homebridge-dyson-solarcycle-morph 0.1.0

package/dist/cli/pair.js

@@ -0,0 +1,144 @@
+#!/usr/bin/env node
+/**
+ * One-time pairing helper.
+ *
+ * Logs in to the Dyson cloud, fetches the lamp's long-term key, and stores it
+ * where the plugin will find it. After this the plugin never needs network
+ * access again.
+ *
+ * Most people should use the plugin's settings page in the Homebridge UI
+ * instead; this exists for setups without it.
+ *
+ * Usage: dyson-morph-pair [--serial ABC-EU-…] [--country DE] [--culture de-DE]
+ *                        [--email …] [--storage …] [--debug]
+ */
+import { createInterface } from 'node:readline/promises';
+import { stdin, stdout } from 'node:process';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { DysonCloud } from '../dyson/cloud.js';
+import { CredentialStore } from '../dyson/credentials.js';
+import { PLUGIN_NAME } from '../settings.js';
+function parseArgs(argv) {
+    const args = {};
+    for (let i = 0; i < argv.length; i++) {
+        const match = /^--([a-z]+)(?:=(.*))?$/.exec(argv[i]);
+        if (!match) {
+            continue;
+        }
+        const key = match[1];
+        // --debug is a flag, not a value; don't let it swallow the next argument.
+        args[key] = key === 'debug' ? (match[2] ?? 'true') : (match[2] ?? argv[++i]);
+    }
+    return args;
+}
+/**
+ * Prompts the user, or replays piped input.
+ *
+ * Readline hands over every buffered line the moment stdin delivers it, so a
+ * question asked after the first would miss its answer when input is piped.
+ * For non-interactive input we therefore read stdin to EOF up front and answer
+ * from that queue; only a real TTY goes through readline.
+ */
+class Prompter {
+    rl;
+    scripted;
+    constructor(interactive) {
+        this.rl = interactive ? createInterface({ input: stdin, output: stdout }) : undefined;
+    }
+    async ask(query) {
+        if (this.rl) {
+            return this.rl.question(query);
+        }
+        this.scripted ??= await readAllLines();
+        stdout.write(`${query}\n`);
+        return this.scripted.shift() ?? '';
+    }
+    /**
+     * Ask without echoing, so the password stays out of the terminal and its
+     * scrollback. Readline has no masking, so we intercept its output: the
+     * prompt goes through once, the keystrokes echoed after it do not.
+     */
+    async askSecret(query) {
+        if (!this.rl) {
+            return this.ask(query);
+        }
+        const internals = this.rl;
+        const write = internals._writeToOutput;
+        let promptShown = false;
+        internals._writeToOutput = (text) => {
+            if (!promptShown && text.includes(query)) {
+                write.call(this.rl, text);
+                promptShown = true;
+            }
+        };
+        try {
+            return await this.rl.question(query);
+        }
+        finally {
+            internals._writeToOutput = write;
+            stdout.write('\n');
+        }
+    }
+    close() {
+        this.rl?.close();
+    }
+}
+async function readAllLines() {
+    const chunks = [];
+    for await (const chunk of stdin) {
+        chunks.push(chunk);
+    }
+    return Buffer.concat(chunks).toString('utf8').split('\n');
+}
+/** Reject empty answers early rather than sending them to Dyson. */
+function required(value, what) {
+    const trimmed = value.trim();
+    if (!trimmed) {
+        throw new Error(`No ${what} entered.\n\n` +
+            'This tool needs a terminal it can read from. If you started it through an\n' +
+            'editor, agent or CI shell, the prompts appear but your typing never reaches\n' +
+            'it. Run it directly in a terminal instead.');
+    }
+    return trimmed;
+}
+async function main(prompter) {
+    const args = parseArgs(process.argv.slice(2));
+    if (!stdin.isTTY) {
+        console.error('Note: stdin is not a terminal, so answers are being read from piped input.\n');
+    }
+    const country = args.country ?? ((await prompter.ask('Country code [DE]: ')).trim() || 'DE');
+    const culture = args.culture ?? `${country.toLowerCase()}-${country.toUpperCase()}`;
+    const email = required(args.email ?? (await prompter.ask('Dyson account email: ')), 'email address');
+    const password = required(await prompter.askSecret('Dyson account password: '), 'password');
+    const serial = required(args.serial ?? (await prompter.ask('Lamp serial number: ')), 'serial number').toUpperCase();
+    const storagePath = args.storage ?? join(homedir(), '.homebridge');
+    const cloud = new DysonCloud({ country, culture, debug: args.debug === 'true' });
+    console.log('\nRequesting a one-time code…');
+    const challengeId = await cloud.beginLogin(email);
+    console.log('Dyson has emailed you a 6-digit code.');
+    const otpCode = required(await prompter.ask('Code from the email: '), 'one-time code');
+    const { token, accountId } = await cloud.completeLogin(email, password, challengeId, otpCode);
+    console.log(`Logged in. Account ${accountId}`);
+    console.log(`Fetching the long-term key for ${serial}…`);
+    const ltk = await cloud.fetchLtk(serial, token);
+    await new CredentialStore(storagePath, PLUGIN_NAME).set(serial, { ltk, accountId });
+    console.log(`Stored the key for ${serial} under ${storagePath}.`);
+    console.log('\nAdd this to the platforms array in your Homebridge config.json:\n');
+    console.log(JSON.stringify({ platform: 'DysonSolarcycleMorph', lights: [{ name: 'Dyson Morph', mac: '<the lamp BLE address>', serial }] }, null, 2));
+    console.log('\nThe key itself is deliberately not shown: it is a device credential, and it now\n' +
+        'lives outside config.json. Pass --storage if your Homebridge storage directory is\n' +
+        `not ${storagePath}.`);
+}
+const prompter = new Prompter(Boolean(stdin.isTTY));
+main(prompter)
+    .catch((error) => {
+    console.error(`\nPairing failed: ${error instanceof Error ? error.message : String(error)}`);
+    if (String(error).includes('404')) {
+        console.error('A 404 from the LTK endpoint usually means the lamp is not registered to this\n' +
+            'Dyson account. Add it in the MyDyson app first, then run this again.');
+    }
+    process.exitCode = 1;
+})
+    .finally(() => prompter.close());
+//# sourceMappingURL=pair.js.map

package/dist/cli/pair.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pair.js","sourceRoot":"","sources":["../../src/cli/pair.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,eAAe,EAAkB,MAAM,wBAAwB,CAAC;AACzE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE7C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAY7C,SAAS,SAAS,CAAC,IAAc;IAC/B,MAAM,IAAI,GAAS,EAAE,CAAC;IACtB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC;QACtD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAe,CAAC;QACnC,0EAA0E;QAC1E,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,QAAQ;IACK,EAAE,CAAwB;IACnC,QAAQ,CAAuB;IAEvC,YAAY,WAAoB;QAC9B,IAAI,CAAC,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxF,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAa;QACrB,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;QACD,IAAI,CAAC,QAAQ,KAAK,MAAM,YAAY,EAAE,CAAC;QACvC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;QAC3B,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;IACrC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,SAAS,CAAC,KAAa;QAC3B,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,EAA2D,CAAC;QACnF,MAAM,KAAK,GAAG,SAAS,CAAC,cAAc,CAAC;QACvC,IAAI,WAAW,GAAG,KAAK,CAAC;QACxB,SAAS,CAAC,cAAc,GAAG,CAAC,IAAY,EAAQ,EAAE;YAChD,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;gBAC1B,WAAW,GAAG,IAAI,CAAC;YACrB,CAAC;QACH,CAAC,CAAC;QACF,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC;gBAAS,CAAC;YACT,SAAS,CAAC,cAAc,GAAG,KAAK,CAAC;YACjC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IAED,KAAK;QACH,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC;IACnB,CAAC;CACF;AAED,KAAK,UAAU,YAAY;IACzB,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAC5D,CAAC;AAED,oEAAoE;AACpE,SAAS,QAAQ,CAAC,KAAa,EAAE,IAAY;IAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,MAAM,IAAI,eAAe;YACvB,6EAA6E;YAC7E,+EAA+E;YAC/E,4CAA4C,CAC/C,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,QAAkB;IACpC,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAE9C,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACjB,OAAO,CAAC,KAAK,CAAC,8EAA8E,CAAC,CAAC;IAChG,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,CAAC;IAC7F,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,GAAG,OAAO,CAAC,WAAW,EAAE,IAAI,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;IACpF,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;IACrG,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,QAAQ,CAAC,SAAS,CAAC,0BAA0B,CAAC,EAAE,UAAU,CAAC,CAAC;IAC5F,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC,WAAW,EAAE,CAAC;IACpH,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,aAAa,CAAC,CAAC;IAEnE,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC,CAAC;IAEjF,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;IAC7C,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IAClD,OAAO,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,uBAAuB,CAAC,EAAE,eAAe,CAAC,CAAC;IAEvF,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IAC9F,OAAO,CAAC,GAAG,CAAC,sBAAsB,SAAS,EAAE,CAAC,CAAC;IAE/C,OAAO,CAAC,GAAG,CAAC,kCAAkC,MAAM,GAAG,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAEhD,MAAM,IAAI,eAAe,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;IACpF,OAAO,CAAC,GAAG,CAAC,sBAAsB,MAAM,UAAU,WAAW,GAAG,CAAC,CAAC;IAElE,OAAO,CAAC,GAAG,CAAC,qEAAqE,CAAC,CAAC;IACnF,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CACZ,EAAE,QAAQ,EAAE,sBAAsB,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,wBAAwB,EAAE,MAAM,EAAE,CAAC,EAAE,EAC9G,IAAI,EACJ,CAAC,CACF,CACF,CAAC;IACF,OAAO,CAAC,GAAG,CACT,qFAAqF;QACnF,qFAAqF;QACrF,OAAO,WAAW,GAAG,CACxB,CAAC;AACJ,CAAC;AAED,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;AACpD,IAAI,CAAC,QAAQ,CAAC;KACX,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;IACxB,OAAO,CAAC,KAAK,CAAC,qBAAqB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC7F,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO,CAAC,KAAK,CACX,gFAAgF;YAC9E,sEAAsE,CACzE,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC,CAAC;KACD,OAAO,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,51 @@
+import type { PlatformConfig } from 'homebridge';
+/** One lamp, as configured in Homebridge's config.json. */
+export interface LightConfig {
+    /** Display name in HomeKit. */
+    name: string;
+    /** BLE MAC, e.g. `AA:BB:CC:DD:EE:FF`. */
+    mac: string;
+    /** Lamp serial. Used as the HomeKit accessory identity, so it must be stable. */
+    serial: string;
+    /**
+     * Long-term key (hex). Normally absent: pairing stores it outside the config
+     * so the key is not kept in a file the UI displays. Set it here only to
+     * override the stored value, e.g. when migrating an existing setup.
+     */
+    ltk?: string;
+    /** Dyson account GUID the LTK was issued to. Stored alongside the key. */
+    accountId?: string;
+    /** Expose the built-in motion sensor as a separate HomeKit service. */
+    motionSensor?: boolean;
+}
+/** A lamp whose credentials are known, from the config or the credential store. */
+export type ResolvedLightConfig = LightConfig & {
+    ltk: string;
+    accountId: string;
+};
+/**
+ * MyDyson credentials, owned by the settings page.
+ *
+ * The plugin itself never reads these: they exist so the settings page can
+ * remember who to authorise as between visits. The password is only needed
+ * while exchanging a code for a token, and the page offers to clear it after.
+ */
+export interface DysonAccountConfig {
+    email?: string;
+    password?: string;
+    country?: string;
+}
+export interface MorphPlatformConfig extends PlatformConfig {
+    /** Homebridge uses this as the log prefix for everything this plugin says. */
+    name?: string;
+    lights?: LightConfig[];
+    dysonAccount?: DysonAccountConfig;
+    /** HCI adapter to use, e.g. `hci0`. Defaults to the system default adapter. */
+    adapter?: string;
+}
+/**
+ * Validate one configured lamp.
+ *
+ * @returns A list of human-readable problems; empty means the entry is usable.
+ */
+export declare function validateLightConfig(light: Partial<LightConfig>, index: number): string[];

package/dist/config.js

@@ -0,0 +1,32 @@
+/**
+ * Validate one configured lamp.
+ *
+ * @returns A list of human-readable problems; empty means the entry is usable.
+ */
+export function validateLightConfig(light, index) {
+    const problems = [];
+    const where = `lights[${index}]`;
+    if (!light.name?.trim()) {
+        problems.push(`${where}.name is required`);
+    }
+    if (!light.mac || !/^([0-9A-Fa-f]{2}:){5}[0-9A-Fa-f]{2}$/.test(light.mac)) {
+        problems.push(`${where}.mac must look like AA:BB:CC:DD:EE:FF (got ${JSON.stringify(light.mac)})`);
+    }
+    if (!light.serial?.trim()) {
+        problems.push(`${where}.serial is required`);
+    }
+    // Credentials are optional here — they normally come from the credential
+    // store. Only validate what was actually supplied; a missing pair is reported
+    // later, once the store has been consulted.
+    if (light.ltk !== undefined && (!/^[0-9a-fA-F]+$/.test(light.ltk) || light.ltk.length % 2 !== 0)) {
+        problems.push(`${where}.ltk must be an even-length hex string`);
+    }
+    if (light.accountId !== undefined && !/^[0-9a-fA-F-]{36}$/.test(light.accountId)) {
+        problems.push(`${where}.accountId must be a Dyson account UUID`);
+    }
+    if ((light.ltk === undefined) !== (light.accountId === undefined)) {
+        problems.push(`${where} sets only one of ltk/accountId — supply both to override the stored credentials, or neither`);
+    }
+    return problems;
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AA+CA;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAA2B,EAAE,KAAa;IAC5E,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,UAAU,KAAK,GAAG,CAAC;IAEjC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;QACxB,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,mBAAmB,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,sCAAsC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1E,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,8CAA8C,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACpG,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC;QAC1B,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,qBAAqB,CAAC,CAAC;IAC/C,CAAC;IACD,yEAAyE;IACzE,8EAA8E;IAC9E,4CAA4C;IAC5C,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACjG,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,wCAAwC,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACjF,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,yCAAyC,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,GAAG,KAAK,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,EAAE,CAAC;QAClE,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,8FAA8F,CAAC,CAAC;IACxH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/dyson/cloud.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Minimal Dyson cloud client — just enough to obtain the long-term key (LTK)
+ * that the lamp's offline handshake needs.
+ *
+ * This runs once, during pairing. Normal operation never touches the network.
+ */
+/** One device as the account describes it. */
+export interface DysonDevice {
+    serialNumber: string;
+    name: string;
+    /** `light`, `robot`, `ec` (air treatment), and so on. */
+    category?: string;
+    /** `lecOnly` means Bluetooth with no Wi-Fi path. */
+    connectionCategory?: string;
+    model?: string | null;
+    type?: string;
+}
+/** Devices this plugin can drive: lights reachable over Bluetooth. */
+export declare function isBluetoothLight(device: DysonDevice): boolean;
+export interface LoginResult {
+    /** Bearer token for subsequent calls. */
+    token: string;
+    /** Account GUID — goes into re-auth PayloadA verbatim. */
+    accountId: string;
+}
+export interface CloudOptions {
+    /** ISO 3166-1 alpha-2, e.g. `DE`. Selects the regional endpoint. */
+    country?: string;
+    /** BCP 47 culture, e.g. `de-DE`. */
+    culture?: string;
+    timeoutMs?: number;
+    /** Log every request and response. Never logs credentials or tokens. */
+    debug?: boolean;
+}
+export declare class DysonCloud {
+    private readonly country;
+    private readonly culture;
+    private readonly timeoutMs;
+    private readonly debug;
+    constructor(options?: CloudOptions);
+    /**
+     * Start a login. Dyson emails a one-time code and returns the challenge it
+     * belongs to.
+     *
+     * @returns The `challengeId` to pass to {@link completeLogin}.
+     */
+    beginLogin(email: string): Promise<string>;
+    /** Exchange the emailed one-time code for a bearer token and account GUID. */
+    completeLogin(email: string, password: string, challengeId: string, otpCode: string): Promise<LoginResult>;
+    /**
+     * List the devices registered to the account.
+     *
+     * This is how a light is told apart from a vacuum: both advertise the same
+     * Dyson BLE service and neither carries model information in its
+     * advertisement, so the account is the only reliable source.
+     */
+    getDevices(token: string): Promise<DysonDevice[]>;
+    /**
+     * Fetch a lamp's long-term key.
+     *
+     * Requires the lamp to already be registered to this account in the MyDyson
+     * app; otherwise the endpoint returns 404 and you need the physical
+     * fresh-pairing flow instead.
+     */
+    fetchLtk(serial: string, token: string): Promise<string>;
+    private request;
+}

package/dist/dyson/cloud.js

@@ -0,0 +1,147 @@
+/**
+ * Minimal Dyson cloud client — just enough to obtain the long-term key (LTK)
+ * that the lamp's offline handshake needs.
+ *
+ * This runs once, during pairing. Normal operation never touches the network.
+ */
+/** The `X-Dyson-ApiAuthCode` the LTK endpoint accepts in place of a session code. */
+const LTK_AUTH_CODE = '80541406';
+/** The MyDyson Android app identifies itself with exactly this string. */
+const USER_AGENT = 'android client';
+/** Only China has a dedicated endpoint; everything else uses the global one. */
+function apiHostname(country) {
+    return country.toUpperCase() === 'CN' ? 'https://appapi.cp.dyson.cn' : 'https://appapi.cp.dyson.com';
+}
+/** Devices this plugin can drive: lights reachable over Bluetooth. */
+export function isBluetoothLight(device) {
+    return device.category === 'light' && device.connectionCategory !== 'wifiOnly';
+}
+export class DysonCloud {
+    country;
+    culture;
+    timeoutMs;
+    debug;
+    constructor(options = {}) {
+        this.country = options.country ?? 'DE';
+        this.culture = options.culture ?? 'de-DE';
+        this.timeoutMs = options.timeoutMs ?? 20_000;
+        this.debug = options.debug ?? false;
+    }
+    /**
+     * Start a login. Dyson emails a one-time code and returns the challenge it
+     * belongs to.
+     *
+     * @returns The `challengeId` to pass to {@link completeLogin}.
+     */
+    async beginLogin(email) {
+        // The API rejects clients that have not announced themselves recently.
+        await this.request('GET', '/v1/provisioningservice/application/Android/version');
+        await this.request('POST', '/v3/userregistration/email/userstatus', {
+            query: { country: this.country },
+            body: { email },
+        });
+        const data = await this.request('POST', '/v3/userregistration/email/auth', {
+            query: { country: this.country, culture: this.culture },
+            body: { email },
+        });
+        if (!data.challengeId) {
+            throw new Error('Dyson did not return a challengeId — is the email registered?');
+        }
+        return data.challengeId;
+    }
+    /** Exchange the emailed one-time code for a bearer token and account GUID. */
+    async completeLogin(email, password, challengeId, otpCode) {
+        const data = await this.request('POST', '/v3/userregistration/email/verify', {
+            query: { country: this.country, culture: this.culture },
+            body: { challengeId, email, otpCode, password },
+        });
+        if (!data.token || !data.account) {
+            throw new Error('Dyson login succeeded but returned no token/account');
+        }
+        return { token: data.token, accountId: data.account };
+    }
+    /**
+     * List the devices registered to the account.
+     *
+     * This is how a light is told apart from a vacuum: both advertise the same
+     * Dyson BLE service and neither carries model information in its
+     * advertisement, so the account is the only reliable source.
+     */
+    async getDevices(token) {
+        const devices = await this.request('GET', '/v3/manifest', {
+            headers: { Authorization: `Bearer ${token}` },
+        });
+        return Array.isArray(devices) ? devices : [];
+    }
+    /**
+     * Fetch a lamp's long-term key.
+     *
+     * Requires the lamp to already be registered to this account in the MyDyson
+     * app; otherwise the endpoint returns 404 and you need the physical
+     * fresh-pairing flow instead.
+     */
+    async fetchLtk(serial, token) {
+        const data = await this.request('GET', `/v1/lec/${encodeURIComponent(serial)}/ltk`, {
+            headers: {
+                Authorization: `Bearer ${token}`,
+                'X-Dyson-ApiAuthCode': LTK_AUTH_CODE,
+            },
+        });
+        if (!data.ltk) {
+            throw new Error(`Dyson returned no LTK for ${serial}`);
+        }
+        return data.ltk;
+    }
+    async request(method, path, options = {}) {
+        const url = new URL(path, apiHostname(this.country));
+        for (const [k, v] of Object.entries(options.query ?? {})) {
+            url.searchParams.set(k, v);
+        }
+        const headers = {
+            'User-Agent': USER_AGENT,
+            Accept: 'application/json',
+            ...options.headers,
+        };
+        if (options.body !== undefined) {
+            headers['Content-Type'] = 'application/json';
+        }
+        if (this.debug) {
+            console.error(`→ ${method} ${url}`);
+            console.error(`  headers: ${JSON.stringify(redact(headers))}`);
+            console.error(`  body:    ${JSON.stringify(redact(options.body))}`);
+        }
+        const response = await fetch(url, {
+            method,
+            headers,
+            body: options.body === undefined ? undefined : JSON.stringify(options.body),
+            signal: AbortSignal.timeout(this.timeoutMs),
+        });
+        const text = await response.text();
+        if (this.debug) {
+            console.error(`← ${response.status} ${response.statusText}`);
+            console.error(`  headers: ${JSON.stringify(Object.fromEntries(response.headers))}`);
+            console.error(`  body:    ${text.slice(0, 500)}`);
+        }
+        if (!response.ok) {
+            throw new Error(`Dyson API ${method} ${path} failed: ${response.status} ${response.statusText} ${text.slice(0, 300)}`);
+        }
+        if (!text) {
+            return {};
+        }
+        try {
+            return JSON.parse(text);
+        }
+        catch {
+            throw new Error(`Dyson API ${method} ${path} returned non-JSON: ${text.slice(0, 200)}`);
+        }
+    }
+}
+/** Strip anything credential-shaped so debug output is safe to paste. */
+function redact(value) {
+    if (value === undefined || value === null || typeof value !== 'object') {
+        return value;
+    }
+    const secret = /password|token|otp|ltk|authorization|apiauthcode/i;
+    return Object.fromEntries(Object.entries(value).map(([k, v]) => [k, secret.test(k) ? '<redacted>' : v]));
+}
+//# sourceMappingURL=cloud.js.map

package/dist/dyson/cloud.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud.js","sourceRoot":"","sources":["../../src/dyson/cloud.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,qFAAqF;AACrF,MAAM,aAAa,GAAG,UAAU,CAAC;AAEjC,0EAA0E;AAC1E,MAAM,UAAU,GAAG,gBAAgB,CAAC;AAEpC,gFAAgF;AAChF,SAAS,WAAW,CAAC,OAAe;IAClC,OAAO,OAAO,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,6BAA6B,CAAC;AACvG,CAAC;AAcD,sEAAsE;AACtE,MAAM,UAAU,gBAAgB,CAAC,MAAmB;IAClD,OAAO,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,kBAAkB,KAAK,UAAU,CAAC;AACjF,CAAC;AAmBD,MAAM,OAAO,UAAU;IACJ,OAAO,CAAS;IAChB,OAAO,CAAS;IAChB,SAAS,CAAS;IAClB,KAAK,CAAU;IAEhC,YAAY,UAAwB,EAAE;QACpC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC;QACvC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC;QAC1C,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC;QAC7C,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IACtC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU,CAAC,KAAa;QAC5B,uEAAuE;QACvE,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,qDAAqD,CAAC,CAAC;QACjF,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,uCAAuC,EAAE;YAClE,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;YAChC,IAAI,EAAE,EAAE,KAAK,EAAE;SAChB,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAA0B,MAAM,EAAE,iCAAiC,EAAE;YAClG,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;YACvD,IAAI,EAAE,EAAE,KAAK,EAAE;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;QACnF,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,aAAa,CACjB,KAAa,EACb,QAAgB,EAChB,WAAmB,EACnB,OAAe;QAEf,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAC7B,MAAM,EACN,mCAAmC,EACnC;YACE,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;YACvD,IAAI,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE;SAChD,CACF,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;IACxD,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,UAAU,CAAC,KAAa;QAC5B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAgB,KAAK,EAAE,cAAc,EAAE;YACvE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;SAC9C,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/C,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,QAAQ,CAAC,MAAc,EAAE,KAAa;QAC1C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAkB,KAAK,EAAE,WAAW,kBAAkB,CAAC,MAAM,CAAC,MAAM,EAAE;YACnG,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,EAAE;gBAChC,qBAAqB,EAAE,aAAa;aACrC;SACF,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,6BAA6B,MAAM,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,OAAO,IAAI,CAAC,GAAG,CAAC;IAClB,CAAC;IAEO,KAAK,CAAC,OAAO,CACnB,MAAsB,EACtB,IAAY,EACZ,UAII,EAAE;QAEN,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QACrD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;YACzD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7B,CAAC;QAED,MAAM,OAAO,GAA2B;YACtC,YAAY,EAAE,UAAU;YACxB,MAAM,EAAE,kBAAkB;YAC1B,GAAG,OAAO,CAAC,OAAO;SACnB,CAAC;QACF,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;QAC/C,CAAC;QAED,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,KAAK,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC;YACpC,OAAO,CAAC,KAAK,CAAC,cAAc,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;YAC/D,OAAO,CAAC,KAAK,CAAC,cAAc,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;QACtE,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,MAAM;YACN,OAAO;YACP,IAAI,EAAE,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC;YAC3E,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC;SAC5C,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAEnC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;YAC7D,OAAO,CAAC,KAAK,CAAC,cAAc,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;YACpF,OAAO,CAAC,KAAK,CAAC,cAAc,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QACpD,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,aAAa,MAAM,IAAI,IAAI,YAAY,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CACtG,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,EAAO,CAAC;QACjB,CAAC;QACD,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,aAAa,MAAM,IAAI,IAAI,uBAAuB,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QAC1F,CAAC;IACH,CAAC;CACF;AAED,yEAAyE;AACzE,SAAS,MAAM,CAAC,KAAc;IAC5B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAAG,mDAAmD,CAAC;IACnE,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CACzG,CAAC;AACJ,CAAC"}

package/dist/dyson/credentials.d.ts

@@ -0,0 +1,32 @@
+/** What pairing produces for one lamp. */
+export interface StoredCredentials {
+    /** Long-term key as hex. */
+    ltk: string;
+    /** Dyson account GUID the key was issued to. */
+    accountId: string;
+    /** ISO timestamp, so the UI can say how old an authorisation is. */
+    created: string;
+}
+/** A MyDyson session, kept so the device list survives a page reload. */
+export interface StoredAccount {
+    token: string;
+    accountId: string;
+    created: string;
+}
+export declare class CredentialStore {
+    private readonly directory;
+    private store;
+    /** @param storagePath Homebridge's storage directory. */
+    constructor(storagePath: string, pluginName: string);
+    private open;
+    /** Serials are case-insensitive in practice; normalise so lookups agree. */
+    private static key;
+    get(serial: string): Promise<StoredCredentials | undefined>;
+    set(serial: string, credentials: Omit<StoredCredentials, 'created'>): Promise<void>;
+    delete(serial: string): Promise<void>;
+    getAccount(email: string): Promise<StoredAccount | undefined>;
+    setAccount(email: string, account: Omit<StoredAccount, 'created'>): Promise<void>;
+    deleteAccount(email: string): Promise<void>;
+    /** Serials that have stored credentials. */
+    list(): Promise<string[]>;
+}

package/dist/dyson/credentials.js

@@ -0,0 +1,73 @@
+/**
+ * Persistent storage for lamp credentials.
+ *
+ * The long-term key is a device credential, and `config.json` is the wrong
+ * place for it: the Homebridge UI shows that file, it gets pasted into support
+ * threads, and it is backed up wherever the storage directory is not. Keys live
+ * here instead, in the same node-persist store the custom UI writes to, so
+ * pairing never has to round-trip through the config at all.
+ */
+import { join } from 'node:path';
+import storage from 'node-persist';
+export class CredentialStore {
+    directory;
+    store;
+    /** @param storagePath Homebridge's storage directory. */
+    constructor(storagePath, pluginName) {
+        this.directory = join(storagePath, pluginName, 'persist');
+    }
+    async open() {
+        if (!this.store) {
+            const store = storage.create({ dir: this.directory });
+            await store.init();
+            this.store = store;
+        }
+        return this.store;
+    }
+    /** Serials are case-insensitive in practice; normalise so lookups agree. */
+    static key(serial) {
+        return `${serial.trim().toUpperCase()}:credentials`;
+    }
+    async get(serial) {
+        const stored = await (await this.open()).getItem(CredentialStore.key(serial));
+        if (!stored || typeof stored !== 'object') {
+            return undefined;
+        }
+        const { ltk, accountId } = stored;
+        // A half-written entry is worse than none: it would fail the handshake with
+        // a confusing crypto error rather than an obvious "not paired yet".
+        return ltk && accountId ? stored : undefined;
+    }
+    async set(serial, credentials) {
+        await (await this.open()).setItem(CredentialStore.key(serial), {
+            ...credentials,
+            created: new Date().toISOString(),
+        });
+    }
+    async delete(serial) {
+        await (await this.open()).removeItem(CredentialStore.key(serial));
+    }
+    async getAccount(email) {
+        const stored = await (await this.open()).getItem(`${email.trim().toLowerCase()}:account`);
+        if (!stored || typeof stored !== 'object') {
+            return undefined;
+        }
+        const { token, accountId } = stored;
+        return token && accountId ? stored : undefined;
+    }
+    async setAccount(email, account) {
+        await (await this.open()).setItem(`${email.trim().toLowerCase()}:account`, {
+            ...account,
+            created: new Date().toISOString(),
+        });
+    }
+    async deleteAccount(email) {
+        await (await this.open()).removeItem(`${email.trim().toLowerCase()}:account`);
+    }
+    /** Serials that have stored credentials. */
+    async list() {
+        const keys = await (await this.open()).keys();
+        return keys.filter((k) => k.endsWith(':credentials')).map((k) => k.slice(0, -':credentials'.length));
+    }
+}
+//# sourceMappingURL=credentials.js.map

package/dist/dyson/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/dyson/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,OAAO,MAAM,cAAc,CAAC;AAmBnC,MAAM,OAAO,eAAe;IACT,SAAS,CAAS;IAC3B,KAAK,CAAgD;IAE7D,yDAAyD;IACzD,YAAY,WAAmB,EAAE,UAAkB;QACjD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;IAC5D,CAAC;IAEO,KAAK,CAAC,IAAI;QAChB,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;YACtD,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;YACnB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACrB,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,4EAA4E;IACpE,MAAM,CAAC,GAAG,CAAC,MAAc;QAC/B,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,cAAc,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,MAAc;QACtB,MAAM,MAAM,GAAY,MAAM,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QACvF,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC1C,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,MAAoC,CAAC;QAChE,4EAA4E;QAC5E,oEAAoE;QACpE,OAAO,GAAG,IAAI,SAAS,CAAC,CAAC,CAAE,MAA4B,CAAC,CAAC,CAAC,SAAS,CAAC;IACtE,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,MAAc,EAAE,WAA+C;QACvE,MAAM,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE;YAC7D,GAAG,WAAW;YACd,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SAClC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAAc;QACzB,MAAM,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAAa;QAC5B,MAAM,MAAM,GAAY,MAAM,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QACnG,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC1C,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAgC,CAAC;QAC9D,OAAO,KAAK,IAAI,SAAS,CAAC,CAAC,CAAE,MAAwB,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAAa,EAAE,OAAuC;QACrE,MAAM,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE;YACzE,GAAG,OAAO;YACV,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SAClC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAa;QAC/B,MAAM,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IAChF,CAAC;IAED,4CAA4C;IAC5C,KAAK,CAAC,IAAI;QACR,MAAM,IAAI,GAAa,MAAM,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACxD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;IACvG,CAAC;CACF"}

package/dist/dyson/crypto.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Derive the 16-byte AES key from the long-term key.
+ *
+ * HKDF-SHA256 with an empty salt, truncated to the first expansion block.
+ */
+export declare function deriveAesKey(ltk: Buffer): Buffer;
+/**
+ * Encrypt-then-MAC one or more AES blocks.
+ *
+ * @returns `IV(16) || ciphertext || HMAC-SHA256(ciphertext)(32)` — 64 bytes for
+ * the single-block plaintexts this protocol uses.
+ */
+export declare function sealBlock(key: Buffer, plaintext: Buffer, iv?: Buffer): Buffer;
+/**
+ * Build the 82-byte re-auth PayloadA (message type 0x06).
+ *
+ * Layout: `account GUID(16) || 0x00 0x00 || sealBlock(nonce)(64)`.
+ */
+export declare function buildReauthPayloadA(accountUuid: string, key: Buffer, nonce?: Buffer): Buffer;
+/**
+ * Build the 66-byte re-auth PayloadC (message type 0x08).
+ *
+ * Layout: `0x00 0x00 || sealBlock(challenge)(64)`.
+ */
+export declare function buildReauthPayloadC(key: Buffer, challenge: Buffer): Buffer;
+/**
+ * Recover the lamp's challenge from PayloadB (message type 0x07).
+ *
+ * Layout: `0x00 0x00 || IV(16) || ciphertext(32) || MAC(32)?`. The MAC is
+ * absent on some firmware; when present we verify it, since a mismatch is the
+ * earliest and clearest signal that the stored LTK is wrong.
+ *
+ * @param payload The reassembled PayloadB, type byte already stripped.
+ * @returns The 16-byte challenge to echo back in PayloadC.
+ */
+export declare function parseReauthPayloadB(key: Buffer, payload: Buffer): Buffer;
+/** Dyson sends account GUIDs in big-endian (RFC 4122) byte order. */
+export declare function uuidToBytes(uuid: string): Buffer;