rhombus-node-mcp 0.1.21 → 0.1.23

package/dist/tools/update-tool.js

@@ -1,4 +1,4 @@
-import { updateCameraConfig, getCameraDetails, cleanUpdatePayload, formatCameraSettings, } from "../api/update-tool-api.js";
+import { updateCameraConfig, getCameraDetails, cleanUpdatePayload, formatCameraSettings, validateCameraFeatureSupport, } from "../api/update-tool-api.js";
 import { OUTPUT_SCHEMA, TOOL_ARGS, UpdateCameraConfigPayload, CameraVideoSettings, CameraAudioSettings, CameraDeviceSettings, parseFacetedUuid, } from "../types/update-tool-types.js";
 import { logger } from "../logger.js";
 const TOOL_NAME = "update-tool";
@@ -22,6 +22,9 @@ Future support planned for:
 - Climate sensors
 - Door controllers
 - Environmental gateways
+- Audio gateways
+- Doorbell cameras
+- Badge readers
 
 The tool uses elicitation forms for rich user interaction and shows current settings before updates.
 `;
@@ -84,14 +87,30 @@ const TOOL_HANDLER = async (args, extra) => {
                 }
                 // Validate the full payload
                 const validatedPayload = UpdateCameraConfigPayload.parse(updatePayload);
+                const featureValidation = await validateCameraFeatureSupport(validatedPayload, extra._meta?.requestModifiers, extra.sessionId);
+                if (!featureValidation.canProceed) {
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: featureValidation.error ||
+                                    "This camera does not support one or more requested features.",
+                            },
+                        ],
+                    };
+                }
                 // Apply the updates
                 const result = await updateCameraConfig(validatedPayload, extra._meta?.requestModifiers, extra.sessionId);
                 if (!result.success) {
+                    const hasCapabilitySensitiveChange = hasCapabilitySensitiveSettings(validatedPayload);
+                    const normalizedError = hasCapabilitySensitiveChange
+                        ? "This camera may not support one or more requested settings."
+                        : result.error;
                     return {
                         content: [
                             {
                                 type: "text",
-                                text: `Failed to update camera settings: ${result.error}`,
+                                text: `Failed to update camera settings: ${normalizedError}`,
                             },
                         ],
                     };
@@ -238,6 +257,36 @@ const TOOL_HANDLER = async (args, extra) => {
             ],
         };
     }
+    if (entityType === "audio-gateway") {
+        return {
+            content: [
+                {
+                    type: "text",
+                    text: "Audio gateway updates are not yet fully implemented. Coming soon!",
+                },
+            ],
+        };
+    }
+    if (entityType === "doorbell-camera") {
+        return {
+            content: [
+                {
+                    type: "text",
+                    text: "Doorbell camera updates are not yet fully implemented. Coming soon!",
+                },
+            ],
+        };
+    }
+    if (entityType === "badge-reader") {
+        return {
+            content: [
+                {
+                    type: "text",
+                    text: "Badge reader updates are not yet fully implemented. Coming soon!",
+                },
+            ],
+        };
+    }
     // Step 0: Show initial form (no entityType provided)
     return {
         content: [
@@ -253,6 +302,18 @@ const TOOL_HANDLER = async (args, extra) => {
         ],
     };
 };
+function hasCapabilitySensitiveSettings(payload) {
+    const requestedVideoSettings = Object.values(payload.configUpdate.videoFacetSettings ?? {});
+    const hasCapabilityDependentVideoChange = requestedVideoSettings.some(settings => settings.resolution !== undefined ||
+        settings.hdr_enabled !== undefined ||
+        settings.wdr_enabled !== undefined ||
+        settings.wdr_strength !== undefined);
+    const requestedAudioSettings = Object.values(payload.configUpdate.audioFacetSettings ?? {});
+    const hasCapabilityDependentAudioChange = requestedAudioSettings.some(settings => settings.audio_record !== undefined ||
+        settings.device_mic_enabled !== undefined ||
+        settings.device_speaker_enabled !== undefined);
+    return hasCapabilityDependentVideoChange || hasCapabilityDependentAudioChange;
+}
 export function createTool(server) {
     server.registerTool(TOOL_NAME, {
         description: TOOL_DESCRIPTION,

package/dist/tools/user-access-trail-tool.js

@@ -0,0 +1,64 @@
+import { resolveUserUuid, getAccessEventsByUser, } from "../api/user-access-trail-tool-api.js";
+import { UserAccessTrailRequestType, OUTPUT_SCHEMA, TOOL_ARGS, } from "../types/user-access-trail-tool-types.js";
+import { createToolStructuredContent, extractFromToolExtra } from "../util.js";
+const TOOL_NAME = "user-access-trail-tool";
+const TOOL_DESCRIPTION = `
+This tool traces a specific user's physical access events across all doors and access points. It answers questions like "Where did this person badge in?" or "Show me all access events for this user."
+
+It has the following modes of operation, determined by the "requestType" parameter:
+- ${UserAccessTrailRequestType.GET_ACCESS_EVENTS_BY_USER}: Get access events using a known userUuid. Requires userUuid.
+- ${UserAccessTrailRequestType.GET_ACCESS_EVENTS_BY_EMAIL}: Get access events by looking up the user's email first. Requires email. Automatically resolves the user UUID.
+
+Both modes support optional startTimeMs, endTimeMs, and limit parameters.
+Use the user-tool to find user UUIDs if needed, or use the email-based lookup directly.
+`;
+const TOOL_HANDLER = async (args, _extra) => {
+    const { requestModifiers, sessionId } = extractFromToolExtra(_extra);
+    try {
+        let userUuid;
+        let userName;
+        switch (args.requestType) {
+            case UserAccessTrailRequestType.GET_ACCESS_EVENTS_BY_USER: {
+                if (!args.userUuid) {
+                    return createToolStructuredContent({
+                        error: "userUuid is required for get-access-events-by-user.",
+                    });
+                }
+                userUuid = args.userUuid;
+                break;
+            }
+            case UserAccessTrailRequestType.GET_ACCESS_EVENTS_BY_EMAIL: {
+                if (!args.email) {
+                    return createToolStructuredContent({
+                        error: "email is required for get-access-events-by-email.",
+                    });
+                }
+                const resolved = await resolveUserUuid(args.email, requestModifiers, sessionId);
+                userUuid = resolved.uuid;
+                userName = resolved.name;
+                break;
+            }
+            default:
+                return createToolStructuredContent({ error: "Invalid request type" });
+        }
+        const accessEvents = await getAccessEventsByUser(userUuid, args.startTimeMs ?? undefined, args.endTimeMs ?? undefined, args.limit ?? undefined, requestModifiers, sessionId);
+        return createToolStructuredContent({
+            userUuid,
+            userName,
+            accessEvents,
+        });
+    }
+    catch (error) {
+        if (error instanceof Error) {
+            return createToolStructuredContent({ error: error.message });
+        }
+        return createToolStructuredContent({ error: "Unknown error" });
+    }
+};
+export function createTool(server) {
+    server.registerTool(TOOL_NAME, {
+        description: TOOL_DESCRIPTION,
+        inputSchema: TOOL_ARGS,
+        outputSchema: OUTPUT_SCHEMA.shape,
+    }, TOOL_HANDLER);
+}

package/dist/tools/user-audit-tool.js

@@ -0,0 +1,53 @@
+import { getAuditFeedForPrincipal, getAuditFeedForTarget, } from "../api/user-audit-tool-api.js";
+import { UserAuditRequestType, OUTPUT_SCHEMA, TOOL_ARGS, } from "../types/user-audit-tool-types.js";
+import { createToolStructuredContent, extractFromToolExtra } from "../util.js";
+const TOOL_NAME = "user-audit-tool";
+const TOOL_DESCRIPTION = `
+This tool retrieves configuration audit trails for specific users or specific targets (devices, policies, etc.).
+Unlike the general audit feed, this focuses on a SINGLE user or a SINGLE target entity.
+
+It has the following modes of operation, determined by the "requestType" parameter:
+- ${UserAuditRequestType.AUDIT_BY_USER}: Get all configuration changes made BY a specific user. Requires userUuid (use user-tool to find it). Answers: "What did this admin change recently?"
+- ${UserAuditRequestType.AUDIT_BY_TARGET}: Get all configuration changes made TO a specific entity (camera, door, policy, etc.). Requires targetUuid. Answers: "Who changed the settings on this camera?"
+
+Both modes return audit events with action, display text, who did it, what was changed, and when.
+`;
+const TOOL_HANDLER = async (args, _extra) => {
+    const { requestModifiers, sessionId } = extractFromToolExtra(_extra);
+    try {
+        switch (args.requestType) {
+            case UserAuditRequestType.AUDIT_BY_USER: {
+                if (!args.userUuid) {
+                    return createToolStructuredContent({
+                        error: "userUuid is required for audit-by-user. Use user-tool to find it.",
+                    });
+                }
+                const auditEvents = await getAuditFeedForPrincipal(args.userUuid, args.maxResults ?? undefined, requestModifiers, sessionId);
+                return createToolStructuredContent({ auditEvents });
+            }
+            case UserAuditRequestType.AUDIT_BY_TARGET: {
+                if (!args.targetUuid) {
+                    return createToolStructuredContent({
+                        error: "targetUuid is required for audit-by-target.",
+                    });
+                }
+                const auditEvents = await getAuditFeedForTarget(args.targetUuid, args.maxResults ?? undefined, requestModifiers, sessionId);
+                return createToolStructuredContent({ auditEvents });
+            }
+        }
+    }
+    catch (error) {
+        if (error instanceof Error) {
+            return createToolStructuredContent({ error: error.message });
+        }
+        return createToolStructuredContent({ error: "Unknown error" });
+    }
+    return createToolStructuredContent({ error: "Invalid request type" });
+};
+export function createTool(server) {
+    server.registerTool(TOOL_NAME, {
+        description: TOOL_DESCRIPTION,
+        inputSchema: TOOL_ARGS,
+        outputSchema: OUTPUT_SCHEMA.shape,
+    }, TOOL_HANDLER);
+}

package/dist/tools/user-tool.js

@@ -0,0 +1,55 @@
+import { listUsers, findUserByEmail, getPermissionsForCurrentUser, getPermissionGroups, } from "../api/user-tool-api.js";
+import { UserToolRequestType, OUTPUT_SCHEMA, TOOL_ARGS, } from "../types/user-tool-types.js";
+import { createToolStructuredContent, createToolTextContent, extractFromToolExtra, } from "../util.js";
+const TOOL_NAME = "user-tool";
+const TOOL_DESCRIPTION = `
+This tool manages Rhombus user operations including listing users, finding users by email, and viewing permissions.
+
+It has the following modes of operation, determined by the "requestType" parameter:
+- ${UserToolRequestType.LIST_USERS}: List all users in the organization with their details and roles.
+- ${UserToolRequestType.FIND_BY_EMAIL}: Find a specific user by their email address. Requires the email parameter.
+- ${UserToolRequestType.GET_PERMISSIONS}: Get the permissions for the current API user/token.
+- ${UserToolRequestType.GET_PERMISSION_GROUPS}: List all permission groups defined in the organization.
+
+User UUIDs returned here can be used with the access-control-tool to look up credentials.
+`;
+const TOOL_HANDLER = async (args, _extra) => {
+    const { requestModifiers, sessionId } = extractFromToolExtra(_extra);
+    try {
+        switch (args.requestType) {
+            case UserToolRequestType.LIST_USERS: {
+                const users = await listUsers(requestModifiers, sessionId);
+                return createToolStructuredContent({ users });
+            }
+            case UserToolRequestType.FIND_BY_EMAIL: {
+                if (!args.email) {
+                    return createToolTextContent(JSON.stringify({ error: "email is required for find-by-email." }));
+                }
+                const user = await findUserByEmail(args.email, requestModifiers, sessionId);
+                return createToolStructuredContent({ user });
+            }
+            case UserToolRequestType.GET_PERMISSIONS: {
+                const permissions = await getPermissionsForCurrentUser(requestModifiers, sessionId);
+                return createToolStructuredContent({ permissions });
+            }
+            case UserToolRequestType.GET_PERMISSION_GROUPS: {
+                const permissionGroups = await getPermissionGroups(requestModifiers, sessionId);
+                return createToolStructuredContent({ permissionGroups });
+            }
+        }
+    }
+    catch (error) {
+        if (error instanceof Error) {
+            return createToolStructuredContent({ error: error.message });
+        }
+        return createToolStructuredContent({ error: "Unknown error" });
+    }
+    return createToolStructuredContent({ error: "Invalid request type" });
+};
+export function createTool(server) {
+    server.registerTool(TOOL_NAME, {
+        description: TOOL_DESCRIPTION,
+        inputSchema: TOOL_ARGS,
+        outputSchema: OUTPUT_SCHEMA.shape,
+    }, TOOL_HANDLER);
+}

package/dist/tools/video-walls-tool.js

@@ -0,0 +1,41 @@
+import { getVideoWalls, handleCreateVideoWallRequest, } from "../api/create-tool-api.js";
+import { OUTPUT_SCHEMA, TOOL_ARGS, } from "../types/video-walls-tool-types.js";
+import { createToolStructuredContent, createToolTextContent, extractFromToolExtra, } from "../util.js";
+const TOOL_NAME = "video-walls-tool";
+const TOOL_DESCRIPTION = `
+This tool interacts with Rhombus video walls. Rhombus video walls are a collection of camera feeds combined into a single view,
+allowing users to monitor multiple cameras.
+
+The layout of created video walls is automatically determined by the number of cameras in video wall settings "numVisibleDevicesAtOnce".
+`;
+const TOOL_HANDLER = async (args, extra) => {
+    const { requestType, videoWallCreateOptions } = args;
+    const { requestModifiers, sessionId } = extractFromToolExtra(extra);
+    switch (requestType) {
+        case "create":
+            if (!videoWallCreateOptions) {
+                return createToolTextContent(JSON.stringify({
+                    error: "videoWallCreateOptions is required. Please try again.",
+                }));
+            }
+            return createToolStructuredContent(await handleCreateVideoWallRequest(videoWallCreateOptions, requestModifiers, sessionId));
+        case "list":
+            return createToolStructuredContent(await getVideoWalls(requestModifiers, sessionId));
+        default:
+    }
+    return {
+        content: [
+            {
+                type: "text",
+                text: "Invalid entity type. Please try again.",
+            },
+        ],
+    };
+};
+export function createTool(server) {
+    server.registerTool(TOOL_NAME, {
+        description: TOOL_DESCRIPTION,
+        inputSchema: TOOL_ARGS,
+        outputSchema: OUTPUT_SCHEMA.shape,
+    }, TOOL_HANDLER);
+}

package/dist/transports/streamable-http.js

@@ -7,6 +7,7 @@ import createServer from "../createServer.js";
 import { logger } from "../logger.js";
 var AuthScheme;
 (function (AuthScheme) {
+    AuthScheme["OAUTH"] = "oauth";
     AuthScheme["API_TOKEN"] = "api-token";
     AuthScheme["CHATBOT"] = "chatbot";
     AuthScheme["WEB2"] = "web2";
@@ -27,13 +28,17 @@ export default function streamableHttpTransport() {
      */
     const authRequired = ["tools/call"];
     app.post("/mcp", async (req, res) => {
-        logger.info(`Received MCP request`, JSON.stringify(req.body));
+        logger.info(`Received MCP request`, JSON.stringify(req.body, null, 2));
         // Check for existing session ID
         const sessionId = req.headers["mcp-session-id"];
         let transport;
         if (sessionId && transports.has(sessionId)) {
             // Reuse existing transport
-            transport = transports.get(sessionId);
+            const _transport = transports.get(sessionId);
+            if (!_transport) {
+                throw new Error(`Transport not found for sessionId: ${sessionId}`);
+            }
+            transport = _transport;
         }
         else if (!sessionId && isInitializeRequest(req.body)) {
             // New initialization request
@@ -44,9 +49,17 @@ export default function streamableHttpTransport() {
                     transports.set(sessionId, transport);
                     logger.info(`🔒 MCP request initialized with sessionId: ${sessionId}`);
                     try {
-                        const authScheme = req.headers["x-auth-scheme"] ?? "api-token";
-                        // if api key is provided
-                        if (authScheme === AuthScheme.API_TOKEN) {
+                        const oauthToken = req.headers["x-auth-access-token"];
+                        const authScheme = req.headers["x-auth-scheme"] ?? AuthScheme.API_TOKEN; // otherwise, read 'x-auth-scheme'
+                        // if oauth token is provided
+                        if (oauthToken && typeof oauthToken === "string") {
+                            authStore.set(sessionId, {
+                                oauthToken: oauthToken,
+                                createdMs: Date.now(),
+                            });
+                            logger.info(`🔒 MCP request authenticated with oauth token: ${oauthToken}`);
+                        }
+                        else if (authScheme === AuthScheme.API_TOKEN) {
                             const apiKey = "x-auth-apikey" in req.headers
                                 ? req.headers["x-auth-apikey"]
                                 : process.env.RHOMBUS_API_KEY;
@@ -73,6 +86,7 @@ export default function streamableHttpTransport() {
                         else if (authScheme === AuthScheme.WEB2 && "x-auth-cookie" in req.headers) {
                             authStore.set(sessionId, {
                                 cookie: req.headers["x-auth-cookie"],
+                                sessionAlias: req.headers["x-auth-session-alias"],
                                 createdMs: Date.now(),
                             });
                         }
@@ -85,11 +99,16 @@ export default function streamableHttpTransport() {
                         if (authRequired.includes(req.body.method)) {
                             if (e instanceof Error) {
                                 logger.error(e.message);
+                                res
+                                    .status(401)
+                                    .setHeader("WWW-Authenticate", `Bearer realm="${process.env.REALM}", error="invalid_token", error_description="The access token is missing or invalid"`)
+                                    .send(e.message);
+                                return;
                             }
                             else {
                                 logger.error(e);
+                                throw e;
                             }
-                            throw e;
                         }
                     }
                 },
@@ -122,15 +141,6 @@ export default function streamableHttpTransport() {
             });
             return;
         }
-        // Handle the request
-        // modify request body to include meta
-        // if (req?.body?.params) {
-        //   req.body.params._meta = {
-        //     ...(req.body.params._meta ?? {}),
-        //     foo: "bar",
-        //   };
-        // }
-        // logger.trace("blah blah blah", JSON.stringify(req.body, null, 2));
         await transport.handleRequest(req, res, req.body);
     });
     app.get("/mcp", async (_, res) => {

package/dist/types/access-control-tool-types.js

@@ -0,0 +1,120 @@
+import { z } from "zod";
+import { INCLUDE_FIELDS_ARG, FILTER_BY_ARG } from "../util.js";
+export var AccessControlRequestType;
+(function (AccessControlRequestType) {
+    AccessControlRequestType["UNLOCK_DOOR"] = "unlock-door";
+    AccessControlRequestType["GET_GROUPS"] = "get-groups";
+    AccessControlRequestType["GET_CREDENTIALS_BY_USER"] = "get-credentials-by-user";
+    AccessControlRequestType["GET_LOCKDOWN_PLANS"] = "get-lockdown-plans";
+    AccessControlRequestType["ACTIVATE_LOCKDOWN"] = "activate-lockdown";
+    AccessControlRequestType["DEACTIVATE_LOCKDOWN"] = "deactivate-lockdown";
+    AccessControlRequestType["GET_DOOR_SCHEDULES"] = "get-door-schedules";
+    AccessControlRequestType["GET_ACCESS_GRANTS"] = "get-access-grants";
+    AccessControlRequestType["GET_REMOTE_UNLOCK_USERS"] = "get-remote-unlock-users";
+})(AccessControlRequestType || (AccessControlRequestType = {}));
+export const TOOL_ARGS = {
+    requestType: z.nativeEnum(AccessControlRequestType).describe("The type of access control request to make."),
+    doorUuid: z
+        .string()
+        .nullable()
+        .describe("The UUID of the access controlled door. Required for 'unlock-door'."),
+    userUuid: z
+        .string()
+        .nullable()
+        .describe("The UUID of the user. Required for 'get-credentials-by-user'."),
+    locationUuid: z
+        .string()
+        .nullable()
+        .describe("The UUID of the location. Required for 'activate-lockdown', 'deactivate-lockdown', 'get-door-schedules', and 'get-remote-unlock-users'. Optional for 'get-access-grants' to filter by location."),
+    lockdownPlanUuid: z
+        .string()
+        .nullable()
+        .describe("The UUID of the lockdown plan. Required for 'activate-lockdown' and 'deactivate-lockdown'."),
+    includeFields: INCLUDE_FIELDS_ARG,
+    filterBy: FILTER_BY_ARG,
+};
+const TOOL_ARGS_SCHEMA = z.object(TOOL_ARGS);
+export const OUTPUT_SCHEMA = z.object({
+    unlockResult: z
+        .object({
+        success: z.boolean().optional(),
+        doorUuid: z.string().optional(),
+    })
+        .optional()
+        .describe("Result of unlocking a door"),
+    accessControlGroups: z
+        .array(z.object({
+        uuid: z.string().optional(),
+        name: z.string().optional(),
+        description: z.string().optional(),
+        orgUuid: z.string().optional(),
+        userUuids: z.array(z.string()).optional(),
+    }))
+        .optional()
+        .describe("List of access control groups"),
+    credentials: z
+        .array(z.object({
+        uuid: z.string().optional(),
+        userUuid: z.string().optional(),
+        credentialType: z.string().optional(),
+        status: z.string().optional(),
+        note: z.string().optional(),
+    }))
+        .optional()
+        .describe("List of access control credentials for a user"),
+    lockdownPlans: z
+        .array(z.object({
+        uuid: z.string().optional(),
+        name: z.string().optional(),
+        locationUuid: z.string().optional(),
+        description: z.string().optional(),
+        active: z.boolean().optional(),
+    }))
+        .optional()
+        .describe("List of lockdown plans"),
+    lockdownResult: z
+        .object({
+        success: z.boolean().optional(),
+        locationUuid: z.string().optional(),
+        action: z.string().optional(),
+    })
+        .optional()
+        .describe("Result of activating or deactivating a lockdown"),
+    doorScheduleExceptions: z
+        .array(z.object({
+        uuid: z.string().optional(),
+        name: z.string().optional(),
+        startTime: z.number().optional(),
+        endTime: z.number().optional(),
+        doorUuids: z.array(z.string()).optional(),
+    }))
+        .optional()
+        .describe("Door schedule exceptions"),
+    accessGrants: z
+        .array(z.object({
+        uuid: z.string().optional(),
+        name: z.string().optional(),
+        locationUuid: z.string().optional(),
+        userUuids: z.array(z.string()).optional(),
+        groupUuids: z.array(z.string()).optional(),
+        doorUuids: z.array(z.string()).optional(),
+        scheduleUuid: z.string().optional(),
+    }))
+        .optional()
+        .describe("List of location access grants. Each grant contains userUuids and groupUuids that have access to the doorUuids in the grant."),
+    remoteUnlockUsers: z
+        .object({
+        doors: z.array(z.string()).optional().describe("Names of doors with remote unlock enabled at this location."),
+        totalUsers: z.number().optional().describe("Total number of unique users who can remotely unlock doors."),
+        groups: z.array(z.object({
+            permissionGroup: z.string().optional().describe("Name of the permission group/role."),
+            doors: z.union([z.literal("all"), z.array(z.string())]).optional()
+                .describe("Which doors users in this group can unlock. 'all' means every door at the location."),
+            users: z.array(z.string()).optional()
+                .describe("Users in this group, formatted as 'Name (email)'. Always list ALL users completely."),
+        })).optional(),
+    })
+        .optional()
+        .describe("Users who can remotely unlock doors at a location, grouped by permission group. Always present the COMPLETE list of all users to the end user."),
+    error: z.string().optional().describe("An error message if the request failed."),
+});

package/dist/types/alarm-monitoring-tool-types.js

@@ -0,0 +1,60 @@
+import { z } from "zod";
+import { INCLUDE_FIELDS_ARG, FILTER_BY_ARG } from "../util.js";
+export var AlarmMonitoringRequestType;
+(function (AlarmMonitoringRequestType) {
+    AlarmMonitoringRequestType["ORG_STATUS"] = "org-status";
+    AlarmMonitoringRequestType["GET_THREAT_CASES"] = "get-threat-cases";
+    AlarmMonitoringRequestType["LOCATION_STATUS"] = "location-status";
+})(AlarmMonitoringRequestType || (AlarmMonitoringRequestType = {}));
+export const TOOL_ARGS = {
+    requestType: z
+        .nativeEnum(AlarmMonitoringRequestType)
+        .describe("The type of alarm monitoring request to make."),
+    locationUuid: z
+        .string()
+        .nullable()
+        .describe("Location UUID. Required for 'location-status'."),
+    startTimeMs: z
+        .number()
+        .nullable()
+        .describe("Filter threat cases after this timestamp (ms since epoch). Optional for 'get-threat-cases'."),
+    endTimeMs: z
+        .number()
+        .nullable()
+        .describe("Filter threat cases before this timestamp (ms since epoch). Optional for 'get-threat-cases'."),
+    maxResults: z
+        .number()
+        .nullable()
+        .describe("Maximum number of threat cases to return. Optional for 'get-threat-cases'."),
+    includeFields: INCLUDE_FIELDS_ARG,
+    filterBy: FILTER_BY_ARG,
+};
+const TOOL_ARGS_SCHEMA = z.object(TOOL_ARGS);
+const LocationMonitoringStatusSchema = z.object({
+    locationUuid: z.string().optional(),
+    enabled: z.boolean().optional(),
+    enabledOnMs: z.number().optional(),
+    disabledOnMs: z.number().optional(),
+    notEnabledReason: z.string().optional(),
+});
+const ThreatCaseSchema = z.object({
+    uuid: z.string().optional(),
+    status: z.string().optional(),
+    locationName: z.string().optional(),
+    locationUuid: z.string().optional(),
+    deviceUuid: z.string().optional(),
+    createdAtMillis: z.number().optional(),
+    promptTitle: z.string().optional(),
+});
+export const OUTPUT_SCHEMA = z.object({
+    locationStatuses: z
+        .array(LocationMonitoringStatusSchema)
+        .optional()
+        .describe("Alarm monitoring status for each location"),
+    threatCases: z
+        .array(ThreatCaseSchema)
+        .optional()
+        .describe("List of alarm monitoring threat cases"),
+    locationDetail: LocationMonitoringStatusSchema.optional().describe("Detailed alarm monitoring status for a single location"),
+    error: z.string().optional().describe("An error message if the request failed."),
+});