tuya-mobile 1.0.0__tar.gz

tuya_mobile-1.0.0/PKG-INFO

@@ -0,0 +1,66 @@
+Metadata-Version: 2.4
+Name: tuya-mobile
+Version: 1.0.0
+Summary: Pure-Python Tuya mobile-app API signer, client, and MQTT signaling credentials (no native libs, no qemu)
+License: MIT
+Project-URL: Homepage, https://github.com/abovecolin/tuya-mobile
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+Requires-Dist: aiohttp
+Requires-Dist: cryptography
+
+# tuya-mobile
+
+Pure-Python reimplementation of Tuya's **mobile-app** API security layer —
+request signing (`thing_security`), the encrypted mobile API client, and the
+MQTT signaling credential derivation.
+
+Tuya apps sign their mobile API requests with a native library
+(`libthing_security.so`). This package reimplements that algorithm in pure
+Python (HMAC-SHA256 / SHA256 / MD5 over ASCII) — so you can call the Tuya mobile
+API with **no external signer service, no qemu, and no native `.so`**.
+
+It is **generic across Tuya-based apps**: only a handful of *application*
+constants differ per app (extracted from that app's APK). Supply them and it
+works.
+
+## What it provides
+
+- **`PurePythonTuyaSigner(app_id, app_secret, cert_sha256_hex, app_key, package)`**
+  — `sign(canonical)`, `derive_key(request_id, ecode)`, `channel_key()`.
+- **`TuyaMobileClient(signer, session)`** — the encrypted mobile API flow
+  (`thing.m.user.third.login`, signed/encrypted `_call`, local-key retrieval,
+  cloud DP get/publish).
+- **`mqtt_credentials(signer, uid=…, ecode=…, partner_id=…)`** — MQTT broker
+  username/password + signaling topics for the `smart/mb` channel.
+- **`mqtt_client_id(package)`** — isolated mobile-format client ID for a
+  secondary client such as a local bridge.
+- **`NativeTuyaSigner`** — optional legacy fallback that shells out to an
+  external signer (executable or HTTP), for parity/testing.
+
+## App credentials
+
+The five app constants (`app_id`, `app_secret`, `cert_sha256_hex`, `app_key`,
+`package`) are the only app-specific inputs; the algorithm is identical across
+Tuya apps. This package intentionally ships **no** vendor credentials — the
+caller supplies them (e.g. `petsseries` supplies the Philips Pet Series values).
+
+## Usage
+
+```python
+import aiohttp
+from tuya_mobile import PurePythonTuyaSigner, TuyaMobileClient
+
+signer = PurePythonTuyaSigner(
+    app_id="…", app_secret="…", cert_sha256_hex="…", app_key="…",
+    package="com.example.app",
+)
+async with aiohttp.ClientSession() as session:
+    client = TuyaMobileClient(signer, session)
+    await client.login_with_jwt(id_token, country_code="1", platform="…")
+    status = await client.get_device_status(device_id)
+```
+
+## License
+
+MIT.

tuya_mobile-1.0.0/README.md

@@ -0,0 +1,55 @@
+# tuya-mobile
+
+Pure-Python reimplementation of Tuya's **mobile-app** API security layer —
+request signing (`thing_security`), the encrypted mobile API client, and the
+MQTT signaling credential derivation.
+
+Tuya apps sign their mobile API requests with a native library
+(`libthing_security.so`). This package reimplements that algorithm in pure
+Python (HMAC-SHA256 / SHA256 / MD5 over ASCII) — so you can call the Tuya mobile
+API with **no external signer service, no qemu, and no native `.so`**.
+
+It is **generic across Tuya-based apps**: only a handful of *application*
+constants differ per app (extracted from that app's APK). Supply them and it
+works.
+
+## What it provides
+
+- **`PurePythonTuyaSigner(app_id, app_secret, cert_sha256_hex, app_key, package)`**
+  — `sign(canonical)`, `derive_key(request_id, ecode)`, `channel_key()`.
+- **`TuyaMobileClient(signer, session)`** — the encrypted mobile API flow
+  (`thing.m.user.third.login`, signed/encrypted `_call`, local-key retrieval,
+  cloud DP get/publish).
+- **`mqtt_credentials(signer, uid=…, ecode=…, partner_id=…)`** — MQTT broker
+  username/password + signaling topics for the `smart/mb` channel.
+- **`mqtt_client_id(package)`** — isolated mobile-format client ID for a
+  secondary client such as a local bridge.
+- **`NativeTuyaSigner`** — optional legacy fallback that shells out to an
+  external signer (executable or HTTP), for parity/testing.
+
+## App credentials
+
+The five app constants (`app_id`, `app_secret`, `cert_sha256_hex`, `app_key`,
+`package`) are the only app-specific inputs; the algorithm is identical across
+Tuya apps. This package intentionally ships **no** vendor credentials — the
+caller supplies them (e.g. `petsseries` supplies the Philips Pet Series values).
+
+## Usage
+
+```python
+import aiohttp
+from tuya_mobile import PurePythonTuyaSigner, TuyaMobileClient
+
+signer = PurePythonTuyaSigner(
+    app_id="…", app_secret="…", cert_sha256_hex="…", app_key="…",
+    package="com.example.app",
+)
+async with aiohttp.ClientSession() as session:
+    client = TuyaMobileClient(signer, session)
+    await client.login_with_jwt(id_token, country_code="1", platform="…")
+    status = await client.get_device_status(device_id)
+```
+
+## License
+
+MIT.

tuya_mobile-1.0.0/pyproject.toml

@@ -0,0 +1,21 @@
+[build-system]
+requires = ["setuptools>=64"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "tuya-mobile"
+version = "1.0.0"
+description = "Pure-Python Tuya mobile-app API signer, client, and MQTT signaling credentials (no native libs, no qemu)"
+readme = "README.md"
+requires-python = ">=3.9"
+license = { text = "MIT" }
+dependencies = [
+    "aiohttp",
+    "cryptography",
+]
+
+[project.urls]
+Homepage = "https://github.com/abovecolin/tuya-mobile"
+
+[tool.setuptools.packages.find]
+include = ["tuya_mobile*"]

tuya_mobile-1.0.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

tuya_mobile-1.0.0/tuya_mobile/__init__.py

@@ -0,0 +1,31 @@
+"""tuya-mobile: pure-Python Tuya *mobile* API signer + client.
+
+A dependency-free reimplementation of Tuya's ``thing_security`` mobile-app
+request signing, the encrypted mobile API client, and the MQTT signaling
+credential derivation. Generic across Tuya-based apps — supply your app's Tuya
+application credentials (extracted from its APK) and it works with no external
+signer service, no qemu, and no native libraries.
+"""
+from .signer import (
+    NativeSignerError,
+    NativeTuyaSigner,
+    PurePythonTuyaSigner,
+    colon_hex,
+)
+from .client import TuyaMobileClient, canonical_string
+from .mqtt_auth import mqtt_client_id, mqtt_credentials, mqtt_password, mqtt_username
+
+__all__ = [
+    "PurePythonTuyaSigner",
+    "NativeTuyaSigner",
+    "NativeSignerError",
+    "colon_hex",
+    "TuyaMobileClient",
+    "canonical_string",
+    "mqtt_credentials",
+    "mqtt_client_id",
+    "mqtt_username",
+    "mqtt_password",
+]
+
+__version__ = "0.1.0"

tuya_mobile-1.0.0/tuya_mobile/client.py

@@ -0,0 +1,219 @@
+"""Encrypted Tuya *mobile* API client (the flow used by Tuya Android apps).
+
+Generic across Tuya apps: the request signing / session-key derivation is
+delegated to a signer (see :mod:`tuya_mobile.signer`), and the app identity
+(``app_id``) comes from that signer or is passed explicitly. Nothing here is
+vendor-specific.
+"""
+from __future__ import annotations
+
+import asyncio
+import base64
+import gzip
+import hashlib
+import json
+import logging
+import os
+import time
+import uuid
+from typing import Any, Dict, Iterable, List, Optional
+
+import aiohttp
+from cryptography.hazmat.primitives.ciphers.aead import AESGCM
+
+_LOGGER = logging.getLogger(__name__)
+
+SIGN_KEYS = {
+    "a", "appVersion", "chKey", "clientId", "deviceId", "et", "h5",
+    "h5Token", "lang", "lat", "lon", "n4h5", "os", "postData", "requestId",
+    "sid", "sp", "time", "ttid", "v",
+}
+
+
+def _swap_md5(value: str) -> str:
+    digest = hashlib.md5(value.encode()).hexdigest()
+    return digest[8:16] + digest[0:8] + digest[24:32] + digest[16:24]
+
+
+def canonical_string(params: Dict[str, str]) -> str:
+    parts = []
+    for key in sorted(params):
+        value = params[key]
+        if key in SIGN_KEYS and value:
+            if key == "postData":
+                value = _swap_md5(value)
+            parts.append(f"{key}={value}")
+    return "||".join(parts)
+
+
+def _encrypt(key: bytes, payload: Dict[str, Any]) -> str:
+    nonce = os.urandom(12)
+    body = json.dumps(payload, separators=(",", ":"), ensure_ascii=False).encode()
+    return base64.b64encode(nonce + AESGCM(key).encrypt(nonce, body, None)).decode()
+
+
+def _decrypt(key: bytes, value: str) -> Dict[str, Any]:
+    raw = base64.b64decode(value)
+    plain = AESGCM(key).decrypt(raw[:12], raw[12:], None)
+    try:
+        plain = gzip.decompress(plain)
+    except OSError:
+        pass
+    return json.loads(plain.decode())
+
+
+def _walk(value: Any) -> Iterable[Dict[str, Any]]:
+    if isinstance(value, dict):
+        yield value
+        for child in value.values():
+            yield from _walk(child)
+    elif isinstance(value, list):
+        for child in value:
+            yield from _walk(child)
+
+
+class TuyaMobileClient:
+    """Call the encrypted Tuya mobile endpoints used by Tuya Android apps."""
+
+    BASE_URL = "https://a1.tuyaeu.com/api.json"
+    APP_VERSION = "2.2.1"
+
+    def __init__(
+        self,
+        signer,
+        session: aiohttp.ClientSession,
+        *,
+        app_id: Optional[str] = None,
+        device_id: str = "",
+    ) -> None:
+        self.signer = signer
+        self.session = session
+        # App identity comes from the signer (which holds the app credentials)
+        # unless overridden explicitly.
+        self.app_id = app_id or getattr(signer, "app_id", "") or ""
+        self.sid: Optional[str] = None
+        self.ecode: Optional[str] = None
+        self.uid: Optional[str] = None
+        self.mobile_url = self.BASE_URL
+        # Tuya validates a stable installation ID; supply the captured value.
+        self.device_id = device_id or os.environ.get("PETSERIES_TUYA_DEVICE_ID", "")
+
+    async def _call(self, action: str, payload: Dict[str, Any], *, version: str = "1.0") -> Dict[str, Any]:
+        request_id = str(uuid.uuid4())
+        key = await asyncio.to_thread(self.signer.derive_key, request_id, self.ecode)
+        encrypted = _encrypt(key, payload)
+        params: Dict[str, str] = {
+            "a": action,
+            "v": version,
+            "clientId": self.app_id,
+            "os": "Android",
+            "appVersion": self.APP_VERSION,
+            "channel": "sdk",
+            "osSystem": "14",
+            "sdkVersion": "6.7.0",
+            "deviceCoreVersion": "6.7.0",
+            "platform": "Pixel 7",
+            "timeZoneId": os.environ.get("PETSERIES_TUYA_TIMEZONE") or "UTC",
+            "cp": "gzip",
+            "nd": "1",
+            "bizDM": "ipc",
+            "lang": os.environ.get("PETSERIES_TUYA_LANG") or "en",
+            "ttid": "android",
+            "et": "3",
+            "chKey": await asyncio.to_thread(self.signer.channel_key),
+            "deviceId": self.device_id or self.uid or "",
+            "time": str(int(time.time())),
+            "requestId": request_id,
+            "postData": encrypted,
+        }
+        if self.sid:
+            params["sid"] = self.sid
+        params["sign"] = await asyncio.to_thread(self.signer.sign, canonical_string(params))
+        async with self.session.post(self.mobile_url, data=params) as response:
+            envelope = await response.json(content_type=None)
+        if "result" not in envelope:
+            error_code = envelope.get("errorCode") or envelope.get("code") or "unknown"
+            error_msg = envelope.get("errorMsg") or envelope.get("msg") or "no result"
+            raise RuntimeError(f"Tuya mobile API request {action} failed: {error_code} {error_msg}")
+        return _decrypt(key, envelope["result"])
+
+    async def login_with_jwt(self, id_token: str, country_code: str = "",
+                             platform: str = "PhilipsDA") -> Dict[str, Any]:
+        """Third-party (JWT) login. ``platform`` is the app's third-party tag."""
+        result = await self._call(
+            "thing.m.user.third.login",
+            {
+                "countryCode": country_code or os.environ.get("PETSERIES_TUYA_COUNTRY_CODE") or "1",
+                "accessToken": id_token,
+                "type": "jwt",
+                "extraInfo": json.dumps({"platform": platform}),
+                "options": '{"group": 1}',
+            },
+        )
+        data: Dict[str, Any] = result
+        while isinstance(data.get("result"), dict):
+            data = data["result"]
+        self.sid = data.get("sid") or data.get("session") or data.get("sessionId")
+        self.ecode = data.get("ecode") or data.get("eCode") or data.get("encryptCode")
+        self.uid = data.get("uid") or data.get("userId")
+        if data.get("success") is False or data.get("errorCode") or data.get("errorMsg"):
+            raise RuntimeError(
+                "Tuya third-party login failed: "
+                f"{data.get('errorCode') or 'unknown'} {data.get('errorMsg') or ''}".strip()
+            )
+        if not isinstance(self.ecode, str) or not self.ecode:
+            raise RuntimeError("Tuya third-party login returned no encryption code")
+        mobile_url = data.get("domain", {}).get("mobileApiUrl") or data.get("mobileApiUrl")
+        if mobile_url:
+            self.mobile_url = mobile_url.rstrip("/") + "/api.json"
+        if not self.sid:
+            raise RuntimeError("Tuya third-party login returned no session")
+        return data
+
+    # Back-compat alias (petsseries historically called this name).
+    login_with_philips_token = login_with_jwt
+
+    async def get_local_keys(self, device_ids: List[str]) -> List[Dict[str, Any]]:
+        homes = await self._call("m.life.home.space.list", {})
+        wanted = set(device_ids)
+        records = []
+        gids = {
+            obj.get("gid") or obj.get("groupId") or obj.get("homeId")
+            for obj in _walk(homes)
+            if obj.get("gid") or obj.get("groupId") or obj.get("homeId")
+        }
+        for gid in gids:
+            response = await self._call("m.life.my.group.device.list", {"gid": gid}, version="2.2")
+            for obj in _walk(response):
+                local_key = obj.get("localKey") or obj.get("local_key")
+                device_id = obj.get("devId") or obj.get("deviceId") or obj.get("id")
+                if local_key and (not wanted or str(device_id) in wanted):
+                    records.append({
+                        "device_id": device_id, "local_key": local_key,
+                        "ip": obj.get("ip") or obj.get("lanIp"), "name": obj.get("name"),
+                        "uuid": obj.get("uuid"),
+                        "is_online": obj.get("isOnline", obj.get("cloudOnline")),
+                    })
+        unique = {(str(i.get("device_id")), str(i.get("local_key"))): i for i in records}
+        return list(unique.values())
+
+    async def get_device_status(self, device_id: str, gateway_id: str = "") -> Dict[str, Any]:
+        result = await self._call("s.m.dev.dp.get", {"devId": device_id, "gwId": gateway_id})
+        if result.get("success") is False or result.get("errorCode") or result.get("errorMsg"):
+            raise RuntimeError(
+                "Tuya status request failed: "
+                f"{result.get('errorCode') or 'unknown'} {result.get('errorMsg') or ''}".strip()
+            )
+        return result
+
+    async def publish_dps(self, device_id: str, dps: Dict[str, Any], gateway_id: str = "") -> Dict[str, Any]:
+        result = await self._call(
+            "thing.m.device.dp.publish",
+            {"devId": device_id, "gwId": gateway_id, "dps": json.dumps(dps, separators=(",", ":"))},
+        )
+        if result.get("success") is False or result.get("errorCode") or result.get("errorMsg"):
+            raise RuntimeError(
+                "Tuya DP publish failed: "
+                f"{result.get('errorCode') or 'unknown'} {result.get('errorMsg') or ''}".strip()
+            )
+        return result

tuya_mobile-1.0.0/tuya_mobile/mqtt_auth.py

@@ -0,0 +1,78 @@
+"""Tuya mobile MQTT signaling credentials (pure Python).
+
+Implements the Tuya Android SDK scheme (``com.thingclips.sdk.mqtt``):
+the MQTT broker username/password are a straightforward MD5-hex derivation over
+session fields — no native code involved (``MD5Util.md5AsBase64`` is misnamed;
+it returns MD5 *hex*). Source references:
+
+* password  (``dbqqppp.qddqppb``): ``md5hex(ecode)[8:24]``
+* username  (``dbpdpbp.bdpdqbp``):
+    ``partner_id + "_v1_" + app_id + "_" + chKey + "_mb_" + token +
+      md5hex(md5hex(app_id) + ecode)[-16:]``
+
+``chKey`` is the signer's ``channel_key()``; ``token`` is the session token
+(the login ``uid`` in observed traffic); ``partner_id`` is the app's Tuya
+partner prefix (e.g. ``p2065237`` for the Philips app).
+
+NOTE: the MQTT ``client_id`` derivation (ends ``_DEFAULT``) is not yet confirmed
+byte-for-byte and is validated during camera-bridge bring-up.
+"""
+from __future__ import annotations
+
+import hashlib
+import secrets
+from typing import Optional
+
+
+def _md5hex(value: str) -> str:
+    return hashlib.md5(value.encode()).hexdigest()
+
+
+def mqtt_password(global_material: str, ecode: str) -> str:
+    """16-char MQTT password.
+
+    Verified against a live device capture: the SDK's native command 2 computes
+    ``md5(md5(G) + ecode)`` (32 hex) and takes its middle 16 chars, where ``G``
+    is the signer's global key material (package_colonCert_appKey_appSecret).
+    """
+    return _md5hex(_md5hex(global_material) + ecode)[8:24]
+
+
+def mqtt_username(app_id: str, ch_key: str, sid: str, ecode: str,
+                  partner_id: str) -> str:
+    """MQTT username for the ``smart/mb`` signaling channel.
+
+    Verified against a live device capture: the ``_mb_`` body is the session
+    ``sid`` followed by ``md5(md5(app_id) + ecode)[-16:]`` (the "token" the SDK
+    concatenates is the sid, not the uid).
+    """
+    tail = _md5hex(_md5hex(app_id) + ecode)[-16:]
+    return f"{partner_id}_v1_{app_id}_{ch_key}_mb_{sid}{tail}"
+
+
+def mqtt_client_id(package: str, *, installation_id: Optional[str] = None,
+                   tag: str = "DEFAULT") -> str:
+    """Create a mobile MQTT client ID in the SDK's accepted shape.
+
+    The opaque installation component is not an account credential. Generating
+    a fresh one lets a local bridge coexist with the official app.
+    """
+    install = installation_id or secrets.token_hex(24)
+    return f"{package}_mb_{install}_{tag}"
+
+
+def mqtt_credentials(signer, *, uid: str, sid: str, ecode: str,
+                     partner_id: str) -> dict:
+    """Build the MQTT signaling credentials from a signer + session fields.
+
+    ``signer`` supplies ``app_id`` and ``channel_key()``. The username embeds the
+    session ``sid``; the topics use the ``uid``.
+    """
+    ch_key = signer.channel_key()
+    return {
+        "username": mqtt_username(signer.app_id, ch_key, sid, ecode, partner_id),
+        "password": mqtt_password(signer.global_material(), ecode),
+        # Subscribe/publish topics for the mobile signaling channel.
+        "publish_topic": f"smart/mb/in/{uid}",
+        "subscribe_topic": f"smart/mb/out/{uid}",
+    }

tuya_mobile-1.0.0/tuya_mobile/signer.py

@@ -0,0 +1,186 @@
+"""Pure-Python reimplementation of Tuya's ``thing_security`` mobile signer.
+
+Implements the Tuya mobile signing scheme:
+computes three things, and all three are plain HMAC-SHA256 / SHA256 over ASCII
+inputs — there is no whitebox cipher and no native dependency. This lets any
+Tuya *mobile* app's API be called with no external signer, no qemu, and no
+native blobs.
+
+Everything hangs off one "global key material" string::
+
+    G = package + "_" + colon_hex(cert) + "_" + app_key + "_" + app_secret
+
+Primitives (ASCII in/out):
+
+* ``channel_key()`` -> ``HMAC_SHA256(app_id, package + "_" + colon_hex(cert)).hex()[8:16]``
+* ``derive_key(request_id, ecode)`` -> 16-byte AES key = ASCII of
+  ``HMAC_SHA256(request_id, G [+ "_" + ecode]).hex()[:16]``
+* ``sign(canonical)`` -> ``HMAC_SHA256(SHA256(G), canonical).hex()``
+
+The signer is **parameterized by the app's Tuya application credentials**
+(``app_id``, ``app_secret``, ``cert_sha256_hex``, ``app_key``, ``package``).
+These are constant per app (extracted from that app's APK) and are the only
+app-specific inputs — the algorithm itself is generic across Tuya apps.
+"""
+from __future__ import annotations
+
+import hashlib
+import hmac
+import json
+import os
+import subprocess
+import urllib.request
+from pathlib import Path
+from typing import Optional
+
+
+class NativeSignerError(RuntimeError):
+    """A configured external signer failed or returned invalid output."""
+
+
+def colon_hex(cert_sha256_hex: str) -> str:
+    """Render a cert SHA-256 as uppercase, colon-separated hex (Android style)."""
+    h = cert_sha256_hex.replace(":", "").strip()
+    return ":".join(h[i : i + 2] for i in range(0, len(h), 2)).upper()
+
+
+class PurePythonTuyaSigner:
+    """Drop-in ``thing_security`` signer implemented in pure Python."""
+
+    def __init__(
+        self,
+        app_id: str,
+        app_secret: str,
+        cert_sha256_hex: str,
+        app_key: str,
+        package: str,
+    ) -> None:
+        self.app_id = app_id
+        self.app_secret = app_secret
+        self.cert_sha256_hex = cert_sha256_hex
+        self.app_key = app_key
+        self.package = package
+
+    # -- internal helpers ------------------------------------------------
+    def cert_msg(self) -> str:
+        return f"{self.package}_{colon_hex(self.cert_sha256_hex)}"
+
+    def global_material(self) -> str:
+        """The shared "global key material" string G."""
+        return f"{self.cert_msg()}_{self.app_key}_{self.app_secret}"
+
+    def _signing_key(self) -> bytes:
+        return hashlib.sha256(self.global_material().encode()).digest()
+
+    # -- public interface ------------------------------------------------
+    def sign(self, canonical: str) -> str:
+        """Sign a canonical request string -> lowercase hex HMAC-SHA256."""
+        return hmac.new(
+            self._signing_key(), canonical.encode(), hashlib.sha256
+        ).hexdigest()
+
+    def derive_key(self, request_id: str, ecode: Optional[str]) -> bytes:
+        """Return the 16-byte per-request AES key."""
+        g = self.global_material()
+        message = g if not ecode else f"{g}_{ecode}"
+        digest = hmac.new(
+            request_id.encode(), message.encode(), hashlib.sha256
+        ).hexdigest()
+        return digest[:16].encode()
+
+    def channel_key(self) -> str:
+        """Return the account/app-global channel key (chKey)."""
+        return hmac.new(
+            self.app_id.encode(), self.cert_msg().encode(), hashlib.sha256
+        ).hexdigest()[8:16]
+
+
+class NativeTuyaSigner:
+    """Legacy adapter that shells out to an external signer (executable or HTTP).
+
+    Kept only as a fallback for environments that prefer to delegate signing to
+    an out-of-process ``thing_security`` (e.g. a qemu-hosted native lib). The
+    pure-Python signer above is preferred and needs none of this.
+
+    The command must implement: ``sign`` (canonical on stdin -> hex),
+    ``key <request_id> <ecode>`` (-> hex AES key), ``chkey`` (-> channel key).
+    """
+
+    def __init__(
+        self,
+        command: "str | os.PathLike[str]",
+        *,
+        app_id: str,
+        app_secret: str,
+        cert_sha256: str,
+        key_global: Optional[str] = None,
+        android_root: "Optional[str | os.PathLike[str]]" = None,
+        service_token: str = "",
+    ) -> None:
+        raw = str(command)
+        self.command = raw if raw.startswith(("http://", "https://")) else str(Path(raw).expanduser())
+        self.android_root = str(android_root) if android_root else None
+        self.service_token = service_token or os.environ.get("TUYA_SIGNER_SERVICE_TOKEN", "")
+        self.environment = os.environ.copy()
+        self.environment.update(
+            TUYA_APP_ID=app_id, TUYA_APP_SECRET=app_secret, TUYA_CERT_SHA256_HEX=cert_sha256
+        )
+        if key_global:
+            self.environment["TUYA_KEY_GLOBAL"] = key_global
+
+    def _run(self, operation: str, *arguments: str, stdin: Optional[str] = None,
+             extra_env: Optional[dict] = None) -> str:
+        if self.command.startswith(("http://", "https://")):
+            payload = {
+                "operation": operation, "arguments": list(arguments),
+                "stdin": stdin or "", "canonical": (extra_env or {}).get("TUYA_CANONICAL_STRING", ""),
+            }
+            req = urllib.request.Request(
+                self.command, data=json.dumps(payload).encode(),
+                headers={"Content-Type": "application/json",
+                         "Authorization": f"Bearer {self.service_token}"},
+                method="POST",
+            )
+            try:
+                with urllib.request.urlopen(req, timeout=25) as resp:
+                    result = json.loads(resp.read())
+            except Exception as exc:
+                raise NativeSignerError(f"Signer service request failed: {exc}") from exc
+            if not result.get("ok"):
+                raise NativeSignerError(result.get("error", "Signer service failed"))
+            value = str(result.get("value", "")).strip()
+            if not value:
+                raise NativeSignerError(f"Signer op {operation!r} returned no output")
+            return value
+        env = self.environment.copy()
+        if extra_env:
+            env.update(extra_env)
+        if self.android_root:
+            env["PETSERIES_TUYA_ANDROID_ROOT"] = self.android_root
+        try:
+            done = subprocess.run([self.command, operation, *arguments], input=stdin,
+                                  text=True, capture_output=True, check=False, env=env, timeout=20)
+        except OSError as exc:
+            raise NativeSignerError(f"Unable to execute signer: {exc}") from exc
+        if done.returncode:
+            raise NativeSignerError(f"Signer op {operation!r} failed: {done.stderr.strip()[-400:]}")
+        value = done.stdout.strip()
+        if not value:
+            raise NativeSignerError(f"Signer op {operation!r} returned no output")
+        return value
+
+    def sign(self, canonical: str) -> str:
+        return self._run("sign", extra_env={"TUYA_CANONICAL_STRING": canonical})
+
+    def derive_key(self, request_id: str, ecode: Optional[str]) -> bytes:
+        value = self._run("key", request_id, ecode or "-")
+        try:
+            result = bytes.fromhex(value)
+        except ValueError as exc:
+            raise NativeSignerError("Signer returned an invalid key") from exc
+        if len(result) not in (16, 24, 32):
+            raise NativeSignerError("Signer returned an unexpected key length")
+        return result
+
+    def channel_key(self) -> str:
+        return self._run("chkey")

tuya_mobile-1.0.0/tuya_mobile.egg-info/PKG-INFO

@@ -0,0 +1,66 @@
+Metadata-Version: 2.4
+Name: tuya-mobile
+Version: 1.0.0
+Summary: Pure-Python Tuya mobile-app API signer, client, and MQTT signaling credentials (no native libs, no qemu)
+License: MIT
+Project-URL: Homepage, https://github.com/abovecolin/tuya-mobile
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+Requires-Dist: aiohttp
+Requires-Dist: cryptography
+
+# tuya-mobile
+
+Pure-Python reimplementation of Tuya's **mobile-app** API security layer —
+request signing (`thing_security`), the encrypted mobile API client, and the
+MQTT signaling credential derivation.
+
+Tuya apps sign their mobile API requests with a native library
+(`libthing_security.so`). This package reimplements that algorithm in pure
+Python (HMAC-SHA256 / SHA256 / MD5 over ASCII) — so you can call the Tuya mobile
+API with **no external signer service, no qemu, and no native `.so`**.
+
+It is **generic across Tuya-based apps**: only a handful of *application*
+constants differ per app (extracted from that app's APK). Supply them and it
+works.
+
+## What it provides
+
+- **`PurePythonTuyaSigner(app_id, app_secret, cert_sha256_hex, app_key, package)`**
+  — `sign(canonical)`, `derive_key(request_id, ecode)`, `channel_key()`.
+- **`TuyaMobileClient(signer, session)`** — the encrypted mobile API flow
+  (`thing.m.user.third.login`, signed/encrypted `_call`, local-key retrieval,
+  cloud DP get/publish).
+- **`mqtt_credentials(signer, uid=…, ecode=…, partner_id=…)`** — MQTT broker
+  username/password + signaling topics for the `smart/mb` channel.
+- **`mqtt_client_id(package)`** — isolated mobile-format client ID for a
+  secondary client such as a local bridge.
+- **`NativeTuyaSigner`** — optional legacy fallback that shells out to an
+  external signer (executable or HTTP), for parity/testing.
+
+## App credentials
+
+The five app constants (`app_id`, `app_secret`, `cert_sha256_hex`, `app_key`,
+`package`) are the only app-specific inputs; the algorithm is identical across
+Tuya apps. This package intentionally ships **no** vendor credentials — the
+caller supplies them (e.g. `petsseries` supplies the Philips Pet Series values).
+
+## Usage
+
+```python
+import aiohttp
+from tuya_mobile import PurePythonTuyaSigner, TuyaMobileClient
+
+signer = PurePythonTuyaSigner(
+    app_id="…", app_secret="…", cert_sha256_hex="…", app_key="…",
+    package="com.example.app",
+)
+async with aiohttp.ClientSession() as session:
+    client = TuyaMobileClient(signer, session)
+    await client.login_with_jwt(id_token, country_code="1", platform="…")
+    status = await client.get_device_status(device_id)
+```
+
+## License
+
+MIT.

tuya_mobile-1.0.0/tuya_mobile.egg-info/SOURCES.txt

@@ -0,0 +1,11 @@
+README.md
+pyproject.toml
+tuya_mobile/__init__.py
+tuya_mobile/client.py
+tuya_mobile/mqtt_auth.py
+tuya_mobile/signer.py
+tuya_mobile.egg-info/PKG-INFO
+tuya_mobile.egg-info/SOURCES.txt
+tuya_mobile.egg-info/dependency_links.txt
+tuya_mobile.egg-info/requires.txt
+tuya_mobile.egg-info/top_level.txt

tuya_mobile-1.0.0/tuya_mobile.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

tuya_mobile-1.0.0/tuya_mobile.egg-info/requires.txt

@@ -0,0 +1,2 @@
+aiohttp
+cryptography

tuya_mobile-1.0.0/tuya_mobile.egg-info/top_level.txt

@@ -0,0 +1 @@
+tuya_mobile