@usex/mikrotik-mcp 3.24.0 → 3.26.0

package/dist/index.js

@@ -1766,6 +1766,11 @@ var UI_VIEWS = [
     id: "connected-devices",
     name: "MikroTik Connected Devices",
     description: "Devices on the network with per-device Download/Upload charts, uptime/status, and one-click " + "block/allow and pin-IP."
+  },
+  {
+    id: "aaa",
+    name: "MikroTik RADIUS & User Manager",
+    description: "Full RADIUS client + built-in User Manager RADIUS server management: servers, users, " + "profiles, limitations, NAS clients, assignments, sessions and settings, with add/edit/remove."
   }
 ];
 function placeholderHtml(view) {
@@ -2070,18 +2075,54 @@ async function fetchDevices(ctx) {
 async function sampleDeviceTraffic(ctx, ip) {
   const q = await executeMikrotikCommand(`/queue simple print stats detail where target~"${ip}"`, ctx);
   if (isEmpty(q) || looksLikeError(q)) {
-    return { ip, source: "none", rxBitsPerSec: 0, txBitsPerSec: 0, rxBytes: 0, txBytes: 0 };
+    return {
+      ip,
+      source: "none",
+      rxBitsPerSec: 0,
+      txBitsPerSec: 0,
+      rxBytes: 0,
+      txBytes: 0,
+      downloadLimit: "",
+      uploadLimit: ""
+    };
   }
   const row = parseRecords(q).rows[0] ?? {};
   const [up, down] = (row.rate ?? "0/0").split("/");
   const [upB, downB] = (row.bytes ?? "0/0").split("/");
+  const [upLim, downLim] = (row["max-limit"] ?? "0/0").split("/");
+  const limit = (v) => v && v !== "0" ? v : "";
   return {
     ip,
     source: "queue",
     txBitsPerSec: parseLeadingNumber(up) ?? 0,
     rxBitsPerSec: parseLeadingNumber(down) ?? 0,
     txBytes: parseLeadingNumber(upB) ?? 0,
-    rxBytes: parseLeadingNumber(downB) ?? 0
+    rxBytes: parseLeadingNumber(downB) ?? 0,
+    downloadLimit: limit(downLim),
+    uploadLimit: limit(upLim)
+  };
+}
+async function setDeviceLimits(ctx, ip, opts) {
+  const rate = (v) => {
+    const t = (v ?? "").trim();
+    return t === "" ? "0" : t;
+  };
+  const down = rate(opts.download);
+  const up = rate(opts.upload);
+  const maxLimit = `${up}/${down}`;
+  const existing = await executeMikrotikCommand(`/queue simple print count-only where target~"${ip}"`, ctx);
+  const have = (parseLeadingNumber(existing.trim()) ?? 0) > 0;
+  if (!have && down === "0" && up === "0") {
+    return { ok: true, message: `No rate limit set for ${ip} (left unlimited).` };
+  }
+  const cmd = have ? new Cmd(`/queue simple set [find target~"${ip}"]`).set("max-limit", maxLimit).build() : new Cmd("/queue simple add").set("name", opts.name?.trim() || `client-${ip}`).set("target", ip).set("max-limit", maxLimit).build();
+  const out = await executeMikrotikCommand(cmd, ctx);
+  if (looksLikeError(out))
+    return { ok: false, message: `Failed to set limits: ${out}` };
+  const human = (r) => r === "0" ? "unlimited" : r;
+  return {
+    ok: true,
+    message: `Limits for ${ip} set \u2014 \u2193 ${human(down)} / \u2191 ${human(up)}.`
   };
 }
 async function blockRuleCount(mac, ctx) {
@@ -2304,6 +2345,25 @@ ${isEmpty(arp) ? "(no arp entry)" : arp}`;
       return (await setDeviceLabel(ctx, a.mac, a.label)).message;
     }
   }),
+  defineTool({
+    name: "set_device_limits",
+    title: "Set a Device's Download/Upload Rate Limits",
+    annotations: WRITE_IDEMPOTENT,
+    description: "Throttle (or unthrottle) a device's bandwidth by managing a `/queue simple` targeting its IP " + "\u2014 sets the max download and upload rate. RouterOS rate strings: e.g. `10M`, `512k`; pass `0` " + "or omit a side to leave it unlimited. Updates the device's existing simple queue if there is " + "one, otherwise creates it (which also enables the per-device traffic counter the Connected " + "Devices charts read). Identify the device by IP (the queue target).",
+    inputSchema: {
+      ip: z5.string().describe("Device IP address (the queue target)"),
+      download_limit: z5.string().optional().describe('Max download rate, e.g. "10M". "0"/omit = unlimited'),
+      upload_limit: z5.string().optional().describe('Max upload rate, e.g. "2M". "0"/omit = unlimited'),
+      name: z5.string().optional().describe("Optional name for a newly created queue")
+    },
+    async handler(a, ctx) {
+      return (await setDeviceLimits(ctx, a.ip, {
+        download: a.download_limit,
+        upload: a.upload_limit,
+        name: a.name
+      })).message;
+    }
+  }),
   defineTool({
     name: "block_device",
     title: "Block a Device (Deny Network Access)",
@@ -15855,8 +15915,407 @@ ${details}`;
   })
 ];
 
-// src/tools/radius.ts
+// src/tools/aaa-view.ts
 import { z as z77 } from "zod";
+
+// src/tools/aaa-data.ts
+var UM_NOT_AVAILABLE = "User Manager is not available on this device (the user-manager package is not installed).";
+var SECRET_KEYS = new Set(["secret", "password", "shared-secret", "otp-secret"]);
+var REDACTED2 = "\u2022\u2022\u2022\u2022\u2022\u2022";
+var RADIUS_FIELDS = [
+  "address",
+  "secret",
+  "service",
+  "authentication-port",
+  "accounting-port",
+  "timeout",
+  "src-address",
+  "realm",
+  "called-id",
+  "domain",
+  "protocol",
+  "certificate",
+  "accounting-backup",
+  "comment",
+  "disabled"
+];
+var UM_USER_FIELDS = [
+  "name",
+  "password",
+  "group",
+  "shared-users",
+  "attributes",
+  "caller-id",
+  "otp-secret",
+  "comment",
+  "disabled"
+];
+var UM_PROFILE_FIELDS = [
+  "name",
+  "name-for-users",
+  "validity",
+  "price",
+  "starts-when",
+  "override-shared-users",
+  "comment"
+];
+var UM_ROUTER_FIELDS = [
+  "name",
+  "address",
+  "shared-secret",
+  "coa-port",
+  "protocol",
+  "comment",
+  "disabled"
+];
+var UM_LIMITATION_FIELDS = [
+  "name",
+  "rate-limit-rx",
+  "rate-limit-tx",
+  "rate-limit-min-rx",
+  "rate-limit-min-tx",
+  "rate-limit-burst-rx",
+  "rate-limit-burst-tx",
+  "rate-limit-burst-threshold-rx",
+  "rate-limit-burst-threshold-tx",
+  "rate-limit-burst-time-rx",
+  "rate-limit-burst-time-tx",
+  "rate-limit-priority",
+  "download-limit",
+  "upload-limit",
+  "transfer-limit",
+  "uptime-limit",
+  "reset-counters-interval",
+  "reset-counters-start-time",
+  "comment"
+];
+var AAA_ENTITIES = {
+  radius: { menu: "radius", key: ".id", fields: RADIUS_FIELDS, toggle: true },
+  "um-users": {
+    menu: "user-manager user",
+    key: "name",
+    fields: UM_USER_FIELDS,
+    toggle: true,
+    um: true
+  },
+  "um-profiles": { menu: "user-manager profile", key: "name", fields: UM_PROFILE_FIELDS, um: true },
+  "um-user-profiles": {
+    menu: "user-manager user-profile",
+    key: ".id",
+    fields: ["user", "profile"],
+    um: true
+  },
+  "um-routers": {
+    menu: "user-manager router",
+    key: "name",
+    fields: UM_ROUTER_FIELDS,
+    toggle: true,
+    um: true
+  },
+  "um-limitations": {
+    menu: "user-manager limitation",
+    key: "name",
+    fields: UM_LIMITATION_FIELDS,
+    um: true
+  },
+  "um-sessions": { menu: "user-manager session", key: ".id", fields: [], readonly: true, um: true }
+};
+function redactRow(r) {
+  const out = {};
+  for (const [k, v] of Object.entries(r))
+    out[k] = SECRET_KEYS.has(k) && v ? REDACTED2 : v;
+  return out;
+}
+async function idsFor(menu, ctx) {
+  const out = await executeMikrotikCommand(`:put [/${menu} find]`, ctx);
+  if (looksLikeError(out) || commandUnsupported(out))
+    return [];
+  return out.trim().split(/[;\s]+/).filter(Boolean);
+}
+function findClause(entity, id) {
+  return `[find ${entity.key}=${quoteValue(id)}]`;
+}
+function entityFor(slug) {
+  const e = AAA_ENTITIES[slug];
+  if (!e)
+    throw new Error(`Unknown AAA entity '${slug}'.`);
+  return e;
+}
+async function listAaaEntity(ctx, slug) {
+  const entity = entityFor(slug);
+  const out = await executeMikrotikCommand(`/${entity.menu} print detail`, ctx);
+  if (commandUnsupported(out))
+    return { available: false, rows: [] };
+  if (isEmpty(out) || looksLikeError(out))
+    return { available: true, rows: [] };
+  const rows = parseRecords(out).rows;
+  const ids = await idsFor(entity.menu, ctx);
+  return {
+    available: true,
+    rows: rows.map((r, i) => redactRow({ ...r, ".id": r[".id"] ?? ids[i] ?? "" }))
+  };
+}
+function pickFields(entity, fields) {
+  return entity.fields.filter((k) => fields[k] !== undefined && fields[k] !== "").map((k) => [k, fields[k]]);
+}
+function applyFields(cmd, pairs) {
+  for (const [k, v] of pairs)
+    cmd.set(k, v);
+  return cmd;
+}
+async function addAaaEntity(ctx, slug, fields) {
+  const entity = entityFor(slug);
+  if (entity.readonly)
+    return { ok: false, message: `${slug} is read-only.` };
+  const pairs = pickFields(entity, fields);
+  if (pairs.length === 0)
+    return { ok: false, message: "No fields supplied." };
+  const cmd = applyFields(new Cmd(`/${entity.menu} add`), pairs).build();
+  const out = await executeMikrotikCommand(cmd, ctx);
+  if (commandUnsupported(out))
+    return { ok: false, message: UM_NOT_AVAILABLE };
+  if (looksLikeError(out))
+    return { ok: false, message: out.trim() };
+  return { ok: true, message: "Created." };
+}
+async function updateAaaEntity(ctx, slug, id, fields) {
+  const entity = entityFor(slug);
+  if (entity.readonly)
+    return { ok: false, message: `${slug} is read-only.` };
+  const pairs = pickFields(entity, fields);
+  if (pairs.length === 0)
+    return { ok: false, message: "No updates supplied." };
+  const cmd = applyFields(new Cmd(`/${entity.menu} set ${findClause(entity, id)}`), pairs).build();
+  const out = await executeMikrotikCommand(cmd, ctx);
+  if (commandUnsupported(out))
+    return { ok: false, message: UM_NOT_AVAILABLE };
+  if (looksLikeError(out))
+    return { ok: false, message: out.trim() };
+  return { ok: true, message: "Updated." };
+}
+async function removeAaaEntity(ctx, slug, id) {
+  const entity = entityFor(slug);
+  if (entity.readonly)
+    return { ok: false, message: `${slug} is read-only.` };
+  const count = await executeMikrotikCommand(`/${entity.menu} print count-only where ${entity.key}=${quoteValue(id)}`, ctx);
+  if (commandUnsupported(count))
+    return { ok: false, message: UM_NOT_AVAILABLE };
+  if (count.trim() === "0")
+    return { ok: false, message: `${slug} '${id}' not found.` };
+  const out = await executeMikrotikCommand(`/${entity.menu} remove ${findClause(entity, id)}`, ctx);
+  if (looksLikeError(out))
+    return { ok: false, message: out.trim() };
+  return { ok: true, message: "Removed." };
+}
+async function toggleAaaEntity(ctx, slug, id, enable) {
+  const entity = entityFor(slug);
+  if (!entity.toggle)
+    return { ok: false, message: `${slug} cannot be enabled/disabled.` };
+  const cmd = new Cmd(`/${entity.menu} set ${findClause(entity, id)}`).set("disabled", enable ? "no" : "yes").build();
+  const out = await executeMikrotikCommand(cmd, ctx);
+  if (commandUnsupported(out))
+    return { ok: false, message: UM_NOT_AVAILABLE };
+  if (looksLikeError(out))
+    return { ok: false, message: out.trim() };
+  return { ok: true, message: enable ? "Enabled." : "Disabled." };
+}
+function parseSingleton(out) {
+  const rows = parseRecords(out).rows;
+  return redactRow(rows[0] ?? {});
+}
+async function getRadiusIncoming(ctx) {
+  const out = await executeMikrotikCommand("/radius incoming print", ctx);
+  return looksLikeError(out) ? {} : parseSingleton(out);
+}
+async function setRadiusIncoming(ctx, fields) {
+  const cmd = new Cmd("/radius incoming set");
+  if (fields.accept !== undefined && fields.accept !== "")
+    cmd.set("accept", fields.accept);
+  if (fields.port !== undefined && fields.port !== "")
+    cmd.set("port", fields.port);
+  const built = cmd.build();
+  if (!built.includes("="))
+    return { ok: false, message: "No updates supplied." };
+  const out = await executeMikrotikCommand(built, ctx);
+  if (looksLikeError(out))
+    return { ok: false, message: out.trim() };
+  return { ok: true, message: "RADIUS incoming (CoA) updated." };
+}
+async function resetRadiusCounters(ctx) {
+  const out = await executeMikrotikCommand("/radius reset-counters", ctx);
+  if (looksLikeError(out))
+    return { ok: false, message: out.trim() };
+  return { ok: true, message: "RADIUS counters reset." };
+}
+async function getUmSettings(ctx) {
+  const out = await executeMikrotikCommand("/user-manager print", ctx);
+  if (commandUnsupported(out))
+    return { available: false, settings: {} };
+  return { available: true, settings: looksLikeError(out) ? {} : parseSingleton(out) };
+}
+var UM_SETTINGS_FIELDS = [
+  "enabled",
+  "certificate",
+  "radsec-certificate",
+  "accounting-port",
+  "authentication-port",
+  "use-profiles"
+];
+async function setUmSettings(ctx, fields) {
+  const cmd = new Cmd("/user-manager set");
+  let any = false;
+  for (const k of UM_SETTINGS_FIELDS) {
+    if (fields[k] !== undefined && fields[k] !== "") {
+      cmd.set(k, fields[k]);
+      any = true;
+    }
+  }
+  if (!any)
+    return { ok: false, message: "No updates supplied." };
+  const out = await executeMikrotikCommand(cmd.build(), ctx);
+  if (commandUnsupported(out))
+    return { ok: false, message: UM_NOT_AVAILABLE };
+  if (looksLikeError(out))
+    return { ok: false, message: out.trim() };
+  return { ok: true, message: "User Manager settings updated." };
+}
+
+// src/tools/aaa-view.ts
+var SLUGS = Object.keys(AAA_ENTITIES);
+var AAA_UI = {
+  resourceUri: uiViewUri("aaa"),
+  visibility: ["model", "app"]
+};
+var APP_ONLY = { resourceUri: uiViewUri("aaa"), visibility: ["app"] };
+function sectionView(slug, list) {
+  return {
+    __mikrotikView: "aaa-section",
+    slug,
+    available: list.available,
+    rows: list.rows,
+    generatedAt: new Date().toISOString()
+  };
+}
+function summarize(slug, list) {
+  if (!list.available)
+    return `User Manager is not installed on this device (section '${slug}').`;
+  return `${slug}: ${list.rows.length} row(s).`;
+}
+var aaaViewTools = [
+  defineTool({
+    name: "manage_radius_user_manager",
+    title: "Manage RADIUS & User Manager (Dashboard)",
+    annotations: READ,
+    ui: { ...AAA_UI },
+    description: "Opens the interactive RADIUS & User Manager management dashboard \u2014 a single view to manage" + " the router's RADIUS client (`/radius`) and the built-in User Manager RADIUS server" + " (`/user-manager`). Tabs cover RADIUS servers, User Manager users, service profiles," + " rate/quota limitations, NAS clients (routers), profile assignments, accounting sessions," + " and global/CoA settings, each with full add/edit/enable-disable/remove. `section` picks the" + " tab to open first. For one-off scripted changes the granular tools (add_radius_server," + " add_user_manager_user, \u2026) still apply.",
+    inputSchema: {
+      section: z77.enum(SLUGS).optional().describe("Which section/tab to open first (default 'radius')")
+    },
+    async handler(a, ctx) {
+      const slug = a.section ?? "radius";
+      ctx.info(`Opening AAA dashboard: ${slug}`);
+      const list = await listAaaEntity(ctx, slug);
+      return { text: summarize(slug, list), structuredContent: sectionView(slug, list) };
+    }
+  }),
+  defineTool({
+    name: "get_aaa_section",
+    title: "Get AAA Section (Dashboard)",
+    annotations: READ,
+    ui: { ...APP_ONLY },
+    description: "App-only helper for the RADIUS & User Manager dashboard: returns the rows of one section" + " (radius, um-users, um-profiles, um-limitations, um-routers, um-user-profiles, um-sessions)" + " as structured records with a stable id and secrets redacted, so the view can render and" + " refresh its table.",
+    inputSchema: { slug: z77.enum(SLUGS) },
+    async handler(a, ctx) {
+      const list = await listAaaEntity(ctx, a.slug);
+      return { text: summarize(a.slug, list), structuredContent: sectionView(a.slug, list) };
+    }
+  }),
+  defineTool({
+    name: "aaa_mutate",
+    title: "Mutate AAA Row (Dashboard)",
+    annotations: WRITE,
+    ui: { ...APP_ONLY },
+    description: "App-only helper for the RADIUS & User Manager dashboard: performs one create/update/remove/" + "toggle on a section row through the shared whitelist-guarded data layer, then returns the" + " refreshed section so the view can adopt it. `op` is add|update|remove|toggle; `slug` is the" + " section; `id` is the row's stable identifier (RouterOS .id or name); `fields` carries the" + " RouterOS attribute values for add/update; `enable` is the target state for toggle.",
+    inputSchema: {
+      op: z77.enum(["add", "update", "remove", "toggle"]),
+      slug: z77.enum(SLUGS),
+      id: z77.string().optional().describe("Row stable id (.id or name) for update/remove/toggle"),
+      enable: z77.boolean().optional().describe("Target enabled state for op=toggle"),
+      fields: z77.record(z77.string(), z77.string()).optional().describe("RouterOS attribute=value pairs for add/update")
+    },
+    async handler(a, ctx) {
+      const fields = a.fields ?? {};
+      let result;
+      if (a.op === "add")
+        result = await addAaaEntity(ctx, a.slug, fields);
+      else if (a.op === "update")
+        result = a.id ? await updateAaaEntity(ctx, a.slug, a.id, fields) : { ok: false, message: "id required" };
+      else if (a.op === "remove")
+        result = a.id ? await removeAaaEntity(ctx, a.slug, a.id) : { ok: false, message: "id required" };
+      else
+        result = a.id ? await toggleAaaEntity(ctx, a.slug, a.id, a.enable === true) : { ok: false, message: "id required" };
+      const list = await listAaaEntity(ctx, a.slug);
+      return {
+        text: `${result.ok ? "OK" : "Failed"}: ${result.message}`,
+        structuredContent: { ...sectionView(a.slug, list), lastOp: result }
+      };
+    }
+  }),
+  defineTool({
+    name: "get_aaa_settings",
+    title: "Get AAA Settings (Dashboard)",
+    annotations: READ,
+    ui: { ...APP_ONLY },
+    description: "App-only helper for the RADIUS & User Manager dashboard: returns the singleton settings \u2014" + " RADIUS incoming/CoA listener (`/radius incoming`) and User Manager global settings" + " (`/user-manager`) \u2014 for the Settings tab.",
+    async handler(_a, ctx) {
+      const [radiusIncoming, um] = await Promise.all([getRadiusIncoming(ctx), getUmSettings(ctx)]);
+      return {
+        text: "AAA settings loaded.",
+        structuredContent: {
+          __mikrotikView: "aaa-settings",
+          radiusIncoming,
+          umAvailable: um.available,
+          umSettings: um.settings
+        }
+      };
+    }
+  }),
+  defineTool({
+    name: "set_aaa_settings",
+    title: "Set AAA Settings (Dashboard)",
+    annotations: WRITE,
+    ui: { ...APP_ONLY },
+    description: "App-only helper for the RADIUS & User Manager dashboard: writes a singleton setting and" + " returns the refreshed settings. `target` is radius-incoming (CoA accept/port), um-settings" + " (enabled, use-profiles, certificate, ports) or radius-reset-counters; `fields` carries the" + " RouterOS attribute values.",
+    inputSchema: {
+      target: z77.enum(["radius-incoming", "um-settings", "radius-reset-counters"]),
+      fields: z77.record(z77.string(), z77.string()).optional()
+    },
+    async handler(a, ctx) {
+      const fields = a.fields ?? {};
+      let result;
+      if (a.target === "radius-incoming")
+        result = await setRadiusIncoming(ctx, fields);
+      else if (a.target === "um-settings")
+        result = await setUmSettings(ctx, fields);
+      else
+        result = await resetRadiusCounters(ctx);
+      const [radiusIncoming, um] = await Promise.all([getRadiusIncoming(ctx), getUmSettings(ctx)]);
+      return {
+        text: `${result.ok ? "OK" : "Failed"}: ${result.message}`,
+        structuredContent: {
+          __mikrotikView: "aaa-settings",
+          radiusIncoming,
+          umAvailable: um.available,
+          umSettings: um.settings,
+          lastOp: result
+        }
+      };
+    }
+  })
+];
+
+// src/tools/radius.ts
+import { z as z78 } from "zod";
 var radiusTools = [
   defineTool({
     name: "add_radius_server",
@@ -15864,21 +16323,21 @@ var radiusTools = [
     annotations: WRITE,
     description: "Adds a RADIUS server entry (`/radius add`) \u2014 configures the router as a RADIUS client" + " that authenticates PPP users, hotspot clients, wireless stations, DHCP leases, login" + " sessions, IPsec peers, or dot1x supplicants against an external RADIUS server." + " For listing existing entries use `list_radius_servers`." + " Returns the created entry's detail with the shared secret redacted." + ' `service` is a comma-separated list, e.g. `"login,ppp,hotspot,wireless,dhcp,ipsec,dot1x"`;' + ' `timeout` is a RouterOS duration string, e.g. `"300ms"`;' + " default authentication port is 1812 and accounting port is 1813.",
     inputSchema: {
-      address: z77.string().describe("RADIUS server IP address or hostname"),
-      secret: z77.string().describe("Shared secret used with the RADIUS server"),
-      service: z77.string().describe('Comma-separated services, e.g. "login,ppp,hotspot,wireless,dhcp,ipsec,dot1x"'),
-      authentication_port: z77.number().int().default(1812),
-      accounting_port: z77.number().int().default(1813),
-      timeout: z77.string().optional().describe('Request timeout, e.g. "300ms"'),
-      src_address: z77.string().optional(),
-      realm: z77.string().optional(),
-      called_id: z77.string().optional(),
-      domain: z77.string().optional(),
-      protocol: z77.enum(["udp", "radsec"]).optional().describe("Transport protocol used to reach the server (default udp)"),
-      certificate: z77.string().optional().describe("Certificate name to present when protocol is radsec"),
-      accounting_backup: z77.boolean().default(false).describe("Mark this entry as a backup accounting server"),
-      comment: z77.string().optional(),
-      disabled: z77.boolean().default(false)
+      address: z78.string().describe("RADIUS server IP address or hostname"),
+      secret: z78.string().describe("Shared secret used with the RADIUS server"),
+      service: z78.string().describe('Comma-separated services, e.g. "login,ppp,hotspot,wireless,dhcp,ipsec,dot1x"'),
+      authentication_port: z78.number().int().default(1812),
+      accounting_port: z78.number().int().default(1813),
+      timeout: z78.string().optional().describe('Request timeout, e.g. "300ms"'),
+      src_address: z78.string().optional(),
+      realm: z78.string().optional(),
+      called_id: z78.string().optional(),
+      domain: z78.string().optional(),
+      protocol: z78.enum(["udp", "radsec"]).optional().describe("Transport protocol used to reach the server (default udp)"),
+      certificate: z78.string().optional().describe("Certificate name to present when protocol is radsec"),
+      accounting_backup: z78.boolean().default(false).describe("Mark this entry as a backup accounting server"),
+      comment: z78.string().optional(),
+      disabled: z78.boolean().default(false)
     },
     async handler(a, ctx) {
       ctx.info(`Adding RADIUS server: address=${a.address}, service=${a.service}`);
@@ -15898,8 +16357,8 @@ ${redactSecrets(details)}` : "RADIUS server creation completed but unable to ver
     annotations: READ,
     description: "Lists all configured RADIUS server entries (`/radius print`) \u2014 the router's RADIUS" + " client table. Optionally filter by partial service name or partial address string." + " Returns all matching entries with shared secrets redacted; use the `.id` values from" + " this output with `get_radius_server`, `update_radius_server`, `remove_radius_server`," + " `enable_radius_server`, or `disable_radius_server`.",
     inputSchema: {
-      service_filter: z77.string().optional().describe("Partial service match"),
-      address_filter: z77.string().optional().describe("Partial address match")
+      service_filter: z78.string().optional().describe("Partial service match"),
+      address_filter: z78.string().optional().describe("Partial address match")
     },
     async handler(a, ctx) {
       ctx.info("Listing RADIUS servers");
@@ -15920,7 +16379,7 @@ ${redactSecrets(result)}`;
     annotations: READ,
     description: "Retrieves full detail of a single RADIUS server entry (`/radius print detail where .id=`)" + " \u2014 use when you need the exact current configuration of one entry." + " The `radius_id` is the `.id` returned by `list_radius_servers` (e.g. `'*1'`)." + " Returns the entry's full field set with the shared secret redacted." + " For a summary list of all entries use `list_radius_servers`.",
     inputSchema: {
-      radius_id: z77.string().describe("RADIUS entry internal .id, e.g. '*1'")
+      radius_id: z78.string().describe("RADIUS entry internal .id, e.g. '*1'")
     },
     async handler(a, ctx) {
       ctx.info(`Getting RADIUS server details: radius_id=${a.radius_id}`);
@@ -15936,22 +16395,22 @@ ${redactSecrets(result)}`;
     annotations: WRITE_IDEMPOTENT,
     description: "Updates one or more fields on an existing RADIUS server entry (`/radius set <id>`) \u2014" + " use to change the address, shared secret, services, ports, timeout, realm, or enabled" + " state without recreating the entry. The `radius_id` is the `.id` returned by" + " `list_radius_servers`. Returns the updated entry's full detail with the shared secret" + " redacted. To create a new entry use `add_radius_server`; to toggle enabled state only" + " use `enable_radius_server` or `disable_radius_server`.",
     inputSchema: {
-      radius_id: z77.string().describe("RADIUS entry internal .id, e.g. '*1'"),
-      address: z77.string().optional(),
-      secret: z77.string().optional(),
-      service: z77.string().optional(),
-      authentication_port: z77.number().int().optional(),
-      accounting_port: z77.number().int().optional(),
-      timeout: z77.string().optional(),
-      src_address: z77.string().optional(),
-      realm: z77.string().optional(),
-      called_id: z77.string().optional(),
-      domain: z77.string().optional(),
-      protocol: z77.enum(["udp", "radsec"]).optional().describe("Transport protocol used to reach the server (default udp)"),
-      certificate: z77.string().optional().describe("Certificate name to present when protocol is radsec"),
-      accounting_backup: z77.boolean().optional().describe("Mark this entry as a backup accounting server"),
-      comment: z77.string().optional(),
-      disabled: z77.boolean().optional()
+      radius_id: z78.string().describe("RADIUS entry internal .id, e.g. '*1'"),
+      address: z78.string().optional(),
+      secret: z78.string().optional(),
+      service: z78.string().optional(),
+      authentication_port: z78.number().int().optional(),
+      accounting_port: z78.number().int().optional(),
+      timeout: z78.string().optional(),
+      src_address: z78.string().optional(),
+      realm: z78.string().optional(),
+      called_id: z78.string().optional(),
+      domain: z78.string().optional(),
+      protocol: z78.enum(["udp", "radsec"]).optional().describe("Transport protocol used to reach the server (default udp)"),
+      certificate: z78.string().optional().describe("Certificate name to present when protocol is radsec"),
+      accounting_backup: z78.boolean().optional().describe("Mark this entry as a backup accounting server"),
+      comment: z78.string().optional(),
+      disabled: z78.boolean().optional()
     },
     async handler(a, ctx) {
       ctx.info(`Updating RADIUS server: radius_id=${a.radius_id}`);
@@ -15973,7 +16432,7 @@ ${redactSecrets(details)}`;
     annotations: DESTRUCTIVE,
     description: "Permanently deletes a RADIUS server entry (`/radius remove [find .id=...]`) \u2014 use when" + " an external RADIUS server is decommissioned or should no longer be used for any service." + " The `radius_id` is the `.id` returned by `list_radius_servers`." + " Performs an existence check before removal and reports if the entry is not found." + " To temporarily stop using a server without deleting it use `disable_radius_server`.",
     inputSchema: {
-      radius_id: z77.string().describe("RADIUS entry internal .id, e.g. '*1'")
+      radius_id: z78.string().describe("RADIUS entry internal .id, e.g. '*1'")
     },
     async handler(a, ctx) {
       ctx.info(`Removing RADIUS server: radius_id=${a.radius_id}`);
@@ -15992,7 +16451,7 @@ ${redactSecrets(details)}`;
     annotations: WRITE_IDEMPOTENT,
     description: "Re-enables a previously disabled RADIUS server entry (`/radius enable [find .id=...]`) \u2014" + " the router resumes sending authentication/accounting requests to this server for the" + " services it covers. The `radius_id` is the `.id` returned by `list_radius_servers`." + " To disable without deleting use `disable_radius_server`;" + " to remove permanently use `remove_radius_server`.",
     inputSchema: {
-      radius_id: z77.string().describe("RADIUS entry internal .id, e.g. '*1'")
+      radius_id: z78.string().describe("RADIUS entry internal .id, e.g. '*1'")
     },
     async handler(a, ctx) {
       ctx.info(`Enabling RADIUS server: radius_id=${a.radius_id}`);
@@ -16008,7 +16467,7 @@ ${redactSecrets(details)}`;
     annotations: WRITE_IDEMPOTENT,
     description: "Disables a RADIUS server entry without removing it (`/radius disable [find .id=...]`) \u2014" + " the router stops sending authentication/accounting requests to this server but preserves" + " its configuration for later re-activation. The `radius_id` is the `.id` returned by" + " `list_radius_servers`. To re-enable use `enable_radius_server`;" + " to delete permanently use `remove_radius_server`.",
     inputSchema: {
-      radius_id: z77.string().describe("RADIUS entry internal .id, e.g. '*1'")
+      radius_id: z78.string().describe("RADIUS entry internal .id, e.g. '*1'")
     },
     async handler(a, ctx) {
       ctx.info(`Disabling RADIUS server: radius_id=${a.radius_id}`);
@@ -16037,8 +16496,8 @@ ${result}`;
     annotations: WRITE_IDEMPOTENT,
     description: "Configures the global RADIUS Change of Authorization (CoA) listener" + " (`/radius incoming set`) \u2014 controls whether the router accepts unsolicited CoA or" + " Disconnect-Request packets pushed by the RADIUS server to forcibly terminate or update" + " active sessions. `accept` enables/disables the listener; `port` sets the UDP listen" + " port (default 3799). This is a router-wide singleton; no `radius_id` is needed." + " To read current CoA settings use `get_radius_incoming`.",
     inputSchema: {
-      accept: z77.boolean().optional().describe("Whether to accept incoming CoA requests"),
-      port: z77.number().int().optional().describe("UDP port to listen on for CoA requests")
+      accept: z78.boolean().optional().describe("Whether to accept incoming CoA requests"),
+      port: z78.number().int().optional().describe("UDP port to listen on for CoA requests")
     },
     async handler(a, ctx) {
       ctx.info("Setting RADIUS incoming (CoA) settings");
@@ -16070,7 +16529,7 @@ ${details}`;
 ];
 
 // src/tools/multiwan.ts
-import { z as z78 } from "zod";
+import { z as z79 } from "zod";
 async function runOrPreview(commands, apply, ctx, what) {
   if (!apply) {
     const plan = commands.map((c, i) => `${i + 1}. ${c}`).join(`
@@ -16102,11 +16561,11 @@ var multiwanTools = [
     annotations: DANGEROUS,
     description: "Builds ACTIVE-PASSIVE multi-WAN failover by adding health-checked default routes with ascending " + "distances (primary=1, each backup +1). RouterOS uses the lowest-distance reachable route; " + "`check-gateway` withdraws a route when its gateway stops answering, so traffic fails over to " + "the next WAN \u2014 and fails back automatically when the primary recovers. DEFAULTS TO A DRY RUN " + "(`apply=false`) so you can review before changing default routing (which can cut your own " + "access); set `apply=true` to execute. Does NOT remove existing 0.0.0.0/0 routes \u2014 clear " + "conflicting ones first with the route tools. For load balancing instead of failover use " + "setup_wan_loadbalance. Returns the plan or the resulting default routes.",
     inputSchema: {
-      primary_gateway: z78.string().describe("Primary WAN gateway IP (or interface name)"),
-      backup_gateways: z78.array(z78.string()).min(1).describe("One or more backup WAN gateways, in failover order"),
-      check: z78.enum(["ping", "arp"]).default("ping").describe("Gateway health-check method"),
-      comment_prefix: z78.string().default("wan-failover"),
-      apply: z78.boolean().default(false).describe("false = preview only (default); true = execute")
+      primary_gateway: z79.string().describe("Primary WAN gateway IP (or interface name)"),
+      backup_gateways: z79.array(z79.string()).min(1).describe("One or more backup WAN gateways, in failover order"),
+      check: z79.enum(["ping", "arp"]).default("ping").describe("Gateway health-check method"),
+      comment_prefix: z79.string().default("wan-failover"),
+      apply: z79.boolean().default(false).describe("false = preview only (default); true = execute")
     },
     async handler(a, ctx) {
       const backups = a.backup_gateways;
@@ -16125,10 +16584,10 @@ var multiwanTools = [
     annotations: DANGEROUS,
     description: "Builds ECMP (equal-cost multi-path) load balancing across multiple WANs by adding ONE default " + "route whose `gateway` lists every WAN \u2014 RouterOS then spreads connections across the links " + "(per-connection, so a single flow stays on one WAN). `check-gateway` drops a dead link from " + "the set. DEFAULTS TO A DRY RUN (`apply=false`); set `apply=true` to execute. Does NOT remove " + "existing 0.0.0.0/0 routes \u2014 clear conflicting ones first. ECMP is simple but balances by " + "connection-hash, not by bandwidth; for sticky per-source balancing (PCC) use the firewall " + "mangle + routing-table tools. For failover instead of balancing use setup_wan_failover. " + "Returns the plan or the resulting default route.",
     inputSchema: {
-      gateways: z78.array(z78.string()).min(2).describe("Two or more WAN gateways to balance across"),
-      check: z78.enum(["ping", "arp"]).default("ping").describe("Gateway health-check method"),
-      comment: z78.string().default("wan-ecmp"),
-      apply: z78.boolean().default(false).describe("false = preview only (default); true = execute")
+      gateways: z79.array(z79.string()).min(2).describe("Two or more WAN gateways to balance across"),
+      check: z79.enum(["ping", "arp"]).default("ping").describe("Gateway health-check method"),
+      comment: z79.string().default("wan-ecmp"),
+      apply: z79.boolean().default(false).describe("false = preview only (default); true = execute")
     },
     async handler(a, ctx) {
       const gateways = a.gateways;
@@ -16140,7 +16599,7 @@ var multiwanTools = [
 ];
 
 // src/tools/routes.ts
-import { z as z79 } from "zod";
+import { z as z80 } from "zod";
 async function addRoute(a, ctx) {
   ctx.info(`Adding route: dst=${a.dst_address}, gateway=${a.gateway}`);
   const cmd = new Cmd("/ip route add").set("dst-address", a.dst_address).set("gateway", a.gateway).opt("distance", a.distance).opt("scope", a.scope).opt("target-scope", a.target_scope).opt("routing-table", a.routing_table ?? a.routing_mark).opt("comment", a.comment).flag("disabled", a.disabled).opt("vrf-interface", a.vrf_interface).opt("pref-src", a.pref_src).opt("check-gateway", a.check_gateway).bool("suppress-hw-offload", a.suppress_hw_offload).opt("type", a.type).build();
@@ -16177,20 +16636,20 @@ var routeTools = [
     annotations: WRITE,
     description: "Adds an IPv4 static route (`/ip route add`) to the routing table \u2014 use this to define any " + "non-default unicast next-hop (host, subnet, or summarized prefix). " + "For the 0.0.0.0/0 default gateway use add_default_route; for null/drop routes use " + "add_blackhole_route; for IPv6 use add_ipv6_route. " + "`distance` sets priority (1\u2013255, lower wins); `routing_table` assigns the route to a " + 'policy-routing table (must already exist \u2014 see add_routing_table); `check_gateway` ("ping" ' + 'or "arp") enables active gateway monitoring. ' + "Returns the created route's detail including its `.id`.",
     inputSchema: {
-      dst_address: z79.string().describe('CIDR e.g. "0.0.0.0/0", "192.168.1.0/24"'),
-      gateway: z79.string(),
-      distance: z79.number().int().optional().describe("1-255 (lower = higher priority)"),
-      scope: z79.number().int().optional(),
-      target_scope: z79.number().int().optional(),
-      routing_table: z79.string().optional().describe('Policy-routing table name, e.g. "main" or a custom table (RouterOS v7)'),
-      routing_mark: z79.string().optional().describe("Deprecated alias for routing_table (RouterOS v6 name)"),
-      comment: z79.string().optional(),
-      disabled: z79.boolean().default(false),
-      vrf_interface: z79.string().optional(),
-      pref_src: z79.string().optional(),
-      check_gateway: z79.string().optional().describe('"ping" or "arp"'),
-      suppress_hw_offload: z79.boolean().optional().describe("Exclude route from hardware (HW) offloading"),
-      type: z79.string().optional().describe('"unicast" (default), "blackhole", "unreachable", or "prohibit"')
+      dst_address: z80.string().describe('CIDR e.g. "0.0.0.0/0", "192.168.1.0/24"'),
+      gateway: z80.string(),
+      distance: z80.number().int().optional().describe("1-255 (lower = higher priority)"),
+      scope: z80.number().int().optional(),
+      target_scope: z80.number().int().optional(),
+      routing_table: z80.string().optional().describe('Policy-routing table name, e.g. "main" or a custom table (RouterOS v7)'),
+      routing_mark: z80.string().optional().describe("Deprecated alias for routing_table (RouterOS v6 name)"),
+      comment: z80.string().optional(),
+      disabled: z80.boolean().default(false),
+      vrf_interface: z80.string().optional(),
+      pref_src: z80.string().optional(),
+      check_gateway: z80.string().optional().describe('"ping" or "arp"'),
+      suppress_hw_offload: z80.boolean().optional().describe("Exclude route from hardware (HW) offloading"),
+      type: z80.string().optional().describe('"unicast" (default), "blackhole", "unreachable", or "prohibit"')
     },
     async handler(a, ctx) {
       return addRoute(a, ctx);
@@ -16202,15 +16661,15 @@ var routeTools = [
     annotations: READ,
     description: "Lists IPv4 routes from `/ip route` with optional filters \u2014 the primary tool for inspecting " + "what routes the router knows. `dst_filter` and `gateway_filter` do substring matching; " + "`routing_table_filter` and `distance_filter` do exact matching; " + "`active_only`/`disabled_only`/`dynamic_only`/`static_only` are boolean flags. " + "For a table-scoped view of active routes use get_routing_table; for counts and summary stats " + "use get_route_statistics; for IPv6 use list_ipv6_routes. " + "Returns all matching route entries.",
     inputSchema: {
-      dst_filter: z79.string().optional(),
-      gateway_filter: z79.string().optional(),
-      routing_table_filter: z79.string().optional().describe("Exact policy-routing table name (RouterOS v7)"),
-      routing_mark_filter: z79.string().optional().describe("Deprecated alias for routing_table_filter"),
-      distance_filter: z79.number().int().optional(),
-      active_only: z79.boolean().default(false),
-      disabled_only: z79.boolean().default(false),
-      dynamic_only: z79.boolean().default(false),
-      static_only: z79.boolean().default(false)
+      dst_filter: z80.string().optional(),
+      gateway_filter: z80.string().optional(),
+      routing_table_filter: z80.string().optional().describe("Exact policy-routing table name (RouterOS v7)"),
+      routing_mark_filter: z80.string().optional().describe("Deprecated alias for routing_table_filter"),
+      distance_filter: z80.number().int().optional(),
+      active_only: z80.boolean().default(false),
+      disabled_only: z80.boolean().default(false),
+      dynamic_only: z80.boolean().default(false),
+      static_only: z80.boolean().default(false)
     },
     async handler(a, ctx) {
       ctx.info(`Listing routes with filters: dst=${a.dst_filter}, gateway=${a.gateway_filter}`);
@@ -16244,7 +16703,7 @@ ${result}`;
     annotations: READ,
     description: "Fetches full detail for a single IPv4 route (`/ip route print detail where .id=\u2026`) \u2014 " + "use this after list_routes to inspect one entry's flags, nexthop, distance, scope, and " + "all attributes. `route_id` is the `*N` or `N` `.id` value from list_routes. " + "For listing multiple routes use list_routes; for a table-scoped view use get_routing_table. " + "Returns the complete detail block for that route, or a not-found message.",
     inputSchema: {
-      route_id: z79.string().describe('"*N" or "N" from list output e.g. "*3"')
+      route_id: z80.string().describe('"*N" or "N" from list output e.g. "*3"')
     },
     async handler(a, ctx) {
       ctx.info(`Getting route details: route_id=${a.route_id}`);
@@ -16260,21 +16719,21 @@ ${result}`;
     annotations: WRITE_IDEMPOTENT,
     description: "Modifies an existing IPv4 static route (`/ip route set`) \u2014 change its gateway, dst-address, " + "distance, scope, routing-table, VRF interface, preferred-source, or gateway check method. " + "`route_id` is the `*N` `.id` from list_routes. " + 'Pass an empty string ("") for `routing_table`, `vrf_interface`, or `pref_src` to clear those fields. ' + "For toggling active state without editing attributes use enable_route / disable_route. " + "Returns the updated route detail.",
     inputSchema: {
-      route_id: z79.string().describe('"*N" or "N" from list output e.g. "*3"'),
-      dst_address: z79.string().optional().describe('CIDR e.g. "192.168.1.0/24"'),
-      gateway: z79.string().optional(),
-      distance: z79.number().int().optional().describe("1-255"),
-      scope: z79.number().int().optional(),
-      target_scope: z79.number().int().optional(),
-      routing_table: z79.string().optional().describe('Policy-routing table name (RouterOS v7); "" clears it'),
-      routing_mark: z79.string().optional().describe("Deprecated alias for routing_table (RouterOS v6 name)"),
-      comment: z79.string().optional(),
-      disabled: z79.boolean().optional(),
-      vrf_interface: z79.string().optional(),
-      pref_src: z79.string().optional(),
-      check_gateway: z79.string().optional().describe('"ping" or "arp"'),
-      suppress_hw_offload: z79.boolean().optional().describe("Exclude route from hardware (HW) offloading"),
-      type: z79.string().optional().describe('"unicast", "blackhole", "unreachable", or "prohibit"')
+      route_id: z80.string().describe('"*N" or "N" from list output e.g. "*3"'),
+      dst_address: z80.string().optional().describe('CIDR e.g. "192.168.1.0/24"'),
+      gateway: z80.string().optional(),
+      distance: z80.number().int().optional().describe("1-255"),
+      scope: z80.number().int().optional(),
+      target_scope: z80.number().int().optional(),
+      routing_table: z80.string().optional().describe('Policy-routing table name (RouterOS v7); "" clears it'),
+      routing_mark: z80.string().optional().describe("Deprecated alias for routing_table (RouterOS v6 name)"),
+      comment: z80.string().optional(),
+      disabled: z80.boolean().optional(),
+      vrf_interface: z80.string().optional(),
+      pref_src: z80.string().optional(),
+      check_gateway: z80.string().optional().describe('"ping" or "arp"'),
+      suppress_hw_offload: z80.boolean().optional().describe("Exclude route from hardware (HW) offloading"),
+      type: z80.string().optional().describe('"unicast", "blackhole", "unreachable", or "prohibit"')
     },
     async handler(a, ctx) {
       ctx.info(`Updating route: route_id=${a.route_id}`);
@@ -16328,7 +16787,7 @@ ${details}`;
     annotations: DESTRUCTIVE,
     description: "Permanently deletes an IPv4 route (`/ip route remove`) \u2014 verifies the entry exists first " + "(count-only check) then removes it. `route_id` is the `*N` `.id` from list_routes. " + "To temporarily take a route out of service without deleting it use disable_route instead. " + "Confirms deletion or reports not-found.",
     inputSchema: {
-      route_id: z79.string().describe('"*N" or "N" from list output e.g. "*3"')
+      route_id: z80.string().describe('"*N" or "N" from list output e.g. "*3"')
     },
     async handler(a, ctx) {
       ctx.info(`Removing route: route_id=${a.route_id}`);
@@ -16347,7 +16806,7 @@ ${details}`;
     annotations: WRITE_IDEMPOTENT,
     description: "Activates a disabled IPv4 route (`/ip route set disabled=no`) \u2014 makes it eligible for " + "route selection without altering any other attributes. " + "`route_id` is the `*N` `.id` from list_routes. " + "To deactivate a route use disable_route; to remove it permanently use remove_route. " + "Returns the updated route detail.",
     inputSchema: {
-      route_id: z79.string().describe('"*N" or "N" from list output e.g. "*3"')
+      route_id: z80.string().describe('"*N" or "N" from list output e.g. "*3"')
     },
     async handler(a, ctx) {
       return setRouteDisabled(a.route_id, false, ctx);
@@ -16359,7 +16818,7 @@ ${details}`;
     annotations: WRITE_IDEMPOTENT,
     description: "Deactivates an IPv4 route (`/ip route set disabled=yes`) \u2014 removes it from route selection " + "without deleting it so it can be re-enabled later. " + "`route_id` is the `*N` `.id` from list_routes. " + "To re-activate use enable_route; to permanently delete use remove_route. " + "Returns the updated route detail.",
     inputSchema: {
-      route_id: z79.string().describe('"*N" or "N" from list output e.g. "*3"')
+      route_id: z80.string().describe('"*N" or "N" from list output e.g. "*3"')
     },
     async handler(a, ctx) {
       return setRouteDisabled(a.route_id, true, ctx);
@@ -16371,9 +16830,9 @@ ${details}`;
     annotations: READ,
     description: "Reads IPv4 route entries scoped by routing table (`/ip route print`) \u2014 for any `table_name` " + 'other than "main" adds `where routing-table=<name>`; for the implicit default "main" table ' + "the routing-table filter is omitted (routes without an explicit table belong to main). " + 'Designed for policy-routing setups with multiple tables (e.g. "main", "ISP1", "ISP2"). ' + 'Filters by `table_name` (default "main"), optional `protocol_filter`, and `active_only` ' + "(default true, showing only routes currently used for forwarding). " + "For an unfiltered list across all tables use list_routes; for total/active/static counts " + "use get_route_statistics. Returns matching route entries from the specified table.",
     inputSchema: {
-      table_name: z79.string().default("main"),
-      protocol_filter: z79.string().optional(),
-      active_only: z79.boolean().default(true)
+      table_name: z80.string().default("main"),
+      protocol_filter: z80.string().optional(),
+      active_only: z80.boolean().default(true)
     },
     async handler(a, ctx) {
       ctx.info(`Getting routing table: table=${a.table_name}`);
@@ -16396,9 +16855,9 @@ ${result}`;
     annotations: READ,
     description: "Resolves which nexthop RouterOS would use for a given IPv4 destination (`/ip route check`) " + '\u2014 answers "which gateway will this packet take?" without sending any traffic. ' + "Optionally scoped by `source` address and `routing_mark` for policy-routing table lookups. " + "For listing all known routes use list_routes; for a named-table view use get_routing_table. " + "Returns the resolved nexthop and interface detail.",
     inputSchema: {
-      destination: z79.string(),
-      source: z79.string().optional(),
-      routing_mark: z79.string().optional()
+      destination: z80.string(),
+      source: z80.string().optional(),
+      routing_mark: z80.string().optional()
     },
     async handler(a, ctx) {
       ctx.info(`Checking route path to: ${a.destination}`);
@@ -16456,10 +16915,10 @@ ${fib}`;
     annotations: WRITE,
     description: "Adds an IPv4 default route (`/ip route add dst-address=0.0.0.0/0`) with gateway health " + "monitoring \u2014 a convenience wrapper around add_route fixed to the 0.0.0.0/0 prefix. " + '`check_gateway` defaults to "ping" (active gateway probing); set `distance` to control ' + "failover priority when multiple default routes exist. " + "For any other prefix use add_route; for null/drop routes use add_blackhole_route; " + "for IPv6 use add_ipv6_route. Returns the created route detail including its `.id`.",
     inputSchema: {
-      gateway: z79.string(),
-      distance: z79.number().int().default(1),
-      comment: z79.string().optional(),
-      check_gateway: z79.string().default("ping")
+      gateway: z80.string(),
+      distance: z80.number().int().default(1),
+      comment: z80.string().optional(),
+      check_gateway: z80.string().default("ping")
     },
     async handler(a, ctx) {
       return addRoute({
@@ -16477,9 +16936,9 @@ ${fib}`;
     annotations: WRITE,
     description: "Adds an IPv4 null/blackhole route (`/ip route add type=blackhole`) \u2014 traffic to `dst_address` " + "is silently dropped at the routing layer without generating an ICMP unreachable. " + "Used for traffic engineering, bogon suppression, or null-routing abusive prefixes. " + "For a normal next-hop route use add_route; for a default gateway use add_default_route. " + "Returns the created route's `.id` on success.",
     inputSchema: {
-      dst_address: z79.string().describe('CIDR e.g. "10.0.0.0/8"'),
-      distance: z79.number().int().default(1).describe("1-255"),
-      comment: z79.string().optional()
+      dst_address: z80.string().describe('CIDR e.g. "10.0.0.0/8"'),
+      distance: z80.number().int().default(1).describe("1-255"),
+      comment: z80.string().optional()
     },
     async handler(a, ctx) {
       ctx.info(`Adding blackhole route: dst=${a.dst_address}`);
@@ -16522,7 +16981,7 @@ ${stats.join(`
 ];
 
 // src/tools/routing-bfd.ts
-import { z as z80 } from "zod";
+import { z as z81 } from "zod";
 var UNSUPPORTED = "BFD is not available on this device (requires RouterOS v7 with the routing package).";
 var routingBfdTools = [
   defineTool({
@@ -16546,14 +17005,14 @@ ${result}`;
     annotations: WRITE,
     description: "Creates a BFD timer-profile entry (`/routing bfd configuration add`) that binds sub-second " + "failure-detection parameters to an interface or interface-list in a VRF. `interfaces` names the " + "interface or interface-list where BFD runs; `min_rx`/`min_tx` set the desired minimum receive/transmit " + 'intervals (e.g. "200ms"); `multiplier` sets how many missed packets declare a session down ' + "(detection time \u2248 interval \xD7 multiplier). To view existing configurations use `list_bfd_configurations`; " + "to see live session state use `list_bfd_sessions`. Returns the new entry's `.id`.",
     inputSchema: {
-      interfaces: z80.string().describe("Interface or interface-list name BFD runs on"),
-      vrf: z80.string().optional().describe("VRF (default 'main')"),
-      min_rx: z80.string().optional().describe('Desired min RX interval, e.g. "200ms"'),
-      min_tx: z80.string().optional().describe('Desired min TX interval, e.g. "200ms"'),
-      multiplier: z80.number().int().optional().describe("Detection multiplier, e.g. 5"),
-      forbid_bfd: z80.boolean().optional().describe("Forbid BFD on the matched interfaces"),
-      comment: z80.string().optional(),
-      disabled: z80.boolean().default(false)
+      interfaces: z81.string().describe("Interface or interface-list name BFD runs on"),
+      vrf: z81.string().optional().describe("VRF (default 'main')"),
+      min_rx: z81.string().optional().describe('Desired min RX interval, e.g. "200ms"'),
+      min_tx: z81.string().optional().describe('Desired min TX interval, e.g. "200ms"'),
+      multiplier: z81.number().int().optional().describe("Detection multiplier, e.g. 5"),
+      forbid_bfd: z81.boolean().optional().describe("Forbid BFD on the matched interfaces"),
+      comment: z81.string().optional(),
+      disabled: z81.boolean().default(false)
     },
     async handler(a, ctx) {
       ctx.info(`Adding BFD configuration for ${a.interfaces}`);
@@ -16573,15 +17032,15 @@ ${result}`;
     annotations: WRITE_IDEMPOTENT,
     description: "Updates an existing BFD timer-profile entry (`/routing bfd configuration set`) by its `.id` " + "(obtain from `list_bfd_configurations`). Adjusts `interfaces`, `vrf`, `min_rx`/`min_tx` intervals " + '(e.g. "200ms"), `multiplier`, `comment`, or `disabled` state. To toggle enabled state only use ' + "`set_bfd_configuration_enabled`. Returns the updated entry's full detail.",
     inputSchema: {
-      config_id: z80.string().describe('Configuration id, e.g. "*1"'),
-      interfaces: z80.string().optional(),
-      vrf: z80.string().optional(),
-      min_rx: z80.string().optional(),
-      min_tx: z80.string().optional(),
-      multiplier: z80.number().int().optional(),
-      forbid_bfd: z80.boolean().optional(),
-      comment: z80.string().optional(),
-      disabled: z80.boolean().optional()
+      config_id: z81.string().describe('Configuration id, e.g. "*1"'),
+      interfaces: z81.string().optional(),
+      vrf: z81.string().optional(),
+      min_rx: z81.string().optional(),
+      min_tx: z81.string().optional(),
+      multiplier: z81.number().int().optional(),
+      forbid_bfd: z81.boolean().optional(),
+      comment: z81.string().optional(),
+      disabled: z81.boolean().optional()
     },
     async handler(a, ctx) {
       ctx.info(`Updating BFD configuration ${a.config_id}`);
@@ -16611,7 +17070,7 @@ ${details}`;
     annotations: DESTRUCTIVE,
     description: "Permanently removes a BFD timer-profile entry (`/routing bfd configuration remove`) by its `.id` " + "(obtain from `list_bfd_configurations`). Any BFD sessions driven by this configuration will stop. " + "To suspend BFD without deleting the configuration use `set_bfd_configuration_enabled`.",
     inputSchema: {
-      config_id: z80.string().describe('Configuration id, e.g. "*1"')
+      config_id: z81.string().describe('Configuration id, e.g. "*1"')
     },
     async handler(a, ctx) {
       ctx.info(`Removing BFD configuration ${a.config_id}`);
@@ -16629,8 +17088,8 @@ ${details}`;
     annotations: WRITE_IDEMPOTENT,
     description: "Enables or disables a BFD configuration entry (`/routing bfd configuration set ... disabled=yes/no`) " + "by its `.id` (obtain from `list_bfd_configurations`). Use this to suspend BFD on specific interfaces " + "without removing the configuration. To change timer parameters use `update_bfd_configuration`; " + "to delete the entry permanently use `remove_bfd_configuration`.",
     inputSchema: {
-      config_id: z80.string().describe('Configuration id, e.g. "*1"'),
-      enabled: z80.boolean()
+      config_id: z81.string().describe('Configuration id, e.g. "*1"'),
+      enabled: z81.boolean()
     },
     async handler(a, ctx) {
       ctx.info(`Setting BFD configuration ${a.config_id} enabled=${a.enabled}`);
@@ -16648,7 +17107,7 @@ ${details}`;
     annotations: READ,
     description: "Lists live BFD neighbor sessions (`/routing bfd session print detail`) \u2014 shows each peer's state " + "(up/down), local/remote discriminators, and negotiated rx/tx intervals. Read-only runtime state; " + "use it to verify BFD is actually up before relying on fast failover for OSPF/BGP. Filter to only " + "up sessions with `up_only=true`. To manage the timer-profile entries that drive these sessions use " + "`list_bfd_configurations`.",
     inputSchema: {
-      up_only: z80.boolean().default(false).describe("Show only sessions currently up")
+      up_only: z81.boolean().default(false).describe("Show only sessions currently up")
     },
     async handler(a, ctx) {
       ctx.info("Listing BFD sessions");
@@ -16666,7 +17125,7 @@ ${result}`;
 ];
 
 // src/tools/routing-bgp.ts
-import { z as z81 } from "zod";
+import { z as z82 } from "zod";
 var UNSUPPORTED2 = "BGP is not available on this device (requires RouterOS v7 with the routing package).";
 var routingBgpTools = [
   defineTool({
@@ -16675,7 +17134,7 @@ var routingBgpTools = [
     annotations: READ,
     description: "Lists configured BGP peer connections (`/routing bgp connection`) \u2014 the static configuration of each peer " + "or listener, including local/remote AS, addresses, and role. For runtime peering state (established/idle, " + "uptime, prefix counts) use `list_bgp_sessions`. For shared configuration objects inherited by connections " + "use `list_bgp_templates`. Optionally filters by connection name substring. Returns all matching connection " + "entries. Requires RouterOS v7 with the routing package.",
     inputSchema: {
-      name_filter: z81.string().optional().describe("Substring match on connection name")
+      name_filter: z82.string().optional().describe("Substring match on connection name")
     },
     async handler(a, ctx) {
       ctx.info("Listing BGP connections");
@@ -16695,7 +17154,7 @@ ${result}`;
     title: "Get BGP Connection Details",
     annotations: READ,
     description: "Fetches full configuration detail for a single BGP connection by name " + '(`/routing bgp connection print detail where name="<name>"`). Use this to inspect one peer\'s full ' + "settings; to browse all connections use `list_bgp_connections`. For runtime session status (established, " + "uptime, prefix counts) use `list_bgp_sessions`. Returns the complete connection record or a not-found message.",
-    inputSchema: { name: z81.string().describe("BGP connection name") },
+    inputSchema: { name: z82.string().describe("BGP connection name") },
     async handler(a, ctx) {
       ctx.info(`Getting BGP connection: ${a.name}`);
       const result = await executeMikrotikCommand(`/routing bgp connection print detail where name="${a.name}"`, ctx);
@@ -16712,41 +17171,41 @@ ${result}`;
     annotations: WRITE,
     description: "Creates a BGP peer connection (`/routing bgp connection add`) \u2014 the per-peer configuration that " + "initiates or accepts a BGP session. At minimum supply `name`, `remote_address`, and `as`/`local_role` for " + "the local side. `local_role` values: `ebgp`, `ibgp`, `ebgp-customer`, `ebgp-provider`, `ibgp-rr`, " + '`ibgp-rr-client`. For `address_families` pass a comma-separated list, e.g. `"ip"` or `"ip,ipv6,l2vpn"`. ' + 'For `hold_time`/`keepalive_time` use RouterOS duration strings, e.g. `"3m"` or `"180s"`. ' + "`input_filter`/`output_filter` reference `/routing filter` chain names. Common settings (AS, filters, timers) " + "can be factored into a template referenced via `templates`; to create templates use `add_bgp_template`. " + "To modify an existing connection use `update_bgp_connection`. Returns the created connection's full detail. " + "Requires RouterOS v7 with the routing package.",
     inputSchema: {
-      name: z81.string().describe("Unique connection name"),
-      remote_address: z81.string().describe("Peer IP address (remote.address)"),
-      remote_as: z81.number().int().optional().describe("Peer AS number (remote.as)"),
-      remote_port: z81.number().int().optional().describe("Peer TCP port (remote.port)"),
-      as: z81.number().int().optional().describe("Local AS number"),
-      local_role: z81.string().optional().describe("local.role: ebgp, ibgp, ebgp-customer, ebgp-provider, ibgp-rr, ibgp-rr-client, \u2026"),
-      local_address: z81.string().optional().describe("Local source address (local.address)"),
-      local_port: z81.number().int().optional().describe("Local TCP port (local.port)"),
-      router_id: z81.string().optional().describe("Override router-id for this connection"),
-      cluster_id: z81.string().optional().describe("Route-reflector cluster ID (cluster-id)"),
-      templates: z81.string().optional().describe("Template name(s) to inherit settings from"),
-      address_families: z81.string().optional().describe('Comma list, e.g. "ip" or "ip,ipv6,l2vpn"'),
-      hold_time: z81.string().optional().describe('e.g. "3m" or "180s"'),
-      keepalive_time: z81.string().optional(),
-      multihop: z81.boolean().optional().describe("Allow non-directly-connected peers"),
-      nexthop_choice: z81.string().optional().describe("default, force-self, or propagate"),
-      use_bfd: z81.boolean().optional().describe("Use BFD for fast failure detection (use-bfd)"),
-      tcp_md5_key: z81.string().optional().describe("TCP MD5 authentication key (tcp-md5-key)"),
-      connect: z81.boolean().optional().describe("Actively initiate the TCP session (connect)"),
-      listen: z81.boolean().optional().describe("Accept incoming TCP session (listen)"),
-      input_filter: z81.string().optional().describe("Routing filter chain for inbound routes (input.filter)"),
-      input_accept_nlri: z81.string().optional().describe("Address list of accepted NLRI prefixes (input.accept-nlri)"),
-      input_allow_as: z81.number().int().optional().describe("Number of times own AS may appear in AS-path (input.allow-as)"),
-      input_ignore_as_path_len: z81.boolean().optional().describe("Ignore AS-path length in best-path selection (input.ignore-as-path-len)"),
-      output_filter: z81.string().optional().describe("Routing filter chain for outbound routes (output.filter)"),
-      output_network: z81.string().optional().describe("Address list of networks to originate/advertise (output.network)"),
-      output_default_originate: z81.string().optional().describe("Advertise a default route: never, if-installed, or always (output.default-originate)"),
-      output_redistribute: z81.string().optional().describe("Comma list of route sources to redistribute, e.g. connected,static (output.redistribute)"),
-      output_as_override: z81.boolean().optional().describe("Replace peer AS in AS-path with local AS (output.as-override)"),
-      output_keep_sent_attributes: z81.boolean().optional().describe("Retain sent path attributes for inspection (output.keep-sent-attributes)"),
-      output_no_client_to_client_reflection: z81.boolean().optional().describe("Disable route-reflector client-to-client reflection (output.no-client-to-client-reflection)"),
-      routing_table: z81.string().optional().describe("RIB to install learned routes into"),
-      vrf: z81.string().optional(),
-      comment: z81.string().optional(),
-      disabled: z81.boolean().default(false)
+      name: z82.string().describe("Unique connection name"),
+      remote_address: z82.string().describe("Peer IP address (remote.address)"),
+      remote_as: z82.number().int().optional().describe("Peer AS number (remote.as)"),
+      remote_port: z82.number().int().optional().describe("Peer TCP port (remote.port)"),
+      as: z82.number().int().optional().describe("Local AS number"),
+      local_role: z82.string().optional().describe("local.role: ebgp, ibgp, ebgp-customer, ebgp-provider, ibgp-rr, ibgp-rr-client, \u2026"),
+      local_address: z82.string().optional().describe("Local source address (local.address)"),
+      local_port: z82.number().int().optional().describe("Local TCP port (local.port)"),
+      router_id: z82.string().optional().describe("Override router-id for this connection"),
+      cluster_id: z82.string().optional().describe("Route-reflector cluster ID (cluster-id)"),
+      templates: z82.string().optional().describe("Template name(s) to inherit settings from"),
+      address_families: z82.string().optional().describe('Comma list, e.g. "ip" or "ip,ipv6,l2vpn"'),
+      hold_time: z82.string().optional().describe('e.g. "3m" or "180s"'),
+      keepalive_time: z82.string().optional(),
+      multihop: z82.boolean().optional().describe("Allow non-directly-connected peers"),
+      nexthop_choice: z82.string().optional().describe("default, force-self, or propagate"),
+      use_bfd: z82.boolean().optional().describe("Use BFD for fast failure detection (use-bfd)"),
+      tcp_md5_key: z82.string().optional().describe("TCP MD5 authentication key (tcp-md5-key)"),
+      connect: z82.boolean().optional().describe("Actively initiate the TCP session (connect)"),
+      listen: z82.boolean().optional().describe("Accept incoming TCP session (listen)"),
+      input_filter: z82.string().optional().describe("Routing filter chain for inbound routes (input.filter)"),
+      input_accept_nlri: z82.string().optional().describe("Address list of accepted NLRI prefixes (input.accept-nlri)"),
+      input_allow_as: z82.number().int().optional().describe("Number of times own AS may appear in AS-path (input.allow-as)"),
+      input_ignore_as_path_len: z82.boolean().optional().describe("Ignore AS-path length in best-path selection (input.ignore-as-path-len)"),
+      output_filter: z82.string().optional().describe("Routing filter chain for outbound routes (output.filter)"),
+      output_network: z82.string().optional().describe("Address list of networks to originate/advertise (output.network)"),
+      output_default_originate: z82.string().optional().describe("Advertise a default route: never, if-installed, or always (output.default-originate)"),
+      output_redistribute: z82.string().optional().describe("Comma list of route sources to redistribute, e.g. connected,static (output.redistribute)"),
+      output_as_override: z82.boolean().optional().describe("Replace peer AS in AS-path with local AS (output.as-override)"),
+      output_keep_sent_attributes: z82.boolean().optional().describe("Retain sent path attributes for inspection (output.keep-sent-attributes)"),
+      output_no_client_to_client_reflection: z82.boolean().optional().describe("Disable route-reflector client-to-client reflection (output.no-client-to-client-reflection)"),
+      routing_table: z82.string().optional().describe("RIB to install learned routes into"),
+      vrf: z82.string().optional(),
+      comment: z82.string().optional(),
+      disabled: z82.boolean().default(false)
     },
     async handler(a, ctx) {
       ctx.info(`Adding BGP connection: ${a.name}`);
@@ -16768,39 +17227,39 @@ ${details}`;
     annotations: WRITE_IDEMPOTENT,
     description: 'Modifies settings of an existing BGP connection by name (`/routing bgp connection set [find name="<name>"]`). ' + "Only supplied fields are changed; omitted fields are left unchanged. To enable or disable a connection " + "without touching other settings use `set_bgp_connection_enabled`. To delete a connection use " + "`remove_bgp_connection`. Returns the full updated connection detail on success.",
     inputSchema: {
-      name: z81.string().describe("Existing BGP connection name"),
-      remote_address: z81.string().optional(),
-      remote_as: z81.number().int().optional(),
-      remote_port: z81.number().int().optional(),
-      as: z81.number().int().optional(),
-      local_role: z81.string().optional(),
-      local_address: z81.string().optional(),
-      local_port: z81.number().int().optional(),
-      router_id: z81.string().optional(),
-      cluster_id: z81.string().optional(),
-      address_families: z81.string().optional(),
-      hold_time: z81.string().optional(),
-      keepalive_time: z81.string().optional(),
-      multihop: z81.boolean().optional(),
-      nexthop_choice: z81.string().optional(),
-      use_bfd: z81.boolean().optional(),
-      tcp_md5_key: z81.string().optional(),
-      connect: z81.boolean().optional(),
-      listen: z81.boolean().optional(),
-      input_filter: z81.string().optional(),
-      input_accept_nlri: z81.string().optional(),
-      input_allow_as: z81.number().int().optional(),
-      input_ignore_as_path_len: z81.boolean().optional(),
-      output_filter: z81.string().optional(),
-      output_network: z81.string().optional(),
-      output_default_originate: z81.string().optional(),
-      output_redistribute: z81.string().optional(),
-      output_as_override: z81.boolean().optional(),
-      output_keep_sent_attributes: z81.boolean().optional(),
-      output_no_client_to_client_reflection: z81.boolean().optional(),
-      routing_table: z81.string().optional(),
-      comment: z81.string().optional(),
-      disabled: z81.boolean().optional()
+      name: z82.string().describe("Existing BGP connection name"),
+      remote_address: z82.string().optional(),
+      remote_as: z82.number().int().optional(),
+      remote_port: z82.number().int().optional(),
+      as: z82.number().int().optional(),
+      local_role: z82.string().optional(),
+      local_address: z82.string().optional(),
+      local_port: z82.number().int().optional(),
+      router_id: z82.string().optional(),
+      cluster_id: z82.string().optional(),
+      address_families: z82.string().optional(),
+      hold_time: z82.string().optional(),
+      keepalive_time: z82.string().optional(),
+      multihop: z82.boolean().optional(),
+      nexthop_choice: z82.string().optional(),
+      use_bfd: z82.boolean().optional(),
+      tcp_md5_key: z82.string().optional(),
+      connect: z82.boolean().optional(),
+      listen: z82.boolean().optional(),
+      input_filter: z82.string().optional(),
+      input_accept_nlri: z82.string().optional(),
+      input_allow_as: z82.number().int().optional(),
+      input_ignore_as_path_len: z82.boolean().optional(),
+      output_filter: z82.string().optional(),
+      output_network: z82.string().optional(),
+      output_default_originate: z82.string().optional(),
+      output_redistribute: z82.string().optional(),
+      output_as_override: z82.boolean().optional(),
+      output_keep_sent_attributes: z82.boolean().optional(),
+      output_no_client_to_client_reflection: z82.boolean().optional(),
+      routing_table: z82.string().optional(),
+      comment: z82.string().optional(),
+      disabled: z82.boolean().optional()
     },
     async handler(a, ctx) {
       ctx.info(`Updating BGP connection: ${a.name}`);
@@ -16845,7 +17304,7 @@ ${details}`;
     title: "Remove BGP Connection",
     annotations: DESTRUCTIVE,
     description: 'Permanently deletes a BGP peer connection by name (`/routing bgp connection remove [find name="<name>"]`), ' + "tearing down the peering and removing all its configuration. To only suspend a connection without deleting it " + "use `set_bgp_connection_enabled`. To remove a shared settings object use `remove_bgp_template`. " + "The `name` is the connection name visible in `list_bgp_connections`.",
-    inputSchema: { name: z81.string().describe("BGP connection name to remove") },
+    inputSchema: { name: z82.string().describe("BGP connection name to remove") },
     async handler(a, ctx) {
       ctx.info(`Removing BGP connection: ${a.name}`);
       const result = await executeMikrotikCommand(`/routing bgp connection remove [find name="${a.name}"]`, ctx);
@@ -16862,8 +17321,8 @@ ${details}`;
     annotations: WRITE_IDEMPOTENT,
     description: 'Enables or disables a BGP connection by name (`/routing bgp connection set [find name="<name>"] ' + "disabled=yes/no`). Pass `enabled=true` to bring a peer up, `enabled=false` to suspend it without deleting " + "its configuration. To change other connection settings use `update_bgp_connection`. To permanently delete " + "the connection use `remove_bgp_connection`.",
     inputSchema: {
-      name: z81.string().describe("BGP connection name"),
-      enabled: z81.boolean()
+      name: z82.string().describe("BGP connection name"),
+      enabled: z82.boolean()
     },
     async handler(a, ctx) {
       ctx.info(`Setting BGP connection ${a.name} enabled=${a.enabled}`);
@@ -16896,24 +17355,24 @@ ${result}`;
     annotations: WRITE,
     description: "Creates a BGP template (`/routing bgp template add`) to hold shared peer settings (AS, address-families, " + "route filters, routing table) that multiple connections can inherit via their `templates` field, avoiding " + 'repetition across many peers. For `address_families` pass a comma-separated list, e.g. `"ip,ipv6"`. ' + "`input_filter`/`output_filter` reference `/routing filter` chain names. To create a peer that references " + "this template use `add_bgp_connection`. To remove a template use `remove_bgp_template`. Returns success " + "confirmation; verify with `list_bgp_templates`. Requires RouterOS v7 with the routing package.",
     inputSchema: {
-      name: z81.string().describe("Template name"),
-      as: z81.number().int().optional().describe("Local AS number"),
-      router_id: z81.string().optional(),
-      cluster_id: z81.string().optional().describe("Route-reflector cluster ID (cluster-id)"),
-      address_families: z81.string().optional().describe('e.g. "ip,ipv6"'),
-      hold_time: z81.string().optional().describe('e.g. "3m" or "180s"'),
-      keepalive_time: z81.string().optional(),
-      multihop: z81.boolean().optional().describe("Allow non-directly-connected peers"),
-      nexthop_choice: z81.string().optional().describe("default, force-self, or propagate"),
-      use_bfd: z81.boolean().optional().describe("Use BFD for fast failure detection (use-bfd)"),
-      input_filter: z81.string().optional(),
-      output_filter: z81.string().optional(),
-      output_network: z81.string().optional().describe("Address list of networks to originate/advertise (output.network)"),
-      output_default_originate: z81.string().optional().describe("Advertise a default route: never, if-installed, or always (output.default-originate)"),
-      output_redistribute: z81.string().optional().describe("Comma list of route sources to redistribute, e.g. connected,static (output.redistribute)"),
-      routing_table: z81.string().optional(),
-      comment: z81.string().optional(),
-      disabled: z81.boolean().default(false)
+      name: z82.string().describe("Template name"),
+      as: z82.number().int().optional().describe("Local AS number"),
+      router_id: z82.string().optional(),
+      cluster_id: z82.string().optional().describe("Route-reflector cluster ID (cluster-id)"),
+      address_families: z82.string().optional().describe('e.g. "ip,ipv6"'),
+      hold_time: z82.string().optional().describe('e.g. "3m" or "180s"'),
+      keepalive_time: z82.string().optional(),
+      multihop: z82.boolean().optional().describe("Allow non-directly-connected peers"),
+      nexthop_choice: z82.string().optional().describe("default, force-self, or propagate"),
+      use_bfd: z82.boolean().optional().describe("Use BFD for fast failure detection (use-bfd)"),
+      input_filter: z82.string().optional(),
+      output_filter: z82.string().optional(),
+      output_network: z82.string().optional().describe("Address list of networks to originate/advertise (output.network)"),
+      output_default_originate: z82.string().optional().describe("Advertise a default route: never, if-installed, or always (output.default-originate)"),
+      output_redistribute: z82.string().optional().describe("Comma list of route sources to redistribute, e.g. connected,static (output.redistribute)"),
+      routing_table: z82.string().optional(),
+      comment: z82.string().optional(),
+      disabled: z82.boolean().default(false)
     },
     async handler(a, ctx) {
       ctx.info(`Adding BGP template: ${a.name}`);
@@ -16931,7 +17390,7 @@ ${result}`;
     title: "Remove BGP Template",
     annotations: DESTRUCTIVE,
     description: 'Permanently deletes a BGP template by name (`/routing bgp template remove [find name="<name>"]`). ' + "Connections that referenced this template lose the inherited settings \u2014 review with `list_bgp_connections` " + "before removing. To remove a peer connection instead use `remove_bgp_connection`. The `name` is the template " + "name visible in `list_bgp_templates`.",
-    inputSchema: { name: z81.string().describe("BGP template name to remove") },
+    inputSchema: { name: z82.string().describe("BGP template name to remove") },
     async handler(a, ctx) {
       ctx.info(`Removing BGP template: ${a.name}`);
       const result = await executeMikrotikCommand(`/routing bgp template remove [find name="${a.name}"]`, ctx);
@@ -16948,7 +17407,7 @@ ${result}`;
     annotations: READ,
     description: "Lists runtime BGP session state (`/routing bgp session print detail`) \u2014 negotiated peering status " + "(established/idle/active/\u2026), remote AS, uptime, and received/advertised prefix counts. This is the live " + "operational view, not configuration; to view or change peer configuration use `list_bgp_connections`. " + "Pass `established_only=true` to filter to established (fully up) sessions only. For prefixes being sent to a peer use " + "`list_bgp_advertisements`. Returns all matching session entries. Requires RouterOS v7 with the routing package.",
     inputSchema: {
-      established_only: z81.boolean().default(false).describe("Show only established sessions")
+      established_only: z82.boolean().default(false).describe("Show only established sessions")
     },
     async handler(a, ctx) {
       ctx.info("Listing BGP sessions");
@@ -16969,7 +17428,7 @@ ${result}`;
     annotations: READ,
     description: "Lists prefixes currently being advertised to BGP peers (`/routing bgp advertisements print`) after output " + "filters are applied \u2014 use this to verify exactly what routes this router is sending to a given peer. " + "Read-only operational data; to see session status (prefix counts, uptime) use `list_bgp_sessions`. " + "Filter by peer name substring with `peer_filter`. Returns advertisement entries per peer, or a not-found message. " + "Requires RouterOS v7 with the routing package.",
     inputSchema: {
-      peer_filter: z81.string().optional().describe("Substring match on the peer name")
+      peer_filter: z82.string().optional().describe("Substring match on the peer name")
     },
     async handler(a, ctx) {
       ctx.info("Listing BGP advertisements");
@@ -16987,7 +17446,7 @@ ${result}`;
 ];
 
 // src/tools/routing-filter.ts
-import { z as z82 } from "zod";
+import { z as z83 } from "zod";
 var UNSUPPORTED3 = "Routing filters are not available on this device (requires RouterOS v7 with the routing package).";
 var routingFilterTools = [
   defineTool({
@@ -16996,7 +17455,7 @@ var routingFilterTools = [
     annotations: READ,
     description: "Lists routing filter rules (`/routing filter rule`) \u2014 the script-expression match/action chains used as " + "BGP/OSPF input and output filters on RouterOS v7. Each rule belongs to a named chain (e.g. `bgp-in`) " + "and is written as a script-like expression such as `if (dst in 10.0.0.0/8) { set distance 30; accept }`. " + "Returns all rules with their chain, expression, comment, and enabled state; narrow by chain with `chain_filter`. " + "For structured chain-dispatch (select-rule) entries use list_routing_filter_select_rules; " + "for IPv4 packet firewall rules use list_filter_rules; for routing policy rules use list_routing_rules.",
     inputSchema: {
-      chain_filter: z82.string().optional().describe("Show only rules in this chain")
+      chain_filter: z83.string().optional().describe("Show only rules in this chain")
     },
     async handler(a, ctx) {
       ctx.info("Listing routing filter rules");
@@ -17017,11 +17476,11 @@ ${result}`;
     annotations: WRITE,
     description: "Adds a routing filter rule to a named chain (`/routing filter rule add`) \u2014 defines the match/action " + "script expressions that BGP/OSPF consult as input/output filters on RouterOS v7. " + '`rule` is the full script expression, e.g. `"if (dst-len <= 24) { accept } else { reject }"`. ' + "Specifying a new `chain` name implicitly creates that chain; reference it from a BGP/OSPF filter setting. " + "`place_before` takes a `.id` from list_routing_filter_rules to control insertion order. " + "Returns the new rule's `.id` on success. For structured chain-dispatch rules use list_routing_filter_select_rules.",
     inputSchema: {
-      chain: z82.string().describe("Filter chain name, e.g. 'bgp-in'"),
-      rule: z82.string().describe('Match/action expression, e.g. "if (dst-len <= 24) { accept } else { reject }"'),
-      comment: z82.string().optional(),
-      disabled: z82.boolean().default(false),
-      place_before: z82.string().optional().describe("Insert before this rule id to control ordering")
+      chain: z83.string().describe("Filter chain name, e.g. 'bgp-in'"),
+      rule: z83.string().describe('Match/action expression, e.g. "if (dst-len <= 24) { accept } else { reject }"'),
+      comment: z83.string().optional(),
+      disabled: z83.boolean().default(false),
+      place_before: z83.string().optional().describe("Insert before this rule id to control ordering")
     },
     async handler(a, ctx) {
       ctx.info(`Adding routing filter rule to chain ${a.chain}`);
@@ -17041,11 +17500,11 @@ ${result}`;
     annotations: WRITE_IDEMPOTENT,
     description: "Updates an existing routing filter rule's chain, script expression, comment, or enabled state " + "(`/routing filter rule set`) on RouterOS v7. `rule_id` takes the `.id` from list_routing_filter_rules " + '(e.g. `"*3"`). Returns the updated rule\'s full detail. ' + "To toggle only enabled/disabled state use set_routing_filter_rule_enabled.",
     inputSchema: {
-      rule_id: z82.string().describe('Rule id, e.g. "*3"'),
-      chain: z82.string().optional(),
-      rule: z82.string().optional(),
-      comment: z82.string().optional(),
-      disabled: z82.boolean().optional()
+      rule_id: z83.string().describe('Rule id, e.g. "*3"'),
+      chain: z83.string().optional(),
+      rule: z83.string().optional(),
+      comment: z83.string().optional(),
+      disabled: z83.boolean().optional()
     },
     async handler(a, ctx) {
       ctx.info(`Updating routing filter rule ${a.rule_id}`);
@@ -17078,7 +17537,7 @@ ${details}`;
     title: "Remove Routing Filter Rule",
     annotations: DESTRUCTIVE,
     description: "Permanently removes a routing filter rule (`/routing filter rule remove`) on RouterOS v7. " + '`rule_id` takes the `.id` from list_routing_filter_rules (e.g. `"*3"`). ' + "This is destructive \u2014 the rule cannot be recovered. " + "To deactivate without deleting use set_routing_filter_rule_enabled.",
-    inputSchema: { rule_id: z82.string().describe('Rule id, e.g. "*3"') },
+    inputSchema: { rule_id: z83.string().describe('Rule id, e.g. "*3"') },
     async handler(a, ctx) {
       ctx.info(`Removing routing filter rule ${a.rule_id}`);
       const result = await executeMikrotikCommand(`/routing filter rule remove ${a.rule_id}`, ctx);
@@ -17095,8 +17554,8 @@ ${details}`;
     annotations: WRITE_IDEMPOTENT,
     description: "Enables or disables a routing filter rule (`/routing filter rule set disabled=`) on RouterOS v7 " + 'without removing it. `rule_id` takes the `.id` from list_routing_filter_rules (e.g. `"*3"`). ' + "Set `enabled=true` to activate or `enabled=false` to deactivate. " + "To permanently delete a rule use remove_routing_filter_rule; " + "to modify the rule's chain or expression use update_routing_filter_rule.",
     inputSchema: {
-      rule_id: z82.string().describe('Rule id, e.g. "*3"'),
-      enabled: z82.boolean()
+      rule_id: z83.string().describe('Rule id, e.g. "*3"'),
+      enabled: z83.boolean()
     },
     async handler(a, ctx) {
       ctx.info(`Setting routing filter rule ${a.rule_id} enabled=${a.enabled}`);
@@ -17129,7 +17588,7 @@ ${result}`;
     annotations: READ,
     description: "Lists routing filter num-lists (`/routing filter num-list`) \u2014 named sets of numeric ranges " + "(AS numbers, BGP communities, prefix lengths) that routing filter rules can match against by name on RouterOS v7. " + "Optionally filter to a specific named list with `list_filter`. " + "Returns each entry's list name, range, and comment. " + "To add entries use add_routing_filter_num_list; to view the rules that reference these lists use list_routing_filter_rules.",
     inputSchema: {
-      list_filter: z82.string().optional().describe("Show only entries of this named list")
+      list_filter: z83.string().optional().describe("Show only entries of this named list")
     },
     async handler(a, ctx) {
       ctx.info("Listing routing filter num-lists");
@@ -17150,9 +17609,9 @@ ${result}`;
     annotations: WRITE,
     description: "Adds a numeric range entry to a named num-list (`/routing filter num-list add`) on RouterOS v7. " + "Num-lists hold AS numbers, BGP communities, or prefix lengths that routing filter rules match by list name. " + "`list` is the target num-list name (created implicitly if new); " + '`range` is a single value or hyphen-separated range (e.g. `"65000-65010"` or `"100"`). ' + "Returns the new entry's `.id`. " + "To view existing entries use list_routing_filter_num_lists; to remove an entry use remove_routing_filter_num_list.",
     inputSchema: {
-      list: z82.string().describe("Num-list name to add to"),
-      range: z82.string().describe('Numeric range or single value, e.g. "65000-65010" or "100"'),
-      comment: z82.string().optional()
+      list: z83.string().describe("Num-list name to add to"),
+      range: z83.string().describe('Numeric range or single value, e.g. "65000-65010" or "100"'),
+      comment: z83.string().optional()
     },
     async handler(a, ctx) {
       ctx.info(`Adding num-list entry to ${a.list}`);
@@ -17171,7 +17630,7 @@ ${result}`;
     title: "Remove Routing Filter Num-List Entry",
     annotations: DESTRUCTIVE,
     description: "Permanently removes a numeric range entry from a num-list (`/routing filter num-list remove`) on RouterOS v7. " + '`entry_id` takes the `.id` from list_routing_filter_num_lists (e.g. `"*3"`). ' + "Removing an entry affects any routing filter rule that matches against the parent list by name. " + "To add entries use add_routing_filter_num_list.",
-    inputSchema: { entry_id: z82.string().describe('Entry id, e.g. "*3"') },
+    inputSchema: { entry_id: z83.string().describe('Entry id, e.g. "*3"') },
     async handler(a, ctx) {
       ctx.info(`Removing num-list entry ${a.entry_id}`);
       const result = await executeMikrotikCommand(`/routing filter num-list remove ${a.entry_id}`, ctx);
@@ -17185,7 +17644,7 @@ ${result}`;
 ];
 
 // src/tools/routing-gmp.ts
-import { z as z83 } from "zod";
+import { z as z84 } from "zod";
 var UNSUPPORTED4 = "GMP is not available on this device (requires RouterOS v7 with the routing/multicast package).";
 var routingGmpTools = [
   defineTool({
@@ -17209,8 +17668,8 @@ ${result}`;
     annotations: READ,
     description: "Lists GMP group membership records (`/routing gmp group`) \u2014 returns the multicast groups currently joined " + "per interface as learned from downstream IGMP (IPv4) or MLD (IPv6) reports; the source of truth for which " + "segments want which groups, used by PIM-SM and IGMP-proxy for forwarding decisions. " + "For per-interface querier role and timer state use list_gmp_interfaces. " + "Accepts optional filters: interface_filter (exact interface name) and group_filter (regex match on multicast group address). " + "Read-only; requires RouterOS v7 with the routing/multicast package.",
     inputSchema: {
-      interface_filter: z83.string().optional().describe("Show only memberships on this interface"),
-      group_filter: z83.string().optional().describe("Regex match on the multicast group address")
+      interface_filter: z84.string().optional().describe("Show only memberships on this interface"),
+      group_filter: z84.string().optional().describe("Regex match on the multicast group address")
     },
     async handler(a, ctx) {
       ctx.info("Listing GMP group memberships");
@@ -17230,7 +17689,7 @@ ${result}`;
 ];
 
 // src/tools/routing-id.ts
-import { z as z84 } from "zod";
+import { z as z85 } from "zod";
 var UNSUPPORTED5 = "Routing Router-ID is not available on this device (requires RouterOS v7 with the routing package).";
 var routingIdTools = [
   defineTool({
@@ -17239,7 +17698,7 @@ var routingIdTools = [
     annotations: READ,
     description: "Lists all Router-ID instances (`/routing id print detail`). Router-IDs are named 32-bit identifiers " + "assigned to routing processes (OSPF, BGP) to uniquely identify the router within the routing domain; " + "each instance can carry a fixed IPv4 address or auto-derive one from an interface/loopback. " + "Use `get_routing_id` to inspect a single instance by name. " + "For IPv4 route table entries use `list_routes`; for policy routing rules use `list_routing_rules`; " + "for BGP connections that reference a router-id use `list_bgp_connections`. " + "Returns all instance names, configured IDs, dynamic-selection settings, and enabled/disabled state. " + "Requires RouterOS v7 with the routing package.",
     inputSchema: {
-      name_filter: z84.string().optional().describe("Substring match on the instance name")
+      name_filter: z85.string().optional().describe("Substring match on the instance name")
     },
     async handler(a, ctx) {
       ctx.info("Listing routing IDs");
@@ -17258,7 +17717,7 @@ ${result}`;
     annotations: READ,
     description: "Returns full detail for a single named Router-ID instance (`/routing id print detail where name=...`). " + "Use this to inspect the configured or dynamically-selected 32-bit router identifier for a specific OSPF/BGP process. " + "Use `list_routing_ids` to enumerate all instances and discover names. " + "For IPv4 route table entries use `get_route`; for policy routing rules use `list_routing_rules`. " + "Returns all properties (id, select-dynamic-id, disabled, comment) of the named instance, " + "or a not-found message if the name does not exist.",
     inputSchema: {
-      name: z84.string().describe("Router-ID instance name")
+      name: z85.string().describe("Router-ID instance name")
     },
     async handler(a, ctx) {
       ctx.info(`Getting routing ID: ${a.name}`);
@@ -17276,11 +17735,11 @@ ${result}`;
     annotations: WRITE,
     description: "Creates a new Router-ID instance (`/routing id add`) that assigns a stable 32-bit router identifier " + "to a routing process (OSPF, BGP). " + "Either pin a fixed `id` (an IPv4 address, e.g. '10.0.0.1') or let RouterOS auto-derive it from " + "an interface/loopback via `select_dynamic_id` \u2014 at least one of the two should be set. " + "For BGP connections that consume a router-id use `add_bgp_connection`; " + "to modify an existing instance use `update_routing_id`; " + "for IPv4 static routes use `add_route`; for IPv6 static routes use `add_ipv6_route`. " + "Requires RouterOS v7 with the routing package. " + "Returns the created instance's full detail.",
     inputSchema: {
-      name: z84.string().describe("Unique instance name, referenced by OSPF/BGP"),
-      id: z84.string().optional().describe("Fixed router-id as an IPv4 address, e.g. '10.0.0.1'"),
-      select_dynamic_id: z84.string().optional().describe("Interface/loopback name to auto-derive the id from when `id` is omitted"),
-      comment: z84.string().optional(),
-      disabled: z84.boolean().default(false)
+      name: z85.string().describe("Unique instance name, referenced by OSPF/BGP"),
+      id: z85.string().optional().describe("Fixed router-id as an IPv4 address, e.g. '10.0.0.1'"),
+      select_dynamic_id: z85.string().optional().describe("Interface/loopback name to auto-derive the id from when `id` is omitted"),
+      comment: z85.string().optional(),
+      disabled: z85.boolean().default(false)
     },
     async handler(a, ctx) {
       ctx.info(`Adding routing ID: ${a.name}`);
@@ -17302,11 +17761,11 @@ ${details}`;
     annotations: WRITE_IDEMPOTENT,
     description: "Modifies an existing Router-ID instance (`/routing id set [find name=...]`). " + "Supply any combination of fields to change; omitted fields are left untouched. " + 'Pass `""` for `id` to clear the fixed router-id (RouterOS unsets it with `!id`); ' + 'pass `""` for `select_dynamic_id` to clear dynamic interface selection (`!select-dynamic-id`). ' + "Use `add_routing_id` to create a new instance; " + "use `set_routing_id_enabled` to toggle enabled state without changing other properties. " + "For updating IPv4 routes use `update_route`; for policy routing rules use `update_routing_rule`. " + "Returns the updated instance's full detail.",
     inputSchema: {
-      name: z84.string().describe("Existing Router-ID instance name"),
-      id: z84.string().optional().describe('IPv4 router-id, or "" to clear'),
-      select_dynamic_id: z84.string().optional().describe('Interface/loopback name, or "" to clear'),
-      comment: z84.string().optional(),
-      disabled: z84.boolean().optional()
+      name: z85.string().describe("Existing Router-ID instance name"),
+      id: z85.string().optional().describe('IPv4 router-id, or "" to clear'),
+      select_dynamic_id: z85.string().optional().describe('Interface/loopback name, or "" to clear'),
+      comment: z85.string().optional(),
+      disabled: z85.boolean().optional()
     },
     async handler(a, ctx) {
       ctx.info(`Updating routing ID: ${a.name}`);
@@ -17341,7 +17800,7 @@ ${details}`;
     annotations: DESTRUCTIVE,
     description: "Permanently deletes a named Router-ID instance (`/routing id remove [find name=...]`). " + "Removing a router-id that is actively referenced by an OSPF or BGP process will break that " + "process's identifier \u2014 verify dependencies before removing. " + "Use `list_routing_ids` to discover instance names. " + "To disable without deleting use `set_routing_id_enabled`. " + "For removing IPv4 routes use `remove_route`; for IPv6 routes use `remove_ipv6_route`. " + "Returns a success confirmation or an error message.",
     inputSchema: {
-      name: z84.string().describe("Router-ID instance name to remove")
+      name: z85.string().describe("Router-ID instance name to remove")
     },
     async handler(a, ctx) {
       ctx.info(`Removing routing ID: ${a.name}`);
@@ -17359,8 +17818,8 @@ ${details}`;
     annotations: WRITE_IDEMPOTENT,
     description: "Enables or disables a named Router-ID instance (`/routing id set [find name=...] disabled=yes/no`). " + "Disabling prevents the instance from being advertised or used by OSPF/BGP without removing it. " + "Use `add_routing_id` to create a new instance; " + "use `update_routing_id` to change the ID value or other properties; " + "use `remove_routing_id` for permanent deletion. " + "Set `enabled=true` to enable, `enabled=false` to disable. " + "Returns a confirmation string.",
     inputSchema: {
-      name: z84.string().describe("Router-ID instance name"),
-      enabled: z84.boolean().describe("true to enable, false to disable")
+      name: z85.string().describe("Router-ID instance name"),
+      enabled: z85.boolean().describe("true to enable, false to disable")
     },
     async handler(a, ctx) {
       ctx.info(`Setting routing ID ${a.name} enabled=${a.enabled}`);
@@ -17375,7 +17834,7 @@ ${details}`;
 ];
 
 // src/tools/routing-igmp-proxy.ts
-import { z as z85 } from "zod";
+import { z as z86 } from "zod";
 var UNSUPPORTED6 = "IGMP proxy is not available on this device (requires RouterOS v7 with the routing/multicast package).";
 var routingIgmpProxyTools = [
   defineTool({
@@ -17399,9 +17858,9 @@ ${result}`;
     annotations: WRITE_IDEMPOTENT,
     description: "Update global IGMP proxy settings (`/routing igmp-proxy set`). Tunes IPv4 multicast membership refresh " + "timing and fast-leave behaviour for the proxy daemon. For interface-level changes use " + "`update_igmp_proxy_interface`. `quick_leave` prunes a multicast group immediately on member leave \u2014 " + 'recommended for IPTV channel zapping; `query_interval` e.g. "125s"; `query_response_interval` e.g. ' + '"10s". Returns updated settings on success.',
     inputSchema: {
-      quick_leave: z85.boolean().optional(),
-      query_interval: z85.string().optional().describe('e.g. "125s"'),
-      query_response_interval: z85.string().optional().describe('e.g. "10s"')
+      quick_leave: z86.boolean().optional(),
+      query_interval: z86.string().optional().describe('e.g. "125s"'),
+      query_response_interval: z86.string().optional().describe('e.g. "10s"')
     },
     async handler(a, ctx) {
       ctx.info("Updating IGMP proxy settings");
@@ -17443,12 +17902,12 @@ ${result}`;
     annotations: WRITE,
     description: "Add an interface to the IGMP proxy configuration (`/routing igmp-proxy interface add`). Registers a " + "network interface as either upstream (`upstream=true`, toward the IPv4 multicast source) or downstream " + "(toward receivers). Only one upstream interface is permitted per proxy instance. " + "`alternative_subnets` whitelists extra source subnets reachable through this interface (e.g. " + '"10.0.0.0/8"); `threshold` sets the minimum TTL required to forward. For updating an existing entry ' + "use `update_igmp_proxy_interface`; to view current entries use `list_igmp_proxy_interfaces`.",
     inputSchema: {
-      interface: z85.string().describe("Interface name"),
-      upstream: z85.boolean().default(false).describe("true = upstream (toward source), false = downstream"),
-      alternative_subnets: z85.string().optional().describe('Comma list of source subnets, e.g. "10.0.0.0/8"'),
-      threshold: z85.number().int().optional().describe("Minimum TTL to forward"),
-      comment: z85.string().optional(),
-      disabled: z85.boolean().default(false)
+      interface: z86.string().describe("Interface name"),
+      upstream: z86.boolean().default(false).describe("true = upstream (toward source), false = downstream"),
+      alternative_subnets: z86.string().optional().describe('Comma list of source subnets, e.g. "10.0.0.0/8"'),
+      threshold: z86.number().int().optional().describe("Minimum TTL to forward"),
+      comment: z86.string().optional(),
+      disabled: z86.boolean().default(false)
     },
     async handler(a, ctx) {
       ctx.info(`Adding IGMP proxy interface ${a.interface}`);
@@ -17467,12 +17926,12 @@ ${result}`;
     annotations: WRITE_IDEMPOTENT,
     description: "Update an existing IGMP proxy interface entry by name (`/routing igmp-proxy interface set " + "[find interface=...]`). Modifies the upstream/downstream role, alternative subnets, TTL threshold, " + "comment, or disabled state of the named interface. For adding a new interface use " + "`add_igmp_proxy_interface`; to toggle only the enabled state use `set_igmp_proxy_interface_enabled`. " + "Returns updated interface detail on success.",
     inputSchema: {
-      interface: z85.string().describe("Existing IGMP-proxy interface name"),
-      upstream: z85.boolean().optional(),
-      alternative_subnets: z85.string().optional(),
-      threshold: z85.number().int().optional(),
-      comment: z85.string().optional(),
-      disabled: z85.boolean().optional()
+      interface: z86.string().describe("Existing IGMP-proxy interface name"),
+      upstream: z86.boolean().optional(),
+      alternative_subnets: z86.string().optional(),
+      threshold: z86.number().int().optional(),
+      comment: z86.string().optional(),
+      disabled: z86.boolean().optional()
     },
     async handler(a, ctx) {
       ctx.info(`Updating IGMP proxy interface ${a.interface}`);
@@ -17504,7 +17963,7 @@ ${details}`;
     annotations: DESTRUCTIVE,
     description: "Remove an IGMP proxy interface entry by name (`/routing igmp-proxy interface remove " + "[find interface=...]`). Permanently deletes the interface from the proxy configuration; multicast " + "groups that relied on it will stop being forwarded. For disabling without removal use " + "`set_igmp_proxy_interface_enabled`. Provide the interface name as it appears in " + "`list_igmp_proxy_interfaces`.",
     inputSchema: {
-      interface: z85.string().describe("IGMP-proxy interface name to remove")
+      interface: z86.string().describe("IGMP-proxy interface name to remove")
     },
     async handler(a, ctx) {
       ctx.info(`Removing IGMP proxy interface ${a.interface}`);
@@ -17522,8 +17981,8 @@ ${details}`;
     annotations: WRITE_IDEMPOTENT,
     description: "Enable or disable a single IGMP proxy interface by name (`/routing igmp-proxy interface set " + "[find interface=...] disabled=yes/no`). Pauses multicast forwarding through the interface without " + "removing its configuration. For full property changes use `update_igmp_proxy_interface`; to " + "permanently remove the entry use `remove_igmp_proxy_interface`. Provide the interface name as it " + "appears in `list_igmp_proxy_interfaces`.",
     inputSchema: {
-      interface: z85.string().describe("IGMP-proxy interface name"),
-      enabled: z85.boolean()
+      interface: z86.string().describe("IGMP-proxy interface name"),
+      enabled: z86.boolean()
     },
     async handler(a, ctx) {
       ctx.info(`Setting IGMP proxy interface ${a.interface} enabled=${a.enabled}`);
@@ -17553,7 +18012,7 @@ ${result}`;
 ];
 
 // src/tools/routing-nexthop.ts
-import { z as z86 } from "zod";
+import { z as z87 } from "zod";
 var UNSUPPORTED7 = "Routing next-hops are not available on this device (requires RouterOS v7 with the routing package).";
 var routingNexthopTools = [
   defineTool({
@@ -17562,8 +18021,8 @@ var routingNexthopTools = [
     annotations: READ,
     description: "List resolved routing next-hops (`/routing nexthop`) \u2014 the recursive next-hop resolution table that shows " + "how each gateway maps to a concrete egress interface and immediate next-hop address, " + "and whether it is currently active. Use this to debug recursive or BGP next-hop resolution failures where " + "a route exists but traffic is not forwarded as expected. " + "For the IPv4 route table use list_routes; for IPv6 routes use list_ipv6_routes; " + "for routing policy rules use list_routing_rules; for next-hop counts only use get_routing_nexthop_stats. " + "Requires RouterOS v7 with the routing package. " + "Returns full detail for each next-hop entry. " + "Filter with gateway_filter (substring match on gateway address) and active_only=true to restrict to active entries.",
     inputSchema: {
-      gateway_filter: z86.string().optional().describe("Substring match on the resolved gateway address"),
-      active_only: z86.boolean().default(false)
+      gateway_filter: z87.string().optional().describe("Substring match on the resolved gateway address"),
+      active_only: z87.boolean().default(false)
     },
     async handler(a, ctx) {
       ctx.info("Listing routing next-hops");
@@ -17600,7 +18059,7 @@ Active next-hops: ${active2.trim()}`;
 ];
 
 // src/tools/routing-ospf.ts
-import { z as z87 } from "zod";
+import { z as z88 } from "zod";
 var UNSUPPORTED8 = "OSPF is not available on this device (requires RouterOS v7 with the routing package).";
 var routingOspfTools = [
   defineTool({
@@ -17624,21 +18083,21 @@ ${result}`;
     annotations: WRITE,
     description: "Create an OSPF instance (`/routing ospf instance add`) \u2014 the top-level OSPF process. " + "`version` 2 = OSPFv2 (IPv4 routing), 3 = OSPFv3 (IPv6 routing); each address family needs its own instance. " + "`router_id` may be an IPv4 address, 'main', or the name of a `/routing id`. " + "`redistribute` is a comma-separated list (connected,static,rip,bgp,\u2026). " + "Requires RouterOS v7 with the routing package. " + "After creating an instance, add areas with add_ospf_area and bind interfaces with add_ospf_interface_template. " + "Returns the created instance's full detail.",
     inputSchema: {
-      name: z87.string().describe("Unique instance name"),
-      version: z87.number().int().min(2).max(3).default(2).describe("2 = OSPFv2, 3 = OSPFv3"),
-      router_id: z87.string().optional().describe("IPv4 address, 'main', or a /routing id name"),
-      vrf: z87.string().optional(),
-      redistribute: z87.string().optional().describe('Comma list, e.g. "connected,static"'),
-      in_filter_chain: z87.string().optional().describe("Routing filter chain for received routes"),
-      out_filter_chain: z87.string().optional().describe("Routing filter chain for redistributed routes"),
-      originate_default: z87.string().optional().describe("never, if-installed, or always"),
-      domain_id: z87.string().optional().describe("OSPF domain ID (MPLS VPN PE-CE OSPF)"),
-      domain_tag: z87.number().int().optional().describe("OSPF domain tag (MPLS VPN PE-CE OSPF)"),
-      use_dn: z87.boolean().optional().describe("Use/ignore DN bit on OSPF routes (MPLS VPN)"),
-      mpls_te_area: z87.string().optional().describe("Area used for MPLS traffic engineering"),
-      mpls_te_address: z87.string().optional().describe("Router address advertised for MPLS TE"),
-      comment: z87.string().optional(),
-      disabled: z87.boolean().default(false)
+      name: z88.string().describe("Unique instance name"),
+      version: z88.number().int().min(2).max(3).default(2).describe("2 = OSPFv2, 3 = OSPFv3"),
+      router_id: z88.string().optional().describe("IPv4 address, 'main', or a /routing id name"),
+      vrf: z88.string().optional(),
+      redistribute: z88.string().optional().describe('Comma list, e.g. "connected,static"'),
+      in_filter_chain: z88.string().optional().describe("Routing filter chain for received routes"),
+      out_filter_chain: z88.string().optional().describe("Routing filter chain for redistributed routes"),
+      originate_default: z88.string().optional().describe("never, if-installed, or always"),
+      domain_id: z88.string().optional().describe("OSPF domain ID (MPLS VPN PE-CE OSPF)"),
+      domain_tag: z88.number().int().optional().describe("OSPF domain tag (MPLS VPN PE-CE OSPF)"),
+      use_dn: z88.boolean().optional().describe("Use/ignore DN bit on OSPF routes (MPLS VPN)"),
+      mpls_te_area: z88.string().optional().describe("Area used for MPLS traffic engineering"),
+      mpls_te_address: z88.string().optional().describe("Router address advertised for MPLS TE"),
+      comment: z88.string().optional(),
+      disabled: z88.boolean().default(false)
     },
     async handler(a, ctx) {
       ctx.info(`Adding OSPF instance: ${a.name}`);
@@ -17663,19 +18122,19 @@ ${details}`;
     annotations: WRITE_IDEMPOTENT,
     description: "Update an existing OSPF instance (`/routing ospf instance set`) by name \u2014 change router-id, " + "redistribution list, import/export filter chains, originate-default policy, comment, or disabled state. " + "Only supplied fields are modified; omitting a field leaves it unchanged. " + "`name` identifies the target instance (use list_ospf_instances to find names). " + "Returns the updated instance detail. To remove an instance entirely use remove_ospf_instance.",
     inputSchema: {
-      name: z87.string().describe("Existing OSPF instance name"),
-      router_id: z87.string().optional(),
-      redistribute: z87.string().optional(),
-      in_filter_chain: z87.string().optional(),
-      out_filter_chain: z87.string().optional(),
-      originate_default: z87.string().optional(),
-      domain_id: z87.string().optional().describe("OSPF domain ID (MPLS VPN PE-CE OSPF)"),
-      domain_tag: z87.number().int().optional().describe("OSPF domain tag (MPLS VPN PE-CE OSPF)"),
-      use_dn: z87.boolean().optional().describe("Use/ignore DN bit on OSPF routes (MPLS VPN)"),
-      mpls_te_area: z87.string().optional().describe("Area used for MPLS traffic engineering"),
-      mpls_te_address: z87.string().optional().describe("Router address advertised for MPLS TE"),
-      comment: z87.string().optional(),
-      disabled: z87.boolean().optional()
+      name: z88.string().describe("Existing OSPF instance name"),
+      router_id: z88.string().optional(),
+      redistribute: z88.string().optional(),
+      in_filter_chain: z88.string().optional(),
+      out_filter_chain: z88.string().optional(),
+      originate_default: z88.string().optional(),
+      domain_id: z88.string().optional().describe("OSPF domain ID (MPLS VPN PE-CE OSPF)"),
+      domain_tag: z88.number().int().optional().describe("OSPF domain tag (MPLS VPN PE-CE OSPF)"),
+      use_dn: z88.boolean().optional().describe("Use/ignore DN bit on OSPF routes (MPLS VPN)"),
+      mpls_te_area: z88.string().optional().describe("Area used for MPLS traffic engineering"),
+      mpls_te_address: z88.string().optional().describe("Router address advertised for MPLS TE"),
+      comment: z88.string().optional(),
+      disabled: z88.boolean().optional()
     },
     async handler(a, ctx) {
       ctx.info(`Updating OSPF instance: ${a.name}`);
@@ -17706,7 +18165,7 @@ ${details}`;
     title: "Remove OSPF Instance",
     annotations: DESTRUCTIVE,
     description: "Remove an OSPF instance by name (`/routing ospf instance remove`) \u2014 permanently stops the named OSPF process. " + "Use list_ospf_instances to find the instance name. " + "Remove dependent areas (remove_ospf_area), area ranges (remove_ospf_area_range), and interface templates " + "(remove_ospf_interface_template) first to avoid orphaned config or removal errors. " + "Irreversible \u2014 all OSPF adjacencies for that process will drop immediately. " + "For a non-destructive pause use update_ospf_instance with disabled=true.",
-    inputSchema: { name: z87.string().describe("OSPF instance name to remove") },
+    inputSchema: { name: z88.string().describe("OSPF instance name to remove") },
     async handler(a, ctx) {
       ctx.info(`Removing OSPF instance: ${a.name}`);
       const result = await executeMikrotikCommand(`/routing ospf instance remove [find name="${a.name}"]`, ctx);
@@ -17738,14 +18197,14 @@ ${result}`;
     annotations: WRITE,
     description: "Create an OSPF area (`/routing ospf area add`) within a named instance \u2014 area-id must be in IPv4 " + "dotted notation (backbone = '0.0.0.0'). `type` controls LSA flooding: default (normal), stub (no external " + "LSAs), or nssa (allow external redistribution via NSSA LSAs). `no_summaries=true` makes a totally-stubby " + "or totally-NSSA area by blocking summary LSAs. " + "Requires the instance to already exist (add_ospf_instance). " + "After adding an area, bind interfaces to it with add_ospf_interface_template. " + "Returns a success confirmation.",
     inputSchema: {
-      name: z87.string().describe("Unique area name"),
-      area_id: z87.string().describe('Area id in IPv4 notation, e.g. "0.0.0.0" for backbone'),
-      instance: z87.string().describe("OSPF instance name this area belongs to"),
-      type: z87.enum(["default", "stub", "nssa"]).optional(),
-      no_summaries: z87.boolean().optional().describe("Make a totally-stubby/NSSA area (block summary LSAs)"),
-      default_cost: z87.number().int().optional().describe("Cost of the default route an ABR injects into a stub/NSSA area"),
-      comment: z87.string().optional(),
-      disabled: z87.boolean().default(false)
+      name: z88.string().describe("Unique area name"),
+      area_id: z88.string().describe('Area id in IPv4 notation, e.g. "0.0.0.0" for backbone'),
+      instance: z88.string().describe("OSPF instance name this area belongs to"),
+      type: z88.enum(["default", "stub", "nssa"]).optional(),
+      no_summaries: z88.boolean().optional().describe("Make a totally-stubby/NSSA area (block summary LSAs)"),
+      default_cost: z88.number().int().optional().describe("Cost of the default route an ABR injects into a stub/NSSA area"),
+      comment: z88.string().optional(),
+      disabled: z88.boolean().default(false)
     },
     async handler(a, ctx) {
       ctx.info(`Adding OSPF area: ${a.name}`);
@@ -17766,7 +18225,7 @@ ${result}`;
     title: "Remove OSPF Area",
     annotations: DESTRUCTIVE,
     description: "Remove an OSPF area by name (`/routing ospf area remove`) \u2014 permanently deletes the area and its " + "association with the instance. Use list_ospf_areas to find the area name. " + "Remove any area ranges (remove_ospf_area_range) and interface templates (remove_ospf_interface_template) " + "that reference this area first to avoid orphaned config or removal errors.",
-    inputSchema: { name: z87.string().describe("OSPF area name to remove") },
+    inputSchema: { name: z88.string().describe("OSPF area name to remove") },
     async handler(a, ctx) {
       ctx.info(`Removing OSPF area: ${a.name}`);
       const result = await executeMikrotikCommand(`/routing ospf area remove [find name="${a.name}"]`, ctx);
@@ -17798,12 +18257,12 @@ ${result}`;
     annotations: WRITE,
     description: "Add an OSPF area summarisation range (`/routing ospf area range add`) to a named area \u2014 the ABR will " + "aggregate matching intra-area prefixes into a single Type-3 LSA advertised to other areas. " + "`advertise=false` suppresses the summary entirely (null-routes the aggregate). " + "`cost` overrides the auto-computed metric. Area must already exist (add_ospf_area). " + "`prefix` is the aggregate prefix, e.g. '10.10.0.0/16'. " + "Use list_ospf_area_ranges to verify after creation. Returns a success confirmation.",
     inputSchema: {
-      area: z87.string().describe("OSPF area name"),
-      prefix: z87.string().describe('Aggregate prefix, e.g. "10.10.0.0/16"'),
-      advertise: z87.boolean().default(true).describe("Advertise the summary (false suppresses it)"),
-      cost: z87.number().int().optional(),
-      comment: z87.string().optional(),
-      disabled: z87.boolean().optional()
+      area: z88.string().describe("OSPF area name"),
+      prefix: z88.string().describe('Aggregate prefix, e.g. "10.10.0.0/16"'),
+      advertise: z88.boolean().default(true).describe("Advertise the summary (false suppresses it)"),
+      cost: z88.number().int().optional(),
+      comment: z88.string().optional(),
+      disabled: z88.boolean().optional()
     },
     async handler(a, ctx) {
       ctx.info(`Adding OSPF area range ${a.prefix} to ${a.area}`);
@@ -17823,7 +18282,7 @@ ${result}`;
     title: "Remove OSPF Area Range",
     annotations: DESTRUCTIVE,
     description: "Remove an OSPF area summarisation range (`/routing ospf area range remove`) by its `.id` \u2014 " + "use list_ospf_area_ranges to obtain the id (e.g. '*1'). " + "The ABR will revert to advertising individual intra-area prefixes instead of the aggregate.",
-    inputSchema: { range_id: z87.string().describe('Range id, e.g. "*1"') },
+    inputSchema: { range_id: z88.string().describe('Range id, e.g. "*1"') },
     async handler(a, ctx) {
       ctx.info(`Removing OSPF area range ${a.range_id}`);
       const result = await executeMikrotikCommand(`/routing ospf area range remove ${a.range_id}`, ctx);
@@ -17855,26 +18314,26 @@ ${result}`;
     annotations: WRITE,
     description: "Bind interfaces or network prefixes to an OSPF area (`/routing ospf interface-template add`). " + "Match links via `interfaces` (interface or interface-list name) and/or `networks` (prefix, " + "e.g. '10.0.0.0/24'). `type` sets the link model: broadcast (LAN), ptp (point-to-point), " + "nbma, ptmp, or virtual-link. `passive=true` advertises the subnet without forming OSPF adjacencies " + "(for stub networks). `auth`/`auth_id`/`auth_key` enable per-interface authentication; `hello_interval` " + "e.g. '10s', `dead_interval` e.g. '40s'. " + "Requires the area to already exist (add_ospf_area). " + "Returns the new template id (e.g. '*2') if RouterOS echoes one; use list_ospf_interface_templates to verify.",
     inputSchema: {
-      area: z87.string().describe("OSPF area name to attach matched interfaces to"),
-      interfaces: z87.string().optional().describe("Interface or interface-list name"),
-      networks: z87.string().optional().describe('Network prefix(es) to enable OSPF on, e.g. "10.0.0.0/24"'),
-      cost: z87.number().int().optional().describe("Output cost / metric"),
-      priority: z87.number().int().optional().describe("DR election priority (0 = never DR)"),
-      type: z87.enum(["broadcast", "ptp", "nbma", "ptmp", "virtual-link"]).optional(),
-      passive: z87.boolean().optional(),
-      hello_interval: z87.string().optional().describe('e.g. "10s"'),
-      dead_interval: z87.string().optional().describe('e.g. "40s"'),
-      retransmit_interval: z87.string().optional().describe('Interval between LSA retransmissions, e.g. "5s"'),
-      transmit_delay: z87.string().optional().describe('Estimated LSA transmit delay, e.g. "1s"'),
-      instance_id: z87.number().int().optional().describe("OSPF instance-id carried in hello packets"),
-      prefix_list: z87.string().optional().describe("Prefix-list name filtering which connected networks are advertised"),
-      vlink_neighbor_id: z87.string().optional().describe("Virtual-link remote router-id (type=virtual-link)"),
-      vlink_transit_area: z87.string().optional().describe("Transit area the virtual-link traverses (type=virtual-link)"),
-      auth: z87.enum(["simple", "md5", "sha1", "sha256", "sha384", "sha512"]).optional(),
-      auth_id: z87.number().int().optional().describe("Key id for keyed authentication"),
-      auth_key: z87.string().optional().describe("Authentication key/password"),
-      comment: z87.string().optional(),
-      disabled: z87.boolean().default(false)
+      area: z88.string().describe("OSPF area name to attach matched interfaces to"),
+      interfaces: z88.string().optional().describe("Interface or interface-list name"),
+      networks: z88.string().optional().describe('Network prefix(es) to enable OSPF on, e.g. "10.0.0.0/24"'),
+      cost: z88.number().int().optional().describe("Output cost / metric"),
+      priority: z88.number().int().optional().describe("DR election priority (0 = never DR)"),
+      type: z88.enum(["broadcast", "ptp", "nbma", "ptmp", "virtual-link"]).optional(),
+      passive: z88.boolean().optional(),
+      hello_interval: z88.string().optional().describe('e.g. "10s"'),
+      dead_interval: z88.string().optional().describe('e.g. "40s"'),
+      retransmit_interval: z88.string().optional().describe('Interval between LSA retransmissions, e.g. "5s"'),
+      transmit_delay: z88.string().optional().describe('Estimated LSA transmit delay, e.g. "1s"'),
+      instance_id: z88.number().int().optional().describe("OSPF instance-id carried in hello packets"),
+      prefix_list: z88.string().optional().describe("Prefix-list name filtering which connected networks are advertised"),
+      vlink_neighbor_id: z88.string().optional().describe("Virtual-link remote router-id (type=virtual-link)"),
+      vlink_transit_area: z88.string().optional().describe("Transit area the virtual-link traverses (type=virtual-link)"),
+      auth: z88.enum(["simple", "md5", "sha1", "sha256", "sha384", "sha512"]).optional(),
+      auth_id: z88.number().int().optional().describe("Key id for keyed authentication"),
+      auth_key: z88.string().optional().describe("Authentication key/password"),
+      comment: z88.string().optional(),
+      disabled: z88.boolean().default(false)
     },
     async handler(a, ctx) {
       ctx.info(`Adding OSPF interface template for area ${a.area}`);
@@ -17896,7 +18355,7 @@ ${result}`;
     title: "Remove OSPF Interface Template",
     annotations: DESTRUCTIVE,
     description: "Remove an OSPF interface template (`/routing ospf interface-template remove`) by its `.id` \u2014 " + "use list_ospf_interface_templates to obtain the id (e.g. '*2'). " + "Removing a template stops OSPF on all matched interfaces; existing adjacencies will drop immediately.",
-    inputSchema: { template_id: z87.string().describe('Template id, e.g. "*2"') },
+    inputSchema: { template_id: z88.string().describe('Template id, e.g. "*2"') },
     async handler(a, ctx) {
       ctx.info(`Removing OSPF interface template ${a.template_id}`);
       const result = await executeMikrotikCommand(`/routing ospf interface-template remove ${a.template_id}`, ctx);
@@ -17928,7 +18387,7 @@ ${result}`;
     annotations: READ,
     description: "List the OSPF link-state database (`/routing ospf lsa`) \u2014 every LSA the router holds, by type " + "(Router/Network/Summary/ASBR-Summary/External/NSSA/\u2026), area, and originating router-id. " + "Read-only \u2014 used to inspect topology, verify summarisation (Type-3 LSAs), confirm external " + "redistribution (Type-5/Type-7), and diagnose flooding or database synchronisation problems. " + "Filter to a single area with `area_filter`. " + "For adjacency state use list_ospf_neighbors; for instance/area config use list_ospf_instances.",
     inputSchema: {
-      area_filter: z87.string().optional().describe("Show only LSAs for this area")
+      area_filter: z88.string().optional().describe("Show only LSAs for this area")
     },
     async handler(a, ctx) {
       ctx.info("Listing OSPF LSAs");
@@ -17946,7 +18405,7 @@ ${result}`;
 ];
 
 // src/tools/routing-pimsm.ts
-import { z as z88 } from "zod";
+import { z as z89 } from "zod";
 var UNSUPPORTED9 = "PIM-SM is not available on this device (requires RouterOS v7 with the routing/multicast package).";
 var routingPimsmTools = [
   defineTool({
@@ -17970,20 +18429,20 @@ ${result}`;
     annotations: WRITE,
     description: "Create a PIM-SM protocol instance (`/routing pimsm instance`). An instance is required before any " + "interface templates or static RPs can be added \u2014 it anchors the address family (ipv4/ipv6) and VRF " + "that multicast routing runs in. " + "Once created, bind interfaces with add_pimsm_interface_template and add RPs with add_pimsm_rp. " + "Returns the detail of the newly created instance including its name and settings.",
     inputSchema: {
-      name: z88.string().describe("Unique instance name"),
-      afi: z88.enum(["ipv4", "ipv6"]).default("ipv4").describe("Address family"),
-      vrf: z88.string().optional(),
-      rp_set: z88.string().optional().describe("Static RP-set name, if used"),
-      ssm_range: z88.string().optional().describe("Source-Specific Multicast group range(s) for this instance"),
-      rp_hash_mask_length: z88.number().int().optional().describe("RP hash mask length for group-to-RP mapping"),
-      rp_static_override: z88.boolean().optional().describe("Static RP entries override dynamically learned (BSR) RPs"),
-      switch_to_spt: z88.boolean().optional().describe("Switch from the shared (RP) tree to the shortest-path tree"),
-      switch_to_spt_bytes: z88.number().int().optional().describe("Traffic threshold in bytes before switching to the SPT"),
-      switch_to_spt_interval: z88.string().optional().describe('SPT switchover measurement interval, e.g. "1m"'),
-      bsm_forward_back: z88.boolean().optional().describe("Forward bootstrap (BSM) messages back out the receiving interface"),
-      crp_advertise_contained: z88.boolean().optional().describe("Candidate-RP advertises only contained group ranges"),
-      comment: z88.string().optional(),
-      disabled: z88.boolean().default(false)
+      name: z89.string().describe("Unique instance name"),
+      afi: z89.enum(["ipv4", "ipv6"]).default("ipv4").describe("Address family"),
+      vrf: z89.string().optional(),
+      rp_set: z89.string().optional().describe("Static RP-set name, if used"),
+      ssm_range: z89.string().optional().describe("Source-Specific Multicast group range(s) for this instance"),
+      rp_hash_mask_length: z89.number().int().optional().describe("RP hash mask length for group-to-RP mapping"),
+      rp_static_override: z89.boolean().optional().describe("Static RP entries override dynamically learned (BSR) RPs"),
+      switch_to_spt: z89.boolean().optional().describe("Switch from the shared (RP) tree to the shortest-path tree"),
+      switch_to_spt_bytes: z89.number().int().optional().describe("Traffic threshold in bytes before switching to the SPT"),
+      switch_to_spt_interval: z89.string().optional().describe('SPT switchover measurement interval, e.g. "1m"'),
+      bsm_forward_back: z89.boolean().optional().describe("Forward bootstrap (BSM) messages back out the receiving interface"),
+      crp_advertise_contained: z89.boolean().optional().describe("Candidate-RP advertises only contained group ranges"),
+      comment: z89.string().optional(),
+      disabled: z89.boolean().default(false)
     },
     async handler(a, ctx) {
       ctx.info(`Adding PIM-SM instance: ${a.name}`);
@@ -18005,7 +18464,7 @@ ${details}`;
     annotations: DESTRUCTIVE,
     description: "Remove a PIM-SM protocol instance (`/routing pimsm instance`) by name, tearing down all multicast " + "routing for that address family and VRF. " + "Use list_pimsm_instances to obtain the exact instance name. " + "To remove only an interface binding without deleting the instance use remove_pimsm_interface_template; " + "to remove only an RP entry use remove_pimsm_rp. " + "Confirms success or returns the RouterOS error on failure.",
     inputSchema: {
-      name: z88.string().describe("PIM-SM instance name to remove")
+      name: z89.string().describe("PIM-SM instance name to remove")
     },
     async handler(a, ctx) {
       ctx.info(`Removing PIM-SM instance: ${a.name}`);
@@ -18038,18 +18497,18 @@ ${result}`;
     annotations: WRITE,
     description: "Activate PIM-SM on one or more interfaces by creating an interface template (`/routing pimsm interface-template`). " + "Binds a physical or logical interface (or interface-list) to an existing PIM-SM instance and sets " + 'DR election priority and hello interval (e.g. hello_period="30s"). ' + "Requires the parent instance to exist first \u2014 use add_pimsm_instance. " + "To configure static RPs for that instance use add_pimsm_rp instead. " + "Returns the new template's `.id` (e.g. '*1') if RouterOS echoes it back from the add command, " + "or a plain success message; use list_pimsm_interface_templates to look it up afterwards.",
     inputSchema: {
-      instance: z88.string().describe("PIM-SM instance name"),
-      interfaces: z88.string().describe("Interface or interface-list name"),
-      priority: z88.number().int().optional().describe("DR election priority"),
-      hello_period: z88.string().optional().describe('Hello interval, e.g. "30s"'),
-      hello_delay: z88.string().optional().describe('Max random delay before the first Hello, e.g. "5s"'),
-      join_prune_period: z88.string().optional().describe('Interval between periodic Join/Prune messages, e.g. "1m"'),
-      join_tracking_support: z88.boolean().optional().describe("Enable explicit Join/Prune tracking support"),
-      override_interval: z88.string().optional().describe('Randomized Join override interval, e.g. "2s500ms"'),
-      propagation_delay: z88.string().optional().describe('Expected link propagation delay, e.g. "500ms"'),
-      source_addresses: z88.string().optional().describe("Source IP address(es) used for PIM messages on these interfaces"),
-      comment: z88.string().optional(),
-      disabled: z88.boolean().default(false)
+      instance: z89.string().describe("PIM-SM instance name"),
+      interfaces: z89.string().describe("Interface or interface-list name"),
+      priority: z89.number().int().optional().describe("DR election priority"),
+      hello_period: z89.string().optional().describe('Hello interval, e.g. "30s"'),
+      hello_delay: z89.string().optional().describe('Max random delay before the first Hello, e.g. "5s"'),
+      join_prune_period: z89.string().optional().describe('Interval between periodic Join/Prune messages, e.g. "1m"'),
+      join_tracking_support: z89.boolean().optional().describe("Enable explicit Join/Prune tracking support"),
+      override_interval: z89.string().optional().describe('Randomized Join override interval, e.g. "2s500ms"'),
+      propagation_delay: z89.string().optional().describe('Expected link propagation delay, e.g. "500ms"'),
+      source_addresses: z89.string().optional().describe("Source IP address(es) used for PIM messages on these interfaces"),
+      comment: z89.string().optional(),
+      disabled: z89.boolean().default(false)
     },
     async handler(a, ctx) {
       ctx.info(`Adding PIM-SM interface template for instance ${a.instance}`);
@@ -18068,7 +18527,7 @@ ${result}`;
     title: "Remove PIM-SM Interface Template",
     annotations: DESTRUCTIVE,
     description: "Remove a PIM-SM interface template (`/routing pimsm interface-template`) by its `.id`, deactivating PIM " + "on the interfaces it covered without removing the parent instance. " + "The template_id (e.g. '*1') comes from list_pimsm_interface_templates. " + "To tear down the entire PIM instance use remove_pimsm_instance; " + "to remove a static RP entry use remove_pimsm_rp. " + "Confirms success or returns the RouterOS error on failure.",
-    inputSchema: { template_id: z88.string().describe('Template id, e.g. "*1"') },
+    inputSchema: { template_id: z89.string().describe('Template id, e.g. "*1"') },
     async handler(a, ctx) {
       ctx.info(`Removing PIM-SM interface template ${a.template_id}`);
       const result = await executeMikrotikCommand(`/routing pimsm interface-template remove ${a.template_id}`, ctx);
@@ -18100,11 +18559,11 @@ ${result}`;
     annotations: WRITE,
     description: "Register a static Rendezvous Point (RP) for a multicast group range (`/routing pimsm rp`). Tells " + "PIM-SM routers which IP address is the root of the shared distribution tree for a given multicast " + "prefix. The group field accepts a multicast prefix e.g. '239.0.0.0/8'; omit to cover the default " + "multicast range. Requires the target instance to exist \u2014 use add_pimsm_instance first. " + "To enable PIM on interfaces (not configure an RP) use add_pimsm_interface_template. " + "Returns a success message; use list_pimsm_rps to retrieve the new entry's `.id`.",
     inputSchema: {
-      instance: z88.string().describe("PIM-SM instance name"),
-      address: z88.string().describe("RP IP address"),
-      group: z88.string().optional().describe('Multicast group range, e.g. "239.0.0.0/8"'),
-      comment: z88.string().optional(),
-      disabled: z88.boolean().default(false)
+      instance: z89.string().describe("PIM-SM instance name"),
+      address: z89.string().describe("RP IP address"),
+      group: z89.string().optional().describe('Multicast group range, e.g. "239.0.0.0/8"'),
+      comment: z89.string().optional(),
+      disabled: z89.boolean().default(false)
     },
     async handler(a, ctx) {
       ctx.info(`Adding PIM-SM RP ${a.address}`);
@@ -18122,7 +18581,7 @@ ${result}`;
     title: "Remove PIM-SM Rendezvous Point",
     annotations: DESTRUCTIVE,
     description: "Remove a static PIM-SM Rendezvous Point entry (`/routing pimsm rp`) by its `.id`, stopping the router " + "from treating that address as the shared-tree root for the associated multicast group range. " + "The rp_id (e.g. '*1') comes from list_pimsm_rps. " + "To remove an interface template instead use remove_pimsm_interface_template; " + "to tear down the whole PIM instance use remove_pimsm_instance. " + "Confirms success or returns the RouterOS error on failure.",
-    inputSchema: { rp_id: z88.string().describe('RP id, e.g. "*1"') },
+    inputSchema: { rp_id: z89.string().describe('RP id, e.g. "*1"') },
     async handler(a, ctx) {
       ctx.info(`Removing PIM-SM RP ${a.rp_id}`);
       const result = await executeMikrotikCommand(`/routing pimsm rp remove ${a.rp_id}`, ctx);
@@ -18151,7 +18610,7 @@ ${result}`;
 ];
 
 // src/tools/routing-rip.ts
-import { z as z89 } from "zod";
+import { z as z90 } from "zod";
 var UNSUPPORTED10 = "RIP is not available on this device (requires RouterOS v7 with the routing package).";
 var routingRipTools = [
   defineTool({
@@ -18175,16 +18634,16 @@ ${result}`;
     annotations: WRITE,
     description: "Create a RIP process instance (`/routing rip instance add`) \u2014 the top-level RIPv2 process object that " + "governs route redistribution and filter chains. Required before attaching interfaces with " + 'add_rip_interface_template. `redistribute` is a comma-separated list (e.g. "connected,static,ospf,bgp"); ' + "`originate_default` accepts never, if-installed, or always; `router_id` accepts an IPv4 address, 'main', " + "or a /routing id name; filter chains reference /routing filter. For OSPF use the OSPF tools; for BGP use " + "add_bgp_connection. Returns the created instance's detail including its name. Requires RouterOS v7 with " + "the routing package.",
     inputSchema: {
-      name: z89.string().describe("Unique instance name"),
-      router_id: z89.string().optional().describe("IPv4 address, 'main', or a /routing id name"),
-      vrf: z89.string().optional(),
-      routing_table: z89.string().optional().describe("Routing table to install routes into"),
-      redistribute: z89.string().optional().describe('Comma list, e.g. "connected,static"'),
-      in_filter_chain: z89.string().optional(),
-      out_filter_chain: z89.string().optional(),
-      originate_default: z89.string().optional().describe("never, if-installed, or always"),
-      comment: z89.string().optional(),
-      disabled: z89.boolean().default(false)
+      name: z90.string().describe("Unique instance name"),
+      router_id: z90.string().optional().describe("IPv4 address, 'main', or a /routing id name"),
+      vrf: z90.string().optional(),
+      routing_table: z90.string().optional().describe("Routing table to install routes into"),
+      redistribute: z90.string().optional().describe('Comma list, e.g. "connected,static"'),
+      in_filter_chain: z90.string().optional(),
+      out_filter_chain: z90.string().optional(),
+      originate_default: z90.string().optional().describe("never, if-installed, or always"),
+      comment: z90.string().optional(),
+      disabled: z90.boolean().default(false)
     },
     async handler(a, ctx) {
       ctx.info(`Adding RIP instance: ${a.name}`);
@@ -18206,15 +18665,15 @@ ${details}`;
     annotations: WRITE_IDEMPOTENT,
     description: "Modify an existing RIP process instance (`/routing rip instance set`) identified by its name. Use to " + "change redistribution policy, filter chains, router-id, or enabled/disabled state without recreating the " + "instance. Obtain the name from list_rip_instances. For creating a new instance use add_rip_instance; for " + "removing one use remove_rip_instance. Returns the updated instance's detail. Requires RouterOS v7 with " + "the routing package.",
     inputSchema: {
-      name: z89.string().describe("Existing RIP instance name"),
-      router_id: z89.string().optional(),
-      routing_table: z89.string().optional().describe("Routing table to install routes into"),
-      redistribute: z89.string().optional(),
-      in_filter_chain: z89.string().optional(),
-      out_filter_chain: z89.string().optional(),
-      originate_default: z89.string().optional(),
-      comment: z89.string().optional(),
-      disabled: z89.boolean().optional()
+      name: z90.string().describe("Existing RIP instance name"),
+      router_id: z90.string().optional(),
+      routing_table: z90.string().optional().describe("Routing table to install routes into"),
+      redistribute: z90.string().optional(),
+      in_filter_chain: z90.string().optional(),
+      out_filter_chain: z90.string().optional(),
+      originate_default: z90.string().optional(),
+      comment: z90.string().optional(),
+      disabled: z90.boolean().optional()
     },
     async handler(a, ctx) {
       ctx.info(`Updating RIP instance: ${a.name}`);
@@ -18243,7 +18702,7 @@ ${details}`;
     title: "Remove RIP Instance",
     annotations: DESTRUCTIVE,
     description: "Delete a RIP process instance (`/routing rip instance remove`) by its name, removing the process and all " + "associated routing state. Obtain the name from list_rip_instances. Remove associated interface templates " + "first with remove_rip_interface_template to avoid orphaned entries. To disable without deleting use " + "update_rip_instance with disabled=true. Requires RouterOS v7 with the routing package.",
-    inputSchema: { name: z89.string().describe("RIP instance name to remove") },
+    inputSchema: { name: z90.string().describe("RIP instance name to remove") },
     async handler(a, ctx) {
       ctx.info(`Removing RIP instance: ${a.name}`);
       const result = await executeMikrotikCommand(`/routing rip instance remove [find name="${a.name}"]`, ctx);
@@ -18275,14 +18734,14 @@ ${result}`;
     annotations: WRITE,
     description: "Bind interfaces to a RIP instance (`/routing rip interface-template add`) so they participate in RIP " + "route advertisement. The `instance` must already exist \u2014 create it first with add_rip_instance. " + "`passive=true` suppresses outbound RIP updates while still receiving; `key_chain` names a /routing " + "key-chain for MD5 authentication. For static unicast neighbors on non-broadcast links use " + "add_rip_static_neighbor instead. Returns the new template's .id. Requires RouterOS v7 with the " + "routing package.",
     inputSchema: {
-      instance: z89.string().describe("RIP instance name"),
-      interfaces: z89.string().describe("Interface or interface-list name"),
-      passive: z89.boolean().optional(),
-      split_horizon: z89.boolean().optional().describe("Enable split-horizon loop prevention"),
-      poison_reverse: z89.boolean().optional().describe("Advertise back with infinite metric"),
-      key_chain: z89.string().optional().describe("Key-chain name for authentication"),
-      comment: z89.string().optional(),
-      disabled: z89.boolean().default(false)
+      instance: z90.string().describe("RIP instance name"),
+      interfaces: z90.string().describe("Interface or interface-list name"),
+      passive: z90.boolean().optional(),
+      split_horizon: z90.boolean().optional().describe("Enable split-horizon loop prevention"),
+      poison_reverse: z90.boolean().optional().describe("Advertise back with infinite metric"),
+      key_chain: z90.string().optional().describe("Key-chain name for authentication"),
+      comment: z90.string().optional(),
+      disabled: z90.boolean().default(false)
     },
     async handler(a, ctx) {
       ctx.info(`Adding RIP interface template for instance ${a.instance}`);
@@ -18308,7 +18767,7 @@ ${result}`;
     title: "Remove RIP Interface Template",
     annotations: DESTRUCTIVE,
     description: "Remove a RIP interface template (`/routing rip interface-template remove`) by its `.id`, detaching the " + "bound interfaces from the RIP instance. Obtain the `.id` from list_rip_interface_templates. To re-configure " + "instead of removing, delete and recreate with add_rip_interface_template. Requires RouterOS v7 with the " + "routing package.",
-    inputSchema: { template_id: z89.string().describe('Template id, e.g. "*1"') },
+    inputSchema: { template_id: z90.string().describe('Template id, e.g. "*1"') },
     async handler(a, ctx) {
       ctx.info(`Removing RIP interface template ${a.template_id}`);
       const result = await executeMikrotikCommand(`/routing rip interface-template remove ${a.template_id}`, ctx);
@@ -18340,10 +18799,10 @@ ${result}`;
     annotations: WRITE,
     description: "Add a static RIP neighbor entry (`/routing rip static-neighbor add`) to unicast RIP updates to a specific " + "IPv4 address on non-broadcast or point-to-point links. Optionally scope to a specific RIP instance by name " + "(obtain from list_rip_instances). For multicast-reachable peers, binding an interface with " + "add_rip_interface_template is sufficient. Returns a confirmation message on success. Requires RouterOS v7 " + "with the routing package.",
     inputSchema: {
-      address: z89.string().describe("Neighbor IP address"),
-      instance: z89.string().optional().describe("RIP instance name"),
-      comment: z89.string().optional(),
-      disabled: z89.boolean().default(false)
+      address: z90.string().describe("Neighbor IP address"),
+      instance: z90.string().optional().describe("RIP instance name"),
+      comment: z90.string().optional(),
+      disabled: z90.boolean().default(false)
     },
     async handler(a, ctx) {
       ctx.info(`Adding RIP static neighbor ${a.address}`);
@@ -18362,7 +18821,7 @@ ${result}`;
     annotations: DESTRUCTIVE,
     description: "Delete a static RIP neighbor entry (`/routing rip static-neighbor remove`) by its `.id`, stopping unicast " + "RIP updates to that IPv4 peer. Obtain the `.id` from list_rip_static_neighbors. The link itself is " + "unaffected. Requires RouterOS v7 with the routing package.",
     inputSchema: {
-      neighbor_id: z89.string().describe('Static-neighbor id, e.g. "*1"')
+      neighbor_id: z90.string().describe('Static-neighbor id, e.g. "*1"')
     },
     async handler(a, ctx) {
       ctx.info(`Removing RIP static neighbor ${a.neighbor_id}`);
@@ -18392,7 +18851,7 @@ ${result}`;
 ];
 
 // src/tools/routing-rpki.ts
-import { z as z90 } from "zod";
+import { z as z91 } from "zod";
 var UNSUPPORTED11 = "RPKI is not available on this device (requires RouterOS v7 with the routing package).";
 var routingRpkiTools = [
   defineTool({
@@ -18401,7 +18860,7 @@ var routingRpkiTools = [
     annotations: READ,
     description: "Lists all RPKI RTR sessions (`/routing rpki print detail`) \u2014 each session is a connection to a validator " + "cache that streams Validated ROA Payloads (VRPs) for BGP Route Origin Validation. BGP route-policy filters " + "reference the session `group` name to mark prefixes valid/invalid/unknown. Use `add_rpki_session` to create " + "a session; for BGP peer configuration use `add_bgp_connection`. Returns connection status, group, address, " + "port, VRP counts, and refresh/expire state for each session; filtered to `group_filter` when supplied.",
     inputSchema: {
-      group_filter: z90.string().optional().describe("Show only sessions in this group")
+      group_filter: z91.string().optional().describe("Show only sessions in this group")
     },
     async handler(a, ctx) {
       ctx.info("Listing RPKI sessions");
@@ -18422,15 +18881,15 @@ ${result}`;
     annotations: WRITE,
     description: "Adds an RPKI RTR session (`/routing rpki add`) connecting to a validator cache for BGP Route Origin " + "Validation. The `group` name is what BGP route-policy filters match against to mark prefixes " + "valid/invalid/unknown; `address`/`port` identify the RTR cache (port 8282 is the common default, 323 for " + 'RTR-over-TLS). Tune `refresh_interval`, `retry_interval`, and `expire_interval` (e.g. "10m", "30s", ' + '"2h") to control how frequently VRPs are pulled and when stale data is dropped. For BGP peer configuration ' + "use `add_bgp_connection`; to inspect existing sessions use `list_rpki_sessions`. Returns the new session `.id`.",
     inputSchema: {
-      group: z90.string().describe("RPKI group name referenced by BGP route filters"),
-      address: z90.string().describe("Validator (RTR cache) IP address or hostname"),
-      port: z90.number().int().default(8282).describe("RTR port, e.g. 8282 or 323"),
-      refresh_interval: z90.string().optional().describe('e.g. "10m"'),
-      expire_interval: z90.string().optional().describe('e.g. "2h"'),
-      retry_interval: z90.string().optional().describe('e.g. "30s"'),
-      vrf: z90.string().optional(),
-      comment: z90.string().optional(),
-      disabled: z90.boolean().default(false)
+      group: z91.string().describe("RPKI group name referenced by BGP route filters"),
+      address: z91.string().describe("Validator (RTR cache) IP address or hostname"),
+      port: z91.number().int().default(8282).describe("RTR port, e.g. 8282 or 323"),
+      refresh_interval: z91.string().optional().describe('e.g. "10m"'),
+      expire_interval: z91.string().optional().describe('e.g. "2h"'),
+      retry_interval: z91.string().optional().describe('e.g. "30s"'),
+      vrf: z91.string().optional(),
+      comment: z91.string().optional(),
+      disabled: z91.boolean().default(false)
     },
     async handler(a, ctx) {
       ctx.info(`Adding RPKI session group=${a.group} -> ${a.address}:${a.port}`);
@@ -18450,14 +18909,14 @@ ${result}`;
     annotations: WRITE_IDEMPOTENT,
     description: "Modifies an existing RPKI RTR session (`/routing rpki set`) by its `.id`. Use `list_rpki_sessions` to " + 'obtain the `session_id` (e.g. "*1"). Updatable fields include `address`, `port`, interval timings ' + '(`refresh_interval`, `expire_interval`, `retry_interval`, e.g. "10m", "30s", "2h"), `comment`, and ' + "`disabled`. To toggle enabled/disabled only, prefer `set_rpki_session_enabled`. Returns the updated session " + "detail.",
     inputSchema: {
-      session_id: z90.string().describe('Session id, e.g. "*1"'),
-      address: z90.string().optional(),
-      port: z90.number().int().optional(),
-      refresh_interval: z90.string().optional(),
-      expire_interval: z90.string().optional(),
-      retry_interval: z90.string().optional(),
-      comment: z90.string().optional(),
-      disabled: z90.boolean().optional()
+      session_id: z91.string().describe('Session id, e.g. "*1"'),
+      address: z91.string().optional(),
+      port: z91.number().int().optional(),
+      refresh_interval: z91.string().optional(),
+      expire_interval: z91.string().optional(),
+      retry_interval: z91.string().optional(),
+      comment: z91.string().optional(),
+      disabled: z91.boolean().optional()
     },
     async handler(a, ctx) {
       ctx.info(`Updating RPKI session ${a.session_id}`);
@@ -18486,7 +18945,7 @@ ${details}`;
     title: "Remove RPKI Session",
     annotations: DESTRUCTIVE,
     description: "Permanently removes an RPKI RTR session (`/routing rpki remove`) by its `.id`. Use `list_rpki_sessions` " + 'to obtain the `session_id` (e.g. "*1"). After removal, BGP routes that matched this session\'s `group` ' + "fall back to validation state 'unknown'; ensure BGP filters are updated before removing. To deactivate " + "without deleting, use `set_rpki_session_enabled` instead.",
-    inputSchema: { session_id: z90.string().describe('Session id, e.g. "*1"') },
+    inputSchema: { session_id: z91.string().describe('Session id, e.g. "*1"') },
     async handler(a, ctx) {
       ctx.info(`Removing RPKI session ${a.session_id}`);
       const result = await executeMikrotikCommand(`/routing rpki remove ${a.session_id}`, ctx);
@@ -18503,8 +18962,8 @@ ${details}`;
     annotations: WRITE_IDEMPOTENT,
     description: "Toggles an RPKI RTR session active or inactive (`/routing rpki set disabled=yes/no`) by its `.id`. Use " + '`list_rpki_sessions` to obtain the `session_id` (e.g. "*1"). Disabling suspends the RTR connection and ' + "stops VRP updates without deleting the session; BGP routes referencing its group fall back to 'unknown' " + "while disabled. To change address, port, or intervals use `update_rpki_session`; to delete the session " + "permanently use `remove_rpki_session`.",
     inputSchema: {
-      session_id: z90.string().describe('Session id, e.g. "*1"'),
-      enabled: z90.boolean()
+      session_id: z91.string().describe('Session id, e.g. "*1"'),
+      enabled: z91.boolean()
     },
     async handler(a, ctx) {
       ctx.info(`Setting RPKI session ${a.session_id} enabled=${a.enabled}`);
@@ -18519,7 +18978,7 @@ ${details}`;
 ];
 
 // src/tools/routing-settings.ts
-import { z as z91 } from "zod";
+import { z as z92 } from "zod";
 var UNSUPPORTED12 = "Routing settings are not available on this device (requires RouterOS v7 with the routing package).";
 var HASH_POLICY = ["l3", "l3-inner", "l4"];
 var routingSettingsTools = [
@@ -18544,9 +19003,9 @@ ${result}`;
     annotations: WRITE_IDEMPOTENT,
     description: "Sets global routing daemon settings (`/routing settings set`) on RouterOS v7 \u2014 " + "controls ECMP/multipath hash policy and VRF-as-interface behavior. " + "`ipv4_multipath_hash_policy` and `ipv6_multipath_hash_policy` choose how equal-cost next-hops are selected: " + "`l3` = src/dst IP only, `l3-inner` = inner packet header for tunnelled traffic, `l4` = include L4 src/dst ports. " + "`ipv4_vrf_as_interface` exposes VRFs as interfaces to the rest of the config. " + "For modifying individual IPv4 route entries use update_route; " + "for policy-based routing rules use update_routing_rule. " + "Returns the full /routing settings after applying changes.",
     inputSchema: {
-      ipv4_multipath_hash_policy: z91.enum(HASH_POLICY).optional(),
-      ipv6_multipath_hash_policy: z91.enum(HASH_POLICY).optional(),
-      ipv4_vrf_as_interface: z91.boolean().optional()
+      ipv4_multipath_hash_policy: z92.enum(HASH_POLICY).optional(),
+      ipv6_multipath_hash_policy: z92.enum(HASH_POLICY).optional(),
+      ipv4_vrf_as_interface: z92.boolean().optional()
     },
     async handler(a, ctx) {
       ctx.info("Updating routing settings");
@@ -18568,7 +19027,7 @@ ${details}`;
 ];
 
 // src/tools/routing-rule.ts
-import { z as z92 } from "zod";
+import { z as z93 } from "zod";
 var UNSUPPORTED13 = "Routing rules are not available on this device (requires RouterOS v7 with the routing package).";
 var ACTIONS = ["lookup", "lookup-only-in-table", "drop", "unreachable"];
 var routingRuleTools = [
@@ -18578,8 +19037,8 @@ var routingRuleTools = [
     annotations: READ,
     description: "List policy routing rules (`/routing rule`) \u2014 the ordered table that steers packets into specific " + "routing tables based on src/dst prefix, incoming interface, or routing-mark. Rules are evaluated " + "top-down; requires RouterOS v7 with the routing package. For static routes in the main table use " + "`list_routes`; for IPv6 static routes use `list_ipv6_routes`. Returns all matching rules with full " + "detail, including `.id` values needed by `get_routing_rule`, `update_routing_rule`, " + "`remove_routing_rule`, and `set_routing_rule_enabled`.",
     inputSchema: {
-      table_filter: z92.string().optional().describe("Match rules targeting this table"),
-      disabled_only: z92.boolean().default(false)
+      table_filter: z93.string().optional().describe("Match rules targeting this table"),
+      disabled_only: z93.boolean().default(false)
     },
     async handler(a, ctx) {
       ctx.info("Listing routing rules");
@@ -18602,7 +19061,7 @@ ${result}`;
     annotations: READ,
     description: "Fetch full detail for a single policy routing rule (`/routing rule`) by its `.id` " + "(obtain the `.id` from `list_routing_rules`). Requires RouterOS v7 with the routing package. " + "For static route details use `get_route`. Returns the rule's complete property set, or a not-found " + "message if the id does not exist.",
     inputSchema: {
-      rule_id: z92.string().describe('Rule id from list output, e.g. "*3"')
+      rule_id: z93.string().describe('Rule id from list output, e.g. "*3"')
     },
     async handler(a, ctx) {
       ctx.info(`Getting routing rule: ${a.rule_id}`);
@@ -18620,16 +19079,16 @@ ${result}`;
     annotations: WRITE,
     description: "Add a policy routing rule (`/routing rule add`) to steer matched packets into a specific routing table. " + "Rules are evaluated top-down: `action=lookup` consults `table` then falls through to lower-priority " + "tables on no match; `lookup-only-in-table` stops at that table; `drop`/`unreachable` discard the packet. " + 'Match on `src_address` (e.g. `"192.168.10.0/24"`), `dst_address`, `routing_mark`, or incoming ' + "`interface`. Use `place_before` with a rule `.id` to control insertion order. Requires RouterOS v7 with " + "the routing package. For static routes in the main or a named table use `add_route`; for IPv6 static " + "routes use `add_ipv6_route`. Returns the new rule's `.id`.",
     inputSchema: {
-      action: z92.enum(ACTIONS).default("lookup"),
-      table: z92.string().optional().describe("Target routing table for lookup actions"),
-      src_address: z92.string().optional().describe('Source prefix, e.g. "192.168.10.0/24"'),
-      dst_address: z92.string().optional().describe("Destination prefix"),
-      routing_mark: z92.string().optional().describe("Match packets carrying this routing-mark"),
-      interface: z92.string().optional().describe("Match this incoming interface"),
-      min_prefix: z92.number().int().optional(),
-      comment: z92.string().optional(),
-      disabled: z92.boolean().default(false),
-      place_before: z92.string().optional().describe("Insert before this rule id to control ordering")
+      action: z93.enum(ACTIONS).default("lookup"),
+      table: z93.string().optional().describe("Target routing table for lookup actions"),
+      src_address: z93.string().optional().describe('Source prefix, e.g. "192.168.10.0/24"'),
+      dst_address: z93.string().optional().describe("Destination prefix"),
+      routing_mark: z93.string().optional().describe("Match packets carrying this routing-mark"),
+      interface: z93.string().optional().describe("Match this incoming interface"),
+      min_prefix: z93.number().int().optional(),
+      comment: z93.string().optional(),
+      disabled: z93.boolean().default(false),
+      place_before: z93.string().optional().describe("Insert before this rule id to control ordering")
     },
     async handler(a, ctx) {
       ctx.info(`Adding routing rule: action=${a.action}, table=${a.table}`);
@@ -18649,16 +19108,16 @@ ${result}`;
     annotations: WRITE_IDEMPOTENT,
     description: "Modify an existing policy routing rule (`/routing rule set`) by its `.id` (obtain from `list_routing_rules`). " + 'Pass `""` for `src_address`, `dst_address`, `routing_mark`, `interface`, or `table` to clear that field. ' + "Requires RouterOS v7 with the routing package. For updating static routes use `update_route`. " + "Returns the rule's updated detail after applying changes.",
     inputSchema: {
-      rule_id: z92.string().describe('Rule id, e.g. "*3"'),
-      action: z92.enum(ACTIONS).optional(),
-      table: z92.string().optional(),
-      src_address: z92.string().optional(),
-      dst_address: z92.string().optional(),
-      routing_mark: z92.string().optional(),
-      interface: z92.string().optional(),
-      min_prefix: z92.number().int().optional(),
-      comment: z92.string().optional(),
-      disabled: z92.boolean().optional()
+      rule_id: z93.string().describe('Rule id, e.g. "*3"'),
+      action: z93.enum(ACTIONS).optional(),
+      table: z93.string().optional(),
+      src_address: z93.string().optional(),
+      dst_address: z93.string().optional(),
+      routing_mark: z93.string().optional(),
+      interface: z93.string().optional(),
+      min_prefix: z93.number().int().optional(),
+      comment: z93.string().optional(),
+      disabled: z93.boolean().optional()
     },
     async handler(a, ctx) {
       ctx.info(`Updating routing rule: ${a.rule_id}`);
@@ -18701,7 +19160,7 @@ ${details}`;
     title: "Remove Policy Routing Rule",
     annotations: DESTRUCTIVE,
     description: "Delete a policy routing rule (`/routing rule remove`) by its `.id` (obtain from `list_routing_rules`). " + "This is irreversible \u2014 confirm the correct rule with `get_routing_rule` before removing. Requires RouterOS v7 " + "with the routing package. For removing static routes use `remove_route`. Returns a confirmation message on success.",
-    inputSchema: { rule_id: z92.string().describe('Rule id, e.g. "*3"') },
+    inputSchema: { rule_id: z93.string().describe('Rule id, e.g. "*3"') },
     async handler(a, ctx) {
       ctx.info(`Removing routing rule: ${a.rule_id}`);
       const result = await executeMikrotikCommand(`/routing rule remove ${a.rule_id}`, ctx);
@@ -18718,8 +19177,8 @@ ${details}`;
     annotations: WRITE_IDEMPOTENT,
     description: "Enable or disable a policy routing rule (`/routing rule set disabled=yes/no`) by its `.id` " + "(obtain from `list_routing_rules`). Set `enabled=true` to activate or `enabled=false` to temporarily " + "suspend the rule without deleting it. Requires RouterOS v7 with the routing package. To permanently " + "delete a rule use `remove_routing_rule`. Returns a confirmation of the new enabled/disabled state.",
     inputSchema: {
-      rule_id: z92.string().describe('Rule id, e.g. "*3"'),
-      enabled: z92.boolean().describe("true to enable, false to disable")
+      rule_id: z93.string().describe('Rule id, e.g. "*3"'),
+      enabled: z93.boolean().describe("true to enable, false to disable")
     },
     async handler(a, ctx) {
       ctx.info(`Setting routing rule ${a.rule_id} enabled=${a.enabled}`);
@@ -18734,7 +19193,7 @@ ${details}`;
 ];
 
 // src/tools/routing-table.ts
-import { z as z93 } from "zod";
+import { z as z94 } from "zod";
 var UNSUPPORTED14 = "Routing tables are not available on this device (requires RouterOS v7 with the routing package).";
 function fibToken(fib, onSet = false) {
   if (fib === undefined)
@@ -18753,7 +19212,7 @@ var routingTableTools = [
     annotations: READ,
     description: "Lists named routing table definitions (`/routing table print detail`) \u2014 the RIB (Routing Information Base) " + "containers used by RouterOS v7 policy-based routing. Each table isolates a routing domain; `fib=true` means its " + "routes are installed into the forwarding plane. The built-in `main` table is always present. " + "For actual IPv4 routes stored inside a table use `list_routes`; for IPv6 routes use `list_ipv6_routes`; " + "for the policy rules that steer packets into a table use `list_routing_rules`. " + "Returns all table definitions with name, fib flag, disabled state, and comment; " + "supports optional `name_filter` substring match.",
     inputSchema: {
-      name_filter: z93.string().optional().describe("Substring match on table name")
+      name_filter: z94.string().optional().describe("Substring match on table name")
     },
     async handler(a, ctx) {
       ctx.info("Listing routing tables");
@@ -18771,7 +19230,7 @@ ${result}`;
     title: "Get Routing Table Definition",
     annotations: READ,
     description: "Gets the definition of a single named routing table (`/routing table print detail where name=\u2026`) \u2014 " + "inspects whether `fib` is active and whether the table is disabled. " + "For listing all tables use `list_routing_tables`. " + "For the IPv4 routes stored inside a table use `list_routes`; for IPv6 routes use `list_ipv6_routes`. " + "Returns the full detail record for the named table, or a not-found message if the name does not exist.",
-    inputSchema: { name: z93.string().describe("Routing table name") },
+    inputSchema: { name: z94.string().describe("Routing table name") },
     async handler(a, ctx) {
       ctx.info(`Getting routing table: ${a.name}`);
       const result = await executeMikrotikCommand(`/routing table print detail where name="${a.name}"`, ctx);
@@ -18788,10 +19247,10 @@ ${result}`;
     annotations: WRITE,
     description: "Creates a named routing table (`/routing table add`) on RouterOS v7 \u2014 establishes a new RIB container " + "for policy-based routing. `fib` defaults to `true`, which installs the table's routes into the forwarding plane; " + "set `fib=false` to keep it RIB-only, used purely for lookups by routing rules/marks. " + "After creation, assign IPv4 routes to this table via `add_route` (set its `routing-table` argument); " + "for IPv6 routes use `add_ipv6_route`. " + "For the policy rules that steer packets into a table use `list_routing_rules` / `update_routing_rule`. " + "To modify an existing table use `update_routing_table`. " + "Returns the new table's full detail record on success.",
     inputSchema: {
-      name: z93.string().describe("Unique table name, referenced by routes and routing rules"),
-      fib: z93.boolean().default(true).describe("Install routes into the FIB (forwarding plane)"),
-      comment: z93.string().optional(),
-      disabled: z93.boolean().default(false)
+      name: z94.string().describe("Unique table name, referenced by routes and routing rules"),
+      fib: z94.boolean().default(true).describe("Install routes into the FIB (forwarding plane)"),
+      comment: z94.string().optional(),
+      disabled: z94.boolean().default(false)
     },
     async handler(a, ctx) {
       ctx.info(`Adding routing table: ${a.name}`);
@@ -18813,10 +19272,10 @@ ${details}`;
     annotations: WRITE_IDEMPOTENT,
     description: "Modifies an existing routing table (`/routing table set [find name=\u2026]`) \u2014 changes its `fib` flag, " + "`comment`, or `disabled` state. " + "To create a new table use `add_routing_table`; to toggle only the enabled/disabled state use `set_routing_table_enabled`. " + "No-ops safely if no optional arguments are provided. " + "Returns the updated table's full detail record on success.",
     inputSchema: {
-      name: z93.string().describe("Existing routing table name"),
-      fib: z93.boolean().optional().describe("Install routes into the FIB"),
-      comment: z93.string().optional(),
-      disabled: z93.boolean().optional()
+      name: z94.string().describe("Existing routing table name"),
+      fib: z94.boolean().optional().describe("Install routes into the FIB"),
+      comment: z94.string().optional(),
+      disabled: z94.boolean().optional()
     },
     async handler(a, ctx) {
       ctx.info(`Updating routing table: ${a.name}`);
@@ -18846,7 +19305,7 @@ ${details}`;
     title: "Remove Routing Table Definition",
     annotations: DESTRUCTIVE,
     description: "Permanently deletes a named routing table (`/routing table remove [find name=\u2026]`). " + "The built-in `main` table cannot be removed. " + "Routes referencing this table should be removed first via `remove_route` to avoid orphaned entries. " + "To disable without deleting use `set_routing_table_enabled`; to modify properties use `update_routing_table`. " + "Confirms deletion by name on success.",
-    inputSchema: { name: z93.string().describe("Routing table name to remove") },
+    inputSchema: { name: z94.string().describe("Routing table name to remove") },
     async handler(a, ctx) {
       ctx.info(`Removing routing table: ${a.name}`);
       const result = await executeMikrotikCommand(`/routing table remove [find name="${a.name}"]`, ctx);
@@ -18863,8 +19322,8 @@ ${details}`;
     annotations: WRITE_IDEMPOTENT,
     description: "Enables or disables a named routing table (`/routing table set [find name=\u2026] disabled=yes/no`) without " + "removing it \u2014 a disabled table is inactive in the routing engine. " + "To permanently delete a table use `remove_routing_table`; to change other properties (fib, comment) use `update_routing_table`. " + "Pass `enabled=true` to enable, `enabled=false` to disable. " + "Confirms the new state by name on success.",
     inputSchema: {
-      name: z93.string().describe("Routing table name"),
-      enabled: z93.boolean().describe("true to enable, false to disable")
+      name: z94.string().describe("Routing table name"),
+      enabled: z94.boolean().describe("true to enable, false to disable")
     },
     async handler(a, ctx) {
       ctx.info(`Setting routing table ${a.name} enabled=${a.enabled}`);
@@ -18879,7 +19338,7 @@ ${details}`;
 ];
 
 // src/tools/dr-drill.ts
-import { z as z94 } from "zod";
+import { z as z95 } from "zod";
 function parsePingSummary(output) {
   const sent = output.match(/sent=(\d+)/)?.[1];
   const received = output.match(/received=(\d+)/)?.[1];
@@ -18899,11 +19358,11 @@ var drDrillTools = [
     annotations: DANGEROUS,
     description: "Rehearses a disaster safely: INSIDE SAFE MODE it disables a target (a WAN/tunnel interface, or " + "a route), pings `verify_host` to check the backup path actually carries traffic, then ROLLS " + "BACK \u2014 Safe Mode auto-reverts, so the change is never committed. Proves your failover works " + "without a real outage. Requires `confirm=true` to run (it briefly disrupts traffic on the " + "target); with confirm=false it just describes the drill. SSH-only (Safe Mode is unavailable on " + "MAC-Telnet). Returns whether connectivity held during the simulated failure.",
     inputSchema: {
-      target_type: z94.enum(["interface", "route"]).default("interface"),
-      target: z94.string().describe("Interface name (e.g. 'ether1-wan') or, for route, a find expression / .id"),
-      verify_host: z94.string().describe("Host to ping during the outage to confirm the backup path, e.g. '8.8.8.8'"),
-      ping_count: z94.number().int().min(1).max(50).default(5),
-      confirm: z94.boolean().default(false).describe("Must be true to actually run the drill")
+      target_type: z95.enum(["interface", "route"]).default("interface"),
+      target: z95.string().describe("Interface name (e.g. 'ether1-wan') or, for route, a find expression / .id"),
+      verify_host: z95.string().describe("Host to ping during the outage to confirm the backup path, e.g. '8.8.8.8'"),
+      ping_count: z95.number().int().min(1).max(50).default(5),
+      confirm: z95.boolean().default(false).describe("Must be true to actually run the drill")
     },
     async handler(a, ctx) {
       const disableCmd = a.target_type === "interface" ? `/interface disable "${a.target}"` : `/ip route disable [find ${a.target.startsWith("*") ? `.id=${a.target}` : a.target}]`;
@@ -18987,7 +19446,7 @@ var safeModeTools = [
 ];
 
 // src/tools/scheduler.ts
-import { z as z95 } from "zod";
+import { z as z96 } from "zod";
 var schedulerTools = [
   defineTool({
     name: "create_scheduler",
@@ -18995,14 +19454,14 @@ var schedulerTools = [
     annotations: WRITE,
     description: "Creates a scheduler entry (`/system scheduler add`) \u2014 time-driven automation that runs an inline script or calls a named script at a fixed interval or date/time. " + "Use this to trigger recurring or one-shot tasks without an interactive session. " + "For storing reusable scripts by name use add_script; to reference a stored script set on_event to its name. " + "interval accepts RouterOS duration strings like '00:05:00' (every 5 minutes); '0' means run once. " + "start_time accepts 'startup' or a wall-clock time like '12:00:00'; start_date accepts 'jan/01/2026'. " + "Returns the created entry's detail. To suspend without deleting use disable_scheduler; to re-activate use enable_scheduler.",
     inputSchema: {
-      name: z95.string().describe("Name for the scheduler entry"),
-      on_event: z95.string().describe("Script source to run on event (may contain spaces/semicolons)"),
-      interval: z95.string().optional().describe("Run interval, e.g. '00:05:00' (0 = run once)"),
-      start_time: z95.string().optional().describe("Start time, e.g. '12:00:00' or 'startup'"),
-      start_date: z95.string().optional().describe("Start date, e.g. 'jan/01/2026'"),
-      policy: z95.string().optional().describe("Permission policy list, e.g. 'read,write,test,policy'"),
-      comment: z95.string().optional(),
-      disabled: z95.boolean().default(false)
+      name: z96.string().describe("Name for the scheduler entry"),
+      on_event: z96.string().describe("Script source to run on event (may contain spaces/semicolons)"),
+      interval: z96.string().optional().describe("Run interval, e.g. '00:05:00' (0 = run once)"),
+      start_time: z96.string().optional().describe("Start time, e.g. '12:00:00' or 'startup'"),
+      start_date: z96.string().optional().describe("Start date, e.g. 'jan/01/2026'"),
+      policy: z96.string().optional().describe("Permission policy list, e.g. 'read,write,test,policy'"),
+      comment: z96.string().optional(),
+      disabled: z96.boolean().default(false)
     },
     async handler(a, ctx) {
       ctx.info(`Creating scheduler: name=${a.name}`);
@@ -19022,7 +19481,7 @@ ${details}` : "Scheduler creation completed but unable to verify.";
     annotations: READ,
     description: "Lists all scheduler entries (`/system scheduler print`) \u2014 every time-driven task configured on the device. " + "Optionally filters by partial name match via name_filter. " + "To retrieve full detail for a single entry use get_scheduler. " + "To list stored scripts (not schedulers) use list_scripts.",
     inputSchema: {
-      name_filter: z95.string().optional().describe("Partial name match")
+      name_filter: z96.string().optional().describe("Partial name match")
     },
     async handler(a, ctx) {
       ctx.info("Listing schedulers");
@@ -19040,7 +19499,7 @@ ${result}`;
     title: "Get Scheduler Entry Details",
     annotations: READ,
     description: "Retrieves full detail for a single scheduler entry (`/system scheduler print detail where name=...`). " + "Use this to inspect the on-event script, interval, next-run time, and run-count of one specific entry. " + "For all entries use list_schedulers. To look up stored system scripts use list_scripts.",
-    inputSchema: { name: z95.string() },
+    inputSchema: { name: z96.string() },
     async handler(a, ctx) {
       ctx.info(`Getting scheduler details: name=${a.name}`);
       const result = await executeMikrotikCommand(`/system scheduler print detail where name="${a.name}"`, ctx);
@@ -19054,7 +19513,7 @@ ${result}`;
     title: "Remove Scheduler Entry",
     annotations: DESTRUCTIVE,
     description: "Permanently removes a scheduler entry (`/system scheduler remove`) by name after verifying it exists. " + "Use this to delete a time-driven task from the device. " + "To suspend without deleting use disable_scheduler. " + "To remove a stored script (not a scheduler) use remove_script.",
-    inputSchema: { name: z95.string() },
+    inputSchema: { name: z96.string() },
     async handler(a, ctx) {
       ctx.info(`Removing scheduler: name=${a.name}`);
       const count = await executeMikrotikCommand(`/system scheduler print count-only where name="${a.name}"`, ctx);
@@ -19071,7 +19530,7 @@ ${result}`;
     title: "Enable Scheduler Entry",
     annotations: WRITE_IDEMPOTENT,
     description: "Enables a disabled scheduler entry (`/system scheduler enable`) by name, allowing it to fire again on its configured interval or schedule. " + "Idempotent \u2014 safe to call when already enabled. " + "To pause without deleting use disable_scheduler. To permanently delete use remove_scheduler.",
-    inputSchema: { name: z95.string() },
+    inputSchema: { name: z96.string() },
     async handler(a, ctx) {
       ctx.info(`Enabling scheduler: name=${a.name}`);
       const result = await executeMikrotikCommand(`/system scheduler enable [find name="${a.name}"]`, ctx);
@@ -19085,7 +19544,7 @@ ${result}`;
     title: "Disable Scheduler Entry",
     annotations: WRITE_IDEMPOTENT,
     description: "Disables an active scheduler entry (`/system scheduler disable`) by name, preventing it from firing without removing it. " + "Idempotent \u2014 safe to call when already disabled. " + "To resume use enable_scheduler. To permanently delete use remove_scheduler.",
-    inputSchema: { name: z95.string() },
+    inputSchema: { name: z96.string() },
     async handler(a, ctx) {
       ctx.info(`Disabling scheduler: name=${a.name}`);
       const result = await executeMikrotikCommand(`/system scheduler disable [find name="${a.name}"]`, ctx);
@@ -19100,11 +19559,11 @@ ${result}`;
     annotations: WRITE,
     description: "Stores a named script in the system script repository (`/system script add`) \u2014 reusable RouterOS code callable by name. " + "Use this to keep logic out of on-event fields and share it across multiple schedulers or trigger on demand. " + "To execute a stored script immediately use run_script. " + "To schedule a script to run periodically use create_scheduler (set on_event to the script name). " + "dont_require_permissions skips policy-permission checks of the caller. " + "Returns the added script's detail including its name and source.",
     inputSchema: {
-      name: z95.string().describe("Name for the script"),
-      source: z95.string().describe("Script source code (may contain spaces/semicolons)"),
-      policy: z95.string().optional().describe("Permission policy list, e.g. 'read,write,test,policy'"),
-      comment: z95.string().optional(),
-      dont_require_permissions: z95.boolean().default(false).describe("Run without checking the policy permissions of the caller")
+      name: z96.string().describe("Name for the script"),
+      source: z96.string().describe("Script source code (may contain spaces/semicolons)"),
+      policy: z96.string().optional().describe("Permission policy list, e.g. 'read,write,test,policy'"),
+      comment: z96.string().optional(),
+      dont_require_permissions: z96.boolean().default(false).describe("Run without checking the policy permissions of the caller")
     },
     async handler(a, ctx) {
       ctx.info(`Adding script: name=${a.name}`);
@@ -19124,7 +19583,7 @@ ${details}` : "Script creation completed but unable to verify.";
     annotations: READ,
     description: "Lists all stored scripts in the system script repository (`/system script print`). " + "Optionally filters by partial name match via name_filter. " + "Use this to see what named scripts are available for run_script or for referencing in a scheduler's on_event. " + "To list scheduled tasks (not stored scripts) use list_schedulers.",
     inputSchema: {
-      name_filter: z95.string().optional().describe("Partial name match")
+      name_filter: z96.string().optional().describe("Partial name match")
     },
     async handler(a, ctx) {
       ctx.info("Listing scripts");
@@ -19142,7 +19601,7 @@ ${result}`;
     title: "Remove Script from Repository",
     annotations: DESTRUCTIVE,
     description: "Permanently removes a named script from the system script repository (`/system script remove`) after verifying it exists. " + "Use this to clean up scripts no longer needed. " + "Verify nothing references it via list_schedulers before removing \u2014 schedulers whose on-event names a deleted script will fail silently. " + "To remove a scheduler entry (not a script) use remove_scheduler.",
-    inputSchema: { name: z95.string() },
+    inputSchema: { name: z96.string() },
     async handler(a, ctx) {
       ctx.info(`Removing script: name=${a.name}`);
       const count = await executeMikrotikCommand(`/system script print count-only where name="${a.name}"`, ctx);
@@ -19159,7 +19618,7 @@ ${result}`;
     title: "Run Script from Repository",
     annotations: WRITE,
     description: "Executes a named script from the system script repository immediately (`/system script run`). " + "Use this to trigger a stored script on demand without waiting for a scheduler. " + "The script must already exist in the repository \u2014 to add one use add_script; to see available scripts use list_scripts. " + "For recurring or time-based execution use create_scheduler. " + "Returns the script's console output.",
-    inputSchema: { name: z95.string() },
+    inputSchema: { name: z96.string() },
     async handler(a, ctx) {
       ctx.info(`Running script: name=${a.name}`);
       const result = await executeMikrotikCommand(`/system script run [find name="${a.name}"]`, ctx);
@@ -19173,7 +19632,7 @@ ${result}`;
 ];
 
 // src/tools/threat-feed.ts
-import { z as z96 } from "zod";
+import { z as z97 } from "zod";
 var FEED_TAG = "threat-feed";
 var threatFeedTools = [
   defineTool({
@@ -19182,12 +19641,12 @@ var threatFeedTools = [
     annotations: WRITE,
     description: "Subscribes the router to an external threat-intelligence IP feed: installs a `/system script` " + "that fetches `url` and imports it into the `address_list`, a `/system scheduler` that re-runs it " + "every `interval`, and (when `drop=true`) a raw pre-conntrack drop for that list \u2014 a self-updating " + "blocklist (e.g. Spamhaus DROP, tor exit nodes, your own deny list). `url` MUST point to a " + "RouterOS `.rsc` file that populates the address-list. DEFAULTS TO A DRY RUN (`apply=false`); set " + "`apply=true` to install. Script/scheduler/rule are named/tagged `threat-feed-<name>` so " + "remove_threat_feed can undo them. Returns the plan or a build report.",
     inputSchema: {
-      name: z96.string().describe("Short feed id, e.g. 'spamhaus-drop'"),
-      url: z96.string().describe("HTTPS URL of a RouterOS .rsc address-list file"),
-      address_list: z96.string().default("threat-blocklist").describe("Address-list to populate"),
-      interval: z96.string().default("1h").describe("How often to refresh the feed"),
-      drop: z96.boolean().default(true).describe("Also add a raw drop rule for the address-list"),
-      apply: z96.boolean().default(false).describe("false = preview (default); true = install")
+      name: z97.string().describe("Short feed id, e.g. 'spamhaus-drop'"),
+      url: z97.string().describe("HTTPS URL of a RouterOS .rsc address-list file"),
+      address_list: z97.string().default("threat-blocklist").describe("Address-list to populate"),
+      interval: z97.string().default("1h").describe("How often to refresh the feed"),
+      drop: z97.boolean().default(true).describe("Also add a raw drop rule for the address-list"),
+      apply: z97.boolean().default(false).describe("false = preview (default); true = install")
     },
     async handler(a, ctx) {
       const id = `${FEED_TAG}-${a.name}`;
@@ -19224,7 +19683,7 @@ ${plan}`;
     title: "Remove Threat-Intel Feed",
     annotations: DESTRUCTIVE,
     description: "Removes a threat feed installed by subscribe_threat_feed: deletes its `/system scheduler` and " + "`/system script` (named `threat-feed-<name>`) and any raw drop rule tagged for it. Does NOT " + "flush the address-list entries themselves. Returns what was removed.",
-    inputSchema: { name: z96.string().describe("The feed id used when subscribing") },
+    inputSchema: { name: z97.string().describe("The feed id used when subscribing") },
     async handler(a, ctx) {
       const id = `${FEED_TAG}-${a.name}`;
       ctx.info(`Removing threat feed ${id}`);
@@ -19246,7 +19705,7 @@ ${plan}`;
 ];
 
 // src/tools/sstp.ts
-import { z as z97 } from "zod";
+import { z as z98 } from "zod";
 var sstpTools = [
   defineTool({
     name: "get_sstp_server",
@@ -19267,19 +19726,19 @@ ${result}`;
     annotations: WRITE_IDEMPOTENT,
     description: "Configure the global SSTP server listener (`/interface sstp-server server set`) \u2014 accepts/rejects incoming TLS VPN connections on this router. " + "Use to enable the server, bind a TLS certificate, change the TCP port, restrict authentication methods (comma-separated, e.g. `'mschap2,mschap1'`), set the default PPP profile, pin TLS version (`any` or `only-1.2`), or enforce client certificate verification. " + "This is a singleton write that modifies the server block, not a client interface. " + "To read the current server config use `get_sstp_server`. " + "To create outbound SSTP tunnels (this router dials out) use `create_sstp_client`; for L2TP outbound use `create_l2tp_client`, for OpenVPN use `create_ovpn_client`, for PPTP use `create_pptp_client`. " + "Returns the updated server block on success.",
     inputSchema: {
-      enabled: z97.boolean().optional(),
-      default_profile: z97.string().optional(),
-      authentication: z97.string().optional().describe("Comma-separated, e.g. 'mschap2,mschap1'"),
-      certificate: z97.string().optional().describe("TLS certificate name"),
-      port: z97.number().int().optional(),
-      tls_version: z97.enum(["any", "only-1.2"]).optional(),
-      verify_client_certificate: z97.boolean().optional(),
-      pfs: z97.boolean().optional().describe("Enable Perfect Forward Secrecy"),
-      force_aes: z97.boolean().optional().describe("Require clients to use AES ciphers"),
-      max_mtu: z97.number().int().optional().describe("Maximum transmission unit"),
-      max_mru: z97.number().int().optional().describe("Maximum receive unit"),
-      mrru: z97.number().int().optional().describe("Max receive reconstructed unit for MP"),
-      keepalive_timeout: z97.number().int().optional().describe("Seconds before an idle connection is considered down")
+      enabled: z98.boolean().optional(),
+      default_profile: z98.string().optional(),
+      authentication: z98.string().optional().describe("Comma-separated, e.g. 'mschap2,mschap1'"),
+      certificate: z98.string().optional().describe("TLS certificate name"),
+      port: z98.number().int().optional(),
+      tls_version: z98.enum(["any", "only-1.2"]).optional(),
+      verify_client_certificate: z98.boolean().optional(),
+      pfs: z98.boolean().optional().describe("Enable Perfect Forward Secrecy"),
+      force_aes: z98.boolean().optional().describe("Require clients to use AES ciphers"),
+      max_mtu: z98.number().int().optional().describe("Maximum transmission unit"),
+      max_mru: z98.number().int().optional().describe("Maximum receive unit"),
+      mrru: z98.number().int().optional().describe("Max receive reconstructed unit for MP"),
+      keepalive_timeout: z98.number().int().optional().describe("Seconds before an idle connection is considered down")
     },
     async handler(a, ctx) {
       ctx.info("Configuring SSTP server");
@@ -19301,27 +19760,27 @@ ${details}`;
     annotations: WRITE,
     description: "Create an outbound SSTP client tunnel interface (`/interface sstp-client add`) so this router dials out to a remote SSTP server over TLS. " + "Use when this device must act as a VPN client, not the VPN server \u2014 for server-side settings use `set_sstp_server`. " + "`connect_to` is the remote server address (IP or DNS name); the TCP port is separate. " + "You may pass the port in `port` or inline as `host:port` in `connect_to` (it is split out " + "automatically \u2014 RouterOS rejects a port embedded in connect-to). SSTP defaults to 443. " + "For L2TP outbound tunnels use `create_l2tp_client`, for OpenVPN use `create_ovpn_client`, for PPTP use `create_pptp_client`. " + "Credentials are accepted but redacted from return values. " + "Returns the created interface detail (name, status, remote address); use the interface `name` with `get_sstp_client` or `remove_sstp_client`.",
     inputSchema: {
-      name: z97.string().describe("Name for the new SSTP client interface"),
-      connect_to: z97.string().describe("Remote SSTP server address (IP or DNS name; host:port also accepted)"),
-      port: z97.number().int().optional().describe("TCP port (default 443 if omitted)"),
-      user: z97.string(),
-      password: z97.string(),
-      profile: z97.string().optional(),
-      certificate: z97.string().optional().describe("Client TLS certificate name"),
-      verify_server_certificate: z97.boolean().optional(),
-      authentication: z97.string().optional().describe("Comma-separated, e.g. 'mschap2,mschap1'"),
-      tls_version: z97.enum(["any", "only-1.2"]).optional(),
-      pfs: z97.boolean().optional().describe("Enable Perfect Forward Secrecy"),
-      add_default_route: z97.boolean().optional(),
-      default_route_distance: z97.number().int().optional().describe("Distance of the auto-added default route"),
-      dial_on_demand: z97.boolean().optional().describe("Connect only when traffic is sent over the tunnel"),
-      max_mtu: z97.number().int().optional().describe("Maximum transmission unit"),
-      max_mru: z97.number().int().optional().describe("Maximum receive unit"),
-      mrru: z97.number().int().optional().describe("Max receive reconstructed unit for MP"),
-      keepalive_timeout: z97.number().int().optional().describe("Seconds before an idle connection is considered down"),
-      http_proxy: z97.string().optional(),
-      comment: z97.string().optional(),
-      disabled: z97.boolean().default(false)
+      name: z98.string().describe("Name for the new SSTP client interface"),
+      connect_to: z98.string().describe("Remote SSTP server address (IP or DNS name; host:port also accepted)"),
+      port: z98.number().int().optional().describe("TCP port (default 443 if omitted)"),
+      user: z98.string(),
+      password: z98.string(),
+      profile: z98.string().optional(),
+      certificate: z98.string().optional().describe("Client TLS certificate name"),
+      verify_server_certificate: z98.boolean().optional(),
+      authentication: z98.string().optional().describe("Comma-separated, e.g. 'mschap2,mschap1'"),
+      tls_version: z98.enum(["any", "only-1.2"]).optional(),
+      pfs: z98.boolean().optional().describe("Enable Perfect Forward Secrecy"),
+      add_default_route: z98.boolean().optional(),
+      default_route_distance: z98.number().int().optional().describe("Distance of the auto-added default route"),
+      dial_on_demand: z98.boolean().optional().describe("Connect only when traffic is sent over the tunnel"),
+      max_mtu: z98.number().int().optional().describe("Maximum transmission unit"),
+      max_mru: z98.number().int().optional().describe("Maximum receive unit"),
+      mrru: z98.number().int().optional().describe("Max receive reconstructed unit for MP"),
+      keepalive_timeout: z98.number().int().optional().describe("Seconds before an idle connection is considered down"),
+      http_proxy: z98.string().optional(),
+      comment: z98.string().optional(),
+      disabled: z98.boolean().default(false)
     },
     async handler(a, ctx) {
       ctx.info(`Creating SSTP client: name=${a.name}, connect_to=${a.connect_to}`);
@@ -19342,7 +19801,7 @@ ${redactSecrets(details)}` : "SSTP client creation completed but unable to verif
     annotations: READ,
     description: "List all outbound SSTP client tunnel interfaces (`/interface sstp-client print`), optionally narrowed by partial name match via `name_filter`. " + "Use to discover existing SSTP tunnels and their connection status before creating or removing one. " + "Passwords are redacted in the output. " + "For full detail on a single client use `get_sstp_client` with the interface name. " + "To inspect the inbound SSTP server config use `get_sstp_server`. " + "Returns a summary list of all matching SSTP client entries.",
     inputSchema: {
-      name_filter: z97.string().optional().describe("Partial name match")
+      name_filter: z98.string().optional().describe("Partial name match")
     },
     async handler(a, ctx) {
       ctx.info("Listing SSTP clients");
@@ -19360,7 +19819,7 @@ ${redactSecrets(result)}`;
     title: "Get SSTP Client Interface Detail",
     annotations: READ,
     description: "Return full detail for one SSTP client interface (`/interface sstp-client print detail where name=...`) by interface name \u2014 includes status, remote server address, TLS certificate, PPP profile, and connection options; passwords are redacted. " + "Use when you need the complete property set for a single tunnel rather than the summary list. " + "Use `list_sstp_clients` first to discover valid interface names. " + "For the inbound server configuration use `get_sstp_server`. " + "Returns the full detail block for the named interface, or a not-found message.",
-    inputSchema: { name: z97.string() },
+    inputSchema: { name: z98.string() },
     async handler(a, ctx) {
       ctx.info(`Getting SSTP client details: name=${a.name}`);
       const result = await executeMikrotikCommand(`/interface sstp-client print detail where name="${a.name}"`, ctx);
@@ -19374,7 +19833,7 @@ ${redactSecrets(result)}`;
     title: "Remove SSTP Client Interface",
     annotations: DESTRUCTIVE,
     description: "Permanently delete an SSTP client tunnel interface (`/interface sstp-client remove [find name=...]`) by interface name. " + "First verifies the interface exists (count-only check), then removes it; the tunnel is torn down immediately and the action is irreversible. " + "Use `list_sstp_clients` to confirm the interface name before calling this tool. " + "For L2TP, OpenVPN, or PPTP client interfaces see their respective tool scopes (`create_l2tp_client`, `create_ovpn_client`, `create_pptp_client`). " + "To disable the interface without deleting it, no dedicated enable/disable tool exists in this scope \u2014 set `disabled=yes` via RouterOS directly. " + "Returns a confirmation message on success or a not-found message if the name does not exist.",
-    inputSchema: { name: z97.string() },
+    inputSchema: { name: z98.string() },
     async handler(a, ctx) {
       ctx.info(`Removing SSTP client: name=${a.name}`);
       const count = await executeMikrotikCommand(`/interface sstp-client print count-only where name="${a.name}"`, ctx);
@@ -19389,7 +19848,7 @@ ${redactSecrets(result)}`;
 ];
 
 // src/tools/switch-settings.ts
-import { z as z98 } from "zod";
+import { z as z99 } from "zod";
 var switchSettingsTools = [
   defineTool({
     name: "list_switches",
@@ -19397,8 +19856,8 @@ var switchSettingsTools = [
     annotations: READ,
     description: "Lists hardware switch chips (`/interface ethernet switch`). " + "Use to discover switch chip names and types present on the device before targeting a chip with get_switch or update_switch. " + "Accepts optional `name_filter` and `type_filter` for partial-match filtering. " + "Returns chip name, type, and mirror/flow-control configuration for each matching entry; returns an empty message if none match.",
     inputSchema: {
-      name_filter: z98.string().optional().describe("Partial switch-name match"),
-      type_filter: z98.string().optional().describe("Partial switch-type match")
+      name_filter: z99.string().optional().describe("Partial switch-name match"),
+      type_filter: z99.string().optional().describe("Partial switch-type match")
     },
     async handler(a, ctx) {
       ctx.info("Listing switches");
@@ -19419,7 +19878,7 @@ ${result}`;
     annotations: READ,
     description: "Fetches full detail for a single hardware switch chip (`/interface ethernet switch print detail`). " + "Use to inspect the current cpu-flow-control flag and mirror-source, mirror-target, and mirror-egress settings before modifying them with update_switch. " + "`switch_id` accepts the chip name (e.g. 'switch1') or the RouterOS `.id` returned by list_switches \u2014 tries `.id` lookup first, then falls back to name lookup. " + "Returns detailed chip settings or a not-found message.",
     inputSchema: {
-      switch_id: z98.string().describe("Switch name (e.g. 'switch1') or RouterOS '.id'")
+      switch_id: z99.string().describe("Switch name (e.g. 'switch1') or RouterOS '.id'")
     },
     async handler(a, ctx) {
       ctx.info(`Getting switch details: switch_id=${a.switch_id}`);
@@ -19443,14 +19902,14 @@ ${result}`;
 
 ` + "Returns updated switch details on success.",
     inputSchema: {
-      switch_id: z98.string().describe("Switch name (e.g. 'switch1') or RouterOS '.id'"),
-      name: z98.string().optional().describe("Rename the switch"),
-      cpu_flow_control: z98.boolean().optional(),
-      mirror_source: z98.string().optional().describe("Source port to mirror, or 'none'"),
-      mirror_target: z98.string().optional().describe("Monitor port, 'cpu', or 'none'"),
-      mirror_egress: z98.string().optional().describe("Egress mirror source port (newer chips), or 'none'"),
-      mirror_egress_target: z98.string().optional().describe("Egress mirror target port (88E6393X/88E6191X/88E6190 chips), or 'none'"),
-      switch_all_ports: z98.boolean().optional().describe("Switch all ports together (RB450G/RB435G/RB850Gx2 only)")
+      switch_id: z99.string().describe("Switch name (e.g. 'switch1') or RouterOS '.id'"),
+      name: z99.string().optional().describe("Rename the switch"),
+      cpu_flow_control: z99.boolean().optional(),
+      mirror_source: z99.string().optional().describe("Source port to mirror, or 'none'"),
+      mirror_target: z99.string().optional().describe("Monitor port, 'cpu', or 'none'"),
+      mirror_egress: z99.string().optional().describe("Egress mirror source port (newer chips), or 'none'"),
+      mirror_egress_target: z99.string().optional().describe("Egress mirror target port (88E6393X/88E6191X/88E6190 chips), or 'none'"),
+      switch_all_ports: z99.boolean().optional().describe("Switch all ports together (RB450G/RB435G/RB850Gx2 only)")
     },
     async handler(a, ctx) {
       ctx.info(`Updating switch: switch_id=${a.switch_id}`);
@@ -19473,9 +19932,9 @@ ${details}`;
 ];
 
 // src/tools/switch-port.ts
-import { z as z99 } from "zod";
-var VlanMode = z99.enum(["disabled", "optional", "enabled", "secure"]);
-var VlanHeader = z99.enum(["leave-as-is", "always-strip", "add-if-missing"]);
+import { z as z100 } from "zod";
+var VlanMode = z100.enum(["disabled", "optional", "enabled", "secure"]);
+var VlanHeader = z100.enum(["leave-as-is", "always-strip", "add-if-missing"]);
 var switchPortTools = [
   defineTool({
     name: "list_switch_ports",
@@ -19483,8 +19942,8 @@ var switchPortTools = [
     annotations: READ,
     description: "List all switch chip ports (`/interface ethernet switch port print`) \u2014 the hardware-level " + "per-port VLAN configuration entries on RouterOS switch chips. " + "Use this to discover port names and their current vlan-mode, vlan-header, and " + "default-vlan-id (PVID) settings before updating them. " + "For a single port's full detail use get_switch_port; to change settings use update_switch_port. " + "Optional filters narrow results by partial port name or owning switch (e.g. 'switch1'). " + "Returns all matching port rows including VLAN mode, tag-header treatment, and PVID.",
     inputSchema: {
-      name_filter: z99.string().optional().describe("Partial port-name match"),
-      switch_filter: z99.string().optional().describe("Filter by owning switch, e.g. 'switch1'")
+      name_filter: z100.string().optional().describe("Partial port-name match"),
+      switch_filter: z100.string().optional().describe("Filter by owning switch, e.g. 'switch1'")
     },
     async handler(a, ctx) {
       ctx.info("Listing switch ports");
@@ -19505,7 +19964,7 @@ ${result}`;
     annotations: READ,
     description: "Retrieve detailed settings for a single switch chip port (`/interface ethernet switch port print detail`) " + "by port name (e.g. 'ether1') or RouterOS '.id' from list_switch_ports. " + "Use this when you need the full attribute set of one port before updating it; " + "for all ports use list_switch_ports; to change settings use update_switch_port. " + "Returns a detailed view of vlan-mode, vlan-header, default-vlan-id, and force-vlan-id for the matched port.",
     inputSchema: {
-      port_id: z99.string().describe("Port name (e.g. 'ether1') or RouterOS '.id'")
+      port_id: z100.string().describe("Port name (e.g. 'ether1') or RouterOS '.id'")
     },
     async handler(a, ctx) {
       ctx.info(`Getting switch port details: port_id=${a.port_id}`);
@@ -19531,11 +19990,11 @@ ${result}`;
 ` + `        'always-strip', or 'add-if-missing'.
 ` + "    default_vlan_id: PVID for untagged ingress ('auto', 'none', or a number).",
     inputSchema: {
-      port_id: z99.string().describe("Port name (e.g. 'ether1') or RouterOS '.id'"),
-      default_vlan_id: z99.string().optional().describe("PVID: 'auto', 'none', or a VLAN id number"),
+      port_id: z100.string().describe("Port name (e.g. 'ether1') or RouterOS '.id'"),
+      default_vlan_id: z100.string().optional().describe("PVID: 'auto', 'none', or a VLAN id number"),
       vlan_mode: VlanMode.optional(),
       vlan_header: VlanHeader.optional(),
-      force_vlan_id: z99.boolean().optional()
+      force_vlan_id: z100.boolean().optional()
     },
     async handler(a, ctx) {
       ctx.info(`Updating switch port: port_id=${a.port_id}`);
@@ -19557,7 +20016,7 @@ ${details}`;
 ];
 
 // src/tools/switch-port-isolation.ts
-import { z as z100 } from "zod";
+import { z as z101 } from "zod";
 function selectorFor(id) {
   return id.startsWith("*") ? `.id="${id}"` : `port="${id}"`;
 }
@@ -19574,9 +20033,9 @@ var switchPortIsolationTools = [
 ` + `    port: source port to isolate, e.g. 'ether1'.
 ` + "    forwarding_override_ports: comma-separated list of the ONLY ports this port " + "        may forward to \u2014 all others are blocked in hardware.",
     inputSchema: {
-      port: z100.string().describe("Source port to isolate, e.g. 'ether1'"),
-      forwarding_override_ports: z100.string().describe("Comma-separated allowed destination ports"),
-      comment: z100.string().optional()
+      port: z101.string().describe("Source port to isolate, e.g. 'ether1'"),
+      forwarding_override_ports: z101.string().describe("Comma-separated allowed destination ports"),
+      comment: z101.string().optional()
     },
     async handler(a, ctx) {
       ctx.info(`Adding switch port-isolation: port=${a.port}`);
@@ -19598,7 +20057,7 @@ ${details}` : "Switch port-isolation addition completed but unable to verify.";
 
 ` + "Returns a table of all matching entries; optionally filter by partial port name via port_filter.",
     inputSchema: {
-      port_filter: z100.string().optional().describe("Partial source-port match")
+      port_filter: z101.string().optional().describe("Partial source-port match")
     },
     async handler(a, ctx) {
       ctx.info("Listing switch port-isolation entries");
@@ -19619,7 +20078,7 @@ ${result}`;
 
 ` + "Returns the full detail block for the matched entry, or a not-found message.",
     inputSchema: {
-      isolation_id: z100.string().describe("Source port name (e.g. 'ether1') or RouterOS '.id'")
+      isolation_id: z101.string().describe("Source port name (e.g. 'ether1') or RouterOS '.id'")
     },
     async handler(a, ctx) {
       ctx.info(`Getting switch port-isolation: isolation_id=${a.isolation_id}`);
@@ -19639,9 +20098,9 @@ ${result}`;
 
 ` + "Returns the entry's updated detail block.",
     inputSchema: {
-      isolation_id: z100.string().describe("Source port name or RouterOS '.id'"),
-      forwarding_override_ports: z100.string().optional().describe("Comma-separated allowed destination ports"),
-      comment: z100.string().optional()
+      isolation_id: z101.string().describe("Source port name or RouterOS '.id'"),
+      forwarding_override_ports: z101.string().optional().describe("Comma-separated allowed destination ports"),
+      comment: z101.string().optional()
     },
     async handler(a, ctx) {
       ctx.info(`Updating switch port-isolation: isolation_id=${a.isolation_id}`);
@@ -19670,7 +20129,7 @@ ${details}`;
 
 ` + "isolation_id accepts either the source port name (e.g. 'ether1') or the RouterOS `.id` " + "(e.g. '*1') from list_switch_port_isolation. Performs a count-only existence check before " + "removal and returns a not-found message if the entry does not exist. To add a new isolation rule " + "afterwards use add_switch_port_isolation; to only modify allowed ports use update_switch_port_isolation.",
     inputSchema: {
-      isolation_id: z100.string().describe("Source port name or RouterOS '.id'")
+      isolation_id: z101.string().describe("Source port name or RouterOS '.id'")
     },
     async handler(a, ctx) {
       ctx.info(`Removing switch port-isolation: isolation_id=${a.isolation_id}`);
@@ -19687,7 +20146,7 @@ ${details}`;
 ];
 
 // src/tools/switch-rule.ts
-import { z as z101 } from "zod";
+import { z as z102 } from "zod";
 var isDigits8 = (s) => /^\d+$/.test(s);
 async function updateSwitchRule(a, ctx) {
   ctx.info(`Updating switch rule: rule_id=${a.rule_id}`);
@@ -19754,32 +20213,32 @@ var switchRuleTools = [
 ` + `    rate: rate limit in bits/second.
 ` + "    mac_protocol: e.g. 'ip', 'arp', 'vlan', or an EtherType number.",
     inputSchema: {
-      switch: z101.string().describe("Owning switch chip, e.g. 'switch1'"),
-      ports: z101.string().describe("Comma-separated source ports the rule matches"),
-      src_address: z101.string().optional().describe("Source IP/mask"),
-      dst_address: z101.string().optional().describe("Destination IP/mask"),
-      src_address6: z101.string().optional().describe("Source IPv6 address/mask"),
-      dst_address6: z101.string().optional().describe("Destination IPv6 address/mask"),
-      src_mac_address: z101.string().optional().describe("Source MAC/mask"),
-      dst_mac_address: z101.string().optional().describe("Destination MAC/mask"),
-      src_port: z101.string().optional().describe("Layer-4 source port(s)"),
-      dst_port: z101.string().optional().describe("Layer-4 destination port(s)"),
-      protocol: z101.string().optional().describe("IP protocol, e.g. 'tcp'"),
-      mac_protocol: z101.string().optional().describe("MAC protocol, e.g. 'ip', 'arp', 'vlan' or a number"),
-      vlan_header: z101.enum(["any", "not-present", "present"]).optional().describe("Match on VLAN tag presence"),
-      vlan_id: z101.string().optional(),
-      vlan_priority: z101.string().optional(),
-      dscp: z101.string().optional(),
-      flow_label: z101.string().optional().describe("IPv6 flow label"),
-      new_dst_ports: z101.string().optional().describe("Redirect target ports; empty string drops the traffic"),
-      new_vlan_id: z101.string().optional(),
-      new_vlan_priority: z101.string().optional(),
-      redirect_to_cpu: z101.boolean().optional(),
-      copy_to_cpu: z101.boolean().optional(),
-      mirror: z101.boolean().optional(),
-      rate: z101.string().optional().describe("Rate limit in bits/second"),
-      comment: z101.string().optional(),
-      disabled: z101.boolean().default(false)
+      switch: z102.string().describe("Owning switch chip, e.g. 'switch1'"),
+      ports: z102.string().describe("Comma-separated source ports the rule matches"),
+      src_address: z102.string().optional().describe("Source IP/mask"),
+      dst_address: z102.string().optional().describe("Destination IP/mask"),
+      src_address6: z102.string().optional().describe("Source IPv6 address/mask"),
+      dst_address6: z102.string().optional().describe("Destination IPv6 address/mask"),
+      src_mac_address: z102.string().optional().describe("Source MAC/mask"),
+      dst_mac_address: z102.string().optional().describe("Destination MAC/mask"),
+      src_port: z102.string().optional().describe("Layer-4 source port(s)"),
+      dst_port: z102.string().optional().describe("Layer-4 destination port(s)"),
+      protocol: z102.string().optional().describe("IP protocol, e.g. 'tcp'"),
+      mac_protocol: z102.string().optional().describe("MAC protocol, e.g. 'ip', 'arp', 'vlan' or a number"),
+      vlan_header: z102.enum(["any", "not-present", "present"]).optional().describe("Match on VLAN tag presence"),
+      vlan_id: z102.string().optional(),
+      vlan_priority: z102.string().optional(),
+      dscp: z102.string().optional(),
+      flow_label: z102.string().optional().describe("IPv6 flow label"),
+      new_dst_ports: z102.string().optional().describe("Redirect target ports; empty string drops the traffic"),
+      new_vlan_id: z102.string().optional(),
+      new_vlan_priority: z102.string().optional(),
+      redirect_to_cpu: z102.boolean().optional(),
+      copy_to_cpu: z102.boolean().optional(),
+      mirror: z102.boolean().optional(),
+      rate: z102.string().optional().describe("Rate limit in bits/second"),
+      comment: z102.string().optional(),
+      disabled: z102.boolean().default(false)
     },
     async handler(a, ctx) {
       ctx.info(`Adding switch rule: switch=${a.switch}, ports=${a.ports}`);
@@ -19813,9 +20272,9 @@ ${details}`;
     annotations: READ,
     description: "Lists all hardware switch ACL/redirect rules (`/interface ethernet switch rule print`) " + "on the switch chip. Use this to audit or discover existing rules before adding or updating. " + "Optional filters narrow by switch chip name, port name substring, or disabled-only status. " + "For software firewall rules use list_filter_rules; for NAT rules use list_nat_rules. " + "Returns a formatted table of all matching rules including their `.id` values needed by " + "get_switch_rule, update_switch_rule, remove_switch_rule, enable_switch_rule, and disable_switch_rule.",
     inputSchema: {
-      switch_filter: z101.string().optional(),
-      ports_filter: z101.string().optional(),
-      disabled_only: z101.boolean().default(false)
+      switch_filter: z102.string().optional(),
+      ports_filter: z102.string().optional(),
+      disabled_only: z102.boolean().default(false)
     },
     async handler(a, ctx) {
       ctx.info("Listing switch rules");
@@ -19838,7 +20297,7 @@ ${result}`;
     annotations: READ,
     description: "Fetches full detail of a single hardware switch ACL/redirect rule " + "(`/interface ethernet switch rule print detail where .id=\u2026`). " + "Use this to inspect all match criteria and action fields of one rule. " + "`rule_id` takes the `.id` from list_switch_rules (e.g. '*1'). " + "For a tabular overview of all rules use list_switch_rules; " + "for software firewall rule detail use get_filter_rule.",
     inputSchema: {
-      rule_id: z101.string().describe("RouterOS '.id', e.g. '*1' or '0'")
+      rule_id: z102.string().describe("RouterOS '.id', e.g. '*1' or '0'")
     },
     async handler(a, ctx) {
       ctx.info(`Getting switch rule: rule_id=${a.rule_id}`);
@@ -19854,33 +20313,33 @@ ${result}`;
     annotations: WRITE_IDEMPOTENT,
     description: "Modifies an existing hardware switch ACL/redirect rule " + "(`/interface ethernet switch rule set`) by `.id`. " + "Use this to change match criteria (ports, addresses, VLAN, protocol) or actions " + "(redirect target ports, mirror, rate limit, disabled state). " + 'Pass an empty string ("") for any optional field to clear it. ' + "`rule_id` takes the `.id` from list_switch_rules. Returns the updated rule's full detail. " + "For software firewall rule edits use update_filter_rule; " + "to only toggle the enabled state use enable_switch_rule or disable_switch_rule.",
     inputSchema: {
-      rule_id: z101.string(),
-      switch: z101.string().optional(),
-      ports: z101.string().optional(),
-      src_address: z101.string().optional(),
-      dst_address: z101.string().optional(),
-      src_address6: z101.string().optional(),
-      dst_address6: z101.string().optional(),
-      src_mac_address: z101.string().optional(),
-      dst_mac_address: z101.string().optional(),
-      src_port: z101.string().optional(),
-      dst_port: z101.string().optional(),
-      protocol: z101.string().optional(),
-      mac_protocol: z101.string().optional(),
-      vlan_header: z101.enum(["any", "not-present", "present"]).optional(),
-      vlan_id: z101.string().optional(),
-      vlan_priority: z101.string().optional(),
-      dscp: z101.string().optional(),
-      flow_label: z101.string().optional(),
-      new_dst_ports: z101.string().optional(),
-      new_vlan_id: z101.string().optional(),
-      new_vlan_priority: z101.string().optional(),
-      redirect_to_cpu: z101.boolean().optional(),
-      copy_to_cpu: z101.boolean().optional(),
-      mirror: z101.boolean().optional(),
-      rate: z101.string().optional(),
-      comment: z101.string().optional(),
-      disabled: z101.boolean().optional()
+      rule_id: z102.string(),
+      switch: z102.string().optional(),
+      ports: z102.string().optional(),
+      src_address: z102.string().optional(),
+      dst_address: z102.string().optional(),
+      src_address6: z102.string().optional(),
+      dst_address6: z102.string().optional(),
+      src_mac_address: z102.string().optional(),
+      dst_mac_address: z102.string().optional(),
+      src_port: z102.string().optional(),
+      dst_port: z102.string().optional(),
+      protocol: z102.string().optional(),
+      mac_protocol: z102.string().optional(),
+      vlan_header: z102.enum(["any", "not-present", "present"]).optional(),
+      vlan_id: z102.string().optional(),
+      vlan_priority: z102.string().optional(),
+      dscp: z102.string().optional(),
+      flow_label: z102.string().optional(),
+      new_dst_ports: z102.string().optional(),
+      new_vlan_id: z102.string().optional(),
+      new_vlan_priority: z102.string().optional(),
+      redirect_to_cpu: z102.boolean().optional(),
+      copy_to_cpu: z102.boolean().optional(),
+      mirror: z102.boolean().optional(),
+      rate: z102.string().optional(),
+      comment: z102.string().optional(),
+      disabled: z102.boolean().optional()
     },
     async handler(a, ctx) {
       return updateSwitchRule(a, ctx);
@@ -19891,7 +20350,7 @@ ${result}`;
     title: "Remove Switch Chip ACL Rule",
     annotations: DESTRUCTIVE,
     description: "Permanently deletes a hardware switch ACL/redirect rule " + "(`/interface ethernet switch rule remove`) by `.id`. " + "Performs an existence check first and returns an error if the rule is not found. " + "`rule_id` takes the `.id` from list_switch_rules (e.g. '*1'). " + "To keep the rule but stop it from matching use disable_switch_rule instead. " + "For removing software firewall rules use remove_filter_rule.",
-    inputSchema: { rule_id: z101.string() },
+    inputSchema: { rule_id: z102.string() },
     async handler(a, ctx) {
       ctx.info(`Removing switch rule: rule_id=${a.rule_id}`);
       const count = await executeMikrotikCommand(`/interface ethernet switch rule print count-only where .id=${a.rule_id}`, ctx);
@@ -19908,7 +20367,7 @@ ${result}`;
     title: "Enable Switch Chip ACL Rule",
     annotations: WRITE_IDEMPOTENT,
     description: "Re-enables a previously disabled hardware switch ACL/redirect rule " + "(`/interface ethernet switch rule set \u2026 disabled=no`). " + "Use this to activate a rule without recreating it. " + "`rule_id` takes the `.id` from list_switch_rules (e.g. '*1'). " + "To deactivate a rule without deleting it use disable_switch_rule; " + "to permanently delete use remove_switch_rule. Returns the updated rule's full detail.",
-    inputSchema: { rule_id: z101.string() },
+    inputSchema: { rule_id: z102.string() },
     async handler(a, ctx) {
       return updateSwitchRule({ rule_id: a.rule_id, disabled: false }, ctx);
     }
@@ -19918,7 +20377,7 @@ ${result}`;
     title: "Disable Switch Chip ACL Rule",
     annotations: WRITE_IDEMPOTENT,
     description: "Deactivates a hardware switch ACL/redirect rule without deleting it " + "(`/interface ethernet switch rule set \u2026 disabled=yes`). " + "Use this to temporarily suspend a rule's match/action while preserving its configuration. " + "`rule_id` takes the `.id` from list_switch_rules (e.g. '*1'). " + "To reactivate the rule use enable_switch_rule; to permanently delete use remove_switch_rule. " + "Returns the updated rule's full detail.",
-    inputSchema: { rule_id: z101.string() },
+    inputSchema: { rule_id: z102.string() },
     async handler(a, ctx) {
       return updateSwitchRule({ rule_id: a.rule_id, disabled: true }, ctx);
     }
@@ -19926,7 +20385,7 @@ ${result}`;
 ];
 
 // src/tools/system-config.ts
-import { z as z102 } from "zod";
+import { z as z103 } from "zod";
 var systemConfigTools = [
   defineTool({
     name: "list_system_console",
@@ -19973,7 +20432,7 @@ ${result}`;
     annotations: WRITE_IDEMPOTENT,
     description: "Writes the global LED behaviour settings (`/system leds settings set`). " + "Use to enable dark mode by scheduling all LEDs off. " + "For per-LED trigger assignments use `list_leds`; to read current settings use `get_leds_settings`. " + "Accepts `all_leds_off`: `never` | `immediate` | `after-1h` | `after-1min`. " + "Returns the updated settings on success.",
     inputSchema: {
-      all_leds_off: z102.enum(["never", "immediate", "after-1h", "after-1min"]).optional().describe("When to turn all LEDs off (dark mode)")
+      all_leds_off: z103.enum(["never", "immediate", "after-1h", "after-1min"]).optional().describe("When to turn all LEDs off (dark mode)")
     },
     async handler(a, ctx) {
       ctx.info("Setting LED settings");
@@ -20023,8 +20482,8 @@ ${result}`;
     annotations: WRITE_IDEMPOTENT,
     description: "Writes the system-wide login banner text (`/system note set`). " + "Use to set or clear the message displayed to users at login. " + "To read the current note use `get_note`. " + "Accepts optional `note` (text string) and `show_at_login` (boolean). " + "Returns the updated note on success.",
     inputSchema: {
-      note: z102.string().optional().describe("The note text to display"),
-      show_at_login: z102.boolean().optional().describe("Show the note on login")
+      note: z103.string().optional().describe("The note text to display"),
+      show_at_login: z103.boolean().optional().describe("Show the note on login")
     },
     async handler(a, ctx) {
       ctx.info("Setting system note");
@@ -20061,13 +20520,13 @@ ${result}`;
     annotations: WRITE_IDEMPOTENT,
     description: "Writes the device's built-in NTP *server* settings (`/system ntp server set`, RouterOS 7+). " + "Use to enable the router as a time server for LAN clients via broadcast, multicast, or manycast. " + "This tool configures the local NTP *server* role; to set upstream NTP *client* sources " + "use the NTP client tools in the system module. " + "Accepts `enabled`, `broadcast`, `multicast`, `manycast` (booleans) and `broadcast_address` (string). " + "Returns the updated server configuration on success.",
     inputSchema: {
-      enabled: z102.boolean().optional().describe("Enable or disable the NTP server"),
-      broadcast: z102.boolean().optional(),
-      multicast: z102.boolean().optional(),
-      manycast: z102.boolean().optional(),
-      broadcast_address: z102.string().optional().describe("Broadcast address for NTP broadcasts"),
-      use_local_clock: z102.boolean().optional().describe("Serve time from the device's local clock as reference"),
-      local_clock_stratum: z102.number().int().optional().describe("Stratum advertised when using the local clock (1-15)")
+      enabled: z103.boolean().optional().describe("Enable or disable the NTP server"),
+      broadcast: z103.boolean().optional(),
+      multicast: z103.boolean().optional(),
+      manycast: z103.boolean().optional(),
+      broadcast_address: z103.string().optional().describe("Broadcast address for NTP broadcasts"),
+      use_local_clock: z103.boolean().optional().describe("Serve time from the device's local clock as reference"),
+      local_clock_stratum: z103.number().int().optional().describe("Stratum advertised when using the local clock (1-15)")
     },
     async handler(a, ctx) {
       ctx.info("Setting NTP server configuration");
@@ -20090,8 +20549,8 @@ ${details}`;
     annotations: WRITE,
     description: "Changes the password of the currently authenticated user (`/password`). " + "Use to rotate the login credential without touching other user accounts; " + "passwords are never echoed in the response. " + "To manage other users' accounts or create new users use `add_user`. " + "Requires `old_password` and `new_password`; returns success or a rejection message (no credentials logged).",
     inputSchema: {
-      old_password: z102.string().describe("The current password"),
-      new_password: z102.string().describe("The new password to set")
+      old_password: z103.string().describe("The current password"),
+      new_password: z103.string().describe("The new password to set")
     },
     async handler(a, ctx) {
       ctx.info("Changing device password");
@@ -20108,7 +20567,7 @@ ${details}`;
     annotations: READ,
     description: "Lists the physical serial ports registered on the device (`/port print`). " + "Use to discover available serial ports and their current line settings before reconfiguring. " + "For auto-login rules tied to a serial port use `list_special_login`; " + "for console session entries use `list_system_console`. " + "Accepts optional `name_filter` for partial name match. " + "Returns port entries or an empty message when none match.",
     inputSchema: {
-      name_filter: z102.string().optional().describe("Partial port name match")
+      name_filter: z103.string().optional().describe("Partial port name match")
     },
     async handler(a, ctx) {
       ctx.info("Listing serial ports");
@@ -20127,7 +20586,7 @@ ${result}`;
     annotations: READ,
     description: "Reads detailed settings for a named serial port (`/port print detail where name=...`). " + "Use to inspect baud rate, parity, data/stop bits, and flow control for a specific port. " + "For an overview of all ports use `list_ports`; to change settings use `set_port`. " + "Requires `name` (e.g. `serial0`). Returns full detail for the named port.",
     inputSchema: {
-      name: z102.string().describe("Serial port name, e.g. 'serial0'")
+      name: z103.string().describe("Serial port name, e.g. 'serial0'")
     },
     async handler(a, ctx) {
       ctx.info(`Getting serial port details: name=${a.name}`);
@@ -20143,12 +20602,12 @@ ${result}`;
     annotations: WRITE_IDEMPOTENT,
     description: "Writes line settings for a named serial port (`/port set [find name=...]`). " + "Use to change baud rate, data bits, parity, stop bits, or flow control on a serial port. " + "To read current settings first use `get_port`; for a list of all ports use `list_ports`. " + "Requires `name` (e.g. `serial0`), plus optional `baud_rate` (e.g. `115200` or `auto`), " + "`data_bits`, `parity` (`none`|`odd`|`even`), `stop_bits`, " + "`flow_control` (`none`|`hardware`|`xon-xoff`). " + "Returns the updated port detail on success.",
     inputSchema: {
-      name: z102.string().describe("Serial port name to update"),
-      baud_rate: z102.string().optional().describe("e.g. '115200' or 'auto'"),
-      data_bits: z102.number().int().optional(),
-      parity: z102.enum(["none", "odd", "even"]).optional(),
-      stop_bits: z102.number().int().optional(),
-      flow_control: z102.enum(["none", "hardware", "xon-xoff"]).optional()
+      name: z103.string().describe("Serial port name to update"),
+      baud_rate: z103.string().optional().describe("e.g. '115200' or 'auto'"),
+      data_bits: z103.number().int().optional(),
+      parity: z103.enum(["none", "odd", "even"]).optional(),
+      stop_bits: z103.number().int().optional(),
+      flow_control: z103.enum(["none", "hardware", "xon-xoff"]).optional()
     },
     async handler(a, ctx) {
       ctx.info(`Setting serial port: name=${a.name}`);
@@ -20187,12 +20646,12 @@ ${result}`;
     annotations: DANGEROUS,
     description: "Sends a factory-reset command to the device (`/system reset-configuration`). " + "Use ONLY to wipe the entire configuration and reboot into defaults \u2014 " + "the SSH connection will drop immediately after and all config will be lost. " + "Requires `confirm=true`; without it the command is blocked. " + "Optional: `keep_users` (preserve user accounts), `no_defaults` (skip loading default config), " + "`skip_backup` (skip automatic pre-reset backup), `caps_mode` (reset into CAPsMAN-managed CAP mode), " + "`run_after_reset` (script to execute post-reboot). " + "This operation is irreversible \u2014 there is no undo.",
     inputSchema: {
-      confirm: z102.boolean().describe("Must be true to actually ERASE the configuration"),
-      keep_users: z102.boolean().optional().describe("Keep existing user accounts after reset"),
-      no_defaults: z102.boolean().optional().describe("Do not load the default configuration"),
-      skip_backup: z102.boolean().optional().describe("Skip the automatic backup before reset"),
-      caps_mode: z102.boolean().optional().describe("Reset into CAPsMAN-managed CAP mode instead of standalone"),
-      run_after_reset: z102.string().optional().describe("Script file to run after reset")
+      confirm: z103.boolean().describe("Must be true to actually ERASE the configuration"),
+      keep_users: z103.boolean().optional().describe("Keep existing user accounts after reset"),
+      no_defaults: z103.boolean().optional().describe("Do not load the default configuration"),
+      skip_backup: z103.boolean().optional().describe("Skip the automatic backup before reset"),
+      caps_mode: z103.boolean().optional().describe("Reset into CAPsMAN-managed CAP mode instead of standalone"),
+      run_after_reset: z103.string().optional().describe("Script file to run after reset")
     },
     async handler(a, ctx) {
       if (!a.confirm)
@@ -20237,12 +20696,12 @@ ${result}`;
     annotations: WRITE_IDEMPOTENT,
     description: "Writes the hardware/software watchdog timer settings (`/system watchdog set`). " + "Use to enable automatic reboots when the device becomes unresponsive " + "(triggered when pings to `watch_address` fail). " + "To read current settings use `get_watchdog`. " + "Accepts `watchdog_timer` (enable HW watchdog), `watch_address` (IP to ping), " + "`ping_timeout` (e.g. `1m`), `no_ping_delay` (e.g. `5m`), " + "`automatic_supout` (generate diagnostic file on crash), " + "`auto_send_supout` (email the diagnostic). " + "Returns the updated watchdog configuration on success.",
     inputSchema: {
-      watchdog_timer: z102.boolean().optional().describe("Enable the hardware watchdog timer"),
-      watch_address: z102.string().optional().describe("Address to ping; reboot if unreachable"),
-      ping_timeout: z102.string().optional().describe("e.g. '1m'"),
-      no_ping_delay: z102.string().optional().describe("e.g. '5m'"),
-      automatic_supout: z102.boolean().optional().describe("Generate a supout.rif on software failure"),
-      auto_send_supout: z102.boolean().optional().describe("Email the generated supout.rif")
+      watchdog_timer: z103.boolean().optional().describe("Enable the hardware watchdog timer"),
+      watch_address: z103.string().optional().describe("Address to ping; reboot if unreachable"),
+      ping_timeout: z103.string().optional().describe("e.g. '1m'"),
+      no_ping_delay: z103.string().optional().describe("e.g. '5m'"),
+      automatic_supout: z103.boolean().optional().describe("Generate a supout.rif on software failure"),
+      auto_send_supout: z103.boolean().optional().describe("Email the generated supout.rif")
     },
     async handler(a, ctx) {
       ctx.info("Setting watchdog configuration");
@@ -20262,7 +20721,7 @@ ${details}`;
 ];
 
 // src/tools/system.ts
-import { z as z103 } from "zod";
+import { z as z104 } from "zod";
 var systemTools = [
   defineTool({
     name: "get_system_identity",
@@ -20283,7 +20742,7 @@ ${result}`;
     annotations: WRITE,
     description: "Set the system hostname (`/system identity set`) \u2014 the name shown in neighbor discovery, " + "Winbox title bar, and SSH prompts. " + "To read the current value use `get_system_identity`. " + "Returns the updated identity after the change.",
     inputSchema: {
-      name: z103.string().describe("New system identity / hostname")
+      name: z104.string().describe("New system identity / hostname")
     },
     async handler(a, ctx) {
       ctx.info(`Setting system identity: name=${a.name}`);
@@ -20355,10 +20814,10 @@ ${result}`;
     annotations: WRITE,
     description: "Set the system date, time, and/or time-zone (`/system clock set`). " + "Provide at least one of `time_zone_name` (e.g. `'Europe/Amsterdam'` or `'manual'`), " + "`date` (e.g. `'jun/19/2026'`), or `time` (e.g. `'13:45:00'`). " + "For automatic time synchronization configure NTP with `set_ntp_client`. " + "Returns the updated clock after the change.",
     inputSchema: {
-      time_zone_name: z103.string().optional().describe("e.g. 'Europe/Amsterdam' or 'manual'"),
-      date: z103.string().optional().describe("e.g. 'jun/19/2026'"),
-      time: z103.string().optional().describe("e.g. '13:45:00'"),
-      time_zone_autodetect: z103.boolean().optional().describe("Auto-detect the time zone from the public IP")
+      time_zone_name: z104.string().optional().describe("e.g. 'Europe/Amsterdam' or 'manual'"),
+      date: z104.string().optional().describe("e.g. 'jun/19/2026'"),
+      time: z104.string().optional().describe("e.g. '13:45:00'"),
+      time_zone_autodetect: z104.boolean().optional().describe("Auto-detect the time zone from the public IP")
     },
     async handler(a, ctx) {
       ctx.info("Setting system clock");
@@ -20393,10 +20852,10 @@ ${result}`;
     annotations: WRITE,
     description: "Configure the NTP client (`/system ntp client set`) \u2014 enable or disable it " + "and set the server list as a comma-separated string (e.g. `'0.pool.ntp.org,1.pool.ntp.org'`). " + "To read current NTP status use `get_ntp_client`; " + "to set the clock manually instead use `set_system_clock`. " + "Returns the updated NTP client configuration after the change.",
     inputSchema: {
-      enabled: z103.boolean().optional().describe("Enable or disable the NTP client"),
-      servers: z103.string().optional().describe("Comma-separated NTP server list"),
-      mode: z103.enum(["unicast", "broadcast", "multicast", "manycast"]).optional().describe("NTP client operating mode"),
-      vrf: z103.string().optional().describe("VRF the NTP client operates in (e.g. 'main')")
+      enabled: z104.boolean().optional().describe("Enable or disable the NTP client"),
+      servers: z104.string().optional().describe("Comma-separated NTP server list"),
+      mode: z104.enum(["unicast", "broadcast", "multicast", "manycast"]).optional().describe("NTP client operating mode"),
+      vrf: z104.string().optional().describe("VRF the NTP client operates in (e.g. 'main')")
     },
     async handler(a, ctx) {
       ctx.info("Setting NTP client configuration");
@@ -20455,7 +20914,7 @@ ${result}`;
     annotations: DANGEROUS,
     description: "Send a reboot command to the device (`/system reboot`). " + "This is a high-blast-radius action: all connections drop and the device is offline for " + "1-2 minutes while it restarts. " + "Must pass `confirm=true` or the command is rejected without touching the device. " + "For a permanent power-off use `shutdown_system`.",
     inputSchema: {
-      confirm: z103.boolean().describe("Must be true to actually reboot the device")
+      confirm: z104.boolean().describe("Must be true to actually reboot the device")
     },
     async handler(a, ctx) {
       if (!a.confirm)
@@ -20471,7 +20930,7 @@ ${result}`;
     annotations: DANGEROUS,
     description: "Power off the device (`/system shutdown`). " + "This is a high-blast-radius action: all connections drop and the device remains offline " + "until physically powered on again. " + "Must pass `confirm=true` or the command is rejected without touching the device. " + "For a temporary restart use `reboot_system`.",
     inputSchema: {
-      confirm: z103.boolean().describe("Must be true to actually shut down the device")
+      confirm: z104.boolean().describe("Must be true to actually shut down the device")
     },
     async handler(a, ctx) {
       if (!a.confirm)
@@ -20484,10 +20943,10 @@ ${result}`;
 ];
 
 // src/tools/tunnels.ts
-import { z as z104 } from "zod";
-var DontFragment = z104.enum(["inherit", "no"]);
-var Arp = z104.enum(["disabled", "enabled", "local-proxy-arp", "proxy-arp", "reply-only"]);
-var VtepsIpVersion = z104.enum(["ipv4", "ipv6"]);
+import { z as z105 } from "zod";
+var DontFragment = z105.enum(["inherit", "no"]);
+var Arp = z105.enum(["disabled", "enabled", "local-proxy-arp", "proxy-arp", "reply-only"]);
+var VtepsIpVersion = z105.enum(["ipv4", "ipv6"]);
 var tunnelTools = [
   defineTool({
     name: "create_gre_tunnel",
@@ -20495,18 +20954,18 @@ var tunnelTools = [
     annotations: WRITE,
     description: "Creates an IPv4 GRE (Generic Routing Encapsulation) L3 tunnel interface (`/interface gre`)." + " Use to encapsulate routed traffic between two endpoints for site-to-site connectivity when IPsec encryption is not needed." + " GRE is L3-only and not bridgeable; for bridgeable L2 Ethernet-over-IP tunnels use create_eoip_tunnel;" + " for raw IP-in-IP with less overhead use create_ipip_tunnel; for L2 VXLAN overlays use create_vxlan_tunnel;" + " for VPN client interfaces use create_l2tp_client, create_pptp_client, create_sstp_client, or create_ovpn_client." + " Keepalive format: '<interval>,<retries>', e.g. '10s,3'." + " Returns the created interface detail including name, remote-address, and run-time status.",
     inputSchema: {
-      name: z104.string().describe("Name for the new GRE tunnel interface, e.g. 'gre-to-hq'"),
-      remote_address: z104.string().describe("Remote endpoint IP address"),
-      local_address: z104.string().optional().describe("Local endpoint IP address"),
-      keepalive: z104.string().optional().describe("Keepalive interval/retries, e.g. '10s,3'"),
+      name: z105.string().describe("Name for the new GRE tunnel interface, e.g. 'gre-to-hq'"),
+      remote_address: z105.string().describe("Remote endpoint IP address"),
+      local_address: z105.string().optional().describe("Local endpoint IP address"),
+      keepalive: z105.string().optional().describe("Keepalive interval/retries, e.g. '10s,3'"),
       dont_fragment: DontFragment.optional().describe("Don't-fragment behavior"),
-      clamp_tcp_mss: z104.boolean().optional().describe("Clamp TCP MSS to the tunnel MTU"),
-      allow_fast_path: z104.boolean().optional().describe("Allow FastPath processing for this tunnel"),
-      ipsec_secret: z104.string().optional().describe("Pre-shared key to auto-create an IPsec policy securing the tunnel"),
-      dscp: z104.string().optional().describe("DSCP for encapsulated packets: 'inherit' or 0-63"),
-      mtu: z104.number().int().optional(),
-      comment: z104.string().optional(),
-      disabled: z104.boolean().default(false)
+      clamp_tcp_mss: z105.boolean().optional().describe("Clamp TCP MSS to the tunnel MTU"),
+      allow_fast_path: z105.boolean().optional().describe("Allow FastPath processing for this tunnel"),
+      ipsec_secret: z105.string().optional().describe("Pre-shared key to auto-create an IPsec policy securing the tunnel"),
+      dscp: z105.string().optional().describe("DSCP for encapsulated packets: 'inherit' or 0-63"),
+      mtu: z105.number().int().optional(),
+      comment: z105.string().optional(),
+      disabled: z105.boolean().default(false)
     },
     async handler(a, ctx) {
       ctx.info(`Creating GRE tunnel: name=${a.name}, remote_address=${a.remote_address}`);
@@ -20526,7 +20985,7 @@ ${details}` : "GRE tunnel creation completed but unable to verify.";
     annotations: READ,
     description: "Lists all GRE tunnel interfaces (`/interface gre print`)." + " Use to inventory or audit existing GRE tunnels and their remote endpoints." + " Supports optional partial name filter via name_filter." + " For full detail on one tunnel use get_gre_tunnel; for IPIP tunnels use list_ipip_tunnels;" + " for EoIP tunnels use list_eoip_tunnels; for VXLAN use list_vxlan_tunnels." + " Returns name, remote-address, local-address, MTU, and run-time status for each interface.",
     inputSchema: {
-      name_filter: z104.string().optional().describe("Partial name match")
+      name_filter: z105.string().optional().describe("Partial name match")
     },
     async handler(a, ctx) {
       ctx.info("Listing GRE tunnels");
@@ -20544,7 +21003,7 @@ ${result}`;
     title: "Get GRE Tunnel Interface Detail",
     annotations: READ,
     description: "Fetches full detail for a single GRE tunnel interface by name (`/interface gre print detail where name=...`)." + " Use to inspect all parameters of one tunnel \u2014 remote-address, local-address, keepalive, MTU, dont-fragment, and status." + " For a summary list of all GRE tunnels use list_gre_tunnels." + " For IPIP detail use get_ipip_tunnel; for EoIP detail use get_eoip_tunnel; for VXLAN detail use get_vxlan_tunnel." + " Returns the complete property set for the named interface, or a not-found message.",
-    inputSchema: { name: z104.string() },
+    inputSchema: { name: z105.string() },
     async handler(a, ctx) {
       ctx.info(`Getting GRE tunnel details: name=${a.name}`);
       const result = await executeMikrotikCommand(`/interface gre print detail where name="${a.name}"`, ctx);
@@ -20558,7 +21017,7 @@ ${result}`;
     title: "Remove GRE Tunnel Interface",
     annotations: DESTRUCTIVE,
     description: "Permanently deletes a GRE tunnel interface by name (`/interface gre remove [find name=...]`)." + " Verifies existence via count-only before removal and returns a not-found message if the interface does not exist." + " This is destructive and immediately disconnects any traffic using the tunnel." + " For IPIP removal use remove_ipip_tunnel; for EoIP use remove_eoip_tunnel; for VXLAN use remove_vxlan_tunnel.",
-    inputSchema: { name: z104.string() },
+    inputSchema: { name: z105.string() },
     async handler(a, ctx) {
       ctx.info(`Removing GRE tunnel: name=${a.name}`);
       const count = await executeMikrotikCommand(`/interface gre print count-only where name="${a.name}"`, ctx);
@@ -20576,18 +21035,18 @@ ${result}`;
     annotations: WRITE,
     description: "Creates an IPv4 IPIP (IP-in-IP) L3 tunnel interface (`/interface ipip`)." + " Use for lightweight point-to-point IP encapsulation with minimal overhead when GRE's extra header byte is undesirable." + " IPIP is L3-only and not bridgeable; for GRE encapsulation (with dont-fragment support) use create_gre_tunnel;" + " for L2 Ethernet-over-IP tunnels use create_eoip_tunnel; for VXLAN L2 overlays use create_vxlan_tunnel." + " Keepalive format: '<interval>,<retries>', e.g. '10s,3'." + " Returns the created interface detail including name, remote-address, and run-time status.",
     inputSchema: {
-      name: z104.string().describe("Name for the new IPIP tunnel interface, e.g. 'ipip-to-hq'"),
-      remote_address: z104.string().describe("Remote endpoint IP address"),
-      local_address: z104.string().optional().describe("Local endpoint IP address"),
-      keepalive: z104.string().optional().describe("Keepalive interval/retries, e.g. '10s,3'"),
+      name: z105.string().describe("Name for the new IPIP tunnel interface, e.g. 'ipip-to-hq'"),
+      remote_address: z105.string().describe("Remote endpoint IP address"),
+      local_address: z105.string().optional().describe("Local endpoint IP address"),
+      keepalive: z105.string().optional().describe("Keepalive interval/retries, e.g. '10s,3'"),
       dont_fragment: DontFragment.optional().describe("Don't-fragment behavior"),
-      clamp_tcp_mss: z104.boolean().optional().describe("Clamp TCP MSS to the tunnel MTU"),
-      allow_fast_path: z104.boolean().optional().describe("Allow FastPath processing for this tunnel"),
-      ipsec_secret: z104.string().optional().describe("Pre-shared key to auto-create an IPsec policy securing the tunnel"),
-      dscp: z104.string().optional().describe("DSCP for encapsulated packets: 'inherit' or 0-63"),
-      mtu: z104.number().int().optional(),
-      comment: z104.string().optional(),
-      disabled: z104.boolean().default(false)
+      clamp_tcp_mss: z105.boolean().optional().describe("Clamp TCP MSS to the tunnel MTU"),
+      allow_fast_path: z105.boolean().optional().describe("Allow FastPath processing for this tunnel"),
+      ipsec_secret: z105.string().optional().describe("Pre-shared key to auto-create an IPsec policy securing the tunnel"),
+      dscp: z105.string().optional().describe("DSCP for encapsulated packets: 'inherit' or 0-63"),
+      mtu: z105.number().int().optional(),
+      comment: z105.string().optional(),
+      disabled: z105.boolean().default(false)
     },
     async handler(a, ctx) {
       ctx.info(`Creating IPIP tunnel: name=${a.name}, remote_address=${a.remote_address}`);
@@ -20607,7 +21066,7 @@ ${details}` : "IPIP tunnel creation completed but unable to verify.";
     annotations: READ,
     description: "Lists all IPIP tunnel interfaces (`/interface ipip print`)." + " Use to inventory existing IPIP tunnels and their remote endpoints." + " Supports optional partial name filter via name_filter." + " For full detail on one tunnel use get_ipip_tunnel; for GRE tunnels use list_gre_tunnels;" + " for EoIP tunnels use list_eoip_tunnels; for VXLAN use list_vxlan_tunnels." + " Returns name, remote-address, local-address, MTU, and run-time status for each interface.",
     inputSchema: {
-      name_filter: z104.string().optional().describe("Partial name match")
+      name_filter: z105.string().optional().describe("Partial name match")
     },
     async handler(a, ctx) {
       ctx.info("Listing IPIP tunnels");
@@ -20625,7 +21084,7 @@ ${result}`;
     title: "Get IPIP Tunnel Interface Detail",
     annotations: READ,
     description: "Fetches full detail for a single IPIP tunnel interface by name (`/interface ipip print detail where name=...`)." + " Use to inspect all parameters of one tunnel \u2014 remote-address, local-address, keepalive, MTU, and status." + " For a summary list of all IPIP tunnels use list_ipip_tunnels." + " For GRE detail use get_gre_tunnel; for EoIP detail use get_eoip_tunnel; for VXLAN detail use get_vxlan_tunnel." + " Returns the complete property set for the named interface, or a not-found message.",
-    inputSchema: { name: z104.string() },
+    inputSchema: { name: z105.string() },
     async handler(a, ctx) {
       ctx.info(`Getting IPIP tunnel details: name=${a.name}`);
       const result = await executeMikrotikCommand(`/interface ipip print detail where name="${a.name}"`, ctx);
@@ -20639,7 +21098,7 @@ ${result}`;
     title: "Remove IPIP Tunnel Interface",
     annotations: DESTRUCTIVE,
     description: "Permanently deletes an IPIP tunnel interface by name (`/interface ipip remove [find name=...]`)." + " Verifies existence via count-only before removal and returns a not-found message if the interface does not exist." + " This is destructive and immediately disconnects any traffic using the tunnel." + " For GRE removal use remove_gre_tunnel; for EoIP use remove_eoip_tunnel; for VXLAN use remove_vxlan_tunnel.",
-    inputSchema: { name: z104.string() },
+    inputSchema: { name: z105.string() },
     async handler(a, ctx) {
       ctx.info(`Removing IPIP tunnel: name=${a.name}`);
       const count = await executeMikrotikCommand(`/interface ipip print count-only where name="${a.name}"`, ctx);
@@ -20657,22 +21116,22 @@ ${result}`;
     annotations: WRITE,
     description: "Creates an EoIP (Ethernet over IP) L2 tunnel interface (`/interface eoip`)." + " Use when you need a bridgeable L2 link between two MikroTik devices \u2014 traffic appears as raw Ethernet frames over IP." + " Each tunnel requires a unique tunnel_id (0-65535) that must match identically on both peers; mismatched IDs are the most common misconfiguration." + " EoIP is MikroTik-proprietary \u2014 both endpoints must run RouterOS." + " For L3-only encapsulation use create_gre_tunnel or create_ipip_tunnel; for open-standard L2 overlays use create_vxlan_tunnel." + " Keepalive format: '<interval>,<retries>', e.g. '10s,3'." + " Returns the created interface detail including name, remote-address, tunnel-id, and run-time status.",
     inputSchema: {
-      name: z104.string().describe("Name for the new EoIP tunnel interface, e.g. 'eoip-to-hq'"),
-      remote_address: z104.string().describe("Remote endpoint IP address"),
-      tunnel_id: z104.number().int().describe("Unique tunnel ID, must match on both peers"),
-      local_address: z104.string().optional().describe("Local endpoint IP address"),
-      keepalive: z104.string().optional().describe("Keepalive interval/retries, e.g. '10s,3'"),
+      name: z105.string().describe("Name for the new EoIP tunnel interface, e.g. 'eoip-to-hq'"),
+      remote_address: z105.string().describe("Remote endpoint IP address"),
+      tunnel_id: z105.number().int().describe("Unique tunnel ID, must match on both peers"),
+      local_address: z105.string().optional().describe("Local endpoint IP address"),
+      keepalive: z105.string().optional().describe("Keepalive interval/retries, e.g. '10s,3'"),
       dont_fragment: DontFragment.optional().describe("Don't-fragment behavior"),
-      clamp_tcp_mss: z104.boolean().optional().describe("Clamp TCP MSS to the tunnel MTU"),
-      allow_fast_path: z104.boolean().optional().describe("Allow FastPath processing for this tunnel"),
-      ipsec_secret: z104.string().optional().describe("Pre-shared key to auto-create an IPsec policy securing the tunnel"),
-      dscp: z104.string().optional().describe("DSCP for encapsulated packets: 'inherit' or 0-63"),
-      mac_address: z104.string().optional().describe("MAC address of the EoIP interface"),
+      clamp_tcp_mss: z105.boolean().optional().describe("Clamp TCP MSS to the tunnel MTU"),
+      allow_fast_path: z105.boolean().optional().describe("Allow FastPath processing for this tunnel"),
+      ipsec_secret: z105.string().optional().describe("Pre-shared key to auto-create an IPsec policy securing the tunnel"),
+      dscp: z105.string().optional().describe("DSCP for encapsulated packets: 'inherit' or 0-63"),
+      mac_address: z105.string().optional().describe("MAC address of the EoIP interface"),
       arp: Arp.optional().describe("Address Resolution Protocol mode for the interface"),
-      arp_timeout: z104.string().optional().describe("ARP entry timeout, e.g. '30s' or 'auto'"),
-      mtu: z104.number().int().optional(),
-      comment: z104.string().optional(),
-      disabled: z104.boolean().default(false)
+      arp_timeout: z105.string().optional().describe("ARP entry timeout, e.g. '30s' or 'auto'"),
+      mtu: z105.number().int().optional(),
+      comment: z105.string().optional(),
+      disabled: z105.boolean().default(false)
     },
     async handler(a, ctx) {
       ctx.info(`Creating EoIP tunnel: name=${a.name}, remote_address=${a.remote_address}, tunnel_id=${a.tunnel_id}`);
@@ -20692,7 +21151,7 @@ ${details}` : "EoIP tunnel creation completed but unable to verify.";
     annotations: READ,
     description: "Lists all EoIP tunnel interfaces (`/interface eoip print`)." + " Use to inventory existing EoIP tunnels and check their tunnel-id assignments to detect duplicates or mismatches." + " Supports optional partial name filter via name_filter." + " For full detail on one tunnel use get_eoip_tunnel; for GRE tunnels use list_gre_tunnels;" + " for IPIP tunnels use list_ipip_tunnels; for VXLAN use list_vxlan_tunnels." + " Returns name, remote-address, tunnel-id, MTU, and run-time status for each interface.",
     inputSchema: {
-      name_filter: z104.string().optional().describe("Partial name match")
+      name_filter: z105.string().optional().describe("Partial name match")
     },
     async handler(a, ctx) {
       ctx.info("Listing EoIP tunnels");
@@ -20710,7 +21169,7 @@ ${result}`;
     title: "Get EoIP Tunnel Interface Detail",
     annotations: READ,
     description: "Fetches full detail for a single EoIP tunnel interface by name (`/interface eoip print detail where name=...`)." + " Use to inspect the tunnel-id, remote-address, local-address, keepalive, MTU, and status of one tunnel." + " For a summary list of all EoIP tunnels use list_eoip_tunnels." + " For GRE detail use get_gre_tunnel; for IPIP detail use get_ipip_tunnel; for VXLAN detail use get_vxlan_tunnel." + " Returns the complete property set for the named interface, or a not-found message.",
-    inputSchema: { name: z104.string() },
+    inputSchema: { name: z105.string() },
     async handler(a, ctx) {
       ctx.info(`Getting EoIP tunnel details: name=${a.name}`);
       const result = await executeMikrotikCommand(`/interface eoip print detail where name="${a.name}"`, ctx);
@@ -20724,7 +21183,7 @@ ${result}`;
     title: "Remove EoIP Tunnel Interface",
     annotations: DESTRUCTIVE,
     description: "Permanently deletes an EoIP tunnel interface by name (`/interface eoip remove [find name=...]`)." + " Verifies existence via count-only before removal and returns a not-found message if the interface does not exist." + " This is destructive and immediately severs the L2 bridge link using this tunnel." + " For GRE removal use remove_gre_tunnel; for IPIP use remove_ipip_tunnel; for VXLAN use remove_vxlan_tunnel.",
-    inputSchema: { name: z104.string() },
+    inputSchema: { name: z105.string() },
     async handler(a, ctx) {
       ctx.info(`Removing EoIP tunnel: name=${a.name}`);
       const count = await executeMikrotikCommand(`/interface eoip print count-only where name="${a.name}"`, ctx);
@@ -20742,21 +21201,21 @@ ${result}`;
     annotations: WRITE,
     description: "Creates a VXLAN (Virtual Extensible LAN) L2 overlay interface (`/interface vxlan`)." + " Use to build scalable L2 overlays across L3 networks \u2014 the VNI (VXLAN Network Identifier) scopes the broadcast domain, suited for multi-tenant or data-centre scenarios." + " VXLAN is an open standard and works with non-MikroTik peers; for MikroTik-proprietary L2 tunnels use create_eoip_tunnel;" + " for L3-only encapsulation use create_gre_tunnel or create_ipip_tunnel." + " UDP port defaults to 8472; VNI must match on all participating VTEPs." + " Returns the created interface detail including name, VNI, port, and run-time status.",
     inputSchema: {
-      name: z104.string().describe("Name for the new VXLAN interface, e.g. 'vxlan1'"),
-      vni: z104.number().int().describe("VXLAN Network Identifier (VNI)"),
-      port: z104.number().int().default(8472).describe("UDP port (default 8472)"),
-      local_address: z104.string().optional().describe("Local source IP address"),
-      interface: z104.string().optional().describe("Source interface"),
-      group: z104.string().optional().describe("Multicast group address for broadcast/unknown-unicast flooding"),
+      name: z105.string().describe("Name for the new VXLAN interface, e.g. 'vxlan1'"),
+      vni: z105.number().int().describe("VXLAN Network Identifier (VNI)"),
+      port: z105.number().int().default(8472).describe("UDP port (default 8472)"),
+      local_address: z105.string().optional().describe("Local source IP address"),
+      interface: z105.string().optional().describe("Source interface"),
+      group: z105.string().optional().describe("Multicast group address for broadcast/unknown-unicast flooding"),
       vteps_ip_version: VtepsIpVersion.optional().describe("IP version used for VTEP addressing"),
-      mac_address: z104.string().optional().describe("MAC address of the VXLAN interface"),
+      mac_address: z105.string().optional().describe("MAC address of the VXLAN interface"),
       arp: Arp.optional().describe("Address Resolution Protocol mode for the interface"),
-      arp_timeout: z104.string().optional().describe("ARP entry timeout, e.g. '30s' or 'auto'"),
-      max_fdb_size: z104.number().int().optional().describe("Maximum forwarding database (FDB) size"),
-      allow_fast_path: z104.boolean().optional().describe("Allow FastPath processing for this interface"),
-      mtu: z104.number().int().optional(),
-      comment: z104.string().optional(),
-      disabled: z104.boolean().default(false)
+      arp_timeout: z105.string().optional().describe("ARP entry timeout, e.g. '30s' or 'auto'"),
+      max_fdb_size: z105.number().int().optional().describe("Maximum forwarding database (FDB) size"),
+      allow_fast_path: z105.boolean().optional().describe("Allow FastPath processing for this interface"),
+      mtu: z105.number().int().optional(),
+      comment: z105.string().optional(),
+      disabled: z105.boolean().default(false)
     },
     async handler(a, ctx) {
       ctx.info(`Creating VXLAN tunnel: name=${a.name}, vni=${a.vni}`);
@@ -20776,7 +21235,7 @@ ${details}` : "VXLAN tunnel creation completed but unable to verify.";
     annotations: READ,
     description: "Lists all VXLAN interfaces (`/interface vxlan print`)." + " Use to inventory existing VXLAN overlays and check their VNI and UDP port assignments." + " Supports optional partial name filter via name_filter." + " For full detail on one interface use get_vxlan_tunnel; for EoIP tunnels use list_eoip_tunnels;" + " for GRE tunnels use list_gre_tunnels; for IPIP tunnels use list_ipip_tunnels." + " Returns name, VNI, port, local-address, MTU, and run-time status for each interface.",
     inputSchema: {
-      name_filter: z104.string().optional().describe("Partial name match")
+      name_filter: z105.string().optional().describe("Partial name match")
     },
     async handler(a, ctx) {
       ctx.info("Listing VXLAN tunnels");
@@ -20794,7 +21253,7 @@ ${result}`;
     title: "Get VXLAN Tunnel Interface Detail",
     annotations: READ,
     description: "Fetches full detail for a single VXLAN interface by name (`/interface vxlan print detail where name=...`)." + " Use to inspect the VNI, UDP port, local-address, source interface, MTU, and status of one VXLAN interface." + " For a summary list of all VXLAN interfaces use list_vxlan_tunnels." + " For EoIP detail use get_eoip_tunnel; for GRE detail use get_gre_tunnel; for IPIP detail use get_ipip_tunnel." + " Returns the complete property set for the named interface, or a not-found message.",
-    inputSchema: { name: z104.string() },
+    inputSchema: { name: z105.string() },
     async handler(a, ctx) {
       ctx.info(`Getting VXLAN tunnel details: name=${a.name}`);
       const result = await executeMikrotikCommand(`/interface vxlan print detail where name="${a.name}"`, ctx);
@@ -20808,7 +21267,7 @@ ${result}`;
     title: "Remove VXLAN Tunnel Interface",
     annotations: DESTRUCTIVE,
     description: "Permanently deletes a VXLAN interface by name (`/interface vxlan remove [find name=...]`)." + " Verifies existence via count-only before removal and returns a not-found message if the interface does not exist." + " This is destructive and immediately severs all L2 overlay traffic using this VNI endpoint." + " For EoIP removal use remove_eoip_tunnel; for GRE use remove_gre_tunnel; for IPIP use remove_ipip_tunnel.",
-    inputSchema: { name: z104.string() },
+    inputSchema: { name: z105.string() },
     async handler(a, ctx) {
       ctx.info(`Removing VXLAN tunnel: name=${a.name}`);
       const count = await executeMikrotikCommand(`/interface vxlan print count-only where name="${a.name}"`, ctx);
@@ -20823,7 +21282,7 @@ ${result}`;
 ];
 
 // src/tools/user-manager.ts
-import { z as z105 } from "zod";
+import { z as z106 } from "zod";
 var NOT_AVAILABLE = "User Manager is not available on this device (package not installed).";
 var userManagerTools = [
   defineTool({
@@ -20847,12 +21306,12 @@ ${result}`;
     annotations: WRITE_IDEMPOTENT,
     description: "Updates the global User Manager daemon configuration (`/user-manager set`) \u2014 toggle the" + " built-in RADIUS server on/off (`enabled`), set the TLS certificate, or enable the" + " profile/payment subsystem (`use_profiles`). Applies changes idempotently to the single" + " global settings entry; returns the full updated settings after applying. For per-user" + " changes use update_user_manager_user; for profile creation use add_user_manager_profile.",
     inputSchema: {
-      enabled: z105.boolean().optional().describe("Enable or disable the User Manager server"),
-      certificate: z105.string().optional().describe("TLS certificate name for RADIUS over TLS"),
-      radsec_certificate: z105.string().optional().describe("Certificate name for RadSec (RADIUS over TLS)"),
-      accounting_port: z105.number().int().optional().describe("UDP port for RADIUS accounting"),
-      authentication_port: z105.number().int().optional().describe("UDP port for RADIUS authentication"),
-      use_profiles: z105.boolean().optional().describe("Enable the profile/payment subsystem")
+      enabled: z106.boolean().optional().describe("Enable or disable the User Manager server"),
+      certificate: z106.string().optional().describe("TLS certificate name for RADIUS over TLS"),
+      radsec_certificate: z106.string().optional().describe("Certificate name for RadSec (RADIUS over TLS)"),
+      accounting_port: z106.number().int().optional().describe("UDP port for RADIUS accounting"),
+      authentication_port: z106.number().int().optional().describe("UDP port for RADIUS authentication"),
+      use_profiles: z106.boolean().optional().describe("Enable the profile/payment subsystem")
     },
     async handler(a, ctx) {
       ctx.info("Updating User Manager settings");
@@ -20876,15 +21335,15 @@ ${details}`;
     annotations: WRITE,
     description: "Creates a new user in the User Manager RADIUS database (`/user-manager user add`) \u2014 for" + " hotspot, PPP, or 802.1X authentication managed by the built-in RADIUS server. Not for" + " local router login accounts; for those use add_user. Supply `name` and `password`;" + " optionally set `group`, `shared_users` (max simultaneous sessions), and custom RADIUS" + " `attributes`. Returns the created user's detail with secrets redacted.",
     inputSchema: {
-      name: z105.string().describe("Login name for the user"),
-      password: z105.string().describe("Login password for the user"),
-      group: z105.string().optional(),
-      shared_users: z105.number().int().optional().describe("Max simultaneous sessions"),
-      attributes: z105.string().optional().describe("Custom RADIUS attributes"),
-      caller_id: z105.string().optional().describe("Caller ID the user is restricted to (e.g. MAC)"),
-      otp_secret: z105.string().optional().describe("Base32 OTP shared secret for two-factor auth"),
-      comment: z105.string().optional(),
-      disabled: z105.boolean().default(false)
+      name: z106.string().describe("Login name for the user"),
+      password: z106.string().describe("Login password for the user"),
+      group: z106.string().optional(),
+      shared_users: z106.number().int().optional().describe("Max simultaneous sessions"),
+      attributes: z106.string().optional().describe("Custom RADIUS attributes"),
+      caller_id: z106.string().optional().describe("Caller ID the user is restricted to (e.g. MAC)"),
+      otp_secret: z106.string().optional().describe("Base32 OTP shared secret for two-factor auth"),
+      comment: z106.string().optional(),
+      disabled: z106.boolean().default(false)
     },
     async handler(a, ctx) {
       ctx.info(`Adding User Manager user: name=${a.name}`);
@@ -20906,7 +21365,7 @@ ${redactSecrets(details)}` : "User Manager user creation completed but unable to
     annotations: READ,
     description: "Returns all users in the User Manager RADIUS database (`/user-manager user print`) \u2014 the" + " accounts that authenticate against the built-in RADIUS server for hotspot, PPP, or 802.1X." + " Optionally filter by partial `name_filter`. Not for local router login accounts; for those" + " use list_users. Returns user list with secrets redacted; for full" + " single-user detail use get_user_manager_user.",
     inputSchema: {
-      name_filter: z105.string().optional().describe("Partial name match")
+      name_filter: z106.string().optional().describe("Partial name match")
     },
     async handler(a, ctx) {
       ctx.info("Listing User Manager users");
@@ -20926,7 +21385,7 @@ ${redactSecrets(result)}`;
     title: "Get User Manager RADIUS User Detail",
     annotations: READ,
     description: "Returns full detail for a single User Manager RADIUS user" + " (`/user-manager user print detail where name=`) \u2014 all fields including group," + " shared-users limit, RADIUS attributes, and status, with secrets redacted. Use when you" + " need the complete record for one user by exact name. To browse all users use" + " list_user_manager_users; to modify the record use update_user_manager_user.",
-    inputSchema: { name: z105.string() },
+    inputSchema: { name: z106.string() },
     async handler(a, ctx) {
       ctx.info(`Getting User Manager user details: name=${a.name}`);
       const result = await executeMikrotikCommand(`/user-manager user print detail where name="${a.name}"`, ctx);
@@ -20943,16 +21402,16 @@ ${redactSecrets(result)}`;
     annotations: WRITE_IDEMPOTENT,
     description: "Modifies an existing User Manager RADIUS user (`/user-manager user set [find name=...]`)" + " \u2014 change name, password, group, shared-users limit, RADIUS attributes, comment, or" + " enabled/disabled state. Locate the user by its current `name` (from" + " list_user_manager_users or get_user_manager_user). Returns the updated record with" + " secrets redacted. To permanently delete the user use remove_user_manager_user.",
     inputSchema: {
-      name: z105.string().describe("Current name of the user to update"),
-      new_name: z105.string().optional(),
-      password: z105.string().optional(),
-      group: z105.string().optional(),
-      shared_users: z105.number().int().optional(),
-      attributes: z105.string().optional(),
-      caller_id: z105.string().optional().describe("Caller ID the user is restricted to (e.g. MAC)"),
-      otp_secret: z105.string().optional().describe("Base32 OTP shared secret for two-factor auth"),
-      comment: z105.string().optional(),
-      disabled: z105.boolean().optional()
+      name: z106.string().describe("Current name of the user to update"),
+      new_name: z106.string().optional(),
+      password: z106.string().optional(),
+      group: z106.string().optional(),
+      shared_users: z106.number().int().optional(),
+      attributes: z106.string().optional(),
+      caller_id: z106.string().optional().describe("Caller ID the user is restricted to (e.g. MAC)"),
+      otp_secret: z106.string().optional().describe("Base32 OTP shared secret for two-factor auth"),
+      comment: z106.string().optional(),
+      disabled: z106.boolean().optional()
     },
     async handler(a, ctx) {
       ctx.info(`Updating User Manager user: name=${a.name}`);
@@ -20976,7 +21435,7 @@ ${redactSecrets(details)}`;
     title: "Remove User Manager RADIUS User",
     annotations: DESTRUCTIVE,
     description: "Permanently deletes a User Manager RADIUS user (`/user-manager user remove [find name=...]`)" + " \u2014 verifies the user exists via count-only check first, then removes them. Does NOT" + " automatically remove the user's profile assignments; check list_user_manager_user_profiles" + " first. To disable without deleting use update_user_manager_user with `disabled=true`.",
-    inputSchema: { name: z105.string() },
+    inputSchema: { name: z106.string() },
     async handler(a, ctx) {
       ctx.info(`Removing User Manager user: name=${a.name}`);
       const count = await executeMikrotikCommand(`/user-manager user print count-only where name="${a.name}"`, ctx);
@@ -20996,13 +21455,13 @@ ${redactSecrets(details)}`;
     annotations: WRITE,
     description: "Creates a new User Manager service/billing profile (`/user-manager profile add`) \u2014 a named" + " plan template that defines validity period (e.g. '30d'), price, and session override" + " limits (`starts_when`, `override_shared_users`) that can be assigned to users. Profiles are" + " templates only; to link a profile to a specific user use assign_user_manager_profile. For" + " rate/quota constraints attach a limitation (add_user_manager_limitation). Returns the" + " created profile's detail.",
     inputSchema: {
-      name: z105.string().describe("Profile name"),
-      name_for_users: z105.string().optional().describe("Display name shown to users"),
-      validity: z105.string().optional().describe("Validity period, e.g. '30d'"),
-      price: z105.number().optional(),
-      starts_when: z105.enum(["assigned", "first-auth"]).optional(),
-      override_shared_users: z105.string().optional(),
-      comment: z105.string().optional()
+      name: z106.string().describe("Profile name"),
+      name_for_users: z106.string().optional().describe("Display name shown to users"),
+      validity: z106.string().optional().describe("Validity period, e.g. '30d'"),
+      price: z106.number().optional(),
+      starts_when: z106.enum(["assigned", "first-auth"]).optional(),
+      override_shared_users: z106.string().optional(),
+      comment: z106.string().optional()
     },
     async handler(a, ctx) {
       ctx.info(`Adding User Manager profile: name=${a.name}`);
@@ -21024,7 +21483,7 @@ ${details}` : "User Manager profile creation completed but unable to verify.";
     annotations: READ,
     description: "Returns all User Manager service/billing profile templates (`/user-manager profile print`)" + " \u2014 the named plans defining validity, price, and session limits. Optionally filter by" + " partial `name_filter`. Not the same as user-profile assignments; to see which profiles" + " are linked to which users use list_user_manager_user_profiles. Returns profile list.",
     inputSchema: {
-      name_filter: z105.string().optional().describe("Partial name match")
+      name_filter: z106.string().optional().describe("Partial name match")
     },
     async handler(a, ctx) {
       ctx.info("Listing User Manager profiles");
@@ -21044,7 +21503,7 @@ ${result}`;
     title: "Remove User Manager Service Profile",
     annotations: DESTRUCTIVE,
     description: "Permanently deletes a User Manager service/billing profile" + " (`/user-manager profile remove [find name=...]`) \u2014 verifies existence via count-only check" + " first, then removes the plan template. Does NOT automatically remove existing user-profile" + " assignments that reference this profile; check list_user_manager_user_profiles before" + " removing to avoid orphaned assignments. For creating a profile use add_user_manager_profile.",
-    inputSchema: { name: z105.string() },
+    inputSchema: { name: z106.string() },
     async handler(a, ctx) {
       ctx.info(`Removing User Manager profile: name=${a.name}`);
       const count = await executeMikrotikCommand(`/user-manager profile print count-only where name="${a.name}"`, ctx);
@@ -21064,8 +21523,8 @@ ${result}`;
     annotations: WRITE,
     description: "Creates a user-profile assignment in User Manager (`/user-manager user-profile add`) \u2014" + " links an existing service profile plan to a specific user so the user inherits the plan's" + " limits (rate, transfer, validity). Both `user` and `profile` must already exist; to create" + " a user use add_user_manager_user; to create a profile use add_user_manager_profile. To view" + " existing assignments use list_user_manager_user_profiles.",
     inputSchema: {
-      user: z105.string().describe("User to assign the profile to"),
-      profile: z105.string().describe("Profile to assign")
+      user: z106.string().describe("User to assign the profile to"),
+      profile: z106.string().describe("Profile to assign")
     },
     async handler(a, ctx) {
       ctx.info(`Assigning profile '${a.profile}' to user '${a.user}'`);
@@ -21086,7 +21545,7 @@ ${result}`;
     annotations: READ,
     description: "Returns all User Manager user-to-profile assignment records" + " (`/user-manager user-profile print`) \u2014 shows which service profile plan is linked to each" + " user. Optionally filter by partial `user_filter`. Not the same as listing profile" + " definitions; for the plan templates themselves use list_user_manager_profiles. To create an" + " assignment use assign_user_manager_profile.",
     inputSchema: {
-      user_filter: z105.string().optional().describe("Partial user match")
+      user_filter: z106.string().optional().describe("Partial user match")
     },
     async handler(a, ctx) {
       ctx.info("Listing User Manager user-profiles");
@@ -21107,13 +21566,13 @@ ${result}`;
     annotations: WRITE,
     description: "Registers a new RADIUS client (router or NAS device) in User Manager" + " (`/user-manager router add`) \u2014 the network device that forwards authentication requests to" + " this built-in RADIUS server. Requires a friendly `name`, the client's IP `address`, and a" + " `shared_secret`; optionally set the CoA port. Not related to IP routing; for routing table" + " entries use add_route. Returns the created entry with secrets redacted.",
     inputSchema: {
-      name: z105.string().describe("Friendly name for the RADIUS client"),
-      address: z105.string().describe("IP address of the RADIUS client"),
-      shared_secret: z105.string().describe("Shared secret for the RADIUS client"),
-      coa_port: z105.number().int().optional().describe("Change-of-Authorization port"),
-      protocol: z105.string().optional().describe("RADIUS transport protocol for this client (e.g. radius, radsec)"),
-      comment: z105.string().optional(),
-      disabled: z105.boolean().default(false)
+      name: z106.string().describe("Friendly name for the RADIUS client"),
+      address: z106.string().describe("IP address of the RADIUS client"),
+      shared_secret: z106.string().describe("Shared secret for the RADIUS client"),
+      coa_port: z106.number().int().optional().describe("Change-of-Authorization port"),
+      protocol: z106.string().optional().describe("RADIUS transport protocol for this client (e.g. radius, radsec)"),
+      comment: z106.string().optional(),
+      disabled: z106.boolean().default(false)
     },
     async handler(a, ctx) {
       ctx.info(`Adding User Manager router: name=${a.name}, address=${a.address}`);
@@ -21135,7 +21594,7 @@ ${redactSecrets(details)}` : "User Manager router creation completed but unable
     annotations: READ,
     description: "Returns all RADIUS clients (routers/NAS devices) registered in User Manager" + " (`/user-manager router print`) \u2014 the devices authorized to forward authentication requests" + " to this built-in RADIUS server. Optionally filter by partial `name_filter`. Not related to" + " IP routing; for routing table entries use list_routes. Returns entries with secrets redacted.",
     inputSchema: {
-      name_filter: z105.string().optional().describe("Partial name match")
+      name_filter: z106.string().optional().describe("Partial name match")
     },
     async handler(a, ctx) {
       ctx.info("Listing User Manager routers");
@@ -21155,7 +21614,7 @@ ${redactSecrets(result)}`;
     title: "Remove User Manager RADIUS Client (Router/NAS)",
     annotations: DESTRUCTIVE,
     description: "Permanently removes a RADIUS client (router/NAS) from User Manager" + " (`/user-manager router remove [find name=...]`) \u2014 verifies existence via count-only check" + " first, then deletes the entry. The device will no longer be able to forward authentication" + " requests to this RADIUS server after removal. Not related to IP routing; for routing table" + " management use remove_route.",
-    inputSchema: { name: z105.string() },
+    inputSchema: { name: z106.string() },
     async handler(a, ctx) {
       ctx.info(`Removing User Manager router: name=${a.name}`);
       const count = await executeMikrotikCommand(`/user-manager router print count-only where name="${a.name}"`, ctx);
@@ -21175,25 +21634,25 @@ ${redactSecrets(result)}`;
     annotations: WRITE,
     description: "Creates a new User Manager limitation template (`/user-manager limitation add`) \u2014 a reusable" + " named set of rate and quota constraints: download rate (`rate_limit_rx`, e.g. '10M')," + " upload rate (`rate_limit_tx`), total transfer cap (`transfer_limit`, e.g. '10G'), and" + " uptime cap (`uptime_limit`, e.g. '1d'). Limitations are templates attached to profiles, not" + " users directly; for service plan templates use add_user_manager_profile. Returns the created" + " limitation's detail.",
     inputSchema: {
-      name: z105.string().describe("Limitation name"),
-      rate_limit_rx: z105.string().optional().describe("Download rate limit, e.g. '10M'"),
-      rate_limit_tx: z105.string().optional().describe("Upload rate limit, e.g. '10M'"),
-      rate_limit_min_rx: z105.string().optional().describe("Guaranteed (CIR) download rate, e.g. '2M'"),
-      rate_limit_min_tx: z105.string().optional().describe("Guaranteed (CIR) upload rate, e.g. '2M'"),
-      rate_limit_burst_rx: z105.string().optional().describe("Download burst rate, e.g. '20M'"),
-      rate_limit_burst_tx: z105.string().optional().describe("Upload burst rate, e.g. '20M'"),
-      rate_limit_burst_threshold_rx: z105.string().optional().describe("Download burst threshold rate"),
-      rate_limit_burst_threshold_tx: z105.string().optional().describe("Upload burst threshold rate"),
-      rate_limit_burst_time_rx: z105.string().optional().describe("Download burst time, e.g. '10s'"),
-      rate_limit_burst_time_tx: z105.string().optional().describe("Upload burst time, e.g. '10s'"),
-      rate_limit_priority: z105.number().int().optional().describe("Queue priority (1-8)"),
-      download_limit: z105.string().optional().describe("Download transfer cap in bytes, e.g. '5G'"),
-      upload_limit: z105.string().optional().describe("Upload transfer cap in bytes, e.g. '5G'"),
-      transfer_limit: z105.string().optional().describe("Total transfer cap, e.g. '10G'"),
-      uptime_limit: z105.string().optional().describe("Uptime cap, e.g. '1d'"),
-      reset_counters_interval: z105.string().optional().describe("Interval to auto-reset usage counters"),
-      reset_counters_start_time: z105.string().optional().describe("Start time for counter reset interval"),
-      comment: z105.string().optional()
+      name: z106.string().describe("Limitation name"),
+      rate_limit_rx: z106.string().optional().describe("Download rate limit, e.g. '10M'"),
+      rate_limit_tx: z106.string().optional().describe("Upload rate limit, e.g. '10M'"),
+      rate_limit_min_rx: z106.string().optional().describe("Guaranteed (CIR) download rate, e.g. '2M'"),
+      rate_limit_min_tx: z106.string().optional().describe("Guaranteed (CIR) upload rate, e.g. '2M'"),
+      rate_limit_burst_rx: z106.string().optional().describe("Download burst rate, e.g. '20M'"),
+      rate_limit_burst_tx: z106.string().optional().describe("Upload burst rate, e.g. '20M'"),
+      rate_limit_burst_threshold_rx: z106.string().optional().describe("Download burst threshold rate"),
+      rate_limit_burst_threshold_tx: z106.string().optional().describe("Upload burst threshold rate"),
+      rate_limit_burst_time_rx: z106.string().optional().describe("Download burst time, e.g. '10s'"),
+      rate_limit_burst_time_tx: z106.string().optional().describe("Upload burst time, e.g. '10s'"),
+      rate_limit_priority: z106.number().int().optional().describe("Queue priority (1-8)"),
+      download_limit: z106.string().optional().describe("Download transfer cap in bytes, e.g. '5G'"),
+      upload_limit: z106.string().optional().describe("Upload transfer cap in bytes, e.g. '5G'"),
+      transfer_limit: z106.string().optional().describe("Total transfer cap, e.g. '10G'"),
+      uptime_limit: z106.string().optional().describe("Uptime cap, e.g. '1d'"),
+      reset_counters_interval: z106.string().optional().describe("Interval to auto-reset usage counters"),
+      reset_counters_start_time: z106.string().optional().describe("Start time for counter reset interval"),
+      comment: z106.string().optional()
     },
     async handler(a, ctx) {
       ctx.info(`Adding User Manager limitation: name=${a.name}`);
@@ -21215,7 +21674,7 @@ ${details}` : "User Manager limitation creation completed but unable to verify."
     annotations: READ,
     description: "Returns all User Manager limitation templates (`/user-manager limitation print`) \u2014 the named" + " rate/quota constraint definitions (rate-limit-rx/tx, transfer-limit, uptime-limit) that can" + " be attached to service profiles. Optionally filter by partial `name_filter`. Limitations are" + " distinct from profile plan templates; for those use list_user_manager_profiles.",
     inputSchema: {
-      name_filter: z105.string().optional().describe("Partial name match")
+      name_filter: z106.string().optional().describe("Partial name match")
     },
     async handler(a, ctx) {
       ctx.info("Listing User Manager limitations");
@@ -21235,7 +21694,7 @@ ${result}`;
     title: "Remove User Manager Limitation Template",
     annotations: DESTRUCTIVE,
     description: "Permanently deletes a User Manager limitation template" + " (`/user-manager limitation remove [find name=...]`) \u2014 verifies existence via count-only" + " check first, then removes the constraint definition. Does NOT check whether the limitation" + " is still referenced by any profiles; verify with list_user_manager_profiles before removing" + " to avoid orphaned references. For listing limitations use list_user_manager_limitations.",
-    inputSchema: { name: z105.string() },
+    inputSchema: { name: z106.string() },
     async handler(a, ctx) {
       ctx.info(`Removing User Manager limitation: name=${a.name}`);
       const count = await executeMikrotikCommand(`/user-manager limitation print count-only where name="${a.name}"`, ctx);
@@ -21255,8 +21714,8 @@ ${result}`;
     annotations: READ,
     description: "Returns User Manager RADIUS accounting session records (`/user-manager session print`) \u2014 the" + " log of authentication and accounting events for users connecting through registered RADIUS" + " clients. Optionally filter by partial `user_filter` or restrict to currently active sessions" + " with `active_only=true`. Returns session data including bytes transferred, uptime, and" + " status. For the user accounts themselves use list_user_manager_users; for registered RADIUS" + " clients use list_user_manager_routers.",
     inputSchema: {
-      user_filter: z105.string().optional().describe("Partial user match"),
-      active_only: z105.boolean().default(false).describe("Only show currently active sessions")
+      user_filter: z106.string().optional().describe("Partial user match"),
+      active_only: z106.boolean().default(false).describe("Only show currently active sessions")
     },
     async handler(a, ctx) {
       ctx.info("Listing User Manager sessions");
@@ -21276,7 +21735,7 @@ ${result}`;
 ];
 
 // src/tools/users.ts
-import { z as z106 } from "zod";
+import { z as z107 } from "zod";
 var VALID_POLICIES = [
   "local",
   "telnet",
@@ -21333,12 +21792,12 @@ var userTools = [
     annotations: WRITE,
     description: "Create a local user account (`/user add`) \u2014 grants interactive access to the router via SSH, Winbox, web, telnet, or API. " + "The `group` parameter (default: `read`) sets permissions; built-in groups are `read`, `write`, `full`; use `add_user_group` to create custom groups. " + "Use `address` to restrict login to a specific IP/subnet. For PPP/dial-in credentials use `create_ppp_secret` instead. " + "Returns the created account's full detail including its `.id`.",
     inputSchema: {
-      name: z106.string(),
-      password: z106.string(),
-      group: z106.string().default("read"),
-      address: z106.string().optional(),
-      comment: z106.string().optional(),
-      disabled: z106.boolean().default(false)
+      name: z107.string(),
+      password: z107.string(),
+      group: z107.string().default("read"),
+      address: z107.string().optional(),
+      comment: z107.string().optional(),
+      disabled: z107.boolean().default(false)
     },
     async handler(a, ctx) {
       ctx.info(`Adding user: name=${a.name}, group=${a.group}`);
@@ -21370,10 +21829,10 @@ ${redactSecrets(details)}`;
     annotations: READ,
     description: "List local router user accounts (`/user print`) \u2014 shows each account's group, address restriction, and enabled/disabled state. " + "Supports optional filters: `name_filter` (name substring match), `group_filter` (exact group name), `disabled_only`. " + "Note: `active_only` is accepted by the schema but is not applied as a filter \u2014 it has no effect on the output. " + "Passwords are redacted from output. For currently logged-in sessions use `get_active_users`. For PPP dial-in secrets use `create_ppp_secret`.",
     inputSchema: {
-      name_filter: z106.string().optional(),
-      group_filter: z106.string().optional(),
-      disabled_only: z106.boolean().default(false),
-      active_only: z106.boolean().default(false)
+      name_filter: z107.string().optional(),
+      group_filter: z107.string().optional(),
+      disabled_only: z107.boolean().default(false),
+      active_only: z107.boolean().default(false)
     },
     async handler(a, ctx) {
       ctx.info(`Listing users with filters: name=${a.name_filter}, group=${a.group_filter}`);
@@ -21397,7 +21856,7 @@ ${redactSecrets(result)}`;
     title: "Get Local User Account Details",
     annotations: READ,
     description: "Fetch full detail for a single local user account (`/user print detail where name=...`). " + "Identified by login `name`. Passwords are redacted from output. " + "For all accounts use `list_users`; for currently active sessions use `get_active_users`.",
-    inputSchema: { name: z106.string() },
+    inputSchema: { name: z107.string() },
     async handler(a, ctx) {
       ctx.info(`Getting user details: name=${a.name}`);
       const result = await executeMikrotikCommand(`/user print detail where name="${a.name}"`, ctx);
@@ -21414,13 +21873,13 @@ ${redactSecrets(result)}`;
     annotations: WRITE_IDEMPOTENT,
     description: "Modify a local user account (`/user set [find name=...]`). " + "Can change login name (`new_name`), `password`, `group`, allowed source `address` (pass empty string to remove address restriction), `comment`, or `disabled` state. " + "For toggling enabled/disabled state only, prefer `enable_user` or `disable_user`. " + "Returns the updated user detail with passwords redacted.",
     inputSchema: {
-      name: z106.string(),
-      new_name: z106.string().optional(),
-      password: z106.string().optional(),
-      group: z106.string().optional(),
-      address: z106.string().optional(),
-      comment: z106.string().optional(),
-      disabled: z106.boolean().optional()
+      name: z107.string(),
+      new_name: z107.string().optional(),
+      password: z107.string().optional(),
+      group: z107.string().optional(),
+      address: z107.string().optional(),
+      comment: z107.string().optional(),
+      disabled: z107.boolean().optional()
     },
     async handler(a, ctx) {
       return runUpdateUser(a, ctx);
@@ -21431,7 +21890,7 @@ ${redactSecrets(result)}`;
     title: "Remove Local User Account",
     annotations: DESTRUCTIVE,
     description: "Permanently delete a local user account (`/user remove [find name=...]`). " + "Refuses to remove the built-in `admin` account. Verifies the user exists before removing. " + "To temporarily block access without deleting use `disable_user`. To end a live session without deleting the account use `disconnect_user`.",
-    inputSchema: { name: z106.string() },
+    inputSchema: { name: z107.string() },
     async handler(a, ctx) {
       ctx.info(`Removing user: name=${a.name}`);
       if (a.name.toLowerCase() === "admin")
@@ -21450,7 +21909,7 @@ ${redactSecrets(result)}`;
     title: "Disable Local User Account",
     annotations: WRITE_IDEMPOTENT,
     description: "Disable a local user account (`/user set [find name=...] disabled=yes`), preventing new logins without deleting the account. " + "To re-enable use `enable_user`. For a full attribute update use `update_user`. To permanently delete the account use `remove_user`.",
-    inputSchema: { name: z106.string() },
+    inputSchema: { name: z107.string() },
     async handler(a, ctx) {
       return runUpdateUser({ name: a.name, disabled: true }, ctx);
     }
@@ -21460,7 +21919,7 @@ ${redactSecrets(result)}`;
     title: "Enable Local User Account",
     annotations: WRITE_IDEMPOTENT,
     description: "Re-enable a previously disabled local user account (`/user set [find name=...] disabled=no`). " + "To disable use `disable_user`. For a full attribute update use `update_user`.",
-    inputSchema: { name: z106.string() },
+    inputSchema: { name: z107.string() },
     async handler(a, ctx) {
       return runUpdateUser({ name: a.name, disabled: false }, ctx);
     }
@@ -21471,10 +21930,10 @@ ${redactSecrets(result)}`;
     annotations: WRITE,
     description: "Create a custom user group (`/user group add`) that defines a named permission policy for router access. " + "`policy` is a list of permissions to grant from: local, telnet, ssh, ftp, reboot, read, write, policy, test, winbox, password, web, sniff, sensitive, api, romon, dude, tikapp, rest-api. " + "The built-in groups (`read`, `write`, `full`) already exist on the device; this tool does not guard against those names \u2014 attempting to create a group with a duplicate name will be rejected by the device. Assign users to the new group via `add_user` or `update_user`. " + "Returns the created group's full detail.",
     inputSchema: {
-      name: z106.string(),
-      policy: z106.array(z106.string()),
-      skin: z106.string().optional(),
-      comment: z106.string().optional()
+      name: z107.string(),
+      policy: z107.array(z107.string()),
+      skin: z107.string().optional(),
+      comment: z107.string().optional()
     },
     async handler(a, ctx) {
       ctx.info(`Adding user group: name=${a.name}`);
@@ -21511,8 +21970,8 @@ ${details}`;
     annotations: READ,
     description: "List all user groups (`/user group print`), including built-in groups (`read`, `write`, `full`) and custom ones, showing their policy sets. " + "Supports optional filters: `name_filter` (name substring), `policy_filter` (policy substring). " + "To see individual user accounts use `list_users`; to see which users belong to a specific group use `list_users` with `group_filter`.",
     inputSchema: {
-      name_filter: z106.string().optional(),
-      policy_filter: z106.string().optional()
+      name_filter: z107.string().optional(),
+      policy_filter: z107.string().optional()
     },
     async handler(a, ctx) {
       ctx.info(`Listing user groups with filters: name=${a.name_filter}`);
@@ -21534,7 +21993,7 @@ ${result}`;
     title: "Get User Group Details",
     annotations: READ,
     description: "Fetch full detail for a single user group (`/user group print detail where name=...`), showing its complete policy list and skin setting. " + "For all groups use `list_user_groups`. To see which users belong to this group use `list_users` with `group_filter`.",
-    inputSchema: { name: z106.string() },
+    inputSchema: { name: z107.string() },
     async handler(a, ctx) {
       ctx.info(`Getting user group details: name=${a.name}`);
       const result = await executeMikrotikCommand(`/user group print detail where name="${a.name}"`, ctx);
@@ -21551,11 +22010,11 @@ ${result}`;
     annotations: WRITE_IDEMPOTENT,
     description: "Modify a custom user group (`/user group set [find name=...]`). " + "Can change group name (`new_name`), `policy` list, `skin`, or `comment`. " + "Refuses to modify built-in groups (`read`, `write`, `full`). " + "Valid policies: local, telnet, ssh, ftp, reboot, read, write, policy, test, winbox, password, web, sniff, sensitive, api, romon, dude, tikapp, rest-api. " + "Returns the updated group detail.",
     inputSchema: {
-      name: z106.string(),
-      new_name: z106.string().optional(),
-      policy: z106.array(z106.string()).optional(),
-      skin: z106.string().optional(),
-      comment: z106.string().optional()
+      name: z107.string(),
+      new_name: z107.string().optional(),
+      policy: z107.array(z107.string()).optional(),
+      skin: z107.string().optional(),
+      comment: z107.string().optional()
     },
     async handler(a, ctx) {
       ctx.info(`Updating user group: name=${a.name}`);
@@ -21588,7 +22047,7 @@ ${details}`;
     title: "Remove User Group",
     annotations: DESTRUCTIVE,
     description: "Delete a custom user group (`/user group remove [find name=...]`). " + "Refuses to remove built-in groups (`read`, `write`, `full`). " + "Checks that no users are currently assigned to the group \u2014 reassign or remove those users first via `update_user` or `remove_user`. " + "To remove individual user accounts use `remove_user`.",
-    inputSchema: { name: z106.string() },
+    inputSchema: { name: z107.string() },
     async handler(a, ctx) {
       ctx.info(`Removing user group: name=${a.name}`);
       if (BUILTIN_GROUPS.includes(a.name))
@@ -21626,7 +22085,7 @@ ${result}`;
     title: "Disconnect Active User Session",
     annotations: DESTRUCTIVE,
     description: "Forcibly terminate an active user session (`/user active remove <user_id>`). " + "`user_id` is the `.id` from `get_active_users`. " + "Does NOT delete the user account \u2014 to delete the account use `remove_user`. To prevent future logins without deleting use `disable_user`.",
-    inputSchema: { user_id: z106.string() },
+    inputSchema: { user_id: z107.string() },
     async handler(a, ctx) {
       ctx.info(`Disconnecting user: user_id=${a.user_id}`);
       const result = await executeMikrotikCommand(`/user active remove ${a.user_id}`, ctx);
@@ -21640,7 +22099,7 @@ ${result}`;
     title: "Export User Configuration to File",
     annotations: READ,
     description: "Export the router's user accounts and user-group configuration as a RouterOS script (`/user export file=<filename>`). " + "The file is saved on the router's flash storage as `<filename>.rsc`. If `filename` is omitted, defaults to `user_config`. " + "The exported script can be used to restore user accounts on another device.",
-    inputSchema: { filename: z106.string().optional() },
+    inputSchema: { filename: z107.string().optional() },
     async handler(a, ctx) {
       ctx.info("Exporting user configuration");
       const filename = a.filename || "user_config";
@@ -21656,8 +22115,8 @@ ${result}`;
     annotations: WRITE,
     description: "Import an SSH public key for a user (`/user ssh-keys import user=... public-key-file=...`), enabling key-based SSH authentication in addition to password login. " + "`key_file` must be the path to a public key file already present on the router's filesystem. " + "To list a user's existing keys use `list_user_ssh_keys`; to remove a key use `remove_user_ssh_key`.",
     inputSchema: {
-      username: z106.string(),
-      key_file: z106.string()
+      username: z107.string(),
+      key_file: z107.string()
     },
     async handler(a, ctx) {
       ctx.info(`Setting SSH keys for user: ${a.username}`);
@@ -21674,7 +22133,7 @@ ${result}`;
     title: "List User SSH Keys",
     annotations: READ,
     description: "List SSH public keys registered for a specific user (`/user ssh-keys print where user=...`). " + "Returns each key's `.id`, which is required by `remove_user_ssh_key`. To add a key use `set_user_ssh_keys`.",
-    inputSchema: { username: z106.string() },
+    inputSchema: { username: z107.string() },
     async handler(a, ctx) {
       ctx.info(`Listing SSH keys for user: ${a.username}`);
       const result = await executeMikrotikCommand(`/user ssh-keys print where user="${a.username}"`, ctx);
@@ -21690,7 +22149,7 @@ ${result}`;
     title: "Remove User SSH Key",
     annotations: DESTRUCTIVE,
     description: "Delete a specific SSH public key (`/user ssh-keys remove <key_id>`). " + "`key_id` is the `.id` from `list_user_ssh_keys`. " + "Does NOT disable the user's password-based login \u2014 to block all logins use `disable_user`; to delete the account use `remove_user`.",
-    inputSchema: { key_id: z106.string() },
+    inputSchema: { key_id: z107.string() },
     async handler(a, ctx) {
       ctx.info(`Removing SSH key: key_id=${a.key_id}`);
       const result = await executeMikrotikCommand(`/user ssh-keys remove ${a.key_id}`, ctx);
@@ -21702,7 +22161,7 @@ ${result}`;
 ];
 
 // src/tools/vlan-designer.ts
-import { z as z107 } from "zod";
+import { z as z108 } from "zod";
 function defaultRange2(subnet) {
   const o = subnet.split("/")[0].split(".");
   return `${o[0]}.${o[1]}.${o[2]}.10-${o[0]}.${o[1]}.${o[2]}.254`;
@@ -21714,18 +22173,18 @@ var vlanDesignerTools = [
     annotations: DANGEROUS,
     description: "Stands up a complete isolated network segment in one call: a VLAN interface on the bridge, its " + "gateway IP, a DHCP server + pool + network, optional internet access (srcnat masquerade), and " + "inter-VLAN isolation firewall rules \u2014 e.g. 'a guest VLAN that reaches the internet but not the " + "LAN'. DEFAULTS TO A DRY RUN (`apply=false`) showing every command grouped; set `apply=true` to " + "build it. Bridge VLAN tagging is added when `tagged_ports`/`untagged_ports` are given (requires " + "bridge vlan-filtering). Isolation drops forward traffic from this subnet to each `isolate_from` " + "subnet. Returns the plan or a build report.",
     inputSchema: {
-      vlan_id: z107.number().int().min(1).max(4094),
-      name: z107.string().describe("Name for the VLAN interface, e.g. 'guest'"),
-      subnet: z107.string().describe("CIDR for the segment, e.g. '192.168.30.0/24'"),
-      gateway: z107.string().describe("Router's address in the segment, e.g. '192.168.30.1'"),
-      bridge: z107.string().default("bridge").describe("Bridge to put the VLAN on"),
-      tagged_ports: z107.string().optional().describe("Comma-separated trunk/tagged ports (+ the bridge)"),
-      untagged_ports: z107.string().optional().describe("Comma-separated access/untagged ports"),
-      dhcp: z107.boolean().default(true).describe("Create a DHCP server + pool for the segment"),
-      dhcp_range: z107.string().optional().describe("Pool range; defaults to .10\u2013.254 of the subnet"),
-      internet: z107.boolean().default(true).describe("Allow internet access via srcnat masquerade"),
-      isolate_from: z107.array(z107.string()).optional().describe("Subnets this segment must NOT reach, e.g. ['192.168.1.0/24']"),
-      apply: z107.boolean().default(false).describe("false = preview (default); true = build")
+      vlan_id: z108.number().int().min(1).max(4094),
+      name: z108.string().describe("Name for the VLAN interface, e.g. 'guest'"),
+      subnet: z108.string().describe("CIDR for the segment, e.g. '192.168.30.0/24'"),
+      gateway: z108.string().describe("Router's address in the segment, e.g. '192.168.30.1'"),
+      bridge: z108.string().default("bridge").describe("Bridge to put the VLAN on"),
+      tagged_ports: z108.string().optional().describe("Comma-separated trunk/tagged ports (+ the bridge)"),
+      untagged_ports: z108.string().optional().describe("Comma-separated access/untagged ports"),
+      dhcp: z108.boolean().default(true).describe("Create a DHCP server + pool for the segment"),
+      dhcp_range: z108.string().optional().describe("Pool range; defaults to .10\u2013.254 of the subnet"),
+      internet: z108.boolean().default(true).describe("Allow internet access via srcnat masquerade"),
+      isolate_from: z108.array(z108.string()).optional().describe("Subnets this segment must NOT reach, e.g. ['192.168.1.0/24']"),
+      apply: z108.boolean().default(false).describe("false = preview (default); true = build")
     },
     async handler(a, ctx) {
       const prefix = a.subnet.split("/")[1] ?? "24";
@@ -21798,9 +22257,9 @@ Review partial segment (the VLAN may exist without DHCP/firewall).`;
 ];
 
 // src/tools/vlan.ts
-import { z as z108 } from "zod";
-var ArpMode2 = z108.enum(["enabled", "disabled", "proxy-arp", "reply-only"]);
-var LoopProtect = z108.enum(["default", "on", "off"]);
+import { z as z109 } from "zod";
+var ArpMode2 = z109.enum(["enabled", "disabled", "proxy-arp", "reply-only"]);
+var LoopProtect = z109.enum(["default", "on", "off"]);
 var vlanTools = [
   defineTool({
     name: "create_vlan_interface",
@@ -21808,18 +22267,18 @@ var vlanTools = [
     annotations: WRITE,
     description: "Creates an 802.1Q VLAN sub-interface (`/interface vlan`) on a specified parent physical or bridge interface." + " Use this to segment layer-2 traffic by VLAN ID (1\u20134094); set `use_service_tag=true` for 802.1ad QinQ double-tagging." + " For listing existing VLAN interfaces use `list_vlan_interfaces`; for editing an existing VLAN use `update_vlan_interface`." + " Returns the created interface's full detail including its name, which is the identifier accepted by `get_vlan_interface`, `update_vlan_interface`, and `remove_vlan_interface`." + " ARP mode accepts: enabled (default), disabled, proxy-arp, reply-only.",
     inputSchema: {
-      name: z108.string().describe("Name for the new VLAN interface, e.g. 'vlan100'"),
-      vlan_id: z108.number().int().min(1).max(4094).describe("802.1Q VLAN ID (1-4094)"),
-      interface: z108.string().describe("Parent interface, e.g. 'ether1' or 'bridge'"),
-      comment: z108.string().optional(),
-      disabled: z108.boolean().default(false),
-      mtu: z108.number().int().optional(),
-      use_service_tag: z108.boolean().default(false).describe("Use 802.1ad service tag (QinQ)"),
+      name: z109.string().describe("Name for the new VLAN interface, e.g. 'vlan100'"),
+      vlan_id: z109.number().int().min(1).max(4094).describe("802.1Q VLAN ID (1-4094)"),
+      interface: z109.string().describe("Parent interface, e.g. 'ether1' or 'bridge'"),
+      comment: z109.string().optional(),
+      disabled: z109.boolean().default(false),
+      mtu: z109.number().int().optional(),
+      use_service_tag: z109.boolean().default(false).describe("Use 802.1ad service tag (QinQ)"),
       arp: ArpMode2.default("enabled"),
-      arp_timeout: z108.string().optional(),
+      arp_timeout: z109.string().optional(),
       loop_protect: LoopProtect.optional().describe("Loop protection: default, on, off"),
-      loop_protect_disable_time: z108.string().optional().describe("Time to disable interface on loop detection, e.g. '5m' (0 = forever)"),
-      loop_protect_send_interval: z108.string().optional().describe("Interval between loop-protect probe packets, e.g. '5s'")
+      loop_protect_disable_time: z109.string().optional().describe("Time to disable interface on loop detection, e.g. '5m' (0 = forever)"),
+      loop_protect_send_interval: z109.string().optional().describe("Interval between loop-protect probe packets, e.g. '5s'")
     },
     async handler(a, ctx) {
       ctx.info(`Creating VLAN interface: name=${a.name}, vlan_id=${a.vlan_id}, interface=${a.interface}`);
@@ -21839,10 +22298,10 @@ ${details}` : "VLAN interface creation completed but unable to verify.";
     annotations: READ,
     description: "Lists all 802.1Q VLAN sub-interfaces (`/interface vlan print`) with optional filters by name substring, VLAN ID, parent interface, or disabled state." + " Use to discover existing VLANs and obtain interface names for `get_vlan_interface`, `update_vlan_interface`, or `remove_vlan_interface`." + " For a single interface's full property detail use `get_vlan_interface`." + " Returns a table of matching VLAN interfaces, or a not-found message when no entries match the filters.",
     inputSchema: {
-      name_filter: z108.string().optional().describe("Partial name match"),
-      vlan_id_filter: z108.number().int().optional(),
-      interface_filter: z108.string().optional().describe("Exact parent interface name"),
-      disabled_only: z108.boolean().default(false)
+      name_filter: z109.string().optional().describe("Partial name match"),
+      vlan_id_filter: z109.number().int().optional(),
+      interface_filter: z109.string().optional().describe("Exact parent interface name"),
+      disabled_only: z109.boolean().default(false)
     },
     async handler(a, ctx) {
       ctx.info("Listing VLAN interfaces");
@@ -21866,7 +22325,7 @@ ${result}`;
     title: "Get VLAN Interface Details",
     annotations: READ,
     description: 'Returns full detail for a single named VLAN interface (`/interface vlan print detail where name="..."`), including VLAN ID, parent interface, ARP mode, MTU, and running state.' + " Use when you already know the exact interface name and need all properties." + " For searching across all VLANs or filtering by parent interface or VLAN ID use `list_vlan_interfaces`.",
-    inputSchema: { name: z108.string() },
+    inputSchema: { name: z109.string() },
     async handler(a, ctx) {
       ctx.info(`Getting VLAN interface details: name=${a.name}`);
       const result = await executeMikrotikCommand(`/interface vlan print detail where name="${a.name}"`, ctx);
@@ -21881,19 +22340,19 @@ ${result}`;
     annotations: WRITE_IDEMPOTENT,
     description: 'Modifies properties of an existing VLAN sub-interface (`/interface vlan set [find name="..."]`).' + " Accepts any subset of the create parameters; omit fields to leave them unchanged." + " Supply the current `name` from `list_vlan_interfaces` or `get_vlan_interface`; use `new_name` to rename the interface." + " For creating a new VLAN interface use `create_vlan_interface`; to permanently delete use `remove_vlan_interface`." + " Returns the updated interface's full detail after applying the change." + " ARP mode accepts: enabled, disabled, proxy-arp, reply-only.",
     inputSchema: {
-      name: z108.string().describe("Current name of the VLAN interface to update"),
-      new_name: z108.string().optional(),
-      vlan_id: z108.number().int().min(1).max(4094).optional(),
-      interface: z108.string().optional(),
-      comment: z108.string().optional(),
-      disabled: z108.boolean().optional(),
-      mtu: z108.number().int().optional(),
-      use_service_tag: z108.boolean().optional(),
+      name: z109.string().describe("Current name of the VLAN interface to update"),
+      new_name: z109.string().optional(),
+      vlan_id: z109.number().int().min(1).max(4094).optional(),
+      interface: z109.string().optional(),
+      comment: z109.string().optional(),
+      disabled: z109.boolean().optional(),
+      mtu: z109.number().int().optional(),
+      use_service_tag: z109.boolean().optional(),
       arp: ArpMode2.optional(),
-      arp_timeout: z108.string().optional(),
+      arp_timeout: z109.string().optional(),
       loop_protect: LoopProtect.optional().describe("Loop protection: default, on, off"),
-      loop_protect_disable_time: z108.string().optional().describe("Time to disable interface on loop detection, e.g. '5m' (0 = forever)"),
-      loop_protect_send_interval: z108.string().optional().describe("Interval between loop-protect probe packets, e.g. '5s'")
+      loop_protect_disable_time: z109.string().optional().describe("Time to disable interface on loop detection, e.g. '5m' (0 = forever)"),
+      loop_protect_send_interval: z109.string().optional().describe("Interval between loop-protect probe packets, e.g. '5s'")
     },
     async handler(a, ctx) {
       ctx.info(`Updating VLAN interface: name=${a.name}`);
@@ -21915,7 +22374,7 @@ ${details}`;
     title: "Remove VLAN Interface",
     annotations: DESTRUCTIVE,
     description: 'Permanently deletes a VLAN sub-interface (`/interface vlan remove [find name="..."]`) after confirming it exists via a count-only check.' + " Supply the interface `name` from `list_vlan_interfaces` or `get_vlan_interface`." + " Removing a VLAN interface also removes IP addresses assigned to it; firewall rules and other configuration that reference it by name are not automatically deleted and will remain as orphaned, ineffective entries." + " To disable a VLAN temporarily without deleting it use `update_vlan_interface` with `disabled=true`.",
-    inputSchema: { name: z108.string() },
+    inputSchema: { name: z109.string() },
     async handler(a, ctx) {
       ctx.info(`Removing VLAN interface: name=${a.name}`);
       const count = await executeMikrotikCommand(`/interface vlan print count-only where name="${a.name}"`, ctx);
@@ -21930,7 +22389,7 @@ ${details}`;
 ];
 
 // src/tools/wireguard-mesh.ts
-import { z as z109 } from "zod";
+import { z as z110 } from "zod";
 function meshAddress(prefix, index) {
   const [net, len = "24"] = prefix.split("/");
   const octets = net.split(".");
@@ -21947,16 +22406,16 @@ var wireguardMeshTools = [
     annotations: DANGEROUS,
     description: "Stands up a WireGuard VPN across several configured devices in ONE call: ensures a WireGuard " + "interface on each, reads each device's public key, assigns every device a mesh address from " + "`address_prefix`, then wires the peers between routers \u2014 `topology=full-mesh` connects every " + "pair, `hub-spoke` connects the `hub` to each spoke \u2014 distributing public keys automatically. " + "Endpoints default to each device's configured host (override per device via `endpoints`); add " + "each site's LAN subnet via `allowed_lans` to route it through the tunnel. DEFAULTS TO A DRY RUN " + "(`apply=false`) that shows the full plan; set `apply=true` to build it. Operates across " + "MULTIPLE devices, so it is not affected by the single `device` selector. SSH devices only " + "(needs to read public keys). Returns the plan, or a per-device build report.",
     inputSchema: {
-      devices: z109.array(z109.string()).min(2).describe("Configured device names to include in the mesh (2+)"),
-      address_prefix: z109.string().default("10.20.0.0/24").describe("Mesh subnet; each device gets <prefix>.<index+1> on its WireGuard interface"),
-      interface: z109.string().default("wg-mesh").describe("WireGuard interface name to create/use"),
-      listen_port: z109.number().int().default(13231),
-      topology: z109.enum(["full-mesh", "hub-spoke"]).default("full-mesh"),
-      hub: z109.string().optional().describe("Hub device name (required when topology=hub-spoke)"),
-      endpoints: z109.record(z109.string(), z109.string()).optional().describe('Per-device public endpoint host override, e.g. {"site-a":"a.example.com"}'),
-      allowed_lans: z109.record(z109.string(), z109.string()).optional().describe('Per-device LAN subnet to route through the tunnel, e.g. {"site-a":"192.168.10.0/24"}'),
-      persistent_keepalive: z109.string().default("25s"),
-      apply: z109.boolean().default(false).describe("false = preview the plan (default); true = build")
+      devices: z110.array(z110.string()).min(2).describe("Configured device names to include in the mesh (2+)"),
+      address_prefix: z110.string().default("10.20.0.0/24").describe("Mesh subnet; each device gets <prefix>.<index+1> on its WireGuard interface"),
+      interface: z110.string().default("wg-mesh").describe("WireGuard interface name to create/use"),
+      listen_port: z110.number().int().default(13231),
+      topology: z110.enum(["full-mesh", "hub-spoke"]).default("full-mesh"),
+      hub: z110.string().optional().describe("Hub device name (required when topology=hub-spoke)"),
+      endpoints: z110.record(z110.string(), z110.string()).optional().describe('Per-device public endpoint host override, e.g. {"site-a":"a.example.com"}'),
+      allowed_lans: z110.record(z110.string(), z110.string()).optional().describe('Per-device LAN subnet to route through the tunnel, e.g. {"site-a":"192.168.10.0/24"}'),
+      persistent_keepalive: z110.string().default("25s"),
+      apply: z110.boolean().default(false).describe("false = preview the plan (default); true = build")
     },
     async handler(a, ctx) {
       const devices = a.devices;
@@ -22047,7 +22506,7 @@ Check handshakes per device with get_wireguard_peers / list_wireguard_peers.`;
 
 // src/tools/vpn-onboard.ts
 import { generateKeyPairSync } from "crypto";
-import { z as z110 } from "zod";
+import { z as z111 } from "zod";
 function generateWireGuardKeypair() {
   const { privateKey, publicKey } = generateKeyPairSync("x25519");
   const priv = privateKey.export({ type: "pkcs8", format: "der" });
@@ -22064,13 +22523,13 @@ var vpnOnboardTools = [
     annotations: WRITE,
     description: "Generates a ready-to-use WireGuard remote-access profile for one user: creates a client " + "keypair, adds the peer to the server `interface` (allowed-address = the client's tunnel IP), " + "reads the server's public key, and returns a complete client .conf to paste into the WireGuard " + "app or a QR generator. The peer is tagged `vpn-user: <user>` so revoke_wireguard_user can remove " + "it. NOTE: the returned config contains the client PRIVATE key (required to connect) \u2014 handle it " + "securely. `endpoint` is the server's public host:port; `allowed_ips` controls split vs full " + "tunnel. SSH devices only. Returns the client config.",
     inputSchema: {
-      interface: z110.string().describe("Existing WireGuard SERVER interface, e.g. 'wg-server'"),
-      user: z110.string().describe("User/device label, e.g. 'alice-laptop'"),
-      address: z110.string().describe("Tunnel IP to assign the client, e.g. '10.20.0.50'"),
-      endpoint: z110.string().describe("Server public endpoint host:port, e.g. 'vpn.example.com:13231'"),
-      dns: z110.string().optional().describe("DNS for the client, e.g. '10.20.0.1'"),
-      allowed_ips: z110.string().default("0.0.0.0/0").describe("Client AllowedIPs: '0.0.0.0/0' full-tunnel, or a LAN subnet for split-tunnel"),
-      keepalive: z110.string().default("25").describe("PersistentKeepalive seconds")
+      interface: z111.string().describe("Existing WireGuard SERVER interface, e.g. 'wg-server'"),
+      user: z111.string().describe("User/device label, e.g. 'alice-laptop'"),
+      address: z111.string().describe("Tunnel IP to assign the client, e.g. '10.20.0.50'"),
+      endpoint: z111.string().describe("Server public endpoint host:port, e.g. 'vpn.example.com:13231'"),
+      dns: z111.string().optional().describe("DNS for the client, e.g. '10.20.0.1'"),
+      allowed_ips: z111.string().default("0.0.0.0/0").describe("Client AllowedIPs: '0.0.0.0/0' full-tunnel, or a LAN subnet for split-tunnel"),
+      keepalive: z111.string().default("25").describe("PersistentKeepalive seconds")
     },
     async handler(a, ctx) {
       ctx.info(`Onboarding WireGuard user '${a.user}' on ${a.interface}`);
@@ -22108,7 +22567,7 @@ ${config}`;
     title: "Revoke WireGuard Remote User",
     annotations: DESTRUCTIVE,
     description: "Revokes a remote-access user created by onboard_wireguard_user: removes the WireGuard peer " + "tagged `vpn-user: <user>` from the server, immediately cutting their access. Returns whether a " + "peer was removed.",
-    inputSchema: { user: z110.string().describe("The user label used at onboarding") },
+    inputSchema: { user: z111.string().describe("The user label used at onboarding") },
     async handler(a, ctx) {
       const count = await executeMikrotikCommand(`/interface wireguard peers print count-only where comment="vpn-user: ${a.user}"`, ctx);
       if (count.trim() === "0")
@@ -22122,7 +22581,7 @@ ${config}`;
 ];
 
 // src/tools/wireguard.ts
-import { z as z111 } from "zod";
+import { z as z112 } from "zod";
 var wireguardTools = [
   defineTool({
     name: "create_wireguard_interface",
@@ -22130,12 +22589,12 @@ var wireguardTools = [
     annotations: WRITE,
     description: "Creates a WireGuard tunnel interface (`/interface wireguard`) \u2014 the local VPN endpoint" + " with a UDP listen port and private key. Use this to establish the server-side or site-to-site" + " WireGuard interface before adding remote peers with add_wireguard_peer." + " For IPsec tunnels use create_ipsec_peer; for L2TP use create_l2tp_client;" + " for OpenVPN use create_ovpn_client. Returns the created interface's detail including" + " its name and RouterOS-generated public key.",
     inputSchema: {
-      name: z111.string(),
-      listen_port: z111.number().int().optional(),
-      private_key: z111.string().optional(),
-      mtu: z111.number().int().optional(),
-      comment: z111.string().optional(),
-      disabled: z111.boolean().default(false)
+      name: z112.string(),
+      listen_port: z112.number().int().optional(),
+      private_key: z112.string().optional(),
+      mtu: z112.number().int().optional(),
+      comment: z112.string().optional(),
+      disabled: z112.boolean().default(false)
     },
     async handler(a, ctx) {
       ctx.info(`Creating WireGuard interface: name=${a.name}`);
@@ -22155,9 +22614,9 @@ ${details}` : "WireGuard interface created successfully.";
     annotations: READ,
     description: "`list_wireguard_interfaces` \u2014 READ / list / show / inspect all WireGuard tunnel interfaces" + " (`/interface wireguard print`). The go-to tool to read the current WireGuard state on a" + " device. Returns each interface's name, listen-port, public-key, MTU, and running/disabled" + " status. Filter by name substring (name_filter), disabled-only, or running-only." + " For one interface's full detail use get_wireguard_interface; for the peer table use" + " list_wireguard_peers; for interfaces AND peers in one call use get_wireguard_status.",
     inputSchema: {
-      name_filter: z111.string().optional(),
-      disabled_only: z111.boolean().default(false),
-      running_only: z111.boolean().default(false)
+      name_filter: z112.string().optional(),
+      disabled_only: z112.boolean().default(false),
+      running_only: z112.boolean().default(false)
     },
     async handler(a, ctx) {
       ctx.info("Listing WireGuard interfaces");
@@ -22179,7 +22638,7 @@ ${result}`;
     title: "Get WireGuard Interface Details",
     annotations: READ,
     description: "`get_wireguard_interface` \u2014 READ / get / show the full detail of ONE WireGuard tunnel interface" + " (`/interface wireguard print detail`) looked up by name. Returns listen-port, private-key," + " public-key, MTU, running state, and comment. To list all interfaces use" + " list_wireguard_interfaces; for that interface's peers use list_wireguard_peers; for" + " interfaces AND peers in one call use get_wireguard_status.",
-    inputSchema: { name: z111.string() },
+    inputSchema: { name: z112.string() },
     async handler(a, ctx) {
       ctx.info(`Getting WireGuard interface details: name=${a.name}`);
       const result = await executeMikrotikCommand(`/interface wireguard print detail where name="${a.name}"`, ctx);
@@ -22194,7 +22653,7 @@ ${result}`;
     annotations: READ,
     description: "`get_wireguard_status` \u2014 READ the current WireGuard state on a device in ONE call: ALL tunnel" + " interfaces AND ALL peers together. Use this FIRST to inspect / show / check WireGuard before" + " changing anything (e.g. to read public keys, see which side initiates, or confirm the tunnel" + " is up). Interfaces report name, listen-port, public-key, MTU and running state; peers report" + " .id, interface, public-key, allowed-address, endpoint/current-endpoint, last-handshake time" + " and rx/tx bytes. Combines list_wireguard_interfaces + list_wireguard_peers; optionally filter" + " both to one interface with interface_filter.",
     inputSchema: {
-      interface_filter: z111.string().optional().describe("Limit to one interface name, e.g. 'wg-mesh'")
+      interface_filter: z112.string().optional().describe("Limit to one interface name, e.g. 'wg-mesh'")
     },
     async handler(a, ctx) {
       ctx.info("Reading WireGuard status (interfaces + peers)");
@@ -22219,13 +22678,13 @@ ${peerBlock}`;
     annotations: WRITE_IDEMPOTENT,
     description: "Modifies settings on an existing WireGuard tunnel interface (`/interface wireguard set [find name=]`)" + " \u2014 rename (new_name), change listen-port, rotate private-key, adjust MTU, or toggle disabled state." + " Only supplied fields are changed; omitted fields are left as-is." + " For updating remote peers use update_wireguard_peer." + " Returns the updated interface's detail.",
     inputSchema: {
-      name: z111.string(),
-      new_name: z111.string().optional(),
-      listen_port: z111.number().int().optional(),
-      private_key: z111.string().optional(),
-      mtu: z111.number().int().optional(),
-      comment: z111.string().optional(),
-      disabled: z111.boolean().optional()
+      name: z112.string(),
+      new_name: z112.string().optional(),
+      listen_port: z112.number().int().optional(),
+      private_key: z112.string().optional(),
+      mtu: z112.number().int().optional(),
+      comment: z112.string().optional(),
+      disabled: z112.boolean().optional()
     },
     async handler(a, ctx) {
       ctx.info(`Updating WireGuard interface: name=${a.name}`);
@@ -22248,7 +22707,7 @@ ${details}`;
     title: "Remove WireGuard Interface",
     annotations: DESTRUCTIVE,
     description: "Permanently deletes a WireGuard tunnel interface (`/interface wireguard remove`) by name." + " Verifies existence first with count-only; removing the interface also removes all its associated peers." + " For removing only a specific peer without touching the interface use remove_wireguard_peer.",
-    inputSchema: { name: z111.string() },
+    inputSchema: { name: z112.string() },
     async handler(a, ctx) {
       ctx.info(`Removing WireGuard interface: name=${a.name}`);
       const count = await executeMikrotikCommand(`/interface wireguard print count-only where name="${a.name}"`, ctx);
@@ -22265,7 +22724,7 @@ ${details}`;
     title: "Enable WireGuard Interface",
     annotations: WRITE_IDEMPOTENT,
     description: "Enables a disabled WireGuard tunnel interface (`/interface wireguard enable`) by name," + " allowing it to accept and establish tunnel connections." + " For enabling a specific peer without affecting the interface use enable_wireguard_peer." + " To undo, use disable_wireguard_interface.",
-    inputSchema: { name: z111.string() },
+    inputSchema: { name: z112.string() },
     async handler(a, ctx) {
       ctx.info(`Enabling WireGuard interface: name=${a.name}`);
       const result = await executeMikrotikCommand(`/interface wireguard enable [find name="${a.name}"]`, ctx);
@@ -22279,7 +22738,7 @@ ${details}`;
     title: "Disable WireGuard Interface",
     annotations: WRITE_IDEMPOTENT,
     description: "Disables a WireGuard tunnel interface (`/interface wireguard disable`) by name," + " stopping all tunnel traffic through it without removing the interface or its peers." + " For disabling only a specific peer use disable_wireguard_peer." + " To re-enable use enable_wireguard_interface.",
-    inputSchema: { name: z111.string() },
+    inputSchema: { name: z112.string() },
     async handler(a, ctx) {
       ctx.info(`Disabling WireGuard interface: name=${a.name}`);
       const result = await executeMikrotikCommand(`/interface wireguard disable [find name="${a.name}"]`, ctx);
@@ -22299,23 +22758,23 @@ ${details}`;
 ` + `  endpoint_address: remote host IP or hostname e.g. "203.0.113.1" (omit for road-warrior clients that dial in)
 ` + '  persistent_keepalive: seconds as string e.g. "25"',
     inputSchema: {
-      interface: z111.string(),
-      public_key: z111.string(),
-      allowed_address: z111.string().describe('CIDR, comma-separated for multiple e.g. "10.0.0.2/32" or "10.0.0.0/24,192.168.0.0/24"'),
-      endpoint_address: z111.string().optional().describe('remote host IP or hostname e.g. "203.0.113.1"'),
-      endpoint_port: z111.number().int().optional(),
-      preshared_key: z111.string().optional(),
-      persistent_keepalive: z111.string().optional().describe('seconds as string e.g. "25"'),
-      name: z111.string().optional().describe("optional peer name label"),
-      private_key: z111.string().optional().describe("peer's private key (lets the router generate this peer's client config)"),
-      responder: z111.boolean().optional().describe("only respond to handshakes, never initiate (for road-warrior clients)"),
-      client_address: z111.string().optional().describe("client tunnel address(es) for the generated client config"),
-      client_dns: z111.string().optional().describe("DNS server(s) written into the generated client config"),
-      client_endpoint: z111.string().optional().describe("server endpoint host[:port] written into the generated client config"),
-      client_keepalive: z111.string().optional().describe('client persistent-keepalive for the generated config e.g. "25s"'),
-      client_listen_port: z111.number().int().optional().describe("listen-port written into the generated client config"),
-      comment: z111.string().optional(),
-      disabled: z111.boolean().default(false)
+      interface: z112.string(),
+      public_key: z112.string(),
+      allowed_address: z112.string().describe('CIDR, comma-separated for multiple e.g. "10.0.0.2/32" or "10.0.0.0/24,192.168.0.0/24"'),
+      endpoint_address: z112.string().optional().describe('remote host IP or hostname e.g. "203.0.113.1"'),
+      endpoint_port: z112.number().int().optional(),
+      preshared_key: z112.string().optional(),
+      persistent_keepalive: z112.string().optional().describe('seconds as string e.g. "25"'),
+      name: z112.string().optional().describe("optional peer name label"),
+      private_key: z112.string().optional().describe("peer's private key (lets the router generate this peer's client config)"),
+      responder: z112.boolean().optional().describe("only respond to handshakes, never initiate (for road-warrior clients)"),
+      client_address: z112.string().optional().describe("client tunnel address(es) for the generated client config"),
+      client_dns: z112.string().optional().describe("DNS server(s) written into the generated client config"),
+      client_endpoint: z112.string().optional().describe("server endpoint host[:port] written into the generated client config"),
+      client_keepalive: z112.string().optional().describe('client persistent-keepalive for the generated config e.g. "25s"'),
+      client_listen_port: z112.number().int().optional().describe("listen-port written into the generated client config"),
+      comment: z112.string().optional(),
+      disabled: z112.boolean().default(false)
     },
     async handler(a, ctx) {
       ctx.info(`Adding WireGuard peer: interface=${a.interface}, public_key=${a.public_key.slice(0, 12)}...`);
@@ -22335,8 +22794,8 @@ ${details}` : "WireGuard peer added successfully.";
     annotations: READ,
     description: "`list_wireguard_peers` \u2014 READ / list / show / inspect all WireGuard peers" + " (`/interface wireguard peers print`). Use this to read which peers are configured and" + " whether the tunnel is up (handshake). Returns each peer's .id, interface, public-key," + " allowed-address, endpoint/current-endpoint, last-handshake time, and rx/tx byte counters." + " Filter by interface name (interface_filter) or disabled-only. For the interface table use" + " list_wireguard_interfaces; for one peer's full detail use get_wireguard_peer; for interfaces" + " AND peers in one call use get_wireguard_status. Use the .id from this output with" + " update_wireguard_peer, remove_wireguard_peer, enable_wireguard_peer, or disable_wireguard_peer.",
     inputSchema: {
-      interface_filter: z111.string().optional(),
-      disabled_only: z111.boolean().default(false)
+      interface_filter: z112.string().optional(),
+      disabled_only: z112.boolean().default(false)
     },
     async handler(a, ctx) {
       ctx.info("Listing WireGuard peers");
@@ -22360,7 +22819,7 @@ ${result}`;
 ` + `Notes:
 ` + '  peer_id: the .id from list_wireguard_peers, format "*N" or "N" e.g. "*2"',
     inputSchema: {
-      peer_id: z111.string().describe('"*N" or "N" from list output e.g. "*2"')
+      peer_id: z112.string().describe('"*N" or "N" from list output e.g. "*2"')
     },
     async handler(a, ctx) {
       ctx.info(`Getting WireGuard peer details: peer_id=${a.peer_id}`);
@@ -22382,22 +22841,22 @@ ${result}`;
 ` + `  persistent_keepalive: seconds as string e.g. "25"
 ` + '  Pass "" for endpoint_address or preshared_key to clear them.',
     inputSchema: {
-      peer_id: z111.string().describe('"*N" or "N" from list output e.g. "*2"'),
-      allowed_address: z111.string().optional(),
-      endpoint_address: z111.string().optional(),
-      endpoint_port: z111.number().int().optional(),
-      preshared_key: z111.string().optional(),
-      persistent_keepalive: z111.string().optional(),
-      name: z111.string().optional().describe("optional peer name label"),
-      private_key: z111.string().optional().describe("peer's private key (lets the router generate this peer's client config)"),
-      responder: z111.boolean().optional().describe("only respond to handshakes, never initiate"),
-      client_address: z111.string().optional().describe("client tunnel address(es) for the generated client config"),
-      client_dns: z111.string().optional().describe("DNS server(s) written into the generated client config"),
-      client_endpoint: z111.string().optional().describe("server endpoint host[:port] written into the generated client config"),
-      client_keepalive: z111.string().optional().describe('client persistent-keepalive for the generated config e.g. "25s"'),
-      client_listen_port: z111.number().int().optional().describe("listen-port written into the generated client config"),
-      comment: z111.string().optional(),
-      disabled: z111.boolean().optional()
+      peer_id: z112.string().describe('"*N" or "N" from list output e.g. "*2"'),
+      allowed_address: z112.string().optional(),
+      endpoint_address: z112.string().optional(),
+      endpoint_port: z112.number().int().optional(),
+      preshared_key: z112.string().optional(),
+      persistent_keepalive: z112.string().optional(),
+      name: z112.string().optional().describe("optional peer name label"),
+      private_key: z112.string().optional().describe("peer's private key (lets the router generate this peer's client config)"),
+      responder: z112.boolean().optional().describe("only respond to handshakes, never initiate"),
+      client_address: z112.string().optional().describe("client tunnel address(es) for the generated client config"),
+      client_dns: z112.string().optional().describe("DNS server(s) written into the generated client config"),
+      client_endpoint: z112.string().optional().describe("server endpoint host[:port] written into the generated client config"),
+      client_keepalive: z112.string().optional().describe('client persistent-keepalive for the generated config e.g. "25s"'),
+      client_listen_port: z112.number().int().optional().describe("listen-port written into the generated client config"),
+      comment: z112.string().optional(),
+      disabled: z112.boolean().optional()
     },
     async handler(a, ctx) {
       ctx.info(`Updating WireGuard peer: peer_id=${a.peer_id}`);
@@ -22423,7 +22882,7 @@ ${details}`;
 ` + `Notes:
 ` + '  peer_id: the .id from list_wireguard_peers, format "*N" or "N" e.g. "*2"',
     inputSchema: {
-      peer_id: z111.string().describe('"*N" or "N" from list output e.g. "*2"')
+      peer_id: z112.string().describe('"*N" or "N" from list output e.g. "*2"')
     },
     async handler(a, ctx) {
       ctx.info(`Removing WireGuard peer: peer_id=${a.peer_id}`);
@@ -22445,7 +22904,7 @@ ${details}`;
 ` + `Notes:
 ` + '  peer_id: the .id from list_wireguard_peers, format "*N" or "N" e.g. "*2"',
     inputSchema: {
-      peer_id: z111.string().describe('"*N" or "N" from list output e.g. "*2"')
+      peer_id: z112.string().describe('"*N" or "N" from list output e.g. "*2"')
     },
     async handler(a, ctx) {
       ctx.info(`Enabling WireGuard peer: peer_id=${a.peer_id}`);
@@ -22464,7 +22923,7 @@ ${details}`;
 ` + `Notes:
 ` + '  peer_id: the .id from list_wireguard_peers, format "*N" or "N" e.g. "*2"',
     inputSchema: {
-      peer_id: z111.string().describe('"*N" or "N" from list output e.g. "*2"')
+      peer_id: z112.string().describe('"*N" or "N" from list output e.g. "*2"')
     },
     async handler(a, ctx) {
       ctx.info(`Disabling WireGuard peer: peer_id=${a.peer_id}`);
@@ -22484,14 +22943,14 @@ ${details}`;
 ` + `  allowed_ips: CIDRs routed through the tunnel by the client, default "0.0.0.0/0" (all IPv4 traffic; add ::/0 to also route IPv6)
 ` + "  persistent_keepalive: seconds integer, default 25",
     inputSchema: {
-      client_private_key: z111.string(),
-      client_address: z111.string(),
-      server_public_key: z111.string(),
-      server_endpoint: z111.string(),
-      server_port: z111.number().int().default(51820),
-      allowed_ips: z111.string().default("0.0.0.0/0"),
-      dns: z111.string().optional(),
-      persistent_keepalive: z111.number().int().default(25)
+      client_private_key: z112.string(),
+      client_address: z112.string(),
+      server_public_key: z112.string(),
+      server_endpoint: z112.string(),
+      server_port: z112.number().int().default(51820),
+      allowed_ips: z112.string().default("0.0.0.0/0"),
+      dns: z112.string().optional(),
+      persistent_keepalive: z112.number().int().default(25)
     },
     async handler(a, ctx) {
       ctx.info("Generating WireGuard client configuration");
@@ -22525,7 +22984,7 @@ ${details}`;
 ];
 
 // src/tools/wireless.ts
-import { z as z112 } from "zod";
+import { z as z113 } from "zod";
 var V7_WIFI = ["/interface wifi", "/interface wifiwave2"];
 function commandUnsupported2(result) {
   const t = result.toLowerCase();
@@ -22556,12 +23015,12 @@ var wirelessTools = [
     annotations: WRITE,
     description: "Creates a wireless interface (`/interface wifi`, `/interface wifiwave2`, `/interface wireless`, or `/interface wlan` \u2014 auto-detected per device). " + "Use to add a new AP or station interface to the device. " + "On RouterOS v7 accepts name, ssid, disabled, and comment; on v6/legacy also requires radio_name (e.g. `wlan1`) and optionally accepts mode (default `ap-bridge`), frequency, band, channel_width, and security_profile. " + "To modify an existing interface use update_wireless_interface; to see current interfaces use list_wireless_interfaces. " + "Returns the created interface's full detail print including its `.id`.",
     inputSchema: {
-      name: z112.string(),
-      ssid: z112.string().optional(),
-      disabled: z112.boolean().default(false),
-      comment: z112.string().optional(),
-      radio_name: z112.string().optional().describe("Required for legacy wireless systems, e.g. 'wlan1'"),
-      mode: z112.enum([
+      name: z113.string(),
+      ssid: z113.string().optional(),
+      disabled: z113.boolean().default(false),
+      comment: z113.string().optional(),
+      radio_name: z113.string().optional().describe("Required for legacy wireless systems, e.g. 'wlan1'"),
+      mode: z113.enum([
         "ap-bridge",
         "bridge",
         "station",
@@ -22571,8 +23030,8 @@ var wirelessTools = [
         "ap-bridge-wds",
         "alignment-only"
       ]).optional(),
-      frequency: z112.string().optional(),
-      band: z112.enum([
+      frequency: z113.string().optional(),
+      band: z113.enum([
         "2ghz-b",
         "2ghz-b/g",
         "2ghz-b/g/n",
@@ -22584,24 +23043,24 @@ var wirelessTools = [
         "5ghz-n",
         "5ghz-ac"
       ]).optional(),
-      channel_width: z112.enum(["20mhz", "40mhz", "80mhz", "160mhz", "20/40mhz-eC", "20/40mhz-Ce"]).optional(),
-      security_profile: z112.string().optional(),
-      mtu: z112.number().int().optional().describe("Interface MTU in bytes"),
-      arp: z112.enum(["disabled", "enabled", "proxy-arp", "reply-only", "local-proxy-arp"]).optional().describe("ARP mode for the interface"),
-      hide_ssid: z112.boolean().optional().describe("Legacy: do not broadcast the SSID in beacons (AP modes)"),
-      wireless_protocol: z112.string().optional().describe("Legacy: wireless protocol, e.g. '802.11', 'nv2', 'nstreme'"),
-      scan_list: z112.string().optional().describe("Legacy: frequencies/ranges to scan (e.g. 'default' or '5180-5320')"),
-      frequency_mode: z112.enum(["manual-txpower", "regulatory-domain", "superchannel"]).optional().describe("Legacy: regulatory frequency mode"),
-      country: z112.string().optional().describe("Legacy: regulatory country setting (e.g. 'united states')"),
-      antenna_gain: z112.number().int().optional().describe("Legacy: antenna gain in dBi used for tx-power calculations"),
-      wds_mode: z112.enum(["disabled", "dynamic", "dynamic-mesh", "static", "static-mesh"]).optional().describe("Legacy: WDS mode"),
-      wds_default_bridge: z112.string().optional().describe("Legacy: bridge that dynamic WDS interfaces are added to"),
-      default_authentication: z112.boolean().optional().describe("Legacy: allow clients not in the access-list to authenticate"),
-      default_forwarding: z112.boolean().optional().describe("Legacy: allow client-to-client forwarding by default"),
-      tx_power: z112.number().int().optional().describe("Legacy: manual transmit power in dBm"),
-      tx_power_mode: z112.enum(["default", "card-rates", "all-rates-fixed", "manual-table"]).optional().describe("Legacy: how tx-power is determined"),
-      distance: z112.string().optional().describe("Legacy: link distance ('dynamic', 'indoors', or a km value)"),
-      disconnect_timeout: z112.string().optional().describe("Legacy: time before a non-responding client is disconnected")
+      channel_width: z113.enum(["20mhz", "40mhz", "80mhz", "160mhz", "20/40mhz-eC", "20/40mhz-Ce"]).optional(),
+      security_profile: z113.string().optional(),
+      mtu: z113.number().int().optional().describe("Interface MTU in bytes"),
+      arp: z113.enum(["disabled", "enabled", "proxy-arp", "reply-only", "local-proxy-arp"]).optional().describe("ARP mode for the interface"),
+      hide_ssid: z113.boolean().optional().describe("Legacy: do not broadcast the SSID in beacons (AP modes)"),
+      wireless_protocol: z113.string().optional().describe("Legacy: wireless protocol, e.g. '802.11', 'nv2', 'nstreme'"),
+      scan_list: z113.string().optional().describe("Legacy: frequencies/ranges to scan (e.g. 'default' or '5180-5320')"),
+      frequency_mode: z113.enum(["manual-txpower", "regulatory-domain", "superchannel"]).optional().describe("Legacy: regulatory frequency mode"),
+      country: z113.string().optional().describe("Legacy: regulatory country setting (e.g. 'united states')"),
+      antenna_gain: z113.number().int().optional().describe("Legacy: antenna gain in dBi used for tx-power calculations"),
+      wds_mode: z113.enum(["disabled", "dynamic", "dynamic-mesh", "static", "static-mesh"]).optional().describe("Legacy: WDS mode"),
+      wds_default_bridge: z113.string().optional().describe("Legacy: bridge that dynamic WDS interfaces are added to"),
+      default_authentication: z113.boolean().optional().describe("Legacy: allow clients not in the access-list to authenticate"),
+      default_forwarding: z113.boolean().optional().describe("Legacy: allow client-to-client forwarding by default"),
+      tx_power: z113.number().int().optional().describe("Legacy: manual transmit power in dBm"),
+      tx_power_mode: z113.enum(["default", "card-rates", "all-rates-fixed", "manual-table"]).optional().describe("Legacy: how tx-power is determined"),
+      distance: z113.string().optional().describe("Legacy: link distance ('dynamic', 'indoors', or a km value)"),
+      disconnect_timeout: z113.string().optional().describe("Legacy: time before a non-responding client is disconnected")
     },
     async handler(a, ctx) {
       ctx.info(`Creating wireless interface: name=${a.name}, ssid=${a.ssid}`);
@@ -22633,9 +23092,9 @@ ${details}`;
     annotations: READ,
     description: "Lists all wireless interfaces (`/interface wifi`, `/interface wifiwave2`, `/interface wireless`, `/interface wlan`) \u2014 probes every supported command path and aggregates results. " + "Filters by name_filter (substring match), disabled_only, or running_only. " + "For full property detail on a single interface use get_wireless_interface; to see currently connected clients use get_wireless_registration_table. " + "Falls back to `/interface print` with debugging info when no wireless interfaces match, to help identify the correct path on the device.",
     inputSchema: {
-      name_filter: z112.string().optional(),
-      disabled_only: z112.boolean().default(false),
-      running_only: z112.boolean().default(false)
+      name_filter: z113.string().optional(),
+      disabled_only: z113.boolean().default(false),
+      running_only: z113.boolean().default(false)
     },
     async handler(a, ctx) {
       ctx.info(`Listing wireless interfaces with filters: name=${a.name_filter}`);
@@ -22689,7 +23148,7 @@ NOTE: If you see wireless interfaces above, they might be using a different comm
     title: "Get Wireless Interface Details",
     annotations: READ,
     description: "Retrieves the full detail of one named wireless interface (`<auto-detected path> print detail where name=...`), " + "probing `/interface wifi`, `/interface wifiwave2`, `/interface wireless`, and `/interface wlan` in order. " + "Use when you need all properties of a single interface; for a summary of all interfaces use list_wireless_interfaces. " + "Returns the complete property set for the named interface, or an error if not found.",
-    inputSchema: { name: z112.string() },
+    inputSchema: { name: z113.string() },
     async handler(a, ctx) {
       ctx.info(`Getting wireless interface details: name=${a.name}`);
       const interfaceType = await detectWirelessInterfaceType(ctx);
@@ -22708,7 +23167,7 @@ ${result}`;
     title: "Remove Wireless Interface",
     annotations: DESTRUCTIVE,
     description: "Permanently deletes a named wireless interface (`<auto-detected path> remove [find name=...]`). " + "Verifies the interface exists first (count-only check) and returns an error if not found. " + "This action is irreversible \u2014 to keep the interface but stop traffic use disable_wireless_interface; " + "for property changes only use update_wireless_interface.",
-    inputSchema: { name: z112.string() },
+    inputSchema: { name: z113.string() },
     async handler(a, ctx) {
       ctx.info(`Removing wireless interface: name=${a.name}`);
       const interfaceType = await detectWirelessInterfaceType(ctx);
@@ -22728,7 +23187,7 @@ ${result}`;
     title: "Enable Wireless Interface",
     annotations: WRITE_IDEMPOTENT,
     description: "Enables a named wireless interface that is currently disabled (`<auto-detected path> enable [find name=...]`). " + "Idempotent \u2014 safe to call on an already-enabled interface. " + "For the reverse operation use disable_wireless_interface; to change other settings at the same time use update_wireless_interface. " + "Obtain the interface name from list_wireless_interfaces.",
-    inputSchema: { name: z112.string() },
+    inputSchema: { name: z113.string() },
     async handler(a, ctx) {
       ctx.info(`Enabling wireless interface: ${a.name}`);
       const interfaceType = await detectWirelessInterfaceType(ctx);
@@ -22745,7 +23204,7 @@ ${result}`;
     title: "Disable Wireless Interface",
     annotations: WRITE_IDEMPOTENT,
     description: "Disables a named wireless interface without removing it (`<auto-detected path> disable [find name=...]`). " + "Idempotent \u2014 safe to call on an already-disabled interface. " + "For the reverse operation use enable_wireless_interface; to delete the interface permanently use remove_wireless_interface. " + "Obtain the interface name from list_wireless_interfaces.",
-    inputSchema: { name: z112.string() },
+    inputSchema: { name: z113.string() },
     async handler(a, ctx) {
       ctx.info(`Disabling wireless interface: ${a.name}`);
       const interfaceType = await detectWirelessInterfaceType(ctx);
@@ -22763,8 +23222,8 @@ ${result}`;
     annotations: READ,
     description: "Scans for visible nearby wireless networks/SSIDs/APs in range (`<auto-detected path> scan <interface> duration=<n>`). " + "Use to discover external networks \u2014 not to list connected clients. " + "For currently associated client stations use get_wireless_registration_table instead. " + "`interface` is the local wireless interface name to scan from (e.g. `wlan1`); `duration` is scan time in seconds (default 5). " + "Returns raw scan output from the device.",
     inputSchema: {
-      interface: z112.string(),
-      duration: z112.number().int().default(5)
+      interface: z113.string(),
+      duration: z113.number().int().default(5)
     },
     async handler(a, ctx) {
       ctx.info(`Scanning wireless networks on interface: ${a.interface}`);
@@ -22786,7 +23245,7 @@ ${result}`;
     annotations: READ,
     description: "Retrieves the wireless registration table \u2014 the list of client stations currently associated to this AP (`<auto-detected path> registration-table print [where interface=...]`). " + "Each row is an actively connected wireless client with its MAC address, signal strength, and statistics. " + "To discover nearby external APs/SSIDs instead use scan_wireless_networks. " + "Optionally filter by interface name; omit to return all clients across all wireless interfaces.",
     inputSchema: {
-      interface: z112.string().optional()
+      interface: z113.string().optional()
     },
     async handler(a, ctx) {
       ctx.info(`Getting wireless registration table for interface: ${a.interface}`);
@@ -22848,7 +23307,7 @@ For legacy systems:
     title: "Create Wireless Security Profile (Legacy v6 Only \u2014 Not Implemented)",
     annotations: WRITE,
     description: "Stub for creating a `/interface wireless security-profiles` entry \u2014 a RouterOS v6 concept that does not exist in v7. " + "On RouterOS v7 devices (`/interface wifi` or `/interface wifiwave2`) always returns a not-supported message; security is configured directly on the interface. " + "On v6 this is also not implemented and returns an error. " + "For v6 interface creation with a security profile use create_wireless_interface (security_profile arg); for v7, security is configured directly on the interface but is not exposed by this server's wireless tools.",
-    inputSchema: { name: z112.string() },
+    inputSchema: { name: z113.string() },
     async handler(_a, ctx) {
       const interfaceType = await detectWirelessInterfaceType(ctx);
       if (interfaceType && V7_WIFI.includes(interfaceType)) {
@@ -22875,7 +23334,7 @@ For legacy systems:
     title: "Get Wireless Security Profile (Legacy v6 Only \u2014 Not Implemented)",
     annotations: READ,
     description: "Stub for retrieving a named `/interface wireless security-profiles` entry \u2014 a RouterOS v6 concept that does not exist in v7. " + "On RouterOS v7 devices always returns a not-supported message; on v6 also not implemented. " + "Use get_wireless_interface to inspect the security settings on a v7 wireless interface instead.",
-    inputSchema: { name: z112.string() },
+    inputSchema: { name: z113.string() },
     async handler(_a, ctx) {
       const interfaceType = await detectWirelessInterfaceType(ctx);
       if (interfaceType && V7_WIFI.includes(interfaceType)) {
@@ -22889,7 +23348,7 @@ For legacy systems:
     title: "Remove Wireless Security Profile (Legacy v6 Only \u2014 Not Implemented)",
     annotations: DESTRUCTIVE,
     description: "Stub for deleting a named `/interface wireless security-profiles` entry \u2014 a RouterOS v6 concept that does not exist in v7. " + "On RouterOS v7 devices always returns a not-supported message; on v6 also not implemented. " + "To delete a wireless interface entirely use remove_wireless_interface; to change security settings use update_wireless_interface.",
-    inputSchema: { name: z112.string() },
+    inputSchema: { name: z113.string() },
     async handler(_a, ctx) {
       const interfaceType = await detectWirelessInterfaceType(ctx);
       if (interfaceType && V7_WIFI.includes(interfaceType)) {
@@ -22904,8 +23363,8 @@ For legacy systems:
     annotations: WRITE,
     description: "Stub for assigning a named security profile to a v6 `/interface wireless` interface \u2014 a RouterOS v6 concept that does not exist in v7. " + "On RouterOS v7 devices always returns a not-supported message because security is set directly on the interface. " + "On v6 also not implemented. " + "To update a wireless interface's settings on supported versions use update_wireless_interface.",
     inputSchema: {
-      interface_name: z112.string(),
-      security_profile: z112.string()
+      interface_name: z113.string(),
+      security_profile: z113.string()
     },
     async handler(_a, ctx) {
       const interfaceType = await detectWirelessInterfaceType(ctx);
@@ -22946,7 +23405,7 @@ For legacy systems:
     title: "Remove Wireless Access List Entry (Legacy v6 Only \u2014 Not Implemented)",
     annotations: DESTRUCTIVE,
     description: "Stub for removing a `/interface wireless access-list` entry by ID \u2014 a RouterOS v6 concept. " + "On RouterOS v7 devices always returns a not-supported message; on v6 also not implemented. " + "The entry_id would take the `.id` from list_wireless_access_list if that were implemented. " + "For v7 access control use list_filter_rules and remove_filter_rule instead.",
-    inputSchema: { entry_id: z112.string() },
+    inputSchema: { entry_id: z113.string() },
     async handler(_a, ctx) {
       const interfaceType = await detectWirelessInterfaceType(ctx);
       if (interfaceType && V7_WIFI.includes(interfaceType)) {
@@ -22961,31 +23420,31 @@ For legacy systems:
     annotations: WRITE_IDEMPOTENT,
     description: "Updates settings on an existing named wireless interface (`<auto-detected path> set [find name=...] ...`). " + "Supports renaming (new_name), changing SSID, toggling disabled state, and updating comment. " + "Verifies the interface exists before applying; returns 'No updates specified.' if no optional fields are provided. " + "To only enable or disable the interface prefer enable_wireless_interface or disable_wireless_interface; " + "to create a new interface use create_wireless_interface; to delete one use remove_wireless_interface. " + "Returns the updated interface's full detail print.",
     inputSchema: {
-      name: z112.string(),
-      new_name: z112.string().optional(),
-      ssid: z112.string().optional(),
-      disabled: z112.boolean().optional(),
-      comment: z112.string().optional(),
-      mtu: z112.number().int().optional().describe("Interface MTU in bytes"),
-      arp: z112.enum(["disabled", "enabled", "proxy-arp", "reply-only", "local-proxy-arp"]).optional().describe("ARP mode for the interface"),
-      hide_ssid: z112.boolean().optional().describe("Legacy: do not broadcast the SSID in beacons (AP modes)"),
-      wireless_protocol: z112.string().optional().describe("Legacy: wireless protocol, e.g. '802.11', 'nv2', 'nstreme'"),
-      scan_list: z112.string().optional().describe("Legacy: frequencies/ranges to scan (e.g. 'default' or '5180-5320')"),
-      frequency: z112.string().optional().describe("Legacy: operating frequency in MHz"),
-      band: z112.string().optional().describe("Legacy: band, e.g. '2ghz-b/g/n' or '5ghz-a/n/ac'"),
-      channel_width: z112.enum(["20mhz", "40mhz", "80mhz", "160mhz", "20/40mhz-eC", "20/40mhz-Ce"]).optional().describe("Legacy: channel width"),
-      frequency_mode: z112.enum(["manual-txpower", "regulatory-domain", "superchannel"]).optional().describe("Legacy: regulatory frequency mode"),
-      country: z112.string().optional().describe("Legacy: regulatory country setting (e.g. 'united states')"),
-      antenna_gain: z112.number().int().optional().describe("Legacy: antenna gain in dBi used for tx-power calculations"),
-      wds_mode: z112.enum(["disabled", "dynamic", "dynamic-mesh", "static", "static-mesh"]).optional().describe("Legacy: WDS mode"),
-      wds_default_bridge: z112.string().optional().describe("Legacy: bridge that dynamic WDS interfaces are added to"),
-      default_authentication: z112.boolean().optional().describe("Legacy: allow clients not in the access-list to authenticate"),
-      default_forwarding: z112.boolean().optional().describe("Legacy: allow client-to-client forwarding by default"),
-      tx_power: z112.number().int().optional().describe("Legacy: manual transmit power in dBm"),
-      tx_power_mode: z112.enum(["default", "card-rates", "all-rates-fixed", "manual-table"]).optional().describe("Legacy: how tx-power is determined"),
-      distance: z112.string().optional().describe("Legacy: link distance ('dynamic', 'indoors', or a km value)"),
-      disconnect_timeout: z112.string().optional().describe("Legacy: time before a non-responding client is disconnected"),
-      security_profile: z112.string().optional().describe("Legacy: name of the security profile to apply")
+      name: z113.string(),
+      new_name: z113.string().optional(),
+      ssid: z113.string().optional(),
+      disabled: z113.boolean().optional(),
+      comment: z113.string().optional(),
+      mtu: z113.number().int().optional().describe("Interface MTU in bytes"),
+      arp: z113.enum(["disabled", "enabled", "proxy-arp", "reply-only", "local-proxy-arp"]).optional().describe("ARP mode for the interface"),
+      hide_ssid: z113.boolean().optional().describe("Legacy: do not broadcast the SSID in beacons (AP modes)"),
+      wireless_protocol: z113.string().optional().describe("Legacy: wireless protocol, e.g. '802.11', 'nv2', 'nstreme'"),
+      scan_list: z113.string().optional().describe("Legacy: frequencies/ranges to scan (e.g. 'default' or '5180-5320')"),
+      frequency: z113.string().optional().describe("Legacy: operating frequency in MHz"),
+      band: z113.string().optional().describe("Legacy: band, e.g. '2ghz-b/g/n' or '5ghz-a/n/ac'"),
+      channel_width: z113.enum(["20mhz", "40mhz", "80mhz", "160mhz", "20/40mhz-eC", "20/40mhz-Ce"]).optional().describe("Legacy: channel width"),
+      frequency_mode: z113.enum(["manual-txpower", "regulatory-domain", "superchannel"]).optional().describe("Legacy: regulatory frequency mode"),
+      country: z113.string().optional().describe("Legacy: regulatory country setting (e.g. 'united states')"),
+      antenna_gain: z113.number().int().optional().describe("Legacy: antenna gain in dBi used for tx-power calculations"),
+      wds_mode: z113.enum(["disabled", "dynamic", "dynamic-mesh", "static", "static-mesh"]).optional().describe("Legacy: WDS mode"),
+      wds_default_bridge: z113.string().optional().describe("Legacy: bridge that dynamic WDS interfaces are added to"),
+      default_authentication: z113.boolean().optional().describe("Legacy: allow clients not in the access-list to authenticate"),
+      default_forwarding: z113.boolean().optional().describe("Legacy: allow client-to-client forwarding by default"),
+      tx_power: z113.number().int().optional().describe("Legacy: manual transmit power in dBm"),
+      tx_power_mode: z113.enum(["default", "card-rates", "all-rates-fixed", "manual-table"]).optional().describe("Legacy: how tx-power is determined"),
+      distance: z113.string().optional().describe("Legacy: link distance ('dynamic', 'indoors', or a km value)"),
+      disconnect_timeout: z113.string().optional().describe("Legacy: time before a non-responding client is disconnected"),
+      security_profile: z113.string().optional().describe("Legacy: name of the security profile to apply")
     },
     async handler(a, ctx) {
       ctx.info(`Updating wireless interface: name=${a.name}`);
@@ -23011,7 +23470,7 @@ ${details}`;
 ];
 
 // src/tools/wifi-optimizer.ts
-import { z as z113 } from "zod";
+import { z as z114 } from "zod";
 function pickBestFrequency(monitor) {
   const cands = [];
   for (const line of monitor.split(`
@@ -23032,9 +23491,9 @@ var wifiOptimizerTools = [
     annotations: WRITE,
     description: "Runs an RF survey on a wireless radio (`/interface wireless frequency-monitor`, blocking for " + "`duration`), finds the least-congested channel, and reports a before/after. DEFAULTS TO A DRY " + "RUN (`apply=false`) \u2014 it surveys and recommends; set `apply=true` to set the radio to the best " + "frequency (`/interface wireless set`). Targets the LEGACY wireless stack; for wifiwave2 " + "(`/interface wifi`) tune via those tools. Returns the per-channel usage finding and the chosen " + "frequency.",
     inputSchema: {
-      interface: z113.string().describe("Wireless interface, e.g. 'wlan1'"),
-      duration: z113.string().default("5").describe("Survey duration in seconds"),
-      apply: z113.boolean().default(false).describe("false = survey & recommend (default); true = set it")
+      interface: z114.string().describe("Wireless interface, e.g. 'wlan1'"),
+      duration: z114.string().default("5").describe("Survey duration in seconds"),
+      apply: z114.boolean().default(false).describe("false = survey & recommend (default); true = set it")
     },
     async handler(a, ctx) {
       ctx.info(`Wi-Fi survey on ${a.interface} for ${a.duration}s`);
@@ -23585,6 +24044,13 @@ var moduleCatalog = [
     description: "Built-in RADIUS server: users, profiles, routers (NAS), limitations, sessions (`/user-manager`).",
     tools: userManagerTools
   },
+  {
+    label: "RADIUS & UM Dashboard",
+    slug: "aaa-dashboard",
+    group: "AAA",
+    description: "Interactive MCP App dashboard to manage RADIUS + User Manager (servers, users, profiles, " + "limitations, NAS, assignments, sessions, settings) with full add/edit/remove.",
+    tools: aaaViewTools
+  },
   {
     label: "Queues / QoS",
     slug: "queue",
@@ -23873,7 +24339,7 @@ function selectToolModules(filter = {}, catalog = moduleCatalog) {
 // package.json
 var package_default = {
   name: "@usex/mikrotik-mcp",
-  version: "3.24.0",
+  version: "3.26.0",
   description: "MCP server for MikroTik RouterOS \u2014 660+ tools over SSH for firewall, NAT, routing, DHCP, DNS, WireGuard, wireless, QoS and more.",
   keywords: [
     "ai",