tsvesync 1.4.1 → 1.4.3

package/README.md

@@ -208,40 +208,21 @@ await manager.login();
 
 #### Supported Country Codes
 
-The library supports all country codes. Common ones include:
-
-**Americas:**
-- `US` - United States (default)
-- `CA` - Canada
-- `MX` - Mexico
-
-**Europe:** (uses EU endpoint)
-- `GB` - United Kingdom
-- `DE` - Germany
-- `FR` - France
-- `IT` - Italy
-- `ES` - Spain
-- `NL` - Netherlands
-- `SE` - Sweden
-- `NO` - Norway
-- `DK` - Denmark
-- `FI` - Finland
-- `PL` - Poland
-- And all other European countries
-
-**Asia-Pacific:** (uses US endpoint)
-- `AU` - Australia
-- `NZ` - New Zealand
-- `JP` - Japan
-- `SG` - Singapore
-- `CN` - China
-- `KR` - South Korea
-
-**Important Notes:**
-- If you get an authentication error about "country code mismatch" or "cross-region error", you need to set your country code
-- The country code should match the country where your VeSync account was created
-- European countries automatically use the EU endpoint (`smartapi.vesync.eu`)
-- All other countries use the US endpoint (`smartapi.vesync.com`)
+The library supports all ISO 3166-1 alpha-2 country codes (e.g. `US`, `DE`, `AU`).
+
+##### pyvesync parity notes (regions + device list)
+
+VeSync uses two API base URLs:
+- US: `https://smartapi.vesync.com`
+- EU: `https://smartapi.vesync.eu`
+
+This library intentionally mirrors **pyvesync** behavior for the initial region selection:
+- `US` region: `US`, `CA`, `MX`, `JP`
+- `EU` region: everything else
+
+Some accounts may still “live” in the opposite region for historical/app reasons; in that case the new auth flow returns a cross‑region response and we automatically retry Step 2 using the server-provided `currentRegion`/`countryCode` + `bizToken` (pyvesync-style).
+
+Device discovery parity note: the device list call uses `/cloud/v1/deviceManaged/devices` with bypass headers only; `token` and `accountID` are supplied in the request body (matching pyvesync’s request model).
 
 ### Working with Devices
 

package/dist/lib/constants.d.ts

@@ -3,6 +3,7 @@
  */
 export declare const CREDENTIAL_ERROR_CODES: number[];
 export declare const CROSS_REGION_ERROR_CODES: number[];
+export declare const TOKEN_ERROR_CODES: number[];
 export declare const APP_VERSION_ERROR_CODES: number[];
 /**
  * Check if an error code indicates bad credentials
@@ -12,3 +13,7 @@ export declare function isCredentialError(code: number): boolean;
  * Check if an error code indicates cross-region issue
  */
 export declare function isCrossRegionError(code: number): boolean;
+/**
+ * Check if an error code indicates the token is invalid/expired.
+ */
+export declare function isTokenError(code: number): boolean;

package/dist/lib/constants.js

@@ -3,9 +3,10 @@
  * VeSync API Error Codes
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.APP_VERSION_ERROR_CODES = exports.CROSS_REGION_ERROR_CODES = exports.CREDENTIAL_ERROR_CODES = void 0;
+exports.APP_VERSION_ERROR_CODES = exports.TOKEN_ERROR_CODES = exports.CROSS_REGION_ERROR_CODES = exports.CREDENTIAL_ERROR_CODES = void 0;
 exports.isCredentialError = isCredentialError;
 exports.isCrossRegionError = isCrossRegionError;
+exports.isTokenError = isTokenError;
 // Authentication error codes that indicate bad credentials (no point retrying)
 exports.CREDENTIAL_ERROR_CODES = [
     -11201129, // account or password incorrect
@@ -17,6 +18,11 @@ exports.CROSS_REGION_ERROR_CODES = [
     -11260022, // cross region error
     -11261022, // access region conflict error
 ];
+// Token/auth invalidation error codes
+// pyvesync parity: `-11001000` maps to TOKEN_EXPIRED (invalid token)
+exports.TOKEN_ERROR_CODES = [
+    -11001000, // token expired/invalid
+];
 // Other error codes
 exports.APP_VERSION_ERROR_CODES = [
     -11012022, // app version is too low
@@ -33,3 +39,9 @@ function isCredentialError(code) {
 function isCrossRegionError(code) {
     return exports.CROSS_REGION_ERROR_CODES.includes(code);
 }
+/**
+ * Check if an error code indicates the token is invalid/expired.
+ */
+function isTokenError(code) {
+    return exports.TOKEN_ERROR_CODES.includes(code);
+}

package/dist/lib/helpers.d.ts

@@ -6,7 +6,8 @@ export declare function getApiBaseUrl(): string;
 export declare function setApiBaseUrl(url: string): void;
 export declare function getCurrentRegion(): string;
 export declare function setCurrentRegion(region: string): void;
-export declare function getRegionFromCountryCode(countryCode: string): string;
+export declare const NON_EU_COUNTRY_CODES: string[];
+export declare function getRegionFromCountryCode(countryCode: string): 'US' | 'EU';
 export declare const API_RATE_LIMIT = 30;
 export declare const API_TIMEOUT = 15000;
 export declare const APP_VERSION = "5.7.16";
@@ -141,11 +142,11 @@ export declare class Helpers {
     /**
      * Build request body for initial authentication step
      */
-    static reqBodyAuthStep1(manager: VeSync, appId: string, terminalId: string, region?: string): Record<string, any>;
+    static reqBodyAuthStep1(manager: VeSync, appId: string, terminalId: string, userCountryCode: string): Record<string, any>;
     /**
      * Build request body for second authentication step (login with authorize code)
      */
-    static reqBodyAuthStep2(authorizeCode: string, bizToken: string | null, appId: string, terminalId: string, userCountryCode?: string, regionChange?: string): Record<string, any>;
+    static reqBodyAuthStep2(authorizeCode: string, bizToken: string | null, _appId: string, terminalId: string, userCountryCode?: string, regionChange?: string): Record<string, any>;
     /**
      * Builder for body of api requests
      */

package/dist/lib/helpers.js

@@ -6,7 +6,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.Helpers = exports.AUTH_ERROR_CODES = exports.APP_VERSION_TOO_LOW_ERROR_CODE = exports.REGION_ENDPOINTS = exports.CLIENT_VERSION = exports.BYPASS_HEADER_UA = exports.MOBILE_ID = exports.DEFAULT_REGION = exports.DEFAULT_TZ = exports.USER_TYPE = exports.CLIENT_INFO = exports.PHONE_OS = exports.PHONE_BRAND = exports.APP_VERSION = exports.API_TIMEOUT = exports.API_RATE_LIMIT = void 0;
+exports.Helpers = exports.AUTH_ERROR_CODES = exports.APP_VERSION_TOO_LOW_ERROR_CODE = exports.REGION_ENDPOINTS = exports.CLIENT_VERSION = exports.BYPASS_HEADER_UA = exports.MOBILE_ID = exports.DEFAULT_REGION = exports.DEFAULT_TZ = exports.USER_TYPE = exports.CLIENT_INFO = exports.PHONE_OS = exports.PHONE_BRAND = exports.APP_VERSION = exports.API_TIMEOUT = exports.API_RATE_LIMIT = exports.NON_EU_COUNTRY_CODES = void 0;
 exports.getApiBaseUrl = getApiBaseUrl;
 exports.setApiBaseUrl = setApiBaseUrl;
 exports.getCurrentRegion = getCurrentRegion;
@@ -41,19 +41,27 @@ function setCurrentRegion(region) {
         _apiBaseUrl = exports.REGION_ENDPOINTS[region];
     }
 }
+// pyvesync parity:
+// VeSync only exposes two API base URLs (US + EU). pyvesync intentionally uses a
+// *deny-list* mapping here:
+//   - `US` region: US/CA/MX/JP
+//   - `EU` region: everything else
+//
+// This is counter-intuitive if you read it as "EU countries", but it's really
+// "the EU *endpoint*". In practice, many accounts outside Europe (e.g. AU/NZ/SG)
+// can be hosted on either endpoint depending on how/when the account was created.
+//
+// The correct/robust behavior comes from the Step 2 cross-region flow: when the
+// region guess is wrong, the API returns `currentRegion`/`countryCode` plus a
+// `bizToken`, and we retry Step 2 using the server-provided values (pyvesync-style).
+exports.NON_EU_COUNTRY_CODES = ['US', 'CA', 'MX', 'JP'];
 // Determine region from country code
 function getRegionFromCountryCode(countryCode) {
-    const euCountries = [
-        'AT', 'BE', 'BG', 'HR', 'CY', 'CZ', 'DK', 'EE', 'FI', 'FR',
-        'DE', 'GR', 'HU', 'IE', 'IT', 'LV', 'LT', 'LU', 'MT', 'NL',
-        'PL', 'PT', 'RO', 'SK', 'SI', 'ES', 'SE', 'GB', 'IS', 'LI',
-        'NO', 'CH'
-    ];
-    if (euCountries.includes(countryCode)) {
-        return 'EU';
+    const normalized = countryCode.trim().toUpperCase();
+    if (exports.NON_EU_COUNTRY_CODES.includes(normalized)) {
+        return 'US';
     }
-    // Default to US for other countries
-    return 'US';
+    return 'EU';
 }
 exports.API_RATE_LIMIT = 30;
 exports.API_TIMEOUT = 15000;
@@ -97,25 +105,8 @@ function getUSEndpointCountryCodes() {
  * Get the appropriate API endpoint based on country code
  */
 function getEndpointForCountryCode(countryCode) {
-    // European country codes that should use the EU endpoint
-    const euCountryCodes = [
-        // Western Europe
-        'GB', 'DE', 'FR', 'IT', 'ES', 'NL', 'BE', 'AT', 'CH', 'IE', 'PT', 'LU',
-        // Nordic countries
-        'SE', 'NO', 'DK', 'FI', 'IS',
-        // Eastern Europe
-        'PL', 'CZ', 'HU', 'RO', 'BG', 'HR', 'SI', 'SK', 'LT', 'LV', 'EE',
-        // Southern Europe
-        'GR', 'CY', 'MT',
-        // Other European
-        'AL', 'BA', 'RS', 'ME', 'MK', 'MD', 'UA', 'BY'
-    ];
-    // Check if country code is in EU list
-    if (euCountryCodes.includes(countryCode)) {
-        return 'EU';
-    }
-    // Everything else uses US endpoint (including AU, NZ, JP, CA, MX, etc.)
-    return 'US';
+    // Alias for clarity: this is the region-to-endpoint mapping used by pyvesync.
+    return getRegionFromCountryCode(countryCode);
 }
 /**
  * Detect user's home region from email domain or country hints
@@ -166,18 +157,21 @@ function generateAppId() {
 }
 // Generate unique terminal ID for authentication
 function generateTerminalId() {
-    const chars = 'abcdef0123456789';
-    let result = '';
-    for (let i = 0; i < 16; i++) {
-        result += chars.charAt(Math.floor(Math.random() * chars.length));
-    }
-    return result;
+    // pyvesync parity: terminalId is a UUID-like identifier prefixed with "2".
+    return `2${crypto_1.default.randomUUID().replace(/-/g, '')}`;
 }
 function generateTraceId() {
     const timestamp = Math.floor(Date.now() / 1000);
     const randomPart = Math.floor(Math.random() * 100000).toString().padStart(5, '0');
     return `APP${exports.MOBILE_ID.slice(-5, -1)}${timestamp}-${randomPart}`;
 }
+let _authTraceCallNumber = 0;
+function generateAuthTraceId(terminalId) {
+    _authTraceCallNumber += 1;
+    const suffix = terminalId.slice(-5, -1);
+    const timestamp = Math.floor(Date.now() / 1000);
+    return `APP${suffix}${timestamp}-${String(_authTraceCallNumber).padStart(5, '0')}`;
+}
 class Helpers {
     static generateTraceId() {
         return generateTraceId();
@@ -306,16 +300,12 @@ class Helpers {
     /**
      * Build request body for initial authentication step
      */
-    static reqBodyAuthStep1(manager, appId, terminalId, region = 'US') {
-        // Detect user's home region and country code
-        const userRegion = detectUserRegion(manager.username);
-        const userCountryCode = getCountryCodeFromRegion(region === 'EU' ? 'EU' : userRegion, manager.username);
-        logger_1.logger.debug('Authentication Step 1 - Region detection:', {
-            email: manager.username,
-            detectedRegion: userRegion,
-            requestRegion: region,
-            userCountryCode: userCountryCode
-        });
+    static reqBodyAuthStep1(manager, appId, terminalId, userCountryCode) {
+        // pyvesync parity:
+        // - Mirrors `pyvesync.models.vesync_models.RequestGetTokenModel`
+        // - `userCountryCode` defaults to `DEFAULT_REGION` ("US") unless the caller overrides it
+        // - `timeZone` defaults to `DEFAULT_TZ` ("America/New_York") during auth; the API later updates the
+        //   effective timezone used for device operations.
         return {
             'email': manager.username,
             'method': 'authByPWDOrOTM',
@@ -323,29 +313,42 @@ class Helpers {
             'acceptLanguage': 'en',
             'accountID': '',
             'authProtocolType': 'generic',
-            'clientInfo': exports.CLIENT_INFO,
+            'clientInfo': exports.PHONE_BRAND,
             'clientType': 'vesyncApp',
             'clientVersion': exports.CLIENT_VERSION,
             'debugMode': false,
             'osInfo': exports.PHONE_OS,
             'terminalId': terminalId,
-            'timeZone': manager.timeZone || exports.DEFAULT_TZ,
+            'timeZone': exports.DEFAULT_TZ,
             'token': '',
-            'userCountryCode': userCountryCode,
+            'userCountryCode': userCountryCode.trim().toUpperCase(),
             'appID': appId,
             'sourceAppID': appId,
-            'traceId': `APP${appId}${Math.floor(Date.now() / 1000)}`
+            'traceId': generateAuthTraceId(terminalId)
         };
     }
     /**
      * Build request body for second authentication step (login with authorize code)
      */
-    static reqBodyAuthStep2(authorizeCode, bizToken, appId, terminalId, userCountryCode, regionChange) {
+    static reqBodyAuthStep2(authorizeCode, bizToken, _appId, terminalId, userCountryCode, regionChange) {
+        // pyvesync parity:
+        // - Mirrors `pyvesync.models.vesync_models.RequestLoginTokenModel`
+        // - `timeZone` remains `DEFAULT_TZ` during auth (device timezone is handled elsewhere)
+        // - Step 2 intentionally does NOT include `appID` / `sourceAppID`. Those are only sent in Step 1
+        //   (`RequestGetTokenModel`). pyvesync's Step 2 request model has no appID fields.
+        //   If you see older diagnostics including appID/sourceAppID in Step 2, treat it as a superset payload
+        //   rather than a requirement — our goal here is to match the known-working pyvesync request shape.
+        // - IMPORTANT: `bizToken` here is the *region-change token* returned by VeSync on Step 2 CROSS_REGION
+        //   errors. It is not part of the normal Step 1 -> Step 2 flow. pyvesync does not send a Step 1
+        //   bizToken in the initial Step 2 request (Step 1 result is just `{ accountID, authorizeCode }`);
+        //   it only includes `bizToken` + `regionChange='lastRegion'`
+        //   when retrying Step 2 after a cross-region response. See `pyvesync/auth.py:_exchange_authorization_code`.
         const body = {
             'method': 'loginByAuthorizeCode4Vesync',
             'authorizeCode': authorizeCode,
             'acceptLanguage': 'en',
-            'clientInfo': exports.CLIENT_INFO,
+            'accountID': '',
+            'clientInfo': exports.PHONE_BRAND,
             'clientType': 'vesyncApp',
             'clientVersion': exports.CLIENT_VERSION,
             'debugMode': false,
@@ -353,8 +356,9 @@ class Helpers {
             'osInfo': exports.PHONE_OS,
             'terminalId': terminalId,
             'timeZone': exports.DEFAULT_TZ,
-            'userCountryCode': userCountryCode || 'US',
-            'traceId': `APP${appId}${Math.floor(Date.now() / 1000)}`
+            'token': '',
+            'userCountryCode': (userCountryCode || exports.DEFAULT_REGION).trim().toUpperCase(),
+            'traceId': generateAuthTraceId(terminalId)
         };
         // Only include bizToken if it's not null
         if (bizToken) {
@@ -433,13 +437,18 @@ class Helpers {
      * Call VeSync API
      */
     static async callApi(endpoint, method, data = null, headers = {}, manager) {
+        let url = '';
         try {
+            // Prefer manager-scoped base URL (pyvesync resolves per-manager from current region).
+            // Keep the module-level base URL as a fallback for older callers.
+            let baseUrl = manager.apiBaseUrl || _apiBaseUrl;
             // Ensure API base URL is properly set
-            if (!_apiBaseUrl || _apiBaseUrl === 'undefined') {
-                logger_1.logger.error('API base URL is not properly configured. Setting to default US endpoint...');
-                setApiBaseUrl('https://smartapi.vesync.com');
+            if (!baseUrl || baseUrl === 'undefined') {
+                logger_1.logger.error('API base URL is not properly configured. Falling back to US endpoint...');
+                baseUrl = 'https://smartapi.vesync.com';
+                manager.apiBaseUrl = baseUrl;
             }
-            const url = _apiBaseUrl + endpoint;
+            url = baseUrl + endpoint;
             logger_1.logger.debug(`Making API call to: ${url}`);
             const response = await (0, axios_1.default)({
                 method,
@@ -473,14 +482,14 @@ class Helpers {
                     status: error.response.status,
                     code: responseData === null || responseData === void 0 ? void 0 : responseData.code,
                     message: responseData === null || responseData === void 0 ? void 0 : responseData.msg,
-                    url: _apiBaseUrl + endpoint
+                    url
                 });
                 return [responseData, error.response.status];
             }
             logger_1.logger.error('API call failed:', {
                 code: error.code,
                 message: error.message,
-                url: _apiBaseUrl + endpoint
+                url: url || (manager.apiBaseUrl || _apiBaseUrl || '') + endpoint
             });
             return [null, 0];
         }
@@ -549,26 +558,36 @@ class Helpers {
      * Perform new two-step authentication flow
      */
     static async authNewFlow(manager, appId, region = 'US', countryCodeOverride) {
+        var _a, _b, _c;
         try {
             // Generate terminal ID to be used in both steps
             const terminalId = generateTerminalId();
+            // pyvesync parity:
+            // - `userCountryCode` defaults to `DEFAULT_REGION` ("US"), even if we first try the EU base URL.
+            // - If the account truly belongs to another region, the Step 2 response includes the correct
+            //   `countryCode`/`currentRegion` and a `bizToken` to retry Step 2 (handled below).
+            // Avoid "guessing" a country code from `region` or email heuristics here; it diverges from pyvesync.
+            const userCountryCode = (countryCodeOverride || exports.DEFAULT_REGION).trim().toUpperCase();
             // Step 1: Get authorization code
-            const step1Body = this.reqBodyAuthStep1(manager, appId, terminalId, region);
+            const step1Body = this.reqBodyAuthStep1(manager, appId, terminalId, userCountryCode);
             const step1Headers = this.reqHeaderAuth();
             // Set the correct regional endpoint
-            const originalUrl = getApiBaseUrl();
-            if (region in exports.REGION_ENDPOINTS) {
-                setApiBaseUrl(exports.REGION_ENDPOINTS[region]);
+            const originalUrl = manager.apiBaseUrl || getApiBaseUrl();
+            const knownBaseUrls = new Set(Object.values(exports.REGION_ENDPOINTS));
+            const hasCustomBaseUrlOverride = !!manager.apiUrlOverride || !knownBaseUrls.has(originalUrl);
+            if (!hasCustomBaseUrlOverride && region in exports.REGION_ENDPOINTS) {
+                const nextUrl = exports.REGION_ENDPOINTS[region];
+                manager.apiBaseUrl = nextUrl;
             }
             logger_1.logger.debug('Step 1: Getting authorization code...', {
                 region,
-                endpoint: getApiBaseUrl(),
+                endpoint: manager.apiBaseUrl || getApiBaseUrl(),
                 body: { ...step1Body, password: '[REDACTED]' }
             });
             const [authResponse, authStatus] = await this.callApi('/globalPlatform/api/accountAuth/v1/authByPWDOrOTM', 'post', step1Body, step1Headers, manager);
             if (!authResponse || authStatus !== 200) {
                 logger_1.logger.error('Step 1 failed:', authResponse);
-                setApiBaseUrl(originalUrl); // Restore original URL
+                manager.apiBaseUrl = originalUrl;
                 return [false, null, null, null];
             }
             if (authResponse.code !== 0) {
@@ -576,30 +595,43 @@ class Helpers {
                 // Check if it's a credential error (no point retrying)
                 if ((0, constants_1.isCredentialError)(authResponse.code)) {
                     logger_1.logger.error('Credential error detected - invalid username or password');
-                    setApiBaseUrl(originalUrl); // Restore original URL
+                    manager.apiBaseUrl = originalUrl;
                     return [false, null, null, 'credential_error'];
                 }
                 // Handle cross-region error (multiple error codes possible)
                 if ((0, constants_1.isCrossRegionError)(authResponse.code)) {
                     logger_1.logger.debug('Cross-region error detected:', authResponse.code, 'will try different region');
-                    setApiBaseUrl(originalUrl); // Restore original URL
+                    manager.apiBaseUrl = originalUrl;
                     return [false, null, null, 'cross_region'];
                 }
-                setApiBaseUrl(originalUrl); // Restore original URL
+                manager.apiBaseUrl = originalUrl;
                 return [false, null, null, null];
             }
-            const { authorizeCode, bizToken } = authResponse.result || {};
+            // pyvesync parity note:
+            // - Step 1 "authByPWDOrOTM" returns a result shaped like RespGetTokenResultModel:
+            //   `{ accountID, authorizeCode }`. There is no Step 1 bizToken to forward.
+            //   See `pyvesync/models/vesync_models.py:RespGetTokenResultModel`.
+            const { authorizeCode } = authResponse.result || {};
             if (!authorizeCode) {
                 logger_1.logger.error('Missing authorization code in step 1 response:', authResponse.result);
-                setApiBaseUrl(originalUrl); // Restore original URL
+                manager.apiBaseUrl = originalUrl;
                 return [false, null, null, null];
             }
             logger_1.logger.debug('Step 1 successful, got authorization code');
             // Step 2: Login with authorization code
             // Use the override if provided, otherwise default to 'US'
             // Users should specify their actual country code in the configuration
-            const countryCodeForStep2 = countryCodeOverride || 'US';
-            const step2Body = this.reqBodyAuthStep2(authorizeCode, bizToken, appId, terminalId, countryCodeForStep2);
+            const countryCodeForStep2 = userCountryCode;
+            // pyvesync parity note:
+            // - Step 1 returns `authorizeCode` (and an `accountID`) but does not require/provide a bizToken for
+            //   the initial Step 2 request.
+            // - Step 2 initial request omits `bizToken`.
+            // - Only if Step 2 returns a CROSS_REGION error does VeSync provide `result.bizToken`, which is then
+            //   echoed back as `bizToken` along with `regionChange='lastRegion'` for a Step 2 retry.
+            //   See `pyvesync/auth.py:_exchange_authorization_code` for the canonical behavior.
+            // - Step 2 also intentionally omits appID/sourceAppID (pyvesync parity); we still pass `appId` through
+            //   to keep the function signature stable/historical.
+            const step2Body = this.reqBodyAuthStep2(authorizeCode, null, appId, terminalId, countryCodeForStep2);
             logger_1.logger.debug('Step 2: Logging in with authorization code...');
             const [loginResponse, loginStatus] = await this.callApi('/user/api/accountManage/v1/loginByAuthorizeCode4Vesync', 'post', step2Body, step1Headers, manager);
             logger_1.logger.debug('Step 2 response:', {
@@ -610,38 +642,60 @@ class Helpers {
             });
             if (!loginResponse || loginStatus !== 200) {
                 logger_1.logger.error('Step 2 failed:', loginResponse);
-                setApiBaseUrl(originalUrl); // Restore original URL on failure
+                manager.apiBaseUrl = originalUrl;
                 return [false, null, null, null];
             }
             if (loginResponse.code !== 0) {
                 logger_1.logger.debug('Step 2 error, code:', loginResponse.code, 'checking if cross-region...');
-                // Handle cross-region error - for EU accounts, we need to switch regions entirely
-                if (constants_1.CROSS_REGION_ERROR_CODES.includes(loginResponse.code)) {
-                    // Log helpful message about country code mismatch
-                    logger_1.logger.warn('═══════════════════════════════════════════════════════════════');
-                    logger_1.logger.warn('COUNTRY CODE MISMATCH DETECTED');
-                    logger_1.logger.warn(`Your account expects a different country code than '${countryCodeForStep2}'`);
-                    logger_1.logger.warn('This usually means:');
-                    logger_1.logger.warn('  1. You need to set the correct country code in your config');
-                    logger_1.logger.warn('  2. Your account was created in a different country/region');
-                    logger_1.logger.warn('');
-                    logger_1.logger.warn('To fix this:');
-                    logger_1.logger.warn('  - In Homebridge UI: Select your correct country from the dropdown');
-                    logger_1.logger.warn('  - In config.json: Add "countryCode": "YOUR_COUNTRY_CODE"');
-                    logger_1.logger.warn('');
-                    logger_1.logger.warn('Common country codes: US, CA, GB, DE, FR, AU, NZ, JP');
-                    logger_1.logger.warn('═══════════════════════════════════════════════════════════════');
-                    logger_1.logger.debug('Cross-region error detected in Step 2 - will try different endpoint');
-                    // For cross-region errors, we need to retry the entire flow with a different region
-                    // The authorization code from Step 1 is tied to the endpoint it was obtained from
-                    setApiBaseUrl(originalUrl); // Restore original URL
+                // Align with pyvesync: on cross-region errors, retry Step 2 using the server-provided
+                // country/region and bizToken + regionChange.
+                if ((0, constants_1.isCrossRegionError)(loginResponse.code)) {
+                    const serverCountryCode = (_a = loginResponse.result) === null || _a === void 0 ? void 0 : _a.countryCode;
+                    const serverRegion = (_b = loginResponse.result) === null || _b === void 0 ? void 0 : _b.currentRegion;
+                    const regionChangeToken = (_c = loginResponse.result) === null || _c === void 0 ? void 0 : _c.bizToken;
+                    logger_1.logger.debug('Cross-region error detected in Step 2; attempting pyvesync-style retry', {
+                        requestedRegion: region,
+                        requestedCountryCode: countryCodeForStep2,
+                        serverCountryCode,
+                        serverRegion,
+                        hasRegionChangeToken: !!regionChangeToken,
+                    });
+                    // If VeSync tells us which region to use, switch to it for subsequent requests.
+                    if (!hasCustomBaseUrlOverride && serverRegion && serverRegion in exports.REGION_ENDPOINTS) {
+                        manager.region = serverRegion;
+                        logger_1.logger.debug(`Updated region to ${serverRegion} for Step 2 retry`);
+                    }
+                    // If VeSync gives us a region-change token, retry Step 2 without redoing Step 1.
+                    if (regionChangeToken) {
+                        const retryCountryCode = serverCountryCode || countryCodeForStep2;
+                        const retryBody = this.reqBodyAuthStep2(authorizeCode, regionChangeToken, appId, terminalId, retryCountryCode, 'lastRegion');
+                        const [retryResponse, retryStatus] = await this.callApi('/user/api/accountManage/v1/loginByAuthorizeCode4Vesync', 'post', retryBody, step1Headers, manager);
+                        if (retryResponse && retryStatus === 200 && retryResponse.code === 0) {
+                            const { token, accountID, countryCode } = retryResponse.result || {};
+                            if (token && accountID) {
+                                logger_1.logger.debug('Step 2 retry successful, got token and accountID');
+                                return [true, token, accountID, countryCode || retryCountryCode];
+                            }
+                            logger_1.logger.error('Missing required fields in Step 2 retry response:', retryResponse.result);
+                            manager.apiBaseUrl = originalUrl;
+                            return [false, null, null, null];
+                        }
+                        logger_1.logger.error('Step 2 retry failed:', {
+                            status: retryStatus,
+                            code: retryResponse === null || retryResponse === void 0 ? void 0 : retryResponse.code,
+                            msg: retryResponse === null || retryResponse === void 0 ? void 0 : retryResponse.msg,
+                        });
+                        manager.apiBaseUrl = originalUrl;
+                        return [false, null, null, 'cross_region_retry'];
+                    }
+                    logger_1.logger.error('Cross-region error returned no region-change token; cannot retry Step 2');
+                    manager.apiBaseUrl = originalUrl;
                     return [false, null, null, 'cross_region_retry'];
                 }
                 logger_1.logger.error('Step 2 error code:', loginResponse.code, 'message:', loginResponse.msg);
-                setApiBaseUrl(originalUrl); // Restore original URL on error
+                manager.apiBaseUrl = originalUrl;
                 return [false, null, null, null];
             }
-            setApiBaseUrl(originalUrl); // Restore original URL on success
             const { token, accountID, countryCode } = loginResponse.result || {};
             if (!token || !accountID) {
                 logger_1.logger.error('Missing required fields in step 2 response:', loginResponse.result);
@@ -662,7 +716,7 @@ class Helpers {
         try {
             const body = this.reqBody(manager, 'login');
             logger_1.logger.debug('Legacy login attempt...', {
-                endpoint: getApiBaseUrl(),
+                endpoint: manager.apiBaseUrl || getApiBaseUrl(),
                 body: { ...body, password: '[REDACTED]' }
             });
             const [response, status] = await this.callApi('/cloud/v1/user/login', 'post', body, {}, manager);

package/dist/lib/vesync.d.ts

@@ -29,6 +29,7 @@ export declare class VeSync {
     private _appId;
     private _region;
     private _countryCodeOverride;
+    private _apiUrlOverride;
     private _sessionStore?;
     private _onTokenChange?;
     private _loginPromise;
@@ -99,6 +100,10 @@ export declare class VeSync {
      * Get current region
      */
     get region(): string;
+    /**
+     * Return the configured API URL override, if any.
+     */
+    get apiUrlOverride(): string | null;
     /**
      * Set region and update API endpoint
      */