homebridge-salus-cloud 0.1.2 → 0.1.4

package/dist/salusCloudClient.js

@@ -20,9 +20,15 @@ const DEFAULT_EU_SERVICE_API_HOST = 'https://service-api.eu.premium.salusconnect
 const DEFAULT_US_SERVICE_API_HOST = 'https://service-api.us.premium.salusconnect.io';
 const FALLBACK_US_SERVICE_API_HOST = 'https://service-api.us.salusconnect.io';
 const FALLBACK_EU_SERVICE_API_HOST = 'https://service-api.eu.salusconnect.io';
+const DEFAULT_EU_LEGACY_API_HOST = 'https://eu.premium.salusconnect.io';
+const DEFAULT_US_LEGACY_API_HOST = 'https://us.premium.salusconnect.io';
+const FALLBACK_US_LEGACY_API_HOST = 'https://us.salusconnect.io';
+const FALLBACK_EU_LEGACY_API_HOST = 'https://eu.salusconnect.io';
 const COGNITO_INITIATE_AUTH_TARGET = 'AWSCognitoIdentityProviderService.InitiateAuth';
 const ACCEPT_LANGUAGE = 'en-US,en;q=0.9,en;q=0.8';
 const SESSION_REFRESH_SAFETY_MS = 60_000;
+const LEGACY_SESSION_REFRESH_SAFETY_MS = 60_000;
+const LEGACY_DEFAULT_SESSION_TTL_MS = 45 * 60_000;
 const STATUS_ALLOW_PATH_FALLBACK = new Set([404, 405, 426]);
 const STATUS_ALLOW_WRITE_SHAPE_FALLBACK = new Set([400, 404, 405, 409, 415, 422]);
 const DEFAULT_EXPECTED_STATUSES = [200, 201, 202, 204];
@@ -37,6 +43,22 @@ const RETRIABLE_ERROR_CODES = new Set([
     'UND_ERR_CONNECT_TIMEOUT',
     'UND_ERR_SOCKET',
 ]);
+const DEFAULT_COMPANY_CODE_FALLBACKS = [
+    'SALUS',
+    'SALUS_US',
+    'HEATLINK_US',
+    'MRPEX_US',
+    'NEOTHERM_EU',
+    'OMNIE_EU',
+    'PURMO',
+    'CLP_SG',
+    'CLP',
+    'HEATLINK',
+    'MRPEX',
+    'NEOTHERM',
+    'OMNIE',
+];
+const NO_COMPANY_CODE_SENTINEL = '__none__';
 const METADATA_FIELD_NAMES = new Set([
     'id',
     'key',
@@ -56,6 +78,7 @@ const METADATA_FIELD_NAMES = new Set([
     'reported',
     'desired',
     'version',
+    'value',
     'gateway',
     'gateway_id',
     'user_id',
@@ -66,16 +89,25 @@ export class SalusCloudClient {
     config;
     session = null;
     authRequestInFlight = null;
+    legacySession = null;
+    legacyAuthRequestInFlight = null;
     requestTimeoutMs;
     maxRetries;
     retryBaseDelayMs;
     verboseLogging;
     allowInsecureTls;
     serviceApiBaseCandidates;
+    legacyApiBaseCandidates;
     cognitoEndpoint;
     cognitoClientId;
     configuredCompanyCode;
+    companyCodeCandidates = [];
+    activeCompanyCode = null;
+    hasWarnedAboutAuthCompanyCode = false;
     activeServiceApiBaseUrl = null;
+    activeLegacyApiBaseUrl = null;
+    apiTransportMode = 'modern';
+    hasWarnedAboutLegacyFallback = false;
     propertyCacheByDsn = new Map();
     deviceIdToDsn = new Map();
     deviceKeyToDsn = new Map();
@@ -94,22 +126,44 @@ export class SalusCloudClient {
         this.verboseLogging = config.verboseLogging ?? false;
         this.allowInsecureTls = config.allowInsecureTls ?? false;
         this.serviceApiBaseCandidates = buildServiceApiBaseCandidates(config.region, config.apiHost, config.apiVersionPreference);
+        this.legacyApiBaseCandidates = buildLegacyApiBaseCandidates(config.region, config.apiHost);
         const cognitoRegion = normalizeNonEmptyString(config.cognitoRegion) ?? DEFAULT_COGNITO_REGION;
         this.cognitoClientId = normalizeNonEmptyString(config.cognitoClientId) ?? DEFAULT_COGNITO_CLIENT_ID;
         this.cognitoEndpoint = `https://cognito-idp.${cognitoRegion}.amazonaws.com/`;
         this.configuredCompanyCode = normalizeNonEmptyString(config.companyCode) ?? null;
+        this.refreshCompanyCodeCandidates();
         if (this.allowInsecureTls) {
             this.log.warn('TLS certificate validation is disabled for Salus cloud requests (allowInsecureTls=true).');
         }
         if (this.verboseLogging) {
             this.log.debug(`Salus service-api candidates: ${this.serviceApiBaseCandidates.join(', ')}`);
+            this.log.debug(`Salus legacy-api candidates: ${this.legacyApiBaseCandidates.join(', ')}`);
             this.log.debug(`Salus Cognito endpoint: ${this.cognitoEndpoint}`);
+            this.log.debug(`Salus company-code candidates: ${this.companyCodeCandidates.map((candidate) => candidate ?? '<none>').join(', ')}`);
         }
     }
     getCloudBaseUrl() {
+        if (this.apiTransportMode === 'legacy') {
+            return this.activeLegacyApiBaseUrl ?? this.legacyApiBaseCandidates[0];
+        }
         return this.activeServiceApiBaseUrl ?? this.serviceApiBaseCandidates[0];
     }
     async listDevices() {
+        if (this.apiTransportMode === 'legacy') {
+            return await this.listDevicesLegacy();
+        }
+        try {
+            return await this.listDevicesModern();
+        }
+        catch (error) {
+            if (!shouldSwitchToLegacyApi(error)) {
+                throw error;
+            }
+            this.switchToLegacyTransport(`Modern Salus API authorization failed: ${asErrorMessage(error)}`);
+            return await this.listDevicesLegacy();
+        }
+    }
+    async listDevicesModern() {
         const payload = await this.requestServiceJsonWithPathFallback(['/devices/', '/devices'], {
             method: 'GET',
             auth: true,
@@ -138,11 +192,45 @@ export class SalusCloudClient {
         }
         return devices;
     }
+    async listDevicesLegacy() {
+        const payload = await this.requestLegacyJsonWithPathFallback(['/apiv1/devices.json', '/apiv1/devices', '/apiv1/registered_nodes.json'], {
+            method: 'GET',
+            auth: true,
+        });
+        const devices = parseDevices(payload);
+        this.rebuildDeviceIndex(devices);
+        const inlineShadows = parseDeviceShadows(payload, this.deviceIdToDsn, this.deviceKeyToDsn);
+        if (inlineShadows.size > 0) {
+            this.mergeIntoPropertyCache(inlineShadows);
+            if (this.verboseLogging) {
+                this.log.debug(`Hydrated property cache from legacy /apiv1/devices response for ${inlineShadows.size} device(s)`);
+            }
+        }
+        if (this.verboseLogging) {
+            this.log.debug(`Salus legacy cloud returned ${devices.length} device(s)`);
+        }
+        return devices;
+    }
     async listProperties(dsn) {
         const cached = this.propertyCacheByDsn.get(dsn);
         if (cached) {
             return cached;
         }
+        if (this.apiTransportMode === 'legacy') {
+            return await this.listPropertiesLegacy(dsn);
+        }
+        try {
+            return await this.listPropertiesModern(dsn);
+        }
+        catch (error) {
+            if (!shouldSwitchToLegacyApi(error)) {
+                throw error;
+            }
+            this.switchToLegacyTransport(`Modern Salus property sync failed for ${dsn}: ${asErrorMessage(error)}`);
+            return await this.listPropertiesLegacy(dsn);
+        }
+    }
+    async listPropertiesModern(dsn) {
         const shadows = await this.fetchDeviceShadows([], [dsn]);
         const fromFetch = shadows.get(dsn);
         if (fromFetch) {
@@ -154,7 +242,43 @@ export class SalusCloudClient {
         }
         return new Map();
     }
+    async listPropertiesLegacy(dsn) {
+        const encodedDsn = encodeURIComponent(dsn);
+        const payload = await this.requestLegacyJsonWithPathFallback([
+            `/apiv1/dsns/${encodedDsn}/properties.json`,
+            `/apiv1/dsns/${encodedDsn}/properties`,
+        ], {
+            method: 'GET',
+            auth: true,
+        });
+        const parsed = parseProperties(payload);
+        if (parsed.size > 0) {
+            this.propertyCacheByDsn.set(dsn, parsed);
+            return parsed;
+        }
+        if (this.verboseLogging) {
+            this.log.debug(`No legacy cloud property payload found for dsn=${dsn}. Returning empty property map.`);
+        }
+        return new Map();
+    }
     async setDatapoint(dsn, propertyName, value) {
+        if (this.apiTransportMode === 'legacy') {
+            await this.setDatapointLegacy(dsn, propertyName, value);
+            return;
+        }
+        try {
+            await this.setDatapointModern(dsn, propertyName, value);
+            return;
+        }
+        catch (error) {
+            if (!shouldSwitchToLegacyApi(error)) {
+                throw error;
+            }
+            this.switchToLegacyTransport(`Modern Salus datapoint write failed for ${dsn}/${propertyName}: ${asErrorMessage(error)}`);
+            await this.setDatapointLegacy(dsn, propertyName, value);
+        }
+    }
+    async setDatapointModern(dsn, propertyName, value) {
         const writeCacheKey = `${dsn}:${propertyName}`;
         const preferredAttempt = this.preferredWriteAttemptByKey.get(writeCacheKey) ?? null;
         const attempts = prioritizeByDescription(this.buildWriteAttempts(dsn, propertyName, value), preferredAttempt);
@@ -199,6 +323,101 @@ export class SalusCloudClient {
         }
         throw new Error(`Failed to write property ${propertyName} on ${dsn}. Attempts: ${failures.join(' | ')}`);
     }
+    async setDatapointLegacy(dsn, propertyName, value) {
+        const encodedDsn = encodeURIComponent(dsn);
+        const encodedPropertyName = encodeURIComponent(propertyName);
+        const attempts = [
+            {
+                method: 'POST',
+                path: `/apiv1/dsns/${encodedDsn}/properties/${encodedPropertyName}/datapoints.json`,
+                body: {
+                    datapoint: {
+                        value,
+                    },
+                },
+                description: 'POST /apiv1/dsns/{dsn}/properties/{property}/datapoints.json {datapoint:{value}}',
+            },
+            {
+                method: 'POST',
+                path: `/apiv1/dsns/${encodedDsn}/properties/${encodedPropertyName}/datapoints`,
+                body: {
+                    datapoint: {
+                        value,
+                    },
+                },
+                description: 'POST /apiv1/dsns/{dsn}/properties/{property}/datapoints {datapoint:{value}}',
+            },
+            {
+                method: 'PUT',
+                path: `/apiv1/dsns/${encodedDsn}/properties/${encodedPropertyName}/datapoints.json`,
+                body: {
+                    datapoint: {
+                        value,
+                    },
+                },
+                description: 'PUT /apiv1/dsns/{dsn}/properties/{property}/datapoints.json {datapoint:{value}}',
+            },
+            {
+                method: 'POST',
+                path: `/apiv1/dsns/${encodedDsn}/properties/${encodedPropertyName}/datapoints.json`,
+                body: {
+                    value,
+                },
+                description: 'POST /apiv1/dsns/{dsn}/properties/{property}/datapoints.json {value}',
+            },
+        ];
+        const failures = [];
+        let fatalError;
+        for (const attempt of attempts) {
+            try {
+                await this.requestLegacyJson(attempt.path, {
+                    method: attempt.method,
+                    body: attempt.body,
+                    auth: true,
+                    expectedStatuses: DEFAULT_EXPECTED_STATUSES,
+                });
+                this.updateCachedProperty(dsn, propertyName, value);
+                if (this.verboseLogging) {
+                    this.log.debug(`Legacy write succeeded via ${attempt.description}`);
+                }
+                return;
+            }
+            catch (error) {
+                const failureMessage = error instanceof HttpStatusError
+                    ? `${attempt.description} -> HTTP ${error.status}`
+                    : `${attempt.description} -> ${asErrorMessage(error)}`;
+                failures.push(failureMessage);
+                if (error instanceof HttpStatusError && STATUS_ALLOW_WRITE_SHAPE_FALLBACK.has(error.status)) {
+                    continue;
+                }
+                if (error instanceof HttpStatusError && STATUS_ALLOW_PATH_FALLBACK.has(error.status)) {
+                    continue;
+                }
+                fatalError = error;
+                break;
+            }
+        }
+        if (fatalError) {
+            throw new Error(`Failed to write property ${propertyName} on ${dsn} via legacy API. Fatal error: ${asErrorMessage(fatalError)}. Attempts: ${failures.join(' | ')}`);
+        }
+        throw new Error(`Failed to write property ${propertyName} on ${dsn} via legacy API. Attempts: ${failures.join(' | ')}`);
+    }
+    switchToLegacyTransport(reason) {
+        if (this.apiTransportMode === 'legacy') {
+            return;
+        }
+        this.apiTransportMode = 'legacy';
+        this.activeServiceApiBaseUrl = null;
+        this.authorizationHeaderProfile = 'accessBearer';
+        this.session = null;
+        this.authRequestInFlight = null;
+        this.hasWarnedAboutAuthCompanyCode = false;
+        if (!this.hasWarnedAboutLegacyFallback) {
+            this.hasWarnedAboutLegacyFallback = true;
+            this.log.warn(`Switching to legacy Salus cloud compatibility mode (${reason})`);
+            this.log.warn('Legacy mode uses /users/sign_in.json and /apiv1 endpoints for tenant compatibility.');
+        }
+    }
     rememberPreferredWriteAttempt(cacheKey, description) {
         this.preferredWriteAttemptByKey.delete(cacheKey);
         this.preferredWriteAttemptByKey.set(cacheKey, description);
@@ -491,6 +710,37 @@ export class SalusCloudClient {
             },
         });
     }
+    refreshCompanyCodeCandidates() {
+        const candidates = buildCompanyCodeCandidates(this.configuredCompanyCode, this.session?.companyCode);
+        this.companyCodeCandidates = candidates;
+        if (this.activeCompanyCode && candidates.includes(this.activeCompanyCode)) {
+            return;
+        }
+        this.activeCompanyCode = candidates[0] ?? null;
+    }
+    rotateCompanyCodeCandidate(attemptedCompanyCodes, preferredCode) {
+        if (preferredCode) {
+            const normalizedPreferred = normalizeNonEmptyString(preferredCode);
+            if (normalizedPreferred) {
+                const preferredKey = companyCodeCandidateKey(normalizedPreferred);
+                if (!attemptedCompanyCodes.has(preferredKey)) {
+                    attemptedCompanyCodes.add(preferredKey);
+                    this.activeCompanyCode = normalizedPreferred;
+                    return normalizedPreferred;
+                }
+            }
+        }
+        for (const candidate of this.companyCodeCandidates) {
+            const key = companyCodeCandidateKey(candidate);
+            if (attemptedCompanyCodes.has(key)) {
+                continue;
+            }
+            attemptedCompanyCodes.add(key);
+            this.activeCompanyCode = candidate;
+            return candidate;
+        }
+        return null;
+    }
     async ensureLoggedIn() {
         if (this.session && Date.now() + SESSION_REFRESH_SAFETY_MS < this.session.expiresAtEpochMs) {
             return;
@@ -513,6 +763,7 @@ export class SalusCloudClient {
         this.authRequestInFlight = (async () => {
             this.session = null;
             this.session = await this.authenticateWithPassword();
+            this.refreshCompanyCodeCandidates();
             this.log.info('Authenticated with Salus cloud');
         })();
         try {
@@ -531,11 +782,13 @@ export class SalusCloudClient {
             if (!refreshToken) {
                 this.session = null;
                 this.session = await this.authenticateWithPassword();
+                this.refreshCompanyCodeCandidates();
                 this.log.info('Authenticated with Salus cloud');
                 return;
             }
             try {
                 this.session = await this.authenticateWithRefreshToken(refreshToken);
+                this.refreshCompanyCodeCandidates();
             }
             catch (error) {
                 this.session = null;
@@ -552,6 +805,116 @@ export class SalusCloudClient {
             this.authRequestInFlight = null;
         }
     }
+    async ensureLegacyLoggedIn() {
+        if (this.legacySession && Date.now() + LEGACY_SESSION_REFRESH_SAFETY_MS < this.legacySession.expiresAtEpochMs) {
+            return;
+        }
+        await this.loginLegacy();
+    }
+    async loginLegacy() {
+        if (this.legacyAuthRequestInFlight) {
+            return this.legacyAuthRequestInFlight;
+        }
+        this.legacyAuthRequestInFlight = (async () => {
+            this.legacySession = await this.authenticateLegacyWithPassword();
+            this.log.info('Authenticated with Salus cloud (legacy API compatibility mode)');
+        })();
+        try {
+            await this.legacyAuthRequestInFlight;
+        }
+        finally {
+            this.legacyAuthRequestInFlight = null;
+        }
+    }
+    async authenticateLegacyWithPassword() {
+        const email = this.config.email?.trim();
+        const password = this.config.password;
+        if (!email || !password) {
+            throw new Error('Salus credentials are missing. Set email and password in plugin config.');
+        }
+        const totalAttempts = this.maxRetries + 1;
+        let lastError = new Error('Legacy Salus login did not return a session');
+        for (let attempt = 1; attempt <= totalAttempts; attempt++) {
+            const orderedBaseUrls = this.getOrderedLegacyApiBaseUrls();
+            let sawRetriableFailure = false;
+            let sawDefinitiveFailure = false;
+            let definitiveError;
+            for (const baseUrl of orderedBaseUrls) {
+                try {
+                    const response = await this.fetchWithTimeout(buildLegacyUrl(baseUrl, '/users/sign_in.json', true), {
+                        method: 'POST',
+                        headers: {
+                            Accept: 'application/json',
+                            'Content-Type': 'application/json',
+                            'Accept-Language': ACCEPT_LANGUAGE,
+                            'User-Agent': 'homebridge-salus-cloud/2026',
+                        },
+                        body: JSON.stringify({
+                            user: {
+                                email,
+                                password,
+                            },
+                        }),
+                    });
+                    if (!response.ok) {
+                        const responseText = await safeReadText(response);
+                        const statusError = new HttpStatusError(responseText
+                            ? `Legacy Salus login failed at ${baseUrl} (HTTP ${response.status}) :: ${responseText}`
+                            : `Legacy Salus login failed at ${baseUrl} (HTTP ${response.status})`, response.status, responseText);
+                        if (isRetriableStatus(response.status)) {
+                            lastError = statusError;
+                            sawRetriableFailure = true;
+                            continue;
+                        }
+                        sawDefinitiveFailure = true;
+                        if (!definitiveError) {
+                            definitiveError = statusError;
+                        }
+                        lastError = statusError;
+                        continue;
+                    }
+                    const payload = await parseResponseBody(response);
+                    const session = parseLegacyTokens(payload);
+                    if (!session) {
+                        const parseError = new Error(`Legacy Salus login succeeded at ${baseUrl}, but access token was missing in response.`);
+                        sawDefinitiveFailure = true;
+                        if (!definitiveError) {
+                            definitiveError = parseError;
+                        }
+                        lastError = parseError;
+                        continue;
+                    }
+                    this.activeLegacyApiBaseUrl = baseUrl;
+                    return session;
+                }
+                catch (error) {
+                    if (!this.allowInsecureTls && isTlsCertificateError(error)) {
+                        const message = `${asErrorMessage(error)}. If Salus cloud certificate is invalid, set "allowInsecureTls": true in plugin config.`;
+                        throw new Error(message);
+                    }
+                    if (isRetriableFailure(error)) {
+                        sawRetriableFailure = true;
+                        lastError = error;
+                        continue;
+                    }
+                    sawDefinitiveFailure = true;
+                    if (!definitiveError) {
+                        definitiveError = error;
+                    }
+                    lastError = error;
+                }
+            }
+            if (sawDefinitiveFailure) {
+                throw definitiveError ?? lastError;
+            }
+            if (attempt < totalAttempts && sawRetriableFailure) {
+                await this.retryDelay(attempt, asErrorMessage(lastError));
+                continue;
+            }
+            break;
+        }
+        throw new Error(`Legacy Salus login failed after retries: ${asErrorMessage(lastError)}`);
+    }
     async authenticateWithPassword() {
         const email = this.config.email?.trim();
         const password = this.config.password;
@@ -647,6 +1010,25 @@ export class SalusCloudClient {
         }
         throw new Error(`No valid path candidates for request: ${paths.join(', ')}`);
     }
+    async requestLegacyJsonWithPathFallback(paths, options) {
+        let lastPathError;
+        for (const path of paths) {
+            try {
+                return await this.requestLegacyJson(path, options);
+            }
+            catch (error) {
+                if (error instanceof HttpStatusError && STATUS_ALLOW_PATH_FALLBACK.has(error.status)) {
+                    lastPathError = error;
+                    continue;
+                }
+                throw error;
+            }
+        }
+        if (lastPathError) {
+            throw lastPathError;
+        }
+        throw new Error(`No valid legacy path candidates for request: ${paths.join(', ')}`);
+    }
     async requestServiceJson(path, options) {
         const authRequired = options.auth ?? true;
         if (authRequired) {
@@ -655,7 +1037,8 @@ export class SalusCloudClient {
         const expectedStatuses = options.expectedStatuses ?? DEFAULT_EXPECTED_STATUSES;
         const totalAttempts = this.maxRetries + 1;
         let hasRefreshedSessionAfter401 = false;
-        const attemptedAuthProfiles = new Set([this.authorizationHeaderProfile]);
+        let attemptedAuthProfiles = new Set([this.authorizationHeaderProfile]);
+        const attemptedCompanyCodes = new Set([companyCodeCandidateKey(this.activeCompanyCode)]);
         let lastError = new Error(`No Salus cloud response received for ${options.method} ${path}`);
         for (let attempt = 1; attempt <= totalAttempts; attempt++) {
             const orderedBaseUrls = this.getOrderedServiceApiBaseUrls();
@@ -677,31 +1060,49 @@ export class SalusCloudClient {
                         headers,
                         body,
                     });
-                    if (response.status === 401 && authRequired && (options.allow401Refresh ?? true) && !hasRefreshedSessionAfter401) {
-                        hasRefreshedSessionAfter401 = true;
-                        this.log.warn(`Salus cloud returned 401 for ${options.method} ${path} at ${baseUrl}. Refreshing session token and retrying.`);
-                        await this.refreshSession();
-                        lastError = new HttpStatusError('Unauthorized', 401, '');
-                        sawRetriableFailure = true;
-                        lastRetriableError = lastError;
-                        baseIndex -= 1;
-                        continue;
-                    }
                     if (response.status === 401 && authRequired) {
+                        const responseText = await safeReadText(response);
+                        const responseCode = extractServiceResponseCode(responseText);
+                        const hintedCompanyCode = extractCompanyCodeFromServiceAuthError(responseText);
+                        if (responseCode === '900008' && !this.hasWarnedAboutAuthCompanyCode) {
+                            this.hasWarnedAboutAuthCompanyCode = true;
+                            this.log.warn('Salus cloud returned response_code=900008 (Not authorized). This often indicates tenant/company authorization context mismatch.');
+                        }
+                        if ((options.allow401Refresh ?? true) && !hasRefreshedSessionAfter401) {
+                            hasRefreshedSessionAfter401 = true;
+                            this.log.warn(`Salus cloud returned 401 for ${options.method} ${path} at ${baseUrl}. Refreshing session token and retrying.`);
+                            await this.refreshSession();
+                            lastError = new HttpStatusError('Unauthorized', 401, responseText);
+                            sawRetriableFailure = true;
+                            lastRetriableError = lastError;
+                            baseIndex -= 1;
+                            continue;
+                        }
                         const rotatedTo = rotateAuthorizationHeaderProfile(this.authorizationHeaderProfile);
                         if (rotatedTo !== this.authorizationHeaderProfile && !attemptedAuthProfiles.has(rotatedTo)) {
                             this.authorizationHeaderProfile = rotatedTo;
                             attemptedAuthProfiles.add(rotatedTo);
                             this.log.warn(`Salus cloud returned 401 for ${options.method} ${path} at ${baseUrl}. Retrying with alternate auth header profile: ${rotatedTo}.`);
-                            lastError = new HttpStatusError('Unauthorized', 401, '');
+                            lastError = new HttpStatusError('Unauthorized', 401, responseText);
+                            sawRetriableFailure = true;
+                            lastRetriableError = lastError;
+                            baseIndex -= 1;
+                            continue;
+                        }
+                        const previousCompanyCode = this.activeCompanyCode;
+                        const rotatedCompanyCode = this.rotateCompanyCodeCandidate(attemptedCompanyCodes, hintedCompanyCode);
+                        if (companyCodeCandidateKey(rotatedCompanyCode) !== companyCodeCandidateKey(previousCompanyCode)) {
+                            this.authorizationHeaderProfile = 'accessBearer';
+                            attemptedAuthProfiles = new Set([this.authorizationHeaderProfile]);
+                            this.log.warn(rotatedCompanyCode
+                                ? `Salus cloud returned 401 for ${options.method} ${path} at ${baseUrl}. Retrying with alternate company code header: ${rotatedCompanyCode}.`
+                                : `Salus cloud returned 401 for ${options.method} ${path} at ${baseUrl}. Retrying without company code header.`);
+                            lastError = new HttpStatusError('Unauthorized', 401, responseText);
                             sawRetriableFailure = true;
                             lastRetriableError = lastError;
                             baseIndex -= 1;
                             continue;
                         }
-                    }
-                    if (response.status === 401 && authRequired) {
-                        const responseText = await safeReadText(response);
                         const unauthorizedError = new HttpStatusError(responseText
                             ? `HTTP 401 Unauthorized on ${options.method} ${path} via ${baseUrl} :: ${responseText}`
                             : `HTTP 401 Unauthorized on ${options.method} ${path} via ${baseUrl}`, 401, responseText);
@@ -760,6 +1161,9 @@ export class SalusCloudClient {
                         lastError = error;
                         sawRetriableFailure = true;
                         lastRetriableError = error;
+                        if (this.verboseLogging) {
+                            this.log.debug(`Retriable network error for ${options.method} ${path} via ${baseUrl}: ${asErrorMessage(error)}`);
+                        }
                         continue;
                     }
                     throw error;
@@ -778,6 +1182,125 @@ export class SalusCloudClient {
         }
         throw new Error(`Unexpected request state for ${options.method} ${path}`);
     }
+    async requestLegacyJson(path, options) {
+        const authRequired = options.auth ?? true;
+        if (authRequired) {
+            await this.ensureLegacyLoggedIn();
+        }
+        const expectedStatuses = options.expectedStatuses ?? DEFAULT_EXPECTED_STATUSES;
+        const totalAttempts = this.maxRetries + 1;
+        let hasRefreshedSessionAfter401 = false;
+        let lastError = new Error(`No legacy Salus cloud response received for ${options.method} ${path}`);
+        for (let attempt = 1; attempt <= totalAttempts; attempt++) {
+            const orderedBaseUrls = this.getOrderedLegacyApiBaseUrls();
+            let sawRetriableFailure = false;
+            let sawDefinitiveFailure = false;
+            let definitiveError;
+            let lastRetriableError;
+            for (const baseUrl of orderedBaseUrls) {
+                try {
+                    const headers = this.buildLegacyHeaders(authRequired);
+                    const body = options.body !== undefined ? JSON.stringify(options.body) : undefined;
+                    if (body !== undefined) {
+                        headers['Content-Type'] = 'application/json';
+                    }
+                    const response = await this.fetchWithTimeout(buildLegacyUrl(baseUrl, path, options.method === 'GET'), {
+                        method: options.method,
+                        headers,
+                        body,
+                    });
+                    if (response.status === 401 && authRequired) {
+                        const responseText = await safeReadText(response);
+                        if ((options.allow401Refresh ?? true) && !hasRefreshedSessionAfter401) {
+                            hasRefreshedSessionAfter401 = true;
+                            this.log.warn(`Legacy Salus cloud returned 401 for ${options.method} ${path} at ${baseUrl}. Re-authenticating and retrying.`);
+                            this.legacySession = null;
+                            await this.loginLegacy();
+                            lastError = new HttpStatusError('Unauthorized', 401, responseText);
+                            sawRetriableFailure = true;
+                            lastRetriableError = lastError;
+                            continue;
+                        }
+                        const unauthorizedError = new HttpStatusError(responseText
+                            ? `HTTP 401 Unauthorized on legacy ${options.method} ${path} via ${baseUrl} :: ${responseText}`
+                            : `HTTP 401 Unauthorized on legacy ${options.method} ${path} via ${baseUrl}`, 401, responseText);
+                        lastError = unauthorizedError;
+                        sawRetriableFailure = true;
+                        lastRetriableError = unauthorizedError;
+                        continue;
+                    }
+                    if (!expectedStatuses.includes(response.status)) {
+                        const responseText = await safeReadText(response);
+                        const statusError = new HttpStatusError(responseText
+                            ? `Legacy API HTTP ${response.status} ${response.statusText} on ${options.method} ${path} :: ${responseText}`
+                            : `Legacy API HTTP ${response.status} ${response.statusText} on ${options.method} ${path}`, response.status, responseText);
+                        if (STATUS_ALLOW_PATH_FALLBACK.has(response.status)) {
+                            lastError = statusError;
+                            continue;
+                        }
+                        if (isRetriableStatus(response.status)) {
+                            lastError = statusError;
+                            sawRetriableFailure = true;
+                            lastRetriableError = statusError;
+                            continue;
+                        }
+                        lastError = statusError;
+                        sawDefinitiveFailure = true;
+                        if (!definitiveError) {
+                            definitiveError = statusError;
+                        }
+                        continue;
+                    }
+                    this.activeLegacyApiBaseUrl = baseUrl;
+                    if (response.status === 204) {
+                        return undefined;
+                    }
+                    return await parseResponseBody(response);
+                }
+                catch (error) {
+                    if (!this.allowInsecureTls && isTlsCertificateError(error)) {
+                        const message = `${asErrorMessage(error)}. If Salus cloud certificate is invalid, set "allowInsecureTls": true in plugin config.`;
+                        throw new Error(message);
+                    }
+                    if (error instanceof HttpStatusError) {
+                        lastError = error;
+                        if (isRetriableStatus(error.status)) {
+                            sawRetriableFailure = true;
+                            lastRetriableError = error;
+                        }
+                        else if (!STATUS_ALLOW_PATH_FALLBACK.has(error.status)) {
+                            sawDefinitiveFailure = true;
+                            if (!definitiveError) {
+                                definitiveError = error;
+                            }
+                        }
+                        continue;
+                    }
+                    if (isRetriableError(error)) {
+                        lastError = error;
+                        sawRetriableFailure = true;
+                        lastRetriableError = error;
+                        if (this.verboseLogging) {
+                            this.log.debug(`Retriable legacy network error for ${options.method} ${path} via ${baseUrl}: ${asErrorMessage(error)}`);
+                        }
+                        continue;
+                    }
+                    throw error;
+                }
+            }
+            if (sawDefinitiveFailure) {
+                throw definitiveError ?? lastError;
+            }
+            if (attempt < totalAttempts && sawRetriableFailure) {
+                await this.retryDelay(attempt, asErrorMessage(lastRetriableError ?? lastError));
+                continue;
+            }
+            if (lastError) {
+                throw lastError;
+            }
+        }
+        throw new Error(`Unexpected legacy request state for ${options.method} ${path}`);
+    }
     buildServiceHeaders(authRequired) {
         const headers = {
             Accept: 'application/json',
@@ -790,15 +1313,32 @@ export class SalusCloudClient {
         if (!this.session) {
             throw new Error('Missing Salus cloud session while building authenticated request.');
         }
+        const authToken = tokenForAuthorizationProfile(this.authorizationHeaderProfile, this.session.accessToken, this.session.idToken);
         headers.Authorization = formatAuthorizationHeader(this.authorizationHeaderProfile, this.session.accessToken, this.session.idToken);
         headers['x-access-token'] = this.session.accessToken;
-        headers['x-auth-token'] = this.session.idToken || this.session.accessToken;
-        const companyCode = this.configuredCompanyCode ?? this.session.companyCode;
+        headers['x-auth-token'] = authToken;
+        const companyCode = this.activeCompanyCode;
         if (companyCode) {
             headers['x-company-code'] = companyCode;
         }
         return headers;
     }
+    buildLegacyHeaders(authRequired) {
+        const headers = {
+            Accept: 'application/json',
+            'Accept-Language': ACCEPT_LANGUAGE,
+            'User-Agent': 'homebridge-salus-cloud/2026',
+        };
+        if (!authRequired) {
+            return headers;
+        }
+        if (!this.legacySession) {
+            throw new Error('Missing Salus legacy session while building authenticated request.');
+        }
+        const tokenType = normalizeNonEmptyString(this.legacySession.tokenType) ?? 'Bearer';
+        headers.Authorization = `${tokenType} ${this.legacySession.accessToken}`;
+        return headers;
+    }
     getOrderedServiceApiBaseUrls() {
         const dedupe = new Set();
         const ordered = [];
@@ -815,6 +1355,22 @@ export class SalusCloudClient {
         }
         return ordered;
     }
+    getOrderedLegacyApiBaseUrls() {
+        const dedupe = new Set();
+        const ordered = [];
+        if (this.activeLegacyApiBaseUrl) {
+            dedupe.add(this.activeLegacyApiBaseUrl);
+            ordered.push(this.activeLegacyApiBaseUrl);
+        }
+        for (const candidate of this.legacyApiBaseCandidates) {
+            if (dedupe.has(candidate)) {
+                continue;
+            }
+            dedupe.add(candidate);
+            ordered.push(candidate);
+        }
+        return ordered;
+    }
     async retryDelay(attempt, reason) {
         const baseDelay = Math.min(MAX_RETRY_DELAY_MS, this.retryBaseDelayMs * (2 ** (attempt - 1)));
         const jitter = 0.85 + (Math.random() * 0.3);
@@ -886,6 +1442,57 @@ function buildServiceApiBaseCandidates(region, overrideHost, versionPreference)
         ];
     return dedupeStringArray(hosts.flatMap((host) => buildApiVersionCandidates(host, versionPreference)));
 }
+function buildLegacyApiBaseCandidates(region, overrideHost) {
+    const normalizedOverride = normalizeNonEmptyString(overrideHost);
+    if (normalizedOverride) {
+        const overrideCandidates = deriveLegacyHostCandidatesFromOverride(normalizedOverride);
+        if (overrideCandidates.length > 0) {
+            const withFallback = [
+                ...overrideCandidates,
+                ...(region === 'us'
+                    ? [DEFAULT_US_LEGACY_API_HOST, FALLBACK_US_LEGACY_API_HOST, DEFAULT_EU_LEGACY_API_HOST, FALLBACK_EU_LEGACY_API_HOST]
+                    : [DEFAULT_EU_LEGACY_API_HOST, FALLBACK_EU_LEGACY_API_HOST, DEFAULT_US_LEGACY_API_HOST, FALLBACK_US_LEGACY_API_HOST]),
+            ];
+            return dedupeStringArray(withFallback.map((value) => normalizeUrl(value)));
+        }
+    }
+    const hosts = region === 'us'
+        ? [
+            DEFAULT_US_LEGACY_API_HOST,
+            FALLBACK_US_LEGACY_API_HOST,
+            DEFAULT_EU_LEGACY_API_HOST,
+            FALLBACK_EU_LEGACY_API_HOST,
+        ]
+        : [
+            DEFAULT_EU_LEGACY_API_HOST,
+            FALLBACK_EU_LEGACY_API_HOST,
+            DEFAULT_US_LEGACY_API_HOST,
+            FALLBACK_US_LEGACY_API_HOST,
+        ];
+    return dedupeStringArray(hosts.map((value) => normalizeUrl(value)));
+}
+function deriveLegacyHostCandidatesFromOverride(overrideHost) {
+    const normalizedOverride = normalizeUrl(overrideHost);
+    const candidates = new Set();
+    try {
+        const parsed = new URL(normalizedOverride);
+        const hostname = parsed.hostname.toLowerCase();
+        const protocol = parsed.protocol;
+        candidates.add(`${protocol}//${hostname}`);
+        if (hostname.startsWith('service-api.')) {
+            candidates.add(`${protocol}//${hostname.replace(/^service-api\./, '')}`);
+        }
+    }
+    catch {
+        // Keep best-effort fallback.
+        candidates.add(normalizedOverride.replace(/\/api\/v[12](?:\/.*)?$/i, '').replace(/\/+$/, ''));
+        candidates.add(normalizedOverride
+            .replace(/\/api\/v[12](?:\/.*)?$/i, '')
+            .replace(/\/+$/, '')
+            .replace(/:\/\/service-api\./i, '://'));
+    }
+    return [...candidates].filter((value) => value.trim() !== '');
+}
 function buildApiVersionCandidates(baseHost, preference) {
     const normalized = normalizeUrl(baseHost).replace(/\/+$/, '');
     const versions = preference === 'v1'
@@ -912,6 +1519,11 @@ function buildServiceUrl(baseUrl, path, addTimestamp) {
     const joined = `${baseUrl}${normalizedPath}`;
     return addTimestamp ? withTimestampQuery(joined) : joined;
 }
+function buildLegacyUrl(baseUrl, path, addTimestamp) {
+    const normalizedPath = path.startsWith('/') ? path : `/${path}`;
+    const joined = `${baseUrl}${normalizedPath}`;
+    return addTimestamp ? withTimestampQuery(joined) : joined;
+}
 function withTimestampQuery(url) {
     const separator = url.includes('?') ? '&' : '?';
     return `${url}${separator}timestamp=${Date.now()}`;
@@ -933,6 +1545,71 @@ function normalizeNonEmptyString(value) {
     }
     return trimmed;
 }
+function buildCompanyCodeCandidates(configuredCompanyCode, sessionCompanyCode) {
+    const normalizedConfigured = normalizeNonEmptyString(configuredCompanyCode ?? undefined) ?? null;
+    const normalizedSession = normalizeNonEmptyString(sessionCompanyCode);
+    const fallbackCandidates = DEFAULT_COMPANY_CODE_FALLBACKS
+        .map((value) => normalizeNonEmptyString(value))
+        .filter((value) => Boolean(value));
+    const initialCandidates = normalizedConfigured
+        ? [normalizedConfigured, normalizedSession ?? null, null]
+        : [normalizedSession ?? null, null];
+    const seen = new Set();
+    const deduped = [];
+    for (const candidate of [...initialCandidates, ...fallbackCandidates]) {
+        const key = companyCodeCandidateKey(candidate);
+        if (seen.has(key)) {
+            continue;
+        }
+        seen.add(key);
+        deduped.push(candidate);
+    }
+    return deduped;
+}
+function companyCodeCandidateKey(candidate) {
+    return candidate ?? NO_COMPANY_CODE_SENTINEL;
+}
+function tokenForAuthorizationProfile(profile, accessToken, idToken) {
+    if (profile === 'idBearer' || profile === 'idRaw') {
+        return idToken;
+    }
+    return accessToken;
+}
+function extractServiceResponseCode(responseText) {
+    if (!responseText) {
+        return undefined;
+    }
+    const parsed = parseJsonRecord(responseText);
+    if (!parsed) {
+        return undefined;
+    }
+    return asString(parsed.response_code)
+        ?? asString(parsed.code)
+        ?? asString(parsed.error_code);
+}
+function extractCompanyCodeFromServiceAuthError(responseText) {
+    if (!responseText) {
+        return undefined;
+    }
+    const parsed = parseJsonRecord(responseText);
+    if (!parsed) {
+        return undefined;
+    }
+    const direct = asRecord(parsed.data) ?? parsed;
+    return extractCompanyCodeFromTokenClaims(direct);
+}
+function parseJsonRecord(value) {
+    const trimmed = value.trim();
+    if (!trimmed) {
+        return undefined;
+    }
+    try {
+        return asRecord(JSON.parse(trimmed));
+    }
+    catch {
+        return undefined;
+    }
+}
 function parseCognitoTokens(payload, refreshTokenFallback) {
     const record = asRecord(payload);
     if (!record) {
@@ -966,6 +1643,40 @@ function parseCognitoTokens(payload, refreshTokenFallback) {
         companyCode: extractCompanyCodeFromTokenClaims(decodedIdTokenClaims, decodedAccessTokenClaims),
     };
 }
+function parseLegacyTokens(payload) {
+    const root = asRecord(payload);
+    if (!root) {
+        return undefined;
+    }
+    const valueRecord = asRecord(root.value);
+    const candidateRecords = [
+        root,
+        valueRecord,
+        asRecord(root.user),
+        valueRecord ? asRecord(valueRecord.user) : undefined,
+    ].filter((value) => Boolean(value));
+    for (const candidate of candidateRecords) {
+        const accessToken = normalizeNonEmptyString(asString(candidate.access_token)
+            ?? asString(candidate.accessToken)
+            ?? asString(candidate.token)
+            ?? asString(candidate.auth_token)
+            ?? asString(candidate.bearer_token));
+        if (!accessToken) {
+            continue;
+        }
+        const tokenType = normalizeNonEmptyString(asString(candidate.token_type) ?? asString(candidate.tokenType)) ?? 'Bearer';
+        const expiresInRaw = parseNumberLike(candidate.expires_in ?? candidate.expiresIn ?? candidate.expired_in);
+        const expiresInMs = Number.isFinite(expiresInRaw)
+            ? Math.max(60_000, Math.floor(Number(expiresInRaw) * 1_000))
+            : LEGACY_DEFAULT_SESSION_TTL_MS;
+        return {
+            accessToken,
+            tokenType,
+            expiresAtEpochMs: Date.now() + expiresInMs,
+        };
+    }
+    return undefined;
+}
 function formatAuthorizationHeader(profile, accessToken, idToken) {
     if (profile === 'idBearer') {
         return `Bearer ${idToken}`;
@@ -1061,7 +1772,7 @@ function parseDevices(payload) {
         candidates.push(payload);
     }
     if (root) {
-        const arrayKeys = ['devices', 'registered_nodes', 'nodes', 'results', 'data', 'list', 'device_list'];
+        const arrayKeys = ['devices', 'registered_nodes', 'nodes', 'results', 'data', 'list', 'device_list', 'value'];
         for (const key of arrayKeys) {
             const arr = asArray(root[key]);
             if (arr) {
@@ -1216,17 +1927,30 @@ function parseProperties(payload) {
     const result = new Map();
     const root = asRecord(payload);
     const candidateArrays = [];
+    const candidateSingles = [];
     if (Array.isArray(payload)) {
         candidateArrays.push(payload);
     }
     if (root) {
-        const keys = ['properties', 'property', 'data', 'results', 'datapoints', 'list'];
+        const keys = ['properties', 'property', 'data', 'results', 'datapoints', 'list', 'value'];
         for (const key of keys) {
             const maybeArray = asArray(root[key]);
             if (maybeArray) {
                 candidateArrays.push(maybeArray);
             }
         }
+        const valueRecord = asRecord(root.value);
+        if (valueRecord) {
+            candidateSingles.push(valueRecord);
+            const nestedArrayKeys = ['properties', 'property', 'data', 'results', 'datapoints', 'list'];
+            for (const key of nestedArrayKeys) {
+                const nestedArray = asArray(valueRecord[key]);
+                if (nestedArray) {
+                    candidateArrays.push(nestedArray);
+                }
+            }
+        }
+        candidateSingles.push(root);
     }
     for (const entries of candidateArrays) {
         for (const entry of entries) {
@@ -1236,8 +1960,18 @@ function parseProperties(payload) {
             }
         }
     }
-    if (root) {
-        parsePropertyObjectMap(root, result);
+    for (const candidate of candidateSingles) {
+        const property = parsePropertyEntry(candidate);
+        if (property) {
+            result.set(property.name, property);
+        }
+    }
+    for (const candidate of candidateSingles) {
+        const record = asRecord(candidate);
+        if (!record) {
+            continue;
+        }
+        parsePropertyObjectMap(record, result);
     }
     return result;
 }
@@ -1460,6 +2194,22 @@ function isRetriableFailure(error) {
     }
     return isRetriableError(error);
 }
+function shouldSwitchToLegacyApi(error) {
+    if (!(error instanceof HttpStatusError)) {
+        return false;
+    }
+    if (error.status === 401 || error.status === 403) {
+        const responseCode = extractServiceResponseCode(error.responseBody);
+        if (responseCode === '900008') {
+            return true;
+        }
+        const body = error.responseBody.toLowerCase();
+        if (body.includes('not authorized') || body.includes('unauthorized')) {
+            return true;
+        }
+    }
+    return false;
+}
 function isRetriableStatus(status) {
     return status === 408 || status === 425 || status === 429 || status >= 500;
 }