@mega-yfue/eufy-sdk 0.4.0-beta.4 → 0.4.0-beta.5

package/dist/index.js

@@ -2125,6 +2125,10 @@ function solixUserTopics(appName, userId) {
 
 // dist/transport/mqtt/secure-mqtt.js
 var SUBACK_FAILURE = 128;
+function isRefusal(err) {
+  const granted = err?.packet?.granted;
+  return Array.isArray(granted) && granted.some((g) => typeof g === "number" && (g & SUBACK_FAILURE) !== 0);
+}
 function isNotAuthorized(err) {
   return err instanceof Error && /connection refused/i.test(err.message) && /not authori[sz]ed/i.test(err.message);
 }
@@ -2227,19 +2231,16 @@ var SecureMqtt = class extends EventEmitter {
   }
   /**
    * Subscribe every inbound leg this device's line uses (see `topics.ts` — one `/res` for most lines,
-   * four topics for `eufy_life`).
+   * four topics for `eufy_life` and the clean line).
    *
-   * The grants are INSPECTED, not assumed: AWS IoT answers a policy-denied filter with a
-   * SUBACK_FAILURE (`0x80`) grant rather than failing the SUBSCRIBE, so subscribing with a credential
-   * whose scope doesn't cover the topic looks identical to success and then delivers nothing. A denied
-   * topic is reported via `error` naming the credential scope; only an all-denied device throws, so a
-   * line that grants its state channel but refuses (say) the OTA leg still works.
+   * The grants are INSPECTED, not assumed: AWS IoT refuses a policy-denied filter with a
+   * {@link SUBACK_FAILURE} grant rather than failing the connection. A denied topic is reported via
+   * `error` naming the credential scope; only an all-denied device throws, so a line that grants its
+   * state channel but refuses (say) a business leg still works.
    */
   async subscribeDevice(device) {
-    if (!this.client)
-      throw new Error("SecureMqtt not connected");
     const topics = [...subscribeTopics(device)];
-    const { denied } = this.partitionGrants(await this.client.subscribeAsync(topics, { qos: 1 }));
+    const { denied } = await this.subscribeEach(topics);
     const scope = this.o.credentials.app_name ?? "default";
     if (denied.length === topics.length) {
       throw new Error(`subscribe ${device.sn}: every topic denied on credential scope "${scope}" \u2014 this line's topics are granted to a different scope (${denied.join(", ")})`);
@@ -2250,25 +2251,43 @@ var SecureMqtt = class extends EventEmitter {
   }
   /**
    * Subscribe to explicit topic filters, returning the topics that were granted. A scope-denied filter
-   * comes back with SUBACK_FAILURE rather than an error (AWS IoT quirk), so it is dropped from the result
-   * instead of throwing — callers that need every leg check the returned list. Used by lines whose topic
-   * vocabulary isn't the eufy `subscribeTopics` shape (e.g. Anker Solix `dt/{app}/{pn}/{sn}`).
+   * is dropped from the result instead of throwing — callers that need every leg check the returned
+   * list. Used by lines whose topic vocabulary isn't the eufy `subscribeTopics` shape (e.g. Anker Solix
+   * `dt/{app}/{pn}/{sn}`).
    */
   async subscribe(topics) {
-    if (!this.client)
-      throw new Error("SecureMqtt not connected");
-    return this.partitionGrants(await this.client.subscribeAsync(topics, { qos: 1 })).granted;
+    return (await this.subscribeEach(topics)).granted;
   }
   /**
-   * Split SUBACK grants into granted vs scope-denied topics. AWS IoT marks a policy-denied filter with a
-   * SUBACK_FAILURE (`0x80`) grant rather than failing the SUBSCRIBE, so the two subscribe paths share
-   * this split and layer their own policy (drop vs report) on top.
+   * Subscribe each filter in a SUBSCRIBE of its own and split the outcome into granted vs refused.
+   *
+   * One request per filter because the MQTT engine treats a SUBACK as all-or-nothing: one refused grant
+   * rejects the whole request, and it forgets EVERY filter of that request for resubscription after a
+   * reconnect — so a batch holding one denied leg would lose the granted legs on the next drop. Alone,
+   * a refused filter costs only itself. A rejection that carries no SUBACK is a transport failure and
+   * is thrown.
+   *
+   * The cost is one SUBSCRIBE and one SUBACK per filter instead of one per device — four for a
+   * four-leg line. They are sent concurrently, so the wall-clock cost is one round trip. Folding them
+   * back into one request brings back the lost resubscription.
    */
-  partitionGrants(grants) {
+  async subscribeEach(topics) {
+    const client = this.client;
+    if (!client)
+      throw new Error("SecureMqtt not connected");
+    const outcomes = await Promise.allSettled(topics.map((topic) => client.subscribeAsync(topic, { qos: 1 })));
     const granted = [];
     const denied = [];
-    for (const g of grants)
-      (g.qos === SUBACK_FAILURE ? denied : granted).push(g.topic);
+    outcomes.forEach((outcome, i) => {
+      const topic = topics[i];
+      if (outcome.status === "fulfilled") {
+        granted.push(topic);
+        return;
+      }
+      if (!isRefusal(outcome.reason))
+        throw outcome.reason;
+      denied.push(topic);
+    });
     return { granted, denied };
   }
   /**