iobroker.miele-local 0.2.0

package/io-package.json

@@ -0,0 +1,181 @@
+{
+  "common": {
+    "name": "miele-local",
+    "version": "0.2.0",
+    "titleLang": {
+      "en": "Miele@local",
+      "de": "Miele@local",
+      "ru": "Miele@local",
+      "pt": "Miele@local",
+      "nl": "Miele@local",
+      "fr": "Miele@local",
+      "it": "Miele@local",
+      "es": "Miele@local",
+      "pl": "Miele@local",
+      "uk": "Miele@local",
+      "zh-cn": "Miele@local"
+    },
+    "desc": {
+      "en": "Connect modern Miele@Home appliances locally without the internet.",
+      "de": "Verbindet moderne Miele@Home-Geräte lokal ohne Internet.",
+      "ru": "Локальное подключение современных приборов Miele@Home без интернета.",
+      "pt": "Liga eletrodomésticos Miele@Home modernos localmente, sem internet.",
+      "nl": "Verbindt moderne Miele@Home-apparaten lokaal zonder internet.",
+      "fr": "Connecte localement les appareils Miele@Home modernes, sans internet.",
+      "it": "Collega localmente i moderni elettrodomestici Miele@Home senza internet.",
+      "es": "Conecta electrodomésticos Miele@Home modernos localmente, sin internet.",
+      "pl": "Łączy nowoczesne urządzenia Miele@Home lokalnie, bez internetu.",
+      "uk": "Локальне підключення сучасних приладів Miele@Home без інтернету.",
+      "zh-cn": "无需互联网即可在本地连接现代 Miele@Home 家电。"
+    },
+    "authors": [
+      "Immanuel"
+    ],
+    "keywords": [
+      "miele",
+      "local",
+      "dop2",
+      "smarthome",
+      "washing machine",
+      "dishwasher",
+      "oven"
+    ],
+    "licenseInformation": {
+      "type": "free",
+      "license": "MIT"
+    },
+    "tier": 3,
+    "platform": "Javascript/Node.js",
+    "icon": "miele-local.png",
+    "enabled": true,
+    "extIcon": "https://raw.githubusercontent.com/SmarthomeElektroniker/ioBroker.miele-local/main/admin/miele-local.png",
+    "readme": "https://github.com/SmarthomeElektroniker/ioBroker.miele-local/blob/main/README.md",
+    "loglevel": "info",
+    "news": {
+      "0.2.0": {
+        "en": "Renamed from miele-lokal to miele-local: English adapter name and title.",
+        "de": "Umbenennung von miele-lokal in miele-local: englischer Adaptername und Titel.",
+        "ru": "Переименование miele-lokal в miele-local: английское имя и заголовок адаптера.",
+        "pt": "Renomeado de miele-lokal para miele-local: nome e título do adaptador em inglês.",
+        "nl": "Hernoemd van miele-lokal naar miele-local: Engelse adapternaam en titel.",
+        "fr": "Renommé de miele-lokal en miele-local : nom et titre de l'adaptateur en anglais.",
+        "it": "Rinominato da miele-lokal a miele-local: nome e titolo adattatore in inglese.",
+        "es": "Renombrado de miele-lokal a miele-local: nombre y título del adaptador en inglés.",
+        "pl": "Zmiana nazwy z miele-lokal na miele-local: angielska nazwa i tytuł adaptera.",
+        "uk": "Перейменовано з miele-lokal на miele-local: англійська назва та заголовок адаптера.",
+        "zh-cn": "从 miele-lokal 重命名为 miele-local：英文适配器名称和标题。"
+      },
+      "0.1.1": {
+        "en": "Released via GitHub Actions with npm provenance (trusted publishing). No functional changes.",
+        "de": "Veröffentlichung über GitHub Actions mit npm-Provenance (Trusted Publishing). Keine funktionalen Änderungen.",
+        "ru": "Выпуск через GitHub Actions с npm-provenance (trusted publishing). Функциональных изменений нет.",
+        "pt": "Publicado via GitHub Actions com proveniência npm (trusted publishing). Sem alterações funcionais.",
+        "nl": "Uitgebracht via GitHub Actions met npm-provenance (trusted publishing). Geen functionele wijzigingen.",
+        "fr": "Publié via GitHub Actions avec la provenance npm (trusted publishing). Aucun changement fonctionnel.",
+        "it": "Pubblicato tramite GitHub Actions con provenance npm (trusted publishing). Nessuna modifica funzionale.",
+        "es": "Publicado mediante GitHub Actions con procedencia npm (trusted publishing). Sin cambios funcionales.",
+        "pl": "Opublikowano przez GitHub Actions z npm provenance (trusted publishing). Bez zmian funkcjonalnych.",
+        "uk": "Випущено через GitHub Actions з npm-provenance (trusted publishing). Функціональних змін немає.",
+        "zh-cn": "通过 GitHub Actions 发布并附带 npm provenance（可信发布）。无功能变更。"
+      },
+      "0.1.0": {
+        "en": "Initial release: login/GroupKey retrieval, mDNS discovery, state polling with enum decoding, optional SuperVision push, optional control.",
+        "de": "Erste Version: Login/GroupKey-Ermittlung, mDNS-Discovery, State-Polling mit Enum-Dekodierung, optionaler SuperVision-Push, optionale Steuerung.",
+        "ru": "Первый выпуск: получение логина/GroupKey, mDNS-обнаружение, опрос состояний с декодированием enum, опциональный SuperVision-push, опциональное управление.",
+        "pt": "Primeira versão: obtenção de login/GroupKey, deteção mDNS, sondagem de estados com descodificação de enums, push SuperVision opcional, controlo opcional.",
+        "nl": "Eerste versie: login/GroupKey ophalen, mDNS-detectie, statuspolling met enum-decodering, optionele SuperVision-push, optionele besturing.",
+        "fr": "Première version : récupération login/GroupKey, découverte mDNS, interrogation des états avec décodage enum, push SuperVision optionnel, commande optionnelle.",
+        "it": "Prima versione: recupero login/GroupKey, rilevamento mDNS, polling degli stati con decodifica enum, push SuperVision opzionale, controllo opzionale.",
+        "es": "Primera versión: obtención de login/GroupKey, detección mDNS, sondeo de estados con decodificación de enums, push SuperVision opcional, control opcional.",
+        "pl": "Pierwsza wersja: pobieranie login/GroupKey, wykrywanie mDNS, odpytywanie stanów z dekodowaniem enum, opcjonalny push SuperVision, opcjonalne sterowanie.",
+        "uk": "Перший випуск: отримання логіна/GroupKey, виявлення mDNS, опитування станів з декодуванням enum, опціональний SuperVision-push, опціональне керування.",
+        "zh-cn": "首个版本：登录/GroupKey 获取、mDNS 发现、带枚举解码的状态轮询、可选 SuperVision 推送、可选控制。"
+      }
+    },
+    "mode": "daemon",
+    "type": "household",
+    "compact": true,
+    "connectionType": "local",
+    "dataSource": "push",
+    "adminUI": {
+      "config": "json"
+    },
+    "dependencies": [
+      {
+        "js-controller": ">=6.0.11"
+      }
+    ],
+    "globalDependencies": [
+      {
+        "admin": ">=7.6.20"
+      }
+    ],
+    "messagebox": true,
+    "supportCustoms": false
+  },
+  "encryptedNative": [
+    "groupKey",
+    "refreshToken"
+  ],
+  "protectedNative": [
+    "groupKey",
+    "refreshToken",
+    "groupId"
+  ],
+  "native": {
+    "country": "de",
+    "region": "EU",
+    "groupId": "",
+    "groupKey": "",
+    "refreshToken": "",
+    "autoDiscover": true,
+    "devices": [],
+    "pollInterval": 30,
+    "activePollInterval": 30,
+    "usePush": false,
+    "pushPort": 18082,
+    "allowControl": false,
+    "germanNames": true,
+    "ecoFeedback": true,
+    "ecoInterval": 60,
+    "secondsTime": true,
+    "secondsInterval": 30
+  },
+  "objects": [],
+  "instanceObjects": [
+    {
+      "_id": "info",
+      "type": "channel",
+      "common": {
+        "name": "Information"
+      },
+      "native": {}
+    },
+    {
+      "_id": "info.connection",
+      "type": "state",
+      "common": {
+        "role": "indicator.connected",
+        "name": "Device or service connected",
+        "type": "boolean",
+        "read": true,
+        "write": false,
+        "def": false
+      },
+      "native": {}
+    },
+    {
+      "_id": "info.discoveredDevices",
+      "type": "state",
+      "common": {
+        "role": "json",
+        "name": "Discovered devices (mDNS)",
+        "type": "string",
+        "read": true,
+        "write": false,
+        "def": "[]"
+      },
+      "native": {}
+    }
+  ]
+}

package/lib/api.js

@@ -0,0 +1,106 @@
+'use strict';
+
+const http = require('node:http');
+const { MieleCrypto } = require('./crypto');
+
+/**
+ * Lokaler Miele-Geräte-Client: signierte GET-Reads (entschlüsselt JSON) und
+ * signierte PUT-Writes (verschlüsselter Body) über HTTP Port 80.
+ */
+class MieleDeviceApi {
+    /**
+     * @param {string} host    Geräte-IP
+     * @param {MieleCrypto} mc  Krypto-Provider (GroupID/GroupKey)
+     * @param {object} [opts]   { timeout }
+     */
+    constructor(host, mc, opts = {}) {
+        this.host = host;
+        this.mc = mc;
+        this.timeout = opts.timeout || 8000;
+    }
+
+    _request(method, resource, bodyPlain) {
+        return new Promise((resolve, reject) => {
+            const bodyMethod = method === 'PUT' || method === 'POST';
+            let body = Buffer.alloc(0);
+            let signature;
+            if (bodyMethod && bodyPlain != null) {
+                body = MieleCrypto.padBody(bodyPlain);
+            }
+            const { headers, signature: sig } = this.mc.headers(method, this.host, resource, body);
+            signature = sig;
+
+            let sendBuf = null;
+            if (bodyMethod && body.length > 0) {
+                sendBuf = this.mc.encryptBody(body, signature);
+                headers['Content-Length'] = sendBuf.length;
+            }
+
+            const req = http.request(
+                { host: this.host, port: 80, method, path: `/${resource}`, headers, timeout: this.timeout },
+                res => {
+                    const chunks = [];
+                    res.on('data', c => chunks.push(c));
+                    res.on('end', () => {
+                        resolve({
+                            status: res.statusCode,
+                            headers: res.headers,
+                            body: Buffer.concat(chunks),
+                        });
+                    });
+                },
+            );
+            req.on('error', reject);
+            req.on('timeout', () => req.destroy(new Error(`Timeout ${this.host}/${resource}`)));
+            if (sendBuf) req.write(sendBuf);
+            req.end();
+        });
+    }
+
+    /** Signierter GET, entschlüsselt & als JSON geparst. */
+    async get(resource) {
+        const res = await this._request('GET', resource);
+        if (res.status === 204) return null;
+        if (res.status !== 200) {
+            const err = new Error(`GET /${resource} → HTTP ${res.status}`);
+            err.status = res.status;
+            throw err;
+        }
+        const xsig = res.headers['x-signature'];
+        if (!xsig) throw new Error(`GET /${resource}: kein X-Signature-Header`);
+        const plain = this.mc.decryptResponse(xsig, res.body);
+        const txt = plain.toString('utf8').replace(/[\x00\x20]+$/g, '');
+        try {
+            return JSON.parse(txt);
+        } catch (e) {
+            const err = new Error(`GET /${resource}: JSON-Fehler (${e.message})`);
+            err.raw = txt;
+            throw err;
+        }
+    }
+
+    /** Signierter PUT mit verschlüsseltem Body. Gibt Statuscode zurück. */
+    async put(resource, bodyPlain) {
+        const res = await this._request('PUT', resource, bodyPlain);
+        return res.status;
+    }
+
+    /** Signierter POST mit verschlüsseltem Body. Gibt {status, location} zurück. */
+    async post(resource, bodyPlain) {
+        const res = await this._request('POST', resource, bodyPlain);
+        return { status: res.status, location: res.headers['location'] || '' };
+    }
+
+    // --- Convenience ---
+    getIdent(route) {
+        return this.get(`Devices/${route}/Ident`);
+    }
+    getState(route) {
+        return this.get(`Devices/${route}/State`);
+    }
+    readDop2(route, unit, attr, idx1 = 0, idx2 = 0) {
+        return this._request('GET', `Devices/${route}/DOP2/${unit}/${attr}?idx1=${idx1}&idx2=${idx2}`);
+    }
+}
+
+module.exports = { MieleDeviceApi };

package/lib/cloud.js

@@ -0,0 +1,146 @@
+'use strict';
+
+/**
+ * Miele MAP/Gigya-OAuth (PKCE) + Haushalts-GroupKey-Abruf.
+ *
+ * Ablauf ohne lokale Neu-Provisionierung (die Miele-App bleibt gekoppelt):
+ *   1) build_authorize_url() → Nutzer öffnet URL im Browser, meldet sich an.
+ *   2) Browser wird auf  miele://oauth2-code/?code=...&state=...  umgeleitet
+ *      (blockiert) → Nutzer kopiert diese URL zurück.
+ *   3) exchangeCode() tauscht code → {access_token, refresh_token}.
+ *   4) fetchGroupKey() holt {groupId, groupKey, devices} von
+ *      rest-<region>.domestic.miele-iot.com/V2/GroupKeyId/.
+ */
+
+const crypto = require('node:crypto');
+const https = require('node:https');
+const { URL, URLSearchParams } = require('node:url');
+
+// Länderspezifische MAP-Consumer-client_ids (aus offizieller Android-APK).
+const CONSUMER_CLIENT_IDS = {
+    at: 'wNv9HJ3ZcFKH4bxvz0LExQuw', ch: 'V52nWiniHyVotglJKplSXnX8',
+    cz: 'npoAzuJP6okjvJ0NqUq9i5Rv', de: 'UJgKOxacIul2BcPJAzrQE6p0',
+    dk: 'xWgykqRQSa9THqOXWfzZbxsH', es: 'D0Q4NPBR9dwP2EjX4E0_CtHE',
+    fr: 'SOiiE3R4tSD0VxYYBvB8Pi_J', gb: 'WigtLzKGJE1Wg6yeZUECV8-P',
+    hr: 'HD4OUUQYAw_5DtVFSe4-rYzR', hu: '2mm2yscHPGJ4tJCVjd6mp-to',
+    it: 'ARQyaYB0ZxLxJ1SJcjJgctuV', nl: '7ItTbQXQ1wthDOue9jvBQ7Iz',
+    pl: 'jWbgLScpvIuqjUoYvf1jS-Is', pt: '5ZVD-CuJvpG4YpCO9pQhtrGQ',
+    se: '3Mm7m1gD1eU_sUh8yxmShL6S', si: 'UTyhG21RchpI8FPbNeb1vFg1',
+    sk: 'pGeafLwcC1_BCLr8DRTCVxSt', us: 'HpsWh2gzgKqRBduPpkZ4Yui9',
+};
+const REDIRECT_URI = 'miele://oauth2-code/';
+const OAUTH_SCOPE = 'openid mcs bpdata zuora'; // `mcs` ist Pflicht für /V2/GroupKeyId/
+const REST_HOST_BY_REGION = {
+    EU: 'rest-eu.domestic.miele-iot.com',
+    AS: 'rest-as.domestic.miele-iot.com',
+    EU2: 'rest-eu2.domestic.miele-iot.com',
+};
+
+function b64url(buf) {
+    return buf.toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+
+function httpsRequest(method, urlStr, { headers = {}, body = null } = {}) {
+    return new Promise((resolve, reject) => {
+        const u = new URL(urlStr);
+        const req = https.request(
+            { method, hostname: u.hostname, path: u.pathname + u.search, headers, timeout: 20000 },
+            res => {
+                const chunks = [];
+                res.on('data', c => chunks.push(c));
+                res.on('end', () => resolve({ status: res.statusCode, headers: res.headers, body: Buffer.concat(chunks).toString('utf8') }));
+            },
+        );
+        req.on('error', reject);
+        req.on('timeout', () => req.destroy(new Error('HTTPS Timeout')));
+        if (body) req.write(body);
+        req.end();
+    });
+}
+
+/** Autorisierungs-URL + PKCE-Challenge erzeugen. */
+function buildAuthorizeUrl(cc) {
+    cc = String(cc).toLowerCase();
+    const clientId = CONSUMER_CLIENT_IDS[cc];
+    if (!clientId) throw new Error(`Unbekanntes Land "${cc}". Unterstützt: ${Object.keys(CONSUMER_CLIENT_IDS).join(', ')}`);
+    const verifier = b64url(crypto.randomBytes(64));
+    const challenge = b64url(crypto.createHash('sha256').update(verifier).digest());
+    const state = b64url(crypto.randomBytes(16));
+    const nonce = b64url(crypto.randomBytes(16));
+    const params = new URLSearchParams({
+        client_id: clientId, response_type: 'code', redirect_uri: REDIRECT_URI,
+        scope: OAUTH_SCOPE, state, nonce,
+        code_challenge: challenge, code_challenge_method: 'S256',
+    });
+    return {
+        url: `https://prod.map.miele-iot.com/${cc}/authorize?${params}`,
+        challenge: { verifier, state, nonce, cc, clientId },
+    };
+}
+
+/** `code` aus miele://oauth2-code/?code=...&state=... extrahieren (mit state-Prüfung). */
+function parseRedirectUrl(redirectUrl, expectedState) {
+    // miele:// ist kein von URL() parsebares Schema in allen Node-Versionen → manuell.
+    const q = redirectUrl.includes('?') ? redirectUrl.slice(redirectUrl.indexOf('?') + 1) : '';
+    const parsed = new URLSearchParams(q);
+    if (parsed.get('error')) throw new Error(`OAuth-Fehler: ${parsed.get('error')} ${parsed.get('error_description') || ''}`);
+    const code = parsed.get('code');
+    if (!code) throw new Error('Kein "code" in der eingefügten Redirect-URL.');
+    const state = parsed.get('state');
+    if (expectedState && state !== expectedState) throw new Error('state stimmt nicht überein (CSRF-Schutz) – bitte Login-URL neu erzeugen.');
+    return code;
+}
+
+/** code → Token. */
+async function exchangeCode(challenge, code) {
+    const body = new URLSearchParams({
+        grant_type: 'authorization_code', code, client_id: challenge.clientId,
+        redirect_uri: REDIRECT_URI, code_verifier: challenge.verifier,
+    }).toString();
+    const res = await httpsRequest('POST', `https://prod.map.miele-iot.com/${challenge.cc}/token`, {
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded', Accept: 'application/json' },
+        body,
+    });
+    let tok;
+    try { tok = JSON.parse(res.body); } catch { throw new Error(`Nicht-JSON-Token-Antwort: ${res.body.slice(0, 200)}`); }
+    if (tok.error) throw new Error(`Token-Endpoint: ${tok.error} ${tok.error_description || ''}`);
+    return tok;
+}
+
+/** Access-Token erneuern (refresh_token kann rotieren). */
+async function refreshAccessToken(cc, refreshToken) {
+    cc = String(cc).toLowerCase();
+    const body = new URLSearchParams({
+        grant_type: 'refresh_token', refresh_token: refreshToken, client_id: CONSUMER_CLIENT_IDS[cc],
+    }).toString();
+    const res = await httpsRequest('POST', `https://prod.map.miele-iot.com/${cc}/token`, {
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded', Accept: 'application/json' },
+        body,
+    });
+    const tok = JSON.parse(res.body);
+    if (tok.error) throw new Error(`Refresh fehlgeschlagen: ${tok.error} ${tok.error_description || ''}`);
+    return tok;
+}
+
+/** GET /V2/GroupKeyId/ → { groupId, groupKey, devices }. */
+async function fetchGroupKey(accessToken, region = 'EU') {
+    const host = REST_HOST_BY_REGION[String(region).toUpperCase()];
+    if (!host) throw new Error(`Unbekannte Region "${region}"`);
+    const res = await httpsRequest('GET', `https://${host}/V2/GroupKeyId/`, {
+        headers: {
+            Authorization: `Bearer ${accessToken}`, Accept: 'application/json',
+            'Accept-Language': 'de-DE', 'User-Agent': 'Miele@mobile 2.3.3 Android',
+        },
+    });
+    if (res.status === 403) throw new Error(`GroupKeyId → 403 (Token ohne mcs-Scope?). ${res.body.slice(0, 150)}`);
+    if (res.status !== 200) throw new Error(`GroupKeyId → HTTP ${res.status}: ${res.body.slice(0, 150)}`);
+    const groups = JSON.parse(res.body);
+    if (!groups || !groups.length) throw new Error('Kein Haushalt zurückgegeben – Konto ohne gekoppelte Geräte?');
+    const g = groups[0];
+    return { groupId: g.groupId, groupKey: g.groupKey, devices: g.devices || [] };
+}
+
+module.exports = {
+    CONSUMER_CLIENT_IDS, REDIRECT_URI, OAUTH_SCOPE, REST_HOST_BY_REGION,
+    buildAuthorizeUrl, parseRedirectUrl, exchangeCode, refreshAccessToken, fetchGroupKey,
+};

package/lib/crypto.js

@@ -0,0 +1,161 @@
+'use strict';
+
+/**
+ * MieleH256 – lokale Signierung & Verschlüsselung für Miele@Home-Geräte (DOP2).
+ *
+ * Verfahren (reverse-engineered, verifiziert gegen WCR860 / G5840 / H2469BP):
+ *   GroupKey = 64 Byte.  AES-Key = erste 32 Byte,  HMAC-Key = alle 64 Byte.
+ *   Signatur = HMAC-SHA256(GroupKey) über
+ *     "METHOD\nHOST/resource\nContent-Type\nAccept\nDate\n" + Body
+ *   Header:  Authorization: MieleH256 <GroupID>:<SIG_HEX_UPPER>
+ *   Antwort: AES-256-CBC, Key = erste 32 Byte, IV = erste 16 Byte der
+ *            Signatur aus dem X-Signature-Antwortheader.
+ *   PUT-Body: auf 16 Byte gepaddet, AES-256-CBC, IV = erste 16 Byte der
+ *            Request-Signatur.
+ */
+
+const crypto = require('node:crypto');
+
+const ACCEPT = 'application/vnd.miele.v1+json';
+const CONTENT_TYPE = 'application/vnd.miele.v1+json; charset=utf-8';
+// Das Gerät wertet das Datum nicht aus – fester Wert wie in der App.
+const DATE = 'Thu, 01 Jan 1970 02:09:22 GMT';
+
+class MieleCrypto {
+    /**
+     * @param {string} groupId  Hex-String (16 Zeichen / 8 Byte)
+     * @param {string} groupKey Hex-String (128 Zeichen / 64 Byte)
+     */
+    constructor(groupId, groupKey) {
+        this.groupId = String(groupId).toUpperCase();
+        this.groupKey = Buffer.from(groupKey, 'hex');
+        if (this.groupKey.length !== 64) {
+            throw new Error(`GroupKey muss 64 Byte sein, ist ${this.groupKey.length}`);
+        }
+        this.aesKey = this.groupKey.subarray(0, 32);
+    }
+
+    /**
+     * HMAC-SHA256-Signatur über den kanonischen String + Body.
+     * @param {string} method  GET/PUT
+     * @param {string} host     z.B. "192.168.10.127"
+     * @param {string} resource Pfad ohne führenden Slash, z.B. "Devices/000149933556/State"
+     * @param {Buffer} [body]   Klartext-Body (bei PUT), sonst leer
+     * @returns {string} Signatur als Großbuchstaben-Hex
+     */
+    sign(method, host, resource, body = Buffer.alloc(0)) {
+        const header = [method, `${host}/${resource}`, CONTENT_TYPE, ACCEPT, DATE].join('\n') + '\n';
+        const payload = Buffer.concat([Buffer.from(header, 'utf8'), body]);
+        return crypto.createHmac('sha256', this.groupKey).update(payload).digest('hex').toUpperCase();
+    }
+
+    /** Header-Objekt inkl. Authorization für einen Request. */
+    headers(method, host, resource, body) {
+        const signature = this.sign(method, host, resource, body);
+        return {
+            headers: {
+                'Content-Type': CONTENT_TYPE,
+                Host: host,
+                'User-Agent': 'Miele@mobile 2.3.3 iOS',
+                Authorization: `MieleH256 ${this.groupId}:${signature}`,
+                Date: DATE,
+                Accept: ACCEPT,
+            },
+            signature,
+        };
+    }
+
+    /** IV = erste 16 Byte einer Hex-Signatur. */
+    static ivFromSignature(sigHex) {
+        return Buffer.from(sigHex, 'hex').subarray(0, 16);
+    }
+
+    /** IV aus dem X-Signature-Antwortheader ("MieleH256 gid:sig"). */
+    static ivFromAuthHeader(authHeader) {
+        const sig = authHeader.slice('MieleH256 '.length).split(':')[1];
+        return MieleCrypto.ivFromSignature(sig);
+    }
+
+    /** Antwortkörper entschlüsseln. */
+    decryptResponse(xSignatureHeader, cipherBuf) {
+        const iv = MieleCrypto.ivFromAuthHeader(xSignatureHeader);
+        const decipher = crypto.createDecipheriv('aes-256-cbc', this.aesKey, iv);
+        decipher.setAutoPadding(false);
+        return Buffer.concat([decipher.update(cipherBuf), decipher.final()]);
+    }
+
+    /** Eingehenden Push-Body entschlüsseln (IV = erste 16 Byte der Authorization-Signatur). */
+    decryptWithSignature(sigHex, cipherBuf) {
+        if (sigHex.length % 2) sigHex = '0' + sigHex;
+        const iv = MieleCrypto.ivFromSignature(sigHex);
+        const decipher = crypto.createDecipheriv('aes-256-cbc', this.aesKey, iv);
+        decipher.setAutoPadding(false);
+        return Buffer.concat([decipher.update(cipherBuf), decipher.final()]);
+    }
+
+    /**
+     * Peer-Antwort signieren & verschlüsseln (für den SuperVision-Handshake).
+     * canonical = "status\nContent-Type\nDate\n" + gepaddeter Body.
+     * @returns {{ body: Buffer, signature: string }}
+     */
+    signResponse(status, date, bodyPlain) {
+        const bodyBuf = MieleCrypto.padResponseBody(Buffer.isBuffer(bodyPlain) ? bodyPlain : Buffer.from(bodyPlain, 'utf8'));
+        const canonical = Buffer.concat([Buffer.from(`${status}\n${CONTENT_TYPE}\n${date}\n`, 'utf8'), bodyBuf]);
+        const sig = crypto.createHmac('sha256', this.groupKey).update(canonical).digest();
+        const iv = sig.subarray(0, 16);
+        let body = Buffer.alloc(0);
+        if (bodyBuf.length) {
+            const cipher = crypto.createCipheriv('aes-256-cbc', this.aesKey, iv);
+            cipher.setAutoPadding(false);
+            body = Buffer.concat([cipher.update(bodyBuf), cipher.final()]);
+        }
+        return { body, signature: `MieleH256 ${this.groupId}:${sig.toString('hex').toUpperCase()}` };
+    }
+
+    /** Response-Padding (JSON auf min. 64 Byte, sonst auf 16 ausrichten). */
+    static padResponseBody(buf) {
+        if (!buf.length) return buf;
+        const isJson = buf[0] === 0x7b && buf[buf.length - 1] === 0x7d; // { … }
+        if (isJson && buf.length < 64) {
+            return Buffer.concat([buf.subarray(0, buf.length - 1), Buffer.alloc(64 - buf.length, 0x20), Buffer.from('}')]);
+        }
+        const rem = buf.length % 16;
+        if (rem === 0 && buf.length >= 64) return buf;
+        const needed = Math.max(64 - buf.length, 0) || (16 - rem);
+        return Buffer.concat([buf, Buffer.alloc(needed, 0x20)]);
+    }
+
+    /**
+     * Klartext-Body für PUT/POST padden.
+     * JSON-Bodys ({ … }) werden auf mind. 64 Byte und 16-Byte-Ausrichtung gebracht,
+     * indem Leerzeichen VOR dem schließenden '}' eingefügt werden (bleibt gültiges JSON).
+     * Andere Bodys werden nur auf die nächste 16-Byte-Grenze aufgefüllt.
+     */
+    static padBody(plain) {
+        let buf = Buffer.isBuffer(plain) ? plain : Buffer.from(plain, 'utf8');
+        if (buf.length === 0) return buf;
+        const isJson = buf[0] === 0x7b && buf[buf.length - 1] === 0x7d; // { … }
+        if (isJson) {
+            let target = Math.max(64, buf.length);
+            if (target % 16) target += 16 - (target % 16);
+            const spaces = target - buf.length;
+            if (spaces > 0) {
+                return Buffer.concat([buf.subarray(0, buf.length - 1), Buffer.alloc(spaces, 0x20), Buffer.from('}')]);
+            }
+            return buf;
+        }
+        const rem = buf.length % 16;
+        if (rem === 0) return buf;
+        return Buffer.concat([buf, Buffer.alloc(16 - rem, 0x20)]);
+    }
+
+    /** PUT-Body verschlüsseln mit IV = erste 16 Byte der Request-Signatur. */
+    encryptBody(paddedBody, signature) {
+        const iv = MieleCrypto.ivFromSignature(signature);
+        const cipher = crypto.createCipheriv('aes-256-cbc', this.aesKey, iv);
+        cipher.setAutoPadding(false);
+        return Buffer.concat([cipher.update(paddedBody), cipher.final()]);
+    }
+}
+
+module.exports = { MieleCrypto, ACCEPT, CONTENT_TYPE, DATE };