@mega-yfue/eufy-sdk 0.0.4 → 0.1.0-beta.0

package/dist/transport/tuya/sign.d.ts

@@ -0,0 +1,64 @@
+/**
+ * Keys that participate in the signature, in no particular order (the preimage builder sorts).
+ * Everything else in the request (bizData, sdkVersion, os-info fields, cp/channel/nd, …) is
+ * DELIBERATELY excluded from the sign. Verified against a live preimage (see the spec test).
+ */
+export declare const SIGN_ALLOWLIST: ReadonlySet<string>;
+/**
+ * The `postData` sign transform: md5 the body to 32 hex chars, then rotate the four 8-char blocks
+ * `[b0 b1 b2 b3]` → `[b1 b0 b3 b2]`. This is the Thingclips SDK 7.5.0 transform; it is applied to
+ * the `postData` value before it is joined into the preimage.
+ *
+ * ✅ Confirmed: the `thing.m.user.uid.token.create` call carries a `postData`, and its
+ * sign (computed over this transform) was accepted by `a1.tuyaeu.com` with no SIGN_INVALID — so a
+ * postData-bearing preimage IS exercised end-to-end. (The static `smartlife.p.time.get` golden vector
+ * separately carries no postData; the two together cover both paths.)
+ */
+export declare function swapMd5(postData: string): string;
+/**
+ * Build the exact sign **preimage** from a request param map. Keeps only allowlisted keys with a
+ * non-empty value, sorts them ascending, and joins `key=value` pairs with `||`. `postData` is
+ * folded via {@link swapMd5} before joining.
+ */
+export declare function buildSignPreimage(params: Readonly<Record<string, string | undefined>>): string;
+/**
+ * The native signing seam. Given the {@link buildSignPreimage} output, return the final `sign`
+ * value (SHA-256-length hex). Implementations mix in the app secret natively.
+ */
+export interface TuyaSigner {
+    sign(preimage: string): string;
+}
+/** Test-only {@link TuyaSigner} that throws on every call. */
+export declare class StubSigner implements TuyaSigner {
+    sign(_preimage: string): string;
+}
+/**
+ * App-wide HMAC-SHA256 signing key **K** (`package_cert_stego_appSecret`), assembled from four
+ * public per-build constants (wire-confirmed from the eufy Security/Mega app + native memory dump):
+ *   - package name: `com.oceanwing.battery.cam`
+ *   - developer signing-cert SHA-256 (colon-hex UPPER, verified from running app memory)
+ *   - stego value: extracted from `libthing_security.so + 0x384f0` (keyed BMP steganography)
+ *   - manifest app secret (also in {@link TUYA_APP_SECRET} in `request.ts`)
+ *
+ * All four components are public per-build constants.
+ * The env var `TUYA_SIGN_KEY` can override this for non-standard builds.
+ */
+export declare const TUYA_SIGN_K: string;
+/**
+ * The real {@link TuyaSigner}: `sign = HMAC-SHA256(K, preimage)` as lowercase hex.
+ *
+ * Uses {@link TUYA_SIGN_K} by default — no configuration required. The env var `TUYA_SIGN_KEY`
+ * overrides the built-in key (for custom builds); an explicit constructor argument takes precedence
+ * over both. Verified: reproduces the captured `smartlife.p.time.get` sign `97a78b35…a7f8c84`.
+ */
+export declare class HmacSigner implements TuyaSigner {
+    private readonly key;
+    constructor(key?: string);
+    sign(preimage: string): string;
+}
+/**
+ * Channel key sent on every request as `chKey`.
+ * Extracted from the eufy Security/Mega app (`com.oceanwing.battery.cam`); present in the sign
+ * preimage — confirmed from the live-captured golden vector (`smartlife.p.time.get`).
+ */
+export declare const TUYA_CHKEY = "7cbfe6d8";

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@mega-yfue/eufy-sdk",
-  "version": "0.0.4",
-  "description": "One typed TypeScript client for the eufy v6 cloud — capability-driven devices, realtime events over P2P/MQTT/push, and live media",
+  "version": "0.1.0-beta.0",
+  "description": "One typed TypeScript client for the Anker eufy v6 cloud — capability-driven devices, realtime events over P2P/MQTT/push, and live media",
   "license": "Apache-2.0",
   "author": "mega-yfue",
   "contributors": [
@@ -11,6 +11,7 @@
   ],
   "keywords": [
     "eufy",
+    "anker-eufy",
     "anker",
     "eufy-security",
     "smart-home",
@@ -49,7 +50,7 @@
   },
   "scripts": {
     "prebuild": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\"",
-    "build": "tsc -p tsconfig.build.json",
+    "build": "tsc -p tsconfig.build.json && node scripts/bundle.mjs",
     "dev": "tsc -p tsconfig.build.json --watch",
     "typecheck": "tsc --noEmit",
     "typecheck:examples": "tsc -p examples/tsconfig.json",
@@ -57,30 +58,28 @@
     "test:watch": "vitest",
     "format": "prettier --write .",
     "format:check": "prettier --check .",
+    "guard:capability-ownership": "bash scripts/ci/guard-capability-ownership.sh",
     "guard:consumer-agnostic": "bash scripts/ci/guard-consumer-agnostic.sh",
     "guard:decorrelation": "bash scripts/ci/guard-decorrelation.sh",
     "guard:docrefs": "bash scripts/ci/guard-doc-refs.sh",
     "guard:lines": "bash scripts/ci/guard-lines.sh",
-    "guard:seal": "bash scripts/ci/guard-seal.sh",
     "check:esm": "node -e \"import('./dist/index.js').then(m=>console.log('ESM OK:',Object.keys(m).length,'exports'))\"",
-    "verify": "npm run format:check && npm run typecheck && npm run guard:decorrelation && npm run guard:lines && npm run guard:docrefs && npm run guard:consumer-agnostic && npm run build && npm run guard:seal && npm run check:esm && npm run typecheck:examples && npm test"
+    "verify": "npm run format:check && npm run typecheck && npm run guard:decorrelation && npm run guard:lines && npm run guard:docrefs && npm run guard:consumer-agnostic && npm run guard:capability-ownership && npm run build && npm run check:esm && npm run typecheck:examples && npm test",
+    "release": "bash scripts/release.sh"
   },
   "engines": {
     "node": ">=24.5.0"
   },
   "dependencies": {
+    "jpeg-js": "^0.4.4",
     "mqtt": "^5.15.2",
-    "protobufjs": "^8.7.1",
-    "werift": "^0.24.2"
+    "protobufjs": "^8.8.0"
   },
   "devDependencies": {
-    "@types/node": "^26.1.2",
+    "@types/node": "^26.5.0",
+    "esbuild": "^0.28.2",
     "prettier": "^3.9.6",
     "typescript": "^7.0.2",
-    "vitest": "^4.1.10"
-  },
-  "allowScripts": {
-    "esbuild@0.28.1": true,
-    "unrs-resolver@1.12.2": true
+    "vitest": "^5.0.0"
   }
 }

package/dist/client/index.js

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=index.js.map

package/dist/client/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":""}

package/dist/core/index.js

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=index.js.map

package/dist/core/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/core/index.ts"],"names":[],"mappings":""}

package/dist/model/index.js

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=index.js.map

package/dist/model/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/model/index.ts"],"names":[],"mappings":""}

package/dist/transport/index.js

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=index.js.map

package/dist/transport/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/transport/index.ts"],"names":[],"mappings":""}