@usex/mikrotik-mcp 3.57.0 → 3.58.0

package/dist/shared/{cli-thhk9f7n.js → cli-r5p22dag.js}

@@ -386,7 +386,8 @@ var MikrotikConfigSchema = z.object({
   readOnly: z.boolean().default(false),
   tools: ToolFilterSchema.default(() => ToolFilterSchema.parse({})),
   memory: MemoryConfigSchema.default(() => MemoryConfigSchema.parse({})),
-  backupDir: z.string().optional()
+  backupDir: z.string().optional(),
+  disableUpdateCheck: z.boolean().default(false)
 });
 function env(...names) {
   for (const n of names) {
@@ -525,6 +526,7 @@ function loadConfig(argv = process.argv.slice(2)) {
   };
   const isTruthy = (v) => /^(1|true|yes|on)$/i.test(v ?? "");
   const readOnly = isTruthy(pick("read-only", "MIKROTIK_READ_ONLY"));
+  const disableUpdateCheck = isTruthy(pick("disable-update-check", "MIKROTIK_DISABLE_UPDATE_CHECK"));
   const csv = (v) => v === undefined ? undefined : v.split(",").map((s) => s.trim()).filter(Boolean);
   const tools = {
     enabledModules: csv(pick("tools-enabled-modules", "MIKROTIK_TOOLS__ENABLED_MODULES")),
@@ -564,6 +566,7 @@ function loadConfig(argv = process.argv.slice(2)) {
     mcp,
     dashboard,
     readOnly,
+    disableUpdateCheck,
     tools,
     ssh,
     memory,
@@ -8327,7 +8330,7 @@ var cache = null;
 async function gateway() {
   if (cache)
     return cache;
-  const { moduleCatalog } = await import("./cli-0ctwspf1.js");
+  const { moduleCatalog } = await import("./cli-zq0rg72c.js");
   const forIndex = [];
   const byName = new Map;
   for (const mod of moduleCatalog) {
@@ -24845,8 +24848,228 @@ ${result}`;
   })
 ];
 
-// src/tools/threat-feed.ts
+// src/tools/server-pulse.ts
 import { z as z104 } from "zod";
+
+// src/core/update-check.ts
+import { existsSync as existsSync3, mkdirSync as mkdirSync4, readFileSync as readFileSync6, writeFileSync as writeFileSync2 } from "fs";
+import { homedir as homedir2 } from "os";
+import { dirname as dirname4, join as join6 } from "path";
+
+// src/version.ts
+import { readFileSync as readFileSync5 } from "fs";
+import { join as join5 } from "path";
+var pkg = JSON.parse(readFileSync5(join5(PROJECT_ROOT, "package.json"), "utf-8"));
+var VERSION = pkg.version ?? "0.0.0";
+var WEBSITE_URL = pkg.homepage ?? "";
+var LOGO_URL = pkg.logoIcon ?? "";
+var SERVER_TITLE = "MikroTik MCP";
+var SERVER_DESCRIPTION = pkg.description ?? "";
+var SERVER_NAME = "mikrotik-mcp";
+var PKG_META = pkg;
+
+// src/core/update-check.ts
+var GITHUB_API = "https://api.github.com/repos/ali-master/mikrotik-mcp/releases/latest";
+var MEMORY_CACHE_TTL = 15 * 60 * 1000;
+var FILE_CACHE_TTL = 6 * 60 * 60 * 1000;
+var CACHE_PATH = join6(homedir2(), ".mikrotik-mcp", "update-check.json");
+function compareVersions(a, b) {
+  const pa = a.replace(/^v/, "").split(".").map(Number);
+  const pb = b.replace(/^v/, "").split(".").map(Number);
+  for (let i = 0;i < Math.max(pa.length, pb.length); i++) {
+    const diff = (pa[i] ?? 0) - (pb[i] ?? 0);
+    if (diff !== 0)
+      return diff;
+  }
+  return 0;
+}
+var memoryCache = null;
+function loadFileCache(maxAge = FILE_CACHE_TTL) {
+  try {
+    const raw = readFileSync6(CACHE_PATH, "utf-8");
+    const parsed = JSON.parse(raw);
+    if (!parsed?.data?.version || typeof parsed.fetchedAt !== "number")
+      return null;
+    if (Date.now() - parsed.fetchedAt > maxAge)
+      return null;
+    return parsed.data;
+  } catch {
+    return null;
+  }
+}
+function loadFileCacheSync() {
+  return loadFileCache();
+}
+function saveFileCache(data) {
+  try {
+    const dir = dirname4(CACHE_PATH);
+    if (!existsSync3(dir))
+      mkdirSync4(dir, { recursive: true });
+    writeFileSync2(CACHE_PATH, JSON.stringify({ data, fetchedAt: Date.now() }));
+  } catch {}
+}
+async function fetchLatestRelease() {
+  if (memoryCache && Date.now() - memoryCache.fetchedAt < MEMORY_CACHE_TTL) {
+    return memoryCache.data;
+  }
+  const fileCached = loadFileCache();
+  if (fileCached) {
+    memoryCache = { data: fileCached, fetchedAt: Date.now() };
+    return fileCached;
+  }
+  const res = await fetch(GITHUB_API, {
+    headers: {
+      accept: "application/vnd.github+json",
+      "user-agent": `mikrotik-mcp/${VERSION}`
+    }
+  });
+  if (!res.ok)
+    throw new Error(`GitHub API ${res.status}`);
+  const gh = await res.json();
+  const latestVersion = gh.tag_name.replace(/^v/, "");
+  const data = {
+    version: latestVersion,
+    name: gh.name || `v${latestVersion}`,
+    body: gh.body || "",
+    publishedAt: gh.published_at,
+    url: gh.html_url,
+    isNewer: compareVersions(latestVersion, VERSION) > 0,
+    currentVersion: VERSION
+  };
+  memoryCache = { data, fetchedAt: Date.now() };
+  saveFileCache(data);
+  return data;
+}
+async function checkForUpdate() {
+  try {
+    const release = await fetchLatestRelease();
+    return { release, checkedAt: Date.now(), fromCache: false };
+  } catch (e) {
+    const stale = loadFileCache(Infinity);
+    if (stale) {
+      return { release: stale, checkedAt: Date.now(), fromCache: true };
+    }
+    return {
+      release: null,
+      checkedAt: Date.now(),
+      fromCache: false,
+      error: e instanceof Error ? e.message : String(e)
+    };
+  }
+}
+function assessFreshness(current, latest) {
+  const ca = current.replace(/^v/, "").split(".").map(Number);
+  const la = latest.replace(/^v/, "").split(".").map(Number);
+  const majorDiff = (la[0] ?? 0) - (ca[0] ?? 0);
+  const minorDiff = (la[1] ?? 0) - (ca[1] ?? 0);
+  const patchDiff = (la[2] ?? 0) - (ca[2] ?? 0);
+  if (majorDiff > 0)
+    return "ancient";
+  if (minorDiff > 1)
+    return "stale";
+  if (minorDiff === 1)
+    return "aging";
+  if (patchDiff > 1)
+    return "aging";
+  return "fresh";
+}
+function updateSummaryLine(release) {
+  if (!release.isNewer)
+    return null;
+  return `Server update available: MikroTik MCP v${release.version} ` + `(you are running v${VERSION}). ` + `Call check_server_pulse for release notes and upgrade commands, ` + `or upgrade directly: bun i -g @usex/mikrotik-mcp@latest`;
+}
+
+// src/tools/server-pulse.ts
+var UPGRADE_COMMANDS = {
+  bunx: "bunx @usex/mikrotik-mcp@latest",
+  npx: "npx @usex/mikrotik-mcp@latest",
+  "bun global": "bun add -g @usex/mikrotik-mcp@latest",
+  "npm global": "npm install -g @usex/mikrotik-mcp@latest"
+};
+function formatUptime(seconds) {
+  const d = Math.floor(seconds / 86400);
+  const h = Math.floor(seconds % 86400 / 3600);
+  const m = Math.floor(seconds % 3600 / 60);
+  const s = seconds % 60;
+  const parts = [];
+  if (d)
+    parts.push(`${d}d`);
+  if (h)
+    parts.push(`${h}h`);
+  if (m)
+    parts.push(`${m}m`);
+  parts.push(`${s}s`);
+  return parts.join(" ");
+}
+function freshnessLabel(f) {
+  const labels = {
+    fresh: "UP TO DATE",
+    aging: "SLIGHTLY BEHIND",
+    stale: "UPDATE RECOMMENDED",
+    ancient: "CRITICAL UPDATE NEEDED"
+  };
+  return labels[f];
+}
+function timeAgo(iso) {
+  const diff = Date.now() - new Date(iso).getTime();
+  const days = Math.floor(diff / 86400000);
+  if (days < 1)
+    return "today";
+  if (days === 1)
+    return "yesterday";
+  if (days < 30)
+    return `${days} days ago`;
+  if (days < 365)
+    return `${Math.floor(days / 30)} months ago`;
+  return `${Math.floor(days / 365)} years ago`;
+}
+var serverPulseTools = [
+  defineTool({
+    name: "check_server_pulse",
+    title: "Server Pulse & Update Check",
+    annotations: READ,
+    description: "Check the MCP server's own heartbeat: running version, whether a newer release " + "is available, release notes for the latest version, upgrade commands, and server " + "vitals (tool count, uptime). This is server self-awareness \u2014 no RouterOS device " + "is contacted. Call this when the user asks about the MCP server version, updates, " + "what's new, or 'is my server up to date'. Returns rich release notes from GitHub " + "so you can summarize what changed.",
+    inputSchema: {
+      include_release_notes: z104.boolean().optional().describe("Include the full GitHub release notes markdown (default true). " + "Set false for a compact version-only check.")
+    },
+    async handler(args) {
+      const includeNotes = args.include_release_notes !== false;
+      const result = await checkForUpdate();
+      const uptime = Math.floor(process.uptime());
+      const sections = [];
+      const sep = "\u2500".repeat(50);
+      sections.push(`SERVER PULSE \u2014 ${SERVER_TITLE} v${VERSION}`, sep, "Package:    @usex/mikrotik-mcp", `Version:    ${VERSION}`, `Uptime:     ${formatUptime(uptime)}`, `Website:    ${WEBSITE_URL}`);
+      if (result.release) {
+        const freshness = assessFreshness(VERSION, result.release.version);
+        const label = freshnessLabel(freshness);
+        const age = timeAgo(result.release.publishedAt);
+        sections.push("", `UPDATE STATUS: ${label}`, sep, `Current:    v${VERSION}`, `Latest:     v${result.release.version} (${result.release.name})`, `Published:  ${age}`, `Freshness:  ${freshness.toUpperCase()}`);
+        if (result.release.isNewer) {
+          sections.push("", ">>> A newer version is available! <<<");
+        } else {
+          sections.push("", "You are running the latest version.");
+        }
+        if (result.release.isNewer) {
+          sections.push("", "UPGRADE", sep);
+          for (const [method, cmd] of Object.entries(UPGRADE_COMMANDS)) {
+            sections.push(`  ${method.padEnd(12)} ${cmd}`);
+          }
+          sections.push("", `Release:    ${result.release.url}`);
+        }
+        if (includeNotes && result.release.body && result.release.isNewer) {
+          sections.push("", `WHAT'S NEW IN v${result.release.version}`, sep, result.release.body);
+        }
+      } else {
+        sections.push("", "UPDATE STATUS: UNKNOWN", sep, `Could not check for updates${result.error ? `: ${result.error}` : "."}`, `Current version: v${VERSION}`, result.fromCache ? "(showing cached data)" : "(no cached data available \u2014 check network connectivity)");
+      }
+      return sections.join(`
+`);
+    }
+  })
+];
+
+// src/tools/threat-feed.ts
+import { z as z105 } from "zod";
 var FEED_TAG = "threat-feed";
 var threatFeedTools = [
   defineTool({
@@ -24855,12 +25078,12 @@ var threatFeedTools = [
     annotations: WRITE,
     description: "Subscribes the router to an external threat-intelligence IP feed: installs a `/system script` " + "that fetches `url` and imports it into the `address_list`, a `/system scheduler` that re-runs it " + "every `interval`, and (when `drop=true`) a raw pre-conntrack drop for that list \u2014 a self-updating " + "blocklist (e.g. Spamhaus DROP, tor exit nodes, your own deny list). `url` MUST point to a " + "RouterOS `.rsc` file that populates the address-list. DEFAULTS TO A DRY RUN (`apply=false`); set " + "`apply=true` to install. Script/scheduler/rule are named/tagged `threat-feed-<name>` so " + "remove_threat_feed can undo them. Returns the plan or a build report.",
     inputSchema: {
-      name: z104.string().describe("Short feed id, e.g. 'spamhaus-drop'"),
-      url: z104.string().describe("HTTPS URL of a RouterOS .rsc address-list file"),
-      address_list: z104.string().default("threat-blocklist").describe("Address-list to populate"),
-      interval: z104.string().default("1h").describe("How often to refresh the feed"),
-      drop: z104.boolean().default(true).describe("Also add a raw drop rule for the address-list"),
-      apply: z104.boolean().default(false).describe("false = preview (default); true = install")
+      name: z105.string().describe("Short feed id, e.g. 'spamhaus-drop'"),
+      url: z105.string().describe("HTTPS URL of a RouterOS .rsc address-list file"),
+      address_list: z105.string().default("threat-blocklist").describe("Address-list to populate"),
+      interval: z105.string().default("1h").describe("How often to refresh the feed"),
+      drop: z105.boolean().default(true).describe("Also add a raw drop rule for the address-list"),
+      apply: z105.boolean().default(false).describe("false = preview (default); true = install")
     },
     async handler(a, ctx) {
       const id = `${FEED_TAG}-${a.name}`;
@@ -24897,7 +25120,7 @@ ${plan}`;
     title: "Remove Threat-Intel Feed",
     annotations: DESTRUCTIVE,
     description: "Removes a threat feed installed by subscribe_threat_feed: deletes its `/system scheduler` and " + "`/system script` (named `threat-feed-<name>`) and any raw drop rule tagged for it. Does NOT " + "flush the address-list entries themselves. Returns what was removed.",
-    inputSchema: { name: z104.string().describe("The feed id used when subscribing") },
+    inputSchema: { name: z105.string().describe("The feed id used when subscribing") },
     async handler(a, ctx) {
       const id = `${FEED_TAG}-${a.name}`;
       ctx.info(`Removing threat feed ${id}`);
@@ -24919,7 +25142,7 @@ ${plan}`;
 ];
 
 // src/tools/sstp.ts
-import { z as z105 } from "zod";
+import { z as z106 } from "zod";
 var sstpTools = [
   defineTool({
     name: "get_sstp_server",
@@ -24940,19 +25163,19 @@ ${result}`;
     annotations: WRITE_IDEMPOTENT,
     description: "Configure the global SSTP server listener (`/interface sstp-server server set`) \u2014 accepts/rejects incoming TLS VPN connections on this router. " + "Use to enable the server, bind a TLS certificate, change the TCP port, restrict authentication methods (comma-separated, e.g. `'mschap2,mschap1'`), set the default PPP profile, pin TLS version (`any` or `only-1.2`), or enforce client certificate verification. " + "This is a singleton write that modifies the server block, not a client interface. " + "To read the current server config use `get_sstp_server`. " + "To create outbound SSTP tunnels (this router dials out) use `create_sstp_client`; for L2TP outbound use `create_l2tp_client`, for OpenVPN use `create_ovpn_client`, for PPTP use `create_pptp_client`. " + "Returns the updated server block on success.",
     inputSchema: {
-      enabled: z105.boolean().optional(),
-      default_profile: z105.string().optional(),
-      authentication: z105.string().optional().describe("Comma-separated, e.g. 'mschap2,mschap1'"),
-      certificate: z105.string().optional().describe("TLS certificate name"),
-      port: z105.number().int().optional(),
-      tls_version: z105.enum(["any", "only-1.2"]).optional(),
-      verify_client_certificate: z105.boolean().optional(),
-      pfs: z105.boolean().optional().describe("Enable Perfect Forward Secrecy"),
-      force_aes: z105.boolean().optional().describe("Require clients to use AES ciphers"),
-      max_mtu: z105.number().int().optional().describe("Maximum transmission unit"),
-      max_mru: z105.number().int().optional().describe("Maximum receive unit"),
-      mrru: z105.number().int().optional().describe("Max receive reconstructed unit for MP"),
-      keepalive_timeout: z105.number().int().optional().describe("Seconds before an idle connection is considered down")
+      enabled: z106.boolean().optional(),
+      default_profile: z106.string().optional(),
+      authentication: z106.string().optional().describe("Comma-separated, e.g. 'mschap2,mschap1'"),
+      certificate: z106.string().optional().describe("TLS certificate name"),
+      port: z106.number().int().optional(),
+      tls_version: z106.enum(["any", "only-1.2"]).optional(),
+      verify_client_certificate: z106.boolean().optional(),
+      pfs: z106.boolean().optional().describe("Enable Perfect Forward Secrecy"),
+      force_aes: z106.boolean().optional().describe("Require clients to use AES ciphers"),
+      max_mtu: z106.number().int().optional().describe("Maximum transmission unit"),
+      max_mru: z106.number().int().optional().describe("Maximum receive unit"),
+      mrru: z106.number().int().optional().describe("Max receive reconstructed unit for MP"),
+      keepalive_timeout: z106.number().int().optional().describe("Seconds before an idle connection is considered down")
     },
     async handler(a, ctx) {
       ctx.info("Configuring SSTP server");
@@ -24974,27 +25197,27 @@ ${details}`;
     annotations: WRITE,
     description: "Create an outbound SSTP client tunnel interface (`/interface sstp-client add`) so this router dials out to a remote SSTP server over TLS. " + "Use when this device must act as a VPN client, not the VPN server \u2014 for server-side settings use `set_sstp_server`. " + "`connect_to` is the remote server address (IP or DNS name); the TCP port is separate. " + "You may pass the port in `port` or inline as `host:port` in `connect_to` (it is split out " + "automatically \u2014 RouterOS rejects a port embedded in connect-to). SSTP defaults to 443. " + "For L2TP outbound tunnels use `create_l2tp_client`, for OpenVPN use `create_ovpn_client`, for PPTP use `create_pptp_client`. " + "Credentials are accepted but redacted from return values. " + "Returns the created interface detail (name, status, remote address); use the interface `name` with `get_sstp_client` or `remove_sstp_client`.",
     inputSchema: {
-      name: z105.string().describe("Name for the new SSTP client interface"),
-      connect_to: z105.string().describe("Remote SSTP server address (IP or DNS name; host:port also accepted)"),
-      port: z105.number().int().optional().describe("TCP port (default 443 if omitted)"),
-      user: z105.string(),
-      password: z105.string(),
-      profile: z105.string().optional(),
-      certificate: z105.string().optional().describe("Client TLS certificate name"),
-      verify_server_certificate: z105.boolean().optional(),
-      authentication: z105.string().optional().describe("Comma-separated, e.g. 'mschap2,mschap1'"),
-      tls_version: z105.enum(["any", "only-1.2"]).optional(),
-      pfs: z105.boolean().optional().describe("Enable Perfect Forward Secrecy"),
-      add_default_route: z105.boolean().optional(),
-      default_route_distance: z105.number().int().optional().describe("Distance of the auto-added default route"),
-      dial_on_demand: z105.boolean().optional().describe("Connect only when traffic is sent over the tunnel"),
-      max_mtu: z105.number().int().optional().describe("Maximum transmission unit"),
-      max_mru: z105.number().int().optional().describe("Maximum receive unit"),
-      mrru: z105.number().int().optional().describe("Max receive reconstructed unit for MP"),
-      keepalive_timeout: z105.number().int().optional().describe("Seconds before an idle connection is considered down"),
-      http_proxy: z105.string().optional(),
-      comment: z105.string().optional(),
-      disabled: z105.boolean().default(false)
+      name: z106.string().describe("Name for the new SSTP client interface"),
+      connect_to: z106.string().describe("Remote SSTP server address (IP or DNS name; host:port also accepted)"),
+      port: z106.number().int().optional().describe("TCP port (default 443 if omitted)"),
+      user: z106.string(),
+      password: z106.string(),
+      profile: z106.string().optional(),
+      certificate: z106.string().optional().describe("Client TLS certificate name"),
+      verify_server_certificate: z106.boolean().optional(),
+      authentication: z106.string().optional().describe("Comma-separated, e.g. 'mschap2,mschap1'"),
+      tls_version: z106.enum(["any", "only-1.2"]).optional(),
+      pfs: z106.boolean().optional().describe("Enable Perfect Forward Secrecy"),
+      add_default_route: z106.boolean().optional(),
+      default_route_distance: z106.number().int().optional().describe("Distance of the auto-added default route"),
+      dial_on_demand: z106.boolean().optional().describe("Connect only when traffic is sent over the tunnel"),
+      max_mtu: z106.number().int().optional().describe("Maximum transmission unit"),
+      max_mru: z106.number().int().optional().describe("Maximum receive unit"),
+      mrru: z106.number().int().optional().describe("Max receive reconstructed unit for MP"),
+      keepalive_timeout: z106.number().int().optional().describe("Seconds before an idle connection is considered down"),
+      http_proxy: z106.string().optional(),
+      comment: z106.string().optional(),
+      disabled: z106.boolean().default(false)
     },
     async handler(a, ctx) {
       ctx.info(`Creating SSTP client: name=${a.name}, connect_to=${a.connect_to}`);
@@ -25015,7 +25238,7 @@ ${redactSecrets(details)}` : "SSTP client creation completed but unable to verif
     annotations: READ,
     description: "List all outbound SSTP client tunnel interfaces (`/interface sstp-client print`), optionally narrowed by partial name match via `name_filter`. " + "Use to discover existing SSTP tunnels and their connection status before creating or removing one. " + "Passwords are redacted in the output. " + "For full detail on a single client use `get_sstp_client` with the interface name. " + "To inspect the inbound SSTP server config use `get_sstp_server`. " + "Returns a summary list of all matching SSTP client entries.",
     inputSchema: {
-      name_filter: z105.string().optional().describe("Partial name match")
+      name_filter: z106.string().optional().describe("Partial name match")
     },
     async handler(a, ctx) {
       ctx.info("Listing SSTP clients");
@@ -25033,7 +25256,7 @@ ${redactSecrets(result)}`;
     title: "Get SSTP Client Interface Detail",
     annotations: READ,
     description: "Return full detail for one SSTP client interface (`/interface sstp-client print detail where name=...`) by interface name \u2014 includes status, remote server address, TLS certificate, PPP profile, and connection options; passwords are redacted. " + "Use when you need the complete property set for a single tunnel rather than the summary list. " + "Use `list_sstp_clients` first to discover valid interface names. " + "For the inbound server configuration use `get_sstp_server`. " + "Returns the full detail block for the named interface, or a not-found message.",
-    inputSchema: { name: z105.string() },
+    inputSchema: { name: z106.string() },
     async handler(a, ctx) {
       ctx.info(`Getting SSTP client details: name=${a.name}`);
       const result = await executeMikrotikCommand(`/interface sstp-client print detail where name="${a.name}"`, ctx);
@@ -25047,7 +25270,7 @@ ${redactSecrets(result)}`;
     title: "Remove SSTP Client Interface",
     annotations: DESTRUCTIVE,
     description: "Permanently delete an SSTP client tunnel interface (`/interface sstp-client remove [find name=...]`) by interface name. " + "First verifies the interface exists (count-only check), then removes it; the tunnel is torn down immediately and the action is irreversible. " + "Use `list_sstp_clients` to confirm the interface name before calling this tool. " + "For L2TP, OpenVPN, or PPTP client interfaces see their respective tool scopes (`create_l2tp_client`, `create_ovpn_client`, `create_pptp_client`). " + "To deactivate the interface without deleting it use `disable_sstp_client` (re-activate with `enable_sstp_client`). " + "Returns a confirmation message on success or a not-found message if the name does not exist.",
-    inputSchema: { name: z105.string() },
+    inputSchema: { name: z106.string() },
     async handler(a, ctx) {
       ctx.info(`Removing SSTP client: name=${a.name}`);
       const count = await executeMikrotikCommand(`/interface sstp-client print count-only where name="${a.name}"`, ctx);
@@ -25064,7 +25287,7 @@ ${redactSecrets(result)}`;
     title: "Enable SSTP Client Interface",
     annotations: WRITE_IDEMPOTENT,
     description: "Enables a disabled SSTP client interface (`/interface sstp-client enable [find name=...]`), " + "causing the router to dial out and attempt the TLS connection to the remote SSTP server. " + "Use to activate a tunnel that was created disabled or stopped with `disable_sstp_client`. " + "For L2TP/PPTP/OpenVPN tunnels use their own enable tools. " + "Identifies the interface by name \u2014 create one with `create_sstp_client`.",
-    inputSchema: { name: z105.string() },
+    inputSchema: { name: z106.string() },
     async handler(a, ctx) {
       ctx.info(`Enabling SSTP client: name=${a.name}`);
       const count = await executeMikrotikCommand(`/interface sstp-client print count-only where name="${a.name}"`, ctx);
@@ -25081,7 +25304,7 @@ ${redactSecrets(result)}`;
     title: "Disable SSTP Client Interface",
     annotations: WRITE_IDEMPOTENT,
     description: "Disables an active SSTP client interface (`/interface sstp-client disable [find name=...]`), " + "tearing down the tunnel without removing its configuration. " + "Use to temporarily stop a tunnel while preserving its settings for later reuse. " + "To re-enable use `enable_sstp_client`; to permanently remove use `remove_sstp_client`.",
-    inputSchema: { name: z105.string() },
+    inputSchema: { name: z106.string() },
     async handler(a, ctx) {
       ctx.info(`Disabling SSTP client: name=${a.name}`);
       const count = await executeMikrotikCommand(`/interface sstp-client print count-only where name="${a.name}"`, ctx);
@@ -25096,7 +25319,7 @@ ${redactSecrets(result)}`;
 ];
 
 // src/tools/switch-settings.ts
-import { z as z106 } from "zod";
+import { z as z107 } from "zod";
 var switchSettingsTools = [
   defineTool({
     name: "list_switches",
@@ -25104,8 +25327,8 @@ var switchSettingsTools = [
     annotations: READ,
     description: "Lists hardware switch chips (`/interface ethernet switch`). " + "Use to discover switch chip names and types present on the device before targeting a chip with get_switch or update_switch. " + "Accepts optional `name_filter` and `type_filter` for partial-match filtering. " + "Returns chip name, type, and mirror/flow-control configuration for each matching entry; returns an empty message if none match.",
     inputSchema: {
-      name_filter: z106.string().optional().describe("Partial switch-name match"),
-      type_filter: z106.string().optional().describe("Partial switch-type match")
+      name_filter: z107.string().optional().describe("Partial switch-name match"),
+      type_filter: z107.string().optional().describe("Partial switch-type match")
     },
     async handler(a, ctx) {
       ctx.info("Listing switches");
@@ -25126,7 +25349,7 @@ ${result}`;
     annotations: READ,
     description: "Fetches full detail for a single hardware switch chip (`/interface ethernet switch print detail`). " + "Use to inspect the current cpu-flow-control flag and mirror-source, mirror-target, and mirror-egress settings before modifying them with update_switch. " + "`switch_id` accepts the chip name (e.g. 'switch1') or the RouterOS `.id` returned by list_switches \u2014 tries `.id` lookup first, then falls back to name lookup. " + "Returns detailed chip settings or a not-found message.",
     inputSchema: {
-      switch_id: z106.string().describe("Switch name (e.g. 'switch1') or RouterOS '.id'")
+      switch_id: z107.string().describe("Switch name (e.g. 'switch1') or RouterOS '.id'")
     },
     async handler(a, ctx) {
       ctx.info(`Getting switch details: switch_id=${a.switch_id}`);
@@ -25150,14 +25373,14 @@ ${result}`;
 
 ` + "Returns updated switch details on success.",
     inputSchema: {
-      switch_id: z106.string().describe("Switch name (e.g. 'switch1') or RouterOS '.id'"),
-      name: z106.string().optional().describe("Rename the switch"),
-      cpu_flow_control: z106.boolean().optional(),
-      mirror_source: z106.string().optional().describe("Source port to mirror, or 'none'"),
-      mirror_target: z106.string().optional().describe("Monitor port, 'cpu', or 'none'"),
-      mirror_egress: z106.string().optional().describe("Egress mirror source port (newer chips), or 'none'"),
-      mirror_egress_target: z106.string().optional().describe("Egress mirror target port (88E6393X/88E6191X/88E6190 chips), or 'none'"),
-      switch_all_ports: z106.boolean().optional().describe("Switch all ports together (RB450G/RB435G/RB850Gx2 only)")
+      switch_id: z107.string().describe("Switch name (e.g. 'switch1') or RouterOS '.id'"),
+      name: z107.string().optional().describe("Rename the switch"),
+      cpu_flow_control: z107.boolean().optional(),
+      mirror_source: z107.string().optional().describe("Source port to mirror, or 'none'"),
+      mirror_target: z107.string().optional().describe("Monitor port, 'cpu', or 'none'"),
+      mirror_egress: z107.string().optional().describe("Egress mirror source port (newer chips), or 'none'"),
+      mirror_egress_target: z107.string().optional().describe("Egress mirror target port (88E6393X/88E6191X/88E6190 chips), or 'none'"),
+      switch_all_ports: z107.boolean().optional().describe("Switch all ports together (RB450G/RB435G/RB850Gx2 only)")
     },
     async handler(a, ctx) {
       ctx.info(`Updating switch: switch_id=${a.switch_id}`);
@@ -25180,9 +25403,9 @@ ${details}`;
 ];
 
 // src/tools/switch-port.ts
-import { z as z107 } from "zod";
-var VlanMode = z107.enum(["disabled", "optional", "enabled", "secure"]);
-var VlanHeader = z107.enum(["leave-as-is", "always-strip", "add-if-missing"]);
+import { z as z108 } from "zod";
+var VlanMode = z108.enum(["disabled", "optional", "enabled", "secure"]);
+var VlanHeader = z108.enum(["leave-as-is", "always-strip", "add-if-missing"]);
 var switchPortTools = [
   defineTool({
     name: "list_switch_ports",
@@ -25190,8 +25413,8 @@ var switchPortTools = [
     annotations: READ,
     description: "List all switch chip ports (`/interface ethernet switch port print`) \u2014 the hardware-level " + "per-port VLAN configuration entries on RouterOS switch chips. " + "Use this to discover port names and their current vlan-mode, vlan-header, and " + "default-vlan-id (PVID) settings before updating them. " + "For a single port's full detail use get_switch_port; to change settings use update_switch_port. " + "Optional filters narrow results by partial port name or owning switch (e.g. 'switch1'). " + "Returns all matching port rows including VLAN mode, tag-header treatment, and PVID.",
     inputSchema: {
-      name_filter: z107.string().optional().describe("Partial port-name match"),
-      switch_filter: z107.string().optional().describe("Filter by owning switch, e.g. 'switch1'")
+      name_filter: z108.string().optional().describe("Partial port-name match"),
+      switch_filter: z108.string().optional().describe("Filter by owning switch, e.g. 'switch1'")
     },
     async handler(a, ctx) {
       ctx.info("Listing switch ports");
@@ -25212,7 +25435,7 @@ ${result}`;
     annotations: READ,
     description: "Retrieve detailed settings for a single switch chip port (`/interface ethernet switch port print detail`) " + "by port name (e.g. 'ether1') or RouterOS '.id' from list_switch_ports. " + "Use this when you need the full attribute set of one port before updating it; " + "for all ports use list_switch_ports; to change settings use update_switch_port. " + "Returns a detailed view of vlan-mode, vlan-header, default-vlan-id, and force-vlan-id for the matched port.",
     inputSchema: {
-      port_id: z107.string().describe("Port name (e.g. 'ether1') or RouterOS '.id'")
+      port_id: z108.string().describe("Port name (e.g. 'ether1') or RouterOS '.id'")
     },
     async handler(a, ctx) {
       ctx.info(`Getting switch port details: port_id=${a.port_id}`);
@@ -25238,11 +25461,11 @@ ${result}`;
 ` + `        'always-strip', or 'add-if-missing'.
 ` + "    default_vlan_id: PVID for untagged ingress ('auto', 'none', or a number).",
     inputSchema: {
-      port_id: z107.string().describe("Port name (e.g. 'ether1') or RouterOS '.id'"),
-      default_vlan_id: z107.string().optional().describe("PVID: 'auto', 'none', or a VLAN id number"),
+      port_id: z108.string().describe("Port name (e.g. 'ether1') or RouterOS '.id'"),
+      default_vlan_id: z108.string().optional().describe("PVID: 'auto', 'none', or a VLAN id number"),
       vlan_mode: VlanMode.optional(),
       vlan_header: VlanHeader.optional(),
-      force_vlan_id: z107.boolean().optional()
+      force_vlan_id: z108.boolean().optional()
     },
     async handler(a, ctx) {
       ctx.info(`Updating switch port: port_id=${a.port_id}`);
@@ -25264,7 +25487,7 @@ ${details}`;
 ];
 
 // src/tools/switch-port-isolation.ts
-import { z as z108 } from "zod";
+import { z as z109 } from "zod";
 function selectorFor(id) {
   return id.startsWith("*") ? `.id="${id}"` : `port="${id}"`;
 }
@@ -25281,9 +25504,9 @@ var switchPortIsolationTools = [
 ` + `    port: source port to isolate, e.g. 'ether1'.
 ` + "    forwarding_override_ports: comma-separated list of the ONLY ports this port " + "        may forward to \u2014 all others are blocked in hardware.",
     inputSchema: {
-      port: z108.string().describe("Source port to isolate, e.g. 'ether1'"),
-      forwarding_override_ports: z108.string().describe("Comma-separated allowed destination ports"),
-      comment: z108.string().optional()
+      port: z109.string().describe("Source port to isolate, e.g. 'ether1'"),
+      forwarding_override_ports: z109.string().describe("Comma-separated allowed destination ports"),
+      comment: z109.string().optional()
     },
     async handler(a, ctx) {
       ctx.info(`Adding switch port-isolation: port=${a.port}`);
@@ -25305,7 +25528,7 @@ ${details}` : "Switch port-isolation addition completed but unable to verify.";
 
 ` + "Returns a table of all matching entries; optionally filter by partial port name via port_filter.",
     inputSchema: {
-      port_filter: z108.string().optional().describe("Partial source-port match")
+      port_filter: z109.string().optional().describe("Partial source-port match")
     },
     async handler(a, ctx) {
       ctx.info("Listing switch port-isolation entries");
@@ -25326,7 +25549,7 @@ ${result}`;
 
 ` + "Returns the full detail block for the matched entry, or a not-found message.",
     inputSchema: {
-      isolation_id: z108.string().describe("Source port name (e.g. 'ether1') or RouterOS '.id'")
+      isolation_id: z109.string().describe("Source port name (e.g. 'ether1') or RouterOS '.id'")
     },
     async handler(a, ctx) {
       ctx.info(`Getting switch port-isolation: isolation_id=${a.isolation_id}`);
@@ -25346,9 +25569,9 @@ ${result}`;
 
 ` + "Returns the entry's updated detail block.",
     inputSchema: {
-      isolation_id: z108.string().describe("Source port name or RouterOS '.id'"),
-      forwarding_override_ports: z108.string().optional().describe("Comma-separated allowed destination ports"),
-      comment: z108.string().optional()
+      isolation_id: z109.string().describe("Source port name or RouterOS '.id'"),
+      forwarding_override_ports: z109.string().optional().describe("Comma-separated allowed destination ports"),
+      comment: z109.string().optional()
     },
     async handler(a, ctx) {
       ctx.info(`Updating switch port-isolation: isolation_id=${a.isolation_id}`);
@@ -25377,7 +25600,7 @@ ${details}`;
 
 ` + "isolation_id accepts either the source port name (e.g. 'ether1') or the RouterOS `.id` " + "(e.g. '*1') from list_switch_port_isolation. Performs a count-only existence check before " + "removal and returns a not-found message if the entry does not exist. To add a new isolation rule " + "afterwards use add_switch_port_isolation; to only modify allowed ports use update_switch_port_isolation.",
     inputSchema: {
-      isolation_id: z108.string().describe("Source port name or RouterOS '.id'")
+      isolation_id: z109.string().describe("Source port name or RouterOS '.id'")
     },
     async handler(a, ctx) {
       ctx.info(`Removing switch port-isolation: isolation_id=${a.isolation_id}`);
@@ -25394,7 +25617,7 @@ ${details}`;
 ];
 
 // src/tools/switch-rule.ts
-import { z as z109 } from "zod";
+import { z as z110 } from "zod";
 var isDigits8 = (s) => /^\d+$/.test(s);
 async function updateSwitchRule(a, ctx) {
   ctx.info(`Updating switch rule: rule_id=${a.rule_id}`);
@@ -25461,32 +25684,32 @@ var switchRuleTools = [
 ` + `    rate: rate limit in bits/second.
 ` + "    mac_protocol: e.g. 'ip', 'arp', 'vlan', or an EtherType number.",
     inputSchema: {
-      switch: z109.string().describe("Owning switch chip, e.g. 'switch1'"),
-      ports: z109.string().describe("Comma-separated source ports the rule matches"),
-      src_address: z109.string().optional().describe("Source IP/mask"),
-      dst_address: z109.string().optional().describe("Destination IP/mask"),
-      src_address6: z109.string().optional().describe("Source IPv6 address/mask"),
-      dst_address6: z109.string().optional().describe("Destination IPv6 address/mask"),
-      src_mac_address: z109.string().optional().describe("Source MAC/mask"),
-      dst_mac_address: z109.string().optional().describe("Destination MAC/mask"),
-      src_port: z109.string().optional().describe("Layer-4 source port(s)"),
-      dst_port: z109.string().optional().describe("Layer-4 destination port(s)"),
-      protocol: z109.string().optional().describe("IP protocol, e.g. 'tcp'"),
-      mac_protocol: z109.string().optional().describe("MAC protocol, e.g. 'ip', 'arp', 'vlan' or a number"),
-      vlan_header: z109.enum(["any", "not-present", "present"]).optional().describe("Match on VLAN tag presence"),
-      vlan_id: z109.string().optional(),
-      vlan_priority: z109.string().optional(),
-      dscp: z109.string().optional(),
-      flow_label: z109.string().optional().describe("IPv6 flow label"),
-      new_dst_ports: z109.string().optional().describe("Redirect target ports; empty string drops the traffic"),
-      new_vlan_id: z109.string().optional(),
-      new_vlan_priority: z109.string().optional(),
-      redirect_to_cpu: z109.boolean().optional(),
-      copy_to_cpu: z109.boolean().optional(),
-      mirror: z109.boolean().optional(),
-      rate: z109.string().optional().describe("Rate limit in bits/second"),
-      comment: z109.string().optional(),
-      disabled: z109.boolean().default(false)
+      switch: z110.string().describe("Owning switch chip, e.g. 'switch1'"),
+      ports: z110.string().describe("Comma-separated source ports the rule matches"),
+      src_address: z110.string().optional().describe("Source IP/mask"),
+      dst_address: z110.string().optional().describe("Destination IP/mask"),
+      src_address6: z110.string().optional().describe("Source IPv6 address/mask"),
+      dst_address6: z110.string().optional().describe("Destination IPv6 address/mask"),
+      src_mac_address: z110.string().optional().describe("Source MAC/mask"),
+      dst_mac_address: z110.string().optional().describe("Destination MAC/mask"),
+      src_port: z110.string().optional().describe("Layer-4 source port(s)"),
+      dst_port: z110.string().optional().describe("Layer-4 destination port(s)"),
+      protocol: z110.string().optional().describe("IP protocol, e.g. 'tcp'"),
+      mac_protocol: z110.string().optional().describe("MAC protocol, e.g. 'ip', 'arp', 'vlan' or a number"),
+      vlan_header: z110.enum(["any", "not-present", "present"]).optional().describe("Match on VLAN tag presence"),
+      vlan_id: z110.string().optional(),
+      vlan_priority: z110.string().optional(),
+      dscp: z110.string().optional(),
+      flow_label: z110.string().optional().describe("IPv6 flow label"),
+      new_dst_ports: z110.string().optional().describe("Redirect target ports; empty string drops the traffic"),
+      new_vlan_id: z110.string().optional(),
+      new_vlan_priority: z110.string().optional(),
+      redirect_to_cpu: z110.boolean().optional(),
+      copy_to_cpu: z110.boolean().optional(),
+      mirror: z110.boolean().optional(),
+      rate: z110.string().optional().describe("Rate limit in bits/second"),
+      comment: z110.string().optional(),
+      disabled: z110.boolean().default(false)
     },
     async handler(a, ctx) {
       ctx.info(`Adding switch rule: switch=${a.switch}, ports=${a.ports}`);
@@ -25520,9 +25743,9 @@ ${details}`;
     annotations: READ,
     description: "Lists all hardware switch ACL/redirect rules (`/interface ethernet switch rule print`) " + "on the switch chip. Use this to audit or discover existing rules before adding or updating. " + "Optional filters narrow by switch chip name, port name substring, or disabled-only status. " + "For software firewall rules use list_filter_rules; for NAT rules use list_nat_rules. " + "Returns a formatted table of all matching rules including their `.id` values needed by " + "get_switch_rule, update_switch_rule, remove_switch_rule, enable_switch_rule, and disable_switch_rule.",
     inputSchema: {
-      switch_filter: z109.string().optional(),
-      ports_filter: z109.string().optional(),
-      disabled_only: z109.boolean().default(false)
+      switch_filter: z110.string().optional(),
+      ports_filter: z110.string().optional(),
+      disabled_only: z110.boolean().default(false)
     },
     async handler(a, ctx) {
       ctx.info("Listing switch rules");
@@ -25545,7 +25768,7 @@ ${result}`;
     annotations: READ,
     description: "Fetches full detail of a single hardware switch ACL/redirect rule " + "(`/interface ethernet switch rule print detail where .id=\u2026`). " + "Use this to inspect all match criteria and action fields of one rule. " + "`rule_id` takes the `.id` from list_switch_rules (e.g. '*1'). " + "For a tabular overview of all rules use list_switch_rules; " + "for software firewall rule detail use get_filter_rule.",
     inputSchema: {
-      rule_id: z109.string().describe("RouterOS '.id', e.g. '*1' or '0'")
+      rule_id: z110.string().describe("RouterOS '.id', e.g. '*1' or '0'")
     },
     async handler(a, ctx) {
       ctx.info(`Getting switch rule: rule_id=${a.rule_id}`);
@@ -25561,33 +25784,33 @@ ${result}`;
     annotations: WRITE_IDEMPOTENT,
     description: "Modifies an existing hardware switch ACL/redirect rule " + "(`/interface ethernet switch rule set`) by `.id`. " + "Use this to change match criteria (ports, addresses, VLAN, protocol) or actions " + "(redirect target ports, mirror, rate limit, disabled state). " + 'Pass an empty string ("") for any optional field to clear it. ' + "`rule_id` takes the `.id` from list_switch_rules. Returns the updated rule's full detail. " + "For software firewall rule edits use update_filter_rule; " + "to only toggle the enabled state use enable_switch_rule or disable_switch_rule.",
     inputSchema: {
-      rule_id: z109.string(),
-      switch: z109.string().optional(),
-      ports: z109.string().optional(),
-      src_address: z109.string().optional(),
-      dst_address: z109.string().optional(),
-      src_address6: z109.string().optional(),
-      dst_address6: z109.string().optional(),
-      src_mac_address: z109.string().optional(),
-      dst_mac_address: z109.string().optional(),
-      src_port: z109.string().optional(),
-      dst_port: z109.string().optional(),
-      protocol: z109.string().optional(),
-      mac_protocol: z109.string().optional(),
-      vlan_header: z109.enum(["any", "not-present", "present"]).optional(),
-      vlan_id: z109.string().optional(),
-      vlan_priority: z109.string().optional(),
-      dscp: z109.string().optional(),
-      flow_label: z109.string().optional(),
-      new_dst_ports: z109.string().optional(),
-      new_vlan_id: z109.string().optional(),
-      new_vlan_priority: z109.string().optional(),
-      redirect_to_cpu: z109.boolean().optional(),
-      copy_to_cpu: z109.boolean().optional(),
-      mirror: z109.boolean().optional(),
-      rate: z109.string().optional(),
-      comment: z109.string().optional(),
-      disabled: z109.boolean().optional()
+      rule_id: z110.string(),
+      switch: z110.string().optional(),
+      ports: z110.string().optional(),
+      src_address: z110.string().optional(),
+      dst_address: z110.string().optional(),
+      src_address6: z110.string().optional(),
+      dst_address6: z110.string().optional(),
+      src_mac_address: z110.string().optional(),
+      dst_mac_address: z110.string().optional(),
+      src_port: z110.string().optional(),
+      dst_port: z110.string().optional(),
+      protocol: z110.string().optional(),
+      mac_protocol: z110.string().optional(),
+      vlan_header: z110.enum(["any", "not-present", "present"]).optional(),
+      vlan_id: z110.string().optional(),
+      vlan_priority: z110.string().optional(),
+      dscp: z110.string().optional(),
+      flow_label: z110.string().optional(),
+      new_dst_ports: z110.string().optional(),
+      new_vlan_id: z110.string().optional(),
+      new_vlan_priority: z110.string().optional(),
+      redirect_to_cpu: z110.boolean().optional(),
+      copy_to_cpu: z110.boolean().optional(),
+      mirror: z110.boolean().optional(),
+      rate: z110.string().optional(),
+      comment: z110.string().optional(),
+      disabled: z110.boolean().optional()
     },
     async handler(a, ctx) {
       return updateSwitchRule(a, ctx);
@@ -25598,7 +25821,7 @@ ${result}`;
     title: "Remove Switch Chip ACL Rule",
     annotations: DESTRUCTIVE,
     description: "Permanently deletes a hardware switch ACL/redirect rule " + "(`/interface ethernet switch rule remove`) by `.id`. " + "Performs an existence check first and returns an error if the rule is not found. " + "`rule_id` takes the `.id` from list_switch_rules (e.g. '*1'). " + "To keep the rule but stop it from matching use disable_switch_rule instead. " + "For removing software firewall rules use remove_filter_rule.",
-    inputSchema: { rule_id: z109.string() },
+    inputSchema: { rule_id: z110.string() },
     async handler(a, ctx) {
       ctx.info(`Removing switch rule: rule_id=${a.rule_id}`);
       const count = await executeMikrotikCommand(`/interface ethernet switch rule print count-only where .id=${a.rule_id}`, ctx);
@@ -25615,7 +25838,7 @@ ${result}`;
     title: "Enable Switch Chip ACL Rule",
     annotations: WRITE_IDEMPOTENT,
     description: "Re-enables a previously disabled hardware switch ACL/redirect rule " + "(`/interface ethernet switch rule set \u2026 disabled=no`). " + "Use this to activate a rule without recreating it. " + "`rule_id` takes the `.id` from list_switch_rules (e.g. '*1'). " + "To deactivate a rule without deleting it use disable_switch_rule; " + "to permanently delete use remove_switch_rule. Returns the updated rule's full detail.",
-    inputSchema: { rule_id: z109.string() },
+    inputSchema: { rule_id: z110.string() },
     async handler(a, ctx) {
       return updateSwitchRule({ rule_id: a.rule_id, disabled: false }, ctx);
     }
@@ -25625,7 +25848,7 @@ ${result}`;
     title: "Disable Switch Chip ACL Rule",
     annotations: WRITE_IDEMPOTENT,
     description: "Deactivates a hardware switch ACL/redirect rule without deleting it " + "(`/interface ethernet switch rule set \u2026 disabled=yes`). " + "Use this to temporarily suspend a rule's match/action while preserving its configuration. " + "`rule_id` takes the `.id` from list_switch_rules (e.g. '*1'). " + "To reactivate the rule use enable_switch_rule; to permanently delete use remove_switch_rule. " + "Returns the updated rule's full detail.",
-    inputSchema: { rule_id: z109.string() },
+    inputSchema: { rule_id: z110.string() },
     async handler(a, ctx) {
       return updateSwitchRule({ rule_id: a.rule_id, disabled: true }, ctx);
     }
@@ -25633,7 +25856,7 @@ ${result}`;
 ];
 
 // src/tools/system-config.ts
-import { z as z110 } from "zod";
+import { z as z111 } from "zod";
 var systemConfigTools = [
   defineTool({
     name: "list_system_console",
@@ -25680,7 +25903,7 @@ ${result}`;
     annotations: WRITE_IDEMPOTENT,
     description: "Writes the global LED behaviour settings (`/system leds settings set`). " + "Use to enable dark mode by scheduling all LEDs off. " + "For per-LED trigger assignments use `list_leds`; to read current settings use `get_leds_settings`. " + "Accepts `all_leds_off`: `never` | `immediate` | `after-1h` | `after-1min`. " + "Returns the updated settings on success.",
     inputSchema: {
-      all_leds_off: z110.enum(["never", "immediate", "after-1h", "after-1min"]).optional().describe("When to turn all LEDs off (dark mode)")
+      all_leds_off: z111.enum(["never", "immediate", "after-1h", "after-1min"]).optional().describe("When to turn all LEDs off (dark mode)")
     },
     async handler(a, ctx) {
       ctx.info("Setting LED settings");
@@ -25730,8 +25953,8 @@ ${result}`;
     annotations: WRITE_IDEMPOTENT,
     description: "Writes the system-wide login banner text (`/system note set`). " + "Use to set or clear the message displayed to users at login. " + "To read the current note use `get_note`. " + "Accepts optional `note` (text string) and `show_at_login` (boolean). " + "Returns the updated note on success.",
     inputSchema: {
-      note: z110.string().optional().describe("The note text to display"),
-      show_at_login: z110.boolean().optional().describe("Show the note on login")
+      note: z111.string().optional().describe("The note text to display"),
+      show_at_login: z111.boolean().optional().describe("Show the note on login")
     },
     async handler(a, ctx) {
       ctx.info("Setting system note");
@@ -25768,13 +25991,13 @@ ${result}`;
     annotations: WRITE_IDEMPOTENT,
     description: "Writes the device's built-in NTP *server* settings (`/system ntp server set`, RouterOS 7+). " + "Use to enable the router as a time server for LAN clients via broadcast, multicast, or manycast. " + "This tool configures the local NTP *server* role; to set upstream NTP *client* sources " + "use the NTP client tools in the system module. " + "Accepts `enabled`, `broadcast`, `multicast`, `manycast` (booleans) and `broadcast_address` (string). " + "Returns the updated server configuration on success.",
     inputSchema: {
-      enabled: z110.boolean().optional().describe("Enable or disable the NTP server"),
-      broadcast: z110.boolean().optional(),
-      multicast: z110.boolean().optional(),
-      manycast: z110.boolean().optional(),
-      broadcast_address: z110.string().optional().describe("Broadcast address for NTP broadcasts"),
-      use_local_clock: z110.boolean().optional().describe("Serve time from the device's local clock as reference"),
-      local_clock_stratum: z110.number().int().optional().describe("Stratum advertised when using the local clock (1-15)")
+      enabled: z111.boolean().optional().describe("Enable or disable the NTP server"),
+      broadcast: z111.boolean().optional(),
+      multicast: z111.boolean().optional(),
+      manycast: z111.boolean().optional(),
+      broadcast_address: z111.string().optional().describe("Broadcast address for NTP broadcasts"),
+      use_local_clock: z111.boolean().optional().describe("Serve time from the device's local clock as reference"),
+      local_clock_stratum: z111.number().int().optional().describe("Stratum advertised when using the local clock (1-15)")
     },
     async handler(a, ctx) {
       ctx.info("Setting NTP server configuration");
@@ -25797,8 +26020,8 @@ ${details}`;
     annotations: WRITE,
     description: "Changes the password of the currently authenticated user (`/password`). " + "Use to rotate the login credential without touching other user accounts; " + "passwords are never echoed in the response. " + "To manage other users' accounts or create new users use `add_user`. " + "Requires `old_password` and `new_password`; returns success or a rejection message (no credentials logged).",
     inputSchema: {
-      old_password: z110.string().describe("The current password"),
-      new_password: z110.string().describe("The new password to set")
+      old_password: z111.string().describe("The current password"),
+      new_password: z111.string().describe("The new password to set")
     },
     async handler(a, ctx) {
       ctx.info("Changing device password");
@@ -25815,7 +26038,7 @@ ${details}`;
     annotations: READ,
     description: "Lists the physical serial ports registered on the device (`/port print`). " + "Use to discover available serial ports and their current line settings before reconfiguring. " + "For auto-login rules tied to a serial port use `list_special_login`; " + "for console session entries use `list_system_console`. " + "Accepts optional `name_filter` for partial name match. " + "Returns port entries or an empty message when none match.",
     inputSchema: {
-      name_filter: z110.string().optional().describe("Partial port name match")
+      name_filter: z111.string().optional().describe("Partial port name match")
     },
     async handler(a, ctx) {
       ctx.info("Listing serial ports");
@@ -25834,7 +26057,7 @@ ${result}`;
     annotations: READ,
     description: "Reads detailed settings for a named serial port (`/port print detail where name=...`). " + "Use to inspect baud rate, parity, data/stop bits, and flow control for a specific port. " + "For an overview of all ports use `list_ports`; to change settings use `set_port`. " + "Requires `name` (e.g. `serial0`). Returns full detail for the named port.",
     inputSchema: {
-      name: z110.string().describe("Serial port name, e.g. 'serial0'")
+      name: z111.string().describe("Serial port name, e.g. 'serial0'")
     },
     async handler(a, ctx) {
       ctx.info(`Getting serial port details: name=${a.name}`);
@@ -25850,12 +26073,12 @@ ${result}`;
     annotations: WRITE_IDEMPOTENT,
     description: "Writes line settings for a named serial port (`/port set [find name=...]`). " + "Use to change baud rate, data bits, parity, stop bits, or flow control on a serial port. " + "To read current settings first use `get_port`; for a list of all ports use `list_ports`. " + "Requires `name` (e.g. `serial0`), plus optional `baud_rate` (e.g. `115200` or `auto`), " + "`data_bits`, `parity` (`none`|`odd`|`even`), `stop_bits`, " + "`flow_control` (`none`|`hardware`|`xon-xoff`). " + "Returns the updated port detail on success.",
     inputSchema: {
-      name: z110.string().describe("Serial port name to update"),
-      baud_rate: z110.string().optional().describe("e.g. '115200' or 'auto'"),
-      data_bits: z110.number().int().optional(),
-      parity: z110.enum(["none", "odd", "even"]).optional(),
-      stop_bits: z110.number().int().optional(),
-      flow_control: z110.enum(["none", "hardware", "xon-xoff"]).optional()
+      name: z111.string().describe("Serial port name to update"),
+      baud_rate: z111.string().optional().describe("e.g. '115200' or 'auto'"),
+      data_bits: z111.number().int().optional(),
+      parity: z111.enum(["none", "odd", "even"]).optional(),
+      stop_bits: z111.number().int().optional(),
+      flow_control: z111.enum(["none", "hardware", "xon-xoff"]).optional()
     },
     async handler(a, ctx) {
       ctx.info(`Setting serial port: name=${a.name}`);
@@ -25894,12 +26117,12 @@ ${result}`;
     annotations: DANGEROUS,
     description: "Sends a factory-reset command to the device (`/system reset-configuration`). " + "Use ONLY to wipe the entire configuration and reboot into defaults \u2014 " + "the SSH connection will drop immediately after and all config will be lost. " + "Requires `confirm=true`; without it the command is blocked. " + "Optional: `keep_users` (preserve user accounts), `no_defaults` (skip loading default config), " + "`skip_backup` (skip automatic pre-reset backup), `caps_mode` (reset into CAPsMAN-managed CAP mode), " + "`run_after_reset` (script to execute post-reboot). " + "This operation is irreversible \u2014 there is no undo.",
     inputSchema: {
-      confirm: z110.boolean().describe("Must be true to actually ERASE the configuration"),
-      keep_users: z110.boolean().optional().describe("Keep existing user accounts after reset"),
-      no_defaults: z110.boolean().optional().describe("Do not load the default configuration"),
-      skip_backup: z110.boolean().optional().describe("Skip the automatic backup before reset"),
-      caps_mode: z110.boolean().optional().describe("Reset into CAPsMAN-managed CAP mode instead of standalone"),
-      run_after_reset: z110.string().optional().describe("Script file to run after reset")
+      confirm: z111.boolean().describe("Must be true to actually ERASE the configuration"),
+      keep_users: z111.boolean().optional().describe("Keep existing user accounts after reset"),
+      no_defaults: z111.boolean().optional().describe("Do not load the default configuration"),
+      skip_backup: z111.boolean().optional().describe("Skip the automatic backup before reset"),
+      caps_mode: z111.boolean().optional().describe("Reset into CAPsMAN-managed CAP mode instead of standalone"),
+      run_after_reset: z111.string().optional().describe("Script file to run after reset")
     },
     async handler(a, ctx) {
       if (!a.confirm)
@@ -25944,12 +26167,12 @@ ${result}`;
     annotations: WRITE_IDEMPOTENT,
     description: "Writes the hardware/software watchdog timer settings (`/system watchdog set`). " + "Use to enable automatic reboots when the device becomes unresponsive " + "(triggered when pings to `watch_address` fail). " + "To read current settings use `get_watchdog`. " + "Accepts `watchdog_timer` (enable HW watchdog), `watch_address` (IP to ping), " + "`ping_timeout` (e.g. `1m`), `no_ping_delay` (e.g. `5m`), " + "`automatic_supout` (generate diagnostic file on crash), " + "`auto_send_supout` (email the diagnostic). " + "Returns the updated watchdog configuration on success.",
     inputSchema: {
-      watchdog_timer: z110.boolean().optional().describe("Enable the hardware watchdog timer"),
-      watch_address: z110.string().optional().describe("Address to ping; reboot if unreachable"),
-      ping_timeout: z110.string().optional().describe("e.g. '1m'"),
-      no_ping_delay: z110.string().optional().describe("e.g. '5m'"),
-      automatic_supout: z110.boolean().optional().describe("Generate a supout.rif on software failure"),
-      auto_send_supout: z110.boolean().optional().describe("Email the generated supout.rif")
+      watchdog_timer: z111.boolean().optional().describe("Enable the hardware watchdog timer"),
+      watch_address: z111.string().optional().describe("Address to ping; reboot if unreachable"),
+      ping_timeout: z111.string().optional().describe("e.g. '1m'"),
+      no_ping_delay: z111.string().optional().describe("e.g. '5m'"),
+      automatic_supout: z111.boolean().optional().describe("Generate a supout.rif on software failure"),
+      auto_send_supout: z111.boolean().optional().describe("Email the generated supout.rif")
     },
     async handler(a, ctx) {
       ctx.info("Setting watchdog configuration");
@@ -25969,7 +26192,7 @@ ${details}`;
 ];
 
 // src/tools/system.ts
-import { z as z111 } from "zod";
+import { z as z112 } from "zod";
 var systemTools = [
   defineTool({
     name: "get_system_identity",
@@ -25990,7 +26213,7 @@ ${result}`;
     annotations: WRITE,
     description: "Set the system hostname (`/system identity set`) \u2014 the name shown in neighbor discovery, " + "Winbox title bar, and SSH prompts. " + "To read the current value use `get_system_identity`. " + "Returns the updated identity after the change.",
     inputSchema: {
-      name: z111.string().describe("New system identity / hostname")
+      name: z112.string().describe("New system identity / hostname")
     },
     async handler(a, ctx) {
       ctx.info(`Setting system identity: name=${a.name}`);
@@ -26062,10 +26285,10 @@ ${result}`;
     annotations: WRITE,
     description: "Set the system date, time, and/or time-zone (`/system clock set`). " + "Provide at least one of `time_zone_name` (e.g. `'Europe/Amsterdam'` or `'manual'`), " + "`date` (e.g. `'jun/19/2026'`), or `time` (e.g. `'13:45:00'`). " + "For automatic time synchronization configure NTP with `set_ntp_client`. " + "Returns the updated clock after the change.",
     inputSchema: {
-      time_zone_name: z111.string().optional().describe("e.g. 'Europe/Amsterdam' or 'manual'"),
-      date: z111.string().optional().describe("e.g. 'jun/19/2026'"),
-      time: z111.string().optional().describe("e.g. '13:45:00'"),
-      time_zone_autodetect: z111.boolean().optional().describe("Auto-detect the time zone from the public IP")
+      time_zone_name: z112.string().optional().describe("e.g. 'Europe/Amsterdam' or 'manual'"),
+      date: z112.string().optional().describe("e.g. 'jun/19/2026'"),
+      time: z112.string().optional().describe("e.g. '13:45:00'"),
+      time_zone_autodetect: z112.boolean().optional().describe("Auto-detect the time zone from the public IP")
     },
     async handler(a, ctx) {
       ctx.info("Setting system clock");
@@ -26100,10 +26323,10 @@ ${result}`;
     annotations: WRITE,
     description: "Configure the NTP client (`/system ntp client set`) \u2014 enable or disable it " + "and set the server list as a comma-separated string (e.g. `'0.pool.ntp.org,1.pool.ntp.org'`). " + "To read current NTP status use `get_ntp_client`; " + "to set the clock manually instead use `set_system_clock`. " + "Returns the updated NTP client configuration after the change.",
     inputSchema: {
-      enabled: z111.boolean().optional().describe("Enable or disable the NTP client"),
-      servers: z111.string().optional().describe("Comma-separated NTP server list"),
-      mode: z111.enum(["unicast", "broadcast", "multicast", "manycast"]).optional().describe("NTP client operating mode"),
-      vrf: z111.string().optional().describe("VRF the NTP client operates in (e.g. 'main')")
+      enabled: z112.boolean().optional().describe("Enable or disable the NTP client"),
+      servers: z112.string().optional().describe("Comma-separated NTP server list"),
+      mode: z112.enum(["unicast", "broadcast", "multicast", "manycast"]).optional().describe("NTP client operating mode"),
+      vrf: z112.string().optional().describe("VRF the NTP client operates in (e.g. 'main')")
     },
     async handler(a, ctx) {
       ctx.info("Setting NTP client configuration");
@@ -26162,7 +26385,7 @@ ${result}`;
     annotations: DANGEROUS,
     description: "Send a reboot command to the device (`/system reboot`). " + "This is a high-blast-radius action: all connections drop and the device is offline for " + "1-2 minutes while it restarts. " + "Must pass `confirm=true` or the command is rejected without touching the device. " + "For a permanent power-off use `shutdown_system`.",
     inputSchema: {
-      confirm: z111.boolean().describe("Must be true to actually reboot the device")
+      confirm: z112.boolean().describe("Must be true to actually reboot the device")
     },
     async handler(a, ctx) {
       if (!a.confirm)
@@ -26178,7 +26401,7 @@ ${result}`;
     annotations: DANGEROUS,
     description: "Power off the device (`/system shutdown`). " + "This is a high-blast-radius action: all connections drop and the device remains offline " + "until physically powered on again. " + "Must pass `confirm=true` or the command is rejected without touching the device. " + "For a temporary restart use `reboot_system`.",
     inputSchema: {
-      confirm: z111.boolean().describe("Must be true to actually shut down the device")
+      confirm: z112.boolean().describe("Must be true to actually shut down the device")
     },
     async handler(a, ctx) {
       if (!a.confirm)
@@ -26191,10 +26414,10 @@ ${result}`;
 ];
 
 // src/tools/tunnels.ts
-import { z as z112 } from "zod";
-var DontFragment = z112.enum(["inherit", "no"]);
-var Arp = z112.enum(["disabled", "enabled", "local-proxy-arp", "proxy-arp", "reply-only"]);
-var VtepsIpVersion = z112.enum(["ipv4", "ipv6"]);
+import { z as z113 } from "zod";
+var DontFragment = z113.enum(["inherit", "no"]);
+var Arp = z113.enum(["disabled", "enabled", "local-proxy-arp", "proxy-arp", "reply-only"]);
+var VtepsIpVersion = z113.enum(["ipv4", "ipv6"]);
 var tunnelTools = [
   defineTool({
     name: "create_gre_tunnel",
@@ -26202,18 +26425,18 @@ var tunnelTools = [
     annotations: WRITE,
     description: "Creates an IPv4 GRE (Generic Routing Encapsulation) L3 tunnel interface (`/interface gre`)." + " Use to encapsulate routed traffic between two endpoints for site-to-site connectivity when IPsec encryption is not needed." + " GRE is L3-only and not bridgeable; for bridgeable L2 Ethernet-over-IP tunnels use create_eoip_tunnel;" + " for raw IP-in-IP with less overhead use create_ipip_tunnel; for L2 VXLAN overlays use create_vxlan_tunnel;" + " for VPN client interfaces use create_l2tp_client, create_pptp_client, create_sstp_client, or create_ovpn_client." + " Keepalive format: '<interval>,<retries>', e.g. '10s,3'." + " Returns the created interface detail including name, remote-address, and run-time status.",
     inputSchema: {
-      name: z112.string().describe("Name for the new GRE tunnel interface, e.g. 'gre-to-hq'"),
-      remote_address: z112.string().describe("Remote endpoint IP address"),
-      local_address: z112.string().optional().describe("Local endpoint IP address"),
-      keepalive: z112.string().optional().describe("Keepalive interval/retries, e.g. '10s,3'"),
+      name: z113.string().describe("Name for the new GRE tunnel interface, e.g. 'gre-to-hq'"),
+      remote_address: z113.string().describe("Remote endpoint IP address"),
+      local_address: z113.string().optional().describe("Local endpoint IP address"),
+      keepalive: z113.string().optional().describe("Keepalive interval/retries, e.g. '10s,3'"),
       dont_fragment: DontFragment.optional().describe("Don't-fragment behavior"),
-      clamp_tcp_mss: z112.boolean().optional().describe("Clamp TCP MSS to the tunnel MTU"),
-      allow_fast_path: z112.boolean().optional().describe("Allow FastPath processing for this tunnel"),
-      ipsec_secret: z112.string().optional().describe("Pre-shared key to auto-create an IPsec policy securing the tunnel"),
-      dscp: z112.string().optional().describe("DSCP for encapsulated packets: 'inherit' or 0-63"),
-      mtu: z112.number().int().optional(),
-      comment: z112.string().optional(),
-      disabled: z112.boolean().default(false)
+      clamp_tcp_mss: z113.boolean().optional().describe("Clamp TCP MSS to the tunnel MTU"),
+      allow_fast_path: z113.boolean().optional().describe("Allow FastPath processing for this tunnel"),
+      ipsec_secret: z113.string().optional().describe("Pre-shared key to auto-create an IPsec policy securing the tunnel"),
+      dscp: z113.string().optional().describe("DSCP for encapsulated packets: 'inherit' or 0-63"),
+      mtu: z113.number().int().optional(),
+      comment: z113.string().optional(),
+      disabled: z113.boolean().default(false)
     },
     async handler(a, ctx) {
       ctx.info(`Creating GRE tunnel: name=${a.name}, remote_address=${a.remote_address}`);
@@ -26233,7 +26456,7 @@ ${details}` : "GRE tunnel creation completed but unable to verify.";
     annotations: READ,
     description: "Lists all GRE tunnel interfaces (`/interface gre print`)." + " Use to inventory or audit existing GRE tunnels and their remote endpoints." + " Supports optional partial name filter via name_filter." + " For full detail on one tunnel use get_gre_tunnel; for IPIP tunnels use list_ipip_tunnels;" + " for EoIP tunnels use list_eoip_tunnels; for VXLAN use list_vxlan_tunnels." + " Returns name, remote-address, local-address, MTU, and run-time status for each interface.",
     inputSchema: {
-      name_filter: z112.string().optional().describe("Partial name match")
+      name_filter: z113.string().optional().describe("Partial name match")
     },
     async handler(a, ctx) {
       ctx.info("Listing GRE tunnels");
@@ -26251,7 +26474,7 @@ ${result}`;
     title: "Get GRE Tunnel Interface Detail",
     annotations: READ,
     description: "Fetches full detail for a single GRE tunnel interface by name (`/interface gre print detail where name=...`)." + " Use to inspect all parameters of one tunnel \u2014 remote-address, local-address, keepalive, MTU, dont-fragment, and status." + " For a summary list of all GRE tunnels use list_gre_tunnels." + " For IPIP detail use get_ipip_tunnel; for EoIP detail use get_eoip_tunnel; for VXLAN detail use get_vxlan_tunnel." + " Returns the complete property set for the named interface, or a not-found message.",
-    inputSchema: { name: z112.string() },
+    inputSchema: { name: z113.string() },
     async handler(a, ctx) {
       ctx.info(`Getting GRE tunnel details: name=${a.name}`);
       const result = await executeMikrotikCommand(`/interface gre print detail where name="${a.name}"`, ctx);
@@ -26265,7 +26488,7 @@ ${result}`;
     title: "Remove GRE Tunnel Interface",
     annotations: DESTRUCTIVE,
     description: "Permanently deletes a GRE tunnel interface by name (`/interface gre remove [find name=...]`)." + " Verifies existence via count-only before removal and returns a not-found message if the interface does not exist." + " This is destructive and immediately disconnects any traffic using the tunnel." + " For IPIP removal use remove_ipip_tunnel; for EoIP use remove_eoip_tunnel; for VXLAN use remove_vxlan_tunnel.",
-    inputSchema: { name: z112.string() },
+    inputSchema: { name: z113.string() },
     async handler(a, ctx) {
       ctx.info(`Removing GRE tunnel: name=${a.name}`);
       const count = await executeMikrotikCommand(`/interface gre print count-only where name="${a.name}"`, ctx);
@@ -26283,18 +26506,18 @@ ${result}`;
     annotations: WRITE,
     description: "Creates an IPv4 IPIP (IP-in-IP) L3 tunnel interface (`/interface ipip`)." + " Use for lightweight point-to-point IP encapsulation with minimal overhead when GRE's extra header byte is undesirable." + " IPIP is L3-only and not bridgeable; for GRE encapsulation (with dont-fragment support) use create_gre_tunnel;" + " for L2 Ethernet-over-IP tunnels use create_eoip_tunnel; for VXLAN L2 overlays use create_vxlan_tunnel." + " Keepalive format: '<interval>,<retries>', e.g. '10s,3'." + " Returns the created interface detail including name, remote-address, and run-time status.",
     inputSchema: {
-      name: z112.string().describe("Name for the new IPIP tunnel interface, e.g. 'ipip-to-hq'"),
-      remote_address: z112.string().describe("Remote endpoint IP address"),
-      local_address: z112.string().optional().describe("Local endpoint IP address"),
-      keepalive: z112.string().optional().describe("Keepalive interval/retries, e.g. '10s,3'"),
+      name: z113.string().describe("Name for the new IPIP tunnel interface, e.g. 'ipip-to-hq'"),
+      remote_address: z113.string().describe("Remote endpoint IP address"),
+      local_address: z113.string().optional().describe("Local endpoint IP address"),
+      keepalive: z113.string().optional().describe("Keepalive interval/retries, e.g. '10s,3'"),
       dont_fragment: DontFragment.optional().describe("Don't-fragment behavior"),
-      clamp_tcp_mss: z112.boolean().optional().describe("Clamp TCP MSS to the tunnel MTU"),
-      allow_fast_path: z112.boolean().optional().describe("Allow FastPath processing for this tunnel"),
-      ipsec_secret: z112.string().optional().describe("Pre-shared key to auto-create an IPsec policy securing the tunnel"),
-      dscp: z112.string().optional().describe("DSCP for encapsulated packets: 'inherit' or 0-63"),
-      mtu: z112.number().int().optional(),
-      comment: z112.string().optional(),
-      disabled: z112.boolean().default(false)
+      clamp_tcp_mss: z113.boolean().optional().describe("Clamp TCP MSS to the tunnel MTU"),
+      allow_fast_path: z113.boolean().optional().describe("Allow FastPath processing for this tunnel"),
+      ipsec_secret: z113.string().optional().describe("Pre-shared key to auto-create an IPsec policy securing the tunnel"),
+      dscp: z113.string().optional().describe("DSCP for encapsulated packets: 'inherit' or 0-63"),
+      mtu: z113.number().int().optional(),
+      comment: z113.string().optional(),
+      disabled: z113.boolean().default(false)
     },
     async handler(a, ctx) {
       ctx.info(`Creating IPIP tunnel: name=${a.name}, remote_address=${a.remote_address}`);
@@ -26314,7 +26537,7 @@ ${details}` : "IPIP tunnel creation completed but unable to verify.";
     annotations: READ,
     description: "Lists all IPIP tunnel interfaces (`/interface ipip print`)." + " Use to inventory existing IPIP tunnels and their remote endpoints." + " Supports optional partial name filter via name_filter." + " For full detail on one tunnel use get_ipip_tunnel; for GRE tunnels use list_gre_tunnels;" + " for EoIP tunnels use list_eoip_tunnels; for VXLAN use list_vxlan_tunnels." + " Returns name, remote-address, local-address, MTU, and run-time status for each interface.",
     inputSchema: {
-      name_filter: z112.string().optional().describe("Partial name match")
+      name_filter: z113.string().optional().describe("Partial name match")
     },
     async handler(a, ctx) {
       ctx.info("Listing IPIP tunnels");
@@ -26332,7 +26555,7 @@ ${result}`;
     title: "Get IPIP Tunnel Interface Detail",
     annotations: READ,
     description: "Fetches full detail for a single IPIP tunnel interface by name (`/interface ipip print detail where name=...`)." + " Use to inspect all parameters of one tunnel \u2014 remote-address, local-address, keepalive, MTU, and status." + " For a summary list of all IPIP tunnels use list_ipip_tunnels." + " For GRE detail use get_gre_tunnel; for EoIP detail use get_eoip_tunnel; for VXLAN detail use get_vxlan_tunnel." + " Returns the complete property set for the named interface, or a not-found message.",
-    inputSchema: { name: z112.string() },
+    inputSchema: { name: z113.string() },
     async handler(a, ctx) {
       ctx.info(`Getting IPIP tunnel details: name=${a.name}`);
       const result = await executeMikrotikCommand(`/interface ipip print detail where name="${a.name}"`, ctx);
@@ -26346,7 +26569,7 @@ ${result}`;
     title: "Remove IPIP Tunnel Interface",
     annotations: DESTRUCTIVE,
     description: "Permanently deletes an IPIP tunnel interface by name (`/interface ipip remove [find name=...]`)." + " Verifies existence via count-only before removal and returns a not-found message if the interface does not exist." + " This is destructive and immediately disconnects any traffic using the tunnel." + " For GRE removal use remove_gre_tunnel; for EoIP use remove_eoip_tunnel; for VXLAN use remove_vxlan_tunnel.",
-    inputSchema: { name: z112.string() },
+    inputSchema: { name: z113.string() },
     async handler(a, ctx) {
       ctx.info(`Removing IPIP tunnel: name=${a.name}`);
       const count = await executeMikrotikCommand(`/interface ipip print count-only where name="${a.name}"`, ctx);
@@ -26364,22 +26587,22 @@ ${result}`;
     annotations: WRITE,
     description: "Creates an EoIP (Ethernet over IP) L2 tunnel interface (`/interface eoip`)." + " Use when you need a bridgeable L2 link between two MikroTik devices \u2014 traffic appears as raw Ethernet frames over IP." + " Each tunnel requires a unique tunnel_id (0-65535) that must match identically on both peers; mismatched IDs are the most common misconfiguration." + " EoIP is MikroTik-proprietary \u2014 both endpoints must run RouterOS." + " For L3-only encapsulation use create_gre_tunnel or create_ipip_tunnel; for open-standard L2 overlays use create_vxlan_tunnel." + " Keepalive format: '<interval>,<retries>', e.g. '10s,3'." + " Returns the created interface detail including name, remote-address, tunnel-id, and run-time status.",
     inputSchema: {
-      name: z112.string().describe("Name for the new EoIP tunnel interface, e.g. 'eoip-to-hq'"),
-      remote_address: z112.string().describe("Remote endpoint IP address"),
-      tunnel_id: z112.number().int().describe("Unique tunnel ID, must match on both peers"),
-      local_address: z112.string().optional().describe("Local endpoint IP address"),
-      keepalive: z112.string().optional().describe("Keepalive interval/retries, e.g. '10s,3'"),
+      name: z113.string().describe("Name for the new EoIP tunnel interface, e.g. 'eoip-to-hq'"),
+      remote_address: z113.string().describe("Remote endpoint IP address"),
+      tunnel_id: z113.number().int().describe("Unique tunnel ID, must match on both peers"),
+      local_address: z113.string().optional().describe("Local endpoint IP address"),
+      keepalive: z113.string().optional().describe("Keepalive interval/retries, e.g. '10s,3'"),
       dont_fragment: DontFragment.optional().describe("Don't-fragment behavior"),
-      clamp_tcp_mss: z112.boolean().optional().describe("Clamp TCP MSS to the tunnel MTU"),
-      allow_fast_path: z112.boolean().optional().describe("Allow FastPath processing for this tunnel"),
-      ipsec_secret: z112.string().optional().describe("Pre-shared key to auto-create an IPsec policy securing the tunnel"),
-      dscp: z112.string().optional().describe("DSCP for encapsulated packets: 'inherit' or 0-63"),
-      mac_address: z112.string().optional().describe("MAC address of the EoIP interface"),
+      clamp_tcp_mss: z113.boolean().optional().describe("Clamp TCP MSS to the tunnel MTU"),
+      allow_fast_path: z113.boolean().optional().describe("Allow FastPath processing for this tunnel"),
+      ipsec_secret: z113.string().optional().describe("Pre-shared key to auto-create an IPsec policy securing the tunnel"),
+      dscp: z113.string().optional().describe("DSCP for encapsulated packets: 'inherit' or 0-63"),
+      mac_address: z113.string().optional().describe("MAC address of the EoIP interface"),
       arp: Arp.optional().describe("Address Resolution Protocol mode for the interface"),
-      arp_timeout: z112.string().optional().describe("ARP entry timeout, e.g. '30s' or 'auto'"),
-      mtu: z112.number().int().optional(),
-      comment: z112.string().optional(),
-      disabled: z112.boolean().default(false)
+      arp_timeout: z113.string().optional().describe("ARP entry timeout, e.g. '30s' or 'auto'"),
+      mtu: z113.number().int().optional(),
+      comment: z113.string().optional(),
+      disabled: z113.boolean().default(false)
     },
     async handler(a, ctx) {
       ctx.info(`Creating EoIP tunnel: name=${a.name}, remote_address=${a.remote_address}, tunnel_id=${a.tunnel_id}`);
@@ -26399,7 +26622,7 @@ ${details}` : "EoIP tunnel creation completed but unable to verify.";
     annotations: READ,
     description: "Lists all EoIP tunnel interfaces (`/interface eoip print`)." + " Use to inventory existing EoIP tunnels and check their tunnel-id assignments to detect duplicates or mismatches." + " Supports optional partial name filter via name_filter." + " For full detail on one tunnel use get_eoip_tunnel; for GRE tunnels use list_gre_tunnels;" + " for IPIP tunnels use list_ipip_tunnels; for VXLAN use list_vxlan_tunnels." + " Returns name, remote-address, tunnel-id, MTU, and run-time status for each interface.",
     inputSchema: {
-      name_filter: z112.string().optional().describe("Partial name match")
+      name_filter: z113.string().optional().describe("Partial name match")
     },
     async handler(a, ctx) {
       ctx.info("Listing EoIP tunnels");
@@ -26417,7 +26640,7 @@ ${result}`;
     title: "Get EoIP Tunnel Interface Detail",
     annotations: READ,
     description: "Fetches full detail for a single EoIP tunnel interface by name (`/interface eoip print detail where name=...`)." + " Use to inspect the tunnel-id, remote-address, local-address, keepalive, MTU, and status of one tunnel." + " For a summary list of all EoIP tunnels use list_eoip_tunnels." + " For GRE detail use get_gre_tunnel; for IPIP detail use get_ipip_tunnel; for VXLAN detail use get_vxlan_tunnel." + " Returns the complete property set for the named interface, or a not-found message.",
-    inputSchema: { name: z112.string() },
+    inputSchema: { name: z113.string() },
     async handler(a, ctx) {
       ctx.info(`Getting EoIP tunnel details: name=${a.name}`);
       const result = await executeMikrotikCommand(`/interface eoip print detail where name="${a.name}"`, ctx);
@@ -26431,7 +26654,7 @@ ${result}`;
     title: "Remove EoIP Tunnel Interface",
     annotations: DESTRUCTIVE,
     description: "Permanently deletes an EoIP tunnel interface by name (`/interface eoip remove [find name=...]`)." + " Verifies existence via count-only before removal and returns a not-found message if the interface does not exist." + " This is destructive and immediately severs the L2 bridge link using this tunnel." + " For GRE removal use remove_gre_tunnel; for IPIP use remove_ipip_tunnel; for VXLAN use remove_vxlan_tunnel.",
-    inputSchema: { name: z112.string() },
+    inputSchema: { name: z113.string() },
     async handler(a, ctx) {
       ctx.info(`Removing EoIP tunnel: name=${a.name}`);
       const count = await executeMikrotikCommand(`/interface eoip print count-only where name="${a.name}"`, ctx);
@@ -26449,21 +26672,21 @@ ${result}`;
     annotations: WRITE,
     description: "Creates a VXLAN (Virtual Extensible LAN) L2 overlay interface (`/interface vxlan`)." + " Use to build scalable L2 overlays across L3 networks \u2014 the VNI (VXLAN Network Identifier) scopes the broadcast domain, suited for multi-tenant or data-centre scenarios." + " VXLAN is an open standard and works with non-MikroTik peers; for MikroTik-proprietary L2 tunnels use create_eoip_tunnel;" + " for L3-only encapsulation use create_gre_tunnel or create_ipip_tunnel." + " UDP port defaults to 8472; VNI must match on all participating VTEPs." + " Returns the created interface detail including name, VNI, port, and run-time status.",
     inputSchema: {
-      name: z112.string().describe("Name for the new VXLAN interface, e.g. 'vxlan1'"),
-      vni: z112.number().int().describe("VXLAN Network Identifier (VNI)"),
-      port: z112.number().int().default(8472).describe("UDP port (default 8472)"),
-      local_address: z112.string().optional().describe("Local source IP address"),
-      interface: z112.string().optional().describe("Source interface"),
-      group: z112.string().optional().describe("Multicast group address for broadcast/unknown-unicast flooding"),
+      name: z113.string().describe("Name for the new VXLAN interface, e.g. 'vxlan1'"),
+      vni: z113.number().int().describe("VXLAN Network Identifier (VNI)"),
+      port: z113.number().int().default(8472).describe("UDP port (default 8472)"),
+      local_address: z113.string().optional().describe("Local source IP address"),
+      interface: z113.string().optional().describe("Source interface"),
+      group: z113.string().optional().describe("Multicast group address for broadcast/unknown-unicast flooding"),
       vteps_ip_version: VtepsIpVersion.optional().describe("IP version used for VTEP addressing"),
-      mac_address: z112.string().optional().describe("MAC address of the VXLAN interface"),
+      mac_address: z113.string().optional().describe("MAC address of the VXLAN interface"),
       arp: Arp.optional().describe("Address Resolution Protocol mode for the interface"),
-      arp_timeout: z112.string().optional().describe("ARP entry timeout, e.g. '30s' or 'auto'"),
-      max_fdb_size: z112.number().int().optional().describe("Maximum forwarding database (FDB) size"),
-      allow_fast_path: z112.boolean().optional().describe("Allow FastPath processing for this interface"),
-      mtu: z112.number().int().optional(),
-      comment: z112.string().optional(),
-      disabled: z112.boolean().default(false)
+      arp_timeout: z113.string().optional().describe("ARP entry timeout, e.g. '30s' or 'auto'"),
+      max_fdb_size: z113.number().int().optional().describe("Maximum forwarding database (FDB) size"),
+      allow_fast_path: z113.boolean().optional().describe("Allow FastPath processing for this interface"),
+      mtu: z113.number().int().optional(),
+      comment: z113.string().optional(),
+      disabled: z113.boolean().default(false)
     },
     async handler(a, ctx) {
       ctx.info(`Creating VXLAN tunnel: name=${a.name}, vni=${a.vni}`);
@@ -26483,7 +26706,7 @@ ${details}` : "VXLAN tunnel creation completed but unable to verify.";
     annotations: READ,
     description: "Lists all VXLAN interfaces (`/interface vxlan print`)." + " Use to inventory existing VXLAN overlays and check their VNI and UDP port assignments." + " Supports optional partial name filter via name_filter." + " For full detail on one interface use get_vxlan_tunnel; for EoIP tunnels use list_eoip_tunnels;" + " for GRE tunnels use list_gre_tunnels; for IPIP tunnels use list_ipip_tunnels." + " Returns name, VNI, port, local-address, MTU, and run-time status for each interface.",
     inputSchema: {
-      name_filter: z112.string().optional().describe("Partial name match")
+      name_filter: z113.string().optional().describe("Partial name match")
     },
     async handler(a, ctx) {
       ctx.info("Listing VXLAN tunnels");
@@ -26501,7 +26724,7 @@ ${result}`;
     title: "Get VXLAN Tunnel Interface Detail",
     annotations: READ,
     description: "Fetches full detail for a single VXLAN interface by name (`/interface vxlan print detail where name=...`)." + " Use to inspect the VNI, UDP port, local-address, source interface, MTU, and status of one VXLAN interface." + " For a summary list of all VXLAN interfaces use list_vxlan_tunnels." + " For EoIP detail use get_eoip_tunnel; for GRE detail use get_gre_tunnel; for IPIP detail use get_ipip_tunnel." + " Returns the complete property set for the named interface, or a not-found message.",
-    inputSchema: { name: z112.string() },
+    inputSchema: { name: z113.string() },
     async handler(a, ctx) {
       ctx.info(`Getting VXLAN tunnel details: name=${a.name}`);
       const result = await executeMikrotikCommand(`/interface vxlan print detail where name="${a.name}"`, ctx);
@@ -26515,7 +26738,7 @@ ${result}`;
     title: "Remove VXLAN Tunnel Interface",
     annotations: DESTRUCTIVE,
     description: "Permanently deletes a VXLAN interface by name (`/interface vxlan remove [find name=...]`)." + " Verifies existence via count-only before removal and returns a not-found message if the interface does not exist." + " This is destructive and immediately severs all L2 overlay traffic using this VNI endpoint." + " For EoIP removal use remove_eoip_tunnel; for GRE use remove_gre_tunnel; for IPIP use remove_ipip_tunnel.",
-    inputSchema: { name: z112.string() },
+    inputSchema: { name: z113.string() },
     async handler(a, ctx) {
       ctx.info(`Removing VXLAN tunnel: name=${a.name}`);
       const count = await executeMikrotikCommand(`/interface vxlan print count-only where name="${a.name}"`, ctx);
@@ -26530,7 +26753,7 @@ ${result}`;
 ];
 
 // src/tools/user-manager.ts
-import { z as z113 } from "zod";
+import { z as z114 } from "zod";
 var NOT_AVAILABLE3 = "User Manager is not available on this device (package not installed).";
 var userManagerTools = [
   defineTool({
@@ -26554,12 +26777,12 @@ ${result}`;
     annotations: WRITE_IDEMPOTENT,
     description: "Updates the global User Manager daemon configuration (`/user-manager set`) \u2014 toggle the" + " built-in RADIUS server on/off (`enabled`), set the TLS certificate, or enable the" + " profile/payment subsystem (`use_profiles`). Applies changes idempotently to the single" + " global settings entry; returns the full updated settings after applying. For per-user" + " changes use update_user_manager_user; for profile creation use add_user_manager_profile.",
     inputSchema: {
-      enabled: z113.boolean().optional().describe("Enable or disable the User Manager server"),
-      certificate: z113.string().optional().describe("TLS certificate name for RADIUS over TLS"),
-      radsec_certificate: z113.string().optional().describe("Certificate name for RadSec (RADIUS over TLS)"),
-      accounting_port: z113.number().int().optional().describe("UDP port for RADIUS accounting"),
-      authentication_port: z113.number().int().optional().describe("UDP port for RADIUS authentication"),
-      use_profiles: z113.boolean().optional().describe("Enable the profile/payment subsystem")
+      enabled: z114.boolean().optional().describe("Enable or disable the User Manager server"),
+      certificate: z114.string().optional().describe("TLS certificate name for RADIUS over TLS"),
+      radsec_certificate: z114.string().optional().describe("Certificate name for RadSec (RADIUS over TLS)"),
+      accounting_port: z114.number().int().optional().describe("UDP port for RADIUS accounting"),
+      authentication_port: z114.number().int().optional().describe("UDP port for RADIUS authentication"),
+      use_profiles: z114.boolean().optional().describe("Enable the profile/payment subsystem")
     },
     async handler(a, ctx) {
       ctx.info("Updating User Manager settings");
@@ -26583,15 +26806,15 @@ ${details}`;
     annotations: WRITE,
     description: "Creates a new user in the User Manager RADIUS database (`/user-manager user add`) \u2014 for" + " hotspot, PPP, or 802.1X authentication managed by the built-in RADIUS server. Not for" + " local router login accounts; for those use add_user. Supply `name` and `password`;" + " optionally set `group`, `shared_users` (max simultaneous sessions), and custom RADIUS" + " `attributes`. Returns the created user's detail with secrets redacted.",
     inputSchema: {
-      name: z113.string().describe("Login name for the user"),
-      password: z113.string().describe("Login password for the user"),
-      group: z113.string().optional(),
-      shared_users: z113.number().int().optional().describe("Max simultaneous sessions"),
-      attributes: z113.string().optional().describe("Custom RADIUS attributes"),
-      caller_id: z113.string().optional().describe("Caller ID the user is restricted to (e.g. MAC)"),
-      otp_secret: z113.string().optional().describe("Base32 OTP shared secret for two-factor auth"),
-      comment: z113.string().optional(),
-      disabled: z113.boolean().default(false)
+      name: z114.string().describe("Login name for the user"),
+      password: z114.string().describe("Login password for the user"),
+      group: z114.string().optional(),
+      shared_users: z114.number().int().optional().describe("Max simultaneous sessions"),
+      attributes: z114.string().optional().describe("Custom RADIUS attributes"),
+      caller_id: z114.string().optional().describe("Caller ID the user is restricted to (e.g. MAC)"),
+      otp_secret: z114.string().optional().describe("Base32 OTP shared secret for two-factor auth"),
+      comment: z114.string().optional(),
+      disabled: z114.boolean().default(false)
     },
     async handler(a, ctx) {
       ctx.info(`Adding User Manager user: name=${a.name}`);
@@ -26613,7 +26836,7 @@ ${redactSecrets(details)}` : "User Manager user creation completed but unable to
     annotations: READ,
     description: "Returns all users in the User Manager RADIUS database (`/user-manager user print`) \u2014 the" + " accounts that authenticate against the built-in RADIUS server for hotspot, PPP, or 802.1X." + " Optionally filter by partial `name_filter`. Not for local router login accounts; for those" + " use list_users. Returns user list with secrets redacted; for full" + " single-user detail use get_user_manager_user.",
     inputSchema: {
-      name_filter: z113.string().optional().describe("Partial name match")
+      name_filter: z114.string().optional().describe("Partial name match")
     },
     async handler(a, ctx) {
       ctx.info("Listing User Manager users");
@@ -26633,7 +26856,7 @@ ${redactSecrets(result)}`;
     title: "Get User Manager RADIUS User Detail",
     annotations: READ,
     description: "Returns full detail for a single User Manager RADIUS user" + " (`/user-manager user print detail where name=`) \u2014 all fields including group," + " shared-users limit, RADIUS attributes, and status, with secrets redacted. Use when you" + " need the complete record for one user by exact name. To browse all users use" + " list_user_manager_users; to modify the record use update_user_manager_user.",
-    inputSchema: { name: z113.string() },
+    inputSchema: { name: z114.string() },
     async handler(a, ctx) {
       ctx.info(`Getting User Manager user details: name=${a.name}`);
       const result = await executeMikrotikCommand(`/user-manager user print detail where name="${a.name}"`, ctx);
@@ -26650,16 +26873,16 @@ ${redactSecrets(result)}`;
     annotations: WRITE_IDEMPOTENT,
     description: "Modifies an existing User Manager RADIUS user (`/user-manager user set [find name=...]`)" + " \u2014 change name, password, group, shared-users limit, RADIUS attributes, comment, or" + " enabled/disabled state. Locate the user by its current `name` (from" + " list_user_manager_users or get_user_manager_user). Returns the updated record with" + " secrets redacted. To permanently delete the user use remove_user_manager_user.",
     inputSchema: {
-      name: z113.string().describe("Current name of the user to update"),
-      new_name: z113.string().optional(),
-      password: z113.string().optional(),
-      group: z113.string().optional(),
-      shared_users: z113.number().int().optional(),
-      attributes: z113.string().optional(),
-      caller_id: z113.string().optional().describe("Caller ID the user is restricted to (e.g. MAC)"),
-      otp_secret: z113.string().optional().describe("Base32 OTP shared secret for two-factor auth"),
-      comment: z113.string().optional(),
-      disabled: z113.boolean().optional()
+      name: z114.string().describe("Current name of the user to update"),
+      new_name: z114.string().optional(),
+      password: z114.string().optional(),
+      group: z114.string().optional(),
+      shared_users: z114.number().int().optional(),
+      attributes: z114.string().optional(),
+      caller_id: z114.string().optional().describe("Caller ID the user is restricted to (e.g. MAC)"),
+      otp_secret: z114.string().optional().describe("Base32 OTP shared secret for two-factor auth"),
+      comment: z114.string().optional(),
+      disabled: z114.boolean().optional()
     },
     async handler(a, ctx) {
       ctx.info(`Updating User Manager user: name=${a.name}`);
@@ -26683,7 +26906,7 @@ ${redactSecrets(details)}`;
     title: "Remove User Manager RADIUS User",
     annotations: DESTRUCTIVE,
     description: "Permanently deletes a User Manager RADIUS user (`/user-manager user remove [find name=...]`)" + " \u2014 verifies the user exists via count-only check first, then removes them. Does NOT" + " automatically remove the user's profile assignments; check list_user_manager_user_profiles" + " first. To disable without deleting use update_user_manager_user with `disabled=true`.",
-    inputSchema: { name: z113.string() },
+    inputSchema: { name: z114.string() },
     async handler(a, ctx) {
       ctx.info(`Removing User Manager user: name=${a.name}`);
       const count = await executeMikrotikCommand(`/user-manager user print count-only where name="${a.name}"`, ctx);
@@ -26703,13 +26926,13 @@ ${redactSecrets(details)}`;
     annotations: WRITE,
     description: "Creates a new User Manager service/billing profile (`/user-manager profile add`) \u2014 a named" + " plan template that defines validity period (e.g. '30d'), price, and session override" + " limits (`starts_when`, `override_shared_users`) that can be assigned to users. Profiles are" + " templates only; to link a profile to a specific user use assign_user_manager_profile. For" + " rate/quota constraints attach a limitation (add_user_manager_limitation). Returns the" + " created profile's detail.",
     inputSchema: {
-      name: z113.string().describe("Profile name"),
-      name_for_users: z113.string().optional().describe("Display name shown to users"),
-      validity: z113.string().optional().describe("Validity period, e.g. '30d'"),
-      price: z113.number().optional(),
-      starts_when: z113.enum(["assigned", "first-auth"]).optional(),
-      override_shared_users: z113.string().optional(),
-      comment: z113.string().optional()
+      name: z114.string().describe("Profile name"),
+      name_for_users: z114.string().optional().describe("Display name shown to users"),
+      validity: z114.string().optional().describe("Validity period, e.g. '30d'"),
+      price: z114.number().optional(),
+      starts_when: z114.enum(["assigned", "first-auth"]).optional(),
+      override_shared_users: z114.string().optional(),
+      comment: z114.string().optional()
     },
     async handler(a, ctx) {
       ctx.info(`Adding User Manager profile: name=${a.name}`);
@@ -26731,7 +26954,7 @@ ${details}` : "User Manager profile creation completed but unable to verify.";
     annotations: READ,
     description: "Returns all User Manager service/billing profile templates (`/user-manager profile print`)" + " \u2014 the named plans defining validity, price, and session limits. Optionally filter by" + " partial `name_filter`. Not the same as user-profile assignments; to see which profiles" + " are linked to which users use list_user_manager_user_profiles. Returns profile list.",
     inputSchema: {
-      name_filter: z113.string().optional().describe("Partial name match")
+      name_filter: z114.string().optional().describe("Partial name match")
     },
     async handler(a, ctx) {
       ctx.info("Listing User Manager profiles");
@@ -26751,7 +26974,7 @@ ${result}`;
     title: "Remove User Manager Service Profile",
     annotations: DESTRUCTIVE,
     description: "Permanently deletes a User Manager service/billing profile" + " (`/user-manager profile remove [find name=...]`) \u2014 verifies existence via count-only check" + " first, then removes the plan template. Does NOT automatically remove existing user-profile" + " assignments that reference this profile; check list_user_manager_user_profiles before" + " removing to avoid orphaned assignments. For creating a profile use add_user_manager_profile.",
-    inputSchema: { name: z113.string() },
+    inputSchema: { name: z114.string() },
     async handler(a, ctx) {
       ctx.info(`Removing User Manager profile: name=${a.name}`);
       const count = await executeMikrotikCommand(`/user-manager profile print count-only where name="${a.name}"`, ctx);
@@ -26771,8 +26994,8 @@ ${result}`;
     annotations: WRITE,
     description: "Creates a user-profile assignment in User Manager (`/user-manager user-profile add`) \u2014" + " links an existing service profile plan to a specific user so the user inherits the plan's" + " limits (rate, transfer, validity). Both `user` and `profile` must already exist; to create" + " a user use add_user_manager_user; to create a profile use add_user_manager_profile. To view" + " existing assignments use list_user_manager_user_profiles.",
     inputSchema: {
-      user: z113.string().describe("User to assign the profile to"),
-      profile: z113.string().describe("Profile to assign")
+      user: z114.string().describe("User to assign the profile to"),
+      profile: z114.string().describe("Profile to assign")
     },
     async handler(a, ctx) {
       ctx.info(`Assigning profile '${a.profile}' to user '${a.user}'`);
@@ -26793,7 +27016,7 @@ ${result}`;
     annotations: READ,
     description: "Returns all User Manager user-to-profile assignment records" + " (`/user-manager user-profile print`) \u2014 shows which service profile plan is linked to each" + " user. Optionally filter by partial `user_filter`. Not the same as listing profile" + " definitions; for the plan templates themselves use list_user_manager_profiles. To create an" + " assignment use assign_user_manager_profile.",
     inputSchema: {
-      user_filter: z113.string().optional().describe("Partial user match")
+      user_filter: z114.string().optional().describe("Partial user match")
     },
     async handler(a, ctx) {
       ctx.info("Listing User Manager user-profiles");
@@ -26814,13 +27037,13 @@ ${result}`;
     annotations: WRITE,
     description: "Registers a new RADIUS client (router or NAS device) in User Manager" + " (`/user-manager router add`) \u2014 the network device that forwards authentication requests to" + " this built-in RADIUS server. Requires a friendly `name`, the client's IP `address`, and a" + " `shared_secret`; optionally set the CoA port. Not related to IP routing; for routing table" + " entries use add_route. Returns the created entry with secrets redacted.",
     inputSchema: {
-      name: z113.string().describe("Friendly name for the RADIUS client"),
-      address: z113.string().describe("IP address of the RADIUS client"),
-      shared_secret: z113.string().describe("Shared secret for the RADIUS client"),
-      coa_port: z113.number().int().optional().describe("Change-of-Authorization port"),
-      protocol: z113.string().optional().describe("RADIUS transport protocol for this client (e.g. radius, radsec)"),
-      comment: z113.string().optional(),
-      disabled: z113.boolean().default(false)
+      name: z114.string().describe("Friendly name for the RADIUS client"),
+      address: z114.string().describe("IP address of the RADIUS client"),
+      shared_secret: z114.string().describe("Shared secret for the RADIUS client"),
+      coa_port: z114.number().int().optional().describe("Change-of-Authorization port"),
+      protocol: z114.string().optional().describe("RADIUS transport protocol for this client (e.g. radius, radsec)"),
+      comment: z114.string().optional(),
+      disabled: z114.boolean().default(false)
     },
     async handler(a, ctx) {
       ctx.info(`Adding User Manager router: name=${a.name}, address=${a.address}`);
@@ -26842,7 +27065,7 @@ ${redactSecrets(details)}` : "User Manager router creation completed but unable
     annotations: READ,
     description: "Returns all RADIUS clients (routers/NAS devices) registered in User Manager" + " (`/user-manager router print`) \u2014 the devices authorized to forward authentication requests" + " to this built-in RADIUS server. Optionally filter by partial `name_filter`. Not related to" + " IP routing; for routing table entries use list_routes. Returns entries with secrets redacted.",
     inputSchema: {
-      name_filter: z113.string().optional().describe("Partial name match")
+      name_filter: z114.string().optional().describe("Partial name match")
     },
     async handler(a, ctx) {
       ctx.info("Listing User Manager routers");
@@ -26862,7 +27085,7 @@ ${redactSecrets(result)}`;
     title: "Remove User Manager RADIUS Client (Router/NAS)",
     annotations: DESTRUCTIVE,
     description: "Permanently removes a RADIUS client (router/NAS) from User Manager" + " (`/user-manager router remove [find name=...]`) \u2014 verifies existence via count-only check" + " first, then deletes the entry. The device will no longer be able to forward authentication" + " requests to this RADIUS server after removal. Not related to IP routing; for routing table" + " management use remove_route.",
-    inputSchema: { name: z113.string() },
+    inputSchema: { name: z114.string() },
     async handler(a, ctx) {
       ctx.info(`Removing User Manager router: name=${a.name}`);
       const count = await executeMikrotikCommand(`/user-manager router print count-only where name="${a.name}"`, ctx);
@@ -26882,25 +27105,25 @@ ${redactSecrets(result)}`;
     annotations: WRITE,
     description: "Creates a new User Manager limitation template (`/user-manager limitation add`) \u2014 a reusable" + " named set of rate and quota constraints: download rate (`rate_limit_rx`, e.g. '10M')," + " upload rate (`rate_limit_tx`), total transfer cap (`transfer_limit`, e.g. '10G'), and" + " uptime cap (`uptime_limit`, e.g. '1d'). Limitations are templates attached to profiles, not" + " users directly; for service plan templates use add_user_manager_profile. Returns the created" + " limitation's detail.",
     inputSchema: {
-      name: z113.string().describe("Limitation name"),
-      rate_limit_rx: z113.string().optional().describe("Download rate limit, e.g. '10M'"),
-      rate_limit_tx: z113.string().optional().describe("Upload rate limit, e.g. '10M'"),
-      rate_limit_min_rx: z113.string().optional().describe("Guaranteed (CIR) download rate, e.g. '2M'"),
-      rate_limit_min_tx: z113.string().optional().describe("Guaranteed (CIR) upload rate, e.g. '2M'"),
-      rate_limit_burst_rx: z113.string().optional().describe("Download burst rate, e.g. '20M'"),
-      rate_limit_burst_tx: z113.string().optional().describe("Upload burst rate, e.g. '20M'"),
-      rate_limit_burst_threshold_rx: z113.string().optional().describe("Download burst threshold rate"),
-      rate_limit_burst_threshold_tx: z113.string().optional().describe("Upload burst threshold rate"),
-      rate_limit_burst_time_rx: z113.string().optional().describe("Download burst time, e.g. '10s'"),
-      rate_limit_burst_time_tx: z113.string().optional().describe("Upload burst time, e.g. '10s'"),
-      rate_limit_priority: z113.number().int().optional().describe("Queue priority (1-8)"),
-      download_limit: z113.string().optional().describe("Download transfer cap in bytes, e.g. '5G'"),
-      upload_limit: z113.string().optional().describe("Upload transfer cap in bytes, e.g. '5G'"),
-      transfer_limit: z113.string().optional().describe("Total transfer cap, e.g. '10G'"),
-      uptime_limit: z113.string().optional().describe("Uptime cap, e.g. '1d'"),
-      reset_counters_interval: z113.string().optional().describe("Interval to auto-reset usage counters"),
-      reset_counters_start_time: z113.string().optional().describe("Start time for counter reset interval"),
-      comment: z113.string().optional()
+      name: z114.string().describe("Limitation name"),
+      rate_limit_rx: z114.string().optional().describe("Download rate limit, e.g. '10M'"),
+      rate_limit_tx: z114.string().optional().describe("Upload rate limit, e.g. '10M'"),
+      rate_limit_min_rx: z114.string().optional().describe("Guaranteed (CIR) download rate, e.g. '2M'"),
+      rate_limit_min_tx: z114.string().optional().describe("Guaranteed (CIR) upload rate, e.g. '2M'"),
+      rate_limit_burst_rx: z114.string().optional().describe("Download burst rate, e.g. '20M'"),
+      rate_limit_burst_tx: z114.string().optional().describe("Upload burst rate, e.g. '20M'"),
+      rate_limit_burst_threshold_rx: z114.string().optional().describe("Download burst threshold rate"),
+      rate_limit_burst_threshold_tx: z114.string().optional().describe("Upload burst threshold rate"),
+      rate_limit_burst_time_rx: z114.string().optional().describe("Download burst time, e.g. '10s'"),
+      rate_limit_burst_time_tx: z114.string().optional().describe("Upload burst time, e.g. '10s'"),
+      rate_limit_priority: z114.number().int().optional().describe("Queue priority (1-8)"),
+      download_limit: z114.string().optional().describe("Download transfer cap in bytes, e.g. '5G'"),
+      upload_limit: z114.string().optional().describe("Upload transfer cap in bytes, e.g. '5G'"),
+      transfer_limit: z114.string().optional().describe("Total transfer cap, e.g. '10G'"),
+      uptime_limit: z114.string().optional().describe("Uptime cap, e.g. '1d'"),
+      reset_counters_interval: z114.string().optional().describe("Interval to auto-reset usage counters"),
+      reset_counters_start_time: z114.string().optional().describe("Start time for counter reset interval"),
+      comment: z114.string().optional()
     },
     async handler(a, ctx) {
       ctx.info(`Adding User Manager limitation: name=${a.name}`);
@@ -26922,7 +27145,7 @@ ${details}` : "User Manager limitation creation completed but unable to verify."
     annotations: READ,
     description: "Returns all User Manager limitation templates (`/user-manager limitation print`) \u2014 the named" + " rate/quota constraint definitions (rate-limit-rx/tx, transfer-limit, uptime-limit) that can" + " be attached to service profiles. Optionally filter by partial `name_filter`. Limitations are" + " distinct from profile plan templates; for those use list_user_manager_profiles.",
     inputSchema: {
-      name_filter: z113.string().optional().describe("Partial name match")
+      name_filter: z114.string().optional().describe("Partial name match")
     },
     async handler(a, ctx) {
       ctx.info("Listing User Manager limitations");
@@ -26942,7 +27165,7 @@ ${result}`;
     title: "Remove User Manager Limitation Template",
     annotations: DESTRUCTIVE,
     description: "Permanently deletes a User Manager limitation template" + " (`/user-manager limitation remove [find name=...]`) \u2014 verifies existence via count-only" + " check first, then removes the constraint definition. Does NOT check whether the limitation" + " is still referenced by any profiles; verify with list_user_manager_profiles before removing" + " to avoid orphaned references. For listing limitations use list_user_manager_limitations.",
-    inputSchema: { name: z113.string() },
+    inputSchema: { name: z114.string() },
     async handler(a, ctx) {
       ctx.info(`Removing User Manager limitation: name=${a.name}`);
       const count = await executeMikrotikCommand(`/user-manager limitation print count-only where name="${a.name}"`, ctx);
@@ -26962,8 +27185,8 @@ ${result}`;
     annotations: READ,
     description: "Returns User Manager RADIUS accounting session records (`/user-manager session print`) \u2014 the" + " log of authentication and accounting events for users connecting through registered RADIUS" + " clients. Optionally filter by partial `user_filter` or restrict to currently active sessions" + " with `active_only=true`. Returns session data including bytes transferred, uptime, and" + " status. For the user accounts themselves use list_user_manager_users; for registered RADIUS" + " clients use list_user_manager_routers.",
     inputSchema: {
-      user_filter: z113.string().optional().describe("Partial user match"),
-      active_only: z113.boolean().default(false).describe("Only show currently active sessions")
+      user_filter: z114.string().optional().describe("Partial user match"),
+      active_only: z114.boolean().default(false).describe("Only show currently active sessions")
     },
     async handler(a, ctx) {
       ctx.info("Listing User Manager sessions");
@@ -26983,7 +27206,7 @@ ${result}`;
 ];
 
 // src/tools/users.ts
-import { z as z114 } from "zod";
+import { z as z115 } from "zod";
 var VALID_POLICIES = [
   "local",
   "telnet",
@@ -27040,12 +27263,12 @@ var userTools = [
     annotations: WRITE,
     description: "Create a local user account (`/user add`) \u2014 grants interactive access to the router via SSH, Winbox, web, telnet, or API. " + "The `group` parameter (default: `read`) sets permissions; built-in groups are `read`, `write`, `full`; use `add_user_group` to create custom groups. " + "Use `address` to restrict login to a specific IP/subnet. For PPP/dial-in credentials use `create_ppp_secret` instead. " + "Returns the created account's full detail including its `.id`.",
     inputSchema: {
-      name: z114.string(),
-      password: z114.string(),
-      group: z114.string().default("read"),
-      address: z114.string().optional(),
-      comment: z114.string().optional(),
-      disabled: z114.boolean().default(false)
+      name: z115.string(),
+      password: z115.string(),
+      group: z115.string().default("read"),
+      address: z115.string().optional(),
+      comment: z115.string().optional(),
+      disabled: z115.boolean().default(false)
     },
     async handler(a, ctx) {
       ctx.info(`Adding user: name=${a.name}, group=${a.group}`);
@@ -27077,10 +27300,10 @@ ${redactSecrets(details)}`;
     annotations: READ,
     description: "List local router user accounts (`/user print`) \u2014 shows each account's group, address restriction, and enabled/disabled state. " + "Supports optional filters: `name_filter` (name substring match), `group_filter` (exact group name), `disabled_only`. " + "Note: `active_only` is accepted by the schema but is not applied as a filter \u2014 it has no effect on the output. " + "Passwords are redacted from output. For currently logged-in sessions use `get_active_users`. For PPP dial-in secrets use `create_ppp_secret`.",
     inputSchema: {
-      name_filter: z114.string().optional(),
-      group_filter: z114.string().optional(),
-      disabled_only: z114.boolean().default(false),
-      active_only: z114.boolean().default(false)
+      name_filter: z115.string().optional(),
+      group_filter: z115.string().optional(),
+      disabled_only: z115.boolean().default(false),
+      active_only: z115.boolean().default(false)
     },
     async handler(a, ctx) {
       ctx.info(`Listing users with filters: name=${a.name_filter}, group=${a.group_filter}`);
@@ -27104,7 +27327,7 @@ ${redactSecrets(result)}`;
     title: "Get Local User Account Details",
     annotations: READ,
     description: "Fetch full detail for a single local user account (`/user print detail where name=...`). " + "Identified by login `name`. Passwords are redacted from output. " + "For all accounts use `list_users`; for currently active sessions use `get_active_users`.",
-    inputSchema: { name: z114.string() },
+    inputSchema: { name: z115.string() },
     async handler(a, ctx) {
       ctx.info(`Getting user details: name=${a.name}`);
       const result = await executeMikrotikCommand(`/user print detail where name="${a.name}"`, ctx);
@@ -27121,13 +27344,13 @@ ${redactSecrets(result)}`;
     annotations: WRITE_IDEMPOTENT,
     description: "Modify a local user account (`/user set [find name=...]`). " + "Can change login name (`new_name`), `password`, `group`, allowed source `address` (pass empty string to remove address restriction), `comment`, or `disabled` state. " + "For toggling enabled/disabled state only, prefer `enable_user` or `disable_user`. " + "Returns the updated user detail with passwords redacted.",
     inputSchema: {
-      name: z114.string(),
-      new_name: z114.string().optional(),
-      password: z114.string().optional(),
-      group: z114.string().optional(),
-      address: z114.string().optional(),
-      comment: z114.string().optional(),
-      disabled: z114.boolean().optional()
+      name: z115.string(),
+      new_name: z115.string().optional(),
+      password: z115.string().optional(),
+      group: z115.string().optional(),
+      address: z115.string().optional(),
+      comment: z115.string().optional(),
+      disabled: z115.boolean().optional()
     },
     async handler(a, ctx) {
       return runUpdateUser(a, ctx);
@@ -27138,7 +27361,7 @@ ${redactSecrets(result)}`;
     title: "Remove Local User Account",
     annotations: DESTRUCTIVE,
     description: "Permanently delete a local user account (`/user remove [find name=...]`). " + "Refuses to remove the built-in `admin` account. Verifies the user exists before removing. " + "To temporarily block access without deleting use `disable_user`. To end a live session without deleting the account use `disconnect_user`.",
-    inputSchema: { name: z114.string() },
+    inputSchema: { name: z115.string() },
     async handler(a, ctx) {
       ctx.info(`Removing user: name=${a.name}`);
       if (a.name.toLowerCase() === "admin")
@@ -27157,7 +27380,7 @@ ${redactSecrets(result)}`;
     title: "Disable Local User Account",
     annotations: WRITE_IDEMPOTENT,
     description: "Disable a local user account (`/user set [find name=...] disabled=yes`), preventing new logins without deleting the account. " + "To re-enable use `enable_user`. For a full attribute update use `update_user`. To permanently delete the account use `remove_user`.",
-    inputSchema: { name: z114.string() },
+    inputSchema: { name: z115.string() },
     async handler(a, ctx) {
       return runUpdateUser({ name: a.name, disabled: true }, ctx);
     }
@@ -27167,7 +27390,7 @@ ${redactSecrets(result)}`;
     title: "Enable Local User Account",
     annotations: WRITE_IDEMPOTENT,
     description: "Re-enable a previously disabled local user account (`/user set [find name=...] disabled=no`). " + "To disable use `disable_user`. For a full attribute update use `update_user`.",
-    inputSchema: { name: z114.string() },
+    inputSchema: { name: z115.string() },
     async handler(a, ctx) {
       return runUpdateUser({ name: a.name, disabled: false }, ctx);
     }
@@ -27178,10 +27401,10 @@ ${redactSecrets(result)}`;
     annotations: WRITE,
     description: "Create a custom user group (`/user group add`) that defines a named permission policy for router access. " + "`policy` is a list of permissions to grant from: local, telnet, ssh, ftp, reboot, read, write, policy, test, winbox, password, web, sniff, sensitive, api, romon, dude, tikapp, rest-api. " + "The built-in groups (`read`, `write`, `full`) already exist on the device; this tool does not guard against those names \u2014 attempting to create a group with a duplicate name will be rejected by the device. Assign users to the new group via `add_user` or `update_user`. " + "Returns the created group's full detail.",
     inputSchema: {
-      name: z114.string(),
-      policy: z114.array(z114.string()),
-      skin: z114.string().optional(),
-      comment: z114.string().optional()
+      name: z115.string(),
+      policy: z115.array(z115.string()),
+      skin: z115.string().optional(),
+      comment: z115.string().optional()
     },
     async handler(a, ctx) {
       ctx.info(`Adding user group: name=${a.name}`);
@@ -27218,8 +27441,8 @@ ${details}`;
     annotations: READ,
     description: "List all user groups (`/user group print`), including built-in groups (`read`, `write`, `full`) and custom ones, showing their policy sets. " + "Supports optional filters: `name_filter` (name substring), `policy_filter` (policy substring). " + "To see individual user accounts use `list_users`; to see which users belong to a specific group use `list_users` with `group_filter`.",
     inputSchema: {
-      name_filter: z114.string().optional(),
-      policy_filter: z114.string().optional()
+      name_filter: z115.string().optional(),
+      policy_filter: z115.string().optional()
     },
     async handler(a, ctx) {
       ctx.info(`Listing user groups with filters: name=${a.name_filter}`);
@@ -27241,7 +27464,7 @@ ${result}`;
     title: "Get User Group Details",
     annotations: READ,
     description: "Fetch full detail for a single user group (`/user group print detail where name=...`), showing its complete policy list and skin setting. " + "For all groups use `list_user_groups`. To see which users belong to this group use `list_users` with `group_filter`.",
-    inputSchema: { name: z114.string() },
+    inputSchema: { name: z115.string() },
     async handler(a, ctx) {
       ctx.info(`Getting user group details: name=${a.name}`);
       const result = await executeMikrotikCommand(`/user group print detail where name="${a.name}"`, ctx);
@@ -27258,11 +27481,11 @@ ${result}`;
     annotations: WRITE_IDEMPOTENT,
     description: "Modify a custom user group (`/user group set [find name=...]`). " + "Can change group name (`new_name`), `policy` list, `skin`, or `comment`. " + "Refuses to modify built-in groups (`read`, `write`, `full`). " + "Valid policies: local, telnet, ssh, ftp, reboot, read, write, policy, test, winbox, password, web, sniff, sensitive, api, romon, dude, tikapp, rest-api. " + "Returns the updated group detail.",
     inputSchema: {
-      name: z114.string(),
-      new_name: z114.string().optional(),
-      policy: z114.array(z114.string()).optional(),
-      skin: z114.string().optional(),
-      comment: z114.string().optional()
+      name: z115.string(),
+      new_name: z115.string().optional(),
+      policy: z115.array(z115.string()).optional(),
+      skin: z115.string().optional(),
+      comment: z115.string().optional()
     },
     async handler(a, ctx) {
       ctx.info(`Updating user group: name=${a.name}`);
@@ -27295,7 +27518,7 @@ ${details}`;
     title: "Remove User Group",
     annotations: DESTRUCTIVE,
     description: "Delete a custom user group (`/user group remove [find name=...]`). " + "Refuses to remove built-in groups (`read`, `write`, `full`). " + "Checks that no users are currently assigned to the group \u2014 reassign or remove those users first via `update_user` or `remove_user`. " + "To remove individual user accounts use `remove_user`.",
-    inputSchema: { name: z114.string() },
+    inputSchema: { name: z115.string() },
     async handler(a, ctx) {
       ctx.info(`Removing user group: name=${a.name}`);
       if (BUILTIN_GROUPS.includes(a.name))
@@ -27333,7 +27556,7 @@ ${result}`;
     title: "Disconnect Active User Session",
     annotations: DESTRUCTIVE,
     description: "Forcibly terminate an active user session (`/user active remove <user_id>`). " + "`user_id` is the `.id` from `get_active_users`. " + "Does NOT delete the user account \u2014 to delete the account use `remove_user`. To prevent future logins without deleting use `disable_user`.",
-    inputSchema: { user_id: z114.string() },
+    inputSchema: { user_id: z115.string() },
     async handler(a, ctx) {
       ctx.info(`Disconnecting user: user_id=${a.user_id}`);
       const result = await executeMikrotikCommand(`/user active remove ${a.user_id}`, ctx);
@@ -27347,7 +27570,7 @@ ${result}`;
     title: "Export User Configuration to File",
     annotations: READ,
     description: "Export the router's user accounts and user-group configuration as a RouterOS script (`/user export file=<filename>`). " + "The file is saved on the router's flash storage as `<filename>.rsc`. If `filename` is omitted, defaults to `user_config`. " + "The exported script can be used to restore user accounts on another device.",
-    inputSchema: { filename: z114.string().optional() },
+    inputSchema: { filename: z115.string().optional() },
     async handler(a, ctx) {
       ctx.info("Exporting user configuration");
       const filename = a.filename || "user_config";
@@ -27363,8 +27586,8 @@ ${result}`;
     annotations: WRITE,
     description: "Import an SSH public key for a user (`/user ssh-keys import user=... public-key-file=...`), enabling key-based SSH authentication in addition to password login. " + "`key_file` must be the path to a public key file already present on the router's filesystem. " + "To list a user's existing keys use `list_user_ssh_keys`; to remove a key use `remove_user_ssh_key`.",
     inputSchema: {
-      username: z114.string(),
-      key_file: z114.string()
+      username: z115.string(),
+      key_file: z115.string()
     },
     async handler(a, ctx) {
       ctx.info(`Setting SSH keys for user: ${a.username}`);
@@ -27381,7 +27604,7 @@ ${result}`;
     title: "List User SSH Keys",
     annotations: READ,
     description: "List SSH public keys registered for a specific user (`/user ssh-keys print where user=...`). " + "Returns each key's `.id`, which is required by `remove_user_ssh_key`. To add a key use `set_user_ssh_keys`.",
-    inputSchema: { username: z114.string() },
+    inputSchema: { username: z115.string() },
     async handler(a, ctx) {
       ctx.info(`Listing SSH keys for user: ${a.username}`);
       const result = await executeMikrotikCommand(`/user ssh-keys print where user="${a.username}"`, ctx);
@@ -27397,7 +27620,7 @@ ${result}`;
     title: "Remove User SSH Key",
     annotations: DESTRUCTIVE,
     description: "Delete a specific SSH public key (`/user ssh-keys remove <key_id>`). " + "`key_id` is the `.id` from `list_user_ssh_keys`. " + "Does NOT disable the user's password-based login \u2014 to block all logins use `disable_user`; to delete the account use `remove_user`.",
-    inputSchema: { key_id: z114.string() },
+    inputSchema: { key_id: z115.string() },
     async handler(a, ctx) {
       ctx.info(`Removing SSH key: key_id=${a.key_id}`);
       const result = await executeMikrotikCommand(`/user ssh-keys remove ${a.key_id}`, ctx);
@@ -27409,7 +27632,7 @@ ${result}`;
 ];
 
 // src/tools/vlan-designer.ts
-import { z as z115 } from "zod";
+import { z as z116 } from "zod";
 function defaultRange2(subnet) {
   const o = subnet.split("/")[0].split(".");
   return `${o[0]}.${o[1]}.${o[2]}.10-${o[0]}.${o[1]}.${o[2]}.254`;
@@ -27421,18 +27644,18 @@ var vlanDesignerTools = [
     annotations: DANGEROUS,
     description: "Stands up a complete isolated network segment in one call: a VLAN interface on the bridge, its " + "gateway IP, a DHCP server + pool + network, optional internet access (srcnat masquerade), and " + "inter-VLAN isolation firewall rules \u2014 e.g. 'a guest VLAN that reaches the internet but not the " + "LAN'. DEFAULTS TO A DRY RUN (`apply=false`) showing every command grouped; set `apply=true` to " + "build it. Bridge VLAN tagging is added when `tagged_ports`/`untagged_ports` are given (requires " + "bridge vlan-filtering). Isolation drops forward traffic from this subnet to each `isolate_from` " + "subnet. Returns the plan or a build report.",
     inputSchema: {
-      vlan_id: z115.number().int().min(1).max(4094),
-      name: z115.string().describe("Name for the VLAN interface, e.g. 'guest'"),
-      subnet: z115.string().describe("CIDR for the segment, e.g. '192.168.30.0/24'"),
-      gateway: z115.string().describe("Router's address in the segment, e.g. '192.168.30.1'"),
-      bridge: z115.string().default("bridge").describe("Bridge to put the VLAN on"),
-      tagged_ports: z115.string().optional().describe("Comma-separated trunk/tagged ports (+ the bridge)"),
-      untagged_ports: z115.string().optional().describe("Comma-separated access/untagged ports"),
-      dhcp: z115.boolean().default(true).describe("Create a DHCP server + pool for the segment"),
-      dhcp_range: z115.string().optional().describe("Pool range; defaults to .10\u2013.254 of the subnet"),
-      internet: z115.boolean().default(true).describe("Allow internet access via srcnat masquerade"),
-      isolate_from: z115.array(z115.string()).optional().describe("Subnets this segment must NOT reach, e.g. ['192.168.1.0/24']"),
-      apply: z115.boolean().default(false).describe("false = preview (default); true = build")
+      vlan_id: z116.number().int().min(1).max(4094),
+      name: z116.string().describe("Name for the VLAN interface, e.g. 'guest'"),
+      subnet: z116.string().describe("CIDR for the segment, e.g. '192.168.30.0/24'"),
+      gateway: z116.string().describe("Router's address in the segment, e.g. '192.168.30.1'"),
+      bridge: z116.string().default("bridge").describe("Bridge to put the VLAN on"),
+      tagged_ports: z116.string().optional().describe("Comma-separated trunk/tagged ports (+ the bridge)"),
+      untagged_ports: z116.string().optional().describe("Comma-separated access/untagged ports"),
+      dhcp: z116.boolean().default(true).describe("Create a DHCP server + pool for the segment"),
+      dhcp_range: z116.string().optional().describe("Pool range; defaults to .10\u2013.254 of the subnet"),
+      internet: z116.boolean().default(true).describe("Allow internet access via srcnat masquerade"),
+      isolate_from: z116.array(z116.string()).optional().describe("Subnets this segment must NOT reach, e.g. ['192.168.1.0/24']"),
+      apply: z116.boolean().default(false).describe("false = preview (default); true = build")
     },
     async handler(a, ctx) {
       const prefix = a.subnet.split("/")[1] ?? "24";
@@ -27505,9 +27728,9 @@ Review partial segment (the VLAN may exist without DHCP/firewall).`;
 ];
 
 // src/tools/vlan.ts
-import { z as z116 } from "zod";
-var ArpMode2 = z116.enum(["enabled", "disabled", "proxy-arp", "reply-only"]);
-var LoopProtect = z116.enum(["default", "on", "off"]);
+import { z as z117 } from "zod";
+var ArpMode2 = z117.enum(["enabled", "disabled", "proxy-arp", "reply-only"]);
+var LoopProtect = z117.enum(["default", "on", "off"]);
 var vlanTools = [
   defineTool({
     name: "create_vlan_interface",
@@ -27515,18 +27738,18 @@ var vlanTools = [
     annotations: WRITE,
     description: "Creates an 802.1Q VLAN sub-interface (`/interface vlan`) on a specified parent physical or bridge interface." + " Use this to segment layer-2 traffic by VLAN ID (1\u20134094); set `use_service_tag=true` for 802.1ad QinQ double-tagging." + " For listing existing VLAN interfaces use `list_vlan_interfaces`; for editing an existing VLAN use `update_vlan_interface`." + " Returns the created interface's full detail including its name, which is the identifier accepted by `get_vlan_interface`, `update_vlan_interface`, and `remove_vlan_interface`." + " ARP mode accepts: enabled (default), disabled, proxy-arp, reply-only.",
     inputSchema: {
-      name: z116.string().describe("Name for the new VLAN interface, e.g. 'vlan100'"),
-      vlan_id: z116.number().int().min(1).max(4094).describe("802.1Q VLAN ID (1-4094)"),
-      interface: z116.string().describe("Parent interface, e.g. 'ether1' or 'bridge'"),
-      comment: z116.string().optional(),
-      disabled: z116.boolean().default(false),
-      mtu: z116.number().int().optional(),
-      use_service_tag: z116.boolean().default(false).describe("Use 802.1ad service tag (QinQ)"),
+      name: z117.string().describe("Name for the new VLAN interface, e.g. 'vlan100'"),
+      vlan_id: z117.number().int().min(1).max(4094).describe("802.1Q VLAN ID (1-4094)"),
+      interface: z117.string().describe("Parent interface, e.g. 'ether1' or 'bridge'"),
+      comment: z117.string().optional(),
+      disabled: z117.boolean().default(false),
+      mtu: z117.number().int().optional(),
+      use_service_tag: z117.boolean().default(false).describe("Use 802.1ad service tag (QinQ)"),
       arp: ArpMode2.default("enabled"),
-      arp_timeout: z116.string().optional(),
+      arp_timeout: z117.string().optional(),
       loop_protect: LoopProtect.optional().describe("Loop protection: default, on, off"),
-      loop_protect_disable_time: z116.string().optional().describe("Time to disable interface on loop detection, e.g. '5m' (0 = forever)"),
-      loop_protect_send_interval: z116.string().optional().describe("Interval between loop-protect probe packets, e.g. '5s'")
+      loop_protect_disable_time: z117.string().optional().describe("Time to disable interface on loop detection, e.g. '5m' (0 = forever)"),
+      loop_protect_send_interval: z117.string().optional().describe("Interval between loop-protect probe packets, e.g. '5s'")
     },
     async handler(a, ctx) {
       ctx.info(`Creating VLAN interface: name=${a.name}, vlan_id=${a.vlan_id}, interface=${a.interface}`);
@@ -27546,10 +27769,10 @@ ${details}` : "VLAN interface creation completed but unable to verify.";
     annotations: READ,
     description: "Lists all 802.1Q VLAN sub-interfaces (`/interface vlan print`) with optional filters by name substring, VLAN ID, parent interface, or disabled state." + " Use to discover existing VLANs and obtain interface names for `get_vlan_interface`, `update_vlan_interface`, or `remove_vlan_interface`." + " For a single interface's full property detail use `get_vlan_interface`." + " Returns a table of matching VLAN interfaces, or a not-found message when no entries match the filters.",
     inputSchema: {
-      name_filter: z116.string().optional().describe("Partial name match"),
-      vlan_id_filter: z116.number().int().optional(),
-      interface_filter: z116.string().optional().describe("Exact parent interface name"),
-      disabled_only: z116.boolean().default(false)
+      name_filter: z117.string().optional().describe("Partial name match"),
+      vlan_id_filter: z117.number().int().optional(),
+      interface_filter: z117.string().optional().describe("Exact parent interface name"),
+      disabled_only: z117.boolean().default(false)
     },
     async handler(a, ctx) {
       ctx.info("Listing VLAN interfaces");
@@ -27573,7 +27796,7 @@ ${result}`;
     title: "Get VLAN Interface Details",
     annotations: READ,
     description: 'Returns full detail for a single named VLAN interface (`/interface vlan print detail where name="..."`), including VLAN ID, parent interface, ARP mode, MTU, and running state.' + " Use when you already know the exact interface name and need all properties." + " For searching across all VLANs or filtering by parent interface or VLAN ID use `list_vlan_interfaces`.",
-    inputSchema: { name: z116.string() },
+    inputSchema: { name: z117.string() },
     async handler(a, ctx) {
       ctx.info(`Getting VLAN interface details: name=${a.name}`);
       const result = await executeMikrotikCommand(`/interface vlan print detail where name="${a.name}"`, ctx);
@@ -27588,19 +27811,19 @@ ${result}`;
     annotations: WRITE_IDEMPOTENT,
     description: 'Modifies properties of an existing VLAN sub-interface (`/interface vlan set [find name="..."]`).' + " Accepts any subset of the create parameters; omit fields to leave them unchanged." + " Supply the current `name` from `list_vlan_interfaces` or `get_vlan_interface`; use `new_name` to rename the interface." + " For creating a new VLAN interface use `create_vlan_interface`; to permanently delete use `remove_vlan_interface`." + " Returns the updated interface's full detail after applying the change." + " ARP mode accepts: enabled, disabled, proxy-arp, reply-only.",
     inputSchema: {
-      name: z116.string().describe("Current name of the VLAN interface to update"),
-      new_name: z116.string().optional(),
-      vlan_id: z116.number().int().min(1).max(4094).optional(),
-      interface: z116.string().optional(),
-      comment: z116.string().optional(),
-      disabled: z116.boolean().optional(),
-      mtu: z116.number().int().optional(),
-      use_service_tag: z116.boolean().optional(),
+      name: z117.string().describe("Current name of the VLAN interface to update"),
+      new_name: z117.string().optional(),
+      vlan_id: z117.number().int().min(1).max(4094).optional(),
+      interface: z117.string().optional(),
+      comment: z117.string().optional(),
+      disabled: z117.boolean().optional(),
+      mtu: z117.number().int().optional(),
+      use_service_tag: z117.boolean().optional(),
       arp: ArpMode2.optional(),
-      arp_timeout: z116.string().optional(),
+      arp_timeout: z117.string().optional(),
       loop_protect: LoopProtect.optional().describe("Loop protection: default, on, off"),
-      loop_protect_disable_time: z116.string().optional().describe("Time to disable interface on loop detection, e.g. '5m' (0 = forever)"),
-      loop_protect_send_interval: z116.string().optional().describe("Interval between loop-protect probe packets, e.g. '5s'")
+      loop_protect_disable_time: z117.string().optional().describe("Time to disable interface on loop detection, e.g. '5m' (0 = forever)"),
+      loop_protect_send_interval: z117.string().optional().describe("Interval between loop-protect probe packets, e.g. '5s'")
     },
     async handler(a, ctx) {
       ctx.info(`Updating VLAN interface: name=${a.name}`);
@@ -27622,7 +27845,7 @@ ${details}`;
     title: "Remove VLAN Interface",
     annotations: DESTRUCTIVE,
     description: 'Permanently deletes a VLAN sub-interface (`/interface vlan remove [find name="..."]`) after confirming it exists via a count-only check.' + " Supply the interface `name` from `list_vlan_interfaces` or `get_vlan_interface`." + " Removing a VLAN interface also removes IP addresses assigned to it; firewall rules and other configuration that reference it by name are not automatically deleted and will remain as orphaned, ineffective entries." + " To disable a VLAN temporarily without deleting it use `update_vlan_interface` with `disabled=true`.",
-    inputSchema: { name: z116.string() },
+    inputSchema: { name: z117.string() },
     async handler(a, ctx) {
       ctx.info(`Removing VLAN interface: name=${a.name}`);
       const count = await executeMikrotikCommand(`/interface vlan print count-only where name="${a.name}"`, ctx);
@@ -27637,7 +27860,7 @@ ${details}`;
 ];
 
 // src/tools/wireguard-mesh.ts
-import { z as z117 } from "zod";
+import { z as z118 } from "zod";
 function meshAddress(prefix, index) {
   const [net, len = "24"] = prefix.split("/");
   const octets = net.split(".");
@@ -27654,16 +27877,16 @@ var wireguardMeshTools = [
     annotations: DANGEROUS,
     description: "Stands up a WireGuard VPN across several configured devices in ONE call: ensures a WireGuard " + "interface on each, reads each device's public key, assigns every device a mesh address from " + "`address_prefix`, then wires the peers between routers \u2014 `topology=full-mesh` connects every " + "pair, `hub-spoke` connects the `hub` to each spoke \u2014 distributing public keys automatically. " + "Endpoints default to each device's configured host (override per device via `endpoints`); add " + "each site's LAN subnet via `allowed_lans` to route it through the tunnel. DEFAULTS TO A DRY RUN " + "(`apply=false`) that shows the full plan; set `apply=true` to build it. Operates across " + "MULTIPLE devices, so it is not affected by the single `device` selector. SSH devices only " + "(needs to read public keys). Returns the plan, or a per-device build report.",
     inputSchema: {
-      devices: z117.array(z117.string()).min(2).describe("Configured device names to include in the mesh (2+)"),
-      address_prefix: z117.string().default("10.20.0.0/24").describe("Mesh subnet; each device gets <prefix>.<index+1> on its WireGuard interface"),
-      interface: z117.string().default("wg-mesh").describe("WireGuard interface name to create/use"),
-      listen_port: z117.number().int().default(13231),
-      topology: z117.enum(["full-mesh", "hub-spoke"]).default("full-mesh"),
-      hub: z117.string().optional().describe("Hub device name (required when topology=hub-spoke)"),
-      endpoints: z117.record(z117.string(), z117.string()).optional().describe('Per-device public endpoint host override, e.g. {"site-a":"a.example.com"}'),
-      allowed_lans: z117.record(z117.string(), z117.string()).optional().describe('Per-device LAN subnet to route through the tunnel, e.g. {"site-a":"192.168.10.0/24"}'),
-      persistent_keepalive: z117.string().default("25s"),
-      apply: z117.boolean().default(false).describe("false = preview the plan (default); true = build")
+      devices: z118.array(z118.string()).min(2).describe("Configured device names to include in the mesh (2+)"),
+      address_prefix: z118.string().default("10.20.0.0/24").describe("Mesh subnet; each device gets <prefix>.<index+1> on its WireGuard interface"),
+      interface: z118.string().default("wg-mesh").describe("WireGuard interface name to create/use"),
+      listen_port: z118.number().int().default(13231),
+      topology: z118.enum(["full-mesh", "hub-spoke"]).default("full-mesh"),
+      hub: z118.string().optional().describe("Hub device name (required when topology=hub-spoke)"),
+      endpoints: z118.record(z118.string(), z118.string()).optional().describe('Per-device public endpoint host override, e.g. {"site-a":"a.example.com"}'),
+      allowed_lans: z118.record(z118.string(), z118.string()).optional().describe('Per-device LAN subnet to route through the tunnel, e.g. {"site-a":"192.168.10.0/24"}'),
+      persistent_keepalive: z118.string().default("25s"),
+      apply: z118.boolean().default(false).describe("false = preview the plan (default); true = build")
     },
     async handler(a, ctx) {
       const devices = a.devices;
@@ -27754,7 +27977,7 @@ Check handshakes per device with get_wireguard_peers / list_wireguard_peers.`;
 
 // src/tools/vpn-onboard.ts
 import { generateKeyPairSync } from "crypto";
-import { z as z118 } from "zod";
+import { z as z119 } from "zod";
 function generateWireGuardKeypair() {
   const { privateKey, publicKey } = generateKeyPairSync("x25519");
   const priv = privateKey.export({ type: "pkcs8", format: "der" });
@@ -27771,13 +27994,13 @@ var vpnOnboardTools = [
     annotations: WRITE,
     description: "Generates a ready-to-use WireGuard remote-access profile for one user: creates a client " + "keypair, adds the peer to the server `interface` (allowed-address = the client's tunnel IP), " + "reads the server's public key, and returns a complete client .conf to paste into the WireGuard " + "app or a QR generator. The peer is tagged `vpn-user: <user>` so revoke_wireguard_user can remove " + "it. NOTE: the returned config contains the client PRIVATE key (required to connect) \u2014 handle it " + "securely. `endpoint` is the server's public host:port; `allowed_ips` controls split vs full " + "tunnel. SSH devices only. Returns the client config.",
     inputSchema: {
-      interface: z118.string().describe("Existing WireGuard SERVER interface, e.g. 'wg-server'"),
-      user: z118.string().describe("User/device label, e.g. 'alice-laptop'"),
-      address: z118.string().describe("Tunnel IP to assign the client, e.g. '10.20.0.50'"),
-      endpoint: z118.string().describe("Server public endpoint host:port, e.g. 'vpn.example.com:13231'"),
-      dns: z118.string().optional().describe("DNS for the client, e.g. '10.20.0.1'"),
-      allowed_ips: z118.string().default("0.0.0.0/0").describe("Client AllowedIPs: '0.0.0.0/0' full-tunnel, or a LAN subnet for split-tunnel"),
-      keepalive: z118.string().default("25").describe("PersistentKeepalive seconds")
+      interface: z119.string().describe("Existing WireGuard SERVER interface, e.g. 'wg-server'"),
+      user: z119.string().describe("User/device label, e.g. 'alice-laptop'"),
+      address: z119.string().describe("Tunnel IP to assign the client, e.g. '10.20.0.50'"),
+      endpoint: z119.string().describe("Server public endpoint host:port, e.g. 'vpn.example.com:13231'"),
+      dns: z119.string().optional().describe("DNS for the client, e.g. '10.20.0.1'"),
+      allowed_ips: z119.string().default("0.0.0.0/0").describe("Client AllowedIPs: '0.0.0.0/0' full-tunnel, or a LAN subnet for split-tunnel"),
+      keepalive: z119.string().default("25").describe("PersistentKeepalive seconds")
     },
     async handler(a, ctx) {
       ctx.info(`Onboarding WireGuard user '${a.user}' on ${a.interface}`);
@@ -27815,7 +28038,7 @@ ${config}`;
     title: "Revoke WireGuard Remote User",
     annotations: DESTRUCTIVE,
     description: "Revokes a remote-access user created by onboard_wireguard_user: removes the WireGuard peer " + "tagged `vpn-user: <user>` from the server, immediately cutting their access. Returns whether a " + "peer was removed.",
-    inputSchema: { user: z118.string().describe("The user label used at onboarding") },
+    inputSchema: { user: z119.string().describe("The user label used at onboarding") },
     async handler(a, ctx) {
       const count = await executeMikrotikCommand(`/interface wireguard peers print count-only where comment="vpn-user: ${a.user}"`, ctx);
       if (count.trim() === "0")
@@ -27829,7 +28052,7 @@ ${config}`;
 ];
 
 // src/tools/wireguard.ts
-import { z as z119 } from "zod";
+import { z as z120 } from "zod";
 var wireguardTools = [
   defineTool({
     name: "create_wireguard_interface",
@@ -27837,12 +28060,12 @@ var wireguardTools = [
     annotations: WRITE,
     description: "Creates a WireGuard tunnel interface (`/interface wireguard`) \u2014 the local VPN endpoint" + " with a UDP listen port and private key. Use this to establish the server-side or site-to-site" + " WireGuard interface before adding remote peers with add_wireguard_peer." + " For IPsec tunnels use create_ipsec_peer; for L2TP use create_l2tp_client;" + " for OpenVPN use create_ovpn_client. Returns the created interface's detail including" + " its name and RouterOS-generated public key.",
     inputSchema: {
-      name: z119.string(),
-      listen_port: z119.number().int().optional(),
-      private_key: z119.string().optional(),
-      mtu: z119.number().int().optional(),
-      comment: z119.string().optional(),
-      disabled: z119.boolean().default(false)
+      name: z120.string(),
+      listen_port: z120.number().int().optional(),
+      private_key: z120.string().optional(),
+      mtu: z120.number().int().optional(),
+      comment: z120.string().optional(),
+      disabled: z120.boolean().default(false)
     },
     async handler(a, ctx) {
       ctx.info(`Creating WireGuard interface: name=${a.name}`);
@@ -27862,9 +28085,9 @@ ${details}` : "WireGuard interface created successfully.";
     annotations: READ,
     description: "`list_wireguard_interfaces` \u2014 READ / list / show / inspect all WireGuard tunnel interfaces" + " (`/interface wireguard print`). The go-to tool to read the current WireGuard state on a" + " device. Returns each interface's name, listen-port, public-key, MTU, and running/disabled" + " status. Filter by name substring (name_filter), disabled-only, or running-only." + " For one interface's full detail use get_wireguard_interface; for the peer table use" + " list_wireguard_peers; for interfaces AND peers in one call use get_wireguard_status.",
     inputSchema: {
-      name_filter: z119.string().optional(),
-      disabled_only: z119.boolean().default(false),
-      running_only: z119.boolean().default(false)
+      name_filter: z120.string().optional(),
+      disabled_only: z120.boolean().default(false),
+      running_only: z120.boolean().default(false)
     },
     async handler(a, ctx) {
       ctx.info("Listing WireGuard interfaces");
@@ -27886,7 +28109,7 @@ ${result}`;
     title: "Get WireGuard Interface Details",
     annotations: READ,
     description: "`get_wireguard_interface` \u2014 READ / get / show the full detail of ONE WireGuard tunnel interface" + " (`/interface wireguard print detail`) looked up by name. Returns listen-port, private-key," + " public-key, MTU, running state, and comment. To list all interfaces use" + " list_wireguard_interfaces; for that interface's peers use list_wireguard_peers; for" + " interfaces AND peers in one call use get_wireguard_status.",
-    inputSchema: { name: z119.string() },
+    inputSchema: { name: z120.string() },
     async handler(a, ctx) {
       ctx.info(`Getting WireGuard interface details: name=${a.name}`);
       const result = await executeMikrotikCommand(`/interface wireguard print detail where name="${a.name}"`, ctx);
@@ -27901,7 +28124,7 @@ ${result}`;
     annotations: READ,
     description: "`get_wireguard_status` \u2014 READ the current WireGuard state on a device in ONE call: ALL tunnel" + " interfaces AND ALL peers together. Use this FIRST to inspect / show / check WireGuard before" + " changing anything (e.g. to read public keys, see which side initiates, or confirm the tunnel" + " is up). Interfaces report name, listen-port, public-key, MTU and running state; peers report" + " .id, interface, public-key, allowed-address, endpoint/current-endpoint, last-handshake time" + " and rx/tx bytes. Combines list_wireguard_interfaces + list_wireguard_peers; optionally filter" + " both to one interface with interface_filter.",
     inputSchema: {
-      interface_filter: z119.string().optional().describe("Limit to one interface name, e.g. 'wg-mesh'")
+      interface_filter: z120.string().optional().describe("Limit to one interface name, e.g. 'wg-mesh'")
     },
     async handler(a, ctx) {
       ctx.info("Reading WireGuard status (interfaces + peers)");
@@ -27926,13 +28149,13 @@ ${peerBlock}`;
     annotations: WRITE_IDEMPOTENT,
     description: "Modifies settings on an existing WireGuard tunnel interface (`/interface wireguard set [find name=]`)" + " \u2014 rename (new_name), change listen-port, rotate private-key, adjust MTU, or toggle disabled state." + " Only supplied fields are changed; omitted fields are left as-is." + " For updating remote peers use update_wireguard_peer." + " Returns the updated interface's detail.",
     inputSchema: {
-      name: z119.string(),
-      new_name: z119.string().optional(),
-      listen_port: z119.number().int().optional(),
-      private_key: z119.string().optional(),
-      mtu: z119.number().int().optional(),
-      comment: z119.string().optional(),
-      disabled: z119.boolean().optional()
+      name: z120.string(),
+      new_name: z120.string().optional(),
+      listen_port: z120.number().int().optional(),
+      private_key: z120.string().optional(),
+      mtu: z120.number().int().optional(),
+      comment: z120.string().optional(),
+      disabled: z120.boolean().optional()
     },
     async handler(a, ctx) {
       ctx.info(`Updating WireGuard interface: name=${a.name}`);
@@ -27955,7 +28178,7 @@ ${details}`;
     title: "Remove WireGuard Interface",
     annotations: DESTRUCTIVE,
     description: "Permanently deletes a WireGuard tunnel interface (`/interface wireguard remove`) by name." + " Verifies existence first with count-only; removing the interface also removes all its associated peers." + " For removing only a specific peer without touching the interface use remove_wireguard_peer.",
-    inputSchema: { name: z119.string() },
+    inputSchema: { name: z120.string() },
     async handler(a, ctx) {
       ctx.info(`Removing WireGuard interface: name=${a.name}`);
       const count = await executeMikrotikCommand(`/interface wireguard print count-only where name="${a.name}"`, ctx);
@@ -27972,7 +28195,7 @@ ${details}`;
     title: "Enable WireGuard Interface",
     annotations: WRITE_IDEMPOTENT,
     description: "Enables a disabled WireGuard tunnel interface (`/interface wireguard enable`) by name," + " allowing it to accept and establish tunnel connections." + " For enabling a specific peer without affecting the interface use enable_wireguard_peer." + " To undo, use disable_wireguard_interface.",
-    inputSchema: { name: z119.string() },
+    inputSchema: { name: z120.string() },
     async handler(a, ctx) {
       ctx.info(`Enabling WireGuard interface: name=${a.name}`);
       const result = await executeMikrotikCommand(`/interface wireguard enable [find name="${a.name}"]`, ctx);
@@ -27986,7 +28209,7 @@ ${details}`;
     title: "Disable WireGuard Interface",
     annotations: WRITE_IDEMPOTENT,
     description: "Disables a WireGuard tunnel interface (`/interface wireguard disable`) by name," + " stopping all tunnel traffic through it without removing the interface or its peers." + " For disabling only a specific peer use disable_wireguard_peer." + " To re-enable use enable_wireguard_interface.",
-    inputSchema: { name: z119.string() },
+    inputSchema: { name: z120.string() },
     async handler(a, ctx) {
       ctx.info(`Disabling WireGuard interface: name=${a.name}`);
       const result = await executeMikrotikCommand(`/interface wireguard disable [find name="${a.name}"]`, ctx);
@@ -28006,23 +28229,23 @@ ${details}`;
 ` + `  endpoint_address: remote host IP or hostname e.g. "203.0.113.1" (omit for road-warrior clients that dial in)
 ` + '  persistent_keepalive: seconds as string e.g. "25"',
     inputSchema: {
-      interface: z119.string(),
-      public_key: z119.string(),
-      allowed_address: z119.string().describe('CIDR, comma-separated for multiple e.g. "10.0.0.2/32" or "10.0.0.0/24,192.168.0.0/24"'),
-      endpoint_address: z119.string().optional().describe('remote host IP or hostname e.g. "203.0.113.1"'),
-      endpoint_port: z119.number().int().optional(),
-      preshared_key: z119.string().optional(),
-      persistent_keepalive: z119.string().optional().describe('seconds as string e.g. "25"'),
-      name: z119.string().optional().describe("optional peer name label"),
-      private_key: z119.string().optional().describe("peer's private key (lets the router generate this peer's client config)"),
-      responder: z119.boolean().optional().describe("only respond to handshakes, never initiate (for road-warrior clients)"),
-      client_address: z119.string().optional().describe("client tunnel address(es) for the generated client config"),
-      client_dns: z119.string().optional().describe("DNS server(s) written into the generated client config"),
-      client_endpoint: z119.string().optional().describe("server endpoint host[:port] written into the generated client config"),
-      client_keepalive: z119.string().optional().describe('client persistent-keepalive for the generated config e.g. "25s"'),
-      client_listen_port: z119.number().int().optional().describe("listen-port written into the generated client config"),
-      comment: z119.string().optional(),
-      disabled: z119.boolean().default(false)
+      interface: z120.string(),
+      public_key: z120.string(),
+      allowed_address: z120.string().describe('CIDR, comma-separated for multiple e.g. "10.0.0.2/32" or "10.0.0.0/24,192.168.0.0/24"'),
+      endpoint_address: z120.string().optional().describe('remote host IP or hostname e.g. "203.0.113.1"'),
+      endpoint_port: z120.number().int().optional(),
+      preshared_key: z120.string().optional(),
+      persistent_keepalive: z120.string().optional().describe('seconds as string e.g. "25"'),
+      name: z120.string().optional().describe("optional peer name label"),
+      private_key: z120.string().optional().describe("peer's private key (lets the router generate this peer's client config)"),
+      responder: z120.boolean().optional().describe("only respond to handshakes, never initiate (for road-warrior clients)"),
+      client_address: z120.string().optional().describe("client tunnel address(es) for the generated client config"),
+      client_dns: z120.string().optional().describe("DNS server(s) written into the generated client config"),
+      client_endpoint: z120.string().optional().describe("server endpoint host[:port] written into the generated client config"),
+      client_keepalive: z120.string().optional().describe('client persistent-keepalive for the generated config e.g. "25s"'),
+      client_listen_port: z120.number().int().optional().describe("listen-port written into the generated client config"),
+      comment: z120.string().optional(),
+      disabled: z120.boolean().default(false)
     },
     async handler(a, ctx) {
       ctx.info(`Adding WireGuard peer: interface=${a.interface}, public_key=${a.public_key.slice(0, 12)}...`);
@@ -28042,8 +28265,8 @@ ${details}` : "WireGuard peer added successfully.";
     annotations: READ,
     description: "`list_wireguard_peers` \u2014 READ / list / show / inspect all WireGuard peers" + " (`/interface wireguard peers print`). Use this to read which peers are configured and" + " whether the tunnel is up (handshake). Returns each peer's .id, interface, public-key," + " allowed-address, endpoint/current-endpoint, last-handshake time, and rx/tx byte counters." + " Filter by interface name (interface_filter) or disabled-only. For the interface table use" + " list_wireguard_interfaces; for one peer's full detail use get_wireguard_peer; for interfaces" + " AND peers in one call use get_wireguard_status. Use the .id from this output with" + " update_wireguard_peer, remove_wireguard_peer, enable_wireguard_peer, or disable_wireguard_peer.",
     inputSchema: {
-      interface_filter: z119.string().optional(),
-      disabled_only: z119.boolean().default(false)
+      interface_filter: z120.string().optional(),
+      disabled_only: z120.boolean().default(false)
     },
     async handler(a, ctx) {
       ctx.info("Listing WireGuard peers");
@@ -28067,7 +28290,7 @@ ${result}`;
 ` + `Notes:
 ` + '  peer_id: the .id from list_wireguard_peers, format "*N" or "N" e.g. "*2"',
     inputSchema: {
-      peer_id: z119.string().describe('"*N" or "N" from list output e.g. "*2"')
+      peer_id: z120.string().describe('"*N" or "N" from list output e.g. "*2"')
     },
     async handler(a, ctx) {
       ctx.info(`Getting WireGuard peer details: peer_id=${a.peer_id}`);
@@ -28089,22 +28312,22 @@ ${result}`;
 ` + `  persistent_keepalive: seconds as string e.g. "25"
 ` + '  Pass "" for endpoint_address or preshared_key to clear them.',
     inputSchema: {
-      peer_id: z119.string().describe('"*N" or "N" from list output e.g. "*2"'),
-      allowed_address: z119.string().optional(),
-      endpoint_address: z119.string().optional(),
-      endpoint_port: z119.number().int().optional(),
-      preshared_key: z119.string().optional(),
-      persistent_keepalive: z119.string().optional(),
-      name: z119.string().optional().describe("optional peer name label"),
-      private_key: z119.string().optional().describe("peer's private key (lets the router generate this peer's client config)"),
-      responder: z119.boolean().optional().describe("only respond to handshakes, never initiate"),
-      client_address: z119.string().optional().describe("client tunnel address(es) for the generated client config"),
-      client_dns: z119.string().optional().describe("DNS server(s) written into the generated client config"),
-      client_endpoint: z119.string().optional().describe("server endpoint host[:port] written into the generated client config"),
-      client_keepalive: z119.string().optional().describe('client persistent-keepalive for the generated config e.g. "25s"'),
-      client_listen_port: z119.number().int().optional().describe("listen-port written into the generated client config"),
-      comment: z119.string().optional(),
-      disabled: z119.boolean().optional()
+      peer_id: z120.string().describe('"*N" or "N" from list output e.g. "*2"'),
+      allowed_address: z120.string().optional(),
+      endpoint_address: z120.string().optional(),
+      endpoint_port: z120.number().int().optional(),
+      preshared_key: z120.string().optional(),
+      persistent_keepalive: z120.string().optional(),
+      name: z120.string().optional().describe("optional peer name label"),
+      private_key: z120.string().optional().describe("peer's private key (lets the router generate this peer's client config)"),
+      responder: z120.boolean().optional().describe("only respond to handshakes, never initiate"),
+      client_address: z120.string().optional().describe("client tunnel address(es) for the generated client config"),
+      client_dns: z120.string().optional().describe("DNS server(s) written into the generated client config"),
+      client_endpoint: z120.string().optional().describe("server endpoint host[:port] written into the generated client config"),
+      client_keepalive: z120.string().optional().describe('client persistent-keepalive for the generated config e.g. "25s"'),
+      client_listen_port: z120.number().int().optional().describe("listen-port written into the generated client config"),
+      comment: z120.string().optional(),
+      disabled: z120.boolean().optional()
     },
     async handler(a, ctx) {
       ctx.info(`Updating WireGuard peer: peer_id=${a.peer_id}`);
@@ -28130,7 +28353,7 @@ ${details}`;
 ` + `Notes:
 ` + '  peer_id: the .id from list_wireguard_peers, format "*N" or "N" e.g. "*2"',
     inputSchema: {
-      peer_id: z119.string().describe('"*N" or "N" from list output e.g. "*2"')
+      peer_id: z120.string().describe('"*N" or "N" from list output e.g. "*2"')
     },
     async handler(a, ctx) {
       ctx.info(`Removing WireGuard peer: peer_id=${a.peer_id}`);
@@ -28152,7 +28375,7 @@ ${details}`;
 ` + `Notes:
 ` + '  peer_id: the .id from list_wireguard_peers, format "*N" or "N" e.g. "*2"',
     inputSchema: {
-      peer_id: z119.string().describe('"*N" or "N" from list output e.g. "*2"')
+      peer_id: z120.string().describe('"*N" or "N" from list output e.g. "*2"')
     },
     async handler(a, ctx) {
       ctx.info(`Enabling WireGuard peer: peer_id=${a.peer_id}`);
@@ -28171,7 +28394,7 @@ ${details}`;
 ` + `Notes:
 ` + '  peer_id: the .id from list_wireguard_peers, format "*N" or "N" e.g. "*2"',
     inputSchema: {
-      peer_id: z119.string().describe('"*N" or "N" from list output e.g. "*2"')
+      peer_id: z120.string().describe('"*N" or "N" from list output e.g. "*2"')
     },
     async handler(a, ctx) {
       ctx.info(`Disabling WireGuard peer: peer_id=${a.peer_id}`);
@@ -28191,14 +28414,14 @@ ${details}`;
 ` + `  allowed_ips: CIDRs routed through the tunnel by the client, default "0.0.0.0/0" (all IPv4 traffic; add ::/0 to also route IPv6)
 ` + "  persistent_keepalive: seconds integer, default 25",
     inputSchema: {
-      client_private_key: z119.string(),
-      client_address: z119.string(),
-      server_public_key: z119.string(),
-      server_endpoint: z119.string(),
-      server_port: z119.number().int().default(51820),
-      allowed_ips: z119.string().default("0.0.0.0/0"),
-      dns: z119.string().optional(),
-      persistent_keepalive: z119.number().int().default(25)
+      client_private_key: z120.string(),
+      client_address: z120.string(),
+      server_public_key: z120.string(),
+      server_endpoint: z120.string(),
+      server_port: z120.number().int().default(51820),
+      allowed_ips: z120.string().default("0.0.0.0/0"),
+      dns: z120.string().optional(),
+      persistent_keepalive: z120.number().int().default(25)
     },
     async handler(a, ctx) {
       ctx.info("Generating WireGuard client configuration");
@@ -28232,7 +28455,7 @@ ${details}`;
 ];
 
 // src/tools/wireless.ts
-import { z as z120 } from "zod";
+import { z as z121 } from "zod";
 var V7_WIFI = ["/interface wifi", "/interface wifiwave2"];
 function commandUnsupported2(result) {
   const t = result.toLowerCase();
@@ -28263,12 +28486,12 @@ var wirelessTools = [
     annotations: WRITE,
     description: "Creates a wireless interface (`/interface wifi`, `/interface wifiwave2`, `/interface wireless`, or `/interface wlan` \u2014 auto-detected per device). " + "Use to add a new AP or station interface to the device. " + "On RouterOS v7 accepts name, ssid, disabled, and comment; on v6/legacy also requires radio_name (e.g. `wlan1`) and optionally accepts mode (default `ap-bridge`), frequency, band, channel_width, and security_profile. " + "To modify an existing interface use update_wireless_interface; to see current interfaces use list_wireless_interfaces. " + "Returns the created interface's full detail print including its `.id`.",
     inputSchema: {
-      name: z120.string(),
-      ssid: z120.string().optional(),
-      disabled: z120.boolean().default(false),
-      comment: z120.string().optional(),
-      radio_name: z120.string().optional().describe("Required for legacy wireless systems, e.g. 'wlan1'"),
-      mode: z120.enum([
+      name: z121.string(),
+      ssid: z121.string().optional(),
+      disabled: z121.boolean().default(false),
+      comment: z121.string().optional(),
+      radio_name: z121.string().optional().describe("Required for legacy wireless systems, e.g. 'wlan1'"),
+      mode: z121.enum([
         "ap-bridge",
         "bridge",
         "station",
@@ -28278,8 +28501,8 @@ var wirelessTools = [
         "ap-bridge-wds",
         "alignment-only"
       ]).optional(),
-      frequency: z120.string().optional(),
-      band: z120.enum([
+      frequency: z121.string().optional(),
+      band: z121.enum([
         "2ghz-b",
         "2ghz-b/g",
         "2ghz-b/g/n",
@@ -28291,24 +28514,24 @@ var wirelessTools = [
         "5ghz-n",
         "5ghz-ac"
       ]).optional(),
-      channel_width: z120.enum(["20mhz", "40mhz", "80mhz", "160mhz", "20/40mhz-eC", "20/40mhz-Ce"]).optional(),
-      security_profile: z120.string().optional(),
-      mtu: z120.number().int().optional().describe("Interface MTU in bytes"),
-      arp: z120.enum(["disabled", "enabled", "proxy-arp", "reply-only", "local-proxy-arp"]).optional().describe("ARP mode for the interface"),
-      hide_ssid: z120.boolean().optional().describe("Legacy: do not broadcast the SSID in beacons (AP modes)"),
-      wireless_protocol: z120.string().optional().describe("Legacy: wireless protocol, e.g. '802.11', 'nv2', 'nstreme'"),
-      scan_list: z120.string().optional().describe("Legacy: frequencies/ranges to scan (e.g. 'default' or '5180-5320')"),
-      frequency_mode: z120.enum(["manual-txpower", "regulatory-domain", "superchannel"]).optional().describe("Legacy: regulatory frequency mode"),
-      country: z120.string().optional().describe("Legacy: regulatory country setting (e.g. 'united states')"),
-      antenna_gain: z120.number().int().optional().describe("Legacy: antenna gain in dBi used for tx-power calculations"),
-      wds_mode: z120.enum(["disabled", "dynamic", "dynamic-mesh", "static", "static-mesh"]).optional().describe("Legacy: WDS mode"),
-      wds_default_bridge: z120.string().optional().describe("Legacy: bridge that dynamic WDS interfaces are added to"),
-      default_authentication: z120.boolean().optional().describe("Legacy: allow clients not in the access-list to authenticate"),
-      default_forwarding: z120.boolean().optional().describe("Legacy: allow client-to-client forwarding by default"),
-      tx_power: z120.number().int().optional().describe("Legacy: manual transmit power in dBm"),
-      tx_power_mode: z120.enum(["default", "card-rates", "all-rates-fixed", "manual-table"]).optional().describe("Legacy: how tx-power is determined"),
-      distance: z120.string().optional().describe("Legacy: link distance ('dynamic', 'indoors', or a km value)"),
-      disconnect_timeout: z120.string().optional().describe("Legacy: time before a non-responding client is disconnected")
+      channel_width: z121.enum(["20mhz", "40mhz", "80mhz", "160mhz", "20/40mhz-eC", "20/40mhz-Ce"]).optional(),
+      security_profile: z121.string().optional(),
+      mtu: z121.number().int().optional().describe("Interface MTU in bytes"),
+      arp: z121.enum(["disabled", "enabled", "proxy-arp", "reply-only", "local-proxy-arp"]).optional().describe("ARP mode for the interface"),
+      hide_ssid: z121.boolean().optional().describe("Legacy: do not broadcast the SSID in beacons (AP modes)"),
+      wireless_protocol: z121.string().optional().describe("Legacy: wireless protocol, e.g. '802.11', 'nv2', 'nstreme'"),
+      scan_list: z121.string().optional().describe("Legacy: frequencies/ranges to scan (e.g. 'default' or '5180-5320')"),
+      frequency_mode: z121.enum(["manual-txpower", "regulatory-domain", "superchannel"]).optional().describe("Legacy: regulatory frequency mode"),
+      country: z121.string().optional().describe("Legacy: regulatory country setting (e.g. 'united states')"),
+      antenna_gain: z121.number().int().optional().describe("Legacy: antenna gain in dBi used for tx-power calculations"),
+      wds_mode: z121.enum(["disabled", "dynamic", "dynamic-mesh", "static", "static-mesh"]).optional().describe("Legacy: WDS mode"),
+      wds_default_bridge: z121.string().optional().describe("Legacy: bridge that dynamic WDS interfaces are added to"),
+      default_authentication: z121.boolean().optional().describe("Legacy: allow clients not in the access-list to authenticate"),
+      default_forwarding: z121.boolean().optional().describe("Legacy: allow client-to-client forwarding by default"),
+      tx_power: z121.number().int().optional().describe("Legacy: manual transmit power in dBm"),
+      tx_power_mode: z121.enum(["default", "card-rates", "all-rates-fixed", "manual-table"]).optional().describe("Legacy: how tx-power is determined"),
+      distance: z121.string().optional().describe("Legacy: link distance ('dynamic', 'indoors', or a km value)"),
+      disconnect_timeout: z121.string().optional().describe("Legacy: time before a non-responding client is disconnected")
     },
     async handler(a, ctx) {
       ctx.info(`Creating wireless interface: name=${a.name}, ssid=${a.ssid}`);
@@ -28340,9 +28563,9 @@ ${details}`;
     annotations: READ,
     description: "Lists all wireless interfaces (`/interface wifi`, `/interface wifiwave2`, `/interface wireless`, `/interface wlan`) \u2014 probes every supported command path and aggregates results. " + "Filters by name_filter (substring match), disabled_only, or running_only. " + "For full property detail on a single interface use get_wireless_interface; to see currently connected clients use get_wireless_registration_table. " + "Falls back to `/interface print` with debugging info when no wireless interfaces match, to help identify the correct path on the device.",
     inputSchema: {
-      name_filter: z120.string().optional(),
-      disabled_only: z120.boolean().default(false),
-      running_only: z120.boolean().default(false)
+      name_filter: z121.string().optional(),
+      disabled_only: z121.boolean().default(false),
+      running_only: z121.boolean().default(false)
     },
     async handler(a, ctx) {
       ctx.info(`Listing wireless interfaces with filters: name=${a.name_filter}`);
@@ -28396,7 +28619,7 @@ NOTE: If you see wireless interfaces above, they might be using a different comm
     title: "Get Wireless Interface Details",
     annotations: READ,
     description: "Retrieves the full detail of one named wireless interface (`<auto-detected path> print detail where name=...`), " + "probing `/interface wifi`, `/interface wifiwave2`, `/interface wireless`, and `/interface wlan` in order. " + "Use when you need all properties of a single interface; for a summary of all interfaces use list_wireless_interfaces. " + "Returns the complete property set for the named interface, or an error if not found.",
-    inputSchema: { name: z120.string() },
+    inputSchema: { name: z121.string() },
     async handler(a, ctx) {
       ctx.info(`Getting wireless interface details: name=${a.name}`);
       const interfaceType = await detectWirelessInterfaceType(ctx);
@@ -28415,7 +28638,7 @@ ${result}`;
     title: "Remove Wireless Interface",
     annotations: DESTRUCTIVE,
     description: "Permanently deletes a named wireless interface (`<auto-detected path> remove [find name=...]`). " + "Verifies the interface exists first (count-only check) and returns an error if not found. " + "This action is irreversible \u2014 to keep the interface but stop traffic use disable_wireless_interface; " + "for property changes only use update_wireless_interface.",
-    inputSchema: { name: z120.string() },
+    inputSchema: { name: z121.string() },
     async handler(a, ctx) {
       ctx.info(`Removing wireless interface: name=${a.name}`);
       const interfaceType = await detectWirelessInterfaceType(ctx);
@@ -28435,7 +28658,7 @@ ${result}`;
     title: "Enable Wireless Interface",
     annotations: WRITE_IDEMPOTENT,
     description: "Enables a named wireless interface that is currently disabled (`<auto-detected path> enable [find name=...]`). " + "Idempotent \u2014 safe to call on an already-enabled interface. " + "For the reverse operation use disable_wireless_interface; to change other settings at the same time use update_wireless_interface. " + "Obtain the interface name from list_wireless_interfaces.",
-    inputSchema: { name: z120.string() },
+    inputSchema: { name: z121.string() },
     async handler(a, ctx) {
       ctx.info(`Enabling wireless interface: ${a.name}`);
       const interfaceType = await detectWirelessInterfaceType(ctx);
@@ -28452,7 +28675,7 @@ ${result}`;
     title: "Disable Wireless Interface",
     annotations: WRITE_IDEMPOTENT,
     description: "Disables a named wireless interface without removing it (`<auto-detected path> disable [find name=...]`). " + "Idempotent \u2014 safe to call on an already-disabled interface. " + "For the reverse operation use enable_wireless_interface; to delete the interface permanently use remove_wireless_interface. " + "Obtain the interface name from list_wireless_interfaces.",
-    inputSchema: { name: z120.string() },
+    inputSchema: { name: z121.string() },
     async handler(a, ctx) {
       ctx.info(`Disabling wireless interface: ${a.name}`);
       const interfaceType = await detectWirelessInterfaceType(ctx);
@@ -28470,8 +28693,8 @@ ${result}`;
     annotations: READ,
     description: "Scans for visible nearby wireless networks/SSIDs/APs in range (`<auto-detected path> scan <interface> duration=<n>`). " + "Use to discover external networks \u2014 not to list connected clients. " + "For currently associated client stations use get_wireless_registration_table instead. " + "`interface` is the local wireless interface name to scan from (e.g. `wlan1`); `duration` is scan time in seconds (default 5). " + "Returns raw scan output from the device.",
     inputSchema: {
-      interface: z120.string(),
-      duration: z120.number().int().default(5)
+      interface: z121.string(),
+      duration: z121.number().int().default(5)
     },
     async handler(a, ctx) {
       ctx.info(`Scanning wireless networks on interface: ${a.interface}`);
@@ -28493,7 +28716,7 @@ ${result}`;
     annotations: READ,
     description: "Retrieves the wireless registration table \u2014 the list of client stations currently associated to this AP (`<auto-detected path> registration-table print [where interface=...]`). " + "Each row is an actively connected wireless client with its MAC address, signal strength, and statistics. " + "To discover nearby external APs/SSIDs instead use scan_wireless_networks. " + "Optionally filter by interface name; omit to return all clients across all wireless interfaces.",
     inputSchema: {
-      interface: z120.string().optional()
+      interface: z121.string().optional()
     },
     async handler(a, ctx) {
       ctx.info(`Getting wireless registration table for interface: ${a.interface}`);
@@ -28555,7 +28778,7 @@ For legacy systems:
     title: "Create Wireless Security Profile (Legacy v6 Only \u2014 Not Implemented)",
     annotations: WRITE,
     description: "Stub for creating a `/interface wireless security-profiles` entry \u2014 a RouterOS v6 concept that does not exist in v7. " + "On RouterOS v7 devices (`/interface wifi` or `/interface wifiwave2`) always returns a not-supported message; security is configured directly on the interface. " + "On v6 this is also not implemented and returns an error. " + "For v6 interface creation with a security profile use create_wireless_interface (security_profile arg); for v7, security is configured directly on the interface but is not exposed by this server's wireless tools.",
-    inputSchema: { name: z120.string() },
+    inputSchema: { name: z121.string() },
     async handler(_a, ctx) {
       const interfaceType = await detectWirelessInterfaceType(ctx);
       if (interfaceType && V7_WIFI.includes(interfaceType)) {
@@ -28582,7 +28805,7 @@ For legacy systems:
     title: "Get Wireless Security Profile (Legacy v6 Only \u2014 Not Implemented)",
     annotations: READ,
     description: "Stub for retrieving a named `/interface wireless security-profiles` entry \u2014 a RouterOS v6 concept that does not exist in v7. " + "On RouterOS v7 devices always returns a not-supported message; on v6 also not implemented. " + "Use get_wireless_interface to inspect the security settings on a v7 wireless interface instead.",
-    inputSchema: { name: z120.string() },
+    inputSchema: { name: z121.string() },
     async handler(_a, ctx) {
       const interfaceType = await detectWirelessInterfaceType(ctx);
       if (interfaceType && V7_WIFI.includes(interfaceType)) {
@@ -28596,7 +28819,7 @@ For legacy systems:
     title: "Remove Wireless Security Profile (Legacy v6 Only \u2014 Not Implemented)",
     annotations: DESTRUCTIVE,
     description: "Stub for deleting a named `/interface wireless security-profiles` entry \u2014 a RouterOS v6 concept that does not exist in v7. " + "On RouterOS v7 devices always returns a not-supported message; on v6 also not implemented. " + "To delete a wireless interface entirely use remove_wireless_interface; to change security settings use update_wireless_interface.",
-    inputSchema: { name: z120.string() },
+    inputSchema: { name: z121.string() },
     async handler(_a, ctx) {
       const interfaceType = await detectWirelessInterfaceType(ctx);
       if (interfaceType && V7_WIFI.includes(interfaceType)) {
@@ -28611,8 +28834,8 @@ For legacy systems:
     annotations: WRITE,
     description: "Stub for assigning a named security profile to a v6 `/interface wireless` interface \u2014 a RouterOS v6 concept that does not exist in v7. " + "On RouterOS v7 devices always returns a not-supported message because security is set directly on the interface. " + "On v6 also not implemented. " + "To update a wireless interface's settings on supported versions use update_wireless_interface.",
     inputSchema: {
-      interface_name: z120.string(),
-      security_profile: z120.string()
+      interface_name: z121.string(),
+      security_profile: z121.string()
     },
     async handler(_a, ctx) {
       const interfaceType = await detectWirelessInterfaceType(ctx);
@@ -28653,7 +28876,7 @@ For legacy systems:
     title: "Remove Wireless Access List Entry (Legacy v6 Only \u2014 Not Implemented)",
     annotations: DESTRUCTIVE,
     description: "Stub for removing a `/interface wireless access-list` entry by ID \u2014 a RouterOS v6 concept. " + "On RouterOS v7 devices always returns a not-supported message; on v6 also not implemented. " + "The entry_id would take the `.id` from list_wireless_access_list if that were implemented. " + "For v7 access control use list_filter_rules and remove_filter_rule instead.",
-    inputSchema: { entry_id: z120.string() },
+    inputSchema: { entry_id: z121.string() },
     async handler(_a, ctx) {
       const interfaceType = await detectWirelessInterfaceType(ctx);
       if (interfaceType && V7_WIFI.includes(interfaceType)) {
@@ -28668,31 +28891,31 @@ For legacy systems:
     annotations: WRITE_IDEMPOTENT,
     description: "Updates settings on an existing named wireless interface (`<auto-detected path> set [find name=...] ...`). " + "Supports renaming (new_name), changing SSID, toggling disabled state, and updating comment. " + "Verifies the interface exists before applying; returns 'No updates specified.' if no optional fields are provided. " + "To only enable or disable the interface prefer enable_wireless_interface or disable_wireless_interface; " + "to create a new interface use create_wireless_interface; to delete one use remove_wireless_interface. " + "Returns the updated interface's full detail print.",
     inputSchema: {
-      name: z120.string(),
-      new_name: z120.string().optional(),
-      ssid: z120.string().optional(),
-      disabled: z120.boolean().optional(),
-      comment: z120.string().optional(),
-      mtu: z120.number().int().optional().describe("Interface MTU in bytes"),
-      arp: z120.enum(["disabled", "enabled", "proxy-arp", "reply-only", "local-proxy-arp"]).optional().describe("ARP mode for the interface"),
-      hide_ssid: z120.boolean().optional().describe("Legacy: do not broadcast the SSID in beacons (AP modes)"),
-      wireless_protocol: z120.string().optional().describe("Legacy: wireless protocol, e.g. '802.11', 'nv2', 'nstreme'"),
-      scan_list: z120.string().optional().describe("Legacy: frequencies/ranges to scan (e.g. 'default' or '5180-5320')"),
-      frequency: z120.string().optional().describe("Legacy: operating frequency in MHz"),
-      band: z120.string().optional().describe("Legacy: band, e.g. '2ghz-b/g/n' or '5ghz-a/n/ac'"),
-      channel_width: z120.enum(["20mhz", "40mhz", "80mhz", "160mhz", "20/40mhz-eC", "20/40mhz-Ce"]).optional().describe("Legacy: channel width"),
-      frequency_mode: z120.enum(["manual-txpower", "regulatory-domain", "superchannel"]).optional().describe("Legacy: regulatory frequency mode"),
-      country: z120.string().optional().describe("Legacy: regulatory country setting (e.g. 'united states')"),
-      antenna_gain: z120.number().int().optional().describe("Legacy: antenna gain in dBi used for tx-power calculations"),
-      wds_mode: z120.enum(["disabled", "dynamic", "dynamic-mesh", "static", "static-mesh"]).optional().describe("Legacy: WDS mode"),
-      wds_default_bridge: z120.string().optional().describe("Legacy: bridge that dynamic WDS interfaces are added to"),
-      default_authentication: z120.boolean().optional().describe("Legacy: allow clients not in the access-list to authenticate"),
-      default_forwarding: z120.boolean().optional().describe("Legacy: allow client-to-client forwarding by default"),
-      tx_power: z120.number().int().optional().describe("Legacy: manual transmit power in dBm"),
-      tx_power_mode: z120.enum(["default", "card-rates", "all-rates-fixed", "manual-table"]).optional().describe("Legacy: how tx-power is determined"),
-      distance: z120.string().optional().describe("Legacy: link distance ('dynamic', 'indoors', or a km value)"),
-      disconnect_timeout: z120.string().optional().describe("Legacy: time before a non-responding client is disconnected"),
-      security_profile: z120.string().optional().describe("Legacy: name of the security profile to apply")
+      name: z121.string(),
+      new_name: z121.string().optional(),
+      ssid: z121.string().optional(),
+      disabled: z121.boolean().optional(),
+      comment: z121.string().optional(),
+      mtu: z121.number().int().optional().describe("Interface MTU in bytes"),
+      arp: z121.enum(["disabled", "enabled", "proxy-arp", "reply-only", "local-proxy-arp"]).optional().describe("ARP mode for the interface"),
+      hide_ssid: z121.boolean().optional().describe("Legacy: do not broadcast the SSID in beacons (AP modes)"),
+      wireless_protocol: z121.string().optional().describe("Legacy: wireless protocol, e.g. '802.11', 'nv2', 'nstreme'"),
+      scan_list: z121.string().optional().describe("Legacy: frequencies/ranges to scan (e.g. 'default' or '5180-5320')"),
+      frequency: z121.string().optional().describe("Legacy: operating frequency in MHz"),
+      band: z121.string().optional().describe("Legacy: band, e.g. '2ghz-b/g/n' or '5ghz-a/n/ac'"),
+      channel_width: z121.enum(["20mhz", "40mhz", "80mhz", "160mhz", "20/40mhz-eC", "20/40mhz-Ce"]).optional().describe("Legacy: channel width"),
+      frequency_mode: z121.enum(["manual-txpower", "regulatory-domain", "superchannel"]).optional().describe("Legacy: regulatory frequency mode"),
+      country: z121.string().optional().describe("Legacy: regulatory country setting (e.g. 'united states')"),
+      antenna_gain: z121.number().int().optional().describe("Legacy: antenna gain in dBi used for tx-power calculations"),
+      wds_mode: z121.enum(["disabled", "dynamic", "dynamic-mesh", "static", "static-mesh"]).optional().describe("Legacy: WDS mode"),
+      wds_default_bridge: z121.string().optional().describe("Legacy: bridge that dynamic WDS interfaces are added to"),
+      default_authentication: z121.boolean().optional().describe("Legacy: allow clients not in the access-list to authenticate"),
+      default_forwarding: z121.boolean().optional().describe("Legacy: allow client-to-client forwarding by default"),
+      tx_power: z121.number().int().optional().describe("Legacy: manual transmit power in dBm"),
+      tx_power_mode: z121.enum(["default", "card-rates", "all-rates-fixed", "manual-table"]).optional().describe("Legacy: how tx-power is determined"),
+      distance: z121.string().optional().describe("Legacy: link distance ('dynamic', 'indoors', or a km value)"),
+      disconnect_timeout: z121.string().optional().describe("Legacy: time before a non-responding client is disconnected"),
+      security_profile: z121.string().optional().describe("Legacy: name of the security profile to apply")
     },
     async handler(a, ctx) {
       ctx.info(`Updating wireless interface: name=${a.name}`);
@@ -28721,7 +28944,7 @@ ${details}`;
     annotations: READ,
     description: "Lists all available regulatory country codes for wireless configuration " + "(`<auto-detected path> country print`). Each entry shows the country name/code and the " + "regulatory constraints it implies (allowed frequencies, max TX power, DFS rules, etc.). " + "Use this to discover valid values before setting a country on a wireless interface.",
     inputSchema: {
-      search: z120.string().optional().describe("Optional search string to filter countries by name or code.")
+      search: z121.string().optional().describe("Optional search string to filter countries by name or code.")
     },
     async handler(a, ctx) {
       ctx.info("Listing Wi-Fi regulatory countries");
@@ -28748,7 +28971,7 @@ ${result}`;
 ];
 
 // src/tools/wifi-optimizer.ts
-import { z as z121 } from "zod";
+import { z as z122 } from "zod";
 function pickBestFrequency(monitor) {
   const cands = [];
   for (const line of monitor.split(`
@@ -28769,9 +28992,9 @@ var wifiOptimizerTools = [
     annotations: WRITE,
     description: "Runs an RF survey on a wireless radio (`/interface wireless frequency-monitor`, blocking for " + "`duration`), finds the least-congested channel, and reports a before/after. DEFAULTS TO A DRY " + "RUN (`apply=false`) \u2014 it surveys and recommends; set `apply=true` to set the radio to the best " + "frequency (`/interface wireless set`). Targets the LEGACY wireless stack; for wifiwave2 " + "(`/interface wifi`) tune via those tools. Returns the per-channel usage finding and the chosen " + "frequency.",
     inputSchema: {
-      interface: z121.string().describe("Wireless interface, e.g. 'wlan1'"),
-      duration: z121.string().default("5").describe("Survey duration in seconds"),
-      apply: z121.boolean().default(false).describe("false = survey & recommend (default); true = set it")
+      interface: z122.string().describe("Wireless interface, e.g. 'wlan1'"),
+      duration: z122.string().default("5").describe("Survey duration in seconds"),
+      apply: z122.boolean().default(false).describe("false = survey & recommend (default); true = set it")
     },
     async handler(a, ctx) {
       ctx.info(`Wi-Fi survey on ${a.interface} for ${a.duration}s`);
@@ -28796,16 +29019,16 @@ ${monitor.trim() || "(empty)"}`;
 ];
 
 // src/tools/memory.ts
-import { z as z122 } from "zod";
-var EntityInput = z122.object({
-  name: z122.string().describe("Unique name of the entity"),
-  entityType: z122.string().describe("Type/category of the entity (e.g. 'router', 'subnet', 'person')"),
-  observations: z122.array(z122.string()).optional().describe("Initial observations (facts) to attach")
+import { z as z123 } from "zod";
+var EntityInput = z123.object({
+  name: z123.string().describe("Unique name of the entity"),
+  entityType: z123.string().describe("Type/category of the entity (e.g. 'router', 'subnet', 'person')"),
+  observations: z123.array(z123.string()).optional().describe("Initial observations (facts) to attach")
 });
-var RelationInput = z122.object({
-  from: z122.string().describe("Source entity name"),
-  to: z122.string().describe("Target entity name"),
-  relationType: z122.string().describe("Relation type in active voice (e.g. 'manages', 'connects_to', 'depends_on')")
+var RelationInput = z123.object({
+  from: z123.string().describe("Source entity name"),
+  to: z123.string().describe("Target entity name"),
+  relationType: z123.string().describe("Relation type in active voice (e.g. 'manages', 'connects_to', 'depends_on')")
 });
 var memoryTools = [
   defineTool({
@@ -28814,7 +29037,7 @@ var memoryTools = [
     annotations: WRITE,
     description: "Create one or more new entities in the persistent knowledge graph. Each entity has a " + "unique name, a type (e.g. 'router', 'subnet', 'vlan', 'person', 'config_pattern'), " + "and optional initial observations. Entities that already exist are silently skipped. " + "Use this to record things the AI learns about the network, devices, users, or patterns.",
     inputSchema: {
-      entities: z122.array(EntityInput).min(1).describe("Entities to create")
+      entities: z123.array(EntityInput).min(1).describe("Entities to create")
     },
     async handler(args) {
       const store3 = await getMemoryStore();
@@ -28832,7 +29055,7 @@ ${created.map((e) => `  - ${e.name} (${e.entityType})`).join(`
     annotations: WRITE,
     description: "Create directed relations between existing entities in the knowledge graph. Both " + "endpoint entities must already exist. Use active voice for relation types (e.g. " + "'manages', 'connects_to', 'provides_dhcp_for', 'part_of'). Duplicate relations " + "are silently skipped.",
     inputSchema: {
-      relations: z122.array(RelationInput).min(1).describe("Relations to create")
+      relations: z123.array(RelationInput).min(1).describe("Relations to create")
     },
     async handler(args) {
       const store3 = await getMemoryStore();
@@ -28850,9 +29073,9 @@ ${created.map((r) => `  - ${r.from} --[${r.relationType}]--> ${r.to}`).join(`
     annotations: WRITE,
     description: "Add new observations (discrete facts) to existing entities in the knowledge graph. " + "Each observation is a string (e.g. 'runs RouterOS 7.16', 'has 4 ether ports', " + "'managed by John'). Duplicate observations on the same entity are silently skipped. " + "The entity must already exist.",
     inputSchema: {
-      observations: z122.array(z122.object({
-        entityName: z122.string().describe("Name of the existing entity"),
-        contents: z122.array(z122.string()).min(1).describe("Observations to add")
+      observations: z123.array(z123.object({
+        entityName: z123.string().describe("Name of the existing entity"),
+        contents: z123.array(z123.string()).min(1).describe("Observations to add")
       })).min(1)
     },
     async handler(args) {
@@ -28872,7 +29095,7 @@ ${lines.join(`
     annotations: DESTRUCTIVE,
     description: "Remove entities from the knowledge graph. This also deletes all their observations " + "and any relations where they appear as an endpoint (cascade delete).",
     inputSchema: {
-      entityNames: z122.array(z122.string()).min(1).describe("Names of entities to delete")
+      entityNames: z123.array(z123.string()).min(1).describe("Names of entities to delete")
     },
     async handler(args) {
       const store3 = await getMemoryStore();
@@ -28886,9 +29109,9 @@ ${lines.join(`
     annotations: DESTRUCTIVE,
     description: "Remove specific observations from entities in the knowledge graph. The entity " + "itself is kept; only the named observation strings are removed.",
     inputSchema: {
-      deletions: z122.array(z122.object({
-        entityName: z122.string().describe("Entity to remove observations from"),
-        observations: z122.array(z122.string()).min(1).describe("Exact observation strings to delete")
+      deletions: z123.array(z123.object({
+        entityName: z123.string().describe("Entity to remove observations from"),
+        observations: z123.array(z123.string()).min(1).describe("Exact observation strings to delete")
       })).min(1)
     },
     async handler(args) {
@@ -28903,7 +29126,7 @@ ${lines.join(`
     annotations: DESTRUCTIVE,
     description: "Remove specific relations from the knowledge graph. Each relation is identified " + "by its (from, to, relationType) triple.",
     inputSchema: {
-      relations: z122.array(RelationInput).min(1).describe("Relations to delete")
+      relations: z123.array(RelationInput).min(1).describe("Relations to delete")
     },
     async handler(args) {
       const store3 = await getMemoryStore();
@@ -28931,8 +29154,8 @@ ${lines.join(`
     annotations: READ,
     description: "Search for entities in the knowledge graph by name, type, or observation content. " + "Returns matching entities with their observations, plus any relations where at " + "least one endpoint is in the result set.",
     inputSchema: {
-      query: z122.string().describe("Search term \u2014 matched against entity names, types, and observation content"),
-      limit: z122.number().int().positive().optional().describe("Max entities to return (default 50)")
+      query: z123.string().describe("Search term \u2014 matched against entity names, types, and observation content"),
+      limit: z123.number().int().positive().optional().describe("Max entities to return (default 50)")
     },
     async handler(args) {
       const store3 = await getMemoryStore();
@@ -28948,7 +29171,7 @@ ${lines.join(`
     annotations: READ,
     description: "Retrieve specific entities by exact name from the knowledge graph, with all their " + "observations and any relations where at least one endpoint is in the requested set.",
     inputSchema: {
-      names: z122.array(z122.string()).min(1).describe("Exact entity names to retrieve")
+      names: z123.array(z123.string()).min(1).describe("Exact entity names to retrieve")
     },
     async handler(args) {
       const store3 = await getMemoryStore();
@@ -28969,6 +29192,13 @@ var moduleCatalog = [
     description: "Always-discoverable meta-tools that make the whole catalog reachable when the host can't " + "surface a specific tool: search by intent (`find_tools`), inspect a schema (`describe_tool`), " + "and run any tool by name with full validation (`invoke_tool`).",
     tools: toolGatewayTools
   },
+  {
+    label: "Server Pulse",
+    slug: "server-pulse",
+    group: "Discovery & Meta",
+    description: "Server self-awareness: running version, update availability, release notes, " + "upgrade path, and server vitals. No RouterOS device is contacted.",
+    tools: serverPulseTools
+  },
   {
     label: "RouterOS CLI",
     slug: "raw-command",
@@ -29825,7 +30055,7 @@ var moduleCatalog = [
   }
 ];
 var allToolModules = moduleCatalog.map((m) => m.tools);
-var ALWAYS_ON_MODULES = new Set(["tool-gateway", "memory"]);
+var ALWAYS_ON_MODULES = new Set(["tool-gateway", "memory", "server-pulse"]);
 function selectToolModules(filter = {}, catalog = moduleCatalog) {
   const lc = (xs) => new Set((xs ?? []).map((s) => s.toLowerCase()));
   const enabledModules = lc(filter.enabledModules);
@@ -29846,4 +30076,4 @@ function selectToolModules(filter = {}, catalog = moduleCatalog) {
   }).map((m) => m.tools);
 }
 
-export { __require, DEFAULT_SNAPSHOT_DB, DEFAULT_CONFIG_HISTORY_DIR, DeviceConfigSchema, ToolFilterSchema, MikrotikConfigSchema, getConfigSource, loadConfig, logger, setConfig, getConfig, listDevices, deviceLabels, resolveDeviceName, deviceDirectory, isMacTelnetDevice, createDeviceClient, describeTransport, isPoolEnabled, closeAll, poolStatus, getMemoryStore, closeMemoryStore, reopenMemoryStore, executeMikrotikCommand, createContext, Cmd, isEmpty, looksLikeError, commandUnsupported, parseKeyValues, parseRouterosDate, parseSize, parseSystemResource, parseRecords, parseLeadingNumber, REDACTED, redact, configureRecorder, getEventStore, subscribe, subscriberCount, registerTools, fetchDevices, sampleDeviceTraffic, sampleAllTraffic, setDeviceLimits, blockDevice, allowDevice, makeDeviceStatic, setDeviceIp, setDeviceLabel, removeDeviceLease, devicesView, PROMPTS_DIR, PROJECT_ROOT, UI_DIST_DIR, registerUiResources, backupDir, listBackups, readBackup, writeBackup, deleteBackup, renameBackup, createLocalBackup, restoreLocalBackup, isS3Configured, getS3Client, presignExpiresIn, s3Target, splitCommands, buildChangePlan, renderPlan, diffLines, normalizeExport, analyzeDrift, attributeChanges, openSnapshotStore, DEFAULT_TZSP_PORT, capture2 as capture, AAA_ENTITIES, listAaaEntity, addAaaEntity, updateAaaEntity, removeAaaEntity, toggleAaaEntity, getRadiusIncoming, setRadiusIncoming, resetRadiusCounters, getUmSettings, setUmSettings, moduleCatalog, allToolModules, ALWAYS_ON_MODULES, selectToolModules };
+export { __require, DEFAULT_SNAPSHOT_DB, DEFAULT_CONFIG_HISTORY_DIR, DeviceConfigSchema, ToolFilterSchema, MikrotikConfigSchema, getConfigSource, loadConfig, logger, setConfig, getConfig, listDevices, deviceLabels, resolveDeviceName, deviceDirectory, isMacTelnetDevice, createDeviceClient, describeTransport, isPoolEnabled, closeAll, poolStatus, getMemoryStore, closeMemoryStore, reopenMemoryStore, executeMikrotikCommand, createContext, Cmd, isEmpty, looksLikeError, commandUnsupported, parseKeyValues, parseRouterosDate, parseSize, parseSystemResource, parseRecords, parseLeadingNumber, REDACTED, redact, configureRecorder, getEventStore, subscribe, subscriberCount, registerTools, fetchDevices, sampleDeviceTraffic, sampleAllTraffic, setDeviceLimits, blockDevice, allowDevice, makeDeviceStatic, setDeviceIp, setDeviceLabel, removeDeviceLease, devicesView, PROMPTS_DIR, UI_DIST_DIR, registerUiResources, backupDir, listBackups, readBackup, writeBackup, deleteBackup, renameBackup, createLocalBackup, restoreLocalBackup, isS3Configured, getS3Client, presignExpiresIn, s3Target, splitCommands, buildChangePlan, renderPlan, diffLines, normalizeExport, analyzeDrift, attributeChanges, openSnapshotStore, DEFAULT_TZSP_PORT, capture2 as capture, AAA_ENTITIES, listAaaEntity, addAaaEntity, updateAaaEntity, removeAaaEntity, toggleAaaEntity, getRadiusIncoming, setRadiusIncoming, resetRadiusCounters, getUmSettings, setUmSettings, VERSION, WEBSITE_URL, LOGO_URL, SERVER_TITLE, SERVER_DESCRIPTION, SERVER_NAME, PKG_META, loadFileCacheSync, fetchLatestRelease, checkForUpdate, updateSummaryLine, moduleCatalog, allToolModules, ALWAYS_ON_MODULES, selectToolModules };