nervepay 1.3.5 → 1.3.6

package/bin/nervepay-cli.js

@@ -437,7 +437,9 @@ async function deviceNodePairing(options) {
 
     // Pre-compute crypto outside WS handler to avoid async race conditions
     const pubKeyBytes = decodeBase58(publicKeyBase58);
-    const pubKeyB64 = Buffer.from(pubKeyBytes).toString('base64');
+    // OpenClaw expects base64url encoding (no padding) for public key
+    const pubKeyB64Url = Buffer.from(pubKeyBytes).toString('base64')
+      .replaceAll('+', '-').replaceAll('/', '_').replace(/=+$/, '');
 
     const result = await new Promise((resolve, reject) => {
       let settled = false;
@@ -472,13 +474,36 @@ async function deviceNodePairing(options) {
           const frame = JSON.parse(data.toString());
           logDebug('<<', JSON.stringify(frame).slice(0, 300));
 
-          // Challenge → sign and connect
+          // Challenge → build auth payload, sign, and connect
           if (frame.event === 'connect.challenge') {
             const nonce = frame.payload?.nonce || '';
             logOk('Challenge received');
 
-            const nonceBytes = new TextEncoder().encode(nonce);
-            const signatureB64 = await signRawBytes(privateKey, nonceBytes);
+            const signedAtMs = Date.now();
+            const role = 'operator';
+            const scopes = ['operator.read', 'operator.write'];
+
+            // Build structured payload per OpenClaw device-auth protocol (v2)
+            // Format: v2|deviceId|clientId|clientMode|role|scopes|signedAtMs|token|nonce
+            const payload = [
+              'v2',
+              deviceId,
+              'node-host',
+              'node',
+              role,
+              scopes.join(','),
+              String(signedAtMs),
+              '',  // token (empty for initial connect)
+              nonce,
+            ].join('|');
+
+            logDebug('Auth payload:', payload);
+
+            const payloadBytes = new TextEncoder().encode(payload);
+            const signatureB64 = await signRawBytes(privateKey, payloadBytes);
+            // Convert to base64url (no padding)
+            const signatureB64Url = signatureB64
+              .replaceAll('+', '-').replaceAll('/', '_').replace(/=+$/, '');
 
             connectId = crypto.randomUUID();
             ws.send(JSON.stringify({
@@ -486,10 +511,10 @@ async function deviceNodePairing(options) {
               id: connectId,
               method: 'connect',
               params: {
-                role: 'operator',
+                role,
                 minProtocol: 3,
                 maxProtocol: 3,
-                scopes: ['operator.read', 'operator.write'],
+                scopes,
                 client: {
                   id: 'node-host',
                   version: VERSION,
@@ -498,9 +523,9 @@ async function deviceNodePairing(options) {
                 },
                 device: {
                   id: deviceId,
-                  publicKey: pubKeyB64,
-                  signature: signatureB64,
-                  signedAt: Date.now(),
+                  publicKey: pubKeyB64Url,
+                  signature: signatureB64Url,
+                  signedAt: signedAtMs,
                   nonce,
                 },
               },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nervepay",
-  "version": "1.3.5",
+  "version": "1.3.6",
   "description": "NervePay plugin for OpenClaw - Self-sovereign identity, vault, and orchestration",
   "type": "module",
   "main": "dist/index.js",