@owine/unifi-network-mcp 3.0.0 → 3.2.0

package/dist/tools/classic.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerClassicTools = registerClassicTools;
+const responses_js_1 = require("../utils/responses.js");
+const safety_js_1 = require("../utils/safety.js");
+const params_js_1 = require("../utils/params.js");
+const pick_js_1 = require("../utils/pick.js");
+const output_schemas_js_1 = require("../utils/output-schemas.js");
+const CLASSIC_IDS = "IDs are the classic controller's _id values, which differ from Integration API IDs: do not pass one to an Integration API tool, or the reverse.";
+const ruleset = (rule) => (typeof rule.ruleset === "string" ? rule.ruleset : "");
+// A number or a numeric string, depending on the controller version.
+function ruleIndex(rule) {
+    const index = Number.parseFloat(String(rule.rule_index));
+    return Number.isNaN(index) ? Number.MAX_SAFE_INTEGER : index;
+}
+/** The order legacy rules are evaluated in; a rule with no usable index goes last in its ruleset. */
+function byEvaluationOrder(a, b) {
+    return ruleset(a).localeCompare(ruleset(b)) || ruleIndex(a) - ruleIndex(b);
+}
+function registerClassicTools(server, client) {
+    const list = (collection, row, order) => {
+        const fields = Object.keys(row.shape);
+        return async ({ siteReference }) => {
+            try {
+                const { data: rows } = output_schemas_js_1.ClassicEnvelope.parse(await client.getClassic(siteReference, collection));
+                const data = rows.map((record) => row.strip().parse((0, pick_js_1.pick)(record, fields)));
+                if (order)
+                    data.sort(order);
+                return (0, responses_js_1.formatSuccess)({ data, count: data.length, siteReference }, { structured: true });
+            }
+            catch (err) {
+                return (0, responses_js_1.formatError)(err);
+            }
+        };
+    };
+    server.registerTool("unifi_list_classic_networks", {
+        description: `List the site's networks from the classic controller API (rest/networkconf), whole and unpaged. Use it to resolve the classic network IDs legacy firewall rules reference; for everything else prefer unifi_list_networks. ${CLASSIC_IDS} Rows carry only the fields in the output schema; credentials are never returned.`,
+        inputSchema: { siteReference: (0, params_js_1.siteReference)() },
+        outputSchema: output_schemas_js_1.listClassicNetworksOutputSchema,
+        annotations: safety_js_1.READ_ONLY,
+    }, list("networkconf", output_schemas_js_1.ClassicNetwork));
+    server.registerTool("unifi_list_firewall_groups", {
+        description: `List the site's firewall groups (address, IPv6 address and port groups) from the classic controller API (rest/firewallgroup), whole and unpaged. Legacy firewall rules reference these by ID. ${CLASSIC_IDS}`,
+        inputSchema: { siteReference: (0, params_js_1.siteReference)() },
+        outputSchema: output_schemas_js_1.listFirewallGroupsOutputSchema,
+        annotations: safety_js_1.READ_ONLY,
+    }, list("firewallgroup", output_schemas_js_1.ClassicFirewallGroup));
+    server.registerTool("unifi_list_legacy_firewall_rules", {
+        description: `List the site's legacy firewall rules (WAN_IN, LAN_IN, GUEST_LOCAL and the other rulesets) from the classic controller API (rest/firewallrule), whole and unpaged. On a site that uses the zone-based firewall these rules may not be enforced; its rules are the policies unifi_list_firewall_policies returns. ${CLASSIC_IDS} Rules reference networks by unifi_list_classic_networks IDs and groups by unifi_list_firewall_groups IDs. Sorted by ruleset, then rule_index, the order they are evaluated in.`,
+        inputSchema: { siteReference: (0, params_js_1.siteReference)() },
+        outputSchema: output_schemas_js_1.listLegacyFirewallRulesOutputSchema,
+        annotations: safety_js_1.READ_ONLY,
+    }, list("firewallrule", output_schemas_js_1.LegacyFirewallRule, byEvaluationOrder));
+}

package/dist/tools/client-history.js

@@ -4,9 +4,9 @@ exports.registerClientHistoryTools = registerClientHistoryTools;
 const zod_1 = require("zod");
 const responses_js_1 = require("../utils/responses.js");
 const safety_js_1 = require("../utils/safety.js");
+const params_js_1 = require("../utils/params.js");
 const output_schemas_js_1 = require("../utils/output-schemas.js");
-const siteReference = zod_1.z.string().regex(/^[A-Za-z0-9_-]{1,64}$/)
-    .describe("Site internalReference from unifi_list_sites (often default), not the Integration API UUID");
+const siteReference = (0, params_js_1.siteReference)();
 function registerClientHistoryTools(server, client) {
     server.registerTool("unifi_list_client_history", {
         description: `List historical/offline client inventory using the controller v2 API. Returns OFFLINE clients only — currently connected clients are excluded, so merge with unifi_list_clients for a full inventory. Includes names, MACs, first_seen and last_seen epoch seconds when available. This is inventory, not session history; use unifi_list_client_sessions for past connections. Requires controller history API-key support; errors never mean zero activity. Retention depends on the controller. Returns the most recently seen clients first, up to limit, with totalCount; truncated: true means less recently seen clients were left out, so raise limit (narrowing withinHours drops those same clients). Rows carry only ${Object.keys(output_schemas_js_1.HistoryClient.shape).join(", ")}.`,

package/dist/tools/devices.js

@@ -42,7 +42,7 @@ function registerDeviceTools(server, client, readOnly = false) {
         }
     });
     server.registerTool("unifi_get_device", {
-        description: "Get full configuration for a device. Returns (in addition to list fields): adoptedAt, provisionedAt, configurationId, uplink.deviceId (absent on the ISP modem), features (object keyed by capability: switching {lags[]} / accessPoint {}), interfaces.ports[] for switches, gateways and modems ({idx, state, connector, maxSpeedMbps, speedMbps (may be omitted on DOWN ports), poe:{standard, type, enabled, state} on PoE ports only}), interfaces.radios[] for APs ({wlanStandard, frequencyGHz, channelWidthMHz, channel}). Some devices (e.g. 5G modems) return empty features/interfaces objects. NOTE: in the LIST endpoint, features/interfaces are capability-tag string arrays instead. Use for: switch port layout/PoE state, AP radio config, uplink topology. For live throughput/CPU/memory, use unifi_get_device_statistics.",
+        description: "Get full configuration for a device. Returns (in addition to list fields): adoptedAt, provisionedAt, configurationId, uplink.deviceId (absent on the ISP modem), features (object keyed by capability: switching {lags[]} / accessPoint {}), interfaces.ports[] for switches, gateways and modems ({idx, state, connector, maxSpeedMbps, speedMbps (may be omitted on DOWN ports), poe:{standard, type, enabled, state} on PoE ports only}), interfaces.radios[] for APs ({wlanStandard, frequencyGHz, txPowerMode (e.g. MEDIUM; 11.1.47 and later), channelWidthMHz, channel}). Some devices (e.g. 5G modems) return empty features/interfaces objects. NOTE: in the LIST endpoint, features/interfaces are capability-tag string arrays instead. Use for: switch port layout/PoE state, AP radio config, uplink topology. For live throughput/CPU/memory, use unifi_get_device_statistics.",
         inputSchema: {
             siteId: (0, params_js_1.resourceId)().describe("Site ID"),
             deviceId: (0, params_js_1.resourceId)().describe("Device ID"),

package/dist/tools/exposure.d.ts

@@ -0,0 +1,3 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { NetworkClient } from "../client.js";
+export declare function registerExposureTools(server: McpServer, client: NetworkClient): void;

package/dist/tools/exposure.js

@@ -0,0 +1,118 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerExposureTools = registerExposureTools;
+const responses_js_1 = require("../utils/responses.js");
+const safety_js_1 = require("../utils/safety.js");
+const params_js_1 = require("../utils/params.js");
+const pick_js_1 = require("../utils/pick.js");
+const output_schemas_js_1 = require("../utils/output-schemas.js");
+const isRow = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const flag = (value) => (typeof value === "boolean" ? value : null);
+const text = (value) => (typeof value === "string" ? value : null);
+const FORWARD_FIELDS = Object.keys(output_schemas_js_1.PortForward.shape);
+const DESTINATION_FIELDS = Object.keys(output_schemas_js_1.PortForwardDestination.shape);
+/** The site's settings sections by key. Only the caller's picked fields leave this module. */
+async function settingSections(client, site) {
+    const { data } = output_schemas_js_1.ClassicEnvelope.parse(await client.getClassicSettings(site));
+    return new Map(data.flatMap((section) => (typeof section.key === "string" ? [[section.key, section]] : [])));
+}
+const SETTINGS = "from the classic controller API (get/setting)";
+function registerExposureTools(server, client) {
+    server.registerTool("unifi_list_port_forwards", {
+        description: `List the site's port forwards from the classic controller API (rest/portforward), whole and unpaged: each one exposes a LAN host to the internet on the WAN interface pfwd_interface. enabled: false rules forward nothing; enabledCount counts the rest. Unless src_limiting_enabled restricts it to src_firewall_group_id, the forward is open to the whole internet: src is then "any" or absent (Network 11.0.94 omits it). fwd and fwd_port are the LAN target. IDs are the classic controller's _id values.`,
+        inputSchema: { siteReference: (0, params_js_1.siteReference)() },
+        outputSchema: output_schemas_js_1.listPortForwardsOutputSchema,
+        annotations: safety_js_1.READ_ONLY,
+    }, async ({ siteReference }) => {
+        try {
+            const { data: rows } = output_schemas_js_1.ClassicEnvelope.parse(await client.getClassic(siteReference, "portforward"));
+            const data = rows.map((record) => {
+                const row = (0, pick_js_1.pick)(record, FORWARD_FIELDS);
+                if (Array.isArray(row.destination_ips)) {
+                    row.destination_ips = row.destination_ips.map((entry) => (isRow(entry) ? (0, pick_js_1.pick)(entry, DESTINATION_FIELDS) : entry));
+                }
+                return output_schemas_js_1.PortForward.strip().parse(row);
+            });
+            const enabledCount = data.filter((row) => row.enabled !== false).length;
+            return (0, responses_js_1.formatSuccess)({ data, count: data.length, enabledCount, siteReference }, { structured: true });
+        }
+        catch (err) {
+            return (0, responses_js_1.formatError)(err);
+        }
+    });
+    server.registerTool("unifi_get_upnp_status", {
+        description: `Read whether UPnP and NAT-PMP are on for the site's gateway, ${SETTINGS}: the dedicated upnp section where the controller has one, otherwise the gateway (usg) section's upnp_* fields. With UPnP on, LAN devices open WAN ports themselves, without a port forward. upnp_nat_pmp_enabled is the stored setting, which does nothing while UPnP is off; detail says which applies. status: unavailable means no UPnP setting was found on this controller version; it does not mean UPnP is off.`,
+        inputSchema: { siteReference: (0, params_js_1.siteReference)() },
+        outputSchema: output_schemas_js_1.getUpnpStatusOutputSchema,
+        annotations: safety_js_1.READ_ONLY,
+    }, async ({ siteReference }) => {
+        try {
+            const sections = await settingSections(client, siteReference);
+            for (const source of ["upnp", "usg"]) {
+                const section = sections.get(source);
+                if (!section)
+                    continue;
+                // Network 11.0.94 (zone-based) has no upnp section: its usg section holds
+                // the upnp_* fields. A upnp section, where there is one, may drop the prefix.
+                const field = (name) => section[`upnp_${name}`] ?? (source === "upnp" ? section[name] : undefined);
+                const enabled = flag(field("enabled"));
+                if (enabled === null)
+                    continue;
+                const natPmp = flag(field("nat_pmp_enabled"));
+                const detail = enabled
+                    ? `UPnP is on: LAN devices can open ports on the WAN without a port forward.${natPmp ? " NAT-PMP is on too." : ""}`
+                    : natPmp
+                        ? "UPnP is off. NAT-PMP is stored as on, but that flag does nothing while UPnP is off; it applies again if UPnP is turned on."
+                        : "UPnP is off, so NAT-PMP is not served either.";
+                return (0, responses_js_1.formatSuccess)({
+                    siteReference, status: "available", source,
+                    upnp_enabled: enabled,
+                    upnp_nat_pmp_enabled: natPmp,
+                    upnp_secure_mode: flag(field("secure_mode")),
+                    upnp_wan_interface: text(field("wan_interface")),
+                    detail,
+                }, { structured: true });
+            }
+            return (0, responses_js_1.formatSuccess)({
+                siteReference, status: "unavailable", source: null,
+                upnp_enabled: null, upnp_nat_pmp_enabled: null, upnp_secure_mode: null, upnp_wan_interface: null,
+                detail: "No UPnP setting was found in the site's settings (neither a upnp section nor upnp_enabled in the usg section). This controller version may keep it elsewhere; check the gateway's UPnP setting in the console. This is not a result that UPnP is off.",
+            }, { structured: true });
+        }
+        catch (err) {
+            return (0, responses_js_1.formatError)(err);
+        }
+    });
+    server.registerTool("unifi_get_device_ssh_settings", {
+        description: `Read the site's device SSH settings (Device SSH Authentication for adopted UniFi devices) ${SETTINGS} mgmt section: whether SSH is on, whether it accepts passwords, whether it listens on every interface (x_ssh_bind_wildcard), and how many SSH keys are installed. Credentials and keys are never returned. Console (UniFi OS) SSH is a separate UniFi OS setting this API does not expose. Which networks reach the console's web UI and SSH is set by firewall rules and policies, and from the internet by Remote Access and port forwards (unifi_list_port_forwards). status: unavailable means the controller's settings had no such fields.`,
+        inputSchema: { siteReference: (0, params_js_1.siteReference)() },
+        outputSchema: output_schemas_js_1.getDeviceSshSettingsOutputSchema,
+        annotations: safety_js_1.READ_ONLY,
+    }, async ({ siteReference }) => {
+        try {
+            const mgmt = (await settingSections(client, siteReference)).get("mgmt");
+            const sshEnabled = flag(mgmt?.x_ssh_enabled);
+            if (!mgmt || sshEnabled === null) {
+                return (0, responses_js_1.formatSuccess)({
+                    siteReference, status: "unavailable",
+                    x_ssh_enabled: null, x_ssh_auth_password_enabled: null, x_ssh_bind_wildcard: null, sshKeyCount: null,
+                    detail: "The site's settings have no device SSH setting (mgmt.x_ssh_enabled) on this controller version. This is not a result that SSH is off.",
+                }, { structured: true });
+            }
+            const passwords = flag(mgmt.x_ssh_auth_password_enabled);
+            return (0, responses_js_1.formatSuccess)({
+                siteReference, status: "available",
+                x_ssh_enabled: sshEnabled,
+                x_ssh_auth_password_enabled: passwords,
+                x_ssh_bind_wildcard: flag(mgmt.x_ssh_bind_wildcard),
+                sshKeyCount: Array.isArray(mgmt.x_ssh_keys) ? mgmt.x_ssh_keys.length : null,
+                detail: sshEnabled
+                    ? `Device SSH is on${passwords === false ? " with key authentication only" : passwords ? ", and accepts passwords" : ""}. It is reachable from wherever the firewall lets traffic to the devices through.`
+                    : "Device SSH is off.",
+            }, { structured: true });
+        }
+        catch (err) {
+            return (0, responses_js_1.formatError)(err);
+        }
+    });
+}

package/dist/tools/firewall.js

@@ -497,14 +497,14 @@ function registerFirewallTools(server, client, readOnly = false, wan = wan_expos
             const path = `/sites/${siteId}/firewall/policies/ordering${query}`;
             const body = { orderedFirewallPolicyIds };
             const current = (0, full_put_js_1.asObject)(await client.get(path), "the current firewall policy ordering");
-            const opens = await (0, safety_js_1.reorderOpens)(evaluationOrder(current.orderedFirewallPolicyIds), evaluationOrder(orderedFirewallPolicyIds), async (id) => {
-                // The system-defined policies are not listed, so their actions are
-                // unknown: moving anything across them counts both ways.
-                if (id === SYSTEM_DEFINED)
-                    return { letsThrough: true, blocks: true };
-                const policy = (0, full_put_js_1.asObject)(await client.get(`/sites/${siteId}/firewall/policies/${id}`), "a firewall policy");
-                const active = policy.enabled !== false;
-                return { letsThrough: active && letsThrough(policy), blocks: active && !letsThrough(policy) };
+            const opens = await (0, safety_js_1.reorderOpens)(evaluationOrder(current.orderedFirewallPolicyIds), evaluationOrder(orderedFirewallPolicyIds), async () => {
+                const effects = await (0, safety_js_1.listedEffects)(client, `/sites/${siteId}/firewall/policies`, (policy) => {
+                    const active = policy.enabled !== false;
+                    return { letsThrough: active && letsThrough(policy), blocks: active && !letsThrough(policy) };
+                });
+                // The system-defined policies are not in the ordering by ID, so their
+                // actions are unknown: moving anything across them counts both ways.
+                return effects.set(SYSTEM_DEFINED, { letsThrough: true, blocks: true });
             });
             const opening = opens ? "This moves a firewall policy that lets traffic through ahead of one that blocks it" : undefined;
             const guard = (0, safety_js_1.requireConfirmationIf)(opening, confirm, dryRun);

package/dist/tools/index.js

@@ -11,6 +11,8 @@ const sites_js_1 = require("./sites.js");
 const devices_js_1 = require("./devices.js");
 const clients_js_1 = require("./clients.js");
 const client_history_js_1 = require("./client-history.js");
+const classic_js_1 = require("./classic.js");
+const exposure_js_1 = require("./exposure.js");
 const networks_js_1 = require("./networks.js");
 const wifi_js_1 = require("./wifi.js");
 const hotspot_js_1 = require("./hotspot.js");
@@ -28,6 +30,8 @@ function registerAllTools(server, client, readOnly = false, options = {}) {
     (0, devices_js_1.registerDeviceTools)(server, client, readOnly);
     (0, clients_js_1.registerClientTools)(server, client, readOnly);
     (0, client_history_js_1.registerClientHistoryTools)(server, client);
+    (0, classic_js_1.registerClassicTools)(server, client);
+    (0, exposure_js_1.registerExposureTools)(server, client);
     (0, networks_js_1.registerNetworkTools)(server, client, readOnly, wan);
     (0, wifi_js_1.registerWifiTools)(server, client, readOnly);
     (0, hotspot_js_1.registerHotspotTools)(server, client, readOnly);
@@ -82,7 +86,7 @@ function instrumentTools(server, { writeTools, writeLog }) {
 // Words in tool names that read wrongly in plain sentence case.
 const TITLE_WORDS = {
     acl: "ACL", dns: "DNS", dpi: "DPI", vpn: "VPN", radius: "RADIUS",
-    wifi: "WiFi", wan: "WAN", wans: "WANs", lag: "LAG", lags: "LAGs", mc: "MC",
+    wifi: "WiFi", wan: "WAN", wans: "WANs", lag: "LAG", lags: "LAGs", mc: "MC", upnp: "UPnP", ssh: "SSH",
 };
 /** "unifi_list_mc_lag_domains" → "List MC-LAG domains". */
 function toolTitle(name) {

package/dist/utils/list-all.d.ts

@@ -0,0 +1,4 @@
+import { z } from "zod";
+import type { NetworkClient } from "../client.js";
+/** Every item of a paged Integration API list, read page by page. */
+export declare function listAll<T extends z.ZodType>(client: NetworkClient, path: string, item: T): Promise<z.infer<T>[]>;

package/dist/utils/list-all.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.listAll = listAll;
+const zod_1 = require("zod");
+const PAGE_LIMIT = 200;
+const MAX_PAGES = 50;
+/** Every item of a paged Integration API list, read page by page. */
+async function listAll(client, path, item) {
+    const page = zod_1.z.object({ data: zod_1.z.array(item), totalCount: zod_1.z.number().optional() }).loose();
+    const items = [];
+    for (let pages = 0; pages < MAX_PAGES; pages++) {
+        const { data, totalCount } = page.parse(await client.get(`${path}?offset=${items.length}&limit=${PAGE_LIMIT}`));
+        items.push(...data);
+        // Without a totalCount, only an empty page shows the list has ended: a
+        // controller may cap pages below PAGE_LIMIT, so a short page proves nothing.
+        if (data.length === 0 || (totalCount !== undefined && items.length >= totalCount))
+            return items;
+    }
+    // A list that does not end cannot be checked, which must not pass.
+    throw new Error(`the list did not end after ${MAX_PAGES} pages`);
+}

package/dist/utils/output-schemas.d.ts

@@ -482,6 +482,7 @@ export declare const getDeviceOutputSchema: {
         radios: z.ZodOptional<z.ZodArray<z.ZodObject<{
             wlanStandard: z.ZodOptional<z.ZodString>;
             frequencyGHz: z.ZodOptional<z.ZodNumber>;
+            txPowerMode: z.ZodOptional<z.ZodString>;
             channelWidthMHz: z.ZodOptional<z.ZodNumber>;
             channel: z.ZodOptional<z.ZodNumber>;
         }, z.core.$loose>>>;
@@ -753,3 +754,218 @@ export declare const listClientSessionsOutputSchema: {
     readonly end: z.ZodNumber;
     readonly coverage: z.ZodString;
 };
+export declare const ClassicNetwork: z.ZodObject<{
+    _id: z.ZodString;
+    name: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    purpose: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    vlan: z.ZodOptional<z.ZodNullable<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>>;
+    vlan_enabled: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+    ip_subnet: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    networkgroup: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    enabled: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+    dhcpd_enabled: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+    dhcpd_start: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    dhcpd_stop: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    domain_name: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    igmp_snooping: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+    mdns_enabled: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+    network_isolation_enabled: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+    internet_access_enabled: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+    firewall_zone_id: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    is_nat: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+    ipv6_interface_type: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    setting_preference: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, z.core.$loose>;
+export declare const ClassicFirewallGroup: z.ZodObject<{
+    _id: z.ZodString;
+    name: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    group_type: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    group_members: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
+}, z.core.$loose>;
+export declare const LegacyFirewallRule: z.ZodObject<{
+    _id: z.ZodString;
+    name: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    enabled: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+    ruleset: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    rule_index: z.ZodOptional<z.ZodNullable<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>>;
+    action: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    protocol: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    protocol_v6: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    protocol_match_excepted: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+    icmp_typename: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    icmpv6_typename: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    logging: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+    state_established: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+    state_related: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+    state_new: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+    state_invalid: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+    src_firewallgroup_ids: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
+    src_networkconf_id: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    src_networkconf_type: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    src_address: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    src_address_ipv6: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    src_mac_address: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    src_port: z.ZodOptional<z.ZodNullable<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>>;
+    dst_firewallgroup_ids: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
+    dst_networkconf_id: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    dst_networkconf_type: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    dst_address: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    dst_address_ipv6: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    dst_port: z.ZodOptional<z.ZodNullable<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>>;
+    ipsec: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    setting_preference: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, z.core.$loose>;
+/** Envelope of a classic REST collection; rows stay unknown until the allowlist is applied. */
+export declare const ClassicEnvelope: z.ZodObject<{
+    meta: z.ZodObject<{
+        rc: z.ZodLiteral<"ok">;
+    }, z.core.$loose>;
+    data: z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, z.core.$strip>;
+export declare const listClassicNetworksOutputSchema: {
+    readonly data: z.ZodArray<z.ZodObject<{
+        _id: z.ZodString;
+        name: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        purpose: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        vlan: z.ZodOptional<z.ZodNullable<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>>;
+        vlan_enabled: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+        ip_subnet: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        networkgroup: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        enabled: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+        dhcpd_enabled: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+        dhcpd_start: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        dhcpd_stop: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        domain_name: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        igmp_snooping: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+        mdns_enabled: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+        network_isolation_enabled: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+        internet_access_enabled: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+        firewall_zone_id: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        is_nat: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+        ipv6_interface_type: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        setting_preference: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, z.core.$loose>>;
+    readonly count: z.ZodNumber;
+    readonly siteReference: z.ZodString;
+};
+export declare const listFirewallGroupsOutputSchema: {
+    readonly data: z.ZodArray<z.ZodObject<{
+        _id: z.ZodString;
+        name: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        group_type: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        group_members: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
+    }, z.core.$loose>>;
+    readonly count: z.ZodNumber;
+    readonly siteReference: z.ZodString;
+};
+export declare const listLegacyFirewallRulesOutputSchema: {
+    readonly data: z.ZodArray<z.ZodObject<{
+        _id: z.ZodString;
+        name: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        enabled: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+        ruleset: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        rule_index: z.ZodOptional<z.ZodNullable<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>>;
+        action: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        protocol: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        protocol_v6: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        protocol_match_excepted: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+        icmp_typename: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        icmpv6_typename: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        logging: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+        state_established: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+        state_related: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+        state_new: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+        state_invalid: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+        src_firewallgroup_ids: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
+        src_networkconf_id: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        src_networkconf_type: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        src_address: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        src_address_ipv6: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        src_mac_address: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        src_port: z.ZodOptional<z.ZodNullable<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>>;
+        dst_firewallgroup_ids: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
+        dst_networkconf_id: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        dst_networkconf_type: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        dst_address: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        dst_address_ipv6: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        dst_port: z.ZodOptional<z.ZodNullable<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>>;
+        ipsec: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        setting_preference: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, z.core.$loose>>;
+    readonly count: z.ZodNumber;
+    readonly siteReference: z.ZodString;
+};
+export declare const PortForwardDestination: z.ZodObject<{
+    destination_ip: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    interface: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, z.core.$loose>;
+export declare const PortForward: z.ZodObject<{
+    _id: z.ZodString;
+    name: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    enabled: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+    pfwd_interface: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    destination_ip: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    destination_ips: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodObject<{
+        destination_ip: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        interface: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, z.core.$loose>>>>;
+    src: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    src_limiting_enabled: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+    src_limiting_type: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    src_firewall_group_id: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    dst_port: z.ZodOptional<z.ZodNullable<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>>;
+    fwd: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    fwd_port: z.ZodOptional<z.ZodNullable<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>>;
+    proto: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    log: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+}, z.core.$loose>;
+export declare const listPortForwardsOutputSchema: {
+    readonly data: z.ZodArray<z.ZodObject<{
+        _id: z.ZodString;
+        name: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        enabled: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+        pfwd_interface: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        destination_ip: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        destination_ips: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodObject<{
+            destination_ip: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            interface: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        }, z.core.$loose>>>>;
+        src: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        src_limiting_enabled: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+        src_limiting_type: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        src_firewall_group_id: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        dst_port: z.ZodOptional<z.ZodNullable<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>>;
+        fwd: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        fwd_port: z.ZodOptional<z.ZodNullable<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>>;
+        proto: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        log: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+    }, z.core.$loose>>;
+    readonly count: z.ZodNumber;
+    readonly enabledCount: z.ZodNumber;
+    readonly siteReference: z.ZodString;
+};
+export declare const getUpnpStatusOutputSchema: {
+    readonly siteReference: z.ZodString;
+    readonly status: z.ZodEnum<{
+        available: "available";
+        unavailable: "unavailable";
+    }>;
+    readonly source: z.ZodNullable<z.ZodString>;
+    readonly upnp_enabled: z.ZodNullable<z.ZodBoolean>;
+    readonly upnp_nat_pmp_enabled: z.ZodNullable<z.ZodBoolean>;
+    readonly upnp_secure_mode: z.ZodNullable<z.ZodBoolean>;
+    readonly upnp_wan_interface: z.ZodNullable<z.ZodString>;
+    readonly detail: z.ZodString;
+};
+export declare const getDeviceSshSettingsOutputSchema: {
+    readonly siteReference: z.ZodString;
+    readonly status: z.ZodEnum<{
+        available: "available";
+        unavailable: "unavailable";
+    }>;
+    readonly x_ssh_enabled: z.ZodNullable<z.ZodBoolean>;
+    readonly x_ssh_auth_password_enabled: z.ZodNullable<z.ZodBoolean>;
+    readonly x_ssh_bind_wildcard: z.ZodNullable<z.ZodBoolean>;
+    readonly sshKeyCount: z.ZodNullable<z.ZodNumber>;
+    readonly detail: z.ZodString;
+};