@owine/unifi-network-mcp 3.0.0 → 3.2.0

package/dist/utils/output-schemas.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.listClientSessionsOutputSchema = exports.listClientHistoryOutputSchema = exports.ClientSessionEnvelope = exports.ClientSession = exports.HistoryClient = exports.listPendingDevicesOutputSchema = exports.listCountriesOutputSchema = exports.listDpiApplicationsOutputSchema = exports.listDpiCategoriesOutputSchema = exports.listDeviceTagsOutputSchema = exports.listRadiusProfilesOutputSchema = exports.listVpnTunnelsOutputSchema = exports.listVpnServersOutputSchema = exports.listWansOutputSchema = exports.getWifiOutputSchema = exports.listWifiOutputSchema = exports.getClientOutputSchema = exports.listClientsOutputSchema = exports.getDeviceStatisticsOutputSchema = exports.getDeviceOutputSchema = exports.listDevicesOutputSchema = exports.listTrafficMatchingListsOutputSchema = exports.trafficMatchingListOutputSchema = exports.listDnsPoliciesOutputSchema = exports.dnsPolicyOutputSchema = exports.listLagsOutputSchema = exports.lagOutputSchema = exports.listMcLagDomainsOutputSchema = exports.mcLagDomainOutputSchema = exports.listSwitchStacksOutputSchema = exports.switchStackOutputSchema = exports.aclRuleOrderingOutputSchema = exports.listAclRulesOutputSchema = exports.aclRuleOutputSchema = exports.firewallPolicyOrderingOutputSchema = exports.listFirewallPoliciesOutputSchema = exports.firewallPolicyOutputSchema = exports.listFirewallZonesOutputSchema = exports.firewallZoneOutputSchema = exports.createVouchersOutputSchema = exports.listVouchersOutputSchema = exports.voucherOutputSchema = exports.getNetworkReferencesOutputSchema = exports.listNetworksOutputSchema = exports.networkOutputSchema = exports.listSitesOutputSchema = exports.getInfoOutputSchema = void 0;
+exports.LegacyFirewallRule = exports.ClassicFirewallGroup = exports.ClassicNetwork = exports.listClientSessionsOutputSchema = exports.listClientHistoryOutputSchema = exports.ClientSessionEnvelope = exports.ClientSession = exports.HistoryClient = exports.listPendingDevicesOutputSchema = exports.listCountriesOutputSchema = exports.listDpiApplicationsOutputSchema = exports.listDpiCategoriesOutputSchema = exports.listDeviceTagsOutputSchema = exports.listRadiusProfilesOutputSchema = exports.listVpnTunnelsOutputSchema = exports.listVpnServersOutputSchema = exports.listWansOutputSchema = exports.getWifiOutputSchema = exports.listWifiOutputSchema = exports.getClientOutputSchema = exports.listClientsOutputSchema = exports.getDeviceStatisticsOutputSchema = exports.getDeviceOutputSchema = exports.listDevicesOutputSchema = exports.listTrafficMatchingListsOutputSchema = exports.trafficMatchingListOutputSchema = exports.listDnsPoliciesOutputSchema = exports.dnsPolicyOutputSchema = exports.listLagsOutputSchema = exports.lagOutputSchema = exports.listMcLagDomainsOutputSchema = exports.mcLagDomainOutputSchema = exports.listSwitchStacksOutputSchema = exports.switchStackOutputSchema = exports.aclRuleOrderingOutputSchema = exports.listAclRulesOutputSchema = exports.aclRuleOutputSchema = exports.firewallPolicyOrderingOutputSchema = exports.listFirewallPoliciesOutputSchema = exports.firewallPolicyOutputSchema = exports.listFirewallZonesOutputSchema = exports.firewallZoneOutputSchema = exports.createVouchersOutputSchema = exports.listVouchersOutputSchema = exports.voucherOutputSchema = exports.getNetworkReferencesOutputSchema = exports.listNetworksOutputSchema = exports.networkOutputSchema = exports.listSitesOutputSchema = exports.getInfoOutputSchema = void 0;
+exports.getDeviceSshSettingsOutputSchema = exports.getUpnpStatusOutputSchema = exports.listPortForwardsOutputSchema = exports.PortForward = exports.PortForwardDestination = exports.listLegacyFirewallRulesOutputSchema = exports.listFirewallGroupsOutputSchema = exports.listClassicNetworksOutputSchema = exports.ClassicEnvelope = void 0;
 exports.looseOutput = looseOutput;
 exports.writeResult = writeResult;
 /**
@@ -74,6 +75,8 @@ const DeviceRadio = zod_1.z
     .object({
     wlanStandard: zod_1.z.string().optional(),
     frequencyGHz: zod_1.z.number().optional(),
+    // Undocumented; live-verified on 11.1.47 (e.g. "MEDIUM"), absent on 11.0.83.
+    txPowerMode: zod_1.z.string().optional(),
     channelWidthMHz: zod_1.z.number().optional(),
     channel: zod_1.z.number().optional(),
 })
@@ -618,3 +621,146 @@ exports.listClientSessionsOutputSchema = {
     end: zod_1.z.number(),
     coverage: zod_1.z.string(),
 };
+// Classic controller API reads (rest/networkconf, rest/firewallgroup,
+// rest/firewallrule, rest/portforward, get/setting). Unlike every other schema
+// here, each row shape is also the tool's output allowlist: the tools copy only
+// these fields from a record, so a field the controller adds never reaches the
+// model. networkconf records carry WAN, VPN and RADIUS credentials
+// (x_passphrase, x_wan_password, x_ipsec_*, x_openvpn_*, WireGuard keys, PPPoE
+// logins), and settings sections carry more (x_ssh_password, x_mgmt_key,
+// cloud-access keys); never list one here. Field types vary across controller
+// versions, hence the unions.
+const classicScalar = zod_1.z.union([zod_1.z.string(), zod_1.z.number()]).nullish();
+const classicString = zod_1.z.string().nullish();
+const classicBoolean = zod_1.z.boolean().nullish();
+exports.ClassicNetwork = zod_1.z
+    .object({
+    _id: zod_1.z.string(),
+    name: classicString,
+    purpose: classicString,
+    vlan: classicScalar,
+    vlan_enabled: classicBoolean,
+    ip_subnet: classicString,
+    networkgroup: classicString,
+    enabled: classicBoolean,
+    dhcpd_enabled: classicBoolean,
+    dhcpd_start: classicString,
+    dhcpd_stop: classicString,
+    domain_name: classicString,
+    igmp_snooping: classicBoolean,
+    mdns_enabled: classicBoolean,
+    network_isolation_enabled: classicBoolean,
+    internet_access_enabled: classicBoolean,
+    firewall_zone_id: classicString,
+    is_nat: classicBoolean,
+    ipv6_interface_type: classicString,
+    setting_preference: classicString,
+})
+    .loose();
+exports.ClassicFirewallGroup = zod_1.z
+    .object({
+    _id: zod_1.z.string(),
+    name: classicString,
+    group_type: classicString,
+    group_members: zod_1.z.array(zod_1.z.string()).nullish(),
+})
+    .loose();
+exports.LegacyFirewallRule = zod_1.z
+    .object({
+    _id: zod_1.z.string(),
+    name: classicString,
+    enabled: classicBoolean,
+    ruleset: classicString,
+    rule_index: classicScalar,
+    action: classicString,
+    protocol: classicString,
+    protocol_v6: classicString,
+    protocol_match_excepted: classicBoolean,
+    icmp_typename: classicString,
+    icmpv6_typename: classicString,
+    logging: classicBoolean,
+    state_established: classicBoolean,
+    state_related: classicBoolean,
+    state_new: classicBoolean,
+    state_invalid: classicBoolean,
+    src_firewallgroup_ids: zod_1.z.array(zod_1.z.string()).nullish(),
+    src_networkconf_id: classicString,
+    src_networkconf_type: classicString,
+    src_address: classicString,
+    src_address_ipv6: classicString,
+    src_mac_address: classicString,
+    src_port: classicScalar,
+    dst_firewallgroup_ids: zod_1.z.array(zod_1.z.string()).nullish(),
+    dst_networkconf_id: classicString,
+    dst_networkconf_type: classicString,
+    dst_address: classicString,
+    dst_address_ipv6: classicString,
+    dst_port: classicScalar,
+    ipsec: classicString,
+    setting_preference: classicString,
+})
+    .loose();
+/** Envelope of a classic REST collection; rows stay unknown until the allowlist is applied. */
+exports.ClassicEnvelope = zod_1.z.object({
+    meta: zod_1.z.object({ rc: zod_1.z.literal("ok") }).loose(),
+    data: zod_1.z.array(zod_1.z.record(zod_1.z.string(), zod_1.z.unknown())),
+});
+const classicList = (row) => ({
+    data: zod_1.z.array(row),
+    count: zod_1.z.number(),
+    siteReference: zod_1.z.string(),
+});
+exports.listClassicNetworksOutputSchema = classicList(exports.ClassicNetwork);
+exports.listFirewallGroupsOutputSchema = classicList(exports.ClassicFirewallGroup);
+exports.listLegacyFirewallRulesOutputSchema = classicList(exports.LegacyFirewallRule);
+exports.PortForwardDestination = zod_1.z
+    .object({
+    destination_ip: classicString,
+    interface: classicString,
+})
+    .loose();
+exports.PortForward = zod_1.z
+    .object({
+    _id: zod_1.z.string(),
+    name: classicString,
+    enabled: classicBoolean,
+    pfwd_interface: classicString,
+    destination_ip: classicString,
+    destination_ips: zod_1.z.array(exports.PortForwardDestination).nullish(),
+    src: classicString,
+    src_limiting_enabled: classicBoolean,
+    src_limiting_type: classicString,
+    src_firewall_group_id: classicString,
+    dst_port: classicScalar,
+    fwd: classicString,
+    fwd_port: classicScalar,
+    proto: classicString,
+    log: classicBoolean,
+})
+    .loose();
+exports.listPortForwardsOutputSchema = {
+    data: zod_1.z.array(exports.PortForward),
+    count: zod_1.z.number(),
+    enabledCount: zod_1.z.number(),
+    siteReference: zod_1.z.string(),
+};
+const settingsStatus = zod_1.z.enum(["available", "unavailable"]);
+exports.getUpnpStatusOutputSchema = {
+    siteReference: zod_1.z.string(),
+    status: settingsStatus,
+    source: zod_1.z.string().nullable(),
+    upnp_enabled: zod_1.z.boolean().nullable(),
+    upnp_nat_pmp_enabled: zod_1.z.boolean().nullable(),
+    upnp_secure_mode: zod_1.z.boolean().nullable(),
+    upnp_wan_interface: zod_1.z.string().nullable(),
+    detail: zod_1.z.string(),
+};
+exports.getDeviceSshSettingsOutputSchema = {
+    siteReference: zod_1.z.string(),
+    status: settingsStatus,
+    x_ssh_enabled: zod_1.z.boolean().nullable(),
+    x_ssh_auth_password_enabled: zod_1.z.boolean().nullable(),
+    x_ssh_bind_wildcard: zod_1.z.boolean().nullable(),
+    sshKeyCount: zod_1.z.number().nullable(),
+    detail: zod_1.z.string(),
+};

package/dist/utils/params.d.ts

@@ -5,3 +5,8 @@ import { z } from "zod";
  * (`?force=true`), a fragment, or extra path segments into the request.
  */
 export declare function resourceId(): z.ZodString;
+/**
+ * A site's internalReference (often default), which the controller routes
+ * outside the Integration API take in place of the site UUID.
+ */
+export declare function siteReference(): z.ZodString;

package/dist/utils/params.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.resourceId = resourceId;
+exports.siteReference = siteReference;
 const zod_1 = require("zod");
 /**
  * An Integration API resource ID. IDs are interpolated into request paths, so
@@ -10,3 +11,11 @@ const zod_1 = require("zod");
 function resourceId() {
     return zod_1.z.string().regex(/^[A-Za-z0-9_-]{1,64}$/, "Use an ID returned by a list or get tool");
 }
+/**
+ * A site's internalReference (often default), which the controller routes
+ * outside the Integration API take in place of the site UUID.
+ */
+function siteReference() {
+    return zod_1.z.string().regex(/^[A-Za-z0-9_-]{1,64}$/)
+        .describe("Site internalReference from unifi_list_sites (often default), not the Integration API UUID");
+}

package/dist/utils/pick.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copy only the allowlisted fields of a record. Classic records hold
+ * credentials under names no redaction list could anticipate, so the output is
+ * built up from the schema's keys and nothing is ever passed through.
+ */
+export declare function pick(row: Record<string, unknown>, fields: readonly string[]): Record<string, unknown>;

package/dist/utils/pick.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.pick = pick;
+/**
+ * Copy only the allowlisted fields of a record. Classic records hold
+ * credentials under names no redaction list could anticipate, so the output is
+ * built up from the schema's keys and nothing is ever passed through.
+ */
+function pick(row, fields) {
+    return Object.fromEntries(fields.filter((field) => Object.hasOwn(row, field)).map((field) => [field, row[field]]));
+}

package/dist/utils/responses.d.ts

@@ -9,6 +9,12 @@ export declare function formatSuccess(data: unknown, opts?: {
 };
 /** The message of a thrown value, which need not be an Error. */
 export declare function errorMessage(err: unknown): string;
+/**
+ * The message of a failed request, with the reason fetch keeps in cause: fetch
+ * reports every network failure as "fetch failed" and keeps the reason
+ * (ECONNREFUSED, ENOTFOUND, a certificate error) there.
+ */
+export declare function describeError(err: unknown): string;
 export declare function formatError(err: unknown): {
     content: {
         type: "text";

package/dist/utils/responses.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.formatSuccess = formatSuccess;
 exports.errorMessage = errorMessage;
+exports.describeError = describeError;
 exports.formatError = formatError;
 function formatSuccess(data, opts) {
     const result = {
@@ -19,18 +20,24 @@ function formatSuccess(data, opts) {
 function errorMessage(err) {
     return err instanceof Error ? err.message : String(err);
 }
-function formatError(err) {
+/**
+ * The message of a failed request, with the reason fetch keeps in cause: fetch
+ * reports every network failure as "fetch failed" and keeps the reason
+ * (ECONNREFUSED, ENOTFOUND, a certificate error) there.
+ */
+function describeError(err) {
     let message = errorMessage(err);
-    // fetch reports every network failure as "fetch failed" and keeps the reason
-    // (ECONNREFUSED, ENOTFOUND, a certificate error) in cause.
     const cause = err instanceof Error ? err.cause : undefined;
     const code = cause instanceof Error && "code" in cause && typeof cause.code === "string" ? cause.code : undefined;
     if (code) {
         message += ` (${code})`;
         message += tlsHint(code);
     }
+    return message;
+}
+function formatError(err) {
     return {
-        content: [{ type: "text", text: `Error: ${message}` }],
+        content: [{ type: "text", text: `Error: ${describeError(err)}` }],
         isError: true,
     };
 }

package/dist/utils/safety.d.ts

@@ -1,5 +1,6 @@
 import { z } from "zod";
 import type { ToolAnnotations } from "@modelcontextprotocol/sdk/types.js";
+import type { NetworkClient } from "../client.js";
 /** The confirm input of a DESTRUCTIVE tool. */
 export declare const confirmDestructive: () => z.ZodOptional<z.ZodBoolean>;
 export declare const READ_ONLY: ToolAnnotations;
@@ -36,13 +37,28 @@ export interface RuleEffect {
     letsThrough: boolean;
     blocks: boolean;
 }
+/**
+ * A firewall policy or ACL rule as a list returns it, typed only as far as a
+ * reorder check reads it. An entry without an ID cannot be in an ordering, so
+ * it is skipped rather than failing the check.
+ */
+declare const ListedRule: z.ZodObject<{
+    id: z.ZodOptional<z.ZodString>;
+    enabled: z.ZodOptional<z.ZodUnknown>;
+    action: z.ZodOptional<z.ZodUnknown>;
+}, z.core.$loose>;
+/** Every rule of a list by ID, with its effect, for reorderOpens. */
+export declare function listedEffects(client: NetworkClient, path: string, effectOf: (rule: z.infer<typeof ListedRule>) => RuleEffect): Promise<Map<string, RuleEffect>>;
 /**
  * Whether a reorder opens access: whether it moves a rule that lets traffic
  * through ahead of one that blocks, which it used to follow. Only rules in
- * both orders are compared, and effect is asked only about the rules a
- * reorder actually moves past one another. IDs are compared without case.
+ * both orders are compared. effects reads every rule's effect at once (one
+ * list read, not a GET per rule, which a large reshuffle would turn into a
+ * burst of hundreds), and is called only when the reorder moves rules past
+ * one another. A moved rule it does not return (deleted since the ordering
+ * was read) is refused rather than guessed. IDs are compared without case.
  */
-export declare function reorderOpens(before: readonly string[], after: readonly string[], effect: (id: string) => Promise<RuleEffect>): Promise<boolean>;
+export declare function reorderOpens(before: readonly string[], after: readonly string[], effects: () => Promise<ReadonlyMap<string, RuleEffect>>): Promise<boolean>;
 export declare function requireConfirmation(confirm: boolean | undefined, action: string): {
     content: {
         type: "text";
@@ -50,3 +66,4 @@ export declare function requireConfirmation(confirm: boolean | undefined, action
     }[];
     isError: true;
 } | null;
+export {};

package/dist/utils/safety.js

@@ -3,10 +3,13 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.DESTRUCTIVE = exports.WRITE_NOT_IDEMPOTENT = exports.WRITE = exports.READ_ONLY = exports.confirmDestructive = void 0;
 exports.formatDryRun = formatDryRun;
 exports.requireConfirmationIf = requireConfirmationIf;
+exports.listedEffects = listedEffects;
 exports.reorderOpens = reorderOpens;
 exports.requireConfirmation = requireConfirmation;
 const zod_1 = require("zod");
 const write_log_js_1 = require("../write-log.js");
+const list_all_js_1 = require("./list-all.js");
+const responses_js_1 = require("./responses.js");
 /** The confirm input of a DESTRUCTIVE tool. */
 const confirmDestructive = () => zod_1.z.boolean().optional().describe("Must be true to execute this destructive action; not needed with dryRun: true");
 exports.confirmDestructive = confirmDestructive;
@@ -60,13 +63,33 @@ function formatDryRun(method, path, body, confirmationRequired) {
 function requireConfirmationIf(reason, confirm, dryRun) {
     return reason === undefined || dryRun ? null : requireConfirmation(confirm, reason);
 }
+/**
+ * A firewall policy or ACL rule as a list returns it, typed only as far as a
+ * reorder check reads it. An entry without an ID cannot be in an ordering, so
+ * it is skipped rather than failing the check.
+ */
+const ListedRule = zod_1.z.object({
+    id: zod_1.z.string().optional(),
+    enabled: zod_1.z.unknown().optional(),
+    action: zod_1.z.unknown().optional(),
+}).loose();
+/** Every rule of a list by ID, with its effect, for reorderOpens. */
+async function listedEffects(client, path, effectOf) {
+    const rules = await (0, list_all_js_1.listAll)(client, path, ListedRule).catch((err) => {
+        throw new Error(`the rules this reorder moves could not be read, so whether it opens access is unknown (${(0, responses_js_1.errorMessage)(err)})`, { cause: err });
+    });
+    return new Map(rules.flatMap((rule) => rule.id === undefined ? [] : [[rule.id, effectOf(rule)]]));
+}
 /**
  * Whether a reorder opens access: whether it moves a rule that lets traffic
  * through ahead of one that blocks, which it used to follow. Only rules in
- * both orders are compared, and effect is asked only about the rules a
- * reorder actually moves past one another. IDs are compared without case.
+ * both orders are compared. effects reads every rule's effect at once (one
+ * list read, not a GET per rule, which a large reshuffle would turn into a
+ * burst of hundreds), and is called only when the reorder moves rules past
+ * one another. A moved rule it does not return (deleted since the ordering
+ * was read) is refused rather than guessed. IDs are compared without case.
  */
-async function reorderOpens(before, after, effect) {
+async function reorderOpens(before, after, effects) {
     const rank = new Map(before.map((id, index) => [id.toLowerCase(), index]));
     const passes = [];
     after.forEach((ahead, i) => {
@@ -76,9 +99,16 @@ async function reorderOpens(before, after, effect) {
                 passes.push([ahead, behind]);
         }
     });
-    const ids = [...new Set(passes.flat())];
-    const effects = new Map(await Promise.all(ids.map(async (id) => [id, await effect(id)])));
-    return passes.some(([ahead, behind]) => effects.get(ahead)?.letsThrough === true && effects.get(behind)?.blocks === true);
+    if (passes.length === 0)
+        return false;
+    const known = new Map([...(await effects())].map(([id, effect]) => [id.toLowerCase(), effect]));
+    // Every moved rule is checked first, so the answer never rests on a guess.
+    for (const id of new Set(passes.flat())) {
+        if (!known.has(id.toLowerCase())) {
+            throw new Error(`no rule with ID ${JSON.stringify(id)} is in this site's list, though the current ordering names it; read the ordering again`);
+        }
+    }
+    return passes.some(([ahead, behind]) => known.get(ahead.toLowerCase())?.letsThrough === true && known.get(behind.toLowerCase())?.blocks === true);
 }
 function requireConfirmation(confirm, action) {
     if (confirm !== true) {

package/dist/utils/wan-exposure.js

@@ -5,6 +5,7 @@ exports.wanRefusal = wanRefusal;
 const zod_1 = require("zod");
 const write_log_js_1 = require("../write-log.js");
 const responses_js_1 = require("./responses.js");
+const list_all_js_1 = require("./list-all.js");
 exports.DEFAULT_WAN_POLICY = { allowExposure: false, zoneIds: [] };
 const Zone = zod_1.z.object({
     id: zod_1.z.string(),
@@ -19,22 +20,6 @@ const Policy = zod_1.z.object({
     source: zod_1.z.unknown().optional(),
     destination: zod_1.z.unknown().optional(),
 }).loose();
-const PAGE_LIMIT = 200;
-const MAX_PAGES = 50;
-async function listAll(client, path, item) {
-    const page = zod_1.z.object({ data: zod_1.z.array(item), totalCount: zod_1.z.number().optional() }).loose();
-    const items = [];
-    for (let pages = 0; pages < MAX_PAGES; pages++) {
-        const { data, totalCount } = page.parse(await client.get(`${path}?offset=${items.length}&limit=${PAGE_LIMIT}`));
-        items.push(...data);
-        // Without a totalCount, only an empty page shows the list has ended: a
-        // controller may cap pages below PAGE_LIMIT, so a short page proves nothing.
-        if (data.length === 0 || (totalCount !== undefined && items.length >= totalCount))
-            return items;
-    }
-    // A list that does not end cannot be checked, which must not pass.
-    throw new Error(`the list did not end after ${MAX_PAGES} pages`);
-}
 class Refusal extends Error {
 }
 /** The checks for one site; zones and policies are read at most once per call. */
@@ -176,13 +161,13 @@ class WanExposure {
         return zone;
     }
     zoneList() {
-        this.zones ??= listAll(this.client, `/sites/${this.siteId}/firewall/zones`, Zone).catch((err) => {
+        this.zones ??= (0, list_all_js_1.listAll)(this.client, `/sites/${this.siteId}/firewall/zones`, Zone).catch((err) => {
             throw new Refusal(`the firewall zones could not be read to find the WAN zone (${(0, responses_js_1.errorMessage)(err)})`);
         });
         return this.zones;
     }
     policyList() {
-        this.policies ??= listAll(this.client, `/sites/${this.siteId}/firewall/policies`, Policy).catch((err) => {
+        this.policies ??= (0, list_all_js_1.listAll)(this.client, `/sites/${this.siteId}/firewall/policies`, Policy).catch((err) => {
             throw new Refusal(`the firewall policies that the change depends on could not be read (${(0, responses_js_1.errorMessage)(err)})`);
         });
         return this.policies;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owine/unifi-network-mcp",
-  "version": "3.0.0",
+  "version": "3.2.0",
   "description": "MCP server exposing the UniFi Network Integration API as tools for Claude and other MCP clients",
   "main": "dist/index.js",
   "bin": {
@@ -21,9 +21,9 @@
     "test:package": "pnpm run build && sh scripts/smoke-package.sh"
   },
   "engines": {
-    "node": "^22.19.0 || ^24.0.0"
+    "node": "^22.19.0 || ^24.0.0 || ^26.0.0"
   },
-  "packageManager": "pnpm@12.14.0",
+  "packageManager": "pnpm@12.21.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/owine/unifi-network-mcp.git"
@@ -40,19 +40,19 @@
   "author": "owine",
   "license": "MIT",
   "dependencies": {
-    "@modelcontextprotocol/sdk": "1.32.1",
-    "undici": "8.12.2",
+    "@modelcontextprotocol/sdk": "1.32.2",
+    "undici": "8.12.4",
     "zod": "4.6.7"
   },
   "devDependencies": {
     "@eslint/js": "10.0.1",
-    "@types/node": "24.19.2",
+    "@types/node": "26.6.6",
     "@typescript/native": "npm:typescript@7.0.2",
-    "@vitest/coverage-v8": "5.0.5",
-    "eslint": "10.13.0",
+    "@vitest/coverage-v8": "5.1.0",
+    "eslint": "10.15.0",
     "lefthook": "2.2.2",
     "typescript": "npm:@typescript/typescript6@6.0.2",
-    "typescript-eslint": "8.71.2",
-    "vitest": "5.0.5"
+    "typescript-eslint": "8.72.2",
+    "vitest": "5.1.0"
   }
 }