@smarthome.exchange/integrations 1.0.0 → 3.0.0

package/ts/integrations/tasmota/tasmota.types.ts

@@ -1,4 +1,41 @@
 import type { IMqttConfig } from '../mqtt/mqtt.types.js';
+import type { INativeIntegrationOwnerOptions } from '../../core/classes.nativeintegrationowner.js';
+
+export interface ITasmotaBrokerIdentity {
+  readonly host: string;
+  readonly port: number;
+  readonly protocol: 'mqtt' | 'mqtts';
+}
+
+export interface ITasmotaCredential extends ITasmotaBrokerIdentity {
+  readonly version: 1;
+  readonly username?: string;
+  readonly password?: string;
+  readonly ca?: string;
+  readonly cert?: string;
+  readonly key?: string;
+  readonly servername?: string;
+}
+
+export interface ITasmotaCredentialRequest {
+  readonly homeId: string;
+  readonly credentialRef: string;
+  readonly broker: ITasmotaBrokerIdentity;
+  readonly signal: AbortSignal;
+  /** Absolute deadline on performance.now(), not wall-clock time. */
+  readonly deadlineMonotonicMs: number;
+}
+
+export type TTasmotaCredentialResolver = (requestArg: ITasmotaCredentialRequest) => Promise<ITasmotaCredential>;
+
+export interface ITasmotaIntegrationOptions extends INativeIntegrationOwnerOptions {
+  /** Runtime-only embedding-owner permission. Defaults to false. */
+  readonly enableControls?: boolean;
+  readonly credentialResolver?: TTasmotaCredentialResolver;
+}
+
+export type TTasmotaAuthentication = { readonly mode: 'anonymous' }
+  | { readonly mode: 'credential-reference'; readonly credentialRef: string };
 
 export interface ITasmotaDeviceConfig {
   topic: string;
@@ -14,7 +51,9 @@ export interface ITasmotaDeviceConfig {
 }
 
 export interface IHomeAssistantTasmotaConfig {
-  broker: IMqttConfig & { host: string };
+  readonly homeId: string;
+  broker: Omit<IMqttConfig, 'username' | 'password'> & { host: string };
+  readonly authentication: TTasmotaAuthentication;
   devices: ITasmotaDeviceConfig[];
   initialSnapshotTimeoutMs?: number;
 }
@@ -34,7 +73,9 @@ export interface ITasmotaSelectedDevice {
 }
 
 export interface ITasmotaConfig {
-  broker: IMqttConfig & { host: string };
+  readonly homeId: string;
+  readonly authentication: TTasmotaAuthentication;
+  broker: Omit<IMqttConfig, 'username' | 'password'> & { host: string };
   devices: ITasmotaSelectedDevice[];
   initialSnapshotTimeoutMs: number;
 }

package/ts/integrations/tuya/readme.md

@@ -1,7 +1,7 @@
 # Tuya local protocol 3.4
 
 `TuyaIntegration` and the existing `HomeAssistantTuyaIntegration` export provide a
-native local runtime through published `@ecobridge.xyz/devicemanager` 4.2.0.
+native local runtime through published `@ecobridge.xyz/devicemanager` 4.11.1.
 Setup requires an explicit home, device ID, literal private/link-local/loopback
 IPv4 endpoint, local key and this product's verified datapoint schema. Discovery
 has no broadcast probes and makes no claim to locate devices or obtain credentials.
@@ -33,11 +33,12 @@ const config: IHomeAssistantTuyaConfig = {
     { id: 108, name: 'Temperature', kind: 'sensor', valueType: 'integer', scale: 1, unit: '°C' },
   ],
 };
-const integration = new TuyaIntegration();
+const integration = new TuyaIntegration({ homeId: 'home-one' });
+const context = Object.freeze({ homeId: 'home-one', configStore: store });
 // One explicit provisioning action stores configuration and the opaque 16-byte
 // local key together, encrypted under the caller's key provider.
-await integration.provisionLocalKey(config, configuredLocalKeyBytes, { configStore: store });
-const runtime = await integration.setup(config, { configStore: store });
+await integration.provisionLocalKey(config, configuredLocalKeyBytes, context);
+const runtime = await integration.setup(config, context);
 try {
   const [device] = await runtime.devices();
   const power = device.features.find((feature) => feature.id === 'dp_7');
@@ -52,6 +53,14 @@ try {
 }
 ```
 
+The host must independently select `context.homeId` for provisioning and setup.
+It must match the configuration home and the actual store scope; it is never
+inferred from either. An optional constructor `homeId` constrains the instance.
+Otherwise, the first valid synchronous admission fixes its home even if subsequent
+I/O fails. Configuration, context fields and local-key bytes are captured before
+asynchronous work. Accessors and overridden store-scope methods cannot grant
+admission. The host still owns authenticated access to the selected home.
+
 The store must be an actual `NoSqlConfigStore` scoped to the exact configured home
 and `tuya` domain. Generic stores are rejected. Configuration and credentials use
 `device:<configured device ID>` in that encrypted scope; setup rejects a different
@@ -85,14 +94,38 @@ arrive. Failures retain `effectOutcome: 'not-sent'`, `'rejected'` or `'indetermi
 a transmitted effect with a lost/late response may already have happened. There is
 no retry, retransmission or reconnect. Lifetime/setup cancellation and feature-write
 signals are supported. `destroy()` is permanent, idempotent and drains setup and
-protocol operations; use a new integration for a new lifetime. Cached reads after
-shutdown remain marked unavailable with their original report timestamps.
+protocol operations and admitted asynchronous subscriber continuations. A fulfilled
+provisioning write remains fulfilled if cancellation or close arrives during its
+persistence; close joins the actual write result and never replays it. Setup and
+provisioning are reserved before store or protocol callbacks run. Destruction
+publishes one stable close promise before abort callbacks run. Caller cancellation
+also closes promoted runtime ownership and releases its slot after cleanup.
+Use a new integration for a new lifetime. Cached reads after
+shutdown remain unavailable and read-only with their original report timestamps.
 
-Subscriptions are bounded to 128 listeners, abortable and explicitly removable.
-Handlers must not block. Asynchronous handler work is caller-owned; handler failures
-are reported through the supplied logger using a generic credential-free message.
+Subscriptions are bounded to 128 listeners and 128 outstanding callback
+continuations, abortable and explicitly removable. Handlers must not block or
+await destruction of their own runtime: destruction joins their continuation.
+Returned promises and thenables are owned and joined even after listener removal.
+Callback failures are retained through cleanup and logged with a generic,
+credential-free message. Overflow closes the runtime and retains the failure.
 All listeners are removed during destruction.
-One integration owns at most 32 simultaneous setup/provisioning/runtime lifetimes.
+
+The shared native owner accounts for pending setup/provisioning operations,
+promoted runtimes and retained failed cleanup. Its default limit is 16; the optional
+constructor `capacity` selects a positive safe-integer limit. A failed cleanup
+retains its capacity slot and rejects destruction. `integration.retryCleanup()`
+retries only failed cleanup handles and explicitly acknowledges already-drained
+subscriber failures; it never reruns callbacks, provisioning, queries or controls,
+and never reopens a session. It does not change the original rejected close promise.
+A resource whose owning cleanup still rejects remains retained.
+
+Per-DP provisioned `read-write` access continues to grant control. There is no
+additional host control-permission API and no automatic preflight or post-write
+readback. Those public-contract changes require a separate product decision, as
+does a config flow. Protocol authentication proves possession of the local key;
+identity fields are checked when present, but this is not independent hardware
+attestation. Firmware qualification remains separate from fixture verification.
 
 Other protocol versions, cloud-only and sleeping devices, gateway children, BLE,
 Zigbee, raw/bitmap/enum mappings and arbitrary actions are unsupported. The shared
@@ -101,6 +134,15 @@ device protocol union currently has no Tuya member, so the generic device report
 loopback fixture tests cover the implementation; qualification against real product
 firmware requires separately authorized hardware access.
 
+Fixture qualification uses `pnpm exec tstest test/tuya/ --verbose --logfile --timeout 60`:
+`test.tuya.node.ts` contains 28 encrypted persistence/protocol cases and
+`test.tuya.owner.node.ts` adds 22 admission, reentry, cancellation, capacity,
+accepted-persistence, retained-cleanup and callback-continuation regressions.
+The 50-case suite passes with no device or cloud account. Strict domain/test checks
+use `strict: true`, `noImplicitAny: true` and `skipLibCheck: false`; production
+build and the complete test type check are also required. This fixture evidence
+does not establish physical acceptance for a particular product or firmware.
+
 Product types and permissions follow the vendor's [DP Model and Control Protocol](https://developer.tuya.com/en/docs/iot-device-dev/TuyaOS-iot_abi_dp_ctrl?id=Kcoglhn5r7ajr).
 LAN framing is implemented by the owning dependency, whose public API and wire
 contract are documented in its [readme](https://code.foss.global/ecobridge.xyz/devicemanager).

package/ts/integrations/tuya/tuya.classes.integration.ts

@@ -1,10 +1,11 @@
 import * as plugins from '../../plugins.js';
 import { BaseIntegration } from '../../core/classes.baseintegration.js';
+import { NativeIntegrationOwner } from '../../core/classes.nativeintegrationowner.js';
 import { DiscoveryDescriptor } from '../../core/classes.discoverydescriptor.js';
 import type { IIntegrationRuntime, IIntegrationSetupContext } from '../../core/types.js';
 import { TuyaRuntime } from './tuya.classes.runtime.js';
-import type { IHomeAssistantTuyaConfig, ITuyaStoredConfiguration } from './tuya.types.js';
-import { normalizeTuyaConfig, scopedTuyaStore, tuyaCredentialId, tuyaKeys, tuyaRecord } from './tuya.validation.js';
+import type { IHomeAssistantTuyaConfig, ITuyaIntegrationOptions, ITuyaStoredConfiguration } from './tuya.types.js';
+import { normalizeTuyaConfig, tuyaSetupContext, tuyaCredentialId, tuyaKeys, tuyaRecord } from './tuya.validation.js';
 
 export class TuyaIntegration extends BaseIntegration<IHomeAssistantTuyaConfig> {
   public readonly domain = 'tuya';
@@ -12,118 +13,88 @@ export class TuyaIntegration extends BaseIntegration<IHomeAssistantTuyaConfig> {
   public readonly status = 'control-runtime' as const;
   public readonly discoveryDescriptor = new DiscoveryDescriptor({ integrationDomain: 'tuya', displayName: 'Tuya 3.4 local device' });
   public readonly metadata = Object.freeze({ source: 'native-typescript', integrationType: 'device', iotClass: 'local_push', protocolVersion: '3.4' });
-  readonly #setups = new Set<Promise<unknown>>();
-  readonly #controllers = new Set<AbortController>();
-  readonly #runtimes = new Set<TuyaRuntime>();
-  #destroyed = false;
-  #destroy?: Promise<void>;
+  readonly #owner: NativeIntegrationOwner;
+
+  constructor(optionsArg: ITuyaIntegrationOptions = {}) {
+    super();
+    this.#owner = new NativeIntegrationOwner(this.domain, optionsArg);
+  }
 
   public provisionLocalKey(configArg: IHomeAssistantTuyaConfig, localKeyArg: Uint8Array, contextArg: IIntegrationSetupContext): Promise<void> {
-    this.#assertOpen();
-    this.#assertCapacity();
     const config = normalizeTuyaConfig(configArg);
-    const store = scopedTuyaStore(config, contextArg);
+    const context = tuyaSetupContext(contextArg);
     if (!(localKeyArg instanceof Uint8Array) || localKeyArg.byteLength !== 16) throw new TypeError('Tuya local key must contain exactly 16 opaque bytes.');
     const copy = Buffer.from(localKeyArg);
-    const controller = new AbortController();
-    this.#controllers.add(controller);
-    const signal = contextArg.abortSignal ? AbortSignal.any([controller.signal, contextArg.abortSignal]) : controller.signal;
-    const operation = (async () => {
-      try {
-        signal.throwIfAborted();
-        await store.initialize({ signal });
-        this.#assertOpen();
-        signal.throwIfAborted();
+    try {
+      return this.#owner.runOperation(context, config.homeId, async (leaseArg) => {
+        const store = leaseArg.context.configStore!;
+        await store.initialize({ signal: leaseArg.signal });
+        leaseArg.assertOpen();
         await store.set<ITuyaStoredConfiguration>(tuyaCredentialId(config.deviceId), { version: 1, config, localKey: copy.toString('base64') });
-        this.#assertOpen();
-        signal.throwIfAborted();
-      } finally { copy.fill(0); this.#controllers.delete(controller); }
-    })();
-    return this.#track(operation);
+        // A fulfilled admitted write stays fulfilled even if close/cancellation arrives during persistence.
+      }).finally(() => copy.fill(0));
+    } catch (errorArg) { copy.fill(0); throw errorArg; }
   }
 
   public setup(configArg: IHomeAssistantTuyaConfig, contextArg: IIntegrationSetupContext): Promise<IIntegrationRuntime> {
-    this.#assertOpen();
-    this.#assertCapacity();
     const config = normalizeTuyaConfig(configArg);
-    const store = scopedTuyaStore(config, contextArg);
-    const controller = new AbortController();
-    this.#controllers.add(controller);
-    const signal = contextArg.abortSignal ? AbortSignal.any([controller.signal, contextArg.abortSignal]) : controller.signal;
-    const operation = (async () => {
-      let protocol: plugins.ecobridgeDeviceManager.TuyaProtocol | undefined;
+    const context = tuyaSetupContext(contextArg);
+    return this.#owner.runSetup(context, config.homeId, async (leaseArg) => {
+      const store = leaseArg.context.configStore!;
+      const signal = leaseArg.signal;
+      await store.initialize({ signal });
+      leaseArg.assertOpen();
+      const stored = tuyaRecord(await store.get<unknown>(tuyaCredentialId(config.deviceId)), 'stored configuration');
+      tuyaKeys(stored, ['version', 'config', 'localKey']);
+      if (stored.version !== 1 || JSON.stringify(normalizeTuyaConfig(stored.config)) !== JSON.stringify(config)) {
+        throw new TypeError('Tuya configuration does not match its encrypted provisioned configuration.');
+      }
+      if (typeof stored.localKey !== 'string' || stored.localKey.length !== 24) throw new TypeError('Tuya stored local key is invalid.');
+      const key = Buffer.from(stored.localKey, 'base64');
+      let protocol: plugins.ecobridgeDeviceManager.TuyaProtocol;
+      let runtime: TuyaRuntime | undefined;
       let unsubscribeAdmission: (() => void) | undefined;
+      let cleanupAttempted = false;
       try {
-        signal.throwIfAborted();
-        await store.initialize({ signal });
-        signal.throwIfAborted();
-        const stored = tuyaRecord(await store.get<unknown>(tuyaCredentialId(config.deviceId)), 'stored configuration');
-        tuyaKeys(stored, ['version', 'config', 'localKey']);
-        if (stored.version !== 1 || JSON.stringify(normalizeTuyaConfig(stored.config)) !== JSON.stringify(config)) {
-          throw new TypeError('Tuya configuration does not match its encrypted provisioned configuration.');
-        }
-        if (typeof stored.localKey !== 'string' || stored.localKey.length !== 24) throw new TypeError('Tuya stored local key is invalid.');
-        const key = Buffer.from(stored.localKey, 'base64');
-        try {
-          if (key.byteLength !== 16 || key.toString('base64') !== stored.localKey) throw new TypeError('Tuya stored local key is invalid.');
-          signal.throwIfAborted();
-          protocol = new plugins.ecobridgeDeviceManager.TuyaProtocol({
-            deviceId: config.deviceId, localKey: key, host: config.host, port: config.port, version: config.version,
-            connectTimeoutMs: config.connectTimeoutMs, requestTimeoutMs: config.requestTimeoutMs,
-            heartbeatIntervalMs: config.heartbeatIntervalMs, abortSignal: signal,
-          });
-        } finally { key.fill(0); }
-        const reports: plugins.ecobridgeDeviceManager.ITuyaDatapointReport[] = [];
-        let admissionOverflow = false;
-        unsubscribeAdmission = protocol.subscribe((reportArg) => {
-          if (reports.length >= 128) { admissionOverflow = true; controller.abort(); }
-          else reports.push(reportArg);
+        if (key.byteLength !== 16 || key.toString('base64') !== stored.localKey) throw new TypeError('Tuya stored local key is invalid.');
+        leaseArg.assertOpen();
+        protocol = new plugins.ecobridgeDeviceManager.TuyaProtocol({
+          deviceId: config.deviceId, localKey: key, host: config.host, port: config.port, version: config.version,
+          connectTimeoutMs: config.connectTimeoutMs, requestTimeoutMs: config.requestTimeoutMs,
+          heartbeatIntervalMs: config.heartbeatIntervalMs, abortSignal: signal,
         });
-        await protocol.connect(signal);
-        await protocol.queryDatapoints(signal);
-        if (admissionOverflow) throw new Error('Tuya admission report capacity exceeded.');
-        signal.throwIfAborted();
-        this.#assertOpen();
-        unsubscribeAdmission();
-        unsubscribeAdmission = undefined;
-        const runtime = new TuyaRuntime(config, protocol, reports, () => {
-          this.#runtimes.delete(runtime);
-          this.#controllers.delete(controller);
-        }, contextArg.logger);
-        this.#runtimes.add(runtime);
-        return runtime;
-      } catch (errorArg) {
-        controller.abort();
-        unsubscribeAdmission?.();
-        await protocol?.close();
-        this.#controllers.delete(controller);
-        throw errorArg;
-      }
-    })();
-    return this.#track(operation);
-  }
-
-  public destroy(): Promise<void> {
-    if (this.#destroy) return this.#destroy;
-    this.#destroyed = true;
-    for (const controller of this.#controllers) controller.abort();
-    this.#destroy = (async () => {
-      await Promise.allSettled([...this.#setups]);
-      await Promise.all([...this.#runtimes].map((runtimeArg) => runtimeArg.destroy()));
-      this.#controllers.clear();
-    })();
-    return this.#destroy;
+        // One composite handle transfers protocol and callback cleanup together to the runtime.
+        leaseArg.own(async () => {
+          const retry = cleanupAttempted;
+          cleanupAttempted = true;
+          unsubscribeAdmission?.();
+          unsubscribeAdmission = undefined;
+          if (runtime) await runtime.closeOwnedResources(retry);
+          else await protocol.close();
+        });
+      } finally { key.fill(0); }
+      const reports: plugins.ecobridgeDeviceManager.ITuyaDatapointReport[] = [];
+      let admissionOverflow = false;
+      unsubscribeAdmission = protocol.subscribe((reportArg) => {
+        if (reports.length >= 128) { admissionOverflow = true; void leaseArg.close().catch(() => undefined); }
+        else reports.push(reportArg);
+      });
+      await protocol.connect(signal);
+      await protocol.queryDatapoints(signal);
+      if (admissionOverflow) throw new Error('Tuya admission report capacity exceeded.');
+      leaseArg.assertOpen();
+      unsubscribeAdmission();
+      unsubscribeAdmission = undefined;
+      runtime = new TuyaRuntime(config, protocol, reports, leaseArg);
+      leaseArg.promoteToRuntime();
+      return runtime;
+    });
   }
 
-  #assertOpen(): void { if (this.#destroyed) throw new Error('Tuya integration is permanently destroyed.'); }
+  public destroy(): Promise<void> { return this.#owner.close(); }
 
-  #assertCapacity(): void { if (this.#controllers.size >= 32) throw new Error('Tuya integration lifetime capacity reached.'); }
-
-  #track<TResult>(operationArg: Promise<TResult>): Promise<TResult> {
-    this.#setups.add(operationArg);
-    void operationArg.then(() => this.#setups.delete(operationArg), () => this.#setups.delete(operationArg));
-    return operationArg;
-  }
+  /** Retry retained cleanup only; never reopen a session or replay an accepted operation. */
+  public retryCleanup(): Promise<void> { return this.#owner.retryCleanup(); }
 }
 
 export class HomeAssistantTuyaIntegration extends TuyaIntegration {}

package/ts/integrations/tuya/tuya.classes.runtime.ts

@@ -1,47 +1,57 @@
 import * as plugins from '../../plugins.js';
-import type { IDeviceFeatureWriteRequest, IIntegrationEntity, IIntegrationEvent, IIntegrationRuntime, ILogger, IServiceCallRequest, IServiceCallResult } from '../../core/types.js';
+import type { INativeSetupLease } from '../../core/classes.nativeintegrationowner.js';
+import type { IDeviceFeatureWriteRequest, IIntegrationEntity, IIntegrationEvent, IIntegrationRuntime, IServiceCallRequest, IServiceCallResult } from '../../core/types.js';
 import type { IHomeAssistantTuyaConfig, TTuyaDatapointMapping } from './tuya.types.js';
 import { tuyaDeviceId, tuyaDevices, tuyaEntities, tuyaEntityId, tuyaFeatureId, type ITuyaObservedDatapoint } from './tuya.mapper.js';
 import { tuyaKeys, tuyaRecord, tuyaValueMatches } from './tuya.validation.js';
 
+interface ITuyaCleanupResource {
+  readonly cleanup: () => Promise<void>;
+  promise?: Promise<void>;
+  failed: boolean;
+}
+
 export class TuyaRuntime implements IIntegrationRuntime {
   public readonly domain = 'tuya';
   readonly #config: IHomeAssistantTuyaConfig;
   readonly #protocol: plugins.ecobridgeDeviceManager.TuyaProtocol;
-  readonly #onDestroyed: () => void;
-  readonly #logger?: ILogger;
+  readonly #lease: INativeSetupLease;
   readonly #observed = new Map<number, ITuyaObservedDatapoint>();
   readonly #subscriptions = new Set<(eventArg: IIntegrationEvent) => void>();
   readonly #subscriptionCleanup = new Set<() => void>();
-  readonly #unsubscribe: () => void;
-  readonly #unsubscribeErrors: () => void;
+  readonly #resources: ITuyaCleanupResource[] = [];
+  readonly #callbacks = new Set<Promise<void>>();
+  #subscriberFailure = false;
   #closed = false;
   #destroy?: Promise<void>;
 
   constructor(configArg: IHomeAssistantTuyaConfig, protocolArg: plugins.ecobridgeDeviceManager.TuyaProtocol,
-    reportsArg: readonly plugins.ecobridgeDeviceManager.ITuyaDatapointReport[], onDestroyedArg: () => void, loggerArg?: ILogger) {
+    reportsArg: readonly plugins.ecobridgeDeviceManager.ITuyaDatapointReport[], leaseArg: INativeSetupLease) {
     this.#config = configArg;
     this.#protocol = protocolArg;
-    this.#onDestroyed = onDestroyedArg;
-    this.#logger = loggerArg;
+    this.#lease = leaseArg;
+    this.#resources.push({ cleanup: () => this.#protocol.close(), failed: false });
     for (const report of reportsArg) this.#accept(report);
     if (this.#observed.size === 0) throw new Error('Tuya device reported none of the configured product datapoints.');
-    this.#unsubscribe = this.#protocol.subscribe((report) => {
+    const unsubscribe = this.#protocol.subscribe((report) => {
+      if (this.#lease.signal.aborted || this.#destroy) return;
       try { this.#accept(report); }
       catch {
         this.#closed = true;
         this.#emit({ type: 'error', data: { code: 'schema-mismatch', message: 'Tuya reported data no longer matches the configured product schema.' } });
         this.#emit({ type: 'availability_changed', data: { available: false } });
-        void this.destroy();
+        void this.destroy().catch(() => undefined);
       }
     });
-    this.#unsubscribeErrors = this.#protocol.subscribeErrors((error) => {
+    this.#resources.push({ cleanup: async () => unsubscribe(), failed: false });
+    const unsubscribeErrors = this.#protocol.subscribeErrors((error) => {
       this.#emit({ type: 'error', data: { code: error.code, effectOutcome: error.effectOutcome } });
       if (!this.#protocol.connected) this.#emit({ type: 'availability_changed', data: { available: false } });
     });
+    this.#resources.push({ cleanup: async () => unsubscribeErrors(), failed: false });
   }
 
-  public isHealthy(): boolean { return !this.#closed && this.#protocol.connected; }
+  public isHealthy(): boolean { return !this.#closed && !this.#lease.signal.aborted && this.#protocol.connected; }
 
   public async devices(signalArg?: AbortSignal): Promise<plugins.shxInterfaces.data.IDeviceDefinition[]> {
     signalArg?.throwIfAborted();
@@ -53,6 +63,7 @@ export class TuyaRuntime implements IIntegrationRuntime {
   }
 
   public async subscribe(handlerArg: (eventArg: IIntegrationEvent) => void, signalArg?: AbortSignal): Promise<() => Promise<void>> {
+    this.#lease.assertOpen();
     if (this.#closed) throw new Error('Tuya runtime is permanently closed.');
     if (typeof handlerArg !== 'function') throw new TypeError('Tuya subscription handler must be a function.');
     signalArg?.throwIfAborted();
@@ -106,16 +117,37 @@ export class TuyaRuntime implements IIntegrationRuntime {
     } catch (errorArg) { return this.#failure(errorArg); }
   }
 
-  public destroy(): Promise<void> {
-    if (this.#destroy) return this.#destroy;
-    this.#closed = true;
-    this.#unsubscribe();
-    this.#unsubscribeErrors();
-    for (const cleanup of [...this.#subscriptionCleanup]) cleanup();
-    this.#destroy = this.#protocol.close().then(() => this.#onDestroyed());
+  public destroy(): Promise<void> { return this.#lease.close(); }
+
+  /** Invoked by the retained owner handle, including explicit cleanup-only retry. */
+  public closeOwnedResources(retryArg = false): Promise<void> {
+    if (retryArg) return this.#drain(true);
+    if (!this.#destroy) {
+      this.#closed = true;
+      this.#destroy = Promise.resolve().then(() => this.#drain(false));
+    }
     return this.#destroy;
   }
 
+  async #drain(retryArg: boolean): Promise<void> {
+    for (const cleanup of [...this.#subscriptionCleanup]) cleanup();
+    // The first close already joined every admitted callback. Explicit retry acknowledges its
+    // retained failure; subscriber code is never invoked again as part of cleanup.
+    if (retryArg) this.#subscriberFailure = false;
+    const cleanup = this.#resources.map((resourceArg) => {
+      if (retryArg && resourceArg.failed) { resourceArg.promise = undefined; resourceArg.failed = false; }
+      resourceArg.promise ??= Promise.resolve().then(resourceArg.cleanup).catch(() => {
+        resourceArg.failed = true;
+        throw new Error('Tuya owned resource cleanup failed.');
+      });
+      return resourceArg.promise;
+    });
+    const [results] = await Promise.all([Promise.allSettled(cleanup), Promise.allSettled([...this.#callbacks])]);
+    const failures = results.filter((resultArg): resultArg is PromiseRejectedResult => resultArg.status === 'rejected').map((resultArg) => resultArg.reason as unknown);
+    if (this.#subscriberFailure) failures.push(new Error('Tuya event subscriber failed.'));
+    if (failures.length) throw new AggregateError(failures, 'Tuya cleanup failed; ownership remains retained for explicit retry.');
+  }
+
   #accept(reportArg: plugins.ecobridgeDeviceManager.ITuyaDatapointReport): void {
     const changes: ITuyaObservedDatapoint[] = [];
     for (const mapping of this.#config.datapoints) {
@@ -134,6 +166,7 @@ export class TuyaRuntime implements IIntegrationRuntime {
   }
 
   async #write(mappingArg: TTuyaDatapointMapping, valueArg: unknown, signalArg?: AbortSignal): Promise<IServiceCallResult> {
+    this.#lease.assertOpen();
     if (!this.isHealthy()) throw new Error('Tuya session is unavailable; no automatic reconnect or retry is performed.');
     if (mappingArg.kind === 'sensor' || mappingArg.access !== 'read-write') throw new Error('Tuya datapoint is read-only.');
     if (!tuyaValueMatches(mappingArg, valueArg)) throw new TypeError('Tuya write value does not match its configured type/range/step.');
@@ -151,16 +184,29 @@ export class TuyaRuntime implements IIntegrationRuntime {
 
   #emit(eventArg: Omit<IIntegrationEvent, 'integrationDomain' | 'deviceId' | 'timestamp'>): void {
     for (const handler of [...this.#subscriptions]) {
-      if (this.#destroy) return;
+      if (this.#destroy || this.#lease.signal.aborted) return;
+      if (this.#callbacks.size >= 128) {
+        this.#subscriberFailed();
+        void this.destroy().catch(() => undefined);
+        return;
+      }
+      // Reserve a continuation before entering foreign code, including synchronous close reentry.
+      let finish!: () => void;
+      const continuation = new Promise<void>((resolveArg) => { finish = resolveArg; });
+      this.#callbacks.add(continuation);
+      const settled = (): void => { this.#callbacks.delete(continuation); finish(); };
       try {
         const result: unknown = handler({ ...structuredClone(eventArg), integrationDomain: 'tuya', deviceId: tuyaDeviceId(this.#config), timestamp: Date.now() });
-        if (result instanceof Promise) void result.catch(() => this.#subscriberFailed());
-      } catch { this.#subscriberFailed(); }
+        if (result !== null && (typeof result === 'object' || typeof result === 'function')) {
+          void Promise.resolve(result).then(settled, () => { this.#subscriberFailed(); settled(); });
+        } else settled();
+      } catch { this.#subscriberFailed(); settled(); }
     }
   }
 
   #subscriberFailed(): void {
-    if (this.#destroy) return;
-    this.#logger?.log('error', 'Tuya event subscriber failed.', { code: 'subscriber-error' });
+    this.#subscriberFailure = true;
+    try { this.#lease.context.logger?.log('error', 'Tuya event subscriber failed.', { code: 'subscriber-error' }); }
+    catch { /* Logging cannot detach or replace a retained subscriber failure. */ }
   }
 }

package/ts/integrations/tuya/tuya.mapper.ts

@@ -25,7 +25,7 @@ export const tuyaDevices = (configArg: IHomeAssistantTuyaConfig, observedArg: re
   protocol: 'unknown', manufacturer: 'Tuya', online: availableArg,
   features: observedArg.map(({ mapping }) => ({
     id: tuyaFeatureId(mapping), name: mapping.name, readable: true,
-    writable: mapping.kind !== 'sensor' && mapping.access === 'read-write',
+    writable: availableArg && mapping.kind !== 'sensor' && mapping.access === 'read-write',
     capability: mapping.kind === 'switch' ? 'switch' : mapping.kind === 'brightness' ? 'light' : 'sensor',
     ...(mapping.kind === 'sensor' && mapping.unit !== undefined ? { unit: mapping.unit } : {}),
   })),

package/ts/integrations/tuya/tuya.types.ts

@@ -1,3 +1,7 @@
+import type { INativeIntegrationOwnerOptions } from '../../core/classes.nativeintegrationowner.js';
+
+export interface ITuyaIntegrationOptions extends INativeIntegrationOwnerOptions {}
+
 export type TTuyaDatapointAccess = 'read' | 'read-write';
 
 export interface ITuyaDatapointIdentity {

package/ts/integrations/tuya/tuya.validation.ts

@@ -97,15 +97,12 @@ export const normalizeTuyaConfig = (valueArg: unknown): IHomeAssistantTuyaConfig
   });
 };
 
-export const scopedTuyaStore = (configArg: IHomeAssistantTuyaConfig, contextArg: IIntegrationSetupContext): NoSqlConfigStore => {
+/** Capture data fields before admission; the shared owner verifies home and actual store scope. */
+export const tuyaSetupContext = (contextArg: IIntegrationSetupContext): IIntegrationSetupContext => {
   const context = tuyaRecord(contextArg, 'setup context');
-  tuyaKeys(context, ['configStore', 'abortSignal', 'logger']);
-  const store = context.configStore;
-  if (!(store instanceof NoSqlConfigStore)) throw new TypeError('Tuya requires an encrypted NoSqlConfigStore and caller-owned encryption key provider.');
-  const scope = store.getScope();
-  if (scope.homeId !== configArg.homeId || scope.integrationDomain !== 'tuya') throw new TypeError('Tuya encrypted store must belong to the exact configured home and integration.');
-  if (context.abortSignal !== undefined && !(context.abortSignal instanceof AbortSignal)) throw new TypeError('Tuya setup cancellation must be an AbortSignal.');
-  return store;
+  tuyaKeys(context, ['homeId', 'configStore', 'abortSignal', 'logger']);
+  if (!(context.configStore instanceof NoSqlConfigStore)) throw new TypeError('Tuya requires an encrypted NoSqlConfigStore and caller-owned encryption key provider.');
+  return Object.freeze(context) as IIntegrationSetupContext;
 };
 
 export const tuyaCredentialId = (deviceIdArg: string): string => `device:${deviceIdArg}`;