@owine/unifi-protect-mcp 2.14.2 → 3.0.0

package/dist/schemas/misc.d.ts

@@ -1,11 +1,11 @@
 import { z } from "zod";
 /**
  * Schemas below are verified against live UniFi Protect Integration API 7.3.47
- * responses (Melrose NVR Pro console, 2026-09-14) where instances exist, and
- * against the 7.3.47 published docs otherwise (arm profiles, files — no
- * instances on the console). The Integration API surface is much thinner than
+ * responses (Melrose NVR Pro console, 2026-09-14) where instances exist —
+ * re-verified live on 7.3.70 (2026-10-12) — and against the 7.3.70 published
+ * docs otherwise (arm profiles, files — no instances on the console). The Integration API surface is much thinner than
  * the internal Protect app API — only observed/documented fields are typed;
- * `.passthrough()` still allows anything extra a firmware/hardware mix adds.
+ * `.loose()` still allows anything extra a firmware/hardware mix adds.
  */
 export declare const infoOutputSchema: {
     applicationVersion: z.ZodOptional<z.ZodNullable<z.ZodString>>;
@@ -17,13 +17,13 @@ export declare const nvrSchema: z.ZodObject<{
     modelKey: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     name: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     mac: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-    doorbellSettings: z.ZodOptional<z.ZodObject<{
+    doorbellSettings: z.ZodOptional<z.ZodNullable<z.ZodObject<{
         defaultMessageText: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         defaultMessageResetTimeoutMs: z.ZodOptional<z.ZodUnknown>;
         customMessages: z.ZodOptional<z.ZodUnknown>;
         customImages: z.ZodOptional<z.ZodUnknown>;
-    }, z.core.$loose>>;
-    armMode: z.ZodOptional<z.ZodObject<{
+    }, z.core.$loose>>>;
+    armMode: z.ZodOptional<z.ZodNullable<z.ZodObject<{
         status: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         armProfileId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         armedAt: z.ZodOptional<z.ZodUnknown>;
@@ -32,7 +32,7 @@ export declare const nvrSchema: z.ZodObject<{
         breachEventCount: z.ZodOptional<z.ZodUnknown>;
         breachTriggerEventId: z.ZodOptional<z.ZodUnknown>;
         breachEventId: z.ZodOptional<z.ZodUnknown>;
-    }, z.core.$loose>>;
+    }, z.core.$loose>>>;
 }, z.core.$loose>;
 export declare const nvrOutputSchema: {
     type: z.ZodOptional<z.ZodNullable<z.ZodString>>;
@@ -41,13 +41,13 @@ export declare const nvrOutputSchema: {
     modelKey: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     name: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     mac: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-    doorbellSettings: z.ZodOptional<z.ZodObject<{
+    doorbellSettings: z.ZodOptional<z.ZodNullable<z.ZodObject<{
         defaultMessageText: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         defaultMessageResetTimeoutMs: z.ZodOptional<z.ZodUnknown>;
         customMessages: z.ZodOptional<z.ZodUnknown>;
         customImages: z.ZodOptional<z.ZodUnknown>;
-    }, z.core.$loose>>;
-    armMode: z.ZodOptional<z.ZodObject<{
+    }, z.core.$loose>>>;
+    armMode: z.ZodOptional<z.ZodNullable<z.ZodObject<{
         status: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         armProfileId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         armedAt: z.ZodOptional<z.ZodUnknown>;
@@ -56,7 +56,7 @@ export declare const nvrOutputSchema: {
         breachEventCount: z.ZodOptional<z.ZodUnknown>;
         breachTriggerEventId: z.ZodOptional<z.ZodUnknown>;
         breachEventId: z.ZodOptional<z.ZodUnknown>;
-    }, z.core.$loose>>;
+    }, z.core.$loose>>>;
 };
 export declare const userSchema: z.ZodObject<{
     id: z.ZodOptional<z.ZodString>;
@@ -86,6 +86,8 @@ export declare const userListOutputSchema: {
         email: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         ucoreUserId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     }, z.core.$loose>>;
+    totalCount: z.ZodOptional<z.ZodNumber>;
+    offset: z.ZodOptional<z.ZodNumber>;
 };
 export declare const ulpUserSchema: z.ZodObject<{
     id: z.ZodOptional<z.ZodString>;
@@ -115,6 +117,8 @@ export declare const ulpUserListOutputSchema: {
         email: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         status: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     }, z.core.$loose>>;
+    totalCount: z.ZodOptional<z.ZodNumber>;
+    offset: z.ZodOptional<z.ZodNumber>;
 };
 export declare const liveviewSchema: z.ZodObject<{
     id: z.ZodOptional<z.ZodString>;
@@ -124,11 +128,11 @@ export declare const liveviewSchema: z.ZodObject<{
     isGlobal: z.ZodOptional<z.ZodUnknown>;
     layout: z.ZodOptional<z.ZodUnknown>;
     owner: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-    slots: z.ZodOptional<z.ZodArray<z.ZodObject<{
+    slots: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodObject<{
         cameras: z.ZodOptional<z.ZodUnknown>;
         cycleMode: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         cycleInterval: z.ZodOptional<z.ZodUnknown>;
-    }, z.core.$loose>>>;
+    }, z.core.$loose>>>>;
 }, z.core.$loose>;
 export declare const liveviewOutputSchema: {
     id: z.ZodOptional<z.ZodString>;
@@ -138,11 +142,11 @@ export declare const liveviewOutputSchema: {
     isGlobal: z.ZodOptional<z.ZodUnknown>;
     layout: z.ZodOptional<z.ZodUnknown>;
     owner: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-    slots: z.ZodOptional<z.ZodArray<z.ZodObject<{
+    slots: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodObject<{
         cameras: z.ZodOptional<z.ZodUnknown>;
         cycleMode: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         cycleInterval: z.ZodOptional<z.ZodUnknown>;
-    }, z.core.$loose>>>;
+    }, z.core.$loose>>>>;
 };
 export declare const liveviewListOutputSchema: {
     result: z.ZodArray<z.ZodObject<{
@@ -153,12 +157,14 @@ export declare const liveviewListOutputSchema: {
         isGlobal: z.ZodOptional<z.ZodUnknown>;
         layout: z.ZodOptional<z.ZodUnknown>;
         owner: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-        slots: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        slots: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodObject<{
             cameras: z.ZodOptional<z.ZodUnknown>;
             cycleMode: z.ZodOptional<z.ZodNullable<z.ZodString>>;
             cycleInterval: z.ZodOptional<z.ZodUnknown>;
-        }, z.core.$loose>>>;
+        }, z.core.$loose>>>>;
     }, z.core.$loose>>;
+    totalCount: z.ZodOptional<z.ZodNumber>;
+    offset: z.ZodOptional<z.ZodNumber>;
 };
 export declare const armProfileSchema: z.ZodObject<{
     id: z.ZodOptional<z.ZodString>;
@@ -183,6 +189,8 @@ export declare const armProfileListOutputSchema: {
         createdAt: z.ZodOptional<z.ZodUnknown>;
         updatedAt: z.ZodOptional<z.ZodUnknown>;
     }, z.core.$loose>>;
+    totalCount: z.ZodOptional<z.ZodNumber>;
+    offset: z.ZodOptional<z.ZodNumber>;
 };
 export declare const armProfileOutputSchema: {
     id: z.ZodOptional<z.ZodString>;
@@ -196,21 +204,45 @@ export declare const armProfileOutputSchema: {
     updatedAt: z.ZodOptional<z.ZodUnknown>;
 };
 export declare const fileSchema: z.ZodObject<{
+    id: z.ZodOptional<z.ZodString>;
     name: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     type: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     originalName: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     path: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    size: z.ZodOptional<z.ZodUnknown>;
+    createdAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    updatedAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    metadata: z.ZodOptional<z.ZodUnknown>;
 }, z.core.$loose>;
 export declare const fileListOutputSchema: {
     result: z.ZodArray<z.ZodObject<{
+        id: z.ZodOptional<z.ZodString>;
         name: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         type: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         originalName: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         path: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        size: z.ZodOptional<z.ZodUnknown>;
+        createdAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        updatedAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        metadata: z.ZodOptional<z.ZodUnknown>;
     }, z.core.$loose>>;
+    totalCount: z.ZodOptional<z.ZodNumber>;
+    offset: z.ZodOptional<z.ZodNumber>;
+};
+export declare const fileOutputSchema: {
+    id: z.ZodOptional<z.ZodString>;
+    name: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    type: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    originalName: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    path: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    size: z.ZodOptional<z.ZodUnknown>;
+    createdAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    updatedAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    metadata: z.ZodOptional<z.ZodUnknown>;
 };
 export declare const subscriptionOutputSchema: {
     messages: z.ZodOptional<z.ZodArray<z.ZodUnknown>>;
     duration: z.ZodOptional<z.ZodUnknown>;
     error: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    truncated: z.ZodOptional<z.ZodUnknown>;
 };

package/dist/schemas/misc.js

@@ -1,15 +1,15 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.subscriptionOutputSchema = exports.fileListOutputSchema = exports.fileSchema = exports.armProfileOutputSchema = exports.armProfileListOutputSchema = exports.armProfileSchema = exports.liveviewListOutputSchema = exports.liveviewOutputSchema = exports.liveviewSchema = exports.ulpUserListOutputSchema = exports.ulpUserOutputSchema = exports.ulpUserSchema = exports.userListOutputSchema = exports.userOutputSchema = exports.userSchema = exports.nvrOutputSchema = exports.nvrSchema = exports.infoOutputSchema = void 0;
+exports.subscriptionOutputSchema = exports.fileOutputSchema = exports.fileListOutputSchema = exports.fileSchema = exports.armProfileOutputSchema = exports.armProfileListOutputSchema = exports.armProfileSchema = exports.liveviewListOutputSchema = exports.liveviewOutputSchema = exports.liveviewSchema = exports.ulpUserListOutputSchema = exports.ulpUserOutputSchema = exports.ulpUserSchema = exports.userListOutputSchema = exports.userOutputSchema = exports.userSchema = exports.nvrOutputSchema = exports.nvrSchema = exports.infoOutputSchema = void 0;
 const zod_1 = require("zod");
 const common_js_1 = require("./common.js");
 /**
  * Schemas below are verified against live UniFi Protect Integration API 7.3.47
- * responses (Melrose NVR Pro console, 2026-09-14) where instances exist, and
- * against the 7.3.47 published docs otherwise (arm profiles, files — no
- * instances on the console). The Integration API surface is much thinner than
+ * responses (Melrose NVR Pro console, 2026-09-14) where instances exist —
+ * re-verified live on 7.3.70 (2026-10-12) — and against the 7.3.70 published
+ * docs otherwise (arm profiles, files — no instances on the console). The Integration API surface is much thinner than
  * the internal Protect app API — only observed/documented fields are typed;
- * `.passthrough()` still allows anything extra a firmware/hardware mix adds.
+ * `.loose()` still allows anything extra a firmware/hardware mix adds.
  */
 // --- System ---
 exports.infoOutputSchema = {
@@ -30,7 +30,7 @@ const doorbellSettingsSchema = (0, common_js_1.passthroughObject)({
     defaultMessageText: (0, common_js_1.nullableString)("Default doorbell LCD message"),
     defaultMessageResetTimeoutMs: (0, common_js_1.unknownField)("Reset timeout in ms (number)"),
     customMessages: (0, common_js_1.unknownField)("Configured custom LCD messages (array of strings)"),
-    customImages: (0, common_js_1.unknownField)("Configured custom LCD images (array)"),
+    customImages: (0, common_js_1.unknownField)("Configured custom LCD images (array of objects: preview, sprite)"),
 });
 exports.nvrSchema = (0, common_js_1.passthroughObject)({
     id: (0, common_js_1.idField)("NVR ID"),
@@ -38,8 +38,8 @@ exports.nvrSchema = (0, common_js_1.passthroughObject)({
     name: (0, common_js_1.nullableString)("NVR name"),
     ...(0, common_js_1.hardwareModelFields)(),
     mac: (0, common_js_1.nullableString)("MAC address, added in 7.3.x"),
-    doorbellSettings: doorbellSettingsSchema.optional(),
-    armMode: armModeSchema.optional(),
+    doorbellSettings: doorbellSettingsSchema.nullable().optional(),
+    armMode: armModeSchema.nullable().optional(),
 });
 // Single object — use the shape directly, NOT a list wrapper.
 exports.nvrOutputSchema = { ...exports.nvrSchema.shape };
@@ -62,7 +62,7 @@ exports.ulpUserSchema = (0, common_js_1.passthroughObject)({
     lastName: (0, common_js_1.nullableString)("Last name"),
     fullName: (0, common_js_1.nullableString)("Full name"),
     email: (0, common_js_1.nullableString)("Email address, added in 7.3.x. Empty string for service accounts " +
-        "(verified live 7.3.47)"),
+        "(verified live 7.3.70)"),
     status: (0, common_js_1.nullableString)("Account status, e.g. ACTIVE"),
 });
 exports.ulpUserOutputSchema = { ...exports.ulpUserSchema.shape };
@@ -81,12 +81,12 @@ exports.liveviewSchema = (0, common_js_1.passthroughObject)({
     isGlobal: (0, common_js_1.unknownField)("Whether shared across all users (boolean)"),
     layout: (0, common_js_1.unknownField)("Grid layout / slot count (number)"),
     owner: (0, common_js_1.nullableString)("Owning user ID"),
-    slots: zod_1.z.array(liveviewSlotSchema).optional().describe("Camera slots"),
+    slots: zod_1.z.array(liveviewSlotSchema).nullable().optional().describe("Camera slots"),
 });
 exports.liveviewOutputSchema = { ...exports.liveviewSchema.shape };
 exports.liveviewListOutputSchema = (0, common_js_1.listResultSchema)(exports.liveviewSchema);
 // --- Arm profiles ---
-// Fields from the 7.1.83 docs (no instances on the console to verify live).
+// Fields from the 7.3.70 docs (no instances on the console to verify live).
 // Arm profiles carry no `modelKey`. Nested arrays stay unknownField.
 exports.armProfileSchema = (0, common_js_1.passthroughObject)({
     id: (0, common_js_1.idField)("Arm profile ID"),
@@ -102,21 +102,29 @@ exports.armProfileSchema = (0, common_js_1.passthroughObject)({
 exports.armProfileListOutputSchema = (0, common_js_1.listResultSchema)(exports.armProfileSchema);
 exports.armProfileOutputSchema = { ...exports.armProfileSchema.shape };
 // --- Files ---
-// Device asset files (only fileType=animations supported). Shape from 7.1.83
-// docs: { name, type, originalName, path } — no id/modelKey.
+// Device asset files (only fileType=animations supported). The 7.3.70 docs show
+// { name, type, originalName, path }; live 7.3.70 records (2026-10-12) also
+// carry id (equal to name), size, createdAt, updatedAt and metadata. No modelKey.
 exports.fileSchema = (0, common_js_1.passthroughObject)({
+    id: (0, common_js_1.idField)("File ID (same value as name)"),
     name: (0, common_js_1.nullableString)("Stored file name (server-generated)"),
     type: (0, common_js_1.nullableString)('Asset file type, e.g. "animations"'),
-    originalName: (0, common_js_1.nullableString)("Original uploaded file name"),
+    originalName: (0, common_js_1.nullableString)('Uploaded file name; Protect appends the stored extension, e.g. "welcome.gif.png"'),
     path: (0, common_js_1.nullableString)("Server-side storage path"),
+    size: (0, common_js_1.unknownField)("File size in bytes (number)"),
+    createdAt: (0, common_js_1.nullableString)("Creation time (ISO 8601)"),
+    updatedAt: (0, common_js_1.nullableString)("Last update time (ISO 8601)"),
+    metadata: (0, common_js_1.unknownField)("Asset metadata (object, empty in observed records)"),
 });
 exports.fileListOutputSchema = (0, common_js_1.listResultSchema)(exports.fileSchema);
+exports.fileOutputSchema = { ...exports.fileSchema.shape };
 // --- Subscriptions ---
 exports.subscriptionOutputSchema = {
     messages: zod_1.z
         .array(zod_1.z.unknown())
         .optional()
         .describe("Captured WebSocket messages (add/update/remove or event envelopes)"),
-    duration: (0, common_js_1.unknownField)("Actual listen duration in seconds (number)"),
+    duration: (0, common_js_1.unknownField)("Seconds actually spent listening, to 0.1s (number); shorter than requested when the message cap or an error ends the listen early"),
     error: (0, common_js_1.nullableString)("Connection error, if any"),
+    truncated: (0, common_js_1.unknownField)("true when listening stopped early at the message cap (boolean, absent otherwise)"),
 };

package/dist/schemas/pos.d.ts

@@ -2,7 +2,7 @@
  * Point-of-sale event ingestion, added in UniFi Protect 7.3.x
  * (POST /v1/pos/cameras/{id}/transactions).
  *
- * Shape taken from the 7.3.47 published docs with the response sample expanded
+ * Shape taken from the 7.3.70 published docs with the response sample expanded
  * — there is no POS-capable register on the available console, so this is
  * doc-verified rather than live-verified. `created` stays `unknownField()`
  * because we have not observed the boolean live; `eventId` publishes the string

package/dist/schemas/pos.js

@@ -6,7 +6,7 @@ const common_js_1 = require("./common.js");
  * Point-of-sale event ingestion, added in UniFi Protect 7.3.x
  * (POST /v1/pos/cameras/{id}/transactions).
  *
- * Shape taken from the 7.3.47 published docs with the response sample expanded
+ * Shape taken from the 7.3.70 published docs with the response sample expanded
  * — there is no POS-capable register on the available console, so this is
  * doc-verified rather than live-verified. `created` stays `unknownField()`
  * because we have not observed the boolean live; `eventId` publishes the string

package/dist/tls.d.ts

@@ -0,0 +1,41 @@
+import { X509Certificate } from "node:crypto";
+import { type PeerCertificate } from "node:tls";
+import { type Dispatcher } from "undici";
+/** Every certificate in a PEM bundle. Throws on a malformed certificate block. */
+export declare function pemCertificates(pem: string): X509Certificate[];
+interface TlsSettings {
+    verifySsl: boolean;
+    caCert?: string;
+}
+/**
+ * TLS options for a connection to the console, shared by requests and the
+ * subscription WebSocket. They are scoped to this client, not set in the
+ * process-wide NODE_TLS_REJECT_UNAUTHORIZED, which turned verification off for
+ * every other TLS connection in the process as well.
+ */
+export declare function consoleTlsOptions({ verifySsl, caCert }: TlsSettings): {
+    rejectUnauthorized: boolean;
+    ca?: undefined;
+    allowPartialTrustChain?: undefined;
+    checkServerIdentity?: undefined;
+} | {
+    rejectUnauthorized?: undefined;
+    ca?: undefined;
+    allowPartialTrustChain?: undefined;
+    checkServerIdentity?: undefined;
+} | {
+    rejectUnauthorized?: undefined;
+    ca: string;
+    allowPartialTrustChain: boolean;
+    checkServerIdentity: (host: string, cert: PeerCertificate) => Error | undefined;
+};
+/**
+ * The dispatcher for requests to the console: its TLS settings, and
+ * connections kept open across the gaps between a model's calls instead of
+ * paying a new TLS handshake each time. HTTP/1.1 only, as Node's built-in
+ * fetch speaks, rather than undici's default of offering HTTP/2. With Node's
+ * env proxy turned on, requests go through HTTP_PROXY / HTTPS_PROXY (minus
+ * NO_PROXY) as they did through the built-in fetch.
+ */
+export declare function consoleDispatcher(tls: TlsSettings): Dispatcher;
+export {};

package/dist/tls.js

@@ -0,0 +1,75 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.pemCertificates = pemCertificates;
+exports.consoleTlsOptions = consoleTlsOptions;
+exports.consoleDispatcher = consoleDispatcher;
+const node_crypto_1 = require("node:crypto");
+const node_tls_1 = require("node:tls");
+const undici_1 = require("undici");
+/** Every certificate in a PEM bundle. Throws on a malformed certificate block. */
+function pemCertificates(pem) {
+    const blocks = pem.match(/-----BEGIN CERTIFICATE-----[\s\S]+?-----END CERTIFICATE-----/g) ?? [];
+    return blocks.map((block) => new node_crypto_1.X509Certificate(block));
+}
+/**
+ * TLS options for a connection to the console, shared by requests and the
+ * subscription WebSocket. They are scoped to this client, not set in the
+ * process-wide NODE_TLS_REJECT_UNAUTHORIZED, which turned verification off for
+ * every other TLS connection in the process as well.
+ */
+function consoleTlsOptions({ verifySsl, caCert }) {
+    if (!verifySsl)
+        return { rejectUnauthorized: false };
+    if (caCert === undefined)
+        return {};
+    // A console's self-signed certificate is issued to a name like unifi.local
+    // but reached by IP, so its hostname never matches. Accept the console when
+    // it presents exactly a pinned certificate; any other certificate, such as
+    // one issued by a pinned CA, still has to match the hostname.
+    const pinned = new Set(pemCertificates(caCert).map((cert) => cert.fingerprint256));
+    return {
+        ca: caCert,
+        // `ca` replaces the public roots, and OpenSSL otherwise accepts a chain
+        // only when it ends at a self-signed root. A pinned leaf or intermediate
+        // issued by a CA would then never verify, and checkServerIdentity (which
+        // runs only after the chain has) would never see the pin.
+        allowPartialTrustChain: true,
+        checkServerIdentity: (host, cert) => pinned.has(cert.fingerprint256) ? undefined : (0, node_tls_1.checkServerIdentity)(host, cert),
+    };
+}
+/**
+ * How long an idle connection to the console is kept for the next call, when
+ * the server does not say (a Keep-Alive header's timeout wins). It has to end
+ * before the server's own idle timeout, or a call reuses a socket the server
+ * has just closed and fails with "other side closed"; a write is not retried.
+ * Proxies in front of api.ui.com and consoles commonly close at 60 s (AWS
+ * load balancers) or 75 s (nginx), so this stays well short of both while
+ * still covering the usual gap between a model's calls.
+ */
+const KEEP_ALIVE_MS = 20_000;
+/**
+ * Whether Node routes its own fetch through HTTP_PROXY / HTTPS_PROXY. Node
+ * does so only when asked (NODE_USE_ENV_PROXY=1 or --use-env-proxy), so a
+ * proxy variable set for other tools never captures a local console's traffic.
+ */
+function nodeUsesEnvProxy() {
+    const flag = "--use-env-proxy";
+    return (process.env.NODE_USE_ENV_PROXY === "1" ||
+        process.execArgv.includes(flag) ||
+        (process.env.NODE_OPTIONS ?? "").split(/\s+/).includes(flag));
+}
+/**
+ * The dispatcher for requests to the console: its TLS settings, and
+ * connections kept open across the gaps between a model's calls instead of
+ * paying a new TLS handshake each time. HTTP/1.1 only, as Node's built-in
+ * fetch speaks, rather than undici's default of offering HTTP/2. With Node's
+ * env proxy turned on, requests go through HTTP_PROXY / HTTPS_PROXY (minus
+ * NO_PROXY) as they did through the built-in fetch.
+ */
+function consoleDispatcher(tls) {
+    const connect = consoleTlsOptions(tls);
+    const options = { keepAliveTimeout: KEEP_ALIVE_MS, allowH2: false, connect };
+    return nodeUsesEnvProxy()
+        ? new undici_1.EnvHttpProxyAgent({ ...options, requestTls: { ...connect, allowH2: false } })
+        : new undici_1.Agent(options);
+}

package/dist/tools/alarm-manager.d.ts

@@ -0,0 +1,3 @@
+import type { ToolRegistrar } from "./registrar.js";
+import { ProtectClient } from "../client.js";
+export declare function registerAlarmManagerTools(server: ToolRegistrar, client: ProtectClient, readOnly: boolean): void;

package/dist/tools/alarm-manager.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerAlarmManagerTools = registerAlarmManagerTools;
+const responses_js_1 = require("../utils/responses.js");
+const safety_js_1 = require("../utils/safety.js");
+const url_js_1 = require("../utils/url.js");
+const params_js_1 = require("../utils/params.js");
+// Each gate's confirm input and handler check share one action text.
+const TRIGGER_WEBHOOK = (0, safety_js_1.confirmGate)("trigger the alarm webhook");
+function registerAlarmManagerTools(server, client, readOnly) {
+    if (readOnly)
+        return;
+    server.registerTool("protect_trigger_alarm_webhook", {
+        description: "Trigger an alarm manager webhook by ID. This fires the external alarm action configured for it. Requires confirm: true.",
+        inputSchema: {
+            id: (0, params_js_1.webhookId)()
+                .describe("User-defined webhook ID matching an alarm manager configuration"),
+            confirm: TRIGGER_WEBHOOK.input,
+            dryRun: (0, safety_js_1.dryRunInput)(),
+        },
+        annotations: safety_js_1.DESTRUCTIVE,
+    }, async ({ id, confirm, dryRun }) => {
+        if (dryRun) {
+            return (0, safety_js_1.formatDryRun)("POST", (0, url_js_1.safePath) `/alarm-manager/webhook/${id}`);
+        }
+        const denied = TRIGGER_WEBHOOK.check(confirm);
+        if (denied)
+            return denied;
+        await client.post((0, url_js_1.safePath) `/alarm-manager/webhook/${id}`);
+        return (0, responses_js_1.formatSuccess)({ triggered: true, webhookId: id });
+    });
+}

package/dist/tools/arm-profiles.d.ts

@@ -1,3 +1,9 @@
-import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import type { ToolRegistrar } from "./registrar.js";
 import { ProtectClient } from "../client.js";
-export declare function registerArmProfileTools(server: McpServer, client: ProtectClient, readOnly: boolean): void;
+/**
+ * Arm profile settings that change what the alarm protects, and when: a
+ * longer activationDelay leaves the site unprotected for longer after arming,
+ * and recordEverything decides whether an armed site records at all.
+ */
+export declare const ARM_PROFILE_CONFIRM_FIELDS: readonly ["schedules", "automations", "activationDelay", "recordEverything"];
+export declare function registerArmProfileTools(server: ToolRegistrar, client: ProtectClient, readOnly: boolean): void;