@coffeerunhobby/mcp-ha-connect 2.4.5 → 2.4.7

package/README.md

@@ -77,7 +77,7 @@ high-value questions an LLM can actually answer about your network:
 > above through two tools — `omada_browse` + `omada_read` — keeping the tool-schema budget
 > small for low-context models. See the Omada tool tables below for the full eager surface.
 
-## Available Tools (69 Total)
+## Available Tools (75 Total)
 
 ### Home Assistant Tools (38)
 
@@ -251,7 +251,7 @@ Lets the controller enforce a schedule itself (e.g. a curfew) instead of a daily
 | `omada_getSiteNtpStatus` | Get the site's NTP server configuration and status |
 | `omada_setSiteNtpServers` | Replace the site's NTP server list (needs `CONFIGURE`; `dryRun` previews the change) |
 
-### Vendor-neutral Network Tools (9)
+### Vendor-neutral Network Tools (15)
 
 The `net_` tools describe networks the same way for every controller vendor: one shared model, with an adapter per
 vendor (TP-Link Omada today; UniFi and MikroTik are planned). Each adapter says per feature whether it is native,
@@ -268,9 +268,16 @@ one is set in the controller's web UI. Reads need `QUERY`, changes `CONFIGURE`.
 | `net_createNetwork` / `net_updateNetwork` / `net_deleteNetwork` | Create or change a VLAN with its gateway and DHCP range. The network the controller is on is protected; delete is refused while a Wi-Fi network, port profile, reservation or rule uses it |
 | `net_listWifi` | Wi-Fi networks: network, bands, security, isolation, MAC filter |
 | `net_createWifi` / `net_updateWifi` / `net_deleteWifi` | Create or change an SSID on a given network (bands, WPA2/WPA3, PMF, isolation, hidden, 802.11r, MAC filter), or reset its password to a random one |
-
-On Omada, network isolation, a "guest" network type, switching IPv6 on, and WPA2/WPA3 mixed mode are not available
-through the API and are refused. Rules arrive in 2.4.6, switch ports and mDNS in 2.4.7.
+| `net_listRules` | Traffic rules in evaluation order (the first match decides); rules the model can't express are shown read-only (`foreign`, with the reason) |
+| `net_createRule` / `net_updateRule` / `net_deleteRule` / `net_moveRule` | Allow or block traffic from networks, a group or addresses to networks, a group, addresses (optionally on ports) or the internet, at a chosen position. **Stateful:** a block stops new connections, replies to connections started from the other side still pass ("block IoT → Home" lets Home still reach IoT). Addresses given in a rule become a group the rule owns and removes with it. A change after which the controller (and this server) could no longer reach the internet, in its end state or on the way there, is refused |
+| `net_listGroups` | Address groups (usable in rules) and MAC groups (Wi-Fi allow/deny lists) |
+
+On Omada, a network isolation flag (use a block rule instead), a "guest" network type, switching IPv6 on, and WPA2/WPA3
+mixed mode are not available through the API and are refused. Rules are gateway ACLs (the gateway routes between the
+VLANs): LAN to LAN between your networks, LAN to WAN towards the internet. Refused with the reason: the gateway itself as
+a destination (no API option for its own addresses), one device by MAC (give its address), a Wi-Fi network as the
+source, rules that also match replies, schedules (the `omada_` time-range tools do those) and port ranges. Switch
+ports and mDNS arrive in 2.4.8.
 
 ### AI Tools (1)
 

package/dist/index.js

@@ -5,12 +5,9 @@
  * Supports transport modes: stdio, HTTP (Streamable HTTP)
  */
 import { loadConfig } from './config.js';
-import { HaClient } from './haClient/index.js';
-import { LocalAIClient } from './localAI/index.js';
-import { OmadaClient } from './omadaClient/index.js';
-import { checkConfiguredSite } from './omadaClient/site.js';
 import { startHttpServer } from './server/http.js';
 import { startStdioServer } from './server/stdio.js';
+import { connectUpstreams } from './upstreams.js';
 import { initLogger, logger } from './utils/logger.js';
 import { VERSION } from './version.js';
 async function main() {
@@ -28,98 +25,9 @@ async function main() {
             omadaPluginEnabled: config.omadaPluginEnabled,
             useHttp: config.useHttp,
         });
-        // Create Home Assistant client (if plugin enabled and configured)
-        let haClient;
-        if (config.haPluginEnabled) {
-            if (config.baseUrl && config.token) {
-                haClient = new HaClient({
-                    baseUrl: config.baseUrl,
-                    token: config.token,
-                    timeout: config.timeout,
-                    strictSsl: config.strictSsl,
-                });
-                // Test Home Assistant connection
-                const apiCheck = await haClient.checkApi();
-                logger.info('Connected to Home Assistant', { message: apiCheck.message });
-            }
-            else {
-                logger.warn('HA plugin enabled but HA_URL or HA_TOKEN not set');
-            }
-        }
-        else {
-            logger.info('Home Assistant plugin disabled');
-        }
-        // Create Omada client (if plugin enabled and configured)
-        let omadaClient;
-        if (config.omadaPluginEnabled) {
-            if (config.omadaBaseUrl && config.omadaClientId && config.omadaClientSecret && config.omadacId) {
-                try {
-                    omadaClient = new OmadaClient({
-                        baseUrl: config.omadaBaseUrl,
-                        clientId: config.omadaClientId,
-                        clientSecret: config.omadaClientSecret,
-                        omadacId: config.omadacId,
-                        siteId: config.siteId,
-                        strictSsl: config.omadaStrictSsl,
-                        requestTimeout: config.requestTimeout,
-                    });
-                    // Test Omada connection by listing sites
-                    const sites = await omadaClient.listSites();
-                    // Omada is the source of truth: a configured OMADA_SITE_ID that isn't
-                    // on the controller is a deployment bug (drifted site id), not a
-                    // transient outage. Fail the Omada plugin loudly — HA and AI keep
-                    // working — instead of silently scoping every read to a dead site.
-                    const siteError = checkConfiguredSite(config.siteId, sites);
-                    if (siteError) {
-                        logger.error(`Omada plugin disabled - invalid OMADA_SITE_ID. ${siteError}`);
-                        omadaClient = undefined;
-                    }
-                    else {
-                        logger.info('Connected to Omada controller', { siteCount: sites.length });
-                    }
-                }
-                catch (error) {
-                    logger.warn('Omada controller not available - Omada tools will be disabled', {
-                        error: error instanceof Error ? error.message : String(error),
-                    });
-                    omadaClient = undefined;
-                }
-            }
-            else {
-                logger.warn('Omada plugin enabled but required config not set (OMADA_BASE_URL, OMADA_CLIENT_ID, OMADA_CLIENT_SECRET, OMADA_OMADAC_ID)');
-            }
-        }
-        else {
-            logger.info('Omada plugin disabled');
-        }
-        // Create Local AI client (if plugin enabled)
-        let aiClient;
-        if (config.aiPluginEnabled) {
-            if (config.aiProvider === 'none') {
-                logger.info('AI plugin enabled but AI_PROVIDER=none');
-            }
-            else {
-                aiClient = new LocalAIClient(config);
-                const aiHealthy = await aiClient.checkHealth();
-                if (aiHealthy) {
-                    logger.info('Connected to AI provider', {
-                        provider: aiClient.getProviderName(),
-                        url: config.aiUrl,
-                        model: config.aiModel,
-                    });
-                }
-                else {
-                    logger.warn('AI provider not available - AI analysis tool will be disabled', {
-                        provider: config.aiProvider,
-                        url: config.aiUrl,
-                    });
-                    aiClient = undefined;
-                }
-            }
-        }
-        else {
-            logger.info('AI plugin disabled');
-        }
+        // Connect the upstreams. One that doesn't answer yet doesn't stop the server:
+        // it is retried in the background (see upstreams.ts).
+        const { haClient, omadaClient, aiClient } = await connectUpstreams(config);
         // Start server in appropriate mode
         if (config.useHttp) {
             await startHttpServer({ haClient, omadaClient, aiClient, config });

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC,KAAK,UAAU,IAAI;IACjB,IAAI,CAAC;QACH,kCAAkC;QAClC,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAE5B,sGAAsG;QACtG,MAAM,SAAS,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC;QAElC,qEAAqE;QACrE,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAEzD,MAAM,CAAC,IAAI,CAAC,mBAAmB,OAAO,WAAW,CAAC,CAAC;QACnD,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE;YAClC,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;YAC7C,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC,CAAC;QAEH,kEAAkE;QAClE,IAAI,QAA8B,CAAC;QACnC,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;YAC3B,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gBACnC,QAAQ,GAAG,IAAI,QAAQ,CAAC;oBACtB,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,SAAS,EAAE,MAAM,CAAC,SAAS;iBAC5B,CAAC,CAAC;gBAEH,iCAAiC;gBACjC,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,CAAC;gBAC3C,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;YAC5E,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;QAChD,CAAC;QAED,yDAAyD;QACzD,IAAI,WAAoC,CAAC;QACzC,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;YAC9B,IAAI,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,iBAAiB,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBAC/F,IAAI,CAAC;oBACH,WAAW,GAAG,IAAI,WAAW,CAAC;wBAC5B,OAAO,EAAE,MAAM,CAAC,YAAY;wBAC5B,QAAQ,EAAE,MAAM,CAAC,aAAa;wBAC9B,YAAY,EAAE,MAAM,CAAC,iBAAiB;wBACtC,QAAQ,EAAE,MAAM,CAAC,QAAQ;wBACzB,MAAM,EAAE,MAAM,CAAC,MAAM;wBACrB,SAAS,EAAE,MAAM,CAAC,cAAc;wBAChC,cAAc,EAAE,MAAM,CAAC,cAAc;qBACtC,CAAC,CAAC;oBAEH,yCAAyC;oBACzC,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,SAAS,EAAE,CAAC;oBAE5C,sEAAsE;oBACtE,iEAAiE;oBACjE,kEAAkE;oBAClE,mEAAmE;oBACnE,MAAM,SAAS,GAAG,mBAAmB,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;oBAC5D,IAAI,SAAS,EAAE,CAAC;wBACd,MAAM,CAAC,KAAK,CAAC,kDAAkD,SAAS,EAAE,CAAC,CAAC;wBAC5E,WAAW,GAAG,SAAS,CAAC;oBAC1B,CAAC;yBAAM,CAAC;wBACN,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;oBAC5E,CAAC;gBACH,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,IAAI,CAAC,+DAA+D,EAAE;wBAC3E,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;qBAC9D,CAAC,CAAC;oBACH,WAAW,GAAG,SAAS,CAAC;gBAC1B,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC,0HAA0H,CAAC,CAAC;YAC1I,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QACvC,CAAC;QAED,6CAA6C;QAC7C,IAAI,QAAmC,CAAC;QACxC,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;YAC3B,IAAI,MAAM,CAAC,UAAU,KAAK,MAAM,EAAE,CAAC;gBACjC,MAAM,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;YACxD,CAAC;iBAAM,CAAC;gBACN,QAAQ,GAAG,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC;gBACrC,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC;gBAC/C,IAAI,SAAS,EAAE,CAAC;oBACd,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE;wBACtC,QAAQ,EAAE,QAAQ,CAAC,eAAe,EAAE;wBACpC,GAAG,EAAE,MAAM,CAAC,KAAK;wBACjB,KAAK,EAAE,MAAM,CAAC,OAAO;qBACtB,CAAC,CAAC;gBACL,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,IAAI,CAAC,+DAA+D,EAAE;wBAC3E,QAAQ,EAAE,MAAM,CAAC,UAAU;wBAC3B,GAAG,EAAE,MAAM,CAAC,KAAK;qBAClB,CAAC,CAAC;oBACH,QAAQ,GAAG,SAAS,CAAC;gBACvB,CAAC;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACpC,CAAC;QAED,mCAAmC;QACnC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,eAAe,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACrE,CAAC;aAAM,CAAC;YACN,MAAM,gBAAgB,CAAC;gBACrB,QAAQ;gBACR,WAAW;gBACX,QAAQ;gBACR,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;aAClD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE;YACzC,KAAK,EAAE,OAAO;YACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;SACxD,CAAC,CAAC;QACH,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,2BAA2B;AAC3B,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;IACxB,MAAM,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;IACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC;AAEH,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;IACzB,MAAM,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;IAC1D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC;AAEH,mBAAmB;AACnB,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IACrB,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IAC5D,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC,KAAK,UAAU,IAAI;IACjB,IAAI,CAAC;QACH,kCAAkC;QAClC,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAE5B,sGAAsG;QACtG,MAAM,SAAS,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC;QAElC,qEAAqE;QACrE,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAEzD,MAAM,CAAC,IAAI,CAAC,mBAAmB,OAAO,WAAW,CAAC,CAAC;QACnD,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE;YAClC,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;YAC7C,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC,CAAC;QAEH,8EAA8E;QAC9E,sDAAsD;QACtD,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAE3E,mCAAmC;QACnC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,eAAe,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACrE,CAAC;aAAM,CAAC;YACN,MAAM,gBAAgB,CAAC;gBACrB,QAAQ;gBACR,WAAW;gBACX,QAAQ;gBACR,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;aAClD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE;YACzC,KAAK,EAAE,OAAO;YACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;SACxD,CAAC,CAAC;QACH,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,2BAA2B;AAC3B,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;IACxB,MAAM,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;IACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC;AAEH,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;IACzB,MAAM,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;IAC1D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC;AAEH,mBAAmB;AACnB,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IACrB,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IAC5D,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC,CAAC,CAAC"}

package/dist/net/adapters/omada.d.ts

@@ -1,9 +1,9 @@
 /**
  * Omada adapter for the vendor-neutral network model (src/net/model.ts).
  *
- * 2.4.5 covers networks (LAN networks / VLANs) and Wi-Fi (SSIDs). Rules, groups, switch
- * ports and mDNS arrive with 2.4.6 and 2.4.7; until then those calls fail with
- * NetError UNSUPPORTED.
+ * 2.4.5 covers networks (LAN networks / VLANs) and Wi-Fi (SSIDs); 2.4.7 rules (gateway
+ * ACLs, see omadaRules.ts) and listing groups. Switch ports and mDNS arrive with 2.4.8;
+ * until then those calls fail with NetError UNSUPPORTED.
  *
  * Omada specifics handled here:
  * - networks have no "guest" purpose and no isolation flag in the API (guest is per
@@ -14,7 +14,7 @@
  * - Omada lists every SSID again under a pseudo WLAN group "gateway" without detail.
  */
 import type { OmadaClient } from '../../omadaClient/index.js';
-import { type ApplyResult, type Capabilities, type Change, type Client, type Network, type NetworkController, type Plan, type ProtectedResources, type Reservation, type Wifi } from '../model.js';
+import { type ApplyResult, type Capabilities, type Change, type Client, type Group, type Network, type NetworkController, type Plan, type ProtectedResources, type Reservation, type Rule, type Wifi } from '../model.js';
 export interface OmadaAdapterOptions {
     siteId?: string;
     /** The controller's host name or address (host of OMADA_BASE_URL): its network is protected. */
@@ -49,8 +49,8 @@ export declare class OmadaNetworkController implements NetworkController {
     listReservations(): Promise<Reservation[]>;
     listPortProfiles(): Promise<never>;
     listPorts(): Promise<never>;
-    listRules(): Promise<never>;
-    listGroups(): Promise<never>;
+    listRules(): Promise<Rule[]>;
+    listGroups(kind?: Group['kind']): Promise<Group[]>;
     getMdnsRepeater(): Promise<never>;
     plan(change: Change): Promise<Plan>;
     apply(plan: Plan, options?: {
@@ -58,6 +58,60 @@ export declare class OmadaNetworkController implements NetworkController {
     }): Promise<ApplyResult>;
     private planWith;
     private build;
+    private ruleWorld;
+    /** The rule as the model sees it, with its raw ACL; a rule the model can't express is refused. */
+    private editableRule;
+    private checkPosition;
+    /**
+     * Refuses a change if any rule list it passes through (the end state, and the staged
+     * one where the rule is switched off) could expose some of the controller's (and this
+     * server's) internet traffic to a block that doesn't reach it today (controllerRisk).
+     * Waived only when the controller is certainly cut off already.
+     */
+    private guardController;
+    private buildRuleCreate;
+    private buildRuleUpdate;
+    private buildRuleDelete;
+    private buildRuleMove;
+    /**
+     * Existing ids for an endpoint, or the id of the group created for it. The group is
+     * tracked by its (unique) name before it is created, so a create whose answer or
+     * read-back got lost can still be found and undone.
+     */
+    private materialize;
+    /**
+     * Undoes a create that failed part-way and returns the error to throw. A create that
+     * was sent may have happened even if it reported an error: the rule is looked up by
+     * its description and removed before its groups. When that can't be confirmed, the
+     * groups stay (a live rule must never point at deleted groups) and the error says so.
+     */
+    private undoCreate;
+    /**
+     * Undoes an update that failed part-way and returns the error to throw: puts the rule
+     * back as it was (if the change may have been written) and removes the groups made
+     * for it, unless the rule might still point at them.
+     */
+    private undoUpdate;
+    /** Puts the rule order back after a move that failed (it may have happened anyway); returns the error to throw. */
+    private restoreOrder;
+    /** Deletes groups made during a failed change (found by name when the id is unknown); returns what it couldn't remove. */
+    private dropGroups;
+    /**
+     * Deletes every group a net_ rule owned that no ACL (gateway, switch or access point)
+     * references any more. Run after each successful rule change, so a cleanup that failed
+     * once is finished by the next change; a failure here is a warning, not an error (the
+     * change itself is done). Writes are serialized per site, so no rule is half-created
+     * meanwhile.
+     */
+    private sweepOwnedGroups;
+    private sortedAcls;
+    /** Moves one rule to `position` (1 = first); the others keep their order. */
+    private reorder;
+    /**
+     * The result of a change that is done: the rule as it reads back, plus warnings. A
+     * failed read-back is a warning, never an error: the change is already applied.
+     */
+    private done;
     private buildNetworkCreate;
     private buildNetworkUpdate;
     private buildNetworkDelete;