRawBase64UrlFromPem,
+  verifyDeviceSignature,
+} from "./identity.js";
+
+// Device authentication
+export {
+  buildDeviceAuthPayload,
+  buildDeviceAuthPayloadV3,
+  normalizeDeviceMetadataForAuth,
+} from "./auth.js";
+
+// Device builder
+export {
+  buildDeviceInfo,
+  buildNodeDeviceInfo,
+  buildOperatorDeviceInfo,
+} from "./builder.js";