@mega-yfue/eufy-sdk 0.5.0-beta.50 → 0.5.0-beta.51

package/dist/index.js

@@ -25210,7 +25210,7 @@ var MqttCommandRouter = class _MqttCommandRouter {
 
 // dist/transport/tuya/account.js
 import { createCipheriv as createCipheriv5 } from "node:crypto";
-var TUYA_USERNAME_PREFIX = "eufyhome-";
+var TUYA_USERNAME_PREFIX = "eh-";
 var TUYA_PASSWORD_KEY = Buffer.from([
   36,
   78,
@@ -25398,10 +25398,13 @@ var StubSigner = class {
   }
 };
 var TUYA_SIGN_K = "com.oceanwing.battery.cam_16:6C:23:45:57:B7:76:CA:D8:AC:94:C9:79:37:9E:48:DF:38:7D:4D:8F:96:A3:43:DF:40:FC:D9:05:BF:F6:86_dn9erpyp7nmeuvah8ktghqsgpay87maa_pt585qhmt75hwcynchnps9dnxh9suhwd";
+function resolveSignKey(override) {
+  return override ?? process.env.TUYA_SIGN_KEY ?? TUYA_SIGN_K;
+}
 var HmacSigner = class {
   key;
   constructor(key) {
-    this.key = key ?? process.env.TUYA_SIGN_KEY ?? TUYA_SIGN_K;
+    this.key = resolveSignKey(key);
   }
   sign(preimage) {
     return createHmac4("sha256", this.key).update(preimage, "utf-8").digest("hex");
@@ -25410,7 +25413,37 @@ var HmacSigner = class {
 var TUYA_CHKEY = "7cbfe6d8";
 
 // dist/transport/tuya/client.js
-import { randomBytes as randomBytes4, createHash as createHash6, createPublicKey, publicEncrypt, constants as constants2 } from "node:crypto";
+import { randomBytes as randomBytes5, createHash as createHash6, createPublicKey, publicEncrypt, constants as constants2 } from "node:crypto";
+
+// dist/transport/tuya/et3.js
+import { createCipheriv as createCipheriv6, createDecipheriv as createDecipheriv8, createHmac as createHmac5, randomBytes as randomBytes4 } from "node:crypto";
+import { gunzipSync } from "node:zlib";
+function deriveBodyKey(requestId, ecode) {
+  const k = resolveSignKey();
+  const msg = ecode === null ? k : `${k}_${ecode}`;
+  const hex = createHmac5("sha256", requestId).update(msg, "utf-8").digest("hex");
+  return Buffer.from(hex.slice(0, 16), "ascii");
+}
+function encryptBody2(key, json) {
+  const nonce = randomBytes4(12);
+  const cipher = createCipheriv6("aes-128-gcm", key, nonce);
+  const ciphertext = Buffer.concat([cipher.update(Buffer.from(json, "utf-8")), cipher.final()]);
+  return Buffer.concat([nonce, ciphertext, cipher.getAuthTag()]).toString("base64");
+}
+function decryptReply(key, resultB64) {
+  const blob = Buffer.from(resultB64, "base64");
+  if (blob.length < 12 + 16) {
+    throw new Error("tuya et=3 reply too short to hold a 12-byte nonce + 16-byte tag");
+  }
+  const nonce = blob.subarray(0, 12);
+  const tag2 = blob.subarray(blob.length - 16);
+  const ciphertext = blob.subarray(12, blob.length - 16);
+  const decipher = createDecipheriv8("aes-128-gcm", key, nonce);
+  decipher.setAuthTag(tag2);
+  const plain = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+  const text2 = plain.length >= 2 && plain[0] === 31 && plain[1] === 139 ? gunzipSync(plain) : plain;
+  return text2.toString("utf-8");
+}
 
 // dist/transport/tuya/request.js
 import { randomUUID as randomUUID4 } from "node:crypto";
@@ -25465,8 +25498,9 @@ function buildApiParams(action, opts) {
     nd: env.nd,
     deviceCoreVersion: env.deviceCoreVersion
   };
-  if (action.postData !== void 0)
-    params.postData = action.postData;
+  if (action.postData !== void 0) {
+    params.postData = env.et === "3" ? encryptBody2(deriveBodyKey(params.requestId, opts.session.ecode ?? null), action.postData) : action.postData;
+  }
   const sign = opts.signer.sign(buildSignPreimage(params));
   return { ...params, sign };
 }
@@ -25486,14 +25520,14 @@ async function sendApiRequest(params, opts = {}) {
 }
 function buildPublishDpsAction(devId, gwId, dps) {
   return {
-    a: "thing.m.device.dp.publish",
+    a: "smartlife.m.device.dp.publish",
     v: "2.0",
     postData: JSON.stringify({ gwId, devId, dps: JSON.stringify(dps) })
   };
 }
 function buildGetDeviceDpsAction(devId, dpCacheType = 1) {
   return {
-    a: "thing.m.device.cache.dp.get",
+    a: "smartlife.m.device.cache.dp.get",
     v: "2.0",
     postData: JSON.stringify({ devId, dpCacheType })
   };
@@ -25509,7 +25543,15 @@ function buildPasswordLoginRegAction(countryCode, uid, passwd, token) {
   return {
     a: "smartlife.m.user.uid.password.login.reg",
     v: "1.0",
-    postData: JSON.stringify({ countryCode, uid, passwd, token, ifencrypt: 1, createGroup: true })
+    postData: JSON.stringify({
+      countryCode,
+      uid,
+      passwd,
+      token,
+      ifencrypt: 1,
+      createGroup: true,
+      options: '{"group": 1}'
+    })
   };
 }
 function buildUidTokenCreateAction(countryCode, uid) {
@@ -25522,7 +25564,7 @@ function buildUidTokenCreateAction(countryCode, uid) {
 
 // dist/transport/tuya/client.js
 function genDeviceId() {
-  return randomBytes4(22).toString("hex");
+  return randomBytes5(22).toString("hex");
 }
 function rsaEncryptPassword(password, publicKeyDecimal, exponentDecimal) {
   const bigintToBuffer = (n) => {
@@ -25572,9 +25614,29 @@ var TuyaClient = class {
   buildRequest(action) {
     return buildApiParams(action, { session: this.session, signer: this.signer, env: this.env });
   }
-  /** Build + POST an action, returning the parsed envelope. Requires a working signer. */
+  /**
+   * Build + POST an action, returning the parsed envelope. Requires a working signer.
+   *
+   * On an `et=3` reply the envelope's `result` is a base64 AES-128-GCM blob, not an object; this
+   * decrypts it (keyed off the request's `requestId` and the session's `ecode`) and returns the
+   * decrypted inner envelope, so callers read `result` as an object regardless. A non-string `result`
+   * (an error, or an already-plain reply) passes through untouched.
+   */
   async call(action) {
-    return sendApiRequest(this.buildRequest(action), { endpoint: this.endpoint, http: this.http });
+    const params = this.buildRequest(action);
+    const env = await sendApiRequest(params, { endpoint: this.endpoint, http: this.http });
+    return this.decodeReply(env, params.requestId);
+  }
+  /**
+   * Decode an et=3 reply. When `result` is a non-empty string it is the encrypted blob: decrypt and
+   * parse it (a wrong key or tampered blob fails the GCM tag in {@link decryptReply} and throws). The
+   * plaintext is itself the standard `{success, t, result}` envelope, which becomes the returned one.
+   */
+  decodeReply(env, requestId) {
+    if (typeof env.result !== "string" || env.result === "")
+      return env;
+    const key = deriveBodyKey(requestId, this.session.ecode ?? null);
+    return JSON.parse(decryptReply(key, env.result));
   }
   /**
    * Log into the Tuya cloud from a eufy user id (wire-confirmed from the eufy Security app).
@@ -25607,7 +25669,7 @@ var TuyaClient = class {
       const encPasswd = rsaEncryptPassword(password, publicKey, exponent);
       const loginRes = await this.call(buildPasswordLoginRegAction(account.countryCode, account.username, encPasswd, token));
       if (loginRes.success && loginRes.result?.sid && loginRes.result?.uid) {
-        return { sid: loginRes.result.sid, uid: loginRes.result.uid };
+        return { sid: loginRes.result.sid, uid: loginRes.result.uid, ecode: loginRes.result.ecode };
       }
       if ((loginRes.errorCode ?? loginRes.errorMsg) === "USER_PASSWD_WRONG")
         return "PASSWD_WRONG";
@@ -25619,18 +25681,18 @@ var TuyaClient = class {
     if (result === "PASSWD_WRONG") {
       throw new Error("tuya login: USER_PASSWD_WRONG on both derived password and fallback '12345678'");
     }
-    this.session = { ...this.session, sid: result.sid };
-    return result;
+    this.session = { ...this.session, sid: result.sid, ecode: result.ecode };
+    return { sid: result.sid, uid: result.uid };
   }
   /**
-   * READ/dump a device's cached data-points (`thing.m.device.cache.dp.get`).
+   * READ/dump a device's cached data-points (`smartlife.m.device.cache.dp.get`).
    * Builds the request without needing a working signer; the signer is only exercised on send.
    */
   async getDeviceDps(devId, dpCacheType) {
     return this.call(buildGetDeviceDpsAction(devId, dpCacheType));
   }
   /**
-   * CONTROL: publish data-points to a device (`thing.m.device.dp.publish`). `dps` is
+   * CONTROL: publish data-points to a device (`smartlife.m.device.dp.publish`). `dps` is
    * `{ "<dpId>": <value> }`. `gwId` is the gateway/parent id (equals `devId` for a standalone gw).
    *
    * ⚠️ UNVERIFIED write — refuses to send by default. The `dp.publish` param shape
@@ -25769,7 +25831,7 @@ var TuyaCommandRouter = class {
     return this.loginOnce;
   }
   /**
-   * Fetch a device's cached DPs from the Tuya cloud (`thing.m.device.cache.dp.get`) and deliver
+   * Fetch a device's cached DPs from the Tuya cloud (`smartlife.m.device.cache.dp.get`) and deliver
    * the raw DP map to the caller. Used for initial state hydration after MQTT subscribe — gets the
    * last-known state without waiting for the first realtime push.
    *
@@ -26647,7 +26709,7 @@ var PushClient = class _PushClient extends EventEmitter12 {
 };
 
 // dist/transport/push/fcm.js
-import { randomBytes as randomBytes5 } from "node:crypto";
+import { randomBytes as randomBytes6 } from "node:crypto";
 import { setTimeout as sleep3 } from "node:timers/promises";
 var FCM = {
   PROJECT_ID: "batterycam-3250a",
@@ -26660,7 +26722,7 @@ var FCM = {
   SDK_VERSION: "a:16.3.1"
 };
 function generateFid() {
-  const b = randomBytes5(17);
+  const b = randomBytes6(17);
   b[0] = 112 + b[0] % 16;
   return b.toString("base64url").slice(0, 22);
 }
@@ -30787,6 +30849,7 @@ __export(tuya_exports, {
   genDeviceId: () => genDeviceId,
   isoToDialCode: () => isoToDialCode,
   resolveCountryCode: () => resolveCountryCode,
+  resolveSignKey: () => resolveSignKey,
   sendApiRequest: () => sendApiRequest,
   swapMd5: () => swapMd5,
   tuyaUsername: () => tuyaUsername