@owine/unifi-network-mcp 2.14.2 → 3.0.0

package/dist/tools/supporting.js

@@ -6,24 +6,25 @@ const responses_js_1 = require("../utils/responses.js");
 const query_js_1 = require("../utils/query.js");
 const safety_js_1 = require("../utils/safety.js");
 const output_schemas_js_1 = require("../utils/output-schemas.js");
+const params_js_1 = require("../utils/params.js");
 function registerSupportingTools(server, client) {
     server.registerTool("unifi_list_wans", {
-        description: "List WAN interface definitions at a site. Returns: id, name only (verified against 10.6.106 — the Integration API exposes no live link status or throughput rates here). Use for: WAN inventory, multi-WAN topology.",
+        description: "List WAN interface definitions at a site. Returns: id, name only (verified against 11.0.83 — the Integration API exposes no live link status or throughput rates here). Use for: WAN inventory, multi-WAN topology.",
         inputSchema: {
-            siteId: zod_1.z.string().describe("Site ID"),
+            siteId: (0, params_js_1.resourceId)().describe("Site ID"),
             offset: zod_1.z
                 .number()
                 .int()
                 .nonnegative()
                 .optional()
-                .describe("Number of records to skip (default: 0)"),
+                .describe("Number of records to skip"),
             limit: zod_1.z
                 .number()
                 .int()
                 .min(0)
                 .max(200)
                 .optional()
-                .describe("Number of records to return (default: 25, max: 200)"),
+                .describe("Number of records to return (API default: 25)"),
         },
         outputSchema: output_schemas_js_1.listWansOutputSchema,
         annotations: safety_js_1.READ_ONLY,
@@ -38,26 +39,26 @@ function registerSupportingTools(server, client) {
         }
     });
     server.registerTool("unifi_list_vpn_tunnels", {
-        description: "List site-to-site VPN tunnels (IPsec, WireGuard, OpenVPN site-to-site) at a site. Returns: tunnel definitions per row (per-row schema not rendered in 10.6.106 docs — call to inspect). For roaming client VPN servers, see unifi_list_vpn_servers.",
+        description: "List site-to-site VPN tunnels (IPsec, WireGuard, OpenVPN site-to-site) at a site. Returns: tunnel definitions per row (per-row schema not rendered in 11.0.83 docs and no tunnels to sample live; the older 10.4.57 spec lists id, type (IPSEC/OPENVPN/WIREGUARD), name, metadata.origin/source — call to inspect). For roaming client VPN servers, see unifi_list_vpn_servers.",
         inputSchema: {
-            siteId: zod_1.z.string().describe("Site ID"),
+            siteId: (0, params_js_1.resourceId)().describe("Site ID"),
             offset: zod_1.z
                 .number()
                 .int()
                 .nonnegative()
                 .optional()
-                .describe("Number of records to skip (default: 0)"),
+                .describe("Number of records to skip"),
             limit: zod_1.z
                 .number()
                 .int()
                 .min(0)
                 .max(200)
                 .optional()
-                .describe("Number of records to return (default: 25, max: 200)"),
+                .describe("Number of records to return (API default: 25)"),
             filter: zod_1.z
                 .string()
                 .optional()
-                .describe("Filter expression"),
+                .describe("Filter expression, e.g. metadata.source.isNull()"),
         },
         outputSchema: output_schemas_js_1.listVpnTunnelsOutputSchema,
         annotations: safety_js_1.READ_ONLY,
@@ -72,26 +73,26 @@ function registerSupportingTools(server, client) {
         }
     });
     server.registerTool("unifi_list_vpn_servers", {
-        description: "List VPN servers (roaming/client-access VPNs: WireGuard, OpenVPN, L2TP, Teleport) at a site. Returns: id, type (e.g. WIREGUARD, UID), name, enabled, metadata.origin.",
+        description: "List VPN servers (roaming/client-access VPNs) at a site. Returns: id, type (L2TP, OPENVPN, PPTP, UID, WIREGUARD), name, enabled, metadata.origin.",
         inputSchema: {
-            siteId: zod_1.z.string().describe("Site ID"),
+            siteId: (0, params_js_1.resourceId)().describe("Site ID"),
             offset: zod_1.z
                 .number()
                 .int()
                 .nonnegative()
                 .optional()
-                .describe("Number of records to skip (default: 0)"),
+                .describe("Number of records to skip"),
             limit: zod_1.z
                 .number()
                 .int()
                 .min(0)
                 .max(200)
                 .optional()
-                .describe("Number of records to return (default: 25, max: 200)"),
+                .describe("Number of records to return (API default: 25)"),
             filter: zod_1.z
                 .string()
                 .optional()
-                .describe("Filter expression"),
+                .describe("Filter expression, e.g. type.eq('WIREGUARD')"),
         },
         outputSchema: output_schemas_js_1.listVpnServersOutputSchema,
         annotations: safety_js_1.READ_ONLY,
@@ -108,24 +109,24 @@ function registerSupportingTools(server, client) {
     server.registerTool("unifi_list_radius_profiles", {
         description: "List RADIUS profiles (auth/accounting server configurations referenced by WiFi WPA-Enterprise, switch 802.1X port auth, VPN). Returns: id, name, metadata (origin, configurable).",
         inputSchema: {
-            siteId: zod_1.z.string().describe("Site ID"),
+            siteId: (0, params_js_1.resourceId)().describe("Site ID"),
             offset: zod_1.z
                 .number()
                 .int()
                 .nonnegative()
                 .optional()
-                .describe("Number of records to skip (default: 0)"),
+                .describe("Number of records to skip"),
             limit: zod_1.z
                 .number()
                 .int()
                 .min(0)
                 .max(200)
                 .optional()
-                .describe("Number of records to return (default: 25, max: 200)"),
+                .describe("Number of records to return (API default: 25)"),
             filter: zod_1.z
                 .string()
                 .optional()
-                .describe("Filter expression"),
+                .describe("Filter expression, e.g. name.eq('Default')"),
         },
         outputSchema: output_schemas_js_1.listRadiusProfilesOutputSchema,
         annotations: safety_js_1.READ_ONLY,
@@ -140,22 +141,22 @@ function registerSupportingTools(server, client) {
         }
     });
     server.registerTool("unifi_list_device_tags", {
-        description: "List device tags at a site. Tags group APs/switches for selective WiFi broadcast (via broadcastingDeviceFilter on a WiFi network). Returns: id, name, deviceIds[].",
+        description: "List device tags at a site. Tags group APs/switches for selective WiFi broadcast (via broadcastingDeviceFilter on a WiFi network). Returns: id, name, deviceIds[], metadata.",
         inputSchema: {
-            siteId: zod_1.z.string().describe("Site ID"),
+            siteId: (0, params_js_1.resourceId)().describe("Site ID"),
             offset: zod_1.z
                 .number()
                 .int()
                 .nonnegative()
                 .optional()
-                .describe("Number of records to skip (default: 0)"),
+                .describe("Number of records to skip"),
             limit: zod_1.z
                 .number()
                 .int()
                 .min(0)
                 .max(200)
                 .optional()
-                .describe("Number of records to return (default: 25, max: 200)"),
+                .describe("Number of records to return (API default: 25)"),
             filter: zod_1.z
                 .string()
                 .optional()
@@ -181,18 +182,18 @@ function registerSupportingTools(server, client) {
                 .int()
                 .nonnegative()
                 .optional()
-                .describe("Number of records to skip (default: 0)"),
+                .describe("Number of records to skip"),
             limit: zod_1.z
                 .number()
                 .int()
                 .min(0)
                 .max(200)
                 .optional()
-                .describe("Number of records to return (default: 25, max: 200)"),
+                .describe("Number of records to return (API default: 25)"),
             filter: zod_1.z
                 .string()
                 .optional()
-                .describe("Filter expression"),
+                .describe("Filter expression, e.g. name.like('Stream*') or id.eq(3). NOTE: totalCount ignores the filter here — page by count"),
         },
         outputSchema: output_schemas_js_1.listDpiCategoriesOutputSchema,
         annotations: safety_js_1.READ_ONLY,
@@ -214,18 +215,18 @@ function registerSupportingTools(server, client) {
                 .int()
                 .nonnegative()
                 .optional()
-                .describe("Number of records to skip (default: 0)"),
+                .describe("Number of records to skip"),
             limit: zod_1.z
                 .number()
                 .int()
                 .min(0)
                 .max(200)
                 .optional()
-                .describe("Number of records to return (default: 25, max: 200)"),
+                .describe("Number of records to return (API default: 25)"),
             filter: zod_1.z
                 .string()
                 .optional()
-                .describe("Filter expression"),
+                .describe("Filter expression, e.g. name.like('Net*') or id.eq(3). NOTE: totalCount ignores the filter here — page by count"),
         },
         outputSchema: output_schemas_js_1.listDpiApplicationsOutputSchema,
         annotations: safety_js_1.READ_ONLY,
@@ -247,14 +248,14 @@ function registerSupportingTools(server, client) {
                 .int()
                 .nonnegative()
                 .optional()
-                .describe("Number of records to skip (default: 0)"),
+                .describe("Number of records to skip"),
             limit: zod_1.z
                 .number()
                 .int()
                 .min(0)
                 .max(200)
                 .optional()
-                .describe("Number of records to return (default: 25, max: 200)"),
+                .describe("Number of records to return (API default: 25)"),
             filter: zod_1.z
                 .string()
                 .optional()

package/dist/tools/switching.js

@@ -6,28 +6,29 @@ const responses_js_1 = require("../utils/responses.js");
 const query_js_1 = require("../utils/query.js");
 const safety_js_1 = require("../utils/safety.js");
 const output_schemas_js_1 = require("../utils/output-schemas.js");
+const params_js_1 = require("../utils/params.js");
 function registerSwitchingTools(server, client) {
     server.registerTool("unifi_list_switch_stacks", {
-        description: "List Switch Stacks (multiple physical switches managed as one logical unit) at a site. Returns: id, deviceId (the stack's primary device), name, units[] (the stacked switches — named `members` on consoles older than 10.6.106), lags[] (LAGs spanning the stack), metadata.origin. Per-unit schema is not rendered in the 10.6.106 docs — call unifi_get_switch_stack to inspect. Use for: identifying stacked switches; individual member configs/stats still come from unifi_get_device.",
+        description: "List Switch Stacks (multiple physical switches managed as one logical unit) at a site. Returns: id, deviceId (the stack's primary device), name, units[] (the stacked switches — named `members` on consoles older than 10.6.106), lags[] (LAGs spanning the stack), metadata.origin. Per-unit schema is not rendered in the 11.0.83 docs — call unifi_get_switch_stack to inspect. Use for: identifying stacked switches; individual member configs/stats still come from unifi_get_device.",
         inputSchema: {
-            siteId: zod_1.z.string().describe("Site ID"),
+            siteId: (0, params_js_1.resourceId)().describe("Site ID"),
             offset: zod_1.z
                 .number()
                 .int()
                 .nonnegative()
                 .optional()
-                .describe("Number of records to skip (default: 0)"),
+                .describe("Number of records to skip"),
             limit: zod_1.z
                 .number()
                 .int()
                 .min(0)
                 .max(200)
                 .optional()
-                .describe("Number of records to return (default: 25, max: 200)"),
+                .describe("Number of records to return (API default: 25)"),
             filter: zod_1.z
                 .string()
                 .optional()
-                .describe("Filter expression"),
+                .describe("Filter expression, e.g. name.like('Core*') or metadata.origin.eq('USER_DEFINED'). Device filters (members.deviceId, units.deviceId) are rejected on 11.0.83"),
         },
         outputSchema: output_schemas_js_1.listSwitchStacksOutputSchema,
         annotations: safety_js_1.READ_ONLY,
@@ -44,8 +45,8 @@ function registerSwitchingTools(server, client) {
     server.registerTool("unifi_get_switch_stack", {
         description: "Get full details of a Switch Stack including all units and stacking topology. Returns the same fields as the list response but for a single stack: id, deviceId, name, units[] (named `members` before 10.6.106), lags[], metadata.origin.",
         inputSchema: {
-            siteId: zod_1.z.string().describe("Site ID"),
-            switchStackId: zod_1.z.string().describe("Switch Stack ID"),
+            siteId: (0, params_js_1.resourceId)().describe("Site ID"),
+            switchStackId: (0, params_js_1.resourceId)().describe("Switch Stack ID"),
         },
         outputSchema: output_schemas_js_1.switchStackOutputSchema,
         annotations: safety_js_1.READ_ONLY,
@@ -59,26 +60,26 @@ function registerSwitchingTools(server, client) {
         }
     });
     server.registerTool("unifi_list_mc_lag_domains", {
-        description: "List MC-LAG (Multi-Chassis Link Aggregation) Domains — pairs of switches presenting as one for LAG redundancy. Returns: id, name, peers[], lags[] (LAGs spanning the domain), metadata.origin.",
+        description: "List MC-LAG (Multi-Chassis Link Aggregation) Domains — pairs of switches presenting as one for LAG redundancy. Returns: id, name, peers[] (per the older 10.4.57 spec: {deviceId, linkPortIdxs[], role TOP|BOTTOM}; not live-verified), lags[] (LAGs spanning the domain), metadata.origin.",
         inputSchema: {
-            siteId: zod_1.z.string().describe("Site ID"),
+            siteId: (0, params_js_1.resourceId)().describe("Site ID"),
             offset: zod_1.z
                 .number()
                 .int()
                 .nonnegative()
                 .optional()
-                .describe("Number of records to skip (default: 0)"),
+                .describe("Number of records to skip"),
             limit: zod_1.z
                 .number()
                 .int()
                 .min(0)
                 .max(200)
                 .optional()
-                .describe("Number of records to return (default: 25, max: 200)"),
+                .describe("Number of records to return (API default: 25)"),
             filter: zod_1.z
                 .string()
                 .optional()
-                .describe("Filter expression"),
+                .describe("Filter expression, e.g. peers.deviceId.contains('<deviceId>')"),
         },
         outputSchema: output_schemas_js_1.listMcLagDomainsOutputSchema,
         annotations: safety_js_1.READ_ONLY,
@@ -95,8 +96,8 @@ function registerSwitchingTools(server, client) {
     server.registerTool("unifi_get_mc_lag_domain", {
         description: "Get full details of an MC-LAG Domain (peer switches and member LAGs).",
         inputSchema: {
-            siteId: zod_1.z.string().describe("Site ID"),
-            mcLagDomainId: zod_1.z.string().describe("MC-LAG Domain ID"),
+            siteId: (0, params_js_1.resourceId)().describe("Site ID"),
+            mcLagDomainId: (0, params_js_1.resourceId)().describe("MC-LAG Domain ID"),
         },
         outputSchema: output_schemas_js_1.mcLagDomainOutputSchema,
         annotations: safety_js_1.READ_ONLY,
@@ -110,26 +111,26 @@ function registerSwitchingTools(server, client) {
         }
     });
     server.registerTool("unifi_list_lags", {
-        description: "List LAGs (Link Aggregation Groups — bonded switch ports) at a site. Returns: id, type (LOCAL/SWITCH_STACK/MULTI_CHASSIS), members[], metadata.origin.",
+        description: "List LAGs (Link Aggregation Groups — bonded switch ports) at a site. Returns: id, type (LOCAL/SWITCH_STACK/MULTI_CHASSIS), members[] ({deviceId, portIdxs[]}), switchStackId (SWITCH_STACK) or mcLagDomainId (MULTI_CHASSIS), metadata.origin.",
         inputSchema: {
-            siteId: zod_1.z.string().describe("Site ID"),
+            siteId: (0, params_js_1.resourceId)().describe("Site ID"),
             offset: zod_1.z
                 .number()
                 .int()
                 .nonnegative()
                 .optional()
-                .describe("Number of records to skip (default: 0)"),
+                .describe("Number of records to skip"),
             limit: zod_1.z
                 .number()
                 .int()
                 .min(0)
                 .max(200)
                 .optional()
-                .describe("Number of records to return (default: 25, max: 200)"),
+                .describe("Number of records to return (API default: 25)"),
             filter: zod_1.z
                 .string()
                 .optional()
-                .describe("Filter expression"),
+                .describe("Filter expression, e.g. type.eq('LOCAL'), members.deviceId.contains('<deviceId>'), switchStackId.isNull()"),
         },
         outputSchema: output_schemas_js_1.listLagsOutputSchema,
         annotations: safety_js_1.READ_ONLY,
@@ -146,8 +147,8 @@ function registerSwitchingTools(server, client) {
     server.registerTool("unifi_get_lag", {
         description: "Get full details of a LAG including its type (LOCAL/SWITCH_STACK/MULTI_CHASSIS) and member ports.",
         inputSchema: {
-            siteId: zod_1.z.string().describe("Site ID"),
-            lagId: zod_1.z.string().describe("LAG ID"),
+            siteId: (0, params_js_1.resourceId)().describe("Site ID"),
+            lagId: (0, params_js_1.resourceId)().describe("LAG ID"),
         },
         outputSchema: output_schemas_js_1.lagOutputSchema,
         annotations: safety_js_1.READ_ONLY,

package/dist/tools/system.js

@@ -6,7 +6,7 @@ const safety_js_1 = require("../utils/safety.js");
 const output_schemas_js_1 = require("../utils/output-schemas.js");
 function registerSystemTools(server, client) {
     server.registerTool("unifi_get_info", {
-        description: "Get UniFi Network application info. Returns: applicationVersion. NOTE: verified against 10.6.106 on a UniFi OS console — the Integration API returns ONLY applicationVersion here; there is no isUniFiOSConsole or other field. Use for: version checks before calling version-gated tools.",
+        description: "Get UniFi Network application info. Returns: applicationVersion only — the Integration API returns no isUniFiOSConsole or other field here. Use for: checking the Network version when a tool's description notes version-specific behaviour.",
         inputSchema: {},
         outputSchema: output_schemas_js_1.getInfoOutputSchema,
         annotations: safety_js_1.READ_ONLY,

package/dist/tools/traffic-matching.d.ts

@@ -1,3 +1,4 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { NetworkClient } from "../client.js";
-export declare function registerTrafficMatchingTools(server: McpServer, client: NetworkClient, readOnly?: boolean): void;
+import { type WanPolicy } from "../utils/wan-exposure.js";
+export declare function registerTrafficMatchingTools(server: McpServer, client: NetworkClient, readOnly?: boolean, wan?: WanPolicy): void;

package/dist/tools/traffic-matching.js

@@ -6,28 +6,34 @@ const responses_js_1 = require("../utils/responses.js");
 const query_js_1 = require("../utils/query.js");
 const safety_js_1 = require("../utils/safety.js");
 const output_schemas_js_1 = require("../utils/output-schemas.js");
-function registerTrafficMatchingTools(server, client, readOnly = false) {
+const params_js_1 = require("../utils/params.js");
+const wan_exposure_js_1 = require("../utils/wan-exposure.js");
+const matchingItems = zod_1.z
+    .array(zod_1.z.object({ type: zod_1.z.string().describe("Item type, e.g. PORT_NUMBER, IP_ADDRESS, SUBNET") }).loose())
+    .min(1)
+    .describe("Non-empty array of tagged item objects, e.g. [{type:'PORT_NUMBER', value:443}]");
+function registerTrafficMatchingTools(server, client, readOnly = false, wan = wan_exposure_js_1.DEFAULT_WAN_POLICY) {
     server.registerTool("unifi_list_traffic_matching_lists", {
-        description: "List traffic matching lists at a site — named collections of ports or IPs reused in firewall/ACL rules. Returns: id, type (PORTS/IPV4_ADDRESSES/IPV6_ADDRESSES), name, items[]. Use for: finding the matching-list ID to reference from a firewall policy.",
+        description: "List traffic matching lists at a site — named collections of ports or IPs reused in firewall/ACL rules. Returns: id, type (PORTS/IPV4_ADDRESSES/IPV6_ADDRESSES), name, items[] (tagged objects such as {type:'PORT_NUMBER', value:22} or {type:'SUBNET', value:'<cidr>'}). Use for: finding the matching-list ID to reference from a firewall policy.",
         inputSchema: {
-            siteId: zod_1.z.string().describe("Site ID"),
+            siteId: (0, params_js_1.resourceId)().describe("Site ID"),
             offset: zod_1.z
                 .number()
                 .int()
                 .nonnegative()
                 .optional()
-                .describe("Number of records to skip (default: 0)"),
+                .describe("Number of records to skip"),
             limit: zod_1.z
                 .number()
                 .int()
                 .min(0)
                 .max(200)
                 .optional()
-                .describe("Number of records to return (default: 25, max: 200)"),
+                .describe("Number of records to return (API default: 25)"),
             filter: zod_1.z
                 .string()
                 .optional()
-                .describe("Filter expression"),
+                .describe("Filter expression. Only id and name are filterable (type is rejected with HTTP 400). Example: name.like('Web*'). NOTE: totalCount ignores the filter here — page by count"),
         },
         outputSchema: output_schemas_js_1.listTrafficMatchingListsOutputSchema,
         annotations: safety_js_1.READ_ONLY,
@@ -44,8 +50,8 @@ function registerTrafficMatchingTools(server, client, readOnly = false) {
     server.registerTool("unifi_get_traffic_matching_list", {
         description: "Get a specific traffic matching list by ID (full items array).",
         inputSchema: {
-            siteId: zod_1.z.string().describe("Site ID"),
-            trafficMatchingListId: zod_1.z.string().describe("Traffic matching list ID"),
+            siteId: (0, params_js_1.resourceId)().describe("Site ID"),
+            trafficMatchingListId: (0, params_js_1.resourceId)().describe("Traffic matching list ID"),
         },
         outputSchema: output_schemas_js_1.trafficMatchingListOutputSchema,
         annotations: safety_js_1.READ_ONLY,
@@ -61,23 +67,20 @@ function registerTrafficMatchingTools(server, client, readOnly = false) {
     if (readOnly)
         return;
     server.registerTool("unifi_create_traffic_matching_list", {
-        description: "Create a new traffic matching list",
+        description: "Create a new traffic matching list. Items are tagged objects, not strings (live-verified 11.0.83): PORTS lists take {type:'PORT_NUMBER', value:443} (the older 10.4.57 spec also lists {type:'PORT_NUMBER_RANGE', start, stop}); IPV4_ADDRESSES lists take {type:'IP_ADDRESS', value:'192.0.2.1'} or {type:'SUBNET', value:'192.0.2.0/24'} (spec also: IP_ADDRESS_RANGE {start, stop}); IPV6_ADDRESSES lists take IP_ADDRESS or SUBNET. Idempotency: not safe to retry — re-running creates a duplicate list.",
         inputSchema: {
-            siteId: zod_1.z.string().describe("Site ID"),
+            siteId: (0, params_js_1.resourceId)().describe("Site ID"),
             type: zod_1.z
                 .enum(["PORTS", "IPV4_ADDRESSES", "IPV6_ADDRESSES"])
                 .describe("List type"),
             name: zod_1.z.string().min(1).describe("List name"),
-            items: zod_1.z
-                .array(zod_1.z.unknown())
-                .min(1)
-                .describe("List items (ports or IP addresses)"),
+            items: matchingItems,
             dryRun: zod_1.z
                 .boolean()
                 .optional()
                 .describe("Preview this action without executing it"),
         },
-        outputSchema: output_schemas_js_1.trafficMatchingListOutputSchema,
+        outputSchema: (0, output_schemas_js_1.writeResult)(output_schemas_js_1.trafficMatchingListOutputSchema),
         annotations: safety_js_1.WRITE_NOT_IDEMPOTENT,
     }, async ({ siteId, type, name, items, dryRun }) => {
         try {
@@ -92,25 +95,28 @@ function registerTrafficMatchingTools(server, client, readOnly = false) {
         }
     });
     server.registerTool("unifi_update_traffic_matching_list", {
-        description: "Update a traffic matching list",
+        description: "Replace a traffic matching list (full PUT — type, name and the complete items array are all required; read the current list with unifi_get_traffic_matching_list first). Items are tagged objects, not strings (live-verified 11.0.83): PORTS lists take {type:'PORT_NUMBER', value:443} (the older 10.4.57 spec also lists {type:'PORT_NUMBER_RANGE', start, stop}); IPV4_ADDRESSES lists take {type:'IP_ADDRESS', value:'192.0.2.1'} or {type:'SUBNET', value:'192.0.2.0/24'} (spec also: IP_ADDRESS_RANGE {start, stop}); IPV6_ADDRESSES lists take IP_ADDRESS or SUBNET.",
         inputSchema: {
-            siteId: zod_1.z.string().describe("Site ID"),
-            trafficMatchingListId: zod_1.z.string().describe("Traffic matching list ID"),
+            siteId: (0, params_js_1.resourceId)().describe("Site ID"),
+            trafficMatchingListId: (0, params_js_1.resourceId)().describe("Traffic matching list ID"),
             type: zod_1.z
                 .enum(["PORTS", "IPV4_ADDRESSES", "IPV6_ADDRESSES"])
                 .describe("List type"),
             name: zod_1.z.string().min(1).describe("List name"),
-            items: zod_1.z.array(zod_1.z.unknown()).min(1).describe("List items"),
+            items: matchingItems,
             dryRun: zod_1.z
                 .boolean()
                 .optional()
                 .describe("Preview this action without executing it"),
         },
-        outputSchema: output_schemas_js_1.trafficMatchingListOutputSchema,
+        outputSchema: (0, output_schemas_js_1.writeResult)(output_schemas_js_1.trafficMatchingListOutputSchema),
         annotations: safety_js_1.WRITE,
     }, async ({ siteId, trafficMatchingListId, type, name, items, dryRun }) => {
         try {
             const body = { type, name, items };
+            const exposure = await new wan_exposure_js_1.WanExposure(client, wan, siteId).matchingList(trafficMatchingListId);
+            if (exposure)
+                return (0, wan_exposure_js_1.wanRefusal)(exposure, "PUT", `/sites/${siteId}/traffic-matching-lists/${trafficMatchingListId}`);
             if (dryRun)
                 return (0, safety_js_1.formatDryRun)("PUT", `/sites/${siteId}/traffic-matching-lists/${trafficMatchingListId}`, body);
             const data = await client.put(`/sites/${siteId}/traffic-matching-lists/${trafficMatchingListId}`, body);
@@ -123,12 +129,9 @@ function registerTrafficMatchingTools(server, client, readOnly = false) {
     server.registerTool("unifi_delete_traffic_matching_list", {
         description: "DESTRUCTIVE: Delete a traffic matching list",
         inputSchema: {
-            siteId: zod_1.z.string().describe("Site ID"),
-            trafficMatchingListId: zod_1.z.string().describe("Traffic matching list ID"),
-            confirm: zod_1.z
-                .boolean()
-                .optional()
-                .describe("Must be true to execute this destructive action"),
+            siteId: (0, params_js_1.resourceId)().describe("Site ID"),
+            trafficMatchingListId: (0, params_js_1.resourceId)().describe("Traffic matching list ID"),
+            confirm: (0, safety_js_1.confirmDestructive)(),
             dryRun: zod_1.z
                 .boolean()
                 .optional()
@@ -136,12 +139,12 @@ function registerTrafficMatchingTools(server, client, readOnly = false) {
         },
         annotations: safety_js_1.DESTRUCTIVE,
     }, async ({ siteId, trafficMatchingListId, confirm, dryRun }) => {
-        const guard = (0, safety_js_1.requireConfirmation)(confirm, "This will delete the traffic matching list");
+        const guard = dryRun ? null : (0, safety_js_1.requireConfirmation)(confirm, "This will delete the traffic matching list");
         if (guard)
             return guard;
         try {
             if (dryRun)
-                return (0, safety_js_1.formatDryRun)("DELETE", `/sites/${siteId}/traffic-matching-lists/${trafficMatchingListId}`, {});
+                return (0, safety_js_1.formatDryRun)("DELETE", `/sites/${siteId}/traffic-matching-lists/${trafficMatchingListId}`);
             const data = await client.delete(`/sites/${siteId}/traffic-matching-lists/${trafficMatchingListId}`);
             return (0, responses_js_1.formatSuccess)(data);
         }