@camstack/addon-provider-wyze 0.1.7 → 0.1.8

package/dist/addon.mjs

@@ -1,6 +1,6 @@
 import { createRequire } from "node:module";
-import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { createCipheriv, createDecipheriv, createHash, createHmac, createPublicKey, diffieHellman, generateKeyPairSync, randomBytes } from "crypto";
 import * as dgram from "dgram";
 import { EventEmitter } from "events";
@@ -6623,6 +6623,18 @@ method(object({ deviceId: number() }), array(StreamSourceEntrySchema)), method(o
 	input: unknown()
 }), unknown(), { kind: "mutation" }), method(object({ deviceId: number() }), _void(), { kind: "mutation" }), method(object({ deviceId: number() }), unknown().nullable()), method(object({ deviceId: number() }), RawStateResultSchema.nullable(), { auth: "protected" });
 //#endregion
+//#region ../types/dist/err-msg-IQTHeDzc.mjs
+/**
+import { errMsg } from '@camstack/types'
+* Extract a human-readable message from an unknown error value.
+* Replaces the ubiquitous `errMsg(err)` pattern.
+*/
+function errMsg(err) {
+	if (err instanceof Error) return err.message;
+	if (typeof err === "string") return err;
+	return String(err);
+}
+//#endregion
 //#region ../types/dist/index.mjs
 /**
 * Deep wiring healthcheck — snapshot of active reachability probes across
@@ -15027,19 +15039,36 @@ var ResyncResultSchema = object({
 	*  provider re-derived the device. 0/absent for a normal incremental re-sync. */
 	removedChildren: number().int().nonnegative().optional()
 });
-method(object({ integrationId: string() }), object({ filters: array(AdoptionFilterSchema) }), { auth: "admin" }), method(ListCandidatesInputSchema, ListCandidatesOutputSchema, { auth: "admin" }), method(GetCandidateInputSchema, DiscoveredChildDeviceSchema.nullable(), { auth: "admin" }), method(object({ integrationId: string() }), AdoptionStatusSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(AdoptInputSchema, AdoptResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(ReleaseInputSchema, _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(ResyncInputSchema, ResyncResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-});
+var deviceAdoptionCapability = {
+	name: "device-adoption",
+	scope: "system",
+	mode: "singleton",
+	status: {
+		schema: AdoptionStatusSchema,
+		kind: "poll"
+	},
+	methods: {
+		listCandidateFilters: method(object({ integrationId: string() }), object({ filters: array(AdoptionFilterSchema) }), { auth: "admin" }),
+		listCandidates: method(ListCandidatesInputSchema, ListCandidatesOutputSchema, { auth: "admin" }),
+		getCandidate: method(GetCandidateInputSchema, DiscoveredChildDeviceSchema.nullable(), { auth: "admin" }),
+		refresh: method(object({ integrationId: string() }), AdoptionStatusSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		adopt: method(AdoptInputSchema, AdoptResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		release: method(ReleaseInputSchema, _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		resync: method(ResyncInputSchema, ResyncResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		})
+	}
+};
 /**
 * `device-export` — collection cap for addons that export camstack
 * devices to external ecosystems (HomeAssistant via MQTT discovery,
@@ -18272,6 +18301,17 @@ var AvailableIntegrationTypeSchema = object({
 	iconUrl: string().nullable(),
 	color: string(),
 	instanceMode: string(),
+	/**
+	* Integration wizard `mode` (LOCKED MODEL): `standalone` (create
+	* immediately then add devices, no config step/button), `account` (config
+	* step), or `broker` (broker step). Derived server-side by
+	* `getAvailableTypes` when the addon manifest omits an explicit `mode`.
+	*/
+	mode: _enum([
+		"standalone",
+		"account",
+		"broker"
+	]),
 	discoveryMode: string(),
 	/**
 	* Which integration-marker cap the addon declared, so the wizard can
@@ -27170,6 +27210,147 @@ var WyzeCloudClient = class {
 	}
 };
 //#endregion
+//#region src/error-classifier.ts
+function isWyzeAuthError(err) {
+	return typeof err === "object" && err !== null && "needsMfa" in err && err.needsMfa === true;
+}
+function classifyCloudError(err) {
+	if (isWyzeAuthError(err)) return {
+		kind: "mfa",
+		message: `Wyze account requires MFA${typeof err.mfaType === "string" ? ` (${err.mfaType})` : ""}. The bridge library has no MFA-completion flow — use a sub-account or disable MFA on this account.`
+	};
+	const message = err instanceof Error ? err.message : String(err);
+	const lower = message.toLowerCase();
+	if (lower.includes("429") || lower.includes("too many") || lower.includes("rate")) return {
+		kind: "rate-limited",
+		message: `Wyze auth is rate-limited (~1 request / 30s per IP). Retry later — the session is persisted and reused to avoid this. ${message}`
+	};
+	if (lower.includes("password") || lower.includes("credential") || lower.includes("login failed") || lower.includes("access token") || lower.includes("unauthorized")) return {
+		kind: "credentials",
+		message: `Wyze login failed — check email / password / API key / Key ID. ${message}`
+	};
+	if (lower.includes("dtls") || lower.includes("keyframe") || lower.includes("p2p") || lower.includes("discover") || lower.includes("handshake") || lower.includes("kauth")) return {
+		kind: "p2p",
+		message: `Wyze P2P session failed (DTLS / discovery / keyframe). ${message}`
+	};
+	return {
+		kind: "unknown",
+		message
+	};
+}
+//#endregion
+//#region src/client-registry.ts
+/**
+* Per-integration Wyze cloud client registry (account mode).
+*
+* Under the LOCKED integration/adoption model, Wyze is a `mode: account`
+* addon: each Wyze integration carries its own account credentials in its
+* `integration.settings`, and this registry holds one
+* {@link WyzeCloudClient} per `integrationId`
+* (`Map<integrationId, WyzeCloudClient>`). Multi-account = multiple
+* integrations; there is NO shared broker.
+*
+* Each client's persisted session lives under a per-integration
+* subdirectory of `dataDir` so two accounts never clobber each other's
+* `wyze-session.json`.
+*
+* The registry also owns a per-integration camera-list cache (debounced to
+* respect Wyze's auth rate-limit) so both the adoption provider and the
+* live cameras read a single shared, rate-safe list per account.
+*/
+var CAMERA_LIST_REFRESH_MS = 5 * 6e4;
+/** True when two credential blobs are identical (session-preserving reconcile). */
+function sameCredentials(a, b) {
+	return a.email === b.email && a.password === b.password && a.apiKey === b.apiKey && a.apiId === b.apiId;
+}
+/**
+* Owns the `Map<integrationId, WyzeCloudClient>`. Callers reconcile the map
+* against the live integration list on boot + on every integration lifecycle
+* event; device classes + the adoption provider resolve their client by
+* `integrationId`.
+*/
+var WyzeClientRegistry = class {
+	#entries = /* @__PURE__ */ new Map();
+	#deps;
+	constructor(deps) {
+		this.#deps = deps;
+	}
+	/**
+	* Ensure a client exists for `integrationId` with the given credentials.
+	* Idempotent: an existing entry with identical credentials is preserved
+	* (keeps its live session + cache); a credentials change rebuilds it.
+	*/
+	upsert(integrationId, credentials) {
+		const existing = this.#entries.get(integrationId);
+		if (existing && sameCredentials(existing.credentials, credentials)) return;
+		const client = new WyzeCloudClient({
+			dataDir: join(this.#deps.dataDir, "integrations", integrationId),
+			logger: this.#deps.logger.child(`cloud:${integrationId}`),
+			credentials
+		});
+		this.#entries.set(integrationId, {
+			client,
+			credentials,
+			cameraListCache: [],
+			cameraListFetchedAt: 0,
+			cameraListInFlight: null
+		});
+	}
+	/** Drop the client for an integration that no longer exists / was disabled. */
+	remove(integrationId) {
+		this.#entries.delete(integrationId);
+	}
+	/** Replace the whole set with `keep` — removes any client not in the set. */
+	retain(keep) {
+		for (const id of [...this.#entries.keys()]) if (!keep.has(id)) this.#entries.delete(id);
+	}
+	/** The live client for an integration, or null when unknown. */
+	client(integrationId) {
+		return this.#entries.get(integrationId)?.client ?? null;
+	}
+	/** True when a client is registered for the integration. */
+	has(integrationId) {
+		return this.#entries.has(integrationId);
+	}
+	/** The registered integration ids (one per account). */
+	list() {
+		return [...this.#entries.keys()];
+	}
+	/** Remove all clients (full shutdown). */
+	clear() {
+		this.#entries.clear();
+	}
+	/**
+	* Cloud camera list for ONE integration, cached + debounced + single-flight
+	* to avoid auth rate-limits. Returns the last cache (possibly empty) when the
+	* integration is unknown or the fetch fails.
+	*/
+	async getCameraList(integrationId, force = false) {
+		const entry = this.#entries.get(integrationId);
+		if (!entry) return [];
+		const fresh = Date.now() - entry.cameraListFetchedAt < CAMERA_LIST_REFRESH_MS;
+		if (!force && fresh && entry.cameraListCache.length > 0) return entry.cameraListCache;
+		if (entry.cameraListInFlight) return entry.cameraListInFlight;
+		const run = entry.client.getCameraList().then((cams) => {
+			entry.cameraListCache = cams;
+			entry.cameraListFetchedAt = Date.now();
+			return cams;
+		}).catch((err) => {
+			const classified = classifyCloudError(err);
+			this.#deps.logger.error("Wyze getCameraList failed", { meta: {
+				integrationId,
+				kind: classified.kind,
+				error: classified.message
+			} });
+			return entry.cameraListCache;
+		}).finally(() => {
+			entry.cameraListInFlight = null;
+		});
+		entry.cameraListInFlight = run;
+		return run;
+	}
+};
+//#endregion
 //#region src/constants.ts
 /**
 * Single source of truth for the Wyze provider addon id. Must match the
@@ -27408,35 +27589,6 @@ function buildSettingsSchema() {
 	}] };
 }
 //#endregion
-//#region src/error-classifier.ts
-function isWyzeAuthError(err) {
-	return typeof err === "object" && err !== null && "needsMfa" in err && err.needsMfa === true;
-}
-function classifyCloudError(err) {
-	if (isWyzeAuthError(err)) return {
-		kind: "mfa",
-		message: `Wyze account requires MFA${typeof err.mfaType === "string" ? ` (${err.mfaType})` : ""}. The bridge library has no MFA-completion flow — use a sub-account or disable MFA on this account.`
-	};
-	const message = err instanceof Error ? err.message : String(err);
-	const lower = message.toLowerCase();
-	if (lower.includes("429") || lower.includes("too many") || lower.includes("rate")) return {
-		kind: "rate-limited",
-		message: `Wyze auth is rate-limited (~1 request / 30s per IP). Retry later — the session is persisted and reused to avoid this. ${message}`
-	};
-	if (lower.includes("password") || lower.includes("credential") || lower.includes("login failed") || lower.includes("access token") || lower.includes("unauthorized")) return {
-		kind: "credentials",
-		message: `Wyze login failed — check email / password / API key / Key ID. ${message}`
-	};
-	if (lower.includes("dtls") || lower.includes("keyframe") || lower.includes("p2p") || lower.includes("discover") || lower.includes("handshake") || lower.includes("kauth")) return {
-		kind: "p2p",
-		message: `Wyze P2P session failed (DTLS / discovery / keyframe). ${message}`
-	};
-	return {
-		kind: "unknown",
-		message
-	};
-}
-//#endregion
 //#region src/mapping.ts
 /** Canonical camstack codec name from the lib's `videoType`. */
 function codecFromVideoType(videoType) {
@@ -27468,9 +27620,14 @@ function stableIdForMac(mac) {
 * Reduce a cloud `WyzeCamera` blob to the persisted camera config. Pure:
 * `resolution` / `bitrate` / `motionSource` carry their schema defaults
 * here (the device config schema re-applies them on parse).
+*
+* `integrationId` stamps the owning account so the camera resolves its
+* per-account cloud client from the registry. Defaults to `''` (legacy
+* single-global-credentials cameras) when not supplied by the adopt path.
 */
-function cameraConfigFromCloud(cam) {
+function cameraConfigFromCloud(cam, integrationId = "") {
 	return {
+		integrationId,
 		mac: cam.mac,
 		p2pId: cam.p2pId,
 		enr: cam.enr,
@@ -27536,6 +27693,15 @@ var WyzeResolutionSchema = _enum([
 var WyzeBitrateSchema = _enum(["max", "sd"]);
 var WyzeMotionSourceSchema = _enum(["cloud", "boa"]);
 var wyzeCameraSchema = object({
+	/**
+	* Owning Wyze integration id (account). Stamped at adopt/create so the
+	* camera resolves its per-account {@link WyzeCloudClient} from the client
+	* registry (multi-account: one integration = one account = one client).
+	* Optional for back-compat with cameras persisted under the legacy
+	* single-global-credentials model — those resolve via the migration
+	* fallback until re-adopted.
+	*/
+	integrationId: string().default(""),
 	/** Hardware MAC — globally unique, the stableId discriminator. */
 	mac: string().describe("Wyze camera MAC (hardware id)"),
 	/** P2P UID (TUTK) — the cloud `device_params.p2p_id`. */
@@ -27563,6 +27729,192 @@ var wyzeCameraSchema = object({
 	motionSource: WyzeMotionSourceSchema.default("cloud")
 });
 //#endregion
+//#region src/candidates.ts
+/**
+* Pure mapping: cloud camera list → `device-adoption` candidates.
+*
+* Mirrors `buildDreoCandidates` — no network I/O, no side effects, so it is
+* exhaustively unit-testable without the lib or a live account. A camera is a
+* candidate only when it carries the local P2P parameters the DTLS client
+* needs (`isAdoptableCamera`).
+*/
+/**
+* Map live cloud cameras to adoption candidates. The `childNativeId` is the
+* camera MAC — globally unique + durable, the same key used for the device
+* stableId — so re-discovery of an already-adopted camera is de-duped.
+*/
+function buildWyzeCandidates(input) {
+	const out = [];
+	for (const cam of input.cameras) {
+		if (!isAdoptableCamera(cam)) continue;
+		const adoptedId = input.adopted.get(cam.mac.toUpperCase()) ?? null;
+		out.push({
+			childNativeId: cam.mac,
+			name: cam.nickname || cam.productModel || cam.mac,
+			type: DeviceType.Camera,
+			status: cam.isOnline === false ? "offline" : "online",
+			metadata: {
+				serialNumber: cam.mac,
+				model: cam.productModel,
+				manufacturer: "Wyze"
+			},
+			alreadyAdopted: adoptedId !== null,
+			adoptedDeviceId: adoptedId
+		});
+	}
+	return out;
+}
+//#endregion
+//#region src/wyze-adoption-provider.ts
+/**
+* `device-adoption` cap provider for the Wyze addon (account mode).
+*
+* Broker-less: candidates + adoption are resolved directly by
+* `integrationId` → the per-account {@link WyzeClientRegistry} client. Mirrors
+* `buildDreoAdoptionProvider`'s shape (listCandidateFilters / listCandidates /
+* getCandidate / getStatus / refresh / adopt / release / resync) with a single
+* `devices` granularity (one Camera per cloud device). Pure builder: every
+* side-effecting dependency is injected.
+*/
+/** The single granularity this provider advertises: whole-device adoption. */
+var DEVICES_FILTER = {
+	id: "devices",
+	label: "Cameras",
+	isDefault: true
+};
+/** Build a `MAC(uppercased) → CamStack deviceId` map for one integration. */
+function adoptedMapForIntegration(integrationId, adopted) {
+	const map = /* @__PURE__ */ new Map();
+	for (const device of adopted) {
+		if (device.config["integrationId"] !== integrationId) continue;
+		const mac = device.config["mac"];
+		if (typeof mac === "string" && mac.length > 0) map.set(mac.toUpperCase(), device.id);
+	}
+	return map;
+}
+function buildWyzeAdoptionProvider(deps) {
+	const { getCameraList, hasIntegration, listIntegrations, listAdopted, adoptCamera, removeDevice, findDeviceConfig, logger } = deps;
+	async function candidatesForIntegration(integrationId, force = false) {
+		return buildWyzeCandidates({
+			cameras: await getCameraList(integrationId, force),
+			adopted: adoptedMapForIntegration(integrationId, await listAdopted())
+		});
+	}
+	function applyCandidateTextFilter(cands, filterText) {
+		let filtered = [...cands];
+		if (filterText === void 0) return filtered;
+		const { search, adoptedOnly, unadoptedOnly } = filterText;
+		if (search !== void 0 && search.length > 0) {
+			const lower = search.toLowerCase();
+			filtered = filtered.filter((c) => c.name.toLowerCase().includes(lower) || (c.metadata.model?.toLowerCase().includes(lower) ?? false) || c.childNativeId.toLowerCase().includes(lower));
+		}
+		if (adoptedOnly === true) filtered = filtered.filter((c) => c.alreadyAdopted);
+		if (unadoptedOnly === true) filtered = filtered.filter((c) => !c.alreadyAdopted);
+		return filtered;
+	}
+	return {
+		listCandidateFilters: async () => ({ filters: [DEVICES_FILTER] }),
+		listCandidates: async ({ integrationId, page, pageSize, filterText }) => {
+			const filtered = applyCandidateTextFilter(await candidatesForIntegration(integrationId), filterText);
+			const start = (page - 1) * pageSize;
+			return {
+				candidates: filtered.slice(start, start + pageSize),
+				totalCount: filtered.length,
+				page,
+				pageSize
+			};
+		},
+		getCandidate: async ({ integrationId, childNativeId }) => {
+			return (await candidatesForIntegration(integrationId)).find((c) => c.childNativeId === childNativeId) ?? null;
+		},
+		getStatus: async () => {
+			try {
+				let candidateCount = 0;
+				for (const integrationId of listIntegrations()) candidateCount += (await candidatesForIntegration(integrationId)).length;
+				const adoptedCount = (await listAdopted()).length;
+				return {
+					lastDiscoveryAt: Date.now(),
+					candidateCount,
+					adoptedCount,
+					lastError: null
+				};
+			} catch (err) {
+				logger.warn("wyze adoption: getStatus failed", { meta: { error: errMsg(err) } });
+				return {
+					lastDiscoveryAt: null,
+					candidateCount: 0,
+					adoptedCount: 0,
+					lastError: errMsg(err)
+				};
+			}
+		},
+		refresh: async ({ integrationId }) => {
+			const candidateCount = (await candidatesForIntegration(integrationId, true)).length;
+			const adoptedCount = adoptedMapForIntegration(integrationId, await listAdopted()).size;
+			return {
+				lastDiscoveryAt: Date.now(),
+				candidateCount,
+				adoptedCount,
+				lastError: null
+			};
+		},
+		adopt: async ({ integrationId, childNativeIds, perCandidate }) => {
+			if (!hasIntegration(integrationId)) throw new Error(`wyze adopt: integration ${integrationId} not connected`);
+			const cameras = await getCameraList(integrationId, true);
+			const adopted = [];
+			let failures = 0;
+			for (const mac of childNativeIds) try {
+				const cam = cameras.find((c) => c.mac.toUpperCase() === mac.toUpperCase());
+				if (cam === void 0) {
+					logger.warn("wyze adopt: camera not found on account — skipping", { meta: {
+						mac,
+						integrationId
+					} });
+					failures++;
+					continue;
+				}
+				const name = perCandidate?.[mac]?.name ?? cam.nickname ?? cam.productModel ?? mac;
+				const { deviceId } = await adoptCamera({
+					integrationId,
+					mac: cam.mac,
+					name
+				});
+				adopted.push({
+					childNativeId: mac,
+					parentDeviceId: deviceId,
+					accessoryDeviceIds: []
+				});
+			} catch (err) {
+				logger.warn("wyze adopt: failed to adopt camera", { meta: {
+					mac,
+					integrationId,
+					error: errMsg(err)
+				} });
+				failures++;
+			}
+			if (adopted.length === 0 && failures > 0) throw new Error(`wyze adopt: all ${failures} adopt(s) failed`);
+			return { adopted };
+		},
+		release: async ({ camDeviceId }) => {
+			await removeDevice(camDeviceId);
+		},
+		resync: async ({ camDeviceId }) => {
+			const cfg = await findDeviceConfig(camDeviceId);
+			if (cfg === null) throw new Error(`wyze resync: device ${camDeviceId} not found`);
+			const integrationId = typeof cfg["integrationId"] === "string" ? cfg["integrationId"] : "";
+			const mac = typeof cfg["mac"] === "string" ? cfg["mac"] : "";
+			if (mac.length === 0) throw new Error(`wyze resync: device ${camDeviceId} has no MAC`);
+			if (integrationId.length > 0 && hasIntegration(integrationId)) {
+				if (!(await getCameraList(integrationId)).some((c) => c.mac.toUpperCase() === mac.toUpperCase())) throw new Error(`wyze resync: camera ${mac} no longer present on integration ${integrationId}`);
+			}
+			return {
+				changed: false,
+				rebuiltChildren: 0
+			};
+		}
+	};
+}
+//#endregion
 //#region src/snapshot-ffmpeg.ts
 /**
 * Decode a raw Annex-B keyframe (H264 or H265) into a single JPEG via
@@ -28236,34 +28588,56 @@ var WyzeCamera = class extends BaseDevice {
 };
 //#endregion
 //#region src/addon.ts
-var CAMERA_LIST_REFRESH_MS = 5 * 6e4;
 function getString(obj, key) {
 	const v = obj[key];
 	return typeof v === "string" ? v : "";
 }
+/** Extract account credentials from an integration's settings, or null. */
+function credentialsFromSettings(settings) {
+	const email = getString(settings, "email").trim();
+	const password = getString(settings, "password");
+	const apiKey = getString(settings, "apiKey").trim();
+	const apiId = getString(settings, "apiId").trim();
+	if (!email || !password || !apiKey || !apiId) return null;
+	return {
+		email,
+		password,
+		apiKey,
+		apiId
+	};
+}
 /**
-* Wyze device-provider addon. Discovers cameras via the Wyze cloud
-* (`getCameraList`), persists each camera's P2P parameters, and feeds the
-* stream-broker through the `pull-rfc4571` lazy-publish + dial-time
-* `materializeStreamSocket` path — structurally identical to Reolink.
+* Wyze device-provider addon — `mode: account` (multi-account).
+*
+* Each Wyze integration carries its own account credentials in its
+* `integration.settings`; the addon holds one `WyzeCloudClient` per
+* `integrationId` in {@link WyzeClientRegistry} (`Map<integrationId,
+* WyzeCloudClient>`). There is NO shared broker. A `device-adoption` cap
+* provider enumerates each account's cameras and adopts them; each adopted
+* camera is stamped with its `integrationId` and resolves its account client
+* by that id.
+*
+* Cameras still feed the stream-broker through the `pull-rfc4571`
+* lazy-publish + dial-time `materializeStreamSocket` path — structurally
+* identical to Reolink.
 *
 * `hub-only`: the loopback RFC 4571 server binds 127.0.0.1, so the broker
-* that dials it must be co-resident (same as every other camstack
-* provider).
+* that dials it must be co-resident.
 */
 var WyzeProviderAddon = class extends BaseDeviceProvider {
 	addonId = WYZE_ADDON_ID;
 	providerName = "Wyze";
 	deviceClasses = { [DeviceType.Camera]: WyzeCamera };
-	cloud = null;
-	cameraListCache = [];
-	cameraListFetchedAt = 0;
-	cameraListInFlight = null;
+	clients = null;
 	constructor() {
 		super({});
 	}
 	async onInitialize() {
 		const regs = await super.onInitialize();
+		this.clients = new WyzeClientRegistry({
+			dataDir: this.ctx.dataDir,
+			logger: this.ctx.logger
+		});
 		this.subscribe({ category: EventCategory.StreamBrokerOnRequestStreamSourceRefresh }, (event) => {
 			const data = event.data;
 			const deviceId = typeof data.deviceId === "number" ? data.deviceId : null;
@@ -28273,15 +28647,68 @@ var WyzeProviderAddon = class extends BaseDeviceProvider {
 					tags: { deviceId },
 					meta: {
 						camStreamId: data.camStreamId ?? null,
-						error: err instanceof Error ? err.message : String(err)
+						error: errMsg(err)
 					}
 				});
 			});
 		});
-		return regs;
+		await this.reconcileIntegrations();
+		this.subscribeIntegrationLifecycle();
+		return [...regs, {
+			capability: deviceAdoptionCapability,
+			provider: this.buildAdoptionProvider()
+		}];
+	}
+	async onShutdown() {
+		this.clients?.clear();
+		this.clients = null;
+		await super.onShutdown();
+	}
+	requireClients() {
+		if (!this.clients) throw new Error("Wyze provider not initialised");
+		return this.clients;
+	}
+	/**
+	* Rebuild the `Map<integrationId, WyzeCloudClient>` from the live
+	* integration list: for each surviving Wyze integration read its settings
+	* and upsert a client (session-preserving if credentials are unchanged);
+	* drop clients whose integration was deleted/disabled. Idempotent; runs on
+	* boot + on every integration lifecycle event. Guarded so a failure never
+	* fails init.
+	*/
+	async reconcileIntegrations() {
+		const reg = this.requireClients();
+		try {
+			const mine = (await this.ctx.api.integrations.list.query()).filter((i) => i.addonId === this.ctx.id && i.enabled);
+			const surviving = /* @__PURE__ */ new Set();
+			for (const integration of mine) try {
+				const credentials = credentialsFromSettings(await this.ctx.api.integrations.getSettings.query({ id: integration.id }));
+				if (!credentials) {
+					this.ctx.logger.warn("Wyze integration has no complete credentials — skipping", { meta: { integrationId: integration.id } });
+					continue;
+				}
+				reg.upsert(integration.id, credentials);
+				surviving.add(integration.id);
+			} catch (err) {
+				this.ctx.logger.warn("Wyze reconcile: failed to read integration settings", { meta: {
+					integrationId: integration.id,
+					error: errMsg(err)
+				} });
+			}
+			reg.retain(surviving);
+		} catch (err) {
+			this.ctx.logger.warn("Wyze integration reconcile failed", { meta: { error: errMsg(err) } });
+		}
 	}
-	async onConfigChanged() {
-		this.cloud = null;
+	subscribeIntegrationLifecycle() {
+		const handler = (event) => {
+			const addonId = event.data["addonId"];
+			if (typeof addonId === "string" && addonId !== this.ctx.id) return;
+			this.reconcileIntegrations();
+		};
+		this.ctx.eventBus.subscribe({ category: EventCategory.IntegrationEnabled }, handler);
+		this.ctx.eventBus.subscribe({ category: EventCategory.IntegrationDisabled }, handler);
+		this.ctx.eventBus.subscribe({ category: EventCategory.IntegrationDeleted }, handler);
 	}
 	async refreshDeviceStream(deviceId, camStreamId) {
 		const dev = this.ctx.kernel.deviceRegistry?.getById(deviceId);
@@ -28293,94 +28720,57 @@ var WyzeProviderAddon = class extends BaseDeviceProvider {
 		this.wireCameraDeps(dev);
 		await dev.materializeStreamSocket(camStreamId);
 	}
-	async getGlobalSettings() {
-		const raw = await this.ctx.settings?.readAddonStore() ?? {};
-		return hydrateSchema(buildSettingsSchema(), raw);
-	}
-	async updateGlobalSettings(patch) {
-		await this.ctx.settings?.writeAddonStore(patch);
-		await this.onConfigChanged();
-	}
-	async readCredentials() {
-		const raw = await this.ctx.settings?.readAddonStore() ?? {};
-		const email = getString(raw, "email").trim();
-		const password = getString(raw, "password");
-		const apiKey = getString(raw, "apiKey").trim();
-		const apiId = getString(raw, "apiId").trim();
-		if (!email || !password || !apiKey || !apiId) return null;
-		return {
-			email,
-			password,
-			apiKey,
-			apiId
-		};
-	}
-	/** Lazily build the shared cloud client from persisted credentials. */
-	async ensureCloud() {
-		if (this.cloud) return this.cloud;
-		const credentials = await this.readCredentials();
-		if (!credentials) {
-			this.ctx.logger.warn("Wyze credentials not configured — set email / password / API key / Key ID in the addon settings");
-			return null;
-		}
-		this.cloud = new WyzeCloudClient({
-			dataDir: this.ctx.dataDir,
-			logger: this.ctx.logger.child("cloud"),
-			credentials
-		});
-		return this.cloud;
-	}
-	/** Cloud camera list, cached + debounced to avoid auth rate-limits. */
-	async getCameraList(force = false) {
-		const fresh = Date.now() - this.cameraListFetchedAt < CAMERA_LIST_REFRESH_MS;
-		if (!force && fresh && this.cameraListCache.length > 0) return this.cameraListCache;
-		if (this.cameraListInFlight) return this.cameraListInFlight;
-		const cloud = await this.ensureCloud();
-		if (!cloud) return this.cameraListCache;
-		const run = cloud.getCameraList().then((cams) => {
-			this.cameraListCache = cams;
-			this.cameraListFetchedAt = Date.now();
-			return cams;
-		}).catch((err) => {
-			const classified = classifyCloudError(err);
-			this.ctx.logger.error("Wyze getCameraList failed", { meta: {
-				kind: classified.kind,
-				error: classified.message
-			} });
-			return this.cameraListCache;
-		}).finally(() => {
-			this.cameraListInFlight = null;
-		});
-		this.cameraListInFlight = run;
-		return run;
-	}
-	async supportsDiscovery() {
-		return true;
-	}
-	async discoverDevices() {
-		const cams = await this.getCameraList(true);
-		const candidates = [];
-		for (const cam of cams) {
-			if (!isAdoptableCamera(cam)) continue;
-			candidates.push({
-				stableId: stableIdForMac(cam.mac),
-				type: DeviceType.Camera,
-				suggestedName: cam.nickname || cam.productModel || cam.mac,
-				prefilledConfig: cameraConfigFromCloud(cam)
-			});
-		}
-		return candidates;
-	}
-	async adoptDiscoveredDevice(input) {
-		const config = wyzeCameraSchema.parse(input.candidate.prefilledConfig);
-		return this.createDevice({
-			type: DeviceType.Camera,
-			config: {
-				...config,
-				name: input.candidate.suggestedName
+	buildAdoptionProvider() {
+		return buildWyzeAdoptionProvider({
+			logger: this.ctx.logger,
+			getCameraList: (integrationId, force) => this.requireClients().getCameraList(integrationId, force),
+			hasIntegration: (integrationId) => this.requireClients().has(integrationId),
+			listIntegrations: () => this.requireClients().list(),
+			listAdopted: async () => {
+				const reg = this.ctx.kernel.deviceRegistry;
+				const devices = this.ctx.kernel.devices;
+				if (!reg || !devices) return [];
+				const out = [];
+				for (const d of reg.getAllForAddon(this.addonId)) {
+					if (d.parentDeviceId !== null) continue;
+					const config = await devices.loadConfig(d.id).catch(() => ({}));
+					out.push({
+						id: d.id,
+						config
+					});
+				}
+				return out;
+			},
+			adoptCamera: async ({ integrationId, mac, name }) => {
+				const cam = (await this.requireClients().getCameraList(integrationId)).find((c) => c.mac.toUpperCase() === mac.toUpperCase());
+				if (!cam) throw new Error(`wyze adopt: camera ${mac} not found on integration ${integrationId}`);
+				const config = {
+					...cameraConfigFromCloud(cam, integrationId),
+					name
+				};
+				const parsed = wyzeCameraSchema.parse(config);
+				return { deviceId: (await this.createDevice({
+					type: DeviceType.Camera,
+					config: {
+						...parsed,
+						name,
+						integrationId
+					}
+				})).id };
+			},
+			removeDevice: async (id) => {
+				await this.ctx.kernel.devices?.remove(id);
+			},
+			findDeviceConfig: async (id) => {
+				const devices = this.ctx.kernel.devices;
+				if (!devices) return null;
+				return devices.loadConfig(id).catch(() => null);
 			}
 		});
 	}
+	async getGlobalSettings() {
+		return hydrateSchema(buildSettingsSchema(), {});
+	}
 	async onGetCreationSchema(type) {
 		if (type !== DeviceType.Camera) return null;
 		return buildCreationFormSchema();
@@ -28389,20 +28779,25 @@ var WyzeProviderAddon = class extends BaseDeviceProvider {
 		if (type !== DeviceType.Camera) throw new Error(`Wyze provider does not support device type: ${type}`);
 		const name = getString(config, "name").trim();
 		if (!name) throw new Error("Camera name is required");
+		const integrationId = getString(config, "integrationId").trim();
 		const mac = getString(config, "mac").trim();
 		let merged = config;
-		if (mac) {
-			const fromCloud = (await this.getCameraList()).find((c) => c.mac.toUpperCase() === mac.toUpperCase());
+		if (mac && integrationId) {
+			const fromCloud = (await this.requireClients().getCameraList(integrationId)).find((c) => c.mac.toUpperCase() === mac.toUpperCase());
 			if (fromCloud) merged = {
 				...config,
-				...cameraConfigFromCloud(fromCloud)
+				...cameraConfigFromCloud(fromCloud, integrationId)
 			};
 		}
-		const parsed = wyzeCameraSchema.parse(merged);
+		const parsed = wyzeCameraSchema.parse({
+			...merged,
+			integrationId
+		});
 		return {
 			meta: {
 				type: DeviceType.Camera,
-				name
+				name,
+				...integrationId ? { integrationId } : {}
 			},
 			config: parsed,
 			onAfterCreate: async (device) => {
@@ -28416,16 +28811,19 @@ var WyzeProviderAddon = class extends BaseDeviceProvider {
 		throw new Error("Wyze: cannot persist a camera without a MAC address");
 	}
 	/**
-	* Inject the cloud resolvers into a camera so it can (a) refresh its
-	* local IP before each dial and (b) poll cloud events for motion +
-	* thumbnails — without holding a direct provider reference.
+	* Inject the per-account cloud resolvers into a camera so it can (a) refresh
+	* its local IP before each dial and (b) poll cloud events for motion +
+	* thumbnails — resolving its account {@link WyzeCloudClient} by the camera's
+	* own `integrationId` config, without holding a direct provider reference.
 	*/
 	wireCameraDeps(camera) {
 		const mac = camera.config.get("mac");
+		const integrationId = camera.config.get("integrationId");
 		camera.setDeps({
-			cloud: () => this.cloud,
+			cloud: () => this.clients?.client(integrationId) ?? null,
 			resolveCloudCamera: async () => {
-				return (await this.getCameraList()).find((c) => c.mac.toUpperCase() === mac.toUpperCase()) ?? null;
+				if (!integrationId) return null;
+				return (await this.requireClients().getCameraList(integrationId)).find((c) => c.mac.toUpperCase() === mac.toUpperCase()) ?? null;
 			}
 		});
 	}
@@ -28436,4 +28834,4 @@ var WyzeProviderAddon = class extends BaseDeviceProvider {
 	}
 };
 //#endregion
-export { WyzeProviderAddon, wyzeCameraSchema as n, WyzeCamera as t };
+export { WyzeProviderAddon, WyzeClientRegistry as a, wyzeCameraSchema as i, buildWyzeAdoptionProvider as n, buildWyzeCandidates as r, WyzeCamera as t };