@usex/mikrotik-mcp 4.15.0 → 4.17.0

package/dist/shared/{library-212xbkwr.js → library-qma8metz.js}

@@ -8804,7 +8804,7 @@ var cache = null;
 async function gateway() {
   if (cache)
     return cache;
-  const { moduleCatalog } = await import("./library-c0fxxq85.js");
+  const { moduleCatalog } = await import("./library-ydfn3v4j.js");
   const forIndex = [];
   const byName = new Map;
   for (const mod of moduleCatalog) {
@@ -30971,17 +30971,963 @@ ${monitor.trim() || "(empty)"}`;
   })
 ];
 
-// src/tools/memory.ts
+// src/tools/capsman.ts
 import { z as z125 } from "zod";
-var EntityInput = z125.object({
-  name: z125.string().describe("Unique name of the entity"),
-  entityType: z125.string().describe("Type/category of the entity (e.g. 'router', 'subnet', 'person')"),
-  observations: z125.array(z125.string()).optional().describe("Initial observations (facts) to attach")
+
+// src/core/capsman.ts
+var SEVERITY_ORDER3 = {
+  critical: 0,
+  high: 1,
+  medium: 2,
+  low: 3
+};
+function emptyCapsmanState() {
+  return {
+    managerEnabled: false,
+    managerCount: 0,
+    capsHaveBackupManager: false,
+    requirePeerCertificate: false,
+    radios: [],
+    clients: [],
+    securityConfigs: [],
+    accessList: [],
+    path: "/interface wifi"
+  };
+}
+var DEFAULT_WEAK_DBM = -70;
+var MIN_STEER_GAIN_DB = 8;
+var OVERLOAD_CLIENTS = 25;
+var CPU_CONSTRAINED_PCT = 80;
+function parseFloorTag(text) {
+  if (!text)
+    return {};
+  const kvFloor = text.match(/floor\s*[=:]\s*([\w-]+)/i)?.[1];
+  const kvZone = text.match(/zone\s*[=:]\s*([\w-]+)/i)?.[1];
+  if (kvFloor || kvZone)
+    return { floor: kvFloor, zone: kvZone };
+  const f = text.match(/\bF(\d{1,2})\b/i) ?? text.match(/floor[-_]?(\d{1,2})/i);
+  const z125 = text.match(/\b(?:F\d{1,2}|floor[-_]?\d{1,2})[-_]([A-Za-z]+)\b/i);
+  const out = {};
+  if (f)
+    out.floor = f[1];
+  if (z125)
+    out.zone = z125[1];
+  return out;
+}
+function buildAdjacency(clients) {
+  const adj = new Map;
+  const link = (a, b) => {
+    if (a === b)
+      return;
+    (adj.get(a) ?? adj.set(a, new Set).get(a)).add(b);
+    (adj.get(b) ?? adj.set(b, new Set).get(b)).add(a);
+  };
+  for (const c of clients) {
+    if (!c.seenOn)
+      continue;
+    for (const [other, sig] of Object.entries(c.seenOn)) {
+      if (other !== c.radioId && sig > -85)
+        link(c.radioId, other);
+    }
+  }
+  return adj;
+}
+function radioIndex(radios) {
+  return new Map(radios.map((r) => [r.radioId, r]));
+}
+function bandOf(radio) {
+  if (radio.band !== "unknown")
+    return radio.band;
+  const ch = radio.channel ?? 0;
+  if (ch >= 5000 || ch >= 36 && ch <= 177)
+    return "5ghz";
+  if (ch >= 2400 && ch <= 2500 || ch >= 1 && ch <= 14)
+    return "2ghz";
+  return "unknown";
+}
+var CLEAN_24_CHANNELS = [1, 6, 11];
+function auditCoverage(state) {
+  const findings = [];
+  const adj = buildAdjacency(state.clients);
+  const byId = radioIndex(state.radios);
+  const seenPairs = new Set;
+  for (const r of state.radios) {
+    const neighbors = adj.get(r.radioId);
+    if (!neighbors)
+      continue;
+    for (const nId of neighbors) {
+      const n = byId.get(nId);
+      if (!n)
+        continue;
+      if (bandOf(r) !== bandOf(n) || r.channel == null || r.channel !== n.channel)
+        continue;
+      const key = [r.radioId, nId].sort().join("|");
+      if (seenPairs.has(key))
+        continue;
+      seenPairs.add(key);
+      findings.push({
+        finding_id: `cochannel:${key}`,
+        category: "coverage",
+        severity: "high",
+        confidence: "proven",
+        title: `Co-channel overlap on ${bandOf(r)} channel ${r.channel}`,
+        target: `${r.cap}/${r.radioId} \u2194 ${n.cap}/${n.radioId}`,
+        detail: `Adjacent radios ${r.cap} and ${n.cap} both use ${bandOf(r)} channel ${r.channel}; ` + "clients in the overlap contend for the same airtime, cutting throughput.",
+        recommendation: bandOf(r) === "2ghz" ? `Move one radio to a non-overlapping 2.4 GHz channel (${CLEAN_24_CHANNELS.join("/")}).` : "Assign the two radios different 5 GHz channels (DFS-aware)."
+      });
+    }
+  }
+  return findings;
+}
+function proposeChannelPlan(state) {
+  const adj = buildAdjacency(state.clients);
+  const plan = new Map;
+  const order = [...state.radios].sort((a, b) => b.clientCount - a.clientCount);
+  for (const r of order) {
+    const band = bandOf(r);
+    const palette = band === "2ghz" ? CLEAN_24_CHANNELS : [36, 40, 44, 48, 149, 153, 157, 161];
+    const used = new Set;
+    for (const nId of adj.get(r.radioId) ?? []) {
+      const nc = plan.get(nId);
+      if (nc != null)
+        used.add(nc);
+    }
+    plan.set(r.radioId, palette.find((c) => !used.has(c)) ?? palette[0]);
+  }
+  return plan;
+}
+function channelToFrequencyMhz(channel, band) {
+  if (band === "2ghz")
+    return channel >= 1 && channel <= 14 ? 2407 + channel * 5 : channel;
+  if (band === "5ghz")
+    return channel >= 36 && channel <= 177 ? 5000 + channel * 5 : channel;
+  return null;
+}
+function buildChannelPlanCommands(state, onlyRadioIds) {
+  if (state.path === "/caps-man")
+    return [];
+  const plan = proposeChannelPlan(state);
+  const byId = radioIndex(state.radios);
+  const cmds = [];
+  for (const [radioId, ch] of plan) {
+    if (onlyRadioIds && !onlyRadioIds.has(radioId))
+      continue;
+    const radio = byId.get(radioId);
+    if (!radio || radio.channel === ch)
+      continue;
+    const freq = channelToFrequencyMhz(ch, bandOf(radio));
+    if (freq == null)
+      continue;
+    cmds.push(`${state.path} set [find name="${radioId}"] channel.frequency=${freq}`);
+  }
+  return cmds;
+}
+function reportWeakClients(state, weakDbm = DEFAULT_WEAK_DBM) {
+  const byId = radioIndex(state.radios);
+  const out = [];
+  for (const c of state.clients) {
+    if (c.signal >= weakDbm)
+      continue;
+    const cur = byId.get(c.radioId);
+    let bestId;
+    let bestSig = c.signal;
+    for (const [rid, sig] of Object.entries(c.seenOn ?? {})) {
+      if (rid === c.radioId)
+        continue;
+      if (sig > bestSig) {
+        bestSig = sig;
+        bestId = rid;
+      }
+    }
+    const gain = bestId ? bestSig - c.signal : 0;
+    const rec = bestId && gain >= MIN_STEER_GAIN_DB ? byId.get(bestId) : undefined;
+    out.push({
+      mac: c.mac,
+      currentRadio: c.radioId,
+      currentCap: cur?.cap ?? "?",
+      signal: c.signal,
+      band: c.band,
+      recommendRadioId: rec ? rec.radioId : undefined,
+      recommendCap: rec ? rec.cap : undefined,
+      gainDb: rec ? gain : undefined
+    });
+  }
+  return out.sort((a, b) => a.signal - b.signal);
+}
+function auditWeakSignal(state, weakDbm = DEFAULT_WEAK_DBM) {
+  return reportWeakClients(state, weakDbm).map((w) => ({
+    finding_id: `weak:${w.mac}`,
+    category: "weak_signal",
+    severity: w.signal < weakDbm - 15 ? "high" : "medium",
+    confidence: "needs_live_verification",
+    title: `Weak client ${w.mac} at ${w.signal} dBm on ${w.currentCap}`,
+    target: `${w.mac} @ ${w.currentCap}/${w.currentRadio}`,
+    detail: `Client signal ${w.signal} dBm is below the ${weakDbm} dBm threshold${w.recommendCap ? `; it sees ${w.recommendCap} ~${w.gainDb} dB stronger.` : "; no neighbor radio hears it meaningfully better (coverage gap here)."}`,
+    recommendation: w.recommendCap ? `Steer ${w.mac} toward ${w.recommendCap} (soft 802.11k/v, or hard signal-range).` : "Coverage hole \u2014 add/relocate an AP or raise tx-power; steering won't help."
+  }));
+}
+function loadModel(state) {
+  return state.radios.map((radio) => ({
+    radio,
+    overloaded: radio.clientCount > OVERLOAD_CLIENTS,
+    cpuConstrained: (radio.cpuLoad ?? 0) > CPU_CONSTRAINED_PCT
+  }));
+}
+function auditLoad(state) {
+  const findings = [];
+  const adj = buildAdjacency(state.clients);
+  const byId = radioIndex(state.radios);
+  const loads = loadModel(state);
+  for (const l of loads) {
+    if (!l.overloaded && !l.cpuConstrained)
+      continue;
+    let target;
+    for (const nId of adj.get(l.radio.radioId) ?? []) {
+      const n = byId.get(nId);
+      if (!n)
+        continue;
+      if (n.clientCount < OVERLOAD_CLIENTS && (n.cpuLoad ?? 0) < CPU_CONSTRAINED_PCT) {
+        if (!target || n.clientCount < target.clientCount)
+          target = n;
+      }
+    }
+    const why = l.cpuConstrained ? `CAP CPU at ${l.radio.cpuLoad}% (>${CPU_CONSTRAINED_PCT}%)` : `${l.radio.clientCount} clients (>${OVERLOAD_CLIENTS})`;
+    findings.push({
+      finding_id: `load:${l.radio.radioId}`,
+      category: "load",
+      severity: l.cpuConstrained ? "high" : "medium",
+      confidence: "needs_live_verification",
+      title: `Overloaded radio ${l.radio.cap}/${l.radio.radioId}`,
+      target: `${l.radio.cap}/${l.radio.radioId}`,
+      detail: `${why}.${target ? ` Neighbor ${target.cap} has spare capacity.` : ""}`,
+      recommendation: target ? `Rebalance some clients toward ${target.cap}; steer dual-band clients to 5 GHz.` : "No adjacent radio has spare capacity \u2014 the whole zone is saturated; add an AP."
+    });
+  }
+  return findings;
+}
+function auditFt(state) {
+  const findings = [];
+  if (state.securityConfigs.length === 0)
+    return findings;
+  for (const c of state.securityConfigs) {
+    if (!c.ft) {
+      findings.push({
+        finding_id: `ft-off:${c.name}`,
+        category: "ft",
+        severity: "medium",
+        confidence: "proven",
+        title: `802.11r fast-transition off on "${c.ssid ?? c.name}"`,
+        target: c.name,
+        detail: "Without FT, roaming re-does the full auth handshake \u2014 a visible stall for VoIP/video as people move between floors.",
+        recommendation: "Enable ft + a shared ft-mobility-domain across all CAPs, and 802.11k/v steering."
+      });
+    }
+    if (c.ft && (!c.rrm || !c.wnm)) {
+      findings.push({
+        finding_id: `ft-nosteer:${c.name}`,
+        category: "ft",
+        severity: "low",
+        confidence: "proven",
+        title: `FT on but 802.11k/v steering incomplete on "${c.ssid ?? c.name}"`,
+        target: c.name,
+        detail: `rrm(k)=${c.rrm ? "on" : "off"}, wnm(v)=${c.wnm ? "on" : "off"} \u2014 clients get no neighbor hints to roam early.`,
+        recommendation: "Enable both rrm (802.11k) and wnm (802.11v) so clients roam before the signal collapses."
+      });
+    }
+  }
+  const domains = new Set(state.securityConfigs.filter((c) => c.ft && c.ftMobilityDomain).map((c) => c.ftMobilityDomain));
+  if (domains.size > 1) {
+    findings.push({
+      finding_id: "ft-domain-mismatch",
+      category: "ft",
+      severity: "high",
+      confidence: "proven",
+      title: "Inconsistent FT mobility domains across CAPs",
+      target: [...domains].join(", "),
+      detail: `Found ${domains.size} distinct ft-mobility-domain values \u2014 fast roaming only works WITHIN a domain, so clients still do a full handshake crossing the boundary.`,
+      recommendation: "Set the SAME ft-mobility-domain on every CAP that shares an SSID."
+    });
+  }
+  return findings;
+}
+function auditHa(state) {
+  const findings = [];
+  if (!state.managerEnabled)
+    return findings;
+  if (state.managerCount < 2 || !state.capsHaveBackupManager) {
+    findings.push({
+      finding_id: "ha-single-manager",
+      category: "ha",
+      severity: "high",
+      confidence: "proven",
+      title: "CAPsMAN has no backup manager (single point of failure)",
+      target: "capsman manager",
+      detail: "Only one manager is configured / the CAPs aren't pointed at a backup. If it reboots or the link drops, every AP in the building goes dark.",
+      recommendation: "Stand up a second manager and point the CAPs at both (caps-man-addresses / discovery), cert-based."
+    });
+  }
+  if ((state.managerCount >= 2 || state.capsHaveBackupManager) && !state.requirePeerCertificate) {
+    findings.push({
+      finding_id: "ha-no-cert",
+      category: "ha",
+      severity: "medium",
+      confidence: "proven",
+      title: "CAPsMAN HA without peer-certificate enforcement",
+      target: "capsman manager",
+      detail: "A backup manager exists but require-peer-certificate is off \u2014 a rogue manager could adopt your CAPs.",
+      recommendation: "Enable require-peer-certificate and provision CA/manager certificates."
+    });
+  }
+  return findings;
+}
+function runCapsmanAudit(state, opts = {}) {
+  const want = new Set(opts.categories ?? ["coverage", "weak_signal", "load", "ft", "ha"]);
+  const findings = [];
+  if (want.has("coverage"))
+    findings.push(...auditCoverage(state));
+  if (want.has("weak_signal"))
+    findings.push(...auditWeakSignal(state, opts.weakDbm ?? DEFAULT_WEAK_DBM));
+  if (want.has("load"))
+    findings.push(...auditLoad(state));
+  if (want.has("ft"))
+    findings.push(...auditFt(state));
+  if (want.has("ha"))
+    findings.push(...auditHa(state));
+  findings.sort((a, b) => SEVERITY_ORDER3[a.severity] - SEVERITY_ORDER3[b.severity] || a.category.localeCompare(b.category) || a.finding_id.localeCompare(b.finding_id));
+  const summary = { critical: 0, high: 0, medium: 0, low: 0 };
+  for (const f of findings)
+    summary[f.severity]++;
+  return { findings, summary, total: findings.length };
+}
+var STEER_TAG = "capsman-steer";
+var LB_TAG = "capsman-lb";
+function accessListMenu(path) {
+  return path === "/caps-man" ? "/caps-man access-list" : `${path} access-list`;
+}
+function steerAlreadyPresent(state, mac2) {
+  const tag = `${STEER_TAG}: ${mac2.toLowerCase()}`;
+  return state.accessList.some((e) => (e.comment ?? "").toLowerCase().includes(tag) || (e.macAddress ?? "").toLowerCase() === mac2.toLowerCase() && (e.comment ?? "").toLowerCase().includes(STEER_TAG));
+}
+function buildSteerCommands(state, mac2, currentRadio, mode, rejectAbove = DEFAULT_WEAK_DBM) {
+  if (mode === "soft")
+    return [];
+  const menu = accessListMenu(state.path);
+  return [
+    `${menu} add mac-address=${mac2} interface=${currentRadio} ` + `signal-range=-120..${rejectAbove} action=reject ` + `comment="${STEER_TAG}: ${mac2}" place-before=0`
+  ];
+}
+function loadBalancePlan(state) {
+  const adj = buildAdjacency(state.clients);
+  const byId = radioIndex(state.radios);
+  const out = [];
+  for (const r of state.radios) {
+    const overloaded = r.clientCount > OVERLOAD_CLIENTS || (r.cpuLoad ?? 0) > CPU_CONSTRAINED_PCT;
+    if (!overloaded)
+      continue;
+    let target;
+    for (const nId of adj.get(r.radioId) ?? []) {
+      const n = byId.get(nId);
+      if (!n)
+        continue;
+      if (n.clientCount < OVERLOAD_CLIENTS && (n.cpuLoad ?? 0) < CPU_CONSTRAINED_PCT) {
+        if (!target || n.clientCount < target.clientCount)
+          target = n;
+      }
+    }
+    if (target)
+      out.push({
+        radioId: r.radioId,
+        cap: r.cap,
+        targetRadioId: target.radioId,
+        targetCap: target.cap
+      });
+  }
+  return out;
+}
+function loadBalanceAlreadyPresent(state, radioId) {
+  const tag = `${LB_TAG}: ${radioId}`;
+  return state.accessList.some((e) => (e.comment ?? "").includes(tag));
+}
+function buildLoadBalanceCommands(state, plan) {
+  const menu = accessListMenu(state.path);
+  const cmds = [];
+  for (const item of plan) {
+    if (loadBalanceAlreadyPresent(state, item.radioId))
+      continue;
+    cmds.push(`${menu} add interface=${item.radioId} action=accept connect-priority=0 ` + `comment="${LB_TAG}: ${item.radioId} \u2192 ${item.targetRadioId}" place-before=0`);
+  }
+  return cmds;
+}
+function securityMenu(path) {
+  return path === "/caps-man" ? "/caps-man security" : `${path} security`;
+}
+function resolveMobilityDomain(state, override) {
+  if (override)
+    return override;
+  const existing = state.securityConfigs.find((c) => c.ftMobilityDomain)?.ftMobilityDomain;
+  return existing ?? "0001";
+}
+function buildFtCommands(state, opts = {}) {
+  const menu = securityMenu(state.path);
+  const domain = resolveMobilityDomain(state, opts.mobilityDomain);
+  const want = opts.configNames ? new Set(opts.configNames) : null;
+  const cmds = [];
+  for (const c of state.securityConfigs) {
+    if (want && !want.has(c.name))
+      continue;
+    if (c.ft && c.ftMobilityDomain === domain)
+      continue;
+    cmds.push(`${menu} set [find name="${c.name}"] ft=yes ft-over-ds=yes ft-mobility-domain=${domain}`);
+  }
+  return cmds;
+}
+function managerMenu(path) {
+  return path === "/caps-man" ? "/caps-man manager" : `${path} capsman`;
+}
+function buildHaCommands(state, opts = {}) {
+  const cmds = [];
+  if ((opts.requireCert ?? true) && !state.requirePeerCertificate) {
+    cmds.push(`${managerMenu(state.path)} set require-peer-certificate=yes`);
+  }
+  return cmds;
+}
+function haGuidance(state, backupAddress) {
+  const g = [
+    "Stand up a SECOND manager (a spare RouterOS box or a CHR) with the same CA/manager certificate.",
+    backupAddress ? `On EVERY CAP, point it at both managers: /interface wifi cap set caps-man-addresses=<primary>,${backupAddress}` : "On EVERY CAP, add the backup manager to its caps-man-addresses (or discovery-interfaces) so it fails over.",
+    "Provision the backup with an identical configuration/provisioning set so a failover is seamless."
+  ];
+  if (!state.requirePeerCertificate) {
+    g.unshift("(This tool can enable require-peer-certificate on THIS manager \u2014 see the applied commands.)");
+  }
+  return g;
+}
+var FIX_ORDER = ["coverage", "load", "weak_signal", "ft", "ha"];
+function fixCommandsForFinding(state, findingId) {
+  if (findingId.startsWith("cochannel:"))
+    return buildChannelPlanCommands(state);
+  if (findingId.startsWith("load:"))
+    return buildLoadBalanceCommands(state, loadBalancePlan(state));
+  if (findingId.startsWith("weak:")) {
+    const mac2 = findingId.slice("weak:".length);
+    const client = state.clients.find((c) => c.mac === mac2);
+    return client ? buildSteerCommands(state, mac2, client.radioId, "hard") : [];
+  }
+  if (findingId.startsWith("ft-"))
+    return buildFtCommands(state);
+  if (findingId.startsWith("ha-"))
+    return buildHaCommands(state);
+  return [];
+}
+function categoryOfFinding(findingId) {
+  if (findingId.startsWith("cochannel:"))
+    return "coverage";
+  if (findingId.startsWith("load:"))
+    return "load";
+  if (findingId.startsWith("weak:"))
+    return "weak_signal";
+  if (findingId.startsWith("ft-"))
+    return "ft";
+  return "ha";
+}
+function buildFixPlan(state, findingIds) {
+  const ordered = [...findingIds].sort((a, b) => FIX_ORDER.indexOf(categoryOfFinding(a)) - FIX_ORDER.indexOf(categoryOfFinding(b)));
+  const seen = new Set;
+  const out = [];
+  for (const id of ordered) {
+    for (const cmd of fixCommandsForFinding(state, id)) {
+      if (!seen.has(cmd)) {
+        seen.add(cmd);
+        out.push(cmd);
+      }
+    }
+  }
+  return out;
+}
+var SEV_TAG3 = {
+  critical: "CRIT",
+  high: "HIGH",
+  medium: "MED ",
+  low: "LOW "
+};
+function renderCapsmanReport(report, device) {
+  const head = `CAPsMAN AUDIT \u2014 ${device}
+` + `${report.total} finding(s): ${report.summary.critical} critical, ${report.summary.high} high, ` + `${report.summary.medium} medium, ${report.summary.low} low`;
+  if (report.total === 0)
+    return `${head}
+
+No findings \u2014 Wi-Fi fabric looks healthy. \u2713`;
+  const body = report.findings.map((f, i) => {
+    return `${i + 1}. [${SEV_TAG3[f.severity]}] ${f.title}
+` + `   id=${f.finding_id}  category=${f.category}  confidence=${f.confidence}
+` + `   target : ${f.target}
+` + `   detail : ${f.detail}
+` + `   suggest: ${f.recommendation}`;
+  }).join(`
+
+`);
+  return `${head}
+
+${body}`;
+}
+
+// src/core/capsman-normalize.ts
+function yes(v) {
+  return (v ?? "").trim().toLowerCase() === "yes" || (v ?? "").trim().toLowerCase() === "true";
+}
+function num2(v) {
+  if (v == null)
+    return;
+  const n = Number.parseFloat(v.replace(/[^\d.-]/g, ""));
+  return Number.isFinite(n) ? n : undefined;
+}
+function bandFromRow(row) {
+  const b = (row.band ?? row["configuration.mode"] ?? "").toLowerCase();
+  if (b.includes("2ghz") || b.includes("2.4"))
+    return "2ghz";
+  if (b.includes("5ghz") || b.includes("5."))
+    return "5ghz";
+  const ch = num2(row.channel ?? row.frequency ?? row["channel.frequency"]);
+  if (ch != null) {
+    if (ch >= 5000 || ch >= 36 && ch <= 177)
+      return "5ghz";
+    if (ch >= 2400 && ch <= 2500 || ch >= 1 && ch <= 14)
+      return "2ghz";
+  }
+  return "unknown";
+}
+function channelOf(row) {
+  return num2(row.channel ?? row.frequency ?? row["channel.frequency"]);
+}
+function normalizeCapsmanState(raw) {
+  if (!raw)
+    return emptyCapsmanState();
+  const clientsByRadio = new Map;
+  for (const r of raw.registrations) {
+    const rid = r.interface ?? r.radio ?? r.ap ?? "";
+    if (rid)
+      clientsByRadio.set(rid, (clientsByRadio.get(rid) ?? 0) + 1);
+  }
+  const radios = raw.radios.map((row) => {
+    const cap = row["remote-cap-identity"] ?? row.identity ?? row["cap-name"] ?? row.name ?? "?";
+    const radioId = row.interface ?? row.name ?? row["radio-mac"] ?? cap;
+    const tag = parseFloorTag(`${cap} ${row.comment ?? ""}`);
+    const res = raw.resources[cap] ?? {};
+    return {
+      cap,
+      radioId,
+      band: bandFromRow(row),
+      channel: channelOf(row),
+      width: row.width ?? row["channel.width"],
+      txPower: num2(row["tx-power"] ?? row["tx-power-dbm"]),
+      clientCount: clientsByRadio.get(radioId) ?? num2(row["registered-clients"]) ?? 0,
+      floor: tag.floor,
+      zone: tag.zone,
+      cpuLoad: res.cpuLoad,
+      memUsedPct: res.memUsedPct
+    };
+  });
+  const radioBand = new Map(radios.map((r) => [r.radioId, r.band]));
+  const clients = raw.registrations.map((r) => {
+    const radioId = r.interface ?? r.radio ?? r.ap ?? "";
+    return {
+      mac: r["mac-address"] ?? r.mac ?? "?",
+      radioId,
+      signal: num2(r.signal ?? r["signal-strength"] ?? r["rx-signal"]) ?? -100,
+      band: radioBand.get(radioId) ?? "unknown",
+      txRate: r["tx-rate"],
+      rxRate: r["rx-rate"],
+      uptime: r.uptime,
+      seenOn: undefined
+    };
+  });
+  const securityConfigs = raw.securityConfigs.map((c) => ({
+    name: c.name ?? "?",
+    ssid: c.ssid ?? c["configuration.ssid"],
+    ft: yes(c.ft),
+    ftOverDs: yes(c["ft-over-ds"]),
+    ftMobilityDomain: c["ft-mobility-domain"] || undefined,
+    rrm: yes(c.rrm ?? c["steering.rrm"]),
+    wnm: yes(c.wnm ?? c["steering.wnm"])
+  }));
+  const accessList = (raw.accessList ?? []).map((e) => ({
+    macAddress: e["mac-address"] ?? e.mac,
+    interface: e.interface,
+    comment: e.comment
+  }));
+  const managerEnabled = yes(raw.manager.enabled);
+  const addrs = (raw.manager["caps-man-addresses"] ?? raw.manager["caps-man-names"] ?? "").split(",").map((s) => s.trim()).filter(Boolean);
+  const managerCount = Math.max(managerEnabled ? 1 : 0, addrs.length);
+  return {
+    managerEnabled,
+    managerCount,
+    capsHaveBackupManager: addrs.length > 1,
+    requirePeerCertificate: yes(raw.manager["require-peer-certificate"]),
+    radios,
+    clients,
+    securityConfigs,
+    accessList,
+    path: raw.path
+  };
+}
+
+// src/utils/wifi-query.ts
+var WIFI_PATHS = ["/interface wifi", "/interface wifiwave2", "/interface wireless"];
+async function detectWifiPath(ctx) {
+  for (const p of WIFI_PATHS) {
+    const out = await safe(`${p} print count-only`, ctx);
+    if (out !== "" && !commandUnsupported(out)) {
+      if (p === "/interface wireless") {
+        const caps2 = await safe("/caps-man manager print", ctx);
+        if (caps2 !== "" && !commandUnsupported(caps2))
+          return "/caps-man";
+      }
+      return p;
+    }
+  }
+  const caps = await safe("/caps-man manager print", ctx);
+  if (caps !== "" && !commandUnsupported(caps))
+    return "/caps-man";
+  return null;
+}
+async function fetchCapsmanState(ctx) {
+  const path = await detectWifiPath(ctx);
+  if (!path)
+    return normalizeCapsmanState(null);
+  const isCapsman = path === "/caps-man";
+  const [manager, remoteCaps, radios, registrations, securityConfigs, accessList] = await Promise.all([
+    fetchKv(isCapsman ? "/caps-man manager print" : `${path} capsman print`, ctx),
+    fetchRows(isCapsman ? "/caps-man remote-cap print detail" : `${path} capsman remote-cap print detail`, ctx),
+    fetchRows(isCapsman ? "/caps-man radio print detail" : `${path} radio print detail`, ctx),
+    fetchRows(isCapsman ? "/caps-man registration-table print detail" : `${path} registration-table print detail`, ctx),
+    fetchRows(isCapsman ? "/caps-man security print detail" : `${path} security print detail`, ctx),
+    fetchRows(isCapsman ? "/caps-man access-list print detail" : `${path} access-list print detail`, ctx)
+  ]);
+  const raw = {
+    path,
+    manager,
+    remoteCaps,
+    radios,
+    registrations,
+    securityConfigs,
+    accessList,
+    resources: {}
+  };
+  return normalizeCapsmanState(raw);
+}
+
+// src/tools/capsman.ts
+async function applyCapsman(ctx, device, commands, label) {
+  if (commands.length === 0)
+    return "Nothing to apply \u2014 already in the desired state (idempotent no-op).";
+  const snapshotId = await captureSnapshot(ctx, label);
+  const outcome = await applyWritesSafely(ctx, device, commands, { allowDirectFallback: false });
+  const lines = [
+    `CAPsMAN APPLY \u2014 snapshot=${snapshotId}  safe-mode=${outcome.safeMode}`,
+    `Applied ${outcome.applied}/${outcome.total} command(s).`,
+    ...outcome.error ? [`FAILED: ${outcome.error}`] : [],
+    "",
+    ...commands.map((c) => `  ${c}`),
+    "",
+    `Roll back with: diff_config_snapshots from=${snapshotId} to=live`
+  ];
+  return lines.join(`
+`);
+}
+var weakDbm = z125.number().int().max(-1).optional().describe(`Weak-signal threshold in dBm (negative; default ${DEFAULT_WEAK_DBM}).`);
+async function auditOne(ctx, category, opts = {}) {
+  const device = resolveDeviceName(ctx.device);
+  const state = await fetchCapsmanState(ctx);
+  const report = runCapsmanAudit(state, { categories: [category], weakDbm: opts.weakDbm });
+  return renderCapsmanReport(report, device);
+}
+var capsmanTools = [
+  defineTool({
+    name: "run_capsman_audit",
+    title: "Run CAPsMAN Audit",
+    annotations: READ,
+    description: "Read-only. Audits the device's CAPsMAN Wi-Fi fabric across coverage/co-channel, weak-signal " + "clients, resource-aware load, 802.11r (FT) roaming, and HA (backup-manager) redundancy \u2014 one " + "severity-ranked report with per-finding id, severity and confidence (proven vs " + "needs_live_verification; steering/balancing are advisory since RouterOS has no force-move). " + "Supports both the v7 `/interface wifi` CAPsMAN and legacy `/caps-man`. Narrow with `categories`. " + "For a single dimension use audit_capsman_coverage / report_weak_signal_clients / " + "audit_capsman_load / audit_capsman_ft / audit_capsman_ha.",
+    inputSchema: {
+      categories: z125.array(z125.enum(["coverage", "weak_signal", "load", "ft", "ha"])).optional().describe("Narrow to specific categories. Omit to audit all five."),
+      weak_dbm: weakDbm
+    },
+    async handler(a, ctx) {
+      const device = resolveDeviceName(ctx.device);
+      ctx.info(`[${device}] run_capsman_audit`);
+      const state = await fetchCapsmanState(ctx);
+      const report = runCapsmanAudit(state, {
+        categories: a.categories,
+        weakDbm: a.weak_dbm
+      });
+      return renderCapsmanReport(report, device);
+    }
+  }),
+  defineTool({
+    name: "audit_capsman_coverage",
+    title: "Audit CAPsMAN Coverage & Channels",
+    annotations: READ,
+    description: "Read-only. Inventories every managed CAP radio (band, manual channel/width, tx-power, client " + "count), detects CO-CHANNEL overlap between physically-adjacent radios (adjacency inferred from " + "clients seen on more than one radio), and proposes a non-overlapping manual channel plan " + "(2.4 GHz \u2192 1/6/11; 5 GHz DFS-aware). Preview only \u2014 apply is a later, confirm-gated tool.",
+    async handler(_a, ctx) {
+      const device = resolveDeviceName(ctx.device);
+      ctx.info(`[${device}] audit_capsman_coverage`);
+      const state = await fetchCapsmanState(ctx);
+      const report = runCapsmanAudit(state, { categories: ["coverage"] });
+      const plan = proposeChannelPlan(state);
+      const planLines = [...plan.entries()].map(([rid, ch]) => {
+        const r = state.radios.find((radio) => radio.radioId === rid);
+        return `  ${r?.cap ?? "?"}/${rid} (${r?.band ?? "?"}) \u2192 channel ${ch}`;
+      }).join(`
+`);
+      return renderCapsmanReport(report, device) + (planLines ? `
+
+PROPOSED MANUAL CHANNEL PLAN (preview):
+${planLines}` : "");
+    }
+  }),
+  defineTool({
+    name: "report_weak_signal_clients",
+    title: "Report Weak-Signal Clients",
+    annotations: READ,
+    description: "Read-only. Merges every CAP's registration-table and lists clients below the weak-signal " + "threshold (default -70 dBm), each with its current AP, signal, band, and \u2014 when a neighbor " + "radio hears it meaningfully stronger \u2014 the recommended AP to steer toward and the dB gain. " + "Steering itself is a later, confirm-gated tool (soft 802.11k/v or hard signal-range).",
+    inputSchema: { weak_dbm: weakDbm },
+    async handler(a, ctx) {
+      const device = resolveDeviceName(ctx.device);
+      ctx.info(`[${device}] report_weak_signal_clients`);
+      const state = await fetchCapsmanState(ctx);
+      const weak = reportWeakClients(state, a.weak_dbm ?? DEFAULT_WEAK_DBM);
+      if (weak.length === 0) {
+        return `WEAK-SIGNAL CLIENTS \u2014 ${device}
+
+None below ${a.weak_dbm ?? DEFAULT_WEAK_DBM} dBm. \u2713`;
+      }
+      const lines = weak.map((w) => `  ${w.mac}  ${w.signal} dBm  ${w.band}  on ${w.currentCap}${w.recommendCap ? `  \u2192 steer to ${w.recommendCap} (+${w.gainDb} dB)` : "  (coverage gap)"}`).join(`
+`);
+      return `WEAK-SIGNAL CLIENTS \u2014 ${device} (${weak.length} below ${a.weak_dbm ?? DEFAULT_WEAK_DBM} dBm):
+
+${lines}`;
+    }
+  }),
+  defineTool({
+    name: "audit_capsman_load",
+    title: "Audit CAPsMAN Load & Resources",
+    annotations: READ,
+    description: "Read-only. Reports per-radio client load and the owning CAP's CPU/mem, flags overloaded or " + "resource-constrained radios that have an adjacent radio with spare capacity, and recommends " + "a resource-aware rebalance (offload toward the idle neighbor; steer dual-band clients to 5 GHz). " + "Advisory \u2014 apply is a later, confirm-gated tool.",
+    async handler(_a, ctx) {
+      return auditOne(ctx, "load");
+    }
+  }),
+  defineTool({
+    name: "audit_capsman_ft",
+    title: "Audit CAPsMAN Fast-Roaming (802.11r)",
+    annotations: READ,
+    description: "Read-only. Checks 802.11r fast-transition per SSID: is `ft` enabled, is 802.11k/v steering on, " + "and is the `ft-mobility-domain` CONSISTENT across all CAPs (fast roaming only works within one " + "domain). Reports roam-readiness. Enabling FT is a later, confirm-gated tool.",
+    async handler(_a, ctx) {
+      return auditOne(ctx, "ft");
+    }
+  }),
+  defineTool({
+    name: "audit_capsman_ha",
+    title: "Audit CAPsMAN High-Availability",
+    annotations: READ,
+    description: "Read-only. Checks CAPsMAN redundancy: is there a backup manager, are the CAPs pointed at both " + "managers, and is require-peer-certificate on? Flags single points of failure (one manager = the " + "whole building's Wi-Fi drops if it reboots). Setting up HA is a later, confirm-gated tool.",
+    async handler(_a, ctx) {
+      return auditOne(ctx, "ha");
+    }
+  }),
+  defineTool({
+    name: "steer_client",
+    title: "Steer a Weak-Signal Client",
+    annotations: DANGEROUS,
+    description: "Steers ONE weak client toward a better AP. `mode=hard` installs an access-list signal-range " + "REJECT on the client's current radio so it re-associates on a neighbor it hears stronger (can " + "briefly disconnect it). `mode=soft` is 802.11k/v-only and installs no rule (advisory \u2014 enable " + "steering via enable_capsman_ft). ADVISORY: RouterOS has no force-move, so the client ultimately " + "decides. DRY RUN unless confirm=true. Snapshots first and applies inside Safe Mode (auto-revert " + "on lockout). Idempotent \u2014 a re-run for the same MAC adds nothing.",
+    inputSchema: {
+      mac: z125.string().min(1).describe("Client MAC address to steer."),
+      mode: z125.enum(["soft", "hard"]).default("hard").describe("hard = signal-range reject; soft = k/v only (no write)."),
+      reject_above_dbm: z125.number().int().max(-1).optional().describe(`dBm ceiling of the reject band for hard mode (default ${DEFAULT_WEAK_DBM}).`),
+      confirm: z125.literal(true).optional().describe("Must be true to write; omit for a dry-run preview.")
+    },
+    async handler(a, ctx) {
+      const device = resolveDeviceName(ctx.device);
+      const state = await fetchCapsmanState(ctx);
+      const client = state.clients.find((c) => c.mac.toLowerCase() === a.mac.toLowerCase());
+      if (!client)
+        return `Client ${a.mac} is not currently associated to any managed radio.`;
+      if (steerAlreadyPresent(state, a.mac)) {
+        return `A steer rule for ${a.mac} already exists (idempotent no-op). Remove it manually to change.`;
+      }
+      const commands = buildSteerCommands(state, a.mac, client.radioId, a.mode, a.reject_above_dbm);
+      if (a.mode === "soft") {
+        return `Soft steer is advisory-only (802.11k/v hints) \u2014 no access-list rule written. Ensure 802.11k/v is enabled with enable_capsman_ft, then the client roams on its own. Current signal ${client.signal} dBm on ${client.radioId}.`;
+      }
+      if (!a.confirm) {
+        return `DRY RUN \u2014 steer ${a.mac} (${a.mode}); set confirm=true to apply:
+
+${commands.map((c) => `  ${c}`).join(`
+`)}`;
+      }
+      return applyCapsman(ctx, device, commands, `pre-steer_client-${a.mac}`);
+    }
+  }),
+  defineTool({
+    name: "apply_capsman_load_balance",
+    title: "Apply CAPsMAN Load Balance",
+    annotations: DANGEROUS,
+    description: "Applies a resource-aware rebalance: for each overloaded / CPU-constrained radio that has an " + "adjacent radio with spare capacity, installs a connect-priority nudge so NEW clients prefer the " + "idle neighbor (gentle \u2014 does not disconnect existing clients). ADVISORY. DRY RUN unless " + "confirm=true. Snapshots first, applies inside Safe Mode. Idempotent. Preview the plan with " + "audit_capsman_load first.",
+    inputSchema: {
+      confirm: z125.literal(true).optional().describe("Must be true to write; omit for a dry-run preview.")
+    },
+    async handler(a, ctx) {
+      const device = resolveDeviceName(ctx.device);
+      const state = await fetchCapsmanState(ctx);
+      const plan = loadBalancePlan(state);
+      if (plan.length === 0)
+        return "No rebalance needed \u2014 no overloaded radio has an idle adjacent neighbor.";
+      const commands = buildLoadBalanceCommands(state, plan);
+      if (commands.length === 0)
+        return "Load-balance rules already present (idempotent no-op).";
+      const preview = plan.map((p) => `  ${p.cap}/${p.radioId} \u2192 offload toward ${p.targetCap}/${p.targetRadioId}`).join(`
+`);
+      if (!a.confirm) {
+        return `DRY RUN \u2014 load-balance plan (set confirm=true to apply):
+${preview}
+
+Commands:
+${commands.map((c) => `  ${c}`).join(`
+`)}`;
+      }
+      return applyCapsman(ctx, device, commands, "pre-apply_capsman_load_balance");
+    }
+  }),
+  defineTool({
+    name: "apply_capsman_channel_plan",
+    title: "Apply CAPsMAN Channel Plan",
+    annotations: DANGEROUS,
+    description: "Applies the proposed non-overlapping manual channel plan (from audit_capsman_coverage) to the " + "managed radios by setting each radio's frequency \u2014 resolving co-channel conflicts. Optionally " + "scope to specific radios with `radio_ids`. DRY RUN unless confirm=true. Snapshots first, applies " + "inside Safe Mode; idempotent (radios already on the target channel are skipped). v7 " + "`/interface wifi` only \u2014 on legacy `/caps-man` the channel lives in named channel objects, so " + "edit those manually (the audit still shows the plan).",
+    inputSchema: {
+      radio_ids: z125.array(z125.string()).optional().describe("Only re-channel these radio ids. Omit to apply the whole plan."),
+      confirm: z125.literal(true).optional().describe("Must be true to write; omit for a dry-run preview.")
+    },
+    async handler(a, ctx) {
+      const device = resolveDeviceName(ctx.device);
+      const state = await fetchCapsmanState(ctx);
+      if (state.path === "/caps-man") {
+        return "Channel-plan apply targets v7 /interface wifi. This device uses legacy /caps-man \u2014 edit the /caps-man channel objects manually; audit_capsman_coverage shows the proposed plan.";
+      }
+      const only = a.radio_ids ? new Set(a.radio_ids) : undefined;
+      const commands = buildChannelPlanCommands(state, only);
+      if (commands.length === 0)
+        return "No channel changes needed \u2014 every radio is already on its proposed channel (idempotent no-op).";
+      if (!a.confirm) {
+        return `DRY RUN \u2014 channel plan (set confirm=true to apply):
+
+${commands.map((c) => `  ${c}`).join(`
+`)}`;
+      }
+      return applyCapsman(ctx, device, commands, "pre-apply_capsman_channel_plan");
+    }
+  }),
+  defineTool({
+    name: "enable_capsman_ft",
+    title: "Enable CAPsMAN Fast-Roaming (802.11r)",
+    annotations: DANGEROUS,
+    description: "Enables 802.11r fast-transition on the CAPsMAN security configs, converging every one on a " + "SINGLE shared `ft-mobility-domain` (so roaming between floors is seamless and consistent) \u2014 " + "fixing the ft-off and ft-domain-mismatch findings. Scope with `config_names`; set the domain " + "with `mobility_domain` (default: the existing domain, else 0001). Note: enabling FT changes the " + "SSID's roaming behaviour and briefly re-keys clients. DRY RUN unless confirm=true. Snapshots " + "first, applies inside Safe Mode; idempotent. 802.11k/v steering is configured separately.",
+    inputSchema: {
+      config_names: z125.array(z125.string()).optional().describe("Only enable FT on these security configs. Omit for all."),
+      mobility_domain: z125.string().optional().describe("Shared ft-mobility-domain to converge on. Omit to adopt the existing one (or 0001)."),
+      confirm: z125.literal(true).optional().describe("Must be true to write; omit for a dry-run preview.")
+    },
+    async handler(a, ctx) {
+      const device = resolveDeviceName(ctx.device);
+      const state = await fetchCapsmanState(ctx);
+      if (state.securityConfigs.length === 0) {
+        return "No CAPsMAN security configs found \u2014 nothing to enable FT on.";
+      }
+      const commands = buildFtCommands(state, {
+        configNames: a.config_names,
+        mobilityDomain: a.mobility_domain
+      });
+      if (commands.length === 0) {
+        return `FT already enabled and consistent (mobility-domain=${resolveMobilityDomain(state, a.mobility_domain)}). Idempotent no-op.`;
+      }
+      if (!a.confirm) {
+        return `DRY RUN \u2014 enable FT (set confirm=true to apply):
+
+${commands.map((c) => `  ${c}`).join(`
+`)}`;
+      }
+      return applyCapsman(ctx, device, commands, "pre-enable_capsman_ft");
+    }
+  }),
+  defineTool({
+    name: "setup_capsman_ha",
+    title: "Set Up CAPsMAN High-Availability",
+    annotations: DANGEROUS,
+    description: "Hardens CAPsMAN redundancy. Applies what THIS manager can safely do \u2014 enable " + "require-peer-certificate (so a rogue manager can't adopt your CAPs) \u2014 and returns the exact " + "manual, multi-device steps to finish HA (stand up a second manager with the same certificate, " + "point every CAP at both managers). Standing up the backup + editing each CAP is inherently " + "multi-device, so it is NOT auto-applied. HIGHEST blast radius \u2014 DRY RUN unless confirm=true; " + "snapshots first, applies inside Safe Mode. Requires a `reason`.",
+    inputSchema: {
+      backup_manager_address: z125.string().optional().describe("Address of the (planned) backup manager, woven into the guidance."),
+      confirm: z125.literal(true).optional().describe("Must be true to write; omit for a dry-run preview.")
+    },
+    async handler(a, ctx) {
+      const device = resolveDeviceName(ctx.device);
+      const state = await fetchCapsmanState(ctx);
+      if (!state.managerEnabled)
+        return "This device is not a CAPsMAN manager \u2014 HA setup does not apply.";
+      const commands = buildHaCommands(state);
+      const guidance = haGuidance(state, a.backup_manager_address);
+      const guide = `
+
+MANUAL STEPS TO COMPLETE HA (multi-device \u2014 not auto-applied):
+${guidance.map((g) => `  \u2022 ${g}`).join(`
+`)}`;
+      if (commands.length === 0) {
+        return `require-peer-certificate is already enabled on this manager.${guide}`;
+      }
+      if (!a.confirm) {
+        return `DRY RUN \u2014 HA hardening on this manager (set confirm=true to apply):
+
+${commands.map((c) => `  ${c}`).join(`
+`)}${guide}`;
+      }
+      return await applyCapsman(ctx, device, commands, "pre-setup_capsman_ha") + guide;
+    }
+  }),
+  defineTool({
+    name: "apply_capsman_fixes",
+    title: "Apply CAPsMAN Fixes",
+    annotations: DANGEROUS,
+    description: "Applies specific finding_ids from a prior run_capsman_audit, dispatching each to its remediation " + "in a SAFE order (coverage/channel-plan \u2192 load-balance \u2192 steer \u2192 FT \u2192 HA), all wrapped in ONE " + "snapshot + ONE Safe-Mode session. Returns the applied commands + snapshot id. DRY RUN unless " + "confirm=true. NEVER a blanket 'fix everything' \u2014 pass explicit finding_ids from an audit. " + "Steering/balancing remain advisory; HA require-cert is applied but the multi-device HA steps are not.",
+    inputSchema: {
+      finding_ids: z125.array(z125.string()).min(1).describe("Explicit finding_id(s) from a prior run_capsman_audit. No blanket apply."),
+      confirm: z125.literal(true).optional().describe("Must be true to write; omit for a dry-run preview.")
+    },
+    async handler(a, ctx) {
+      const device = resolveDeviceName(ctx.device);
+      const state = await fetchCapsmanState(ctx);
+      const commands = buildFixPlan(state, a.finding_ids);
+      if (commands.length === 0) {
+        return "No applicable automated fix for those finding_ids (already fixed, or manual-only like the HA multi-device steps).";
+      }
+      if (!a.confirm) {
+        return `DRY RUN \u2014 ${commands.length} command(s) in safe order (set confirm=true to apply):
+
+${commands.map((c) => `  ${c}`).join(`
+`)}`;
+      }
+      return applyCapsman(ctx, device, commands, "pre-apply_capsman_fixes");
+    }
+  })
+];
+
+// src/tools/memory.ts
+import { z as z126 } from "zod";
+var EntityInput = z126.object({
+  name: z126.string().describe("Unique name of the entity"),
+  entityType: z126.string().describe("Type/category of the entity (e.g. 'router', 'subnet', 'person')"),
+  observations: z126.array(z126.string()).optional().describe("Initial observations (facts) to attach")
 });
-var RelationInput = z125.object({
-  from: z125.string().describe("Source entity name"),
-  to: z125.string().describe("Target entity name"),
-  relationType: z125.string().describe("Relation type in active voice (e.g. 'manages', 'connects_to', 'depends_on')")
+var RelationInput = z126.object({
+  from: z126.string().describe("Source entity name"),
+  to: z126.string().describe("Target entity name"),
+  relationType: z126.string().describe("Relation type in active voice (e.g. 'manages', 'connects_to', 'depends_on')")
 });
 var memoryTools = [
   defineTool({
@@ -30990,7 +31936,7 @@ var memoryTools = [
     annotations: WRITE,
     description: "Create one or more new entities in the persistent knowledge graph. Each entity has a " + "unique name, a type (e.g. 'router', 'subnet', 'vlan', 'person', 'config_pattern'), " + "and optional initial observations. Entities that already exist are silently skipped. " + "Use this to record things the AI learns about the network, devices, users, or patterns.",
     inputSchema: {
-      entities: z125.array(EntityInput).min(1).describe("Entities to create")
+      entities: z126.array(EntityInput).min(1).describe("Entities to create")
     },
     async handler(args) {
       const store3 = await getMemoryStore();
@@ -31008,7 +31954,7 @@ ${created.map((e) => `  - ${e.name} (${e.entityType})`).join(`
     annotations: WRITE,
     description: "Create directed relations between existing entities in the knowledge graph. Both " + "endpoint entities must already exist. Use active voice for relation types (e.g. " + "'manages', 'connects_to', 'provides_dhcp_for', 'part_of'). Duplicate relations " + "are silently skipped.",
     inputSchema: {
-      relations: z125.array(RelationInput).min(1).describe("Relations to create")
+      relations: z126.array(RelationInput).min(1).describe("Relations to create")
     },
     async handler(args) {
       const store3 = await getMemoryStore();
@@ -31026,9 +31972,9 @@ ${created.map((r) => `  - ${r.from} --[${r.relationType}]--> ${r.to}`).join(`
     annotations: WRITE,
     description: "Add new observations (discrete facts) to existing entities in the knowledge graph. " + "Each observation is a string (e.g. 'runs RouterOS 7.16', 'has 4 ether ports', " + "'managed by John'). Duplicate observations on the same entity are silently skipped. " + "The entity must already exist.",
     inputSchema: {
-      observations: z125.array(z125.object({
-        entityName: z125.string().describe("Name of the existing entity"),
-        contents: z125.array(z125.string()).min(1).describe("Observations to add")
+      observations: z126.array(z126.object({
+        entityName: z126.string().describe("Name of the existing entity"),
+        contents: z126.array(z126.string()).min(1).describe("Observations to add")
       })).min(1)
     },
     async handler(args) {
@@ -31048,7 +31994,7 @@ ${lines.join(`
     annotations: DESTRUCTIVE,
     description: "Remove entities from the knowledge graph. This also deletes all their observations " + "and any relations where they appear as an endpoint (cascade delete).",
     inputSchema: {
-      entityNames: z125.array(z125.string()).min(1).describe("Names of entities to delete")
+      entityNames: z126.array(z126.string()).min(1).describe("Names of entities to delete")
     },
     async handler(args) {
       const store3 = await getMemoryStore();
@@ -31062,9 +32008,9 @@ ${lines.join(`
     annotations: DESTRUCTIVE,
     description: "Remove specific observations from entities in the knowledge graph. The entity " + "itself is kept; only the named observation strings are removed.",
     inputSchema: {
-      deletions: z125.array(z125.object({
-        entityName: z125.string().describe("Entity to remove observations from"),
-        observations: z125.array(z125.string()).min(1).describe("Exact observation strings to delete")
+      deletions: z126.array(z126.object({
+        entityName: z126.string().describe("Entity to remove observations from"),
+        observations: z126.array(z126.string()).min(1).describe("Exact observation strings to delete")
       })).min(1)
     },
     async handler(args) {
@@ -31079,7 +32025,7 @@ ${lines.join(`
     annotations: DESTRUCTIVE,
     description: "Remove specific relations from the knowledge graph. Each relation is identified " + "by its (from, to, relationType) triple.",
     inputSchema: {
-      relations: z125.array(RelationInput).min(1).describe("Relations to delete")
+      relations: z126.array(RelationInput).min(1).describe("Relations to delete")
     },
     async handler(args) {
       const store3 = await getMemoryStore();
@@ -31107,8 +32053,8 @@ ${lines.join(`
     annotations: READ,
     description: "Search for entities in the knowledge graph by name, type, or observation content. " + "Returns matching entities with their observations, plus any relations where at " + "least one endpoint is in the result set.",
     inputSchema: {
-      query: z125.string().describe("Search term \u2014 matched against entity names, types, and observation content"),
-      limit: z125.number().int().positive().optional().describe("Max entities to return (default 50)")
+      query: z126.string().describe("Search term \u2014 matched against entity names, types, and observation content"),
+      limit: z126.number().int().positive().optional().describe("Max entities to return (default 50)")
     },
     async handler(args) {
       const store3 = await getMemoryStore();
@@ -31124,7 +32070,7 @@ ${lines.join(`
     annotations: READ,
     description: "Retrieve specific entities by exact name from the knowledge graph, with all their " + "observations and any relations where at least one endpoint is in the requested set.",
     inputSchema: {
-      names: z125.array(z125.string()).min(1).describe("Exact entity names to retrieve")
+      names: z126.array(z126.string()).min(1).describe("Exact entity names to retrieve")
     },
     async handler(args) {
       const store3 = await getMemoryStore();
@@ -31201,6 +32147,13 @@ var moduleCatalog = [
     description: "Survey RF channel usage and tune a wireless radio to the least-congested frequency, with " + "preview-before-apply (legacy `/interface wireless`).",
     tools: wifiOptimizerTools
   },
+  {
+    label: "CAPsMAN Orchestrator",
+    slug: "capsman",
+    group: "Interfaces",
+    description: "Enterprise CAPsMAN Wi-Fi control-plane audit: coverage/co-channel, weak-signal clients + " + "neighbor steering, resource-aware load, 802.11r fast-roaming (FT) and HA redundancy \u2014 one " + "severity-ranked report (read-only; steering/apply land in later phases). Supports v7 " + "`/interface wifi` CAPsMAN and legacy `/caps-man`.",
+    tools: capsmanTools
+  },
   {
     label: "PoE",
     slug: "poe",