@mgcrea/mcp-unifi-protect 0.0.0

package/dist/index.d.ts

@@ -0,0 +1,385 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { z } from "zod";
+//#region src/config.d.ts
+/**
+ * The private (undocumented) Protect API, mounted under UniFi OS's proxy. This
+ * server deliberately wraps this rather than the official Integration API at
+ * `/proxy/protect/integration/v1`: the official one has NO historical query
+ * capability at all — its only query parameters in the entire published OpenAPI
+ * spec are `channel`, `highQuality` and `qualities` — so "what happened at the
+ * front door last night" is unanswerable through it.
+ *
+ * The trade is real and accepted: nothing below is contractual, and Ubiquiti
+ * moves these endpoints between Protect releases. `unifi_protect_get_system_info`
+ * reports the running version so a mismatch is visible, and
+ * `unifi_protect_request` reaches anything that moved without a code change.
+ */
+declare const PRIVATE_API_PATH = "/proxy/protect/api";
+/** UniFi OS's own auth surface, which is NOT under the Protect proxy path. */
+declare const LOGIN_PATH = "/api/auth/login";
+/** The realtime channel. Not used yet — see the WebSocket note in the README. */
+declare const UPDATES_WS_PATH = "/proxy/protect/ws/updates";
+declare const ConfigSchema: z.ZodObject<{
+  baseUrl: z.ZodOptional<z.ZodString>;
+  username: z.ZodOptional<z.ZodString>;
+  password: z.ZodOptional<z.ZodString>;
+  totp: z.ZodOptional<z.ZodString>;
+  verifyTls: z.ZodDefault<z.ZodBoolean>;
+  allowWrites: z.ZodDefault<z.ZodBoolean>;
+  sessionFile: z.ZodString;
+  snapshotDir: z.ZodString;
+  maxRetries: z.ZodDefault<z.ZodNumber>;
+  maxDownloadBytes: z.ZodDefault<z.ZodNumber>;
+  deviceCacheTtlSeconds: z.ZodDefault<z.ZodNumber>;
+}, z.core.$strict>;
+type Config = z.infer<typeof ConfigSchema>;
+/**
+ * The on-disk config document. Keys are camelCase to mirror `Config` rather
+ * than the env var names: this is a typed JSON file, not a shell.
+ *
+ * `.strict()` on purpose — a typo'd `userName` must be an error. Silently
+ * ignoring an unknown key looks exactly like "that setting had no effect",
+ * which is the worst way to learn your credentials came from somewhere else.
+ */
+declare const FileConfigSchema: z.ZodObject<{
+  host: z.ZodOptional<z.ZodString>;
+  username: z.ZodOptional<z.ZodString>;
+  password: z.ZodOptional<z.ZodString>;
+  verifyTls: z.ZodOptional<z.ZodBoolean>;
+  allowWrites: z.ZodOptional<z.ZodBoolean>;
+  sessionFile: z.ZodOptional<z.ZodString>;
+  snapshotDir: z.ZodOptional<z.ZodString>;
+  maxRetries: z.ZodOptional<z.ZodNumber>;
+  maxDownloadBytes: z.ZodOptional<z.ZodNumber>;
+  deviceCacheTtlSeconds: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strict>;
+type FileConfig = z.infer<typeof FileConfigSchema>;
+/**
+ * Normalize whatever someone pasted into a console origin, preserving the port.
+ *
+ *   "192.168.1.1"              -> "https://192.168.1.1"
+ *   "10.0.0.1:8443"            -> "https://10.0.0.1:8443"
+ *   "https://udm.lan/protect/" -> "https://udm.lan"
+ *
+ * A port must survive: consoles are commonly reached on a non-443 port, and the
+ * normalizers in mcp-keycloak and mcp-shopify both drop it. Everything after
+ * the origin is discarded — the API paths are this server's business, and a
+ * pasted `/protect/dashboard` URL would otherwise be prefixed onto every call.
+ *
+ * `https` is forced: UniFi OS redirects plain HTTP, and following that redirect
+ * would send the session cookie over cleartext on the first hop.
+ */
+declare const normalizeBaseUrl: (raw: string) => string;
+/** `readFileSync` does not expand `~`, but it is the natural thing to write in a config file. */
+declare const expandTilde: (path: string) => string;
+/**
+ * Where the config file lives, most specific first: an explicit override, then
+ * the XDG location, then the conventional `~/.config`.
+ */
+declare const resolveConfigPath: (env?: NodeJS.ProcessEnv) => string;
+/** The session file sits beside the config file unless told otherwise. */
+declare const resolveSessionPath: (env?: NodeJS.ProcessEnv) => string;
+/**
+ * Environment first, config file second, **per field** — not whole-source.
+ * Docker and CI inject the environment and must keep working untouched, while a
+ * one-off `UNIFI_PROTECT_ALLOW_WRITES=0` still has to override a file that says
+ * `true`. Merging field by field is the only rule that gives both.
+ */
+declare const loadConfig: (env?: NodeJS.ProcessEnv, configPath?: string) => Config;
+/** True once the server has everything it needs to reach a console. */
+declare const isConfigured: (config: Config) => boolean;
+/**
+ * Returned by unifi_protect_auth_status and printed to stderr at startup. Prose
+ * rather than a code, because this is the text someone acts on when nothing
+ * works — and the server can no longer signal it by refusing to start.
+ */
+declare const setupInstructions: (config: Config) => string[];
+//#endregion
+//#region src/client/auth.d.ts
+type Logger = {
+  debug?(...args: unknown[]): void;
+  warn?(...args: unknown[]): void;
+  error?(...args: unknown[]): void;
+};
+/** The two headers that authenticate every request to a UniFi OS console. */
+type SessionHeaders = {
+  cookie: string;
+  "x-csrf-token": string;
+};
+type SessionStatus = {
+  authenticated: boolean;
+  /** Where the live session came from, for unifi_protect_auth_status. */
+  source: "none" | "restored" | "login";
+  username: string | undefined;
+  savedAt: string | undefined;
+};
+/**
+ * A pluggable source of console session headers. The client calls `headers()`
+ * on every request and `invalidate()` on a 401 to force the next call to
+ * re-run the handshake.
+ */
+type SessionProvider = {
+  headers(): Promise<SessionHeaders>;
+  invalidate(): void;
+  /** Force a fresh handshake now, optionally with a 2FA code. Used by auth_login. */
+  login(totp?: string): Promise<SessionStatus>;
+  /** Drop the session in memory and on disk. */
+  logout(): Promise<void>;
+  describe(): SessionStatus;
+};
+type SessionProviderOptions = {
+  config: Config;
+  fetch?: typeof fetch;
+  logger?: Logger;
+  now?: () => number;
+};
+declare const createSessionProvider: (opts: SessionProviderOptions) => SessionProvider;
+/** For tests: fixed headers, no network, no disk. */
+declare const staticSessionProvider: (headers?: SessionHeaders) => SessionProvider;
+//#endregion
+//#region src/client/protect.d.ts
+/** Array values become repeated params, which is how Protect expects `types`. */
+type Query = Record<string, string | number | boolean | string[] | undefined>;
+declare const backoffMs: (attempt: number) => number;
+declare const retryAfterMs: (res: Response) => number | undefined;
+declare const buildQuery: (query: Query | undefined) => string;
+type ProtectClientOptions = {
+  baseUrl: string;
+  session: SessionProvider;
+  maxRetries: number;
+  userAgent: string;
+  maxDownloadBytes: number;
+  fetch?: typeof fetch;
+  logger?: Logger;
+};
+type BinaryResult = {
+  bytes: Uint8Array;
+  contentType: string;
+};
+/**
+ * The private Protect API client. Every path passed in is relative to
+ * `/proxy/protect/api` — callers write `cameras/abc123`, not the full path.
+ */
+declare class ProtectClient {
+  readonly baseUrl: string;
+  private readonly session;
+  private readonly maxRetries;
+  private readonly userAgent;
+  private readonly maxDownloadBytes;
+  private readonly fetchImpl;
+  private readonly logger;
+  constructor(opts: ProtectClientOptions);
+  /** Absolute URL for a path relative to the private API root. */
+  url(path: string, query?: Query): string;
+  /**
+   * Perform one authenticated request, retrying on 401 (re-login), 429 and 5xx.
+   * Returns the raw Response so callers can decide between JSON and bytes.
+   */
+  private send;
+  /** A JSON request against the private API. */
+  request<T = unknown>(method: string, path: string, opts?: {
+    query?: Query;
+    body?: unknown;
+  }): Promise<T>;
+  get<T = unknown>(path: string, query?: Query): Promise<T>;
+  post<T = unknown>(path: string, body?: unknown, query?: Query): Promise<T>;
+  patch<T = unknown>(path: string, body?: unknown, query?: Query): Promise<T>;
+  del<T = unknown>(path: string, query?: Query): Promise<T>;
+  /**
+   * Fetch a binary asset — a snapshot JPEG, an event thumbnail, an exported
+   * MP4. Size is checked against `maxDownloadBytes` from Content-Length where
+   * the console supplies one, and again after reading where it does not, so an
+   * unexpectedly huge export fails with a clear message rather than by
+   * exhausting the heap.
+   */
+  requestBytes(path: string, opts?: {
+    query?: Query;
+    accept?: string;
+  }): Promise<BinaryResult>;
+  /** Status-aware prose, because this is the text someone acts on. */
+  private errorMessage;
+}
+//#endregion
+//#region src/client/shape.d.ts
+type Rec = Record<string, unknown>;
+/** Apply a summarizer across an array, passing non-arrays through untouched. */
+declare const summarizeEach: <T>(value: unknown, fn: (item: Rec) => T) => unknown;
+/**
+ * Protect timestamps are milliseconds since the Unix epoch. Rendering them as
+ * ISO 8601 costs a few characters and saves the model from having to reason
+ * about a bare 13-digit integer — which it does get wrong, usually by reading
+ * it as seconds and landing in 1970.
+ */
+declare const isoTime: (value: unknown) => string | undefined;
+/** An index from device id to display name, used to resolve event references. */
+type NameIndex = ReadonlyMap<string, string>;
+declare const buildNameIndex: (devices: unknown) => NameIndex;
+declare const summarizeCamera: (camera: Rec) => Rec;
+/**
+ * Events reference their camera by id. Resolving that to a name server-side is
+ * the single most useful thing this layer does: it removes a join the model
+ * would otherwise have to perform against a separate camera list, and get
+ * silently wrong. The id is kept too, since the write and snapshot tools need it.
+ */
+declare const summarizeEvent: (event: Rec, cameras?: NameIndex) => Rec;
+declare const summarizeLight: (light: Rec) => Rec;
+declare const summarizeSensor: (sensor: Rec) => Rec;
+declare const summarizeViewer: (viewer: Rec) => Rec;
+declare const summarizeChime: (chime: Rec) => Rec;
+declare const summarizeLiveview: (liveview: Rec) => Rec;
+declare const summarizeUser: (user: Rec) => Rec;
+declare const summarizeNvr: (nvr: Rec) => Rec;
+/**
+ * The bootstrap document is the entire console state and must never be returned
+ * raw — it is the single largest context bomb this API offers. This reduces it
+ * to the NVR summary plus per-type counts, which is what "tell me about my
+ * system" actually wants.
+ */
+declare const summarizeBootstrap: (bootstrap: Rec) => Rec;
+//#endregion
+//#region src/client/device-cache.d.ts
+type DeviceCacheOptions = {
+  client: ProtectClient;
+  ttlSeconds: number;
+  now?: () => number;
+};
+/**
+ * A short-lived camera id→name index, used to resolve the `camera` reference on
+ * every event into something readable.
+ *
+ * It is cached because event search is the hot path and every result set needs
+ * the same index: fetching the camera list once per search rather than once per
+ * event is the difference between one extra request and none. The TTL is short
+ * because a renamed or newly adopted camera should appear without a restart,
+ * and a stale name is only ever cosmetic — the id travels alongside it.
+ */
+type DeviceCache = {
+  cameras(): Promise<NameIndex>;
+  invalidate(): void;
+};
+declare const createDeviceCache: (opts: DeviceCacheOptions) => DeviceCache;
+//#endregion
+//#region src/server.d.ts
+declare const SERVER_NAME: string;
+declare const SERVER_VERSION: string;
+declare const USER_AGENT: string;
+type CreateServerOptions = {
+  config: Config;
+  fetch?: typeof fetch;
+  logger?: Logger;
+  /** Override the session provider (tests, and the interactive login flow). */
+  session?: SessionProvider;
+};
+type CreatedServer = {
+  server: McpServer;
+  client: ProtectClient;
+  session: SessionProvider;
+  devices: DeviceCache;
+};
+declare const createServer: (opts: CreateServerOptions) => CreatedServer;
+//#endregion
+//#region src/client/session-store.d.ts
+/**
+ * A console session: the bare cookie value plus the CSRF token that was current
+ * when it was issued. Both are needed on every request, and neither is derivable
+ * from the other, so they are stored and invalidated as one unit.
+ */
+type PersistedSession = {
+  /** The `TOKEN=<jwt>` pair, attributes already stripped. */
+  cookie: string;
+  csrfToken: string;
+  /** Which console this belongs to, so a changed host does not reuse a stale session. */
+  baseUrl: string;
+  /** Which account it was issued to, for the same reason. */
+  username: string;
+  savedAt: string;
+};
+/** Load a persisted session, or undefined if none / unreadable / not JSON. */
+declare const loadSession: (path: string) => Promise<PersistedSession | undefined>;
+/** Persist a session with owner-only permissions. */
+declare const saveSession: (path: string, session: PersistedSession) => Promise<void>;
+/** Remove a persisted session. Absent is success — logout is idempotent. */
+declare const clearSession: (path: string) => Promise<void>;
+//#endregion
+//#region src/client/errors.d.ts
+/** A non-2xx answer from the console. */
+declare class ProtectApiError extends Error {
+  readonly name = "ProtectApiError";
+  readonly status: number;
+  /** The request path, so an error names what failed without a stack trace. */
+  readonly path: string | undefined;
+  readonly errors: unknown;
+  constructor(message: string, opts: {
+    status: number;
+    path?: string | undefined;
+    errors?: unknown;
+  });
+}
+/** The console rejected the credentials, or 2FA is required and was not supplied. */
+declare class ProtectAuthError extends Error {
+  readonly name = "ProtectAuthError";
+  /** True when the console asked for a 2FA code rather than refusing the password. */
+  readonly needsTwoFactor: boolean;
+  constructor(message: string, opts?: {
+    needsTwoFactor?: boolean;
+  });
+}
+/** Thrown when a write path is reached while UNIFI_PROTECT_ALLOW_WRITES is off. */
+declare class WritesDisabledError extends Error {
+  readonly name = "WritesDisabledError";
+  constructor(what: string);
+}
+/** Thrown when the server is asked to reach a console it has no credentials for. */
+declare class NotConfiguredError extends Error {
+  readonly name = "NotConfiguredError";
+  constructor();
+}
+//#endregion
+//#region src/tools/index.d.ts
+type ToolContext = {
+  config: Config;
+  /** Register the mutating tools too. Off by default — see UNIFI_PROTECT_ALLOW_WRITES. */
+  allowWrites: boolean;
+  session: SessionProvider;
+  devices: DeviceCache;
+};
+/**
+ * Register the UniFi Protect tools.
+ *
+ * unifi_protect_auth_status comes first and unconditionally, so a server with no
+ * console configured is still a useful one — it can say what to set — rather
+ * than a connection that closes with its own error message swallowed.
+ *
+ * Read tools are then always registered; the write tools only when
+ * `allowWrites` is set, so with the flag off they are not merely refused — they
+ * are absent from tools/list and cannot be called at all. A refusal still lets a
+ * model try, retry, and reason about how to get around it; a tool that does not
+ * exist ends the conversation.
+ */
+declare const registerTools: (server: McpServer, client: ProtectClient, ctx: ToolContext) => void;
+//#endregion
+//#region src/tools/request.d.ts
+/**
+ * Reject anything that is not a plain relative path. The server decides the
+ * host and the `/proxy/protect/api` prefix; letting a caller supply either
+ * would send the console session somewhere it does not belong.
+ */
+declare const assertSafePath: (path: string) => void;
+//#endregion
+//#region src/tools/util.d.ts
+/**
+ * Convert a time expression to milliseconds since the Unix epoch.
+ *
+ * This exists because the console's `/events` endpoint takes JavaScript
+ * millisecond timestamps — not ISO 8601, and NOT Unix seconds. A seconds value
+ * is not rejected: it is interpreted as a moment in January 1970, so the query
+ * succeeds and returns an empty list. That reads as "nothing happened last
+ * night", which is the most expensive possible failure for this server.
+ *
+ * Accepts ISO 8601, a relative expression like "2h ago" or "30m", the literal
+ * "now", or a raw millisecond number.
+ */
+declare const toEpochMs: (value: string | number, now?: number) => number;
+//#endregion
+export { type BinaryResult, type Config, type CreateServerOptions, type CreatedServer, type DeviceCache, type FileConfig, LOGIN_PATH, type Logger, type NameIndex, NotConfiguredError, PRIVATE_API_PATH, type PersistedSession, ProtectApiError, ProtectAuthError, ProtectClient, type ProtectClientOptions, type Query, SERVER_NAME, SERVER_VERSION, type SessionHeaders, type SessionProvider, type SessionStatus, type ToolContext, UPDATES_WS_PATH, USER_AGENT, WritesDisabledError, assertSafePath, backoffMs, buildNameIndex, buildQuery, clearSession, createDeviceCache, createServer, createSessionProvider, expandTilde, isConfigured, isoTime, loadConfig, loadSession, normalizeBaseUrl, registerTools, resolveConfigPath, resolveSessionPath, retryAfterMs, saveSession, setupInstructions, staticSessionProvider, summarizeBootstrap, summarizeCamera, summarizeChime, summarizeEach, summarizeEvent, summarizeLight, summarizeLiveview, summarizeNvr, summarizeSensor, summarizeUser, summarizeViewer, toEpochMs };
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","names":[],"sources":["../src/config.ts","../src/client/auth.ts","../src/client/protect.ts","../src/client/shape.ts","../src/client/device-cache.ts","../src/server.ts","../src/client/session-store.ts","../src/client/errors.ts","../src/tools/index.ts","../src/tools/request.ts","../src/tools/util.ts"],"mappings":";;;;;;;;;;;;;;;;cAmBa;;cAGA;;cAGA;cAEP,cAAY,EAAA;;;;;;;;;;;;GA0Dd,EAAA,KAAA;KAEQ,SAAS,EAAE,aAAa;;;;;;;;;cAU9B,kBAAgB,EAAA;;;;;;;;;;;GAaX,EAAA,KAAA;KAEC,aAAa,EAAE,aAAa;;;;;;;;;;;;;;;;cAiB3B,mBAAgB;;cA6BhB,cAAW;;;;;cAOX,oBAAiB,MAAS,OAAO;;cAQjC,qBAAkB,MAAS,OAAO;;;;;;;cA6DlC,aAAU,MAChB,OAAO,YAAU,wBAErB;;cA2BU,eAAY,QAAY;;;;;;cAQxB,oBAAiB,QAAY;;;KC5Q9B;EACV,UAAU;EACV,SAAS;EACT,UAAU;;;KAIA;EACV;EACA;;KAGU;EACV;;EAEA;EACA;EACA;;;;;;;KAQU;EACV,WAAW,QAAQ;EACnB;;EAEA,MAAM,gBAAgB,QAAQ;;EAE9B,UAAU;EACV,YAAY;;KAGF;EACV,QAAQ;EACR,eAAe;EACf,SAAS;EACT;;cA6BW,wBAAqB,MAAU,2BAAyB;;cA+MxD,wBAAqB,UACvB,mBACR;;;;KCpRS,QAAQ;cAIP,YAAS;cAET,eAAY,KAAS;cAerB,aAAU,OAAW;KAkBtB;EACV;EACA,SAAS;EACT;EACA;EACA;EACA,eAAe;EACf,SAAS;;KAGC;EACV,OAAO;EACP;;;;;;cAOW;WACF;mBACQ;mBACA;mBACA;mBACA;mBACA;mBACA;EAEjB,YAAY,MAAM;;EAWlB,IAAI,cAAc,QAAQ;;;;;UASZ;;EAgDR,QAAQ,aACZ,gBACA,cACA;IAAQ,QAAQ;IAAO;MACtB,QAAQ;EAkBX,IAAI,aAAa,cAAc,QAAQ,QAAQ,QAAQ;EAIvD,KAAK,aAAa,cAAc,gBAAgB,QAAQ,QAAQ,QAAQ;EAOxE,MAAM,aAAa,cAAc,gBAAgB,QAAQ,QAAQ,QAAQ;EAOzE,IAAI,aAAa,cAAc,QAAQ,QAAQ,QAAQ;;;;;;;;EAWjD,aACJ,cACA;IAAQ,QAAQ;IAAO;MACtB,QAAQ;;UAwCH;;;;KC/NL,MAAM;;cASE,gBAAiB,GAAC,gBAAgB,KAAO,MAAM,QAAQ;;;;;;;cASvD,UAAO;;KAMR,YAAY;cAEX,iBAAc,qBAAuB;cAYrC,kBAAe,QAAY,QAAM;;;;;;;cAiCjC,iBAAc,OAAW,KAAG,UAAY,cAAY;cA6BpD,iBAAc,OAAW,QAAM;cAe/B,kBAAe,QAAY,QAAM;cA0BjC,kBAAe,QAAY,QAAM;cAUjC,iBAAc,OAAW,QAAM;cAU/B,oBAAiB,UAAc,QAAM;cASrC,gBAAa,MAAU,QAAM;cA0E7B,eAAY,KAAS,QAAM;;;;;;;cAwC3B,qBAAkB,WAAe,QAAM;;;KCpSxC;EACV,QAAQ;EACR;EACA;;;;;;;;;;;;KAaU;EACV,WAAW,QAAQ;EACnB;;cAGW,oBAAiB,MAAU,uBAAqB;;;cCdhD;cACA;cACA;KAED;EACV,QAAQ;EACR,eAAe;EACf,SAAS;;EAET,UAAU;;KAGA;EACV,QAAQ;EACR,QAAQ;EACR,SAAS;EACT,SAAS;;cAGE,eAAY,MAAU,wBAAsB;;;;;;;;KCrB7C;;EAEV;EACA;;EAEA;;EAEA;EACA;;;cAIW,cAAW,iBAAyB,QAAQ;;cAiB5C,cAAW,cAAsB,SAAW,qBAAmB;;cAU/D,eAAY,iBAAyB;;;;cC9CrC,wBAAwB;WACjB;WACT;;WAEA;WACA;EAET,YACE,iBACA;IAAQ;IAAgB;IAA2B;;;;cAU1C,yBAAyB;WAClB;;WAET;EAET,YAAY,iBAAiB;IAAQ;;;;cAO1B,4BAA4B;WACrB;EAElB,YAAY;;;cASD,2BAA2B;WACpB;EAElB;;;;KClCU;EACV,QAAQ;;EAER;EACA,SAAS;EACT,SAAS;;;;;;;;;;;;;;;cAgBE,gBAAa,QAAY,WAAS,QAAU,eAAa,KAAO;;;;;;;;cCtBhE,iBAAc;;;;;;;;;;;;;;;cCwFd,YAAS,wBAA0B"}

package/dist/index.js

@@ -0,0 +1,2 @@
+import { A as saveSession, B as loadConfig, C as summarizeSensor, D as staticSessionProvider, E as createSessionProvider, F as LOGIN_PATH, H as resolveConfigPath, I as PRIVATE_API_PATH, L as UPDATES_WS_PATH, M as ProtectApiError, N as ProtectAuthError, O as clearSession, P as WritesDisabledError, R as expandTilde, S as summarizeNvr, T as summarizeViewer, U as resolveSessionPath, V as normalizeBaseUrl, W as setupInstructions, _ as summarizeChime, a as registerTools, b as summarizeLight, c as ProtectClient, d as retryAfterMs, f as createDeviceCache, g as summarizeCamera, h as summarizeBootstrap, i as createServer, j as NotConfiguredError, k as loadSession, l as backoffMs, m as isoTime, n as SERVER_VERSION, o as assertSafePath, p as buildNameIndex, r as USER_AGENT, s as toEpochMs, t as SERVER_NAME, u as buildQuery, v as summarizeEach, w as summarizeUser, x as summarizeLiveview, y as summarizeEvent, z as isConfigured } from "./server-iu_3JECB.js";
+export { LOGIN_PATH, NotConfiguredError, PRIVATE_API_PATH, ProtectApiError, ProtectAuthError, ProtectClient, SERVER_NAME, SERVER_VERSION, UPDATES_WS_PATH, USER_AGENT, WritesDisabledError, assertSafePath, backoffMs, buildNameIndex, buildQuery, clearSession, createDeviceCache, createServer, createSessionProvider, expandTilde, isConfigured, isoTime, loadConfig, loadSession, normalizeBaseUrl, registerTools, resolveConfigPath, resolveSessionPath, retryAfterMs, saveSession, setupInstructions, staticSessionProvider, summarizeBootstrap, summarizeCamera, summarizeChime, summarizeEach, summarizeEvent, summarizeLight, summarizeLiveview, summarizeNvr, summarizeSensor, summarizeUser, summarizeViewer, toEpochMs };