@mega-yfue/eufy-sdk 0.5.0-beta.50 → 0.5.0-beta.52

package/dist/client/eufy-mega.d.ts

@@ -454,8 +454,9 @@ export declare class EufyMega extends EventEmitter {
      *
      * Side-effect: registers `eufy_home_tuya` devices with the Tuya command router so
      * the command dispatcher can resolve a eufy SN → Tuya devId without a separate lookup.
-     * The Tuya id is extracted from the device's raw cloud record (`tuya_uuid`, `tuya_virtual_id`,
-     * `tuya_device_id`, or `virtualId` fields — whichever is non-empty).
+     * The Tuya id is the first non-empty `tuya_uuid`, `tuya_virtual_id`, `tuya_device_id` or
+     * `virtualId` on the raw cloud record, else the device's serial: the app keys its Tuya device by
+     * the eufy device id, and a record that carries none of those fields is read under its serial.
      *
      * A partial cloud outage still resolves, with the devices that answered plus the ones already known — but a
      * session the cloud has rejected REJECTS, with {@link SessionExpiredError}. An empty list would be
@@ -790,6 +791,10 @@ export declare class EufyMega extends EventEmitter {
     /**
      * Subscribe the devices on one credential scope; a failing subscribe is reported, not fatal (one
      * unreachable device must not stop the rest of the roster from coming up).
+     *
+     * A Tuya clean-line device's DPs are also read from the Tuya cloud, whether or not its subscribe
+     * succeeded: the cloud read is a separate plane, and the broker can refuse a subscribe for a device
+     * whose DPs the Tuya cloud still serves.
      */
     private subscribeMqttDevices;
     /**

package/dist/index.js

@@ -25210,7 +25210,7 @@ var MqttCommandRouter = class _MqttCommandRouter {
 
 // dist/transport/tuya/account.js
 import { createCipheriv as createCipheriv5 } from "node:crypto";
-var TUYA_USERNAME_PREFIX = "eufyhome-";
+var TUYA_USERNAME_PREFIX = "eh-";
 var TUYA_PASSWORD_KEY = Buffer.from([
   36,
   78,
@@ -25398,10 +25398,13 @@ var StubSigner = class {
   }
 };
 var TUYA_SIGN_K = "com.oceanwing.battery.cam_16:6C:23:45:57:B7:76:CA:D8:AC:94:C9:79:37:9E:48:DF:38:7D:4D:8F:96:A3:43:DF:40:FC:D9:05:BF:F6:86_dn9erpyp7nmeuvah8ktghqsgpay87maa_pt585qhmt75hwcynchnps9dnxh9suhwd";
+function resolveSignKey(override) {
+  return override ?? process.env.TUYA_SIGN_KEY ?? TUYA_SIGN_K;
+}
 var HmacSigner = class {
   key;
   constructor(key) {
-    this.key = key ?? process.env.TUYA_SIGN_KEY ?? TUYA_SIGN_K;
+    this.key = resolveSignKey(key);
   }
   sign(preimage) {
     return createHmac4("sha256", this.key).update(preimage, "utf-8").digest("hex");
@@ -25410,7 +25413,37 @@ var HmacSigner = class {
 var TUYA_CHKEY = "7cbfe6d8";
 
 // dist/transport/tuya/client.js
-import { randomBytes as randomBytes4, createHash as createHash6, createPublicKey, publicEncrypt, constants as constants2 } from "node:crypto";
+import { randomBytes as randomBytes5, createHash as createHash6, createPublicKey, publicEncrypt, constants as constants2 } from "node:crypto";
+
+// dist/transport/tuya/et3.js
+import { createCipheriv as createCipheriv6, createDecipheriv as createDecipheriv8, createHmac as createHmac5, randomBytes as randomBytes4 } from "node:crypto";
+import { gunzipSync } from "node:zlib";
+function deriveBodyKey(requestId, ecode) {
+  const k = resolveSignKey();
+  const msg = ecode === null ? k : `${k}_${ecode}`;
+  const hex = createHmac5("sha256", requestId).update(msg, "utf-8").digest("hex");
+  return Buffer.from(hex.slice(0, 16), "ascii");
+}
+function encryptBody2(key, json) {
+  const nonce = randomBytes4(12);
+  const cipher = createCipheriv6("aes-128-gcm", key, nonce);
+  const ciphertext = Buffer.concat([cipher.update(Buffer.from(json, "utf-8")), cipher.final()]);
+  return Buffer.concat([nonce, ciphertext, cipher.getAuthTag()]).toString("base64");
+}
+function decryptReply(key, resultB64) {
+  const blob = Buffer.from(resultB64, "base64");
+  if (blob.length < 12 + 16) {
+    throw new Error("tuya et=3 reply too short to hold a 12-byte nonce + 16-byte tag");
+  }
+  const nonce = blob.subarray(0, 12);
+  const tag2 = blob.subarray(blob.length - 16);
+  const ciphertext = blob.subarray(12, blob.length - 16);
+  const decipher = createDecipheriv8("aes-128-gcm", key, nonce);
+  decipher.setAuthTag(tag2);
+  const plain = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+  const text2 = plain.length >= 2 && plain[0] === 31 && plain[1] === 139 ? gunzipSync(plain) : plain;
+  return text2.toString("utf-8");
+}
 
 // dist/transport/tuya/request.js
 import { randomUUID as randomUUID4 } from "node:crypto";
@@ -25465,8 +25498,9 @@ function buildApiParams(action, opts) {
     nd: env.nd,
     deviceCoreVersion: env.deviceCoreVersion
   };
-  if (action.postData !== void 0)
-    params.postData = action.postData;
+  if (action.postData !== void 0) {
+    params.postData = env.et === "3" ? encryptBody2(deriveBodyKey(params.requestId, opts.session.ecode ?? null), action.postData) : action.postData;
+  }
   const sign = opts.signer.sign(buildSignPreimage(params));
   return { ...params, sign };
 }
@@ -25486,16 +25520,16 @@ async function sendApiRequest(params, opts = {}) {
 }
 function buildPublishDpsAction(devId, gwId, dps) {
   return {
-    a: "thing.m.device.dp.publish",
+    a: "smartlife.m.device.dp.publish",
     v: "2.0",
     postData: JSON.stringify({ gwId, devId, dps: JSON.stringify(dps) })
   };
 }
-function buildGetDeviceDpsAction(devId, dpCacheType = 1) {
+function buildGetDeviceDpsAction(devId) {
   return {
-    a: "thing.m.device.cache.dp.get",
-    v: "2.0",
-    postData: JSON.stringify({ devId, dpCacheType })
+    a: "smartlife.m.device.dp.get",
+    v: "1.0",
+    postData: JSON.stringify({ devId })
   };
 }
 function buildUsernameTokenGetAction(countryCode, username) {
@@ -25509,7 +25543,15 @@ function buildPasswordLoginRegAction(countryCode, uid, passwd, token) {
   return {
     a: "smartlife.m.user.uid.password.login.reg",
     v: "1.0",
-    postData: JSON.stringify({ countryCode, uid, passwd, token, ifencrypt: 1, createGroup: true })
+    postData: JSON.stringify({
+      countryCode,
+      uid,
+      passwd,
+      token,
+      ifencrypt: 1,
+      createGroup: true,
+      options: '{"group": 1}'
+    })
   };
 }
 function buildUidTokenCreateAction(countryCode, uid) {
@@ -25522,7 +25564,7 @@ function buildUidTokenCreateAction(countryCode, uid) {
 
 // dist/transport/tuya/client.js
 function genDeviceId() {
-  return randomBytes4(22).toString("hex");
+  return randomBytes5(22).toString("hex");
 }
 function rsaEncryptPassword(password, publicKeyDecimal, exponentDecimal) {
   const bigintToBuffer = (n) => {
@@ -25572,9 +25614,29 @@ var TuyaClient = class {
   buildRequest(action) {
     return buildApiParams(action, { session: this.session, signer: this.signer, env: this.env });
   }
-  /** Build + POST an action, returning the parsed envelope. Requires a working signer. */
+  /**
+   * Build + POST an action, returning the parsed envelope. Requires a working signer.
+   *
+   * On an `et=3` reply the envelope's `result` is a base64 AES-128-GCM blob, not an object; this
+   * decrypts it (keyed off the request's `requestId` and the session's `ecode`) and returns the
+   * decrypted inner envelope, so callers read `result` as an object regardless. A non-string `result`
+   * (an error, or an already-plain reply) passes through untouched.
+   */
   async call(action) {
-    return sendApiRequest(this.buildRequest(action), { endpoint: this.endpoint, http: this.http });
+    const params = this.buildRequest(action);
+    const env = await sendApiRequest(params, { endpoint: this.endpoint, http: this.http });
+    return this.decodeReply(env, params.requestId);
+  }
+  /**
+   * Decode an et=3 reply. When `result` is a non-empty string it is the encrypted blob: decrypt and
+   * parse it (a wrong key or tampered blob fails the GCM tag in {@link decryptReply} and throws). The
+   * plaintext is itself the standard `{success, t, result}` envelope, which becomes the returned one.
+   */
+  decodeReply(env, requestId) {
+    if (typeof env.result !== "string" || env.result === "")
+      return env;
+    const key = deriveBodyKey(requestId, this.session.ecode ?? null);
+    return JSON.parse(decryptReply(key, env.result));
   }
   /**
    * Log into the Tuya cloud from a eufy user id (wire-confirmed from the eufy Security app).
@@ -25607,7 +25669,7 @@ var TuyaClient = class {
       const encPasswd = rsaEncryptPassword(password, publicKey, exponent);
       const loginRes = await this.call(buildPasswordLoginRegAction(account.countryCode, account.username, encPasswd, token));
       if (loginRes.success && loginRes.result?.sid && loginRes.result?.uid) {
-        return { sid: loginRes.result.sid, uid: loginRes.result.uid };
+        return { sid: loginRes.result.sid, uid: loginRes.result.uid, ecode: loginRes.result.ecode };
       }
       if ((loginRes.errorCode ?? loginRes.errorMsg) === "USER_PASSWD_WRONG")
         return "PASSWD_WRONG";
@@ -25619,18 +25681,19 @@ var TuyaClient = class {
     if (result === "PASSWD_WRONG") {
       throw new Error("tuya login: USER_PASSWD_WRONG on both derived password and fallback '12345678'");
     }
-    this.session = { ...this.session, sid: result.sid };
-    return result;
+    this.session = { ...this.session, sid: result.sid, ecode: result.ecode };
+    return { sid: result.sid, uid: result.uid };
   }
   /**
-   * READ/dump a device's cached data-points (`thing.m.device.cache.dp.get`).
-   * Builds the request without needing a working signer; the signer is only exercised on send.
+   * READ a device's current data-points (`smartlife.m.device.dp.get`). The envelope's `result` is a
+   * flat `{ "<dpId>": value }` map. Builds the request without needing a working signer; the signer is
+   * only exercised on send.
    */
-  async getDeviceDps(devId, dpCacheType) {
-    return this.call(buildGetDeviceDpsAction(devId, dpCacheType));
+  async getDeviceDps(devId) {
+    return this.call(buildGetDeviceDpsAction(devId));
   }
   /**
-   * CONTROL: publish data-points to a device (`thing.m.device.dp.publish`). `dps` is
+   * CONTROL: publish data-points to a device (`smartlife.m.device.dp.publish`). `dps` is
    * `{ "<dpId>": <value> }`. `gwId` is the gateway/parent id (equals `devId` for a standalone gw).
    *
    * ⚠️ UNVERIFIED write — refuses to send by default. The `dp.publish` param shape
@@ -25718,9 +25781,9 @@ var TuyaCommandRouter = class {
   /** Promise that resolves once Tuya login has completed. Reset by {@link bind}. */
   loginOnce = null;
   /**
-   * eufy SN → Tuya device ids, populated by the facade via {@link registerDevice}.
-   * The facade extracts the Tuya id from the `raw` device record fields (`tuya_uuid`,
-   * `tuya_virtual_id`, `tuya_device_id`, `virtualId`) and registers it once the device list loads.
+   * eufy SN → Tuya device ids, populated via {@link registerDevice} once the device list loads.
+   * The Tuya id is the record's first non-empty `tuya_uuid` / `tuya_virtual_id` / `tuya_device_id` /
+   * `virtualId`, or the device's serial when the record carries none of them.
    */
   snMap = /* @__PURE__ */ new Map();
   constructor(config = {}) {
@@ -25742,10 +25805,10 @@ var TuyaCommandRouter = class {
     this.loginOnce = null;
   }
   /**
-   * Register a eufy SN → Tuya devId mapping. Called by the facade for each `eufy_home_tuya`
-   * device after the cloud device list loads. The facade extracts the Tuya id from the device's
-   * raw record (`tuya_uuid` / `tuya_virtual_id` / `tuya_device_id` / `virtualId` fields).
-   * `gwId` defaults to `devId` — standalone devices share the two.
+   * Register a eufy SN → Tuya devId mapping for an `eufy_home_tuya` device. `devId` is the record's
+   * first non-empty `tuya_uuid` / `tuya_virtual_id` / `tuya_device_id` / `virtualId`, or the device's
+   * serial when the record carries none of them. `gwId` defaults to `devId` — standalone devices
+   * share the two.
    */
   registerDevice(sn, devId, gwId = devId) {
     this.snMap.set(sn, { devId, gwId });
@@ -25769,13 +25832,9 @@ var TuyaCommandRouter = class {
     return this.loginOnce;
   }
   /**
-   * Fetch a device's cached DPs from the Tuya cloud (`thing.m.device.cache.dp.get`) and deliver
-   * the raw DP map to the caller. Used for initial state hydration after MQTT subscribe — gets the
-   * last-known state without waiting for the first realtime push.
-   *
-   * The response shape from `getDeviceDps` is not yet pinned from a live capture. The defensive
-   * extraction tries both `result.dps` (a nested map) and bare `result` (a flat map), and returns
-   * `null` when neither yields a non-empty record.
+   * Read a device's current DPs from the Tuya cloud (`smartlife.m.device.dp.get`) and answer the DP
+   * map: the reply's flat `result`, kept to integer DP keys with scalar values. Answers `null` for an
+   * unregistered device, a failed reply, or a reply with no DPs.
    */
   async fetchDps(sn) {
     const ids = this.snMap.get(sn);
@@ -25785,12 +25844,8 @@ var TuyaCommandRouter = class {
     const res = await this.client.getDeviceDps(ids.devId);
     if (!res.success || !res.result)
       return null;
-    const nested = res.result.dps;
-    if (nested && typeof nested === "object" && !Array.isArray(nested) && Object.keys(nested).length > 0) {
-      return nested;
-    }
-    const flat = parseTuyaDpEvent(res.result);
-    return flat ? flat : null;
+    const dps = parseTuyaDpEvent(res.result);
+    return dps ? dps : null;
   }
   /**
    * Route an `aiot-dp` {@link Command} to the Tuya REST API.
@@ -25809,7 +25864,7 @@ var TuyaCommandRouter = class {
     await this.ensureLoggedIn();
     const ids = this.snMap.get(sn);
     if (!ids) {
-      throw new Error(`TuyaCommandRouter: no Tuya device id registered for ${sn}. Ensure getDevices() was called and the cloud record includes a tuya_uuid / tuya_virtual_id field.`);
+      throw new Error(`TuyaCommandRouter: no Tuya device id registered for ${sn}. Ensure getDevices() was called; it registers every eufy_home_tuya device under its Tuya id or its serial.`);
     }
     await this.client.publishDps(ids.devId, ids.gwId, { [cmd.dp]: cmd.value }, { allowUnverified: this.allowUnverified });
   }
@@ -26647,7 +26702,7 @@ var PushClient = class _PushClient extends EventEmitter12 {
 };
 
 // dist/transport/push/fcm.js
-import { randomBytes as randomBytes5 } from "node:crypto";
+import { randomBytes as randomBytes6 } from "node:crypto";
 import { setTimeout as sleep3 } from "node:timers/promises";
 var FCM = {
   PROJECT_ID: "batterycam-3250a",
@@ -26660,7 +26715,7 @@ var FCM = {
   SDK_VERSION: "a:16.3.1"
 };
 function generateFid() {
-  const b = randomBytes5(17);
+  const b = randomBytes6(17);
   b[0] = 112 + b[0] % 16;
   return b.toString("base64url").slice(0, 22);
 }
@@ -28617,8 +28672,9 @@ var EufyMega = class extends EventEmitter13 {
    *
    * Side-effect: registers `eufy_home_tuya` devices with the Tuya command router so
    * the command dispatcher can resolve a eufy SN → Tuya devId without a separate lookup.
-   * The Tuya id is extracted from the device's raw cloud record (`tuya_uuid`, `tuya_virtual_id`,
-   * `tuya_device_id`, or `virtualId` fields — whichever is non-empty).
+   * The Tuya id is the first non-empty `tuya_uuid`, `tuya_virtual_id`, `tuya_device_id` or
+   * `virtualId` on the raw cloud record, else the device's serial: the app keys its Tuya device by
+   * the eufy device id, and a record that carries none of those fields is read under its serial.
    *
    * A partial cloud outage still resolves, with the devices that answered plus the ones already known — but a
    * session the cloud has rejected REJECTS, with {@link SessionExpiredError}. An empty list would be
@@ -28630,9 +28686,7 @@ var EufyMega = class extends EventEmitter13 {
       if (dev.category !== "eufy_home_tuya")
         continue;
       const raw = dev.raw ?? {};
-      const devId = tuyaDevIdFrom(raw);
-      if (devId)
-        this.tuya.registerDevice(dev.sn, devId);
+      this.tuya.registerDevice(dev.sn, tuyaDevIdFrom(raw) ?? dev.sn);
     }
     return devices;
   }
@@ -29300,21 +29354,25 @@ var EufyMega = class extends EventEmitter13 {
   /**
    * Subscribe the devices on one credential scope; a failing subscribe is reported, not fatal (one
    * unreachable device must not stop the rest of the roster from coming up).
+   *
+   * A Tuya clean-line device's DPs are also read from the Tuya cloud, whether or not its subscribe
+   * succeeded: the cloud read is a separate plane, and the broker can refuse a subscribe for a device
+   * whose DPs the Tuya cloud still serves.
    */
   async subscribeMqttDevices(scope, transport) {
     for (const d of this.getMqttDevices().filter((dev) => mqttScopeFor(dev) === scope)) {
       try {
         await transport.subscribeDevice(d);
         await this.sendRealtimeInit(d.sn);
-        if (d.category === "eufy_home_tuya") {
-          this.tuya.fetchDps(d.sn).then((dps) => {
-            if (dps)
-              this.tuyaDpRouter.deliver(d.sn, dps);
-          }).catch((e) => this.reportError(e));
-        }
       } catch (e) {
         this.reportError(e);
       }
+      if (d.category === "eufy_home_tuya") {
+        this.tuya.fetchDps(d.sn).then((dps) => {
+          if (dps)
+            this.tuyaDpRouter.deliver(d.sn, dps);
+        }).catch((e) => this.reportError(e));
+      }
     }
   }
   /**
@@ -30787,6 +30845,7 @@ __export(tuya_exports, {
   genDeviceId: () => genDeviceId,
   isoToDialCode: () => isoToDialCode,
   resolveCountryCode: () => resolveCountryCode,
+  resolveSignKey: () => resolveSignKey,
   sendApiRequest: () => sendApiRequest,
   swapMd5: () => swapMd5,
   tuyaUsername: () => tuyaUsername