@usex/mikrotik-mcp 3.50.0 → 3.51.0

package/dist/cli.js

@@ -3,11 +3,13 @@
 import {
   AAA_ENTITIES,
   ALWAYS_ON_MODULES,
+  Cmd,
   DEFAULT_CONFIG_HISTORY_DIR,
   DEFAULT_SNAPSHOT_DB,
   DEFAULT_TZSP_PORT,
   DeviceConfigSchema,
   MikrotikConfigSchema,
+  PROJECT_ROOT,
   PROMPTS_DIR,
   REDACTED,
   ToolFilterSchema,
@@ -16,6 +18,8 @@ import {
   addAaaEntity,
   allToolModules,
   allowDevice,
+  analyzeDrift,
+  attributeChanges,
   backupDir,
   blockDevice,
   buildChangePlan,
@@ -53,6 +57,7 @@ import {
   makeDeviceStatic,
   moduleCatalog,
   normalizeExport,
+  openMemoryStore,
   openSnapshotStore,
   parseKeyValues,
   parseLeadingNumber,
@@ -70,6 +75,7 @@ import {
   removeDeviceLease,
   renameBackup,
   renderPlan,
+  resetMemoryStore,
   resetRadiusCounters,
   resolveDeviceName,
   restoreLocalBackup,
@@ -89,15 +95,15 @@ import {
   toggleAaaEntity,
   updateAaaEntity,
   writeBackup
-} from "./shared/cli-z6dyvbeb.js";
+} from "./shared/cli-22wrpg71.js";
 
 // src/cli.ts
 import { existsSync as existsSync2 } from "fs";
 
 // src/observability/dashboard.ts
-import { readFileSync as readFileSync2 } from "fs";
+import { readFileSync as readFileSync3 } from "fs";
 import { homedir, networkInterfaces } from "os";
-import { dirname as dirname4, join as join2 } from "path";
+import { dirname as dirname4, join as join3 } from "path";
 var {serve } = globalThis.Bun;
 import { z } from "zod";
 
@@ -1140,149 +1146,297 @@ function computeStats(events, opts) {
     windowMs: span
   };
 }
-// package.json
-var package_default = {
-  name: "@usex/mikrotik-mcp",
-  version: "3.50.0",
-  description: "MCP server for MikroTik RouterOS \u2014 660+ tools over SSH for firewall, NAT, routing, DHCP, DNS, WireGuard, wireless, QoS and more.",
-  keywords: [
-    "ai",
-    "bun",
-    "claude",
-    "mcp",
-    "mikrotik",
-    "mikrotik mcp"
-  ],
-  homepage: "https://mikrotik-mcp.usestrict.dev",
-  bugs: {
-    url: "https://github.com/ali-master/mikrotik-mcp/issues"
-  },
-  license: "MIT",
-  author: {
-    name: "Ali Torki",
-    email: "ali_4286@live.com",
-    url: "https://github.com/ali-master"
-  },
-  repository: {
-    type: "git",
-    url: "https://github.com/ali-master/mikrotik-mcp.git"
-  },
-  bin: {
-    "mikrotik-mcp": "dist/cli.js"
-  },
-  files: [
-    "dist",
-    "prompts",
-    "schemas"
-  ],
-  type: "module",
-  main: "dist/index.js",
-  module: "dist/index.js",
-  types: "dist/index.d.ts",
-  exports: {
-    ".": {
-      types: "./dist/index.d.ts",
-      import: "./dist/index.js"
-    }
-  },
-  publishConfig: {
-    access: "public"
-  },
-  scripts: {
-    build: "bunup && chmod +x dist/cli.js && bun run build:ui",
-    "build:ui": "bun run scripts/build-ui.ts",
-    dev: "bunup --watch",
-    prepack: "bunup && chmod +x dist/cli.js && bun run build:ui",
-    "auth-check": "bun run src/cli.ts auth-check",
-    "gen:schemas": "bun run scripts/gen-schemas.ts",
-    "gen:docs": "bun run scripts/gen-tool-docs.ts",
-    gen: "bun run gen:schemas && bun run gen:docs",
-    start: "bun run src/cli.ts serve",
-    discover: "bun run scripts/discover-macs.ts",
-    inspect: "bunx @modelcontextprotocol/inspector bun run src/cli.ts serve",
-    "inspect:built": "bun run build && bunx @modelcontextprotocol/inspector bun dist/cli.js serve",
-    "inspect:config": "bunx @modelcontextprotocol/inspector --config mcp-inspector.config.json --server mikrotik",
-    "inspect:cli": "bunx @modelcontextprotocol/inspector --cli bun run src/cli.ts serve --method tools/list",
-    "inspect:config:local": "bunx @modelcontextprotocol/inspector --config /var/open-source/mikrotik-mcp/mcp-inspector.config.local.json --server mikrotik",
-    test: "vp test run",
-    "test:watch": "vp test",
-    release: "release-it",
-    "test:types": "tsc --noEmit",
-    check: "vp check",
-    lint: "vp lint",
-    "lint:fix": "vp lint --fix",
-    format: "vp fmt --check",
-    "format:fix": "vp fmt --write",
-    prepare: "vp config"
-  },
-  dependencies: {
-    "@modelcontextprotocol/ext-apps": "^1.7.4",
-    "@modelcontextprotocol/sdk": "^1.29.0",
-    "@tikoci/centrs": "^0.1.0",
-    figlet: "^1.11.0",
-    "gradient-string": "^3.0.0",
-    "ipaddr.js": "^2.4.0",
-    ssh2: "^1.17.0",
-    zod: "^4.4.3"
-  },
-  devDependencies: {
-    "@resvg/resvg-js": "^2.6.2",
-    "@tailwindcss/vite": "^4.3.2",
-    "@types/bun": "latest",
-    "@types/figlet": "^1.7.0",
-    "@types/node": "^26.1.0",
-    "@types/react": "^19.2.17",
-    "@types/react-dom": "^19.2.3",
-    "@types/ssh2": "^1.15.5",
-    "@types/update-notifier": "^6.0.8",
-    bunup: "^0.16.32",
-    "class-variance-authority": "^0.7.1",
-    clsx: "^2.1.1",
-    gsap: "^3.15.0",
-    prettier: "^3.9.4",
-    react: "^19.2.7",
-    "react-dom": "^19.2.7",
-    recharts: "^3.9.1",
-    "release-it": "^20.2.1",
-    "tailwind-merge": "^3.6.0",
-    tailwindcss: "^4.3.2",
-    vite: "npm:@voidzero-dev/vite-plus-core@latest",
-    "vite-plus": "^0.2.2"
-  },
-  peerDependencies: {
-    typescript: "^6.0.3"
-  },
-  overrides: {
-    vite: "npm:@voidzero-dev/vite-plus-core@latest",
-    vitest: "4.1.9"
-  },
-  engines: {
-    bun: ">=1.3.0"
-  },
-  packageManager: "bun@1.3.14",
-  changelog: {
-    labels: {
-      feature: "Features",
-      bug: "Bug fixes",
-      enhancement: "Enhancements",
-      docs: "Docs",
-      dependencies: "Dependencies",
-      "type: code style": "Code style tweaks",
-      "status: blocked": "Breaking changes",
-      "breaking change": "Breaking changes"
-    }
-  },
-  logo: "https://raw.githubusercontent.com/ali-master/mikrotik-mcp/master/assets/logo.svg",
-  logoIcon: "https://raw.githubusercontent.com/ali-master/mikrotik-mcp/master/assets/logo-icon.svg"
-};
 
 // src/version.ts
-var VERSION = package_default.version;
-var WEBSITE_URL = package_default.homepage;
-var LOGO_URL = package_default.logoIcon;
-var SERVER_TITLE = package_default.name;
-var SERVER_DESCRIPTION = package_default.description;
+import { readFileSync as readFileSync2 } from "fs";
+import { join as join2 } from "path";
+var pkg = JSON.parse(readFileSync2(join2(PROJECT_ROOT, "package.json"), "utf-8"));
+var VERSION = pkg.version ?? "0.0.0";
+var WEBSITE_URL = pkg.homepage ?? "";
+var LOGO_URL = pkg.logoIcon ?? "";
+var SERVER_TITLE = pkg.name ?? "mcp-mikrotik";
+var SERVER_DESCRIPTION = pkg.description ?? "";
 var SERVER_NAME = "mcp-mikrotik";
+var PKG_META = pkg;
+
+// src/observability/drift-routes.ts
+var storePromise = null;
+function getStore() {
+  if (!storePromise)
+    storePromise = openSnapshotStore(DEFAULT_SNAPSHOT_DB);
+  return storePromise;
+}
+var JSON_HEADERS = { "content-type": "application/json; charset=utf-8" };
+function json(body, status = 200) {
+  return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS });
+}
+async function bodyJson(req) {
+  return await req.json();
+}
+async function driftRoutes(req, url) {
+  const p = url.pathname;
+  if (!p.startsWith("/api/drift"))
+    return null;
+  const store = await getStore();
+  if (p === "/api/drift/status" && req.method === "GET") {
+    const cfg = getConfig();
+    const deviceNames = Object.keys(cfg.devices);
+    const devices = deviceNames.map((name) => {
+      const baseline = store.getBaseline(name);
+      if (!baseline) {
+        return { device: name, status: "no-baseline", baseline: null };
+      }
+      const baselineSnap = store.get(baseline.snapshotId);
+      if (!baselineSnap) {
+        return {
+          device: name,
+          status: "unknown",
+          baseline,
+          error: "baseline snapshot deleted"
+        };
+      }
+      const latest = store.latest(name);
+      if (!latest || latest.id === baselineSnap.id) {
+        return { device: name, status: "in-sync", baseline };
+      }
+      const identical = latest.sha === baselineSnap.sha;
+      return {
+        device: name,
+        status: identical ? "in-sync" : "drifted",
+        baseline,
+        latestSnapshotId: latest.id,
+        latestSnapshotTs: latest.ts
+      };
+    });
+    return json({ devices });
+  }
+  if (p === "/api/drift/baselines" && req.method === "GET") {
+    const baselines = store.listBaselines();
+    const enriched = baselines.map((b) => {
+      const snap = store.get(b.snapshotId);
+      return {
+        ...b,
+        snapshot: snap ? { lines: snap.lines, bytes: snap.bytes, sha: snap.sha, rosVersion: snap.rosVersion } : null
+      };
+    });
+    return json({ baselines: enriched });
+  }
+  const baselineMatch = p.match(/^\/api\/drift\/baseline\/(.+)$/);
+  if (baselineMatch && req.method === "GET") {
+    const device = decodeURIComponent(baselineMatch[1]);
+    const baseline = store.getBaseline(device);
+    if (!baseline)
+      return json({ error: "no baseline set" }, 404);
+    const snap = store.get(baseline.snapshotId);
+    return json({
+      ...baseline,
+      snapshot: snap ? { lines: snap.lines, bytes: snap.bytes, sha: snap.sha, rosVersion: snap.rosVersion } : null
+    });
+  }
+  if (p === "/api/drift/baseline" && req.method === "POST") {
+    const b = await bodyJson(req);
+    if (!b.device || !b.snapshotId) {
+      return json({ error: "device and snapshotId are required" }, 400);
+    }
+    const snap = store.get(b.snapshotId);
+    if (!snap)
+      return json({ error: `snapshot '${b.snapshotId}' not found` }, 404);
+    store.setBaseline(b.device, b.snapshotId, "dashboard", b.label, b.notes);
+    return json({ ok: true, device: b.device, snapshotId: b.snapshotId });
+  }
+  if (baselineMatch && req.method === "DELETE") {
+    const device = decodeURIComponent(baselineMatch[1]);
+    const removed = store.removeBaseline(device);
+    return json({ ok: removed, device });
+  }
+  const historyMatch = p.match(/^\/api\/drift\/history\/(.+)$/);
+  if (historyMatch && req.method === "GET") {
+    const device = decodeURIComponent(historyMatch[1]);
+    const limit = Number(url.searchParams.get("limit") ?? "20");
+    const snapshots = store.list(device, limit, false);
+    return json({ device, snapshots });
+  }
+  const checkMatch = p.match(/^\/api\/drift\/check\/(.+)$/);
+  if (checkMatch && req.method === "GET") {
+    const deviceKey = decodeURIComponent(checkMatch[1]);
+    let device;
+    try {
+      device = resolveDeviceName(deviceKey);
+    } catch {
+      return json({ error: `unknown device '${deviceKey}'` }, 404);
+    }
+    const baseline = store.getBaseline(device);
+    if (!baseline)
+      return json({ error: "no baseline set" }, 404);
+    const baselineSnap = store.get(baseline.snapshotId);
+    if (!baselineSnap)
+      return json({ error: "baseline snapshot deleted" }, 404);
+    try {
+      const ctx = createContext(undefined, device);
+      const exportCmd = new Cmd("/export").raw("terse").build();
+      const liveBody = await executeMikrotikCommand(exportCmd, ctx);
+      if (isEmpty(liveBody) || looksLikeError(liveBody)) {
+        return json({ error: `export failed: ${liveBody.trim() || "(empty)"}` }, 502);
+      }
+      const diff = diffLines(normalizeExport(baselineSnap.body), normalizeExport(liveBody), {
+        contextLines: 3,
+        fromLabel: `baseline:${baselineSnap.id}`,
+        toLabel: `${device}@live`
+      });
+      const report = analyzeDrift(diff, device, baseline.snapshotId, baseline.setAt);
+      try {
+        const logCmd = `/log print where topics~"system" and time > ([:timestamp] - 7d)`;
+        const logText = await executeMikrotikCommand(logCmd, ctx);
+        if (!isEmpty(logText) && !looksLikeError(logText)) {
+          report.attributions = attributeChanges(report.sections, logText);
+        }
+      } catch {}
+      return json(report);
+    } catch (e) {
+      return json({ error: e instanceof Error ? e.message : String(e) }, 502);
+    }
+  }
+  return null;
+}
+
+// src/observability/memory-routes.ts
+var storePromise2 = null;
+function getStore2() {
+  if (!storePromise2) {
+    const cfg = getConfig();
+    storePromise2 = openMemoryStore(cfg.memory.dbPath);
+  }
+  return storePromise2;
+}
+function closeMemoryStore() {
+  if (storePromise2) {
+    storePromise2.then((s) => s.close()).catch(() => {});
+    storePromise2 = null;
+  }
+}
+var JSON_HEADERS2 = { "content-type": "application/json; charset=utf-8" };
+function json2(body, status = 200) {
+  return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS2 });
+}
+async function bodyJson2(req) {
+  return await req.json();
+}
+async function memoryRoutes(req, url) {
+  const p = url.pathname;
+  if (!p.startsWith("/api/memory"))
+    return null;
+  const cfg = getConfig();
+  if (!cfg.memory.enabled) {
+    return json2({ error: "Knowledge-graph memory is disabled" }, 503);
+  }
+  if (p === "/api/memory/config" && req.method === "GET") {
+    let stats = null;
+    try {
+      const store2 = await getStore2();
+      stats = store2.stats();
+    } catch {}
+    return json2({
+      enabled: cfg.memory.enabled,
+      dbPath: cfg.memory.dbPath,
+      stats
+    });
+  }
+  if (p === "/api/memory/config" && req.method === "POST") {
+    const body = await bodyJson2(req);
+    const updates = {};
+    if (body.dbPath !== undefined && typeof body.dbPath === "string" && body.dbPath !== cfg.memory.dbPath) {
+      closeMemoryStore();
+      resetMemoryStore();
+      updates.dbPath = body.dbPath;
+      storePromise2 = openMemoryStore(body.dbPath);
+      try {
+        await storePromise2;
+      } catch (e) {
+        storePromise2 = null;
+        return json2({ error: `Failed to open memory DB at ${body.dbPath}: ${e instanceof Error ? e.message : String(e)}` }, 400);
+      }
+    }
+    if (body.enabled !== undefined && typeof body.enabled === "boolean") {
+      updates.enabled = body.enabled;
+    }
+    if (Object.keys(updates).length > 0) {
+      const newMemory = { ...cfg.memory, ...updates };
+      const newCfg = { ...cfg, memory: newMemory };
+      setConfig(newCfg);
+      const src = getConfigSource();
+      try {
+        atomicWrite(src.path, serializeConfig(newCfg));
+      } catch {}
+    }
+    let stats = null;
+    try {
+      const store2 = await getStore2();
+      stats = store2.stats();
+    } catch {}
+    return json2({
+      ok: true,
+      enabled: getConfig().memory.enabled,
+      dbPath: getConfig().memory.dbPath,
+      stats
+    });
+  }
+  const store = await getStore2();
+  if (p === "/api/memory/graph" && req.method === "GET") {
+    return json2(store.readGraph());
+  }
+  if (p === "/api/memory/stats" && req.method === "GET") {
+    return json2(store.stats());
+  }
+  if (p === "/api/memory/search" && req.method === "GET") {
+    const q = url.searchParams.get("q") || "";
+    const limit = Number(url.searchParams.get("limit") ?? 50);
+    return json2(store.searchNodes(q, limit));
+  }
+  if (p === "/api/memory/activity" && req.method === "GET") {
+    const limit = Number(url.searchParams.get("limit") ?? 50);
+    const since = url.searchParams.get("since");
+    return json2(store.activity(limit, since ? Number(since) : undefined));
+  }
+  const entityMatch = p.match(/^\/api\/memory\/entity\/(.+)$/);
+  if (entityMatch && req.method === "GET") {
+    const name = decodeURIComponent(entityMatch[1]);
+    const graph = store.openNodes([name]);
+    if (graph.entities.length === 0)
+      return json2({ error: "Entity not found" }, 404);
+    return json2({ entity: graph.entities[0], relations: graph.relations });
+  }
+  if (p === "/api/memory/entities" && req.method === "POST") {
+    const body = await bodyJson2(req);
+    const created = store.createEntities(body.entities ?? []);
+    return json2({ created, count: created.length });
+  }
+  if (p === "/api/memory/relations" && req.method === "POST") {
+    const body = await bodyJson2(req);
+    const created = store.createRelations(body.relations ?? []);
+    return json2({ created, count: created.length });
+  }
+  if (p === "/api/memory/observations" && req.method === "POST") {
+    const body = await bodyJson2(req);
+    const results = store.addObservations(body.observations ?? []);
+    return json2({ results });
+  }
+  if (p === "/api/memory/entities" && req.method === "DELETE") {
+    const body = await bodyJson2(req);
+    const removed = store.deleteEntities(body.names ?? []);
+    return json2({ removed });
+  }
+  if (p === "/api/memory/relations" && req.method === "DELETE") {
+    const body = await bodyJson2(req);
+    const removed = store.deleteRelations(body.relations ?? []);
+    return json2({ removed });
+  }
+  if (p === "/api/memory/observations" && req.method === "DELETE") {
+    const body = await bodyJson2(req);
+    const removed = store.deleteObservations(body.deletions ?? []);
+    return json2({ removed });
+  }
+  return null;
+}
 
 // src/observability/dashboard.ts
 var SERVER_TAG2 = "mikrotik-mcp";
@@ -1324,13 +1478,13 @@ async function fetchLatestRelease() {
   releaseCache = { data, fetchedAt: Date.now() };
   return data;
 }
-var JSON_HEADERS = { "content-type": "application/json; charset=utf-8" };
-function json(body, status = 200) {
-  return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS });
+var JSON_HEADERS3 = { "content-type": "application/json; charset=utf-8" };
+function json3(body, status = 200) {
+  return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS3 });
 }
 function dashboardHtml() {
   try {
-    return readFileSync2(join2(UI_DIST_DIR, "observability.html"), "utf8");
+    return readFileSync3(join3(UI_DIST_DIR, "observability.html"), "utf8");
   } catch {
     return `<!doctype html><meta charset=utf-8><body style="font:14px system-ui;padding:24px;background:#0b0d10;color:#e8eaed">
 <h2>MikroTik MCP \u2014 Observability Dashboard</h2>
@@ -1530,11 +1684,11 @@ function issues(error) {
 async function configRoutes(req, url, admin) {
   const p = url.pathname;
   if (p === "/api/config-schema" && req.method === "GET") {
-    return json(configSchemaJson());
+    return json3(configSchemaJson());
   }
   if (p === "/api/config/validate" && req.method === "POST") {
     const merged = mergeSecrets(await readJson(req), getConfig());
-    return json(validateConfig(merged));
+    return json3(validateConfig(merged));
   }
   if (p === "/api/config/test-device" && req.method === "POST") {
     const body = await readJson(req);
@@ -1543,22 +1697,22 @@ async function configRoutes(req, url, admin) {
     const merged = mergeSecrets(body?.config, currentDc);
     const parsed = DeviceConfigSchema.safeParse(merged);
     if (!parsed.success)
-      return json({ ok: false, errors: issues(parsed.error) }, 400);
+      return json3({ ok: false, errors: issues(parsed.error) }, 400);
     const status = await probeDevice(`config-test:${name}`, parsed.data);
-    return json({ ok: true, status });
+    return json3({ ok: true, status });
   }
   if (p === "/api/config/preview" && req.method === "POST") {
     const before = JSON.stringify(redact(getConfig()), null, 2);
     const after = JSON.stringify(await readJson(req) ?? {}, null, 2);
     const d = diffLines(before, after, { fromLabel: "current", toLabel: "edited" });
-    return json({ summary: d.summary, unified: d.unified });
+    return json3({ summary: d.summary, unified: d.unified });
   }
   if (p === "/api/config" && req.method === "POST") {
     const body = await readJson(req);
     const merged = mergeSecrets(body?.config, getConfig());
     const v = validateConfig(merged);
     if (!v.ok || !v.value)
-      return json({ ok: false, errors: v.errors }, 400);
+      return json3({ ok: false, errors: v.errors }, 400);
     const prev = getConfig();
     const before = JSON.stringify(redact(prev), null, 2);
     const after = JSON.stringify(redact(v.value), null, 2);
@@ -1567,19 +1721,19 @@ async function configRoutes(req, url, admin) {
     const nextDevs = Object.keys(v.value.devices);
     const devicesChanged = prevDevs.length !== nextDevs.length || prevDevs.some((d) => !nextDevs.includes(d));
     const res = admin.applyConfig(v.value, clampRollback(body?.rollbackMs));
-    return json({ ok: true, ...res, devicesChanged, summary: diff.summary, unified: diff.unified });
+    return json3({ ok: true, ...res, devicesChanged, summary: diff.summary, unified: diff.unified });
   }
   if (p === "/api/config/keep" && req.method === "POST") {
     const body = await readJson(req);
     const kept = admin.keepConfig(String(body?.pendingId ?? ""));
     if (kept)
       recordVersion(getConfig(), "auto", Date.now());
-    return json({ kept });
+    return json3({ kept });
   }
   if (p === "/api/config/rollback" && req.method === "POST") {
     const body = await readJson(req);
     const rolledBack = admin.rollback(String(body?.pendingId ?? ""));
-    return json({ rolledBack, config: redact(getConfig()) });
+    return json3({ rolledBack, config: redact(getConfig()) });
   }
   if (p === "/api/config/history" && req.method === "GET") {
     const current = JSON.stringify(redact(getConfig()), null, 2);
@@ -1594,55 +1748,55 @@ async function configRoutes(req, url, admin) {
       } catch {}
       return { ...v, drift: { added, removed } };
     });
-    return json({ versions, bytes: historyBytes(), retention: AUTO_RETENTION });
+    return json3({ versions, bytes: historyBytes(), retention: AUTO_RETENTION });
   }
   if (p === "/api/config/history/get" && req.method === "GET") {
     const id = url.searchParams.get("id");
     if (!id)
-      return json({ error: "id required" }, 400);
+      return json3({ error: "id required" }, 400);
     try {
       const v = readVersion(id);
-      return json({
+      return json3({
         ts: v.ts,
         kind: v.kind,
         label: v.label,
         config: JSON.stringify(redact(v.config), null, 2)
       });
     } catch {
-      return json({ error: "not found" }, 404);
+      return json3({ error: "not found" }, 404);
     }
   }
   if (p === "/api/config/history/diff" && req.method === "GET") {
     const id = url.searchParams.get("id");
     if (!id)
-      return json({ error: "id required" }, 400);
+      return json3({ error: "id required" }, 400);
     try {
       const before = JSON.stringify(redact(readVersion(id).config), null, 2);
       const after = JSON.stringify(redact(getConfig()), null, 2);
       const d = diffLines(before, after, { fromLabel: "this version", toLabel: "current" });
-      return json({ summary: d.summary, unified: d.unified });
+      return json3({ summary: d.summary, unified: d.unified });
     } catch {
-      return json({ error: "not found" }, 404);
+      return json3({ error: "not found" }, 404);
     }
   }
   if (p === "/api/config/history/checkpoint" && req.method === "POST") {
     const b = await readJson(req);
     const label = b?.label?.trim() || "checkpoint";
-    return json({ ok: true, version: recordVersion(getConfig(), "checkpoint", Date.now(), label) });
+    return json3({ ok: true, version: recordVersion(getConfig(), "checkpoint", Date.now(), label) });
   }
   if (p === "/api/config/history/restore" && req.method === "POST") {
     const b = await readJson(req);
     if (!b?.id)
-      return json({ error: "id required" }, 400);
+      return json3({ error: "id required" }, 400);
     let target;
     try {
       target = readVersion(b.id);
     } catch {
-      return json({ error: "not found" }, 404);
+      return json3({ error: "not found" }, 404);
     }
     const v = validateConfig(target.config);
     if (!v.ok || !v.value)
-      return json({ ok: false, errors: v.errors }, 400);
+      return json3({ ok: false, errors: v.errors }, 400);
     recordVersion(getConfig(), "auto", Date.now(), "before restore");
     setConfig(v.value);
     let persisted = true;
@@ -1653,13 +1807,13 @@ async function configRoutes(req, url, admin) {
     }
     const label = target.label ? `restored "${target.label}"` : `restored ${b.id}`;
     recordVersion(getConfig(), "auto", Date.now(), label);
-    return json({ ok: true, persisted, restored: b.id, config: redact(getConfig()) });
+    return json3({ ok: true, persisted, restored: b.id, config: redact(getConfig()) });
   }
   if (p === "/api/config/history/delete" && req.method === "POST") {
     const b = await readJson(req);
     if (!b?.id)
-      return json({ error: "id required" }, 400);
-    return deleteVersion(b.id) ? json({ ok: true }) : json({ error: "not found" }, 404);
+      return json3({ error: "id required" }, 400);
+    return deleteVersion(b.id) ? json3({ ok: true }) : json3({ error: "not found" }, 404);
   }
   return null;
 }
@@ -1670,16 +1824,16 @@ async function modulesRoutes(req, url) {
   if (p === "/api/modules" && req.method === "GET") {
     const cfg = getConfig();
     const src = getConfigSource();
-    return json({ ...moduleSurface(cfg.tools), filter: cfg.tools, source: src });
+    return json3({ ...moduleSurface(cfg.tools), filter: cfg.tools, source: src });
   }
   if (p === "/api/modules/toggle" && req.method === "POST") {
     const b = await readJson(req);
     if (typeof b?.slug !== "string" || typeof b?.enabled !== "boolean") {
-      return json({ error: "slug (string) and enabled (boolean) are required" }, 400);
+      return json3({ error: "slug (string) and enabled (boolean) are required" }, 400);
     }
     const mod = moduleCatalog.find((m) => m.slug.toLowerCase() === b.slug.toLowerCase());
     if (!mod)
-      return json({ error: `unknown module: ${b.slug}` }, 404);
+      return json3({ error: `unknown module: ${b.slug}` }, 404);
     const cfg = getConfig();
     const nextTools = ToolFilterSchema.parse(applyModuleToggle(cfg.tools, mod.slug, b.enabled));
     const next = { ...cfg, tools: nextTools };
@@ -1695,7 +1849,7 @@ async function modulesRoutes(req, url) {
     if (persisted) {
       recordVersion(getConfig(), "auto", Date.now(), `module ${b.enabled ? "enabled" : "disabled"}: ${mod.slug}`);
     }
-    return json({
+    return json3({
       ok: true,
       persisted,
       requiresReconnect: true,
@@ -1712,11 +1866,11 @@ async function modulesRoutes(req, url) {
 async function captureRoutes(req, url) {
   const p = url.pathname;
   if (p === "/api/capture/status" && req.method === "GET") {
-    return json(capture.stats());
+    return json3(capture.stats());
   }
   if (p === "/api/capture/packets" && req.method === "GET") {
     const limit = Number(url.searchParams.get("limit") ?? 200) || 200;
-    return json({ packets: capture.recent(limit), stats: capture.stats() });
+    return json3({ packets: capture.recent(limit), stats: capture.stats() });
   }
   if (p === "/api/capture/pcap" && req.method === "GET") {
     return new Response(capture.pcap(), {
@@ -1728,11 +1882,11 @@ async function captureRoutes(req, url) {
   }
   if (p === "/api/capture/start" && req.method === "POST") {
     const body = await readJson(req);
-    return json(await capture.start(typeof body?.port === "number" ? body.port : DEFAULT_TZSP_PORT));
+    return json3(await capture.start(typeof body?.port === "number" ? body.port : DEFAULT_TZSP_PORT));
   }
   if (p === "/api/capture/stop" && req.method === "POST") {
     capture.stop();
-    return json({ ok: true, ...capture.stats() });
+    return json3({ ok: true, ...capture.stats() });
   }
   return null;
 }
@@ -1743,32 +1897,32 @@ async function clientsRoutes(req, url) {
   const deviceFromQuery = () => url.searchParams.get("device") ?? undefined;
   if (p === "/api/clients" && req.method === "GET") {
     const ctx = createContext(undefined, deviceFromQuery());
-    return json(devicesView(await fetchDevices(ctx)));
+    return json3(devicesView(await fetchDevices(ctx)));
   }
   if (p === "/api/clients/traffic" && req.method === "GET") {
     const ip = url.searchParams.get("ip");
     if (!ip)
-      return json({ error: "ip required" }, 400);
+      return json3({ error: "ip required" }, 400);
     const ctx = createContext(undefined, deviceFromQuery());
-    return json(await sampleDeviceTraffic(ctx, ip));
+    return json3(await sampleDeviceTraffic(ctx, ip));
   }
   if (p === "/api/clients/traffic-bulk" && req.method === "GET") {
     const ctx = createContext(undefined, deviceFromQuery());
-    return json(await sampleAllTraffic(ctx));
+    return json3(await sampleAllTraffic(ctx));
   }
   if (req.method === "POST") {
     const b = await readJson(req);
     const ctx = createContext(undefined, b?.device);
     if (p === "/api/clients/limits") {
       if (!b?.ip)
-        return json({ error: "ip required" }, 400);
-      return json(await setDeviceLimits(ctx, b.ip, { download: b.download, upload: b.upload }));
+        return json3({ error: "ip required" }, 400);
+      return json3(await setDeviceLimits(ctx, b.ip, { download: b.download, upload: b.upload }));
     }
     if (!b?.mac)
-      return json({ error: "mac required" }, 400);
+      return json3({ error: "mac required" }, 400);
     const run = async (op) => {
       const r = await op;
-      return json({ ...r, view: r.ok ? devicesView(await fetchDevices(ctx)) : undefined });
+      return json3({ ...r, view: r.ok ? devicesView(await fetchDevices(ctx)) : undefined });
     };
     if (p === "/api/clients/block")
       return run(blockDevice(ctx, b.mac, b.comment));
@@ -1780,12 +1934,12 @@ async function clientsRoutes(req, url) {
       return run(removeDeviceLease(ctx, b.mac));
     if (p === "/api/clients/set-ip") {
       if (!b.ip)
-        return json({ error: "ip required" }, 400);
+        return json3({ error: "ip required" }, 400);
       return run(setDeviceIp(ctx, b.mac, b.ip));
     }
     if (p === "/api/clients/label") {
       if (typeof b.label !== "string")
-        return json({ error: "label required" }, 400);
+        return json3({ error: "label required" }, 400);
       return run(setDeviceLabel(ctx, b.mac, b.label));
     }
   }
@@ -1798,20 +1952,20 @@ async function aaaRoutes(req, url) {
   const deviceFromQuery = () => url.searchParams.get("device") ?? undefined;
   if (req.method === "GET") {
     if (p === "/api/aaa/entities") {
-      return json({ entities: AAA_ENTITIES });
+      return json3({ entities: AAA_ENTITIES });
     }
     if (p === "/api/aaa/radius-incoming") {
-      return json(await getRadiusIncoming(createContext(undefined, deviceFromQuery())));
+      return json3(await getRadiusIncoming(createContext(undefined, deviceFromQuery())));
     }
     if (p === "/api/aaa/um-settings") {
-      return json(await getUmSettings(createContext(undefined, deviceFromQuery())));
+      return json3(await getUmSettings(createContext(undefined, deviceFromQuery())));
     }
     const listMatch = p.match(/^\/api\/aaa\/list\/([\w-]+)$/);
     if (listMatch) {
       const slug = listMatch[1];
       if (!AAA_ENTITIES[slug])
-        return json({ error: "unknown entity" }, 404);
-      return json(await listAaaEntity(createContext(undefined, deviceFromQuery()), slug));
+        return json3({ error: "unknown entity" }, 404);
+      return json3(await listAaaEntity(createContext(undefined, deviceFromQuery()), slug));
     }
     return null;
   }
@@ -1819,30 +1973,30 @@ async function aaaRoutes(req, url) {
     const body = await readJson(req);
     const ctx = createContext(undefined, body?.device);
     if (p === "/api/aaa/radius-incoming")
-      return json(await setRadiusIncoming(ctx, body?.fields ?? {}));
+      return json3(await setRadiusIncoming(ctx, body?.fields ?? {}));
     if (p === "/api/aaa/um-settings")
-      return json(await setUmSettings(ctx, body?.fields ?? {}));
+      return json3(await setUmSettings(ctx, body?.fields ?? {}));
     if (p === "/api/aaa/radius-reset-counters")
-      return json(await resetRadiusCounters(ctx));
+      return json3(await resetRadiusCounters(ctx));
     const slug = body?.slug ?? "";
     if (!AAA_ENTITIES[slug])
-      return json({ error: "unknown entity" }, 404);
+      return json3({ error: "unknown entity" }, 404);
     if (p === "/api/aaa/add")
-      return json(await addAaaEntity(ctx, slug, body?.fields ?? {}));
+      return json3(await addAaaEntity(ctx, slug, body?.fields ?? {}));
     if (p === "/api/aaa/update") {
       if (!body?.id)
-        return json({ error: "id required" }, 400);
-      return json(await updateAaaEntity(ctx, slug, body.id, body?.fields ?? {}));
+        return json3({ error: "id required" }, 400);
+      return json3(await updateAaaEntity(ctx, slug, body.id, body?.fields ?? {}));
     }
     if (p === "/api/aaa/remove") {
       if (!body?.id)
-        return json({ error: "id required" }, 400);
-      return json(await removeAaaEntity(ctx, slug, body.id));
+        return json3({ error: "id required" }, 400);
+      return json3(await removeAaaEntity(ctx, slug, body.id));
     }
     if (p === "/api/aaa/toggle") {
       if (!body?.id)
-        return json({ error: "id required" }, 400);
-      return json(await toggleAaaEntity(ctx, slug, body.id, body?.enable === true));
+        return json3({ error: "id required" }, 400);
+      return json3(await toggleAaaEntity(ctx, slug, body.id, body?.enable === true));
     }
   }
   return null;
@@ -1858,43 +2012,43 @@ async function usageRoutes(req, url) {
     return null;
   if (p === "/api/usage/sampler") {
     if (req.method === "GET")
-      return json({ intervalMs: getUsageSamplerInterval() });
+      return json3({ intervalMs: getUsageSamplerInterval() });
     if (req.method === "POST") {
       const b = await readJson(req);
       const applied = setUsageSamplerInterval(Number(b?.intervalMs));
-      return json({ intervalMs: applied });
+      return json3({ intervalMs: applied });
     }
     return null;
   }
   if (req.method !== "GET")
     return null;
   if (!usageStore)
-    return json({ error: "usage store not active" }, 503);
+    return json3({ error: "usage store not active" }, 503);
   const device = resolveDeviceName(url.searchParams.get("device") ?? undefined);
   const sinceTs = (days) => Date.now() - days * 86400000;
   if (p === "/api/usage/um-users") {
-    return json({ users: usageStore.umUsers(device) });
+    return json3({ users: usageStore.umUsers(device) });
   }
   if (p === "/api/usage/client") {
     const ip = url.searchParams.get("ip");
     if (!ip)
-      return json({ error: "ip required" }, 400);
+      return json3({ error: "ip required" }, 400);
     const series = usageStore.clientDailyUsage(device, ip, sinceTs(daysParam(url, 90, 400)));
-    return json(withTotals(series));
+    return json3(withTotals(series));
   }
   if (p === "/api/usage/um-user") {
     const user = url.searchParams.get("user");
     if (!user)
-      return json({ error: "user required" }, 400);
+      return json3({ error: "user required" }, 400);
     const series = usageStore.umUserDailyUsage(device, user, sinceTs(daysParam(url, 90, 400)));
-    return json(withTotals(series));
+    return json3(withTotals(series));
   }
   if (p === "/api/usage/heatmap") {
     const user = url.searchParams.get("user");
     const days = usageStore.heatmap(device, user || null, sinceTs(daysParam(url, 371, 400)));
     const total = days.reduce((s, d) => s + d.count, 0);
     const max = days.reduce((m, d) => Math.max(m, d.count), 0);
-    return json({ days, total, max });
+    return json3({ days, total, max });
   }
   return null;
 }
@@ -1918,13 +2072,13 @@ async function featureRoutes(req, url) {
     const cfg = getConfig();
     const all = Object.keys(cfg.devices).flatMap((d) => store.list(d, 200, false));
     all.sort((a, b) => b.ts - a.ts);
-    return json({ snapshots: all });
+    return json3({ snapshots: all });
   }
   const snapMatch = p.match(/^\/api\/snapshot\/(.+)$/);
   if (snapMatch && req.method === "GET") {
     const store = await snapStore();
     const s = store.get(decodeURIComponent(snapMatch[1]));
-    return s ? json(s) : json({ error: "not found" }, 404);
+    return s ? json3(s) : json3({ error: "not found" }, 404);
   }
   if (p === "/api/snapshots/diff" && req.method === "POST") {
     const store = await snapStore();
@@ -1932,13 +2086,13 @@ async function featureRoutes(req, url) {
     const from = b?.from ? store.get(b.from) : null;
     const to = b?.to ? store.get(b.to) : null;
     if (!from || !to) {
-      return json({ error: "both 'from' and 'to' snapshot ids are required" }, 400);
+      return json3({ error: "both 'from' and 'to' snapshot ids are required" }, 400);
     }
     const diff = diffLines(normalizeExport(from.body), normalizeExport(to.body), {
       fromLabel: from.label ?? from.id,
       toLabel: to.label ?? to.id
     });
-    return json({
+    return json3({
       from: { id: from.id, label: from.label, ts: from.ts, device: from.device },
       to: { id: to.id, label: to.label, ts: to.ts, device: to.device },
       summary: diff.summary,
@@ -1952,16 +2106,16 @@ async function featureRoutes(req, url) {
       ...b?.script ? splitCommands(b.script) : []
     ];
     if (commands.length === 0)
-      return json({ error: "no commands provided" }, 400);
+      return json3({ error: "no commands provided" }, 400);
     const plan = buildChangePlan(commands);
-    return json({ plan, text: renderPlan(plan) });
+    return json3({ plan, text: renderPlan(plan) });
   }
   if (p === "/api/s3" && req.method === "GET") {
-    return json({ configured: isS3Configured(), target: isS3Configured() ? s3Target() : null });
+    return json3({ configured: isS3Configured(), target: isS3Configured() ? s3Target() : null });
   }
   if (p === "/api/s3/list" && req.method === "GET") {
     if (!isS3Configured())
-      return json({ configured: false, objects: [] });
+      return json3({ configured: false, objects: [] });
     const prefix = url.searchParams.get("prefix") ?? "";
     try {
       const res = await getS3Client().list({ prefix: prefix || undefined, maxKeys: 1000 });
@@ -1970,42 +2124,42 @@ async function featureRoutes(req, url) {
         size: o.size ?? 0,
         lastModified: o.lastModified ?? null
       }));
-      return json({ configured: true, target: s3Target(), objects, truncated: !!res.isTruncated });
+      return json3({ configured: true, target: s3Target(), objects, truncated: !!res.isTruncated });
     } catch (e) {
-      return json({ error: e instanceof Error ? e.message : String(e) }, 502);
+      return json3({ error: e instanceof Error ? e.message : String(e) }, 502);
     }
   }
   if (p === "/api/s3/presign" && req.method === "GET") {
     if (!isS3Configured())
-      return json({ error: "S3 not configured" }, 400);
+      return json3({ error: "S3 not configured" }, 400);
     const key = url.searchParams.get("key");
     if (!key)
-      return json({ error: "key required" }, 400);
+      return json3({ error: "key required" }, 400);
     try {
       const link = getS3Client().presign(key, { expiresIn: presignExpiresIn(), method: "GET" });
-      return json({ url: link });
+      return json3({ url: link });
     } catch (e) {
-      return json({ error: e instanceof Error ? e.message : String(e) }, 502);
+      return json3({ error: e instanceof Error ? e.message : String(e) }, 502);
     }
   }
   if (p === "/api/s3/delete" && req.method === "POST") {
     if (!isS3Configured())
-      return json({ error: "S3 not configured" }, 400);
+      return json3({ error: "S3 not configured" }, 400);
     const b = await readJson(req);
     if (!b?.key)
-      return json({ error: "key required" }, 400);
+      return json3({ error: "key required" }, 400);
     try {
       const client = getS3Client();
       if (!await client.exists(b.key))
-        return json({ error: "not found" }, 404);
+        return json3({ error: "not found" }, 404);
       await client.delete(b.key);
-      return json({ ok: true, key: b.key });
+      return json3({ ok: true, key: b.key });
     } catch (e) {
-      return json({ error: e instanceof Error ? e.message : String(e) }, 502);
+      return json3({ error: e instanceof Error ? e.message : String(e) }, 502);
     }
   }
   if (p === "/api/backups" && req.method === "GET") {
-    return json({
+    return json3({
       dir: backupDir(),
       devices: Object.keys(getConfig().devices),
       backups: listBackups()
@@ -2015,14 +2169,14 @@ async function featureRoutes(req, url) {
     const b = await readJson(req);
     const raw = b?.dir?.trim();
     if (!raw)
-      return json({ error: "dir required" }, 400);
-    const dir = raw === "~" || raw.startsWith("~/") ? join2(homedir(), raw.slice(1)) : raw;
+      return json3({ error: "dir required" }, 400);
+    const dir = raw === "~" || raw.startsWith("~/") ? join3(homedir(), raw.slice(1)) : raw;
     const next = { ...getConfig(), backupDir: dir };
     setConfig(next);
     try {
       atomicWrite(getConfigSource().path, serializeConfig(next));
     } catch (e) {
-      return json({
+      return json3({
         ok: true,
         dir: backupDir(),
         persisted: false,
@@ -2030,16 +2184,16 @@ async function featureRoutes(req, url) {
       });
     }
     recordVersion(getConfig(), "auto", Date.now(), "backup path changed");
-    return json({ ok: true, dir: backupDir(), persisted: true });
+    return json3({ ok: true, dir: backupDir(), persisted: true });
   }
   if (p === "/api/backups/get" && req.method === "GET") {
     const name = url.searchParams.get("name");
     if (!name)
-      return json({ error: "name required" }, 400);
+      return json3({ error: "name required" }, 400);
     try {
-      return json({ name, content: readBackup(name) });
+      return json3({ name, content: readBackup(name) });
     } catch {
-      return json({ error: "not found" }, 404);
+      return json3({ error: "not found" }, 404);
     }
   }
   if (p === "/api/backups/raw" && req.method === "GET") {
@@ -2060,41 +2214,41 @@ async function featureRoutes(req, url) {
   if (p === "/api/backups/upload" && req.method === "POST") {
     const b = await readJson(req);
     if (!b?.name || typeof b.content !== "string") {
-      return json({ error: "name and content are required" }, 400);
+      return json3({ error: "name and content are required" }, 400);
     }
     try {
       const safe = b.name.endsWith(".rsc") ? b.name : `${b.name}.rsc`;
-      return json({ ok: true, name: writeBackup(safe, b.content) });
+      return json3({ ok: true, name: writeBackup(safe, b.content) });
     } catch (e) {
-      return json({ error: e instanceof Error ? e.message : String(e) }, 400);
+      return json3({ error: e instanceof Error ? e.message : String(e) }, 400);
     }
   }
   if (p === "/api/backups/rename" && req.method === "POST") {
     const b = await readJson(req);
     if (!b?.name || !b?.new_name)
-      return json({ error: "name and new_name are required" }, 400);
+      return json3({ error: "name and new_name are required" }, 400);
     try {
-      return json({ ok: true, name: renameBackup(b.name, b.new_name) });
+      return json3({ ok: true, name: renameBackup(b.name, b.new_name) });
     } catch (e) {
-      return json({ error: e instanceof Error ? e.message : String(e) }, 400);
+      return json3({ error: e instanceof Error ? e.message : String(e) }, 400);
     }
   }
   if (p === "/api/backups/delete" && req.method === "POST") {
     const b = await readJson(req);
     if (!b?.name)
-      return json({ error: "name required" }, 400);
+      return json3({ error: "name required" }, 400);
     try {
-      return deleteBackup(b.name) ? json({ ok: true }) : json({ error: "not found" }, 404);
+      return deleteBackup(b.name) ? json3({ ok: true }) : json3({ error: "not found" }, 404);
     } catch (e) {
-      return json({ error: e instanceof Error ? e.message : String(e) }, 400);
+      return json3({ error: e instanceof Error ? e.message : String(e) }, 400);
     }
   }
   if (p === "/api/backups/restore" && req.method === "POST") {
     const b = await readJson(req);
     if (!b?.name)
-      return json({ error: "name required" }, 400);
+      return json3({ error: "name required" }, 400);
     const device = resolveDeviceName(b.device);
-    return json(await restoreLocalBackup(device, b.name, b.confirm === true));
+    return json3(await restoreLocalBackup(device, b.name, b.confirm === true));
   }
   if (p === "/api/backups/create" && req.method === "POST") {
     const b = await readJson(req);
@@ -2106,7 +2260,7 @@ async function featureRoutes(req, url) {
       compact: b?.compact === true,
       terse: b?.terse === true
     });
-    return r.ok ? json(r) : json({ error: r.error ?? "export failed" }, 502);
+    return r.ok ? json3(r) : json3({ error: r.error ?? "export failed" }, 502);
   }
   return null;
 }
@@ -2124,7 +2278,7 @@ async function runDashboard(cfg, transportLabel) {
   });
   startHealthChecks(30000);
   try {
-    usageStore = await openUsageStore(join2(dirname4(cfg.dbPath), "usage.db"));
+    usageStore = await openUsageStore(join3(dirname4(cfg.dbPath), "usage.db"));
     startUsageSampler(usageStore);
   } catch (e) {
     logger.warn(`[${SERVER_TAG2}] usage history disabled: ${String(e)}`);
@@ -2141,7 +2295,7 @@ async function runDashboard(cfg, transportLabel) {
     source: getConfigSource,
     readFile: (pth) => {
       try {
-        return readFileSync2(pth, "utf8");
+        return readFileSync3(pth, "utf8");
       } catch {
         return null;
       }
@@ -2190,9 +2344,15 @@ async function runDashboard(cfg, transportLabel) {
     const featureResp = await featureRoutes(req, url);
     if (featureResp)
       return featureResp;
+    const driftResp = await driftRoutes(req, url);
+    if (driftResp)
+      return driftResp;
+    const memoryResp = await memoryRoutes(req, url);
+    if (memoryResp)
+      return memoryResp;
     const db = getEventStore();
     if (!db)
-      return json({ error: "recorder not active" }, 503);
+      return json3({ error: "recorder not active" }, 503);
     if (url.pathname === "/api/events" && req.method === "DELETE") {
       let body = {};
       try {
@@ -2200,7 +2360,7 @@ async function runDashboard(cfg, transportLabel) {
       } catch {}
       const ids = Array.isArray(body.ids) ? body.ids.filter((x) => typeof x === "string") : [];
       const removed = body.all === true ? db.clear() : db.delete(ids);
-      return json({ removed, total: db.total() });
+      return json3({ removed, total: db.total() });
     }
     if (url.pathname === "/api/ssh-pool") {
       const cfg2 = getConfig();
@@ -2209,7 +2369,7 @@ async function runDashboard(cfg, transportLabel) {
       const totalInflight = ps.reduce((s, p) => s + p.inflight, 0);
       const totalIdle = ps.filter((p) => p.idle).length;
       const totalBusy = ps.filter((p) => p.inflight > 0).length;
-      return json({
+      return json3({
         enabled,
         config: {
           keepAlive: cfg2.ssh.keepAlive,
@@ -2226,13 +2386,13 @@ async function runDashboard(cfg, transportLabel) {
       });
     }
     if (url.pathname === "/api/devices") {
-      return json(devicesPayload(db));
+      return json3(devicesPayload(db));
     }
     if (url.pathname === "/api/topology") {
-      return json(topologyPayload());
+      return json3(topologyPayload());
     }
     if (url.pathname === "/api/config") {
-      return json(configPayload());
+      return json3(configPayload());
     }
     if (url.pathname === "/" || url.pathname === "/index.html") {
       return new Response(dashboardHtml(), {
@@ -2241,14 +2401,14 @@ async function runDashboard(cfg, transportLabel) {
     }
     if (url.pathname === "/api/releases/latest") {
       try {
-        return json(await fetchLatestRelease());
+        return json3(await fetchLatestRelease());
       } catch (e) {
-        return json({ error: e instanceof Error ? e.message : "fetch failed" }, 502);
+        return json3({ error: e instanceof Error ? e.message : "fetch failed" }, 502);
       }
     }
     if (url.pathname === "/api/meta") {
       const f = facets(db);
-      return json({
+      return json3({
         ...f,
         version: VERSION,
         risks: ["READ", "WRITE", "WRITE_IDEMPOTENT", "DESTRUCTIVE", "DANGEROUS"],
@@ -2259,19 +2419,19 @@ async function runDashboard(cfg, transportLabel) {
     }
     if (url.pathname === "/api/events") {
       const filter = filterFromQuery(url);
-      return json({ events: db.query(filter), total: db.total() });
+      return json3({ events: db.query(filter), total: db.total() });
     }
     const eventMatch = url.pathname.match(/^\/api\/event\/(.+)$/);
     if (eventMatch) {
       const e = db.get(decodeURIComponent(eventMatch[1]));
-      return e ? json(e) : json({ error: "not found" }, 404);
+      return e ? json3(e) : json3({ error: "not found" }, 404);
     }
     if (url.pathname === "/api/stats") {
       const now = Date.now();
       const windowMs = Number(url.searchParams.get("window") ?? 3600000);
       const buckets = Number(url.searchParams.get("buckets") ?? 60);
       const events = db.query({ since: now - windowMs, limit: 5000 });
-      return json(computeStats(events, { now, windowMs, buckets }));
+      return json3(computeStats(events, { now, windowMs, buckets }));
     }
     return new Response("Not Found", { status: 404 });
   }
@@ -2291,7 +2451,7 @@ async function runDashboard(cfg, transportLabel) {
       } catch (e) {
         const msg = e instanceof Error ? e.message : String(e);
         logger.error(`Dashboard request failed (${url.pathname}): ${msg}`);
-        return json({ error: msg }, 502);
+        return json3({ error: msg }, 502);
       }
     },
     websocket: {
@@ -2328,6 +2488,7 @@ async function runDashboard(cfg, transportLabel) {
       store.close();
       usageStore?.close();
       usageStore = null;
+      closeMemoryStore();
     }
   };
 }
@@ -2381,8 +2542,8 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";
 
 // src/prompts/index.ts
-import { readFileSync as readFileSync3, readdirSync as readdirSync2 } from "fs";
-import { join as join3 } from "path";
+import { readFileSync as readFileSync4, readdirSync as readdirSync2 } from "fs";
+import { join as join4 } from "path";
 import { z as z2 } from "zod";
 function parseFrontmatter(raw) {
   const match = raw.match(/^---\n([\s\S]*?)\n---\n?([\s\S]*)$/);
@@ -2453,7 +2614,7 @@ function registerPrompts(server) {
   for (const file of files) {
     let parsed;
     try {
-      parsed = parseFrontmatter(readFileSync3(join3(PROMPTS_DIR, file), "utf8"));
+      parsed = parseFrontmatter(readFileSync4(join4(PROMPTS_DIR, file), "utf8"));
     } catch (e) {
       logger.warn(`Skipping prompt ${file}: ${String(e)}`);
       continue;
@@ -2716,8 +2877,8 @@ async function printBanner() {
     const colored = BRAND.multiline(art);
     process.stderr.write(`${colored}
 `);
-    const author = typeof package_default.author === "object" ? package_default.author : { name: String(package_default.author) };
-    const site = (package_default.homepage ?? "").replace(/^https?:\/\//, "");
+    const author = typeof PKG_META.author === "object" ? PKG_META.author : { name: PKG_META.author };
+    const site = WEBSITE_URL.replace(/^https?:\/\//, "");
     const w = 56;
     const hr = "\u2500".repeat(w);
     const pad = (s, vis) => `${s}${" ".repeat(Math.max(0, w - 2 - vis))}`;
@@ -2727,7 +2888,7 @@ async function printBanner() {
     const r1Text = `  ${CV}\u25CF${R} ${BOLD}v${VERSION}${R}${DIM}  \u2502  ${CS}${r1Mid}${R}${DIM}  \u2502  ${CT}${r1End}${R}`;
     const r1Vis = r1Label.length + 2 + r1Mid.length + 4 + r1End.length + 4;
     const r2Name = author.name ?? "Unknown";
-    const r2License = package_default.license ?? "MIT";
+    const r2License = PKG_META.license ?? "MIT";
     const r2Text = `  ${CA}${r2Name}${R}${DIM}  \xB7  ${ITALIC}${r2License}${R}${DIM}  \xB7  ${CS}${site}${R}`;
     const r2Vis = r2Name.length + 2 + r2License.length + 4 + site.length + 4;
     const box = [