rhombus-node-mcp 0.1.56 → 0.1.58

package/dist/tools/user-tool.js

@@ -1,4 +1,4 @@
-import { listUsers, findUserByEmail, getPermissionsForCurrentUser, getPermissionGroups, } from "../api/user-tool-api.js";
+import { listUsers, findUserByEmail, getPermissionsForCurrentUser, getPermissionGroups, createUser, updateUser, deleteUser, } from "../api/user-tool-api.js";
 import { UserToolRequestType, OUTPUT_SCHEMA, TOOL_ARGS, } from "../types/user-tool-types.js";
 import { createToolStructuredContent, createToolTextContent, extractFromToolExtra, } from "../util.js";
 const TOOL_NAME = "user-tool";
@@ -10,6 +10,11 @@ It has the following modes of operation, determined by the "requestType" paramet
 - ${UserToolRequestType.FIND_BY_EMAIL}: Find a specific user by their email address. Requires the email parameter.
 - ${UserToolRequestType.GET_PERMISSIONS}: Get the permissions for the current API user/token.
 - ${UserToolRequestType.GET_PERMISSION_GROUPS}: List all permission groups defined in the organization. Each row can be very large — see below.
+- ${UserToolRequestType.CREATE_USER}: Add a user to the organization. Requires userName, email and permissionGroupUuid. Sends them an invitation email unless suppressWelcomeEmail is true.
+- ${UserToolRequestType.UPDATE_USER}: Change a user's name and/or role. Requires userUuid plus userName and/or permissionGroupUuid.
+- ${UserToolRequestType.DELETE_USER}: Remove a user. Requires userUuid and confirmDelete.
+
+Creating a user emails a real person and a role change alters what they can see across the organization, so confirm the name, email address and role NAME with the user before writing. Never guess a userUuid or permissionGroupUuid.
 
 User UUIDs returned here can be used with the access-control-tool to look up credentials.
 
@@ -20,6 +25,11 @@ Each permission group row includes five access maps whose size scales with the o
 - Heavy fields (O(locations) / O(devices) / O(groups) per row): 'permissionGroups.locationAccessMap', 'permissionGroups.accessControlLocationAccessMap', 'permissionGroups.deviceAccessMap', 'permissionGroups.userPermissionGroupAccessMap', 'permissionGroups.locationGranularAccessMap'. Only request these when you specifically need them for a user.
 Typical usage when just picking a role uuid: 'includeFields: ["permissionGroups.uuid", "permissionGroups.name", "permissionGroups.description"]'.
 `;
+/** Users carry firstName/lastName, not a single name field. */
+function displayName(user) {
+    const name = [user.firstName, user.lastName].filter(Boolean).join(" ").trim();
+    return name || undefined;
+}
 const TOOL_HANDLER = async (args, _extra) => {
     const { requestModifiers, sessionId } = extractFromToolExtra(_extra);
     try {
@@ -43,6 +53,94 @@ const TOOL_HANDLER = async (args, _extra) => {
                 const permissionGroups = await getPermissionGroups(requestModifiers, sessionId);
                 return createToolStructuredContent({ permissionGroups });
             }
+            case UserToolRequestType.CREATE_USER: {
+                if (!args.userName?.trim() || !args.email?.trim() || !args.permissionGroupUuid) {
+                    return createToolTextContent("userName, email and permissionGroupUuid are all required for create-user. Get role UUIDs from get-permission-groups.");
+                }
+                // A wrong role here silently over- or under-privileges a real person, so
+                // verify the role exists rather than trusting the uuid.
+                const permissionGroups = await getPermissionGroups(requestModifiers, sessionId);
+                const role = permissionGroups.find(group => group.uuid === args.permissionGroupUuid);
+                if (!role) {
+                    return createToolTextContent(`No permission group in this organization has the uuid "${args.permissionGroupUuid}". Use get-permission-groups to see the roles that exist — do not guess a role uuid, because it decides what the new user can see and do.`);
+                }
+                const existing = await findUserByEmail(args.email.trim(), requestModifiers, sessionId);
+                if (existing?.uuid) {
+                    return createToolStructuredContent({
+                        user: existing,
+                        note: `Nothing was created — ${args.email.trim()} is already a user in this organization (${displayName(existing) ?? "no name"}). Use update-user to change their name or role.`,
+                    });
+                }
+                const created = await createUser({
+                    name: args.userName.trim(),
+                    email: args.email.trim(),
+                    permissionGroupUuid: args.permissionGroupUuid,
+                    suppressWelcomeEmail: args.suppressWelcomeEmail ?? false,
+                }, requestModifiers, sessionId);
+                return createToolStructuredContent({
+                    created,
+                    warningMsg: created.warningMsg,
+                    note: `Created the user "${args.userName.trim()}" (${args.email.trim()}) with the role "${role.name ?? args.permissionGroupUuid}". ${args.suppressWelcomeEmail ? "No invitation email was sent, so they cannot sign in until invited." : "An invitation email has been sent to that address."}`,
+                });
+            }
+            case UserToolRequestType.UPDATE_USER: {
+                if (!args.userUuid) {
+                    return createToolTextContent("userUuid is required for update-user.");
+                }
+                if (!args.userName?.trim() && !args.permissionGroupUuid) {
+                    return createToolTextContent("update-user needs at least one of userName or permissionGroupUuid — both were empty, so there is nothing to change.");
+                }
+                const users = await listUsers(requestModifiers, sessionId);
+                const existing = users.find(user => user.uuid === args.userUuid);
+                if (!existing) {
+                    return createToolTextContent(`No user in this organization has the uuid "${args.userUuid}". Use list-users or find-by-email to find them — do not guess a uuid.`);
+                }
+                let roleName;
+                if (args.permissionGroupUuid) {
+                    const permissionGroups = await getPermissionGroups(requestModifiers, sessionId);
+                    const role = permissionGroups.find(group => group.uuid === args.permissionGroupUuid);
+                    if (!role) {
+                        return createToolTextContent(`No permission group in this organization has the uuid "${args.permissionGroupUuid}". Use get-permission-groups to see the roles that exist.`);
+                    }
+                    roleName = role.name ?? args.permissionGroupUuid;
+                }
+                const updated = await updateUser(args.userUuid, {
+                    name: args.userName?.trim() || undefined,
+                    permissionGroupUuid: args.permissionGroupUuid ?? undefined,
+                }, requestModifiers, sessionId);
+                return createToolStructuredContent({
+                    updated,
+                    warningMsg: updated.warningMsg,
+                    note: roleName
+                        ? `Updated ${displayName(existing) ?? args.userUuid}. Their role is now "${roleName}", which changes what they can see and do across the organization.`
+                        : `Renamed ${displayName(existing) ?? args.userUuid} to "${args.userName?.trim()}". Their role and access are unchanged.`,
+                });
+            }
+            case UserToolRequestType.DELETE_USER: {
+                if (!args.userUuid) {
+                    return createToolTextContent("userUuid is required for delete-user.");
+                }
+                const users = await listUsers(requestModifiers, sessionId);
+                const existing = users.find(user => user.uuid === args.userUuid);
+                if (!existing) {
+                    return createToolTextContent(`No user in this organization has the uuid "${args.userUuid}". Use list-users or find-by-email to find them.`);
+                }
+                if (!args.confirmDelete) {
+                    return createToolStructuredContent({
+                        user: existing,
+                        note: `NOT DELETED — nothing was changed. Deleting ${displayName(existing) ?? args.userUuid} (${existing.email ?? "no email"}) removes their ` +
+                            `console access and their access control credentials, and cannot be undone. If the intent is only to stop their door access, ` +
+                            `access-control-tool's suspend-credential is reversible. To delete the user, confirm with the user and call again with ` +
+                            `confirmDelete: true.`,
+                    });
+                }
+                const deleted = await deleteUser(args.userUuid, requestModifiers, sessionId);
+                return createToolStructuredContent({
+                    deleted,
+                    warningMsg: deleted.warningMsg,
+                    note: `Deleted the user ${displayName(existing) ?? args.userUuid} (${existing.email ?? "no email"}). They can no longer sign in, and their access control credentials no longer work.`,
+                });
+            }
         }
     }
     catch (error) {
@@ -59,6 +157,6 @@ export function createTool(server) {
         description: TOOL_DESCRIPTION,
         inputSchema: TOOL_ARGS,
         outputSchema: OUTPUT_SCHEMA.shape,
-        annotations: { readOnlyHint: true },
+        annotations: { readOnlyHint: false, destructiveHint: true },
     }, TOOL_HANDLER);
 }

package/dist/tools-console/access-anomaly-tool.js

@@ -1,26 +1,9 @@
 import { getAccessAnomalies } from "../api/access-anomaly-tool-api.js";
 import { OUTPUT_SCHEMA, TOOL_ARGS } from "../types/access-anomaly-tool-types.js";
 import { createToolStructuredContent, extractFromToolExtra } from "../util.js";
+import { buildAccessAnomalyToolDescription } from "../types/access-anomaly-tool-types.js";
 const TOOL_NAME = "access-anomaly-tool";
-const TOOL_DESCRIPTION = `
-Scans Honeywell OnGuard (Lenel) access events over a time window and flags anomalous badge activity. Use for
-"find unusual badge activity", "anything suspicious in access this week", or proactive access review.
-
-Runs deterministic rules and returns ranked findings (high severity first):
-- lost_or_inactive_badge: a non-active badge (lost/suspended) was used
-- entry_not_made: access granted but no entry made (possible tailgating)
-- off_hours: entry outside business hours (configurable)
-- impossible_travel: one cardholder at two different areas seconds apart
-- area_novelty: a cardholder's first-ever entry to an area vs their prior history (needs a baseline window)
-
-Each finding includes cardholderName, the rule, severity, datetime, area, the camera deviceUuid, a plain-language
-rationale, and clip/still hints. Resolve relative times (e.g. "this week") to ISO 8601 first via the timestamp tool.
-
-This is a triage aid: present findings grouped by severity, and for the notable ones call the camera-tool
-(requestType "image", cameraUuid = finding.deviceUuid, timestamp = finding.timestampMs) and/or clips-tool
-("createClip" using finding.clipHint) — in PARALLEL — so a human can confirm. Don't assert wrongdoing; surface the
-evidence.
-`;
+const TOOL_DESCRIPTION = buildAccessAnomalyToolDescription("Honeywell OnGuard (Lenel)");
 const TOOL_HANDLER = async (args, _extra) => {
     const { requestModifiers, sessionId } = extractFromToolExtra(_extra);
     try {

package/dist/tools-console/access-control-tool.js

@@ -1,4 +1,4 @@
-import { unlockDoor, getAccessControlGroups, getCredentialsByUser, getLockdownPlans, activateLockdown, deactivateLockdown, getDoorScheduleExceptions, getAccessGrants, getRemoteUnlockUsers, } from "../api/access-control-tool-api.js";
+import { unlockDoor, getAccessControlGroups, createAccessControlGroup, updateAccessControlGroup, deleteAccessControlGroup, changeAccessControlGroupMembers, getCredentialsByUser, assignCredential, changeCredentialState, updateCredentialNote, getLockdownPlans, renameLockdownPlan, deleteLockdownPlan, activateLockdown, deactivateLockdown, getDoorScheduleExceptions, getAccessGrants, writeAccessGrant, deleteAccessGrant, getRemoteUnlockUsers, } from "../api/access-control-tool-api.js";
 import { AccessControlRequestType, OUTPUT_SCHEMA, TOOL_ARGS, } from "../types/access-control-tool-types.js";
 import { createToolStructuredContent, createToolTextContent, extractFromToolExtra, } from "../util.js";
 const TOOL_NAME = "access-control-tool";
@@ -12,13 +12,32 @@ It has the following modes of operation, determined by the "requestType" paramet
 - ${AccessControlRequestType.GET_LOCKDOWN_PLANS}: List all lockdown plans in the organization.
 - ${AccessControlRequestType.ACTIVATE_LOCKDOWN}: Activate a lockdown plan at a location. Requires locationUuid and lockdownPlanUuid.
 - ${AccessControlRequestType.DEACTIVATE_LOCKDOWN}: Deactivate a lockdown plan at a location. Requires locationUuid and lockdownPlanUuid.
-- ${AccessControlRequestType.GET_DOOR_SCHEDULES}: Get door schedule exceptions for a location. Requires locationUuid.
+- ${AccessControlRequestType.GET_DOOR_SCHEDULES}: Get door schedule EXCEPTIONS for a location (despite the name, this does not list schedules). Requires locationUuid. For anything more than a location-scoped list use door-schedule-exception-tool; for the schedules themselves use schedule-tool.
 - ${AccessControlRequestType.GET_ACCESS_GRANTS}: List location access grants (physical badge/card access). Optionally accepts locationUuid to filter by location. Each grant includes userUuids (directly assigned users), groupUuids (assigned access control groups), and doorUuids (the doors this grant provides access to).
 - ${AccessControlRequestType.GET_REMOTE_UNLOCK_USERS}: Get all users who have permission to remotely unlock doors at a location. Requires locationUuid. Returns a list of doors with remote unlock enabled and the users who can unlock each door, based on their permission group roles. This is the correct tool for questions about remote unlock permissions.
 
+Write operations — every one of these changes who can physically open a door:
+- ${AccessControlRequestType.CREATE_GROUP}: Create an access control group. Requires groupName; optionally groupDescription and userUuids.
+- ${AccessControlRequestType.UPDATE_GROUP}: Rename or re-describe a group. Requires groupUuid plus groupName and/or groupDescription.
+- ${AccessControlRequestType.DELETE_GROUP}: Delete a group. Requires groupUuid and confirmDelete.
+- ${AccessControlRequestType.ADD_USERS_TO_GROUP} / ${AccessControlRequestType.REMOVE_USERS_FROM_GROUP}: Change group membership. Requires groupUuid and userUuids.
+- ${AccessControlRequestType.ASSIGN_CREDENTIAL}: Attach an existing unassigned badge/fob to a user. Requires credentialHexValue and userUuid.
+- ${AccessControlRequestType.SUSPEND_CREDENTIAL} / ${AccessControlRequestType.UNSUSPEND_CREDENTIAL}: Temporarily disable / re-enable a credential. Requires credentialUuid. Reversible — prefer this for a lost badge that may turn up.
+- ${AccessControlRequestType.REVOKE_CREDENTIAL}: Detach a credential from its user, keeping the credential record. Requires credentialUuid.
+- ${AccessControlRequestType.DELETE_CREDENTIAL}: Destroy the credential record entirely. Requires credentialUuid and confirmDelete. Not reversible — suspend or revoke instead unless the user asked for permanent deletion.
+- ${AccessControlRequestType.UPDATE_CREDENTIAL_NOTE}: Set a credential's note. Requires credentialUuid and credentialNote.
+- ${AccessControlRequestType.CREATE_ACCESS_GRANT}: Grant access to doors. Requires accessGrantName, locationUuid and doorUuids; optionally userUuids, groupUuids, scheduleUuid.
+- ${AccessControlRequestType.UPDATE_ACCESS_GRANT}: Change a grant. Requires accessGrantUuid. doorUuids / userUuids / groupUuids REPLACE the existing lists when passed.
+- ${AccessControlRequestType.DELETE_ACCESS_GRANT}: Delete a grant, removing that access. Requires accessGrantUuid and confirmDelete.
+- ${AccessControlRequestType.RENAME_LOCKDOWN_PLAN}: Rename a lockdown plan. Requires lockdownPlanUuid and groupName. The plan's door states and activation steps cannot be authored through this tool — that is deliberate, since a wrong door state during a lockdown is a life-safety issue. Direct the user to the Rhombus Console for those.
+- ${AccessControlRequestType.DELETE_LOCKDOWN_PLAN}: Delete a lockdown plan. Requires lockdownPlanUuid and confirmDelete.
+
+Before any write, name the specific people and doors affected and get the user's confirmation. Never guess a user, door, group or credential UUID: a plausible-but-wrong UUID here silently grants or removes physical access, and nothing in the response will reveal it.
+
 Use the get-entity-tool with entityType ACCESS_CONTROL_DOOR to get door UUIDs.
 Use the user-tool to look up user UUIDs and resolve them to names/emails.
 Use the location-tool to get location UUIDs.
+Use the schedule-tool to get schedule UUIDs.
 `;
 const TOOL_HANDLER = async (args, _extra) => {
     const { requestModifiers, sessionId } = extractFromToolExtra(_extra);
@@ -78,6 +97,313 @@ const TOOL_HANDLER = async (args, _extra) => {
                 const remoteUnlockUsers = await getRemoteUnlockUsers(args.locationUuid, requestModifiers, sessionId);
                 return createToolStructuredContent({ remoteUnlockUsers });
             }
+            // ---------------------------------------------------------------------
+            // Access control groups
+            // ---------------------------------------------------------------------
+            case AccessControlRequestType.CREATE_GROUP: {
+                if (!args.groupName?.trim()) {
+                    return createToolTextContent("groupName is required for create-group.");
+                }
+                const created = await createAccessControlGroup(args.groupName.trim(), args.groupDescription ?? undefined, args.userUuids ?? [], requestModifiers, sessionId);
+                return createToolStructuredContent({
+                    created,
+                    note: `Created the access control group "${args.groupName.trim()}" with ${created.memberCount} member(s). A group grants no access on its own — attach it to an access grant with create-access-grant or update-access-grant.`,
+                });
+            }
+            case AccessControlRequestType.UPDATE_GROUP: {
+                if (!args.groupUuid) {
+                    return createToolTextContent("groupUuid is required for update-group.");
+                }
+                if (!args.groupName?.trim() && !args.groupDescription?.trim()) {
+                    return createToolTextContent("update-group needs at least one of groupName or groupDescription — both were empty, so there is nothing to change.");
+                }
+                const groups = await getAccessControlGroups(requestModifiers, sessionId);
+                const existing = groups.find(group => group.uuid === args.groupUuid);
+                if (!existing) {
+                    return createToolTextContent(`No access control group in this organization has the uuid "${args.groupUuid}". Use get-groups to see the groups that exist — do not guess a uuid.`);
+                }
+                const updated = await updateAccessControlGroup(args.groupUuid, {
+                    name: args.groupName?.trim() || existing.name,
+                    description: args.groupDescription?.trim() || existing.description,
+                }, requestModifiers, sessionId);
+                return createToolStructuredContent({
+                    updated,
+                    note: `Updated the access control group "${args.groupName?.trim() || existing.name || args.groupUuid}". Its membership and the access it confers are unchanged.`,
+                });
+            }
+            case AccessControlRequestType.DELETE_GROUP: {
+                if (!args.groupUuid) {
+                    return createToolTextContent("groupUuid is required for delete-group.");
+                }
+                const groups = await getAccessControlGroups(requestModifiers, sessionId);
+                const existing = groups.find(group => group.uuid === args.groupUuid);
+                if (!existing) {
+                    return createToolTextContent(`No access control group in this organization has the uuid "${args.groupUuid}". Use get-groups to see the groups that exist.`);
+                }
+                if (!args.confirmDelete) {
+                    const memberCount = existing.userUuids?.length ?? 0;
+                    return createToolStructuredContent({
+                        accessControlGroups: [existing],
+                        note: `NOT DELETED — nothing was changed. Deleting the group "${existing.name ?? args.groupUuid}" removes it from every access ` +
+                            `grant that uses it, so its ${memberCount} member(s) lose whatever door access the group provided. Tell the user which ` +
+                            `people are affected, then call this tool again with confirmDelete: true.`,
+                    });
+                }
+                const deleted = await deleteAccessControlGroup(args.groupUuid, requestModifiers, sessionId);
+                return createToolStructuredContent({
+                    deleted,
+                    note: `Deleted the access control group "${existing.name ?? args.groupUuid}". Its members lose any door access that came from this group.`,
+                });
+            }
+            case AccessControlRequestType.ADD_USERS_TO_GROUP:
+            case AccessControlRequestType.REMOVE_USERS_FROM_GROUP: {
+                const removing = args.requestType === AccessControlRequestType.REMOVE_USERS_FROM_GROUP;
+                if (!args.groupUuid) {
+                    return createToolTextContent(`groupUuid is required for ${args.requestType}.`);
+                }
+                if (!args.userUuids?.length) {
+                    return createToolTextContent(`userUuids is required for ${args.requestType} and must contain at least one user UUID. Resolve names to UUIDs with user-tool first.`);
+                }
+                const groups = await getAccessControlGroups(requestModifiers, sessionId);
+                const existing = groups.find(group => group.uuid === args.groupUuid);
+                if (!existing) {
+                    return createToolTextContent(`No access control group in this organization has the uuid "${args.groupUuid}". Use get-groups to see the groups that exist.`);
+                }
+                const updated = await changeAccessControlGroupMembers(args.groupUuid, args.userUuids, removing ? "remove" : "add", requestModifiers, sessionId);
+                return createToolStructuredContent({
+                    updated,
+                    note: `${removing ? "Removed" : "Added"} ${updated.userCount} user(s) ${removing ? "from" : "to"} "${existing.name ?? args.groupUuid}". They ${removing ? "lose" : "gain"} every door this group's access grants cover. Confirm the specific people with the user by name.`,
+                });
+            }
+            // ---------------------------------------------------------------------
+            // Credentials
+            // ---------------------------------------------------------------------
+            case AccessControlRequestType.ASSIGN_CREDENTIAL: {
+                if (!args.credentialHexValue?.trim() || !args.userUuid) {
+                    return createToolTextContent("credentialHexValue and userUuid are both required for assign-credential.");
+                }
+                const result = await assignCredential(args.credentialHexValue.trim(), args.userUuid, requestModifiers, sessionId);
+                return createToolStructuredContent({
+                    credentialChange: {
+                        success: result.success,
+                        userUuid: result.userUuid,
+                        action: "assign",
+                    },
+                    warningMsg: result.warningMsg,
+                    note: `Assigned credential ${args.credentialHexValue.trim()} to the user. The credential opens whatever doors that user's access grants cover — confirm the user's name and their access with get-access-grants if it matters.`,
+                });
+            }
+            case AccessControlRequestType.REVOKE_CREDENTIAL:
+            case AccessControlRequestType.SUSPEND_CREDENTIAL:
+            case AccessControlRequestType.UNSUSPEND_CREDENTIAL:
+            case AccessControlRequestType.DELETE_CREDENTIAL: {
+                const action = args.requestType === AccessControlRequestType.REVOKE_CREDENTIAL
+                    ? "revoke"
+                    : args.requestType === AccessControlRequestType.SUSPEND_CREDENTIAL
+                        ? "suspend"
+                        : args.requestType === AccessControlRequestType.UNSUSPEND_CREDENTIAL
+                            ? "unsuspend"
+                            : "delete";
+                if (!args.credentialUuid) {
+                    return createToolTextContent(`credentialUuid is required for ${args.requestType}.`);
+                }
+                if (action === "delete" && !args.confirmDelete) {
+                    return createToolStructuredContent({
+                        note: `NOT DELETED — nothing was changed. Deleting credential ${args.credentialUuid} destroys the record and cannot be undone. ` +
+                            `If the badge is only lost or temporarily out of use, 'suspend-credential' is reversible and usually what is wanted. ` +
+                            `To delete anyway, confirm with the user and call again with confirmDelete: true.`,
+                    });
+                }
+                const result = await changeCredentialState(args.credentialUuid, action, requestModifiers, sessionId);
+                const notes = {
+                    revoke: "Revoked the credential: it is detached from its user and will no longer open any door. The credential record still exists and can be reassigned with assign-credential.",
+                    suspend: "Suspended the credential: it will not open any door until 'unsuspend-credential' is used. It is still assigned to its user.",
+                    unsuspend: "Un-suspended the credential: it opens doors again, per its user's access grants.",
+                    delete: "Deleted the credential record permanently. It cannot be reassigned; a replacement badge has to be added and assigned.",
+                };
+                return createToolStructuredContent({
+                    credentialChange: { success: result.success, uuid: result.uuid, action },
+                    warningMsg: result.warningMsg,
+                    note: notes[action],
+                });
+            }
+            case AccessControlRequestType.UPDATE_CREDENTIAL_NOTE: {
+                if (!args.credentialUuid || args.credentialNote === null) {
+                    return createToolTextContent("credentialUuid and credentialNote are both required for update-credential-note.");
+                }
+                const result = await updateCredentialNote(args.credentialUuid, args.credentialNote, requestModifiers, sessionId);
+                return createToolStructuredContent({
+                    credentialChange: { success: result.success, uuid: result.uuid, action: "update-note" },
+                    warningMsg: result.warningMsg,
+                    note: "Updated the credential's note. This is a label only — it does not change what the credential can open.",
+                });
+            }
+            // ---------------------------------------------------------------------
+            // Location access grants
+            // ---------------------------------------------------------------------
+            case AccessControlRequestType.CREATE_ACCESS_GRANT: {
+                if (!args.accessGrantName?.trim()) {
+                    return createToolTextContent("accessGrantName is required for create-access-grant.");
+                }
+                if (!args.locationUuid) {
+                    return createToolTextContent("locationUuid is required for create-access-grant.");
+                }
+                if (!args.doorUuids?.length) {
+                    return createToolTextContent("doorUuids is required for create-access-grant and must contain at least one door UUID — a grant with no doors gives nobody access. Get UUIDs from get-entity-tool with entityType ACCESS_CONTROL_DOOR.");
+                }
+                if (!args.userUuids?.length && !args.groupUuids?.length) {
+                    return createToolTextContent("create-access-grant needs at least one of userUuids or groupUuids — a grant with no users and no groups gives nobody access.");
+                }
+                const result = await writeAccessGrant({
+                    name: args.accessGrantName.trim(),
+                    locationUuid: args.locationUuid,
+                    accessControlledDoorUuids: args.doorUuids,
+                    userUuids: args.userUuids ?? [],
+                    groupUuids: args.groupUuids ?? [],
+                    scheduleUuid: args.scheduleUuid ?? undefined,
+                }, "create", requestModifiers, sessionId);
+                const unlicensed = [
+                    ...result.expiredACDLicensesDoorUuids,
+                    ...result.unassignedACDLicensesDoorUuids,
+                ];
+                return createToolStructuredContent({
+                    created: { success: result.success, uuid: result.uuid },
+                    doorsWithoutLicense: unlicensed.length > 0 ? unlicensed : undefined,
+                    warningMsg: result.warningMsg,
+                    note: unlicensed.length > 0
+                        ? `Created the access grant "${args.accessGrantName.trim()}" over ${args.doorUuids.length} door(s), BUT ${unlicensed.length} of them has an expired or unassigned access-control license and will grant nobody access until that is fixed: ${unlicensed.join(", ")}. Tell the user this — the grant looks correct otherwise.`
+                        : `Created the access grant "${args.accessGrantName.trim()}" over ${args.doorUuids.length} door(s) for ${args.userUuids?.length ?? 0} user(s) and ${args.groupUuids?.length ?? 0} group(s)${args.scheduleUuid ? ", limited to the given schedule" : ", with no schedule limit — it applies at all times"}.`,
+                });
+            }
+            case AccessControlRequestType.UPDATE_ACCESS_GRANT: {
+                if (!args.accessGrantUuid) {
+                    return createToolTextContent("accessGrantUuid is required for update-access-grant.");
+                }
+                const hasChange = !!args.accessGrantName?.trim() ||
+                    !!args.doorUuids ||
+                    !!args.userUuids ||
+                    !!args.groupUuids ||
+                    !!args.scheduleUuid;
+                if (!hasChange) {
+                    return createToolTextContent("update-access-grant needs at least one of accessGrantName, doorUuids, userUuids, groupUuids or scheduleUuid — all were empty, so there is nothing to change.");
+                }
+                // createAccessGrant/updateAccessGrant both take the WHOLE grant, so a
+                // partial body would blank the lists the caller did not mention.
+                const grants = await getAccessGrants(null, requestModifiers, sessionId);
+                const existing = grants.find(grant => grant.uuid === args.accessGrantUuid);
+                if (!existing) {
+                    return createToolTextContent(`No access grant in this organization has the uuid "${args.accessGrantUuid}". Use get-access-grants to see the grants that exist — do not guess a uuid.`);
+                }
+                const nextDoors = args.doorUuids ?? existing.doorUuids ?? [];
+                const nextUsers = args.userUuids ?? existing.userUuids ?? [];
+                const nextGroups = args.groupUuids ?? existing.groupUuids ?? [];
+                if (nextDoors.length === 0) {
+                    return createToolTextContent("RETRYABLE — nothing was changed. The update would leave the grant with no doors, which gives nobody access. Pass the full set of doors the grant should cover, or use delete-access-grant.");
+                }
+                if (nextUsers.length === 0 && nextGroups.length === 0) {
+                    return createToolTextContent("RETRYABLE — nothing was changed. The update would leave the grant with no users and no groups, which gives nobody access. Pass the full set to keep, or use delete-access-grant.");
+                }
+                const result = await writeAccessGrant({
+                    uuid: args.accessGrantUuid,
+                    name: args.accessGrantName?.trim() || existing.name,
+                    locationUuid: args.locationUuid ?? existing.locationUuid,
+                    accessControlledDoorUuids: nextDoors,
+                    userUuids: nextUsers,
+                    groupUuids: nextGroups,
+                    scheduleUuid: args.scheduleUuid ?? existing.scheduleUuid ?? undefined,
+                }, "update", requestModifiers, sessionId);
+                const removedDoors = (existing.doorUuids ?? []).filter(uuid => !nextDoors.includes(uuid));
+                const removedUsers = (existing.userUuids ?? []).filter(uuid => !nextUsers.includes(uuid));
+                const unlicensed = [
+                    ...result.expiredACDLicensesDoorUuids,
+                    ...result.unassignedACDLicensesDoorUuids,
+                ];
+                const notes = [
+                    `Updated the access grant "${args.accessGrantName?.trim() || existing.name || args.accessGrantUuid}".`,
+                ];
+                if (removedDoors.length > 0) {
+                    notes.push(`ACCESS REMOVED: ${removedDoors.length} door(s) were dropped from the grant (${removedDoors.join(", ")}) — nobody on this grant can open them any more.`);
+                }
+                if (removedUsers.length > 0) {
+                    notes.push(`ACCESS REMOVED: ${removedUsers.length} user(s) were dropped from the grant (${removedUsers.join(", ")}) — they lose the access it provided.`);
+                }
+                if (unlicensed.length > 0) {
+                    notes.push(`${unlicensed.length} door(s) on this grant have an expired or unassigned access-control license and grant nobody access until that is fixed: ${unlicensed.join(", ")}.`);
+                }
+                return createToolStructuredContent({
+                    updated: { success: result.success, uuid: result.uuid },
+                    doorsWithoutLicense: unlicensed.length > 0 ? unlicensed : undefined,
+                    warningMsg: result.warningMsg,
+                    note: notes.join(" "),
+                });
+            }
+            case AccessControlRequestType.DELETE_ACCESS_GRANT: {
+                if (!args.accessGrantUuid) {
+                    return createToolTextContent("accessGrantUuid is required for delete-access-grant.");
+                }
+                const grants = await getAccessGrants(null, requestModifiers, sessionId);
+                const existing = grants.find(grant => grant.uuid === args.accessGrantUuid);
+                if (!existing) {
+                    return createToolTextContent(`No access grant in this organization has the uuid "${args.accessGrantUuid}". Use get-access-grants to see the grants that exist.`);
+                }
+                if (!args.confirmDelete) {
+                    return createToolStructuredContent({
+                        accessGrants: [existing],
+                        note: `NOT DELETED — nothing was changed. Deleting the access grant "${existing.name ?? args.accessGrantUuid}" removes door access ` +
+                            `for ${existing.userUuids?.length ?? 0} directly-assigned user(s) and ${existing.groupUuids?.length ?? 0} group(s) across ` +
+                            `${existing.doorUuids?.length ?? 0} door(s). Resolve those users and doors to names with user-tool and get-entity-tool, tell the ` +
+                            `user exactly who loses access to what, then call this tool again with confirmDelete: true.`,
+                    });
+                }
+                const result = await deleteAccessGrant(args.accessGrantUuid, requestModifiers, sessionId);
+                return createToolStructuredContent({
+                    deleted: { success: result.success, uuid: result.uuid },
+                    warningMsg: result.warningMsg,
+                    note: `Deleted the access grant "${existing.name ?? args.accessGrantUuid}". ${existing.userUuids?.length ?? 0} user(s) and ${existing.groupUuids?.length ?? 0} group(s) no longer have access to its ${existing.doorUuids?.length ?? 0} door(s).`,
+                });
+            }
+            // ---------------------------------------------------------------------
+            // Lockdown plans
+            // ---------------------------------------------------------------------
+            case AccessControlRequestType.RENAME_LOCKDOWN_PLAN: {
+                if (!args.lockdownPlanUuid) {
+                    return createToolTextContent("lockdownPlanUuid is required for rename-lockdown-plan.");
+                }
+                if (!args.groupName?.trim()) {
+                    return createToolTextContent("groupName is required for rename-lockdown-plan — it carries the plan's new name.");
+                }
+                const result = await renameLockdownPlan(args.lockdownPlanUuid, args.groupName.trim(), requestModifiers, sessionId);
+                if (result.missing) {
+                    return createToolTextContent(`No lockdown plan has the uuid "${args.lockdownPlanUuid}". Use get-lockdown-plans to see the plans that exist.`);
+                }
+                return createToolStructuredContent({
+                    updated: { success: result.success, uuid: result.uuid },
+                    note: `Renamed the lockdown plan${result.previousName ? ` "${result.previousName}"` : ""} to "${args.groupName.trim()}". Only the name changed — its door states and activation steps are untouched.`,
+                });
+            }
+            case AccessControlRequestType.DELETE_LOCKDOWN_PLAN: {
+                if (!args.lockdownPlanUuid) {
+                    return createToolTextContent("lockdownPlanUuid is required for delete-lockdown-plan.");
+                }
+                const plans = await getLockdownPlans(requestModifiers, sessionId);
+                const existing = plans.find(plan => plan.uuid === args.lockdownPlanUuid);
+                if (!existing) {
+                    return createToolTextContent(`No lockdown plan has the uuid "${args.lockdownPlanUuid}". Use get-lockdown-plans to see the plans that exist.`);
+                }
+                if (!args.confirmDelete) {
+                    return createToolStructuredContent({
+                        lockdownPlans: [existing],
+                        note: `NOT DELETED — nothing was changed. "${existing.name ?? args.lockdownPlanUuid}" is an emergency lockdown plan: deleting it ` +
+                            `removes the ability to lock down this location, and it cannot be recreated through this tool. This is a life-safety ` +
+                            `configuration — get explicit confirmation from the user, then call again with confirmDelete: true.`,
+                    });
+                }
+                const deleted = await deleteLockdownPlan(args.lockdownPlanUuid, requestModifiers, sessionId);
+                return createToolStructuredContent({
+                    deleted,
+                    note: `Deleted the lockdown plan "${existing.name ?? args.lockdownPlanUuid}". This location can no longer be put into that lockdown. Recreating it requires the Rhombus Console.`,
+                });
+            }
         }
     }
     catch (error) {

package/dist/tools-console/alarm-monitoring-tool.js

@@ -1,4 +1,4 @@
-import { getOrgAlarmStatus, getAlertMonitoringThreatCases, getLocationAlarmStatus, } from "../api/alarm-monitoring-tool-api.js";
+import { getOrgAlarmStatus, getAlertMonitoringThreatCases, getLocationAlarmStatus, setLocationMonitoring, changeThreatCaseState, } from "../api/alarm-monitoring-tool-api.js";
 import { AlarmMonitoringRequestType, OUTPUT_SCHEMA, TOOL_ARGS, } from "../types/alarm-monitoring-tool-types.js";
 import { createToolStructuredContent, extractFromToolExtra } from "../util.js";
 const TOOL_NAME = "alarm-monitoring-tool";
@@ -9,6 +9,12 @@ It has the following modes of operation, determined by the "requestType" paramet
 - ${AlarmMonitoringRequestType.ORG_STATUS}: Get the armed/disarmed alarm monitoring status for ALL locations in the organization in a single call.
 - ${AlarmMonitoringRequestType.GET_THREAT_CASES}: Retrieve alarm monitoring threat cases (security incidents). Supports filtering by time range and max results.
 - ${AlarmMonitoringRequestType.LOCATION_STATUS}: Get detailed alarm monitoring status for a specific location. Requires locationUuid.
+- ${AlarmMonitoringRequestType.ENABLE_MONITORING} / ${AlarmMonitoringRequestType.DISABLE_MONITORING}: Turn alarm monitoring on or off for a location. Requires locationUuid and the location's alarm pin; disabling also requires confirmAction.
+- ${AlarmMonitoringRequestType.DISMISS_THREAT_CASE}: Close a threat case as not requiring action. Requires threatCaseUuid.
+- ${AlarmMonitoringRequestType.CANCEL_THREAT_CASE}: Cancel a threat case so no response is taken. Requires threatCaseUuid.
+- ${AlarmMonitoringRequestType.ESCALATE_THREAT_CASE}: Escalate a threat case to an alarm, triggering a real monitoring response. Requires threatCaseUuid and confirmAction.
+
+These write operations affect whether a real site is being watched and whether responders are dispatched. State plainly what will happen and get the user's confirmation first. Arming and disarming on a schedule is not available here — direct the user to the Rhombus Console for that.
 `;
 const TOOL_HANDLER = async (args, _extra) => {
     const { requestModifiers, sessionId } = extractFromToolExtra(_extra);
@@ -31,6 +37,70 @@ const TOOL_HANDLER = async (args, _extra) => {
                 const locationDetail = await getLocationAlarmStatus(args.locationUuid, requestModifiers, sessionId);
                 return createToolStructuredContent({ locationDetail });
             }
+            case AlarmMonitoringRequestType.ENABLE_MONITORING:
+            case AlarmMonitoringRequestType.DISABLE_MONITORING: {
+                const enabling = args.requestType === AlarmMonitoringRequestType.ENABLE_MONITORING;
+                if (!args.locationUuid) {
+                    return createToolStructuredContent({
+                        error: `locationUuid is required for ${args.requestType}.`,
+                    });
+                }
+                if (!args.pin?.trim()) {
+                    return createToolStructuredContent({
+                        error: `pin is required for ${args.requestType} — this is the location's alarm PIN. Ask the user for it; it cannot be looked up.`,
+                    });
+                }
+                if (!enabling && !args.confirmAction) {
+                    return createToolStructuredContent({
+                        note: "NOTHING WAS CHANGED. Disabling alarm monitoring means this location stops being watched and no threat cases will be raised " +
+                            "for it. Confirm with the user that this is what they want, then call again with confirmAction: true.",
+                    });
+                }
+                const monitoringChange = await setLocationMonitoring(args.locationUuid, args.pin.trim(), enabling, requestModifiers, sessionId);
+                return createToolStructuredContent({
+                    // Deliberately does not echo the PIN.
+                    monitoringChange: {
+                        success: monitoringChange.success,
+                        locationUuid: monitoringChange.locationUuid,
+                        enabled: monitoringChange.enabled,
+                    },
+                    warningMsg: monitoringChange.warningMsg,
+                    note: enabling
+                        ? "Alarm monitoring is now ENABLED for this location — threat cases will be raised again."
+                        : "Alarm monitoring is now DISABLED for this location. It is no longer being watched and no threat cases will be raised until it is re-enabled.",
+                });
+            }
+            case AlarmMonitoringRequestType.DISMISS_THREAT_CASE:
+            case AlarmMonitoringRequestType.CANCEL_THREAT_CASE:
+            case AlarmMonitoringRequestType.ESCALATE_THREAT_CASE: {
+                const action = args.requestType === AlarmMonitoringRequestType.DISMISS_THREAT_CASE
+                    ? "dismiss"
+                    : args.requestType === AlarmMonitoringRequestType.CANCEL_THREAT_CASE
+                        ? "cancel"
+                        : "escalate";
+                if (!args.threatCaseUuid) {
+                    return createToolStructuredContent({
+                        error: `threatCaseUuid is required for ${args.requestType}.`,
+                    });
+                }
+                if (action === "escalate" && !args.confirmAction) {
+                    return createToolStructuredContent({
+                        note: "NOTHING WAS CHANGED. Escalating a threat case to an alarm dispatches a real monitoring response and can result in " +
+                            "responders being sent. Confirm with the user that they want to escalate, then call again with confirmAction: true.",
+                    });
+                }
+                const threatCaseChange = await changeThreatCaseState(args.threatCaseUuid, action, requestModifiers, sessionId);
+                const notes = {
+                    dismiss: "Dismissed the threat case. It is closed as not requiring action and will no longer appear as open.",
+                    cancel: "Cancelled the threat case. No monitoring response will be taken on it.",
+                    escalate: "Escalated the threat case to an alarm. A monitoring response has been triggered.",
+                };
+                return createToolStructuredContent({
+                    threatCaseChange,
+                    warningMsg: threatCaseChange.warningMsg,
+                    note: notes[action],
+                });
+            }
         }
     }
     catch (error) {
@@ -47,6 +117,6 @@ export function createTool(server) {
         description: TOOL_DESCRIPTION,
         inputSchema: TOOL_ARGS,
         outputSchema: OUTPUT_SCHEMA.shape,
-        annotations: { readOnlyHint: true },
+        annotations: { readOnlyHint: false, destructiveHint: true },
     }, TOOL_HANDLER);
 }

package/dist/tools-console/analytics-tool.js

@@ -1,7 +1,7 @@
 import { getCountReportsForDevicesAtLocation, getRunningAverage, getLineCrossingEnabledCameras, getBatchThresholdCrossingCountReport, getSummaryCountReport, triggerScenePrompt, } from "../api/report-tool-api.js";
 import { AnalyticsRequestType, OUTPUT_SCHEMA, TOOL_ARGS, } from "../types/analytics-tool-types.js";
 import { createToolStructuredContent, extractFromToolExtra } from "../util.js";
-import { postApi } from "../network/network.js";
+import { cachedPostApi } from "../network/org-reference-cache.js";
 import { DateTime } from "luxon";
 const TOOL_NAME = "analytics-tool";
 const TOOL_DESCRIPTION = `
@@ -332,7 +332,7 @@ async function handleLocationSummary(args, requestModifiers, sessionId) {
 }
 async function getCameraNameMap(locationUuid, requestModifiers, sessionId) {
     try {
-        const res = await postApi({
+        const res = await cachedPostApi({
             route: "/camera/getMinimalCameraStateList",
             body: {},
             modifiers: requestModifiers,