homematic-manager 3.0.0-beta.31 → 3.0.0-beta.33

package/node_modules/@homematic-manager/backend/dist/api/backend.d.ts

@@ -17,7 +17,9 @@ import { maintenanceAddress, type AppConfig, type ApiEventName, type ApiEvents,
 import { type ConfigStoreOptions } from '../config/store.js';
 import { type DiscoverOptions } from '../discovery/discover.js';
 import { InterfaceManager, type InterfaceManagerOptions } from '../interfaces/manager.js';
+import { LiteInterfaces, type LiteInterfacesOptions } from '../interfaces/lite.js';
 import { type MetaServiceOptions } from '../meta/service.js';
+import { type PairWithSystemOptions } from '../meta/system.js';
 import { RegaService, type RegaServiceOptions } from '../rega/client.js';
 import { ApiEventEmitter } from '../util/emitter.js';
 import { type CallbackNetwork } from '../util/net.js';
@@ -87,6 +89,11 @@ export interface BackendOptions extends Omit<ConfigStoreOptions, 'version'> {
     readonly now?: () => number;
     /** Injected by the tests in place of the real world. */
     readonly createInterfaceManager?: (options: InterfaceManagerOptions) => InterfaceManager;
+    /** Task 72: the same for the openccu-lite path of a remote connection. */
+    readonly createLiteInterfaces?: (options: LiteInterfacesOptions) => LiteInterfaces;
+    readonly liteOptions?: Partial<LiteInterfacesOptions>;
+    /** Task 72: occulite-client's `pair()`, replaced by the tests. */
+    readonly pair?: PairWithSystemOptions['pair'];
     readonly createRega?: (options: RegaServiceOptions) => RegaService;
     /** D-40: injected by the tests, and by the integration test that runs a real occulited. */
     readonly metaOptions?: Partial<MetaServiceOptions>;

package/node_modules/@homematic-manager/backend/dist/api/backend.js

@@ -18,16 +18,16 @@ import { RPC_METHOD_NAMES, RSSI_UNKNOWN, countsAsServiceMessage, isAcknowledgeab
 import { CacheStore } from '../cache/store.js';
 import { ConfigStore } from '../config/store.js';
 import { LinkTemplateStore } from '../config/linkTemplates.js';
-import { validateConnection, writePaceFor } from '../config/defaults.js';
+import { normaliseConnection, validateConnection, writePaceFor } from '../config/defaults.js';
 import { DataFileServer } from '../data/files.js';
 import { installModeCalls } from '../devices/installMode.js';
 import { discoverCcus } from '../discovery/discover.js';
 import { BackendError, configError, connectionError, errorMessage, internalError, isMethodUnsupported, validationError, } from '../errors.js';
 import { DEFAULT_IDLE_UNSUBSCRIBE_MS, InterfaceManager, LOOPBACK_IP, callbackBindHost, firstBidcosInterfaceAddress, } from '../interfaces/manager.js';
+import { LiteInterfaces } from '../interfaces/lite.js';
 import { HeatingGroupsClient } from '../groups/client.js';
-import { DETECT_TIMEOUT_MS, MetaApiClient } from '../meta/client.js';
 import { MetaService, hostBaseUrl } from '../meta/service.js';
-import { createSystemFetch } from '../meta/systemFetch.js';
+import { DETECT_TIMEOUT_MS, detectSystem, pairWithSystem, testSystem, transportFor, } from '../meta/system.js';
 import { RegaService } from '../rega/client.js';
 import { listDevicesAnswer } from '../rpc/server.js';
 import { ApiEventEmitter } from '../util/emitter.js';
@@ -78,7 +78,16 @@ export class Backend {
     #now;
     #methodCache = new Map();
     #caches;
+    /**
+     * Task 72: the interface processes - through callback servers and `init` on a CCU (and on the
+     * system itself, where the addon runs), through lite-rpc on an openccu-lite system reached from
+     * off it. Everything below the API talks to the {@link Interfaces} surface and nothing else.
+     */
     #manager;
+    /** Task 72: counts the connects, so a connect that waited for the probe knows it is still the current one. */
+    #connectSeq = 0;
+    /** Task 72: the pairing with an openccu-lite system that is running, if any. */
+    #pairing;
     #rega;
     /** D-40: the metadata store of this connection - this profile's own, or an openccu-lite box. */
     #meta;
@@ -359,6 +368,12 @@ export class Backend {
                 return this.#clearCaches();
             case 'config.callbackAddresses':
                 return this.#callbackAddresses(p[0]);
+            case 'connection.test':
+                return this.#testConnection(p[0]);
+            case 'connection.pair':
+                return this.#startPairing(p[0]);
+            case 'connection.pairCancel':
+                return this.#cancelPairing();
             case 'interfaces.list':
                 return this.#manager?.states() ?? [];
             case 'interfaces.reconnect':
@@ -593,12 +608,34 @@ export class Backend {
     }
     async #connectNow() {
         const connection = this.#config.connection;
+        const seq = ++this.#connectSeq;
         this.#paramsetIds.clear();
         this.#noServiceMessages.clear();
         this.#serviceMessageFailures.clear();
         this.#listedMethods.clear();
         this.#noListMethods.clear();
-        const manager = (this.#options.createInterfaceManager ?? ((options) => new InterfaceManager(options)))({
+        // Task 72: a connection from off the system with an API token may be one to an openccu-lite
+        // system, which never calls a remote client back (its D-70): the probe decides *before* the
+        // interfaces are started, and its answer picks lite-rpc over callback servers. Only then is
+        // the probe waited for - for everybody else (the addon on the system, a profile without a
+        // token, every CCU) it runs alongside the interface start as before (D-40's rule: a host
+        // that swallows the packet holds up the names, never the interfaces).
+        const token = (connection.metaToken ?? '').trim();
+        const mayBeRemoteLite = connection.local !== true && token !== '';
+        let hostProbe;
+        let liteProbe;
+        if (mayBeRemoteLite) {
+            liteProbe = await this.#probeHost(connection);
+            if (this.#stopped || seq !== this.#connectSeq) {
+                // disconnected while the host was being asked
+                return;
+            }
+            hostProbe = Promise.resolve(liteProbe);
+        }
+        else {
+            hostProbe = this.#probeHost(connection);
+        }
+        const shared = {
             connection,
             handler: this.#callbackHandler(),
             onStateChanged: (states) => {
@@ -612,27 +649,45 @@ export class Backend {
                 this.#onCall(record);
             },
             originOf: currentOrigin,
-            ...(this.#options.callbackHost === undefined ? {} : { callbackHost: this.#options.callbackHost }),
-            ...(this.#options.defaultCallbackPorts === undefined
-                ? {}
-                : { defaultCallbackPorts: this.#options.defaultCallbackPorts }),
-            ...(this.#config.callbackPins === undefined ? {} : { callbackPins: this.#config.callbackPins }),
-            // B-69: read at every watchdog round - the cache is replaced when the host changes
-            listsDevices: (interfaceName) => this.#caches.devices.size(interfaceName) > 0,
-            ...(this.#options.rpcTimeoutMs === undefined ? {} : { rpcTimeoutMs: this.#options.rpcTimeoutMs }),
-            ...(this.#options.watchdogIntervalMs === undefined
-                ? {}
-                : { watchdogIntervalMs: this.#options.watchdogIntervalMs }),
-            ...(this.#options.localAddresses === undefined ? {} : { localAddresses: this.#options.localAddresses }),
-            ...(this.#options.network === undefined ? {} : { network: this.#options.network }),
-            ...(this.#keepsConfiguredCallbackIp() ? { keepConfiguredCallbackIp: true } : {}),
-            ...(this.#options.now === undefined ? {} : { now: this.#options.now }),
-            ...this.#options.interfaceManagerOptions,
-        });
+        };
+        const manager = liteProbe?.answer !== undefined
+            ? (this.#options.createLiteInterfaces ?? ((options) => new LiteInterfaces(options)))({
+                ...shared,
+                baseUrl: liteProbe.baseUrl ?? hostBaseUrl(connection),
+                token,
+                transport: transportFor({
+                    fetch: this.#options.metaOptions?.fetch,
+                    trust: connection.systemTrust,
+                }),
+                ...(this.#options.rpcTimeoutMs === undefined ? {} : { rpcTimeoutMs: this.#options.rpcTimeoutMs }),
+                ...(this.#options.now === undefined ? {} : { now: this.#options.now }),
+                ...this.#options.liteOptions,
+            })
+            : (this.#options.createInterfaceManager ?? ((options) => new InterfaceManager(options)))({
+                ...shared,
+                ...(this.#options.callbackHost === undefined ? {} : { callbackHost: this.#options.callbackHost }),
+                ...(this.#options.defaultCallbackPorts === undefined
+                    ? {}
+                    : { defaultCallbackPorts: this.#options.defaultCallbackPorts }),
+                ...(this.#config.callbackPins === undefined ? {} : { callbackPins: this.#config.callbackPins }),
+                // B-69: read at every watchdog round - the cache is replaced when the host changes
+                listsDevices: (interfaceName) => this.#caches.devices.size(interfaceName) > 0,
+                ...(this.#options.rpcTimeoutMs === undefined ? {} : { rpcTimeoutMs: this.#options.rpcTimeoutMs }),
+                ...(this.#options.watchdogIntervalMs === undefined
+                    ? {}
+                    : { watchdogIntervalMs: this.#options.watchdogIntervalMs }),
+                ...(this.#options.localAddresses === undefined
+                    ? {}
+                    : { localAddresses: this.#options.localAddresses }),
+                ...(this.#options.network === undefined ? {} : { network: this.#options.network }),
+                ...(this.#keepsConfiguredCallbackIp() ? { keepConfiguredCallbackIp: true } : {}),
+                ...(this.#options.now === undefined ? {} : { now: this.#options.now }),
+                ...this.#options.interfaceManagerOptions,
+            });
         this.#manager = manager;
-        // B-62: is the host an openccu-lite system? Asked alongside the interface start, so that a
-        // host which swallows the packet holds up the names, never the interfaces (D-40's rule).
-        const hostProbe = this.#probeHost(connection);
+        if (liteProbe?.answer !== undefined) {
+            this.#notice('info', `${connection.host}: an openccu-lite system - the interfaces are reached through its lite-rpc with the API token, without callbacks`);
+        }
         try {
             await manager.start();
         }
@@ -709,23 +764,16 @@ export class Backend {
         if (baseUrl === '') {
             return { answer: undefined };
         }
-        const client = new MetaApiClient({ baseUrl, fetch: this.#systemFetch(connection) });
         // B-67: the redirect to https:// is followed, and a certificate nothing trusts is said
-        const found = await client.detect(this.#options.metaOptions?.detectTimeoutMs ?? DETECT_TIMEOUT_MS);
+        const found = await detectSystem(transportFor({ fetch: this.#options.metaOptions?.fetch, trust: connection.systemTrust }), baseUrl, this.#options.metaOptions?.detectTimeoutMs ?? DETECT_TIMEOUT_MS);
         return {
             answer: found.version,
             baseUrl: found.baseUrl,
             ...(found.certificate === undefined ? {} : { certificate: found.certificate }),
         };
     }
-    /**
-     * B-67: the `fetch` for the system's own APIs - with the certificates the profile trusts. The
-     * tests inject theirs through `metaOptions.fetch`, which wins.
-     */
-    #systemFetch(connection) {
-        return this.#options.metaOptions?.fetch ?? createSystemFetch(connection.systemTrust);
-    }
     async #disconnect() {
+        this.#connectSeq += 1;
         this.#clearTimers();
         this.#queue.cancel();
         await this.#manager?.stop();
@@ -775,7 +823,6 @@ export class Backend {
                 onNotice: (level, message) => {
                     this.#notice(level, message);
                 },
-                fetch: this.#systemFetch(connection),
                 ...this.#options.metaOptions,
             });
             if (this.#stopped) {
@@ -1016,6 +1063,83 @@ export class Backend {
         const origin = currentOrigin();
         return this.#queue.enqueue(interfaceName, () => client.call(method, params, { origin }));
     }
+    /*
+     * task 72: the connection test and the pairing with an openccu-lite system
+     */
+    /** `connection.test`: what is at the draft's host, and what its token is worth there. */
+    async #testConnection(input) {
+        const connection = normaliseConnection(input);
+        const baseUrl = hostBaseUrl(connection);
+        if (baseUrl === '') {
+            throw validationError('no CCU address configured');
+        }
+        return testSystem(transportFor({ fetch: this.#options.metaOptions?.fetch, trust: connection.systemTrust }), baseUrl, (connection.metaToken ?? '').trim(), this.#options.metaOptions?.detectTimeoutMs ?? DETECT_TIMEOUT_MS);
+    }
+    /**
+     * `connection.pair`: asks the system for a token and answers at once; the steps come as
+     * `pairing.changed` (openccu-lite task 219: the code is shown here and on the system's Status
+     * page, an administrator approves it there). One pairing at a time - a new one cancels the old.
+     */
+    #startPairing(input) {
+        const connection = normaliseConnection(input);
+        const baseUrl = hostBaseUrl(connection);
+        if (baseUrl === '') {
+            throw validationError('no CCU address configured');
+        }
+        this.#cancelPairing();
+        const controller = new AbortController();
+        this.#pairing = controller;
+        this.events.emit('pairing.changed', { state: 'requesting' });
+        void this.#runPairing(connection, baseUrl, controller);
+        return null;
+    }
+    async #runPairing(connection, baseUrl, controller) {
+        const current = () => this.#pairing === controller;
+        try {
+            const paired = await pairWithSystem({
+                transport: transportFor({ fetch: this.#options.metaOptions?.fetch, trust: connection.systemTrust }),
+                baseUrl,
+                appVersion: this.#config.config.version,
+                detectTimeoutMs: this.#options.metaOptions?.detectTimeoutMs ?? DETECT_TIMEOUT_MS,
+                signal: controller.signal,
+                onCode: (code) => {
+                    if (current()) {
+                        this.events.emit('pairing.changed', { state: 'code', code });
+                    }
+                },
+                ...(this.#options.pair === undefined ? {} : { pair: this.#options.pair }),
+            });
+            if (!current()) {
+                return;
+            }
+            this.#pairing = undefined;
+            this.events.emit('pairing.changed', {
+                state: 'approved',
+                token: paired.token,
+                fingerprint256: paired.fingerprint256,
+                scopes: paired.scopes,
+                name: paired.name,
+            });
+        }
+        catch (error) {
+            if (!current()) {
+                // cancelled, or replaced by a newer one: that one said so
+                return;
+            }
+            this.#pairing = undefined;
+            this.events.emit('pairing.changed', { state: 'failed', message: errorMessage(error) });
+        }
+    }
+    /** `connection.pairCancel`: withdraws the request, on the system too (the client does that). */
+    #cancelPairing() {
+        const controller = this.#pairing;
+        if (controller !== undefined) {
+            this.#pairing = undefined;
+            controller.abort();
+            this.events.emit('pairing.changed', { state: 'cancelled' });
+        }
+        return null;
+    }
     /*
      * configuration
      */
@@ -1342,17 +1466,9 @@ export class Backend {
      */
     async #groupsClient() {
         await this.#metaReady?.catch(() => undefined);
-        const meta = this.#meta;
-        const baseUrl = meta?.boxUrl;
-        if (meta === undefined || baseUrl === undefined) {
-            return undefined;
-        }
-        return new HeatingGroupsClient({
-            baseUrl,
-            credential: () => meta.boxCredential(),
-            // B-67: the same trust as the store's, on the https:// URL the detection found
-            fetch: this.#systemFetch(this.#config.connection),
-        });
+        // B-67: the same transport and trust as the store's, on the https:// URL the detection found
+        const system = this.#meta?.boxLink();
+        return system === undefined ? undefined : new HeatingGroupsClient({ system });
     }
     /** `groups.state`: no box is an answer, not an error - it is what every CCU says. */
     async #groupsState() {
@@ -1969,6 +2085,9 @@ export const API_METHOD_NAMES = [
     'config.discover',
     'config.clearCaches',
     'config.callbackAddresses',
+    'connection.test',
+    'connection.pair',
+    'connection.pairCancel',
     'interfaces.list',
     'interfaces.reconnect',
     'rega.state',

package/node_modules/@homematic-manager/backend/dist/groups/client.d.ts

@@ -8,13 +8,15 @@
  * JSON API with the box's own login - the one this application already has for the metadata store
  * (D-40). This client speaks that API and nothing else; on a CCU it is never built.
  *
- * Like the metadata client: `fetch` and `AbortSignal` only, a typed answer or a thrown
- * {@link BackendError} whose `kind` says what the UI should make of it. The box's error body
+ * The requests are occulite-client's `system.groups` (task 72), on the same transport and with the
+ * same certificate trust as the metadata store; what stays here is the contract's shape and a
+ * thrown {@link BackendError} whose `kind` says what the UI should make of it. The box's error body
  * (`{error, message}`) is kept, because its message is the one worth showing - "there is no group
  * 7", "members: hmipserver's device ids, as GET /groups/types lists them".
  */
 import type { HeatingGroupChange, HeatingGroupDetail, HeatingGroupList, HeatingGroupMember, HeatingGroupType, HeatingGroupsState } from '@homematic-manager/core';
 import { BackendError } from '../errors.js';
+import type { SystemLink } from '../meta/system.js';
 /**
  * How long a call may take. A change makes the box's group process configure direct links, and the
  * box itself waits up to thirty seconds for that process before it answers `502`; this has to
@@ -22,17 +24,14 @@ import { BackendError } from '../errors.js';
  */
 export declare const GROUPS_TIMEOUT_MS = 45000;
 export interface HeatingGroupsClientOptions {
-    /** `http://ccu` or `http://127.0.0.1` - scheme and authority, no path. */
-    readonly baseUrl: string;
     /**
-     * The credential every call goes out with. Reads need the box's `system:read`, changes
-     * `system:write`: the person's session on the box, or the API token off it. Never the addon's
-     * local token by choice - it reads metadata and nothing else, and the box answers 403.
+     * The box, with the credential every call goes out with (its write credential). Reads need the
+     * box's `system:read`, changes `system:write`: the person's session on the box, or the API token
+     * off it. Never the addon's local token by choice - it reads metadata and nothing else, and the
+     * box answers 403.
      */
-    readonly credential: () => string | undefined;
+    readonly system: SystemLink;
     readonly timeoutMs?: number;
-    /** Injected by the tests. */
-    readonly fetch?: typeof globalThis.fetch;
 }
 /** The box refused or could not answer; `status` and `code` are what it said. */
 export declare class HeatingGroupsApiError extends BackendError {

package/node_modules/@homematic-manager/backend/dist/groups/client.js

@@ -8,11 +8,13 @@
  * JSON API with the box's own login - the one this application already has for the metadata store
  * (D-40). This client speaks that API and nothing else; on a CCU it is never built.
  *
- * Like the metadata client: `fetch` and `AbortSignal` only, a typed answer or a thrown
- * {@link BackendError} whose `kind` says what the UI should make of it. The box's error body
+ * The requests are occulite-client's `system.groups` (task 72), on the same transport and with the
+ * same certificate trust as the metadata store; what stays here is the contract's shape and a
+ * thrown {@link BackendError} whose `kind` says what the UI should make of it. The box's error body
  * (`{error, message}`) is kept, because its message is the one worth showing - "there is no group
  * 7", "members: hmipserver's device ids, as GET /groups/types lists them".
  */
+import { OccuLiteError } from 'occulite-client';
 import { BackendError } from '../errors.js';
 /**
  * How long a call may take. A change makes the box's group process configure direct links, and the
@@ -51,13 +53,11 @@ function kindOf(status, code) {
 }
 export class HeatingGroupsClient {
     #options;
-    #fetch;
     constructor(options) {
         this.#options = options;
-        this.#fetch = options.fetch ?? globalThis.fetch;
     }
     get baseUrl() {
-        return this.#options.baseUrl;
+        return this.#options.system.baseUrl;
     }
     /**
      * Does this box have the groups API, and may this credential read it? One `GET /groups`; the
@@ -65,7 +65,7 @@ export class HeatingGroupsClient {
      */
     async probe() {
         try {
-            await this.#json('GET', '/groups');
+            await this.#call((groups, options) => groups.list(options));
             return { available: true };
         }
         catch (error) {
@@ -90,8 +90,8 @@ export class HeatingGroupsClient {
      * between the two calls) is listed without members rather than failing the list.
      */
     async list() {
-        const answer = (await this.#json('GET', '/groups'));
-        const groups = await Promise.all((answer.groups ?? []).map(async (wire) => {
+        const answer = (await this.#call((groups, options) => groups.list(options)));
+        const groups = await Promise.all((answer?.groups ?? []).map(async (wire) => {
             let members = [];
             try {
                 members = (await this.get(wire.id)).members;
@@ -101,12 +101,12 @@ export class HeatingGroupsClient {
             }
             return { ...toGroup(wire), members };
         }));
-        return { groups, devicesToConfigure: answer.devices_to_configure ?? [] };
+        return { groups, devicesToConfigure: answer?.devices_to_configure ?? [] };
     }
     /** `GET /groups/types` - what a new group can be, and what each type could take now. */
     async types() {
-        const answer = (await this.#json('GET', '/groups/types'));
-        return (answer.types ?? []).map((type) => ({
+        const types = (await this.#call((groups, options) => groups.types(options)));
+        return (types ?? []).map((type) => ({
             id: type.id ?? '',
             label: type.label ?? type.id ?? '',
             assignable: type.assignable ?? [],
@@ -115,11 +115,11 @@ export class HeatingGroupsClient {
     }
     /** `GET /groups/{id}`. */
     async get(id) {
-        return toDetail((await this.#json('GET', `/groups/${String(id)}`)));
+        return toDetail(await this.#call((groups, options) => groups.get(id, options)));
     }
     /** `POST /groups` - the box's `create` then `save`, and the metadata side effects in one go. */
     async create(name, type, members) {
-        return toChange((await this.#json('POST', '/groups', { name, type, members: [...members] })));
+        return toChange(await this.#call((groups, options) => groups.create({ name, type, members: [...members] }, options)));
     }
     /**
      * `PUT /groups/{id}` - the name and the members as a whole; a field left out keeps its value.
@@ -130,49 +130,22 @@ export class HeatingGroupsClient {
             ...(change.name === undefined ? {} : { name: change.name }),
             ...(change.members === undefined ? {} : { members: [...change.members] }),
         };
-        return toChange((await this.#json('PUT', `/groups/${String(id)}`, body)));
+        return toChange(await this.#call((groups, options) => groups.update(id, body, options)));
     }
     /** `DELETE /groups/{id}` - answers with the former members, whose group membership is gone. */
     async remove(id) {
-        const answer = (await this.#json('DELETE', `/groups/${String(id)}`));
-        return answer.former_members ?? [];
+        const answer = (await this.#call((groups, options) => groups.remove(id, options)));
+        return answer?.former_members ?? [];
     }
-    #url(route) {
-        return `${this.#options.baseUrl.replace(/\/$/, '')}/api/system/v1${route}`;
-    }
-    async #json(method, route, body) {
-        const credential = this.#options.credential();
-        let response;
+    /** One call of the package's `system.groups`, its errors turned into the contract's. */
+    async #call(run) {
         try {
-            response = await this.#fetch(this.#url(route), {
-                method,
-                signal: AbortSignal.timeout(this.#options.timeoutMs ?? GROUPS_TIMEOUT_MS),
-                headers: {
-                    Accept: 'application/json',
-                    ...(body === undefined ? {} : { 'Content-Type': 'application/json' }),
-                    ...(credential === undefined ? {} : { Authorization: `Bearer ${credential}` }),
-                },
-                ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+            return await run(this.#options.system.client('write').system.groups, {
+                timeout: this.#options.timeoutMs ?? GROUPS_TIMEOUT_MS,
             });
         }
         catch (error) {
-            // the box is off, or the change outlasted the timeout above
-            throw new BackendError({
-                message: `the groups API at ${this.#options.baseUrl} did not answer: ${errorText(error)}`,
-                kind: 'connection',
-            }, { cause: error });
-        }
-        if (!response.ok) {
-            throw await refusal(response);
-        }
-        if (response.status === 204) {
-            return {};
-        }
-        try {
-            return await response.json();
-        }
-        catch (error) {
-            throw new BackendError({ message: `the groups API answered ${String(response.status)} without JSON`, kind: 'internal' }, { cause: error });
+            throw refusal(error, this.baseUrl);
         }
     }
 }
@@ -206,26 +179,26 @@ function toDetail(wire) {
 function toChange(wire) {
     return { ...toDetail(wire), devicesToConfigure: wire.devices_to_configure ?? [] };
 }
-/** The API's `{error, message}` body as the error, or the status when there is none. */
-async function refusal(response) {
-    let code = response.status === 401 || response.status === 403 ? 'forbidden' : 'error';
-    let message = `${String(response.status)} ${response.statusText}`.trim();
-    try {
-        const body = (await response.json());
-        if (typeof body.error === 'string') {
-            code = body.error;
-        }
-        if (typeof body.message === 'string') {
-            message = body.message;
-        }
-    }
-    catch {
-        // not JSON: lighttpd's own error page, or a box that is not openccu-lite at all
-    }
-    if (response.status === 401 || response.status === 403) {
-        message = `the system refused the credential for the heating groups (${String(response.status)}): ${message}`;
-    }
-    return new HeatingGroupsApiError(response.status, code, message);
+/**
+ * The API's `{error, message}` answer as the error; a box that did not answer (off, the change
+ * outlasted the timeout above, a certificate nobody trusts) as a connection error.
+ */
+function refusal(error, baseUrl) {
+    if (!(error instanceof OccuLiteError) || error.status === undefined) {
+        return new BackendError({ message: `the groups API at ${baseUrl} did not answer: ${errorText(error)}`, kind: 'connection' }, { cause: error });
+    }
+    const status = error.status;
+    const detail = error.detail;
+    let message = typeof detail?.message === 'string' ? detail.message : error.message;
+    const code = error.code.startsWith('http-')
+        ? status === 401 || status === 403
+            ? 'forbidden'
+            : 'error'
+        : error.code;
+    if (status === 401 || status === 403) {
+        message = `the system refused the credential for the heating groups (${String(status)}): ${message}`;
+    }
+    return new HeatingGroupsApiError(status, code, message);
 }
 function errorText(error) {
     return error instanceof Error ? error.message : String(error);